diff --git a/.agents/skills/wefa-vue-cookbook/SKILL.md b/.agents/skills/wefa-vue-cookbook/SKILL.md
new file mode 100644
index 00000000..8412e9c8
--- /dev/null
+++ b/.agents/skills/wefa-vue-cookbook/SKILL.md
@@ -0,0 +1,78 @@
+---
+name: wefa-vue-cookbook
+description: Shared cookbook of conventions for writing Vue code with the WeFa ecosystem. Use it first in product apps that consume `@nside/wefa`, and also use it inside the WeFa `vue/` package for the shared rules that apply there too. It covers architecture and layout conventions, WeFa versus PrimeVue reuse decisions, i18n expectations, validation planning, and TanStack Query Vue v5 usage including wrapper choice, query keys, invalidation, optimistic updates, and v5 migration pitfalls.
+---
+
+# WeFa Vue Cookbook
+
+This is the shared Vue skill for WeFa.
+
+Use it in two situations:
+
+1. In consuming Vue projects that use `@nside/wefa`.
+2. Inside the WeFa `vue/` package for the shared conventions that also apply to the library itself.
+
+When the task is inside the WeFa `vue/` package, pair this skill with `wefa-vue-frontend`, which is the maintainer skill for repo-specific export, docs, demo, generated-artifact, and quality-gate work.
+
+Use this skill in two layers:
+
+1. Keep this `SKILL.md` loaded for the always-on rules.
+2. Load only the matching reference file when the task needs deeper checks.
+
+## Always-Loaded Rules
+
+1. Treat `@nside/wefa` as a PrimeVue superset styled through Tailwind 4 with `tailwindcss-primeui`.
+2. Follow the reuse hierarchy strictly: **WeFa component/container -> PrimeVue composition -> native HTML fallback**.
+3. Start by mirroring the nearest existing local pattern before inventing a new abstraction, prop API, fetch flow, or styling approach.
+4. Before adding helpers or infrastructure, check whether the current app, WeFa, or PrimeVue already provides the needed building block.
+5. Keep user-facing text translated through i18n keys, including labels, placeholders, validation copy, `aria-label`, and `title`.
+6. Prefer Tailwind utilities for routine styling. Use flex by default for layout, reach for grid when it clearly fits better, and do not add new CSS imports or routine `<style>` blocks.
+7. For server state, prefer `typedApiClient` when an OpenAPI-generated callable exists, then `apiClient` for straightforward URL-based GET or POST flows, then direct TanStack Query hooks only when the wrappers cannot model the behavior cleanly, then raw `axiosInstance` only for lower-level infrastructure or non-query-managed calls.
+8. TanStack Query already covers most fetch lifecycle, caching, retries, invalidation, and mutation state. Prefer built-in query and cache features over hand-rolled refs, watches, loading flags, or manual cache synchronization.
+9. Treat TanStack query data as immutable. Copy it before binding to `v-model` or mutating it locally.
+10. Put every changing query dependency into the query key, and avoid unwrapping reactive inputs too early if the query should react to them.
+11. Parent components own external layout and sizing context. Reusable children should not assume fill behavior or decorative outer chrome unless that is part of their explicit contract.
+12. When shared or public-facing behavior changes, update the surrounding tests, docs, and usage examples expected by that codebase.
+13. Run the validation commands that match the host project and the risk of the change. If working inside the WeFa repo, `wefa-vue-frontend` adds the exact repo gate.
+
+## First Reads
+
+1. Inspect how the current codebase already uses `@nside/wefa`, PrimeVue, i18n, and network helpers before introducing new patterns.
+2. If the task touches API calls, cache behavior, invalidation, optimistic updates, or direct `@tanstack/vue-query` hooks, load `references/api-calls-tanstack-query.md`.
+3. If the task is inside the WeFa repo's `vue/` package, also read `vue/AGENTS.md` and then load `wefa-vue-frontend` for maintainer-only rules.
+
+## Topic References
+
+- `references/ecosystem-map.md`
+  Load when choosing between WeFa, PrimeVue, local app code, router/plugins/stores helpers, i18n, or network layers.
+- `references/design-and-architecture.md`
+  Load when designing a new component/container/composable, choosing where code belongs, or reviewing whether code fits the intended architecture.
+- `references/css-guidelines.md`
+  Load when styling components, deciding whether CSS is allowed, or reviewing Tailwind/PrimeVue usage, flex-first layout choices, and parent/child layout ownership.
+- `references/api-calls-tanstack-query.md`
+  Load when adding or reviewing API calls, wrapper choice, startup wiring, query keys, cache behavior, invalidation, optimistic updates, or TanStack Query Vue v5 usage and migration pitfalls.
+- `references/delivery-and-validation.md`
+  Load when deciding what checks, tests, docs, or review hygiene should accompany the change.
+
+## Package Anchors
+
+- Main package import: `@nside/wefa`
+- Network helpers: `@nside/wefa/network`
+- Type exports: `@nside/wefa/types`
+
+## Repo Anchors
+
+Use these only when the task is inside the WeFa repository:
+
+- Public library entrypoints: `vue/src/lib.ts`, `vue/src/containers/index.ts`
+- Canonical public component shape: `vue/src/components/AutoroutedBreadcrumb/`
+- Translation guidance: `vue/src/locales/Translation.mdx`
+- Network guidance: `vue/src/network/network.mdx`
+
+## Definition of Done
+
+1. The implementation follows the WeFa -> PrimeVue -> native hierarchy.
+2. The chosen tool matches the highest-level fitting abstraction instead of the first thing that works.
+3. Styling stays inside the Tailwind + PrimeVue theme conventions, with parent-owned layout and intentional child fill behavior.
+4. Tests, docs, examples, and translations are updated when the changed surface requires them.
+5. The relevant validation commands for the current codebase have been run.
diff --git a/.agents/skills/wefa-vue-cookbook/agents/openai.yaml b/.agents/skills/wefa-vue-cookbook/agents/openai.yaml
new file mode 100644
index 00000000..19527495
--- /dev/null
+++ b/.agents/skills/wefa-vue-cookbook/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "WeFa Vue Cookbook"
+  short_description: "Shared WeFa Vue rules for consumers and the library"
+  default_prompt: "Use $wefa-vue-cookbook to implement or review Vue code in a consuming app that uses `@nside/wefa`, or as the shared base when working inside the WeFa `vue/` package. Apply WeFa's preferred architecture, flex-first styling, parent-owned layout rules, and TanStack Query Vue v5 conventions."
diff --git a/.agents/skills/wefa-vue-cookbook/references/api-calls-tanstack-query.md b/.agents/skills/wefa-vue-cookbook/references/api-calls-tanstack-query.md
new file mode 100644
index 00000000..58860c01
--- /dev/null
+++ b/.agents/skills/wefa-vue-cookbook/references/api-calls-tanstack-query.md
@@ -0,0 +1,139 @@
+# API Calls With TanStack Query
+
+## Purpose
+
+Use this reference when adding or reviewing API calls, wrapper choice, query configuration, cache invalidation, optimistic updates, or TanStack Query Vue v5 usage in WeFa-based Vue code.
+
+## Decision Order
+
+1. Prefer `typedApiClient` from `@nside/wefa/network` when an OpenAPI-generated callable exists.
+2. If the host app exposes a local wrapper around WeFa's network helpers, follow that local wrapper instead of bypassing it.
+3. Prefer `apiClient` for straightforward URL-based GET and POST flows.
+4. Use direct `@tanstack/vue-query` hooks only when the wrappers cannot model the needed behavior cleanly.
+5. Use `useQueryClient` whenever wrapper-backed flows still need invalidation or other cache management.
+6. Use `axiosInstance` directly only for lower-level infrastructure or non-query-managed calls.
+
+This is the preferred order for WeFa-based code. When the host project already wraps WeFa's network layer locally, keep following that local abstraction boundary.
+
+TanStack Query already provides the main building blocks for fetching, caching, reactivity, retries, invalidation, and mutation lifecycle state. Prefer those built-in features over hand-rolled refs, watches, loading flags, or manual cache synchronization.
+
+## Setup Order
+
+1. Install `VueQueryPlugin` at app startup.
+2. If the app needs non-default cache behavior, pass `queryClientConfig` or a stable `QueryClient` instance to `VueQueryPlugin`; do not create query clients inside components or composables.
+3. Configure `axiosInstance.defaults.baseURL` when env wiring is absent.
+4. Call `typedApiClient.setupOpenApiClient(client)` before using generated SDK callables.
+5. Continue app, router, i18n, feature, and backend-store setup.
+
+Do not create query clients inside components or feature composables.
+
+## Wrapper Conventions In WeFa
+
+### `apiClient.query`
+
+- Accepts a `Ref<string | undefined>`
+- Uses `[url]` as the query key
+- Suppresses fetches when the URL ref is empty
+
+### `typedApiClient.query`
+
+- Accepts a generated callable plus `Ref<TOptions | undefined>`
+- Uses `[callable.name, options]` as the query key
+- Suppresses fetches when the options ref is empty
+- Unwraps `result.data`
+
+### `typedApiClient.mutation`
+
+- Wraps generated POST/PUT/DELETE callables
+- Unwraps `result.data`
+- Throws Axios-like errors when `isAxiosError` is present
+
+Current wrapper boundaries are ref-oriented. For new direct-hook abstractions, plain values or reactive getters may still be reasonable, but do not silently change wrapper ergonomics in feature code.
+
+## Important Defaults
+
+- Cached query data is stale by default.
+- Stale queries refetch automatically on mount, window refocus, and network reconnect unless you opt out.
+- Inactive queries are garbage-collected after 5 minutes by default through `gcTime`.
+- Failed queries retry 3 times with exponential backoff by default.
+- Query results are structurally shared by default.
+
+Implication:
+
+- Set `staleTime` intentionally before disabling refetch triggers.
+- Change `gcTime`, retry behavior, or refetch policies only when the UX or API cost justifies it.
+
+## Query Workflow
+
+1. Build reactive inputs first with `ref`, `toRef`, or `computed`.
+2. Put every fetch dependency in the query key.
+3. Treat fetched data as immutable.
+4. Prefer wrapper signatures that already encode WeFa's reactive patterns:
+   `apiClient.query(refUrl)` and `typedApiClient.query(callable, refOptions)`.
+5. Use TanStack features before custom orchestration:
+   `enabled`, `select`, `placeholderData`, `staleTime`, `gcTime`, `retry`, cancellation via `signal`, and `queryOptions(...)` should usually replace watcher-based or ref-based control flow.
+6. Use `queryOptions(...)` when sharing direct-hook configuration across multiple call sites.
+7. Pass `signal` through custom direct-query functions when cancellation matters.
+
+## Mutation Workflow
+
+1. Start with wrapper mutations unless there is a concrete gap.
+2. After success, prefer one of two cache-update paths:
+   invalidate related queries with `useQueryClient().invalidateQueries(...)`, or
+   write returned entity data into the cache with `setQueryData(...)` only when you own the exact key shape or a direct-hook abstraction exposes it clearly.
+3. Await invalidation when the UI should remain pending until related queries refresh.
+4. Use optimistic updates only when the UX benefit clearly justifies rollback complexity; pair them with `onMutate`, rollback context, and targeted invalidation.
+5. Prefer `useMutation` lifecycle hooks and cache APIs over custom pending, error, or success state machines.
+
+## v5 Migration Checks
+
+- Use the single-object hook signature, not older positional overloads.
+- Do not add `onSuccess`, `onError`, or `onSettled` to query options; those query callbacks were removed in v5.
+- Use `gcTime` instead of `cacheTime`.
+- Use `throwOnError` instead of `useErrorBoundary`.
+- Replace old `keepPreviousData` patterns with `placeholderData`.
+- Infinite queries need `initialPageParam` and `getNextPageParam`.
+- `useQueries` returns a `ref` wrapping the array, not a reactive array directly.
+- Mutation loading state is `isPending`, not the older `isLoading`.
+
+## Review Checklist
+
+1. Did the code use the highest-level fitting abstraction?
+2. Are the query keys complete and stable?
+3. Was reactivity preserved, or did the code unwrap `.value` too early?
+4. Were `staleTime`, `gcTime`, retries, and refetch triggers chosen intentionally?
+5. Are the semantics v5-correct:
+   `gcTime` instead of `cacheTime`, `throwOnError` instead of `useErrorBoundary`, and `placeholderData` instead of old `keepPreviousData` patterns?
+6. Did the implementation avoid common pre-v5 patterns such as positional hook overloads, query callbacks, or infinite queries without `initialPageParam`?
+7. Did the implementation use TanStack features that already exist instead of rebuilding fetch state, caching, or mutation bookkeeping manually?
+
+## Testing Boundaries
+
+### Wrapper tests
+
+- Location: wherever the host project keeps network-wrapper tests
+- Pattern: mock `@tanstack/vue-query` directly and assert wrapper configuration
+
+### Feature tests
+
+- Pattern: mock the host project's network wrapper unless the feature truly owns direct TanStack configuration
+- Goal: test feature behavior against the wrapper contract, not TanStack internals
+
+## Inside The WeFa Repo
+
+Use this section only when the task is inside the WeFa repository itself.
+
+- Concrete startup reference: `vue/src/demo/main.ts`
+- Network guidance: `vue/src/network/network.mdx`
+- Wrapper test location: `vue/src/network/__tests__/`
+- Keep repo docs in sync:
+  `vue/README.md` when consumer setup changes,
+  `vue/CONTRIBUTE.md` when validation expectations change,
+  `vue/AGENTS.md` and the repo-root `AGENTS.md` when skill-routing guidance changes
+
+## Smell Checks
+
+- Raw axios used in a normal query flow that wrappers already support
+- Manual cache writes without owning the key shape
+- Query keys missing a dependency used by `queryFn`
+- Query data mutated directly in component state
diff --git a/.agents/skills/wefa-vue-cookbook/references/css-guidelines.md b/.agents/skills/wefa-vue-cookbook/references/css-guidelines.md
new file mode 100644
index 00000000..8d993678
--- /dev/null
+++ b/.agents/skills/wefa-vue-cookbook/references/css-guidelines.md
@@ -0,0 +1,66 @@
+# CSS Guidelines
+
+## Purpose
+
+Use this reference when styling WeFa-based Vue code or reviewing whether a styling approach fits WeFa conventions.
+
+## Default Styling Stack
+
+1. Tailwind 4 utilities
+2. `tailwindcss-primeui`
+3. PrimeVue theming and component APIs
+4. Scoped styles only as an explicit escape hatch
+
+The default expectation is utility-first styling, not custom CSS-first styling.
+
+## Rules
+
+1. Prefer Tailwind utility classes for layout, spacing, typography, colors, and responsive behavior.
+2. Do not add new CSS imports or routine `<style>` blocks for normal component work.
+3. Use flex by default for layout. Reach for grid when two-dimensional track control, explicit row or column alignment, or track-based sizing clearly makes it the better fit.
+4. Reach for PrimeVue props, slots, and pass-through customization before DOM or CSS hacks.
+5. Use scoped styles or bound style objects only when the existing local pattern already needs them or when Tailwind cannot express the requirement cleanly, such as layout math, chart sizing, or library-specific rendering constraints.
+6. Keep theme ownership centralized:
+   rely on the established app or library theme entrypoints instead of introducing ad-hoc fonts, color systems, or resets inside components.
+
+## Layout Ownership
+
+- The parent owns external layout:
+  available space, flex or grid participation, sibling spacing, and container padding.
+- The child owns internal layout:
+  content arrangement, internal spacing, and the minimum size required by its own UI.
+- The parent should usually control whether children participate in layout at all, for example with parent-owned `v-if` or `v-show` driven by parent props or parent state. Once rendered, the child may still control its own internal visual state.
+- Reusable children should not default to `h-full` or `w-full` unless fill behavior is part of their explicit contract.
+- If a child is meant to fill available space, the parent should establish that sizing context on the relevant axis and pass fill behavior intentionally through classes, slots, or an explicit child API.
+- Do not assume `h-full` works by default:
+  use it only when the parent chain makes height resolvable.
+- Prefer layout-driven sizing through flex, grid, and min/max constraints over fixed `h-*` or `w-*` values. Use fixed sizes sparingly.
+- For parent/child layout interfaces, prefer parent-owned `gap`, padding, and placement rules over child margins or offsets when expressing layout between siblings.
+- Reusable children should usually avoid defining decorative backgrounds, borders, shadows, or similar chrome at the outer interface level. The only exception is if it serves a clearly defined purpose (e.g a red background for an error status).
+
+## Practical Heuristics
+
+- Prefer existing Tailwind scale tokens before arbitrary values.
+- If a class list is growing because the component is doing too much, review the component structure before extracting CSS.
+- If the styling problem comes from the underlying PrimeVue component, first inspect whether PrimeVue props or pass-through APIs already solve it.
+
+## Repo-Specific Anchors
+
+- Theme exports: `vue/src/theme/index.ts`, `vue/src/theme/nside.ts`
+- Shared CSS entrypoint: `vue/src/assets/main.css`
+- Markdown-to-Tailwind utility mapping: `vue/src/utils/markdown.ts`
+
+## When CSS Is Justified
+
+Scoped CSS is justified when all of the following are true:
+
+1. Tailwind or PrimeVue APIs cannot express the requirement cleanly.
+2. The styling is local to the component.
+3. The nearest existing pattern uses the same escape hatch or the need is clearly technical rather than stylistic.
+
+## Smell Checks
+
+- New stylesheet added for routine spacing or color tweaks
+- Component-level font imports or theme definitions
+- Native CSS overrides used before checking PrimeVue theming options
+- Large custom style blocks where Tailwind classes would have been clearer
diff --git a/.agents/skills/wefa-vue-cookbook/references/delivery-and-validation.md b/.agents/skills/wefa-vue-cookbook/references/delivery-and-validation.md
new file mode 100644
index 00000000..845d91f2
--- /dev/null
+++ b/.agents/skills/wefa-vue-cookbook/references/delivery-and-validation.md
@@ -0,0 +1,33 @@
+# Delivery And Validation
+
+## Purpose
+
+Use this reference when deciding what checks, documentation, and review hygiene should accompany a WeFa-based change.
+
+## Core Rule
+
+The validation should match the risk and the host codebase.
+
+- Small presentational change: lint, type-check, focused tests
+- Shared component or composable change: broader unit coverage and affected usage examples
+- Routing or integration change: add the relevant browser or e2e checks
+- Public API or package-surface change: verify the published usage path, not only local internals
+
+## Delivery Checklist
+
+1. Update or add tests for the changed behavior, not only the happy path.
+2. Update the nearest docs, examples, or stories when the usage surface changed.
+3. Verify translations for any new user-facing copy.
+4. Confirm the abstraction choice still matches the WeFa -> PrimeVue -> native order.
+5. Run the validation commands that the current project expects.
+
+## Review Prompts
+
+- Did the code choose the right abstraction layer?
+- Did it preserve existing conventions instead of introducing a parallel pattern?
+- Did it validate the behavior at the layer where users will actually feel the change?
+- Did it update surrounding guidance, examples, or tests when the surface changed?
+
+## WeFa Repo Note
+
+If the task is inside the WeFa repository itself, load `wefa-vue-frontend` for the exact repo quality gate, Storybook/MDX expectations, export wiring, demo wiring, and review workflow.
diff --git a/.agents/skills/wefa-vue-cookbook/references/design-and-architecture.md b/.agents/skills/wefa-vue-cookbook/references/design-and-architecture.md
new file mode 100644
index 00000000..32a7ece2
--- /dev/null
+++ b/.agents/skills/wefa-vue-cookbook/references/design-and-architecture.md
@@ -0,0 +1,88 @@
+# Design And Architecture
+
+## Purpose
+
+Use this reference when shaping new Vue features, reviewing architectural fit, or deciding where code belongs in a WeFa-based codebase.
+
+## SFC structure
+
+Use the following as the recommended SFC organization order. If the host project already has a strong local pattern, keep that pattern, but still split each concern with short comment delimiters inside the SFC.
+
+- Top-level block order should follow the host project rules.
+  The default order is `template -> script -> style`.
+- Inside `script setup lang="ts"`, the recommended concern order is:
+  - imports
+  - hardcoded constants
+  - reference state: props and their types, `v-model`s, router params, and the refs that define the base state of the SFC
+  - emits and `defineExpose`, with their types when needed
+  - additional local types and interfaces used by the code that follows
+  - local helper functions needed by later sections; move reusable logic to composables or utils files
+  - derived and integrated reactive state: computed values, TanStack Query or WeFa query hooks with their options and extracted results, store reads, and data reshaping before passing to child components
+  - watchers
+  - lifecycle hooks
+  - one-time initialization calls
+
+## Core Design Rules
+
+1. Mirror the closest existing implementation before inventing a new pattern.
+2. Keep related files close to the feature when the host codebase already uses that pattern.
+3. Prefer extending the current public surface over creating parallel entrypoints.
+4. Keep product-app code inside the app and reusable library code inside the library; do not blur those layers accidentally.
+5. If working inside the WeFa repo, keep the library surface in `src/`, use `src/demo/` only for demo wiring, and do not hand-edit generated clients in `src/demo/openapi/`.
+
+## Placement Heuristics
+
+Ask first: "Is this behavior app-specific, reusable within the app, or reusable across products?"
+
+- App-specific behavior belongs in the consuming app, close to its feature.
+- WeFa-specific reusable behavior belongs in the library only when it is broadly reusable and consistent with the library's scope.
+- Do not push product logic down into WeFa just because the current task is happening in the WeFa repo.
+
+## Repo-Specific Folder Heuristics
+
+### `vue/src/components`
+
+Use for reusable UI primitives and composable visual building blocks.
+
+### `vue/src/containers`
+
+Use for higher-level routed or layout-aware building blocks that compose multiple primitives and often integrate router concerns.
+
+### `vue/src/network`
+
+Use for shared HTTP and TanStack Query infrastructure, not feature-local fetch logic that belongs inside an existing wrapper consumer.
+
+### `vue/src/router`, `vue/src/plugins`, `vue/src/stores`
+
+Check these before adding new helpers elsewhere. Many cross-cutting needs already have a home.
+
+### `vue/src/demo`
+
+Use for example integration, routed showcase flows, and local manual validation. Keep library abstractions out of the demo unless they are intentionally part of the public package.
+
+## Public Surface Rules
+
+1. If a new abstraction should be reused, expose it through the codebase's normal public surface instead of relying on deep imports.
+2. If a change alters setup or usage for consumers, update the surrounding docs or examples.
+3. Inside the WeFa repo, wire the nearest `index.ts`, shared entrypoint, and supporting docs when the library surface changes.
+
+## Component Design Checks
+
+- Does the API mirror the nearest comparable WeFa component?
+- Is the component wrapping or composing PrimeVue rather than re-implementing the primitive?
+- Are prop defaults expressed with `const { prop = defaultValue } = defineProps<Type>()` unless the local file pattern already depends on `withDefaults()`?
+- If inside the WeFa repo, is the SFC block order `template -> script -> style`?
+- Are user-visible states documented and tested according to the host project's conventions?
+
+## Architecture Smells
+
+- Generic helper added in a feature folder even though a shared helper area already exists
+- Shared abstraction added to WeFa even though the need is product-specific
+- Public component added without exports, docs, or tests
+- Demo code copied into library code
+- New pattern introduced despite a strong neighboring precedent
+- English literals embedded in components instead of locale keys
+
+## Review Prompt
+
+Ask: "If another developer adds the next feature beside this one, will they be able to copy a clear local pattern?"
diff --git a/.agents/skills/wefa-vue-cookbook/references/ecosystem-map.md b/.agents/skills/wefa-vue-cookbook/references/ecosystem-map.md
new file mode 100644
index 00000000..ca8bf055
--- /dev/null
+++ b/.agents/skills/wefa-vue-cookbook/references/ecosystem-map.md
@@ -0,0 +1,78 @@
+# Ecosystem Map
+
+## Purpose
+
+Use this reference when deciding which tool or layer to use for Vue code that depends on WeFa, whether in a consuming app or in the WeFa library itself.
+
+## Library Identity
+
+`@nside/wefa` is a PrimeVue superset. The normal path is:
+
+1. Reuse an existing WeFa component or container.
+2. Compose PrimeVue when WeFa does not provide the needed primitive.
+3. Fall back to native HTML only when both higher layers fail.
+
+If a native element is chosen while PrimeVue already solves the problem, that choice should be justified and rare.
+
+When working in a consuming app, think in layers:
+
+1. Existing app-level abstraction or local pattern
+2. WeFa abstraction
+3. PrimeVue building block
+4. Native Vue or HTML primitive
+
+## Tool Selection By Concern
+
+### UI primitives
+
+- Search for a neighboring feature in the current app before adding a new primitive.
+- Check `@nside/wefa` exports before composing PrimeVue from scratch.
+- Use PrimeVue as the default building-block layer below WeFa.
+- Use native HTML only as an escape hatch.
+
+### Routing and navigation
+
+- Prefer the host app's existing router conventions.
+- If WeFa already provides the navigation-shaped abstraction you need, prefer it over rebuilding the interaction locally.
+- Inside the WeFa repo, check `vue/src/router` and existing routed containers before adding route helpers from scratch.
+
+### State management
+
+- Keep state local to the component or composable when it is screen-local and short-lived.
+- Reach for Pinia only when the state is app-level, cross-route, or already follows an existing store-driven pattern.
+- Avoid introducing a store just to move local component state elsewhere.
+
+### Translations
+
+- In WeFa-based code, use the established i18n helpers instead of hard-coded strings.
+- Inside the WeFa repo, use `vue/src/locales/index.ts` and `useI18nLib`, and add locale messages under `vue/src/locales/<locale>/`.
+- Treat `aria-label`, placeholders, helper text, dialog titles, and validation copy as translatable UI.
+
+### Networking
+
+- Prefer `typedApiClient` when an OpenAPI-generated callable exists.
+- Prefer `apiClient` for simple URL-based GET/POST flows.
+- Use direct TanStack Query hooks only when the wrappers do not model the behavior cleanly.
+- Use `axiosInstance` directly only below the query layer or for calls that should not be modeled as TanStack-managed server state.
+
+### Documentation and demos
+
+- In consuming apps, keep examples and tests close to the app's existing conventions.
+- Inside the WeFa repo, public components and containers usually need a story, MDX docs, and tests next to the implementation.
+- Treat `vue/src/demo` as the manual integration surface, not as a place for reusable library logic.
+- Treat `vue/src/demo/openapi` as generated code.
+
+## Useful Anchors
+
+- Package imports: `@nside/wefa`, `@nside/wefa/network`, `@nside/wefa/types`
+- Repo-only anchors: `vue/src/lib.ts`, `vue/src/containers/index.ts`, `vue/src/network`, `vue/src/router`, `vue/src/plugins`, `vue/src/stores`
+- Repo-only translation guidance: `vue/src/locales/Translation.mdx`
+- Repo-only network guidance: `vue/src/network/network.mdx`
+
+## Smell Checks
+
+- New component created even though a WeFa or PrimeVue equivalent already exists
+- Hard-coded strings instead of i18n keys
+- New store for state that could remain local
+- Repo-only demo shortcuts copied into reusable code
+- Direct axios or raw TanStack usage where the wrappers already fit
diff --git a/.agents/skills/wefa-vue-frontend/SKILL.md b/.agents/skills/wefa-vue-frontend/SKILL.md
new file mode 100644
index 00000000..4d6f0a4f
--- /dev/null
+++ b/.agents/skills/wefa-vue-frontend/SKILL.md
@@ -0,0 +1,66 @@
+---
+name: wefa-vue-frontend
+description: Maintainer guide for contributing to the N-SIDE WeFa Vue package itself. Use it only when the task is inside this repository's `vue/` workspace, and load it after `wefa-vue-cookbook`. It covers repo-specific maintainer concerns such as exports, Storybook or MDX docs, demo wiring, generated artifacts, frontend tests, and the Vue package quality gate.
+---
+
+# WeFa Vue Maintainer
+
+This is the maintainer skill for the WeFa Vue library inside this repository.
+
+Load `wefa-vue-cookbook` first. That cookbook is the shared skill used by consuming projects and by the library itself for common WeFa conventions. Use this skill only for repo-specific maintainer concerns such as exports, Storybook, MDX docs, demo wiring, generated artifacts, tests, and review hygiene inside `vue/`.
+
+## First Reads
+1. Read `vue/AGENTS.md` for workspace identity, gotchas, and the repo quality gate.
+2. Read `vue/README.md` for package capabilities, exports, and workspace scripts.
+3. Read `vue/CONTRIBUTE.md` for contribution expectations and the npm script surface.
+4. Read `code_review.md` from the repo root when the task is a review.
+
+## Workspace Map
+1. Start public-surface discovery at `vue/src/lib.ts` and `vue/src/containers/index.ts`.
+2. Expect feature folders to keep neighbors together: component or container source, `index.ts`, stories, MDX docs, and tests in the same folder.
+3. Use `vue/src/locales/index.ts` plus `vue/src/locales/<locale>/*.json` for library i18n wiring.
+4. Check `vue/src/network`, `vue/src/router`, `vue/src/plugins`, and `vue/src/stores` before adding duplicate helpers.
+5. Treat `vue/src/demo` and `vue/src/demo/openapi` as the manual-validation and generated-client surface for demo flows.
+
+## Repo-Specific Rules
+1. New public components or containers should usually ship with source, stories, MDX docs, and unit tests, unless the adjacent feature pattern in this repo clearly differs.
+2. When a change creates or exposes new public surface, update the nearest `index.ts` and shared entrypoints such as `vue/src/lib.ts` or `vue/src/containers/index.ts`.
+3. Regenerate or reuse generated OpenAPI client artifacts through the existing script instead of hand-editing generated files.
+4. Treat `vue/src/demo` as a manual-validation surface, not as a place to hide reusable library logic.
+5. Keep `README.md`, MDX docs, and Storybook stories aligned with behavior changes that affect consumers.
+6. Respect repo-enforced gotchas from `vue/AGENTS.md`, including SFC block order, the `withDefaults()` preference, and the rule against Storybook `autodocs` tags.
+
+## Delivery Workflow
+1. Inspect existing implementation first:
+   Search for a neighboring component, container, plugin, store, or network helper that already solves most of the problem.
+2. Implement with local conventions:
+   Match adjacent prop patterns, file names, exports, and test naming (`.spec.ts`, `.test.ts`, or `__tests__`) used by that feature.
+3. Wire localization:
+   Add or update locale namespaces under `vue/src/locales/<locale>/` and use `useI18nLib` or `$t` in code. If a story or test needs extra messages, register them through the existing locale helpers.
+4. Update supporting artifacts:
+   Update stories and MDX docs when props, states, a11y guidance, or usage changed. Update demo wiring when the change affects routed or integrated flows.
+5. Validate before handoff:
+   `npm run lint-check`
+   `npm run type-check`
+   `npm run format-check`
+   `npm run test:unit -- --reporter=dot --silent`
+   `npm run build`
+   `npm run test:e2e -- --reporter=dot` when routing, demo flows, or browser interactions changed
+   `npm run test:package-types` when exports or packaging changed
+
+## Test Output Discipline
+1. Always run tests with low-verbosity flags to limit terminal noise and token usage.
+2. Keep the minimal reporters above unless debugging failures requires temporary extra detail.
+3. If extra verbosity is needed for debugging, rerun only the failing test scope with detailed output.
+
+## References
+- Load `wefa-vue-cookbook` for shared WeFa usage conventions.
+- Load `references/contributing-and-checks.md` for the repo quality gate and PR-ready checklist.
+- Read `vue/README.md` and `vue/CONTRIBUTE.md` for project workflows.
+- Read `vue/src/locales/Translation.mdx` when adding or reshaping translations.
+
+## Definition of Done
+1. Shared WeFa usage conventions come from `wefa-vue-cookbook`; this skill adds only repo-specific rules.
+2. Public exports and supporting entrypoints are updated when surface area changes.
+3. Tests, stories, docs, and demo wiring are updated for behavior changes.
+4. Required lint, type, format, unit-test, build, and relevant e2e or package-type checks pass.
diff --git a/.agents/skills/wefa-vue-frontend/agents/openai.yaml b/.agents/skills/wefa-vue-frontend/agents/openai.yaml
new file mode 100644
index 00000000..02bbb955
--- /dev/null
+++ b/.agents/skills/wefa-vue-frontend/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "WeFa Vue Maintainer"
+  short_description: "Repo-only maintainer rules for the WeFa Vue library"
+  default_prompt: "Use $wefa-vue-frontend after $wefa-vue-cookbook when implementing or reviewing changes inside this repository's WeFa `vue/` workspace."
diff --git a/.agents/skills/wefa-vue-frontend/references/contributing-and-checks.md b/.agents/skills/wefa-vue-frontend/references/contributing-and-checks.md
new file mode 100644
index 00000000..db8aadaa
--- /dev/null
+++ b/.agents/skills/wefa-vue-frontend/references/contributing-and-checks.md
@@ -0,0 +1,57 @@
+# Contributing And Checks
+
+## Purpose
+
+Use this reference when the task needs contribution workflow, quality-gate commands, or a deeper verification checklist than the always-loaded summary.
+
+## First Reads
+
+1. `vue/AGENTS.md`
+2. `vue/CONTRIBUTE.md`
+3. `vue/README.md` when the task changes package-level setup, exports, or developer guidance
+
+## Required Quality Gate
+
+Run from `vue/` before handoff:
+
+```bash
+npm run lint-check
+npm run type-check
+npm run format-check
+npm run test:unit -- --reporter=dot --silent
+npm run build
+```
+
+## Extra Checks When The Change Needs Them
+
+- Run `npm run test:e2e -- --reporter=dot` when routing, demo flows, or browser-visible interactions changed.
+- Run `npm run test:package-types` when exports, packaging, or published type declarations changed.
+- Keep test output low-noise by default; only rerun a narrowed failing scope with higher verbosity while debugging.
+
+## Contributor Expectations
+
+1. Mirror the nearest existing component, container, store, plugin, or network helper before introducing a new pattern.
+2. Update docs alongside behavior:
+   `README.md`, MDX docs, stories, or in-repo guidance depending on what changed.
+3. Keep public-surface changes synchronized:
+   update the nearest `index.ts`, `vue/src/lib.ts`, or `vue/src/containers/index.ts` when the change exposes new surface.
+4. Keep generated artifacts generated:
+   never hand-edit the generated OpenAPI client under `vue/src/demo/openapi/`.
+5. Keep user-facing strings translated and test the translated path, not just hard-coded English.
+
+## PR-Ready Checklist
+
+1. Tests cover the changed behavior, not only the happy path.
+2. Stories and MDX docs are updated for public component/container changes.
+3. Screenshots or recordings exist when the UI changes materially.
+4. The quality gate is green, with any justified deviations called out explicitly.
+5. The branch does not contain unrelated refactors mixed into the feature.
+
+## Review Prompts
+
+Use these when reviewing agent-generated Vue work:
+
+- Did it choose the correct layer, or did it skip a WeFa/PrimeVue abstraction that already exists?
+- Did it add docs, tests, translations, and exports together, or only code?
+- Did it run the right checks for the kind of change made?
+- Did it change public behavior without updating package-level guidance?
diff --git a/.gitignore b/.gitignore
index 26e7a897..eecfdbdc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@
 *.code-workspace
 *.iml
 .claude/settings.local.json
+.claude/launch.json
 django/docs/source/api/*
 django/docs/output/**/*
 .env
diff --git a/AGENTS.md b/AGENTS.md
index ba615afb..f71be618 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,62 +1,69 @@
 # N-SIDE WeFa - Agent Guide
 
-## Purpose
+## Product
 
-This file gives Codex durable repository context. Keep it concise: put shared rules here, put workspace-specific rules in nested `AGENTS.md` files, and move repeatable task workflows into skills.
+**WeFa** (Web Factory) is N-SIDE's internal toolkit for assembling full-stack product experiences quickly. The monorepo ships three artifacts on one shared version:
 
-Codex loads AGENTS instructions from the repository root down to the current working directory. Later files are more specific, so prefer plain nested `AGENTS.md` files for additive guidance. Use `AGENTS.override.md` only when intentionally replacing broader guidance.
+- `django/` publishes the `nside-wefa` Django toolkit.
+- `vue/` publishes the `@nside/wefa` Vue 3 component library.
+- `bff/` publishes the Flask backend-for-frontend used for OAuth/session/cookie flows and backend proxying.
 
-## Repository Map
+## Purpose
 
-- `django/` publishes the `nside-wefa` Django toolkit with reusable apps under `nside_wefa/` and the `demo/` validation project.
-- `vue/` publishes the `@nside/wefa` Vue 3 library, demo app, Storybook docs, CLI helpers, and generated OpenAPI demo clients.
-- `bff/` provides the Flask backend-for-frontend for OAuth login/logout/session checks and proxying backend REST calls.
-- `scripts/` contains repository automation, especially the version orchestrator used to keep package versions aligned.
-- `.github/workflows/` is the source of truth for CI-equivalent validation commands.
+This file provides durable repository-wide guidance. Keep shared rules here, keep workspace-specific rules in nested `AGENTS.md` files, and keep reusable task workflows in `.agents/skills/`.
 
-## Technology Baseline
+Codex loads AGENTS instructions from the repository root down to the current working directory. Later files are more specific.
 
-- Python workspaces target Python 3.12+ and use `uv`, pytest, Ruff, mypy, and security checks.
-- `django/` targets modern Django, Django REST Framework, Simple JWT, drf-spectacular, and Hatchling packaging.
-- `bff/` uses Flask, Authlib, encrypted token cookies, Docker, and generated OpenAPI documentation.
-- `vue/` uses Vue 3, Vite, TypeScript, PrimeVue, Tailwind 4, Pinia, Vue I18n, TanStack Query, Vitest, Storybook, and Playwright.
+## Repository Map
+
+- `README.md` is the top-level overview; defer to per-workspace `README.md` files for package specifics.
+- `django/` contains reusable Django apps plus the `demo/` validation project. See [django/AGENTS.md](django/AGENTS.md).
+- `vue/` contains the library, demo app, Storybook docs, and package tooling. See [vue/AGENTS.md](vue/AGENTS.md).
+- `bff/` contains the Flask BFF and its generated OpenAPI spec. See [bff/AGENTS.md](bff/AGENTS.md).
+- `.agents/skills/` contains repo-local Codex skills.
+- `docs/agent-roadmap.md` records cross-cutting infrastructure direction.
+- `code_review.md` is the review checklist.
+- `PLANS.md` is the plan template for larger multi-step work.
 
 ## Instruction Routing
 
-- For `django/` work, read `django/AGENTS.md`, `django/README.md`, and `django/CONTRIBUTE.md`.
-- For `vue/` work, read `vue/AGENTS.md`, `vue/README.md`, and `vue/CONTRIBUTE.md`; use `$wefa-vue-frontend` for component, container, Storybook, i18n, demo, and frontend test work.
-- For TanStack Query work in `vue/`, also use `$wefa-tanstack-query`.
-- For `bff/` work, read `bff/AGENTS.md` and `bff/README.md`.
-- For `scripts/` work, read `scripts/AGENTS.md`.
+- For Vue work in consuming projects that use `@nside/wefa`, use `wefa-vue-cookbook`.
+- For frontend work inside this repository's `vue/` workspace, load `wefa-vue-cookbook` first and then `wefa-vue-frontend`.
+- `wefa-vue-cookbook` is the shared base skill: it applies both to consuming apps and to shared Vue conventions inside this repo.
+- `wefa-vue-frontend` adds only repo-specific maintainer guidance for this monorepo's `vue/` workspace: exports, docs, demo wiring, generated artifacts, tests, and quality-gate expectations.
+- For TanStack Query work in `vue/`, also use `wefa-tanstack-query` when the task is specifically about query wiring, invalidation, mutation flows, or wrapper choice.
+- For `django/` work, follow [django/AGENTS.md](django/AGENTS.md).
+- For `bff/` work, follow [bff/AGENTS.md](bff/AGENTS.md).
 - For cross-cutting changes, coordinate backend/API shape first, then update consumers and documentation in the affected workspaces.
 
-The current repository skills live under `skills/`. A later cleanup should migrate shared Codex skills to official repository discovery under `.agents/skills`, but do not do that as part of AGENTS-only edits unless explicitly requested.
-
 ## Shared Engineering Rules
 
-- Explore first: inspect existing implementations, neighboring files, docs, and CI before designing changes.
-- Prefer existing conventions and helpers over new bespoke wiring.
-- Preserve public APIs unless the task explicitly asks for a breaking change; document behavior changes where consumers will notice them.
-- Keep Python and TypeScript types accurate. Avoid broad casts, silent fallbacks, and broad exception handling.
-- Keep user-facing copy localized in frontend code and documented in the relevant README, MDX, or package docs.
-- Add or update tests when behavior changes. If validation is skipped, state exactly why.
+- Explore first: inspect neighboring implementations, workspace docs, and CI scripts before designing changes.
+- Prefer existing conventions and helpers over bespoke wiring.
+- Keep Python and TypeScript types accurate.
+- Keep user-facing frontend copy localized.
+- Add or update tests when behavior changes.
 - Do not hand-edit generated artifacts unless the workspace guide explicitly allows it.
-- Do not commit secrets. Treat `.env` files, OAuth credentials, tokens, and generated local IDE/cache files as local-only.
+- Keep lockfiles aligned with the package manager in use: `uv.lock` for Python workspaces and `package-lock.json` for `vue/`.
+- Update relevant README, MDX, or changelog-style docs when behavior changes.
 
-## Versioning And Releases
+## Cross-Workspace Invariants
 
-- The monorepo uses one shared version across `django/`, `vue/`, and `bff/`.
-- Use `python3 scripts/wefa_version.py` from the repository root for version changes.
-- Prefer `--dry-run` before version changes; do not manually edit per-package version fields unless repairing the orchestrator itself.
-- Keep lockfiles consistent with the package manager used in the branch: `uv.lock` for Python workspaces and `package-lock.json` for npm.
+- All three workspaces share one version. Use `python3 scripts/wefa_version.py` from the repo root for version changes.
+- `nside_wefa.common` must come before dependent `nside_wefa.*` apps in Django app-order examples and validation setups.
+- BFF cookie names and frontend redirect error codes are part of the BFF ↔ Vue contract; coordinated changes must update both workspaces' docs and flows in the same change.
+- Generated artifacts must stay in sync: regenerate the BFF OpenAPI spec and the Vue demo client through the existing generators instead of hand-editing them.
+- Opt-in flags need dedicated tests with the flag enabled, not only default-path coverage.
 
 ## Validation Expectations
 
-- Run the smallest relevant checks while iterating, then run the workspace's CI-equivalent commands before handoff when feasible.
-- Documentation-only AGENTS changes do not require product test suites, but they should pass basic markdown/content sanity checks.
-- For reviews, prioritize bugs, behavior regressions, missing tests, security risks, and docs drift before style suggestions.
+- Run the smallest relevant checks while iterating.
+- Before handoff, run the workspace-specific gate from the relevant nested `AGENTS.md` when feasible.
+- Documentation-only AGENTS or skill-routing changes do not require product test suites, but they should leave the repo without unresolved conflicts or conflict markers.
+- For reviews, prioritize bugs, regressions, missing tests, security risks, and docs drift before style comments.
 
-## Compatibility Notes
+## When In Doubt
 
-- Codex guidance should come from `AGENTS.md` files and skills, not generated assistant instruction artifacts.
-- Keep AGENTS files compact. Link to workspace docs rather than copying full manuals so the combined instruction chain stays below Codex's default 32 KiB project-doc size limit.
+- Workspace `AGENTS.md` files and skills first, then workspace READMEs and contribution guides.
+- Mirror the closest existing implementation before inventing a new pattern.
+- Surface design questions early when a change would expand auth modes, backend contracts, public exports, or other cross-workspace infrastructure.
diff --git a/PLANS.md b/PLANS.md
new file mode 100644
index 00000000..c2bc3124
--- /dev/null
+++ b/PLANS.md
@@ -0,0 +1,38 @@
+# WeFa Cross-Workspace Plan Template
+
+Use this template for ambiguous, long-running, or cross-workspace work before implementation starts.
+
+## Goal
+
+State the user-visible outcome and the success condition.
+
+## Touched Workspaces
+
+- `django/`
+- `bff/`
+- `vue/`
+
+List only the workspaces that the change will touch and explain why.
+
+## Constraints
+
+- Architecture or ownership boundaries to preserve
+- Existing contracts that must remain compatible
+- Documentation or generated artifacts that must stay in sync
+
+## Implementation Notes
+
+- Main behavior changes
+- Public API or contract changes
+- Required docs or generated-file updates
+
+## Verification
+
+- Exact commands to run in each touched workspace
+- Any cross-workspace checks needed for contracts, generated clients, or browser flows
+
+## Rollback / Compatibility
+
+- Backward-compatibility concerns
+- Migration or deploy notes
+- Safe rollback approach if the change needs to be reverted
diff --git a/README.md b/README.md
index e83c96a4..ad426093 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,15 @@ N-SIDE WeFa (Web Factory) is an open-source toolkit for building full-stack, pro
 
 Explore the [interactive documentation](https://n-side-dev.github.io/wefa/) for the Django and Vue packages.
 
+## Agent Guidance
+
+For AI-agent work on Vue code, this repository keeps two distinct guidance layers under `.agents/skills/`:
+
+- `wefa-vue-cookbook` is the shared Vue skill. It is the right starting point for consuming projects that use `@nside/wefa`, and it is also the shared base for work inside this repository's `vue/` package.
+- `wefa-vue-frontend` is the maintainer skill. Use it only for work inside this repository's `vue/` package, after loading the cookbook, when the task touches repo-specific library concerns such as exports, Storybook or MDX docs, demo wiring, generated artifacts, or the Vue quality gate.
+
+See [AGENTS.md](AGENTS.md) for the repo routing rules.
+
 ## Packages at a Glance
 
 - `django/` – source code for the Django distribution published as `nside-wefa`. Includes the demo project in `django/demo`.
diff --git a/bff/AGENTS.md b/bff/AGENTS.md
index eecd56d6..78d4060a 100644
--- a/bff/AGENTS.md
+++ b/bff/AGENTS.md
@@ -4,7 +4,7 @@
 
 This file applies to the Flask backend-for-frontend in `bff/`. The service handles OAuth login/logout/session checks, encrypted token cookies, health endpoints, OpenAPI generation, and proxying backend REST calls.
 
-Read `bff/README.md` before changing environment contracts, auth/session behavior, OpenAPI output, Docker behavior, or deployment-facing docs.
+Read [README.md](README.md) before changing environment contracts, auth/session behavior, OpenAPI output, Docker behavior, or deployment-facing docs.
 
 ## Security And Configuration Rules
 
@@ -13,11 +13,13 @@ Read `bff/README.md` before changing environment contracts, auth/session behavio
 - Required settings should fail fast at startup when missing or blank.
 - Preserve production security defaults unless explicitly directed otherwise: HttpOnly token cookies, secure cookie settings, strict SameSite behavior, PKCE verifier/state handling, and explicit callback error handling.
 - Token cookies are derived from `SESSION_COOKIE_NAME`; changes to names, payload split behavior, encryption, or expiry semantics need tests and rollout notes.
+- Callback failures redirect to `FRONTEND_REDIRECT?error=<code>`; new error codes must be documented and coordinated with Vue flows.
 - Do not add broad proxy fallbacks that hide backend failures. Surface upstream errors consistently with existing route behavior.
 
 ## Implementation Rules
 
 - Keep route handlers in `bff_app/routes/` and reusable behavior in `bff_app/services/` or `bff_app/settings.py`.
+- Use `flask-smorest` patterns already present in the workspace for schema-validated routes.
 - Preserve the OpenAPI generator as the source of truth for `bff_app/openapi/openapi.yaml`.
 - Use `uv` for dependency and command execution in this workspace.
 - Update Docker and README instructions together when runtime ports, environment variables, or startup commands change.
@@ -25,6 +27,7 @@ Read `bff/README.md` before changing environment contracts, auth/session behavio
 ## Tests And OpenAPI
 
 - Add or update tests under `tests/` for auth redirects, callback errors, session behavior, token-cookie behavior, proxying, settings validation, and OpenAPI generation.
+- Mock the upstream IdP and backend rather than calling real services.
 - Regenerate OpenAPI intentionally, then check for drift.
 - Use narrow pytest runs while iterating, then the CI-equivalent checks before handoff when feasible.
 
@@ -33,6 +36,7 @@ Read `bff/README.md` before changing environment contracts, auth/session behavio
 Run from `bff/` unless noted:
 
 ```bash
+uv sync --dev
 uv run pytest -q
 uv run python -m bff_app.openapi.generate --check --output bff_app/openapi/openapi.yaml
 uvx pysentry-rs --config .pysentry.toml .
diff --git a/bff/pyproject.toml b/bff/pyproject.toml
index d148d9e5..3019073c 100644
--- a/bff/pyproject.toml
+++ b/bff/pyproject.toml
@@ -5,7 +5,7 @@ description = "Flask backend-for-frontend"
 requires-python = ">=3.12,<3.13"
 dependencies = [
     "authlib>=1.7.2",
-    "cryptography",
+    "cryptography>=49.0.0",
     "flask~=3.1.2",
     "flask-cors",
     "flask-session",
diff --git a/bff/uv.lock b/bff/uv.lock
index 5d27e0cd..a2fc933b 100644
--- a/bff/uv.lock
+++ b/bff/uv.lock
@@ -58,7 +58,7 @@ dev = [
 [package.metadata]
 requires-dist = [
     { name = "authlib", specifier = ">=1.7.2" },
-    { name = "cryptography" },
+    { name = "cryptography", specifier = ">=49.0.0" },
     { name = "flask", specifier = "~=3.1.2" },
     { name = "flask-cors" },
     { name = "flask-session" },
@@ -173,41 +173,39 @@ wheels = [
 
 [[package]]
 name = "cryptography"
-version = "48.0.0"
+version = "49.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9f/a9/db8f313fdcd85d767d4973515e1db101f9c71f95fced83233de224673757/cryptography-48.0.0.tar.gz", hash = "sha256:5c3932f4436d1cccb036cb0eaef46e6e2db91035166f1ad6505c3c9d5a635920", size = 832984, upload-time = "2026-05-04T22:59:38.133Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/df/3d/01f6dd9190170a5a241e0e98c2d04be3664a9e6f5b9b872cde63aff1c3dd/cryptography-48.0.0-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:0c558d2cdffd8f4bbb30fc7134c74d2ca9a476f830bb053074498fbc86f41ed6", size = 8001587, upload-time = "2026-05-04T22:57:36.803Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/6e/e90527eef33f309beb811cf7c982c3aeffcce8e3edb178baa4ca3ae4a6fa/cryptography-48.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f5333311663ea94f75dd408665686aaf426563556bb5283554a3539177e03b8c", size = 4690433, upload-time = "2026-05-04T22:57:40.373Z" },
-    { url = "https://files.pythonhosted.org/packages/90/04/673510ed51ddff56575f306cf1617d80411ee76831ccd3097599140efdfe/cryptography-48.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7995ef305d7165c3f11ae07f2517e5a4f1d5c18da1376a0a9ed496336b69e5f3", size = 4710620, upload-time = "2026-05-04T22:57:42.935Z" },
-    { url = "https://files.pythonhosted.org/packages/14/d5/e9c4ef932c8d800490c34d8bd589d64a31d5890e27ec9e9ad532be893294/cryptography-48.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:40ba1f85eaa6959837b1d51c9767e230e14612eea4ef110ee8854ada22da1bf5", size = 4696283, upload-time = "2026-05-04T22:57:45.294Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/29/174b9dfb60b12d59ecfc6cfa04bc88c21b42a54f01b8aae09bb6e51e4c7f/cryptography-48.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:369a6348999f94bbd53435c894377b20ab95f25a9065c283570e70150d8abc3c", size = 5296573, upload-time = "2026-05-04T22:57:47.933Z" },
-    { url = "https://files.pythonhosted.org/packages/95/38/0d29a6fd7d0d1373f0c0c88a04ba20e359b257753ac497564cd660fc1d55/cryptography-48.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:a0e692c683f4df67815a2d258b324e66f4738bd7a96a218c826dce4f4bd05d8f", size = 4743677, upload-time = "2026-05-04T22:57:50.067Z" },
-    { url = "https://files.pythonhosted.org/packages/30/be/eef653013d5c63b6a490529e0316f9ac14a37602965d4903efed1399f32b/cryptography-48.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:18349bbc56f4743c8b12dc32e2bccb2cf83ee8b69a3bba74ef8ae857e26b3d25", size = 4330808, upload-time = "2026-05-04T22:57:52.301Z" },
-    { url = "https://files.pythonhosted.org/packages/84/9e/500463e87abb7a0a0f9f256ec21123ecde0a7b5541a15e840ea54551fd81/cryptography-48.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:7e8eac43dfca5c4cccc6dad9a80504436fca53bb9bc3100a2386d730fbe6b602", size = 4695941, upload-time = "2026-05-04T22:57:54.603Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/dc/7303087450c2ec9e7fbb750e17c2abfbc658f23cbd0e54009509b7cc4091/cryptography-48.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:9ccdac7d40688ecb5a3b4a604b8a88c8002e3442d6c60aead1db2a89a041560c", size = 5252579, upload-time = "2026-05-04T22:57:57.207Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/c0/7101d3b7215edcdc90c45da544961fd8ed2d6448f77577460fa75a8443f7/cryptography-48.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:bd72e68b06bb1e96913f97dd4901119bc17f39d4586a5adf2d3e47bc2b9d58b5", size = 4743326, upload-time = "2026-05-04T22:57:59.535Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/d8/5b833bad13016f562ab9d063d68199a4bd121d18458e439515601d3357ec/cryptography-48.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:59baa2cb386c4f0b9905bd6eb4c2a79a69a128408fd31d32ca4d7102d4156321", size = 4826672, upload-time = "2026-05-04T22:58:01.996Z" },
-    { url = "https://files.pythonhosted.org/packages/98/e1/7074eb8bf3c135558c73fc2bcf0f5633f912e6fb87e868a55c454080ef09/cryptography-48.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9249e3cd978541d665967ac2cb2787fd6a62bddf1e75b3e347a594d7dacf4f74", size = 4972574, upload-time = "2026-05-04T22:58:03.968Z" },
-    { url = "https://files.pythonhosted.org/packages/04/70/e5a1b41d325f797f39427aa44ef8baf0be500065ab6d8e10369d850d4a4f/cryptography-48.0.0-cp311-abi3-win32.whl", hash = "sha256:9c459db21422be75e2809370b829a87eb37f74cd785fc4aa9ea1e5f43b47cda4", size = 3294868, upload-time = "2026-05-04T22:58:06.467Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/ac/8ac51b4a5fc5932eb7ee5c517ba7dc8cd834f0048962b6b352f00f41ebf9/cryptography-48.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:5b012212e08b8dd5edc78ef54da83dd9892fd9105323b3993eff6bea65dc21d7", size = 3817107, upload-time = "2026-05-04T22:58:08.845Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/63/61d4a4e1c6b6bab6ce1e213cd36a24c415d90e76d78c5eb8577c5541d2e8/cryptography-48.0.0-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:58d00498e8933e4a194f3076aee1b4a97dfec1a6da444535755822fe5d8b0b86", size = 7983482, upload-time = "2026-05-04T22:58:43.769Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/ac/f5b5995b87770c693e2596559ffafe195b4033a57f14a82268a2842953f3/cryptography-48.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:614d0949f4790582d2cc25553abd09dd723025f0c0e7c67376a1d77196743d6e", size = 4683266, upload-time = "2026-05-04T22:58:46.064Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/c6/8b14f67e18338fbc4adb76f66c001f5c3610b3e2d1837f268f47a347dbbb/cryptography-48.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7ce4bfae76319a532a2dc68f82cc32f5676ee792a983187dac07183690e5c66f", size = 4696228, upload-time = "2026-05-04T22:58:48.22Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/73/f808fbae9514bd91b47875b003f13e284c8c6bdfd904b7944e803937eec1/cryptography-48.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:2eb992bbd4661238c5a397594c83f5b4dc2bc5b848c365c8f991b6780efcc5c7", size = 4689097, upload-time = "2026-05-04T22:58:50.9Z" },
-    { url = "https://files.pythonhosted.org/packages/93/01/d86632d7d28db8ae83221995752eeb6639ffb374c2d22955648cf8d52797/cryptography-48.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:22a5cb272895dce158b2cacdfdc3debd299019659f42947dbdac6f32d68fe832", size = 5283582, upload-time = "2026-05-04T22:58:53.017Z" },
-    { url = "https://files.pythonhosted.org/packages/02/e1/50edc7a50334807cc4791fc4a0ce7468b4a1416d9138eab358bfc9a3d70b/cryptography-48.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2b4d59804e8408e2fea7d1fbaf218e5ec984325221db76e6a241a9abd6cdd95c", size = 4730479, upload-time = "2026-05-04T22:58:55.611Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/af/99a582b1b1641ff5911ac559beb45097cf79efd4ead4657f578ef1af2d47/cryptography-48.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:984a20b0f62a26f48a3396c72e4bc34c66e356d356bf370053066b3b6d54634a", size = 4326481, upload-time = "2026-05-04T22:58:57.607Z" },
-    { url = "https://files.pythonhosted.org/packages/90/ee/89aa26a06ef0a7d7611788ffd571a7c50e368cc6a4d5eef8b4884e866edb/cryptography-48.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:5a5ed8fde7a1d09376ca0b40e68cd59c69fe23b1f9768bd5824f54681626032a", size = 4688713, upload-time = "2026-05-04T22:59:00.077Z" },
-    { url = "https://files.pythonhosted.org/packages/70/ba/bcb1b0bb7a33d4c7c0c4d4c7874b4a62ae4f56113a5f4baefa362dfb1f0f/cryptography-48.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:8cd666227ef7af430aa5914a9910e0ddd703e75f039cef0825cd0da71b6b711a", size = 5238165, upload-time = "2026-05-04T22:59:02.317Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/70/ca4003b1ce5ca3dc3186ada51908c8a9b9ff7d5cab83cc0d43ee14ec144f/cryptography-48.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:9071196d81abc88b3516ac8cdfad32e2b66dd4a5393a8e68a961e9161ddc6239", size = 4729947, upload-time = "2026-05-04T22:59:05.255Z" },
-    { url = "https://files.pythonhosted.org/packages/44/a0/4ec7cf774207905aef1a8d11c3750d5a1db805eb380ee4e16df317870128/cryptography-48.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:1e2d54c8be6152856a36f0882ab231e70f8ec7f14e93cf87db8a2ed056bf160c", size = 4822059, upload-time = "2026-05-04T22:59:07.802Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/75/a2e55f99c16fcac7b5d6c1eb19ad8e00799854d6be5ca845f9259eae1681/cryptography-48.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a5da777e32ffed6f85a7b2b3f7c5cbc88c146bfcd0a1d7baf5fcc6c52ee35dd4", size = 4960575, upload-time = "2026-05-04T22:59:09.851Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/23/6e6f32143ab5d8b36ca848a502c4bcd477ae75b9e1677e3530d669062578/cryptography-48.0.0-cp39-abi3-win32.whl", hash = "sha256:77a2ccbbe917f6710e05ba9adaa25fb5075620bf3ea6fb751997875aff4ae4bd", size = 3279117, upload-time = "2026-05-04T22:59:12.019Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/9a/0fea98a70cf1749d41d738836f6349d97945f7c89433a259a6c2642eefeb/cryptography-48.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:16cd65b9330583e4619939b3a3843eec1e6e789744bb01e7c7e2e62e33c239c8", size = 3792100, upload-time = "2026-05-04T22:59:14.884Z" },
+sdist = { url = "https://files.pythonhosted.org/packages/1f/99/d1c90d6041656cc6ee229dc99cd67fd0cd5aec3c5f7d72fffc27cc750054/cryptography-49.0.0.tar.gz", hash = "sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493", size = 854345, upload-time = "2026-06-12T20:02:30.512Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9b/22/adf66990e63584a68dfb50c24f48a125c07b1699899381c8151e63ed458c/cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db", size = 4032100, upload-time = "2026-06-12T20:02:32.143Z" },
+    { url = "https://files.pythonhosted.org/packages/09/41/3797cfaf69cae04a13ee78ebd83f0678d9c02b4779d21ce24445326f1a69/cryptography-49.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db", size = 4692978, upload-time = "2026-06-12T20:01:21.305Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/8b/43011f7ebe515a8aa20d61f290a326cd890c2e738e16e59eaff8d9c3a412/cryptography-49.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325", size = 4716422, upload-time = "2026-06-12T20:01:48.566Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/91/01ce7303a4579e6d3a6abef01bd322848e9ea7a219adcabc5048b9033571/cryptography-49.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2", size = 4700503, upload-time = "2026-06-12T20:02:47.091Z" },
+    { url = "https://files.pythonhosted.org/packages/62/99/a2c95cf8293f07491e9e27c20cc4dcd18176d944e674679adeb1d0173fd6/cryptography-49.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b", size = 5309779, upload-time = "2026-06-12T20:02:08.987Z" },
+    { url = "https://files.pythonhosted.org/packages/20/2c/0622f20ff02b2ef32558733443805dc82fd4c275be01b2d19d14676f3a1b/cryptography-49.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6", size = 4749683, upload-time = "2026-06-12T20:02:03.335Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5b/c5246635d5fd3b64e0d45ae10e99fd32fe9676a79915ccfe5a61ba9af1a5/cryptography-49.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c", size = 4337874, upload-time = "2026-06-12T20:02:54.323Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/88/05563c7fe2e914e87d1a536d06fe83e66b4e1d95cb593e05aea375531da8/cryptography-49.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7", size = 4700283, upload-time = "2026-06-12T20:01:34.822Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/b6/d7696e4e890d6ae1469935164c9e5215c557671cb78d6e3f458ccceaa632/cryptography-49.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68", size = 5265844, upload-time = "2026-06-12T20:01:24.09Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/3c/f3ad17eecc1a57b0ba236dc01f90e783c51f4a2f35f64777cc4f47a184b2/cryptography-49.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9", size = 4749290, upload-time = "2026-06-12T20:01:30.848Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/01/339573cf1023163a400b0b5d16f6d507de413b9f60be6fd1b77feeaf6737/cryptography-49.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f", size = 4834612, upload-time = "2026-06-12T20:01:29.246Z" },
+    { url = "https://files.pythonhosted.org/packages/71/fd/577302e213a1be9468f92d1afef66fcf1ef83d516819d9992ca547f592bd/cryptography-49.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459", size = 4980804, upload-time = "2026-06-12T20:01:42.853Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/09/f42b1d190c5ba75f72062a387f8030d1d75f6ab035788f1d9c4b01de6525/cryptography-49.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e", size = 3810026, upload-time = "2026-06-12T20:02:39.262Z" },
+    { url = "https://files.pythonhosted.org/packages/19/2a/5bb823f5bedcf80718cea7fbc95ec5515cca3769633c4b01a32be7f30e7c/cryptography-49.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a", size = 4025947, upload-time = "2026-06-12T20:01:25.745Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/df/40577043ca124e17012f408ddddaeb213b856336ac82ddb3bc915f39e29f/cryptography-49.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4", size = 4692429, upload-time = "2026-06-12T20:01:53.628Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/99/2d13299eb3dd27b02dcfaafcc91d6b5cb3329f7cbd6d8f51921acd566c1a/cryptography-49.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18", size = 4700968, upload-time = "2026-06-12T20:02:45.383Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/4d/9c0cd02f95e2602dd5e563da149ee0830abef3537be8b34dc56281ebe27a/cryptography-49.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69", size = 4697758, upload-time = "2026-06-12T20:01:41.13Z" },
+    { url = "https://files.pythonhosted.org/packages/24/01/186c825898477d77e2324d5360fefe622ff1d8d1963ec0554e2cada8ec77/cryptography-49.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64", size = 5298863, upload-time = "2026-06-12T20:02:24.579Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/7b/62cbbab75d0659865bf0273790031544a0b16c8072d258f9428dcd8190dc/cryptography-49.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21", size = 4735983, upload-time = "2026-06-12T20:01:50.14Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/72/3e798c064bc39e471008075d0f9bc9daf77a80879c092e4a8e170c585ed4/cryptography-49.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9", size = 4334173, upload-time = "2026-06-12T20:01:44.743Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/ee/6fca21d1ac73e06f8bef71940abfd4d2f6472b4bca284d770f32bd4086f6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc", size = 4697298, upload-time = "2026-06-12T20:02:20.918Z" },
+    { url = "https://files.pythonhosted.org/packages/67/d0/a5fcd3515f0bae49a7b6d0413cc1bdccdcc1fc0047037a0d480642cdc5d6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8", size = 5254338, upload-time = "2026-06-12T20:02:22.737Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/84/84fe36f19caf857d61cb7fc9c63035a47ffabd84ea12d1d393148efa3615/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36", size = 4735650, upload-time = "2026-06-12T20:02:41.389Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/a0/db537264e234f7273a73ec020873d6d6b39dfd8a53db78b550ca8320440e/cryptography-49.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e", size = 4834820, upload-time = "2026-06-12T20:01:51.847Z" },
+    { url = "https://files.pythonhosted.org/packages/93/77/8df9eb486495979bccecd1062e2eaf435250e84437040295b57d09048b0b/cryptography-49.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b", size = 4967968, upload-time = "2026-06-12T20:02:12.524Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/e6/f60198ea8d9dfa15fff9ed4ca02ce362f6eadd9ba757dcc50634c4257b63/cryptography-49.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001", size = 3785547, upload-time = "2026-06-12T20:02:26.847Z" },
 ]
 
 [[package]]
diff --git a/code_review.md b/code_review.md
new file mode 100644
index 00000000..bb0a23e5
--- /dev/null
+++ b/code_review.md
@@ -0,0 +1,23 @@
+# WeFa Review Checklist
+
+Use this checklist when the task is a review rather than an implementation.
+
+## Output Shape
+
+- Findings first, ordered by severity, with file references.
+- Keep summaries brief and secondary to the findings.
+- If there are no findings, say so explicitly and call out any residual risk or missing verification.
+
+## Review Priorities
+
+1. Correctness issues, behavioural regressions, broken contracts, and risky edge cases.
+2. Missing tests, especially for non-default or opt-in paths.
+3. API, documentation, release, or versioning impacts that were not updated alongside the change.
+4. Auth, cookie, session, and security-sensitive concerns.
+5. Maintainability issues that materially raise future change risk.
+
+## WeFa-Specific Prompts
+
+- Check that generated artifacts and documented contracts stay in sync.
+- Call out missing workspace quality-gate coverage when the change crosses `django/`, `bff/`, or `vue/`.
+- For Vue work, treat untranslated user-facing text as a review issue.
diff --git a/django/AGENTS.md b/django/AGENTS.md
index 23f53279..3d41adff 100644
--- a/django/AGENTS.md
+++ b/django/AGENTS.md
@@ -4,45 +4,50 @@
 
 This file applies to the Django toolkit in `django/`. The package publishes `nside-wefa` and contains reusable apps under `nside_wefa/` plus the `demo/` project used for local and CI validation.
 
-Read `django/README.md` and `django/CONTRIBUTE.md` before changing public behavior, settings, migrations, or release-facing docs.
+Read [README.md](README.md) and [CONTRIBUTE.md](CONTRIBUTE.md) before changing public behavior, settings, migrations, or release-facing docs.
 
 ## Architecture Rules
 
-- Extend existing apps when the domain fits: `common`, `authentication`, `legal_consent`, `locale`, `audit`, `attachments`, `admin_theme`, or `utils`.
-- Mirror the existing app layout: `apps.py`, `checks.py`, `models/`, `serializers.py`, `urls.py`, `views/`, `tests/`, and app-level README files where applicable.
-- Keep all project configuration under the `NSIDE_WEFA` settings dictionary. New settings need defaults, Django system checks, tests, and README documentation.
+- Extend existing apps when the domain fits: `common`, `utils`, `authentication`, `legal_consent`, `locale`, and `audit`.
+- Mirror the existing app layout: `apps.py`, `checks.py`, models, serializers, URLs, views, tests, and app-level README files where applicable.
+- Keep all project configuration under the `NSIDE_WEFA` settings dictionary.
+- Read settings through `nside_wefa.common.settings` helpers instead of inventing new config wrappers.
 - `nside_wefa.common` is foundational and should remain before dependent WeFa apps in `INSTALLED_APPS` examples.
-- Prefer Django and DRF conventions over custom framework code. Put shared authentication or request helpers under the nearest `utils/` module.
-- Expose app routes through `include("nside_wefa.<app>.urls")` and cover URL/API behavior in tests.
+- Register system checks from `apps.py.ready()` and cover new settings with Django system-check validation.
+- Prefer Django and DRF conventions over custom framework code. Expose app routes through `include("nside_wefa.<app>.urls")`.
 
-## Data, Migrations, And Checks
+## Models, Signals, And Migrations
 
-- Add migrations only when model state changes. Keep them reversible unless Django cannot reasonably reverse the operation.
-- Run `python manage.py makemigrations --check --dry-run` when model or field definitions change.
-- Run `python manage.py check` or targeted system-check tests when changing settings contracts.
 - Preserve existing data semantics for legal consent, audit events, locale preferences, and authentication unless the task explicitly defines a migration path.
+- One-to-one user companion models should follow the existing toolkit pattern, including idempotent signal wiring.
+- Add migrations only when model state changes, and keep them reversible unless Django cannot reasonably reverse the operation.
+- Backfill existing users when introducing one-to-one models tied to `AUTH_USER_MODEL`.
 - Audit-related changes must preserve append-only expectations and document any tamper-evident or retention behavior changes.
 
-## Documentation And Tests
+## Tests And Docs
 
-- Update `django/README.md`, app READMEs, or demo snippets when configuration, URLs, APIs, or behavior changes.
 - Add pytest coverage for new branches, validation checks, serializers, views, management commands, and migrations where relevant.
-- Use the demo project for manual verification when behavior depends on Django settings or installed app ordering.
+- Test opt-in flags with the flag enabled, not only default settings.
+- Update `django/README.md`, app READMEs, and demo snippets when configuration, URLs, APIs, or behavior changes.
+- Use the `demo/` project for manual verification when behavior depends on Django settings or installed-app ordering.
 
 ## Validation Commands
 
 Run from `django/` unless noted:
 
 ```bash
-uv run ruff check .
-uv run ruff format --check .
-DJANGO_SETTINGS_MODULE=demo.settings uv run mypy --install-types --non-interactive .
-python manage.py makemigrations --check --dry-run
-python manage.py migrate --plan
-python manage.py migrate --noinput
-uv run pytest --cov-config=.coveragerc --cov-report xml --cov .
-uvx pysentry-rs --config .pysentry.toml .
-uv run bandit -c pyproject.toml -r nside_wefa -n 3 -l
+uv sync --all-extras
+uv run pytest
+uv run ruff check nside_wefa demo
+uv run ruff format --check nside_wefa demo
+uv run mypy nside_wefa/
+uv run python manage.py check
+uv run python manage.py makemigrations --check --dry-run
 ```
 
-If running a smaller subset, choose the narrowest command that exercises the changed app and state what remains unrun.
+If running a smaller subset while iterating, choose the narrowest command that exercises the changed app and state what remains unrun.
+
+## When In Doubt
+
+- Mirror the closest existing app, usually `audit/` for the fullest reference or `locale/` for the smallest end-to-end shape.
+- Check [../docs/agent-roadmap.md](../docs/agent-roadmap.md) before inventing new cross-cutting infrastructure.
diff --git a/django/CONTRIBUTE.md b/django/CONTRIBUTE.md
index 165c16a8..198a9556 100644
--- a/django/CONTRIBUTE.md
+++ b/django/CONTRIBUTE.md
@@ -3,6 +3,8 @@
 Thank you for your interest in contributing to N-SIDE WeFa!
 This document provides guidelines and instructions for setting up your development environment and contributing to the project.
 
+> **Working with an AI agent (Codex, Claude Code, Copilot, etc.)?** Read [`AGENTS.md`](AGENTS.md) for the curated backend conventions, the quality gate, the new-app checklist, and known gotchas. This CONTRIBUTE.md focuses on the human contributor onboarding flow.
+
 ## Table of Contents
 
 - [Development Setup](#development-setup)
diff --git a/skills/wefa-tanstack-query/SKILL.md b/skills/wefa-tanstack-query/SKILL.md
deleted file mode 100644
index f4b393ae..00000000
--- a/skills/wefa-tanstack-query/SKILL.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-name: wefa-tanstack-query
-description: TanStack Query Vue v5 implementation and review guide for the WeFa `vue/` workspace. Use when adding or reviewing `@tanstack/vue-query` setup, query or mutation flows, cache invalidation, optimistic updates, query keys, or QueryClient defaults, and when deciding whether to use WeFa wrappers (`apiClient`, `typedApiClient`) versus direct TanStack hooks.
----
-
-# WeFa TanStack Query
-
-Apply TanStack Query Vue v5 with official v5 patterns while preserving WeFa's preferred wrapper-first architecture.
-
-## First Reads
-
-1. Read `references/wefa-conventions.md` first for repo-specific rules and preferred entrypoints.
-2. Read `references/official-v5-patterns.md` when a task depends on cache semantics, reactivity, mutations, cancellation, or migration details.
-3. Re-read `vue/src/network/network.mdx`, `vue/README.md`, and `vue/CONTRIBUTE.md` before changing public APIs or developer guidance.
-
-## Decision Order
-
-1. Prefer `typedApiClient` from `@/network` or `@nside/wefa/network` when an OpenAPI-generated callable exists.
-2. Prefer `apiClient` when the call is a straightforward URL-based GET or POST and reactive URL refs are enough.
-3. Use direct TanStack hooks (`useQuery`, `useMutation`, `useInfiniteQuery`, `queryOptions`) only when the wrappers cannot model the behavior cleanly.
-4. Use `useQueryClient` whenever wrapper-backed flows still need invalidation or other cache management.
-5. Use `axiosInstance` directly only when the task does not need TanStack-managed server state or when you are implementing infrastructure beneath the wrappers.
-
-## Setup Workflow
-
-1. Confirm app-level installation before feature work:
-   `app.use(VueQueryPlugin)` must happen during startup.
-2. If the app needs non-default cache behavior, pass `queryClientConfig` or a stable `QueryClient` instance to `VueQueryPlugin`; do not create query clients inside components or composables.
-3. Configure `axiosInstance.defaults.baseURL` when env-based backend wiring is absent.
-4. When OpenAPI codegen exists, call `typedApiClient.setupOpenApiClient(client)` during startup before using generated SDK callables.
-
-## Query Workflow
-
-1. Build reactive inputs first.
-   For existing WeFa wrappers, pass `ref`, `toRef`, or `computed` values that match the current `Ref<... | undefined>` signatures. For new direct-hook composables, accept refs, plain values, or reactive getters when that improves ergonomics.
-2. Put every query dependency into the query key.
-   If `queryFn` depends on a changing variable, that variable belongs in the key.
-3. Prefer wrapper signatures that already encode WeFa's reactive patterns:
-   `apiClient.query(refUrl)` and `typedApiClient.query(callable, refOptions)`.
-4. Use `queryOptions(...)` to share direct-query configuration across `useQuery`, `useQueries`, or prefetching sites.
-5. Treat returned query data as immutable.
-   Copy it before binding to `v-model` or mutating it locally.
-6. Pass the provided `signal` through custom direct-query functions when cancellation matters and the transport supports it.
-
-## Mutation Workflow
-
-1. Start with `typedApiClient.mutation(...)` or `apiClient.mutation(...)` unless direct hooks are required.
-2. After successful mutations, prefer one of two cache-update paths:
-   invalidate related queries with `useQueryClient().invalidateQueries(...)`, or
-   write returned entity data into the cache with `setQueryData(...)` only when you own the exact key shape or a direct-hook abstraction exposes it clearly.
-3. Await invalidations when the mutation should remain pending until related queries are refreshed.
-4. Use optimistic updates only when the UX gain is worth the rollback complexity; pair them with `onMutate`, rollback context, and targeted invalidation.
-
-## Review Checklist
-
-1. Prefer WeFa wrappers over raw TanStack hooks unless there is a concrete gap.
-2. Keep query keys complete, stable, and consistent with the fetch inputs.
-3. Use reactive values correctly; avoid extracting `.value` too early and accidentally freezing reactivity.
-4. Adjust `staleTime`, `gcTime`, retries, or refetch triggers intentionally instead of cargo-culting defaults.
-5. Update docs, tests, and public exports when adding new wrappers or network helpers.
-6. Use TanStack Query v5 names and semantics:
-   `gcTime` instead of `cacheTime`, `throwOnError` instead of `useErrorBoundary`, and `placeholderData` when replacing old `keepPreviousData` behavior.
-7. Reject common pre-v5 patterns:
-   positional hook overloads, `onSuccess` or `onError` on queries, infinite queries without `initialPageParam` and `getNextPageParam`, or `useQueries` code that assumes a reactive array instead of a `ref`.
-
-## Testing
-
-1. For wrapper tests in `vue/src/network/__tests__`, mock `@tanstack/vue-query` directly and assert the wrapper configuration.
-2. For feature or component tests, mock `@/network` instead of TanStack internals unless the feature truly owns the hook configuration.
-3. Use `vue/CONTRIBUTE.md` as the source of truth for the current Vue quality gates and validation commands.
-4. If the task also changes frontend behavior outside the network layer, follow the matching validation expectations from `skills/wefa-vue-frontend/SKILL.md` instead of redefining them here.
diff --git a/skills/wefa-tanstack-query/agents/openai.yaml b/skills/wefa-tanstack-query/agents/openai.yaml
deleted file mode 100644
index 8caf5a52..00000000
--- a/skills/wefa-tanstack-query/agents/openai.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-interface:
-  display_name: "WeFa TanStack Query"
-  short_description: "Guide WeFa TanStack Query v5 usage"
-  default_prompt: "Use $wefa-tanstack-query to implement or review TanStack Query Vue v5 usage in the `vue/` workspace."
diff --git a/skills/wefa-tanstack-query/references/official-v5-patterns.md b/skills/wefa-tanstack-query/references/official-v5-patterns.md
deleted file mode 100644
index 244a33ef..00000000
--- a/skills/wefa-tanstack-query/references/official-v5-patterns.md
+++ /dev/null
@@ -1,111 +0,0 @@
-# Official TanStack Query Vue v5 Patterns
-
-This file distills the official Vue v5 docs into the guidance most likely to matter in WeFa work.
-
-## Source Pages
-
-- Overview: `https://tanstack.com/query/v5/docs/framework/vue/overview`
-- Reactivity: `https://tanstack.com/query/v5/docs/framework/vue/reactivity`
-- Important Defaults: `https://tanstack.com/query/v5/docs/framework/vue/guides/important-defaults`
-- Query Keys: `https://tanstack.com/query/v5/docs/framework/vue/guides/query-keys`
-- Query Options: `https://tanstack.com/query/v5/docs/framework/vue/guides/query-options`
-- Mutations: `https://tanstack.com/query/v5/docs/framework/vue/guides/mutations`
-- Invalidations from Mutations: `https://tanstack.com/query/v5/docs/framework/vue/guides/invalidations-from-mutations`
-- Updates from Mutation Responses: `https://tanstack.com/query/v5/docs/framework/vue/guides/updates-from-mutation-responses`
-- Optimistic Updates: `https://tanstack.com/query/v5/docs/framework/vue/guides/optimistic-updates`
-- Query Cancellation: `https://tanstack.com/query/v5/docs/framework/vue/guides/query-cancellation`
-- Custom Client: `https://tanstack.com/query/v5/docs/framework/vue/guides/custom-client`
-- Migrating to v5: `https://tanstack.com/query/v5/docs/framework/vue/guides/migrating-to-v5`
-
-## Important Defaults
-
-- Cached query data is stale by default.
-- Stale queries refetch automatically when a new instance mounts, the window refocuses, or the network reconnects.
-- Inactive queries remain cached and are garbage-collected after 5 minutes by default.
-  This 5-minute horizon is TanStack's default inactive-query `gcTime`, not a WeFa-specific policy.
-- Failed queries retry 3 times with exponential backoff by default.
-  These are TanStack defaults: `retry` defaults to `3`, and the default `retryDelay` doubles from 1000 ms up to 30000 ms.
-- Query results are structurally shared by default, which preserves references when JSON-compatible data has not meaningfully changed.
-
-Implication:
-
-- Set `staleTime` intentionally before disabling refetch triggers.
-- If your app needs a different inactive-query cache horizon, change the default query `gcTime`.
-- If your app needs different retry behavior, change the default query `retry` and `retryDelay` options globally or per-query. Use `retry: false`, a number, or a function; use `retryDelay` as either a fixed number or a function.
-- Change `gcTime`, `retry`, or refetch policies only when the UX or API cost justifies it.
-
-## Reactivity Rules
-
-- `queryKey` and `enabled` can consume reactive values.
-- If a query should refetch when an input changes, pass the ref or reactive getter itself, not an eagerly-unwrapped `.value`.
-- For composables, prefer parameter types that accept plain values, refs, or reactive getters when the API benefits from both reactive and non-reactive use sites.
-- Query results are immutable; create a copy before editing or two-way binding.
-
-## Query-Key Rules
-
-- Include every changing variable that the query function depends on.
-- Array item order matters in keys.
-- Object property order inside a key segment does not matter because keys are hashed deterministically.
-
-Implication:
-
-- When a fetch depends on filters, pagination, IDs, locale, or auth-relevant scope, put those into the key.
-
-## Shared Query Definitions
-
-Use `queryOptions(...)` when the same key, function, and defaults need to be reused across:
-
-- `useQuery`
-- `useQueries`
-- prefetching
-- imperative cache reads/writes tied to the same key
-
-This keeps the authoritative query shape in one place while preserving strong TypeScript inference.
-
-## Mutation Rules
-
-- Mutations do not update related queries automatically.
-- After success, either invalidate related queries or update the cache directly with `setQueryData(...)`.
-- If the mutation response already contains the full updated entity, prefer `setQueryData(...)` over a blind refetch.
-- If follow-up invalidations must finish before the mutation is considered complete, return or await the invalidation promise from `onSuccess`.
-
-## Optimistic Updates
-
-Use optimistic updates only when:
-
-- the interaction benefits materially from immediate UI feedback, and
-- you can define a safe rollback strategy
-
-Typical shape:
-
-1. `onMutate`: cancel overlapping queries, snapshot previous cache, write optimistic value
-2. `onError`: roll back with the snapshot
-3. `onSettled` or `onSuccess`: invalidate the affected queries
-
-## Cancellation
-
-- Direct query functions receive an `AbortSignal`.
-- If your transport supports cancellation, pass the signal through.
-- Manual cancellation uses `queryClient.cancelQueries({ queryKey })`.
-
-This matters most for long-running or rapidly-changing direct queries.
-
-## Custom Client
-
-- `VueQueryPlugin` accepts either `queryClientConfig` or a prebuilt `QueryClient`.
-- Keep the client stable and app-scoped.
-- Reach for a custom client only when defaults or integration requirements demand it.
-
-## v5 Migration Notes
-
-- v5 only supports the single-object hook signature. Do not copy older positional overloads like `useQuery(key, fn, options)`.
-- Query callbacks were removed from `useQuery` and `QueryObserver`; do not add `onSuccess`, `onError`, or `onSettled` to query options. Mutation callbacks still exist.
-- `cacheTime` was renamed to `gcTime`.
-- `useErrorBoundary` was renamed to `throwOnError`.
-- `keepPreviousData` behavior now maps to `placeholderData` with the previous value identity pattern.
-- Infinite queries now require `initialPageParam`, and `getNextPageParam` is required when using infinite-query pagination.
-- `useQueries` now returns a `ref` that wraps the array instead of returning a reactive array directly.
-- Query and mutation loading state terminology changed: `status: loading` became `status: pending`, and `isLoading` on mutations became `isPending`.
-- The removed hook-level `context` prop from older examples was replaced by passing a custom `queryClient`; in Vue, `queryClientKey` is still supported through `VueQueryPlugin` and per-query options when custom client keys are needed.
-
-If you encounter older examples or local code written against v4 language, translate them to these v5 terms before copying the pattern.
diff --git a/skills/wefa-tanstack-query/references/wefa-conventions.md b/skills/wefa-tanstack-query/references/wefa-conventions.md
deleted file mode 100644
index db8ac2b9..00000000
--- a/skills/wefa-tanstack-query/references/wefa-conventions.md
+++ /dev/null
@@ -1,97 +0,0 @@
-# WeFa TanStack Query Conventions
-
-## Purpose
-
-Capture the project-specific rules that sit on top of TanStack Query Vue v5 in this repository.
-
-## Preferred Entry Points
-
-1. `vue/src/network/typedApiClient.ts`
-   Use first when the backend exposes OpenAPI-generated callables.
-2. `vue/src/network/apiClient.ts`
-   Use for simple URL-based GET and POST flows.
-3. Direct `@tanstack/vue-query` hooks
-   Use only when the wrappers do not cover the required behavior.
-4. `vue/src/network/axios.ts`
-   Use directly only for lower-level infrastructure or non-cached calls.
-
-This mirrors the order documented in `vue/src/network/network.mdx`.
-
-## Existing Wrapper Patterns
-
-### `apiClient.query`
-
-- Input shape: `Ref<string | undefined>`
-- Key shape: `[url]`
-- Fetch suppression: `enabled: () => !!url.value`
-- Query function behavior: return `undefined` when the URL is absent
-- Current wrapper boundary: do not pass plain values or reactive getters directly; wrap prop access with `toRef`, `computed`, or another `Ref`-producing helper first
-
-### `typedApiClient.query`
-
-- Input shape: generated callable plus `Ref<TOptions | undefined>`
-- Key shape: `[callable.name, options]`
-- Fetch suppression: `enabled: () => !!options.value`
-- Query function behavior:
-  - return `undefined` when options are absent
-  - unwrap `result.data`
-  - throw results that expose `isAxiosError`
-- Current wrapper boundary: plain values and reactive getters are excellent for new direct-hook composables, but this wrapper still expects a `Ref`
-
-### `typedApiClient.mutation`
-
-- Wrap generated POST/PUT/DELETE callables
-- Unwrap `result.data`
-- Throw Axios-like errors when `isAxiosError` is present
-
-## Startup Order In This Repo
-
-See `vue/src/demo/main.ts` for the concrete example.
-
-1. `app.use(VueQueryPlugin)`
-2. Configure `axiosInstance.defaults.baseURL` if env wiring is not present
-3. Call `typedApiClient.setupOpenApiClient(client)` when generated SDK code exists
-4. Continue app/plugin/router/i18n setup
-
-There is currently no custom `QueryClient` policy in the demo app. If you add one, keep it app-level and document why the defaults were changed.
-
-## Query-Key Guidance For Repo Work
-
-Use the existing wrapper key shapes unless you are intentionally upgrading the abstraction.
-
-- URL wrapper: `[url]`
-- Typed wrapper: `[callable.name, options]`
-
-If you introduce a new reusable direct-hook composable, prefer a small local key factory or `queryOptions(...)` helper instead of scattering ad-hoc keys across components.
-If you need `setQueryData(...)`, prefer doing it in abstractions that own the exact key shape. Wrapper-backed feature code should usually invalidate instead of reconstructing internal keys by hand.
-
-## Testing Boundaries
-
-### Wrapper tests
-
-Files:
-
-- `vue/src/network/__tests__/apiClient.test.ts`
-- `vue/src/network/__tests__/typedApiClient.test.ts`
-
-Pattern:
-
-- mock `@tanstack/vue-query`
-- assert `queryKey`, `enabled`, forwarded options, and unwrapped/raised results
-
-### Feature tests
-
-Example:
-
-- `vue/src/plugins/legalConsent/views/__tests__/LegalDocument.test.ts`
-
-Pattern:
-
-- mock `@/network`
-- test the feature against the wrapper return shape instead of TanStack internals
-
-## Documentation To Keep In Sync
-
-- `vue/src/network/network.mdx` when public guidance changes
-- `vue/README.md` if package-level setup or exports change
-- `vue/CONTRIBUTE.md` if validation steps or expected checks change
diff --git a/skills/wefa-vue-frontend/SKILL.md b/skills/wefa-vue-frontend/SKILL.md
deleted file mode 100644
index ac5d5cf3..00000000
--- a/skills/wefa-vue-frontend/SKILL.md
+++ /dev/null
@@ -1,66 +0,0 @@
----
-name: wefa-vue-frontend
-description: Frontend implementation and review guide for the N-SIDE WeFa Vue package. Use when coding or reviewing files under `vue/`, especially `vue/src/components`, `vue/src/containers`, `vue/src/locales`, Storybook stories or MDX docs, router/network/plugins/stores helpers, demo wiring, and frontend tests.
----
-
-# WeFa Vue Frontend
-
-Apply the WeFa Vue workspace standards with predictable discovery, implementation, and validation steps.
-
-## First Reads
-1. Read `vue/README.md` for package capabilities, exports, and workspace scripts.
-2. Read `vue/CONTRIBUTE.md` for quality gates and contribution expectations.
-3. Read `vue/scripts/files/copilot-instructions.md` when the task changes UI composition patterns or component selection.
-
-## Workspace Map
-1. Start public-surface discovery at `vue/src/lib.ts` and `vue/src/containers/index.ts`.
-2. Expect feature folders to keep neighbors together: component or container source, `index.ts`, stories, MDX docs, and tests in the same folder.
-3. Use `vue/src/locales/index.ts` plus `vue/src/locales/<locale>/*.json` for library i18n wiring.
-4. Check `vue/src/network`, `vue/src/router`, `vue/src/plugins`, and `vue/src/stores` before adding duplicate helpers.
-5. Treat `vue/src/demo` and `vue/src/demo/openapi` as the manual-validation and generated-client surface for demo flows.
-
-## Implementation Rules
-1. Start from the nearest existing feature and mirror its folder shape, naming, and test style instead of inventing a new pattern.
-2. Reuse existing WeFa exports before building anything new; inspect the nearest `index.ts` files and the library entrypoints first.
-3. Compose with PrimeVue if WeFa does not provide the needed UI.
-4. Fall back to native HTML only when higher tiers fail, and leave a brief inline justification comment when the fallback is not obvious.
-5. Prefer Tailwind utility classes for routine styling. Do not add new CSS imports. Use scoped styles or bound style objects only when the existing feature pattern needs layout math, chart sizing, or other cases Tailwind cannot express cleanly.
-6. Prefer `const { prop = defaultValue } = defineProps<Type>()` for defaults and avoid `withDefaults()` unless the local file pattern already depends on it.
-7. Keep user-facing literals translated through i18n keys (`useI18nLib`, `t`, `$t`), including `aria-label`, `title`, placeholders, validation copy, and button labels.
-8. When a change creates or exposes new public surface, update the nearest `index.ts` and shared entrypoints such as `vue/src/lib.ts` or `vue/src/containers/index.ts` as needed.
-9. Regenerate or reuse generated OpenAPI client artifacts through the existing script instead of hand-editing generated files.
-
-## Delivery Workflow
-1. Inspect existing implementation first:
-   Search for a neighboring component, container, plugin, store, or network helper that already solves most of the problem.
-2. Confirm the reuse hierarchy:
-   WeFa component reuse, then PrimeVue composition, then native HTML fallback.
-3. Implement with local conventions:
-   Match adjacent prop patterns, file names, exports, and test naming (`.spec.ts`, `.test.ts`, or `__tests__`) used by that feature.
-4. Wire localization:
-   Add or update locale namespaces under `vue/src/locales/<locale>/` and use `useI18nLib` or `$t` in code. If a story or test needs extra messages, register them through the existing locale helpers.
-5. Update supporting artifacts:
-   Update stories and MDX docs when props, states, a11y guidance, or usage changed. Update demo wiring when the change affects routed or integrated flows.
-6. Validate before handoff:
-   `npm run lint-check`
-   `npm run type-check`
-   `npm run format-check`
-   `npm run test:unit -- --reporter=dot --silent`
-   `npm run build`
-   `npm run test:e2e -- --reporter=dot` when routing, demo flows, or browser interactions changed
-
-## Test Output Discipline
-1. Always run tests with low-verbosity flags to limit terminal noise and token usage.
-2. Keep the minimal reporters above unless debugging failures requires temporary extra detail.
-3. If extra verbosity is needed for debugging, rerun only the failing test scope with detailed output.
-
-## References
-- Read `vue/README.md` and `vue/CONTRIBUTE.md` for project workflows.
-- Read `vue/src/locales/Translation.mdx` when adding or reshaping translations.
-
-## Definition of Done
-1. UI follows WeFa/PrimeVue/Tailwind hierarchy.
-2. User-facing literals are translated.
-3. Public exports and supporting entrypoints are updated when surface area changes.
-4. Tests, stories, docs, and demo wiring are updated for behaviour changes.
-5. Required lint, type, format, unit-test, build, and relevant e2e checks pass.
diff --git a/skills/wefa-vue-frontend/agents/openai.yaml b/skills/wefa-vue-frontend/agents/openai.yaml
deleted file mode 100644
index 6b189763..00000000
--- a/skills/wefa-vue-frontend/agents/openai.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-interface:
-  display_name: "WeFa Vue Frontend"
-  short_description: "Implement and review WeFa Vue frontend changes"
-  default_prompt: "Use $wefa-vue-frontend to implement or review a change in the `vue/` workspace following WeFa frontend conventions."
diff --git a/vue/.github/copilot-instructions.md b/vue/.github/copilot-instructions.md
new file mode 100644
index 00000000..d6c8ed77
--- /dev/null
+++ b/vue/.github/copilot-instructions.md
@@ -0,0 +1,15 @@
+# WeFa Vue Compatibility Instructions
+
+This file exists only for tools that look specifically for `copilot-instructions.md`.
+
+## Source Of Truth
+
+- Start with [`../AGENTS.md`](../AGENTS.md).
+- For reusable frontend workflows, read [`../../.agents/skills/wefa-vue-frontend/SKILL.md`](../../.agents/skills/wefa-vue-frontend/SKILL.md).
+- For TanStack Query work, also read [`../../.agents/skills/wefa-tanstack-query/SKILL.md`](../../.agents/skills/wefa-tanstack-query/SKILL.md).
+
+## Notes
+
+- Keep durable Vue workspace rules in `vue/AGENTS.md`.
+- Keep reusable workflow instructions in `.agents/skills/`.
+- Do not duplicate those rules here.
diff --git a/vue/AGENTS.md b/vue/AGENTS.md
index 2b35e529..5794a6fd 100644
--- a/vue/AGENTS.md
+++ b/vue/AGENTS.md
@@ -2,59 +2,52 @@
 
 ## Scope
 
-This file applies to the `@nside/wefa` Vue 3 workspace in `vue/`: components, containers, composables, stores, router helpers, network helpers, locales, demo code, Storybook docs, tests, and CLI installer assets.
+This file applies to the `@nside/wefa` Vue 3 workspace in `vue/`: components, containers, composables, stores, router helpers, network helpers, locales, demo code, Storybook docs, tests, and packaging helpers.
 
-Read `vue/README.md` and `vue/CONTRIBUTE.md` before changing public exports, package behavior, docs, or validation commands. Use `$wefa-vue-frontend` for frontend implementation and review work. Use `$wefa-tanstack-query` for TanStack Query setup, query/mutation flows, cache invalidation, query keys, and network wrapper decisions.
+Read [README.md](README.md) and [CONTRIBUTE.md](CONTRIBUTE.md) before changing public exports, package behavior, docs, or validation commands.
 
-## UI And Composition Rules
-
-- Treat public WeFa components as an enhancement layer over PrimeVue: they should wrap, extend, or compose PrimeVue behavior with clear added value for consumers.
-- Reuse WeFa exports first. Start public-surface discovery at `src/lib.ts`, `src/containers/index.ts`, and nearest feature `index.ts` files.
-- If WeFa does not provide the needed UI, compose PrimeVue components before using native HTML.
-- Use native HTML only when WeFa and PrimeVue cannot model the requirement cleanly; leave a brief inline justification when the fallback is not obvious.
-- Prefer Tailwind utility classes for routine styling. Do not add new CSS imports.
-- Use scoped styles or bound style objects only when an existing feature pattern or layout math makes Tailwind impractical.
-- Follow adjacent component patterns for props, emits, file names, tests, stories, and docs. Prefer `const { prop = defaultValue } = defineProps<Type>()` for defaults unless local code already uses another pattern.
-- Use the `@/*` alias for source imports when it improves clarity and matches nearby files.
+## Skill Routing
 
-## Component Deliverables
+- Load `wefa-vue-cookbook` first for any Vue work here.
+- `wefa-vue-cookbook` is the shared base skill for the WeFa Vue ecosystem: it applies to consuming projects that use `@nside/wefa`, and it also applies inside this repository for the shared conventions that the library follows too.
+- After the cookbook, load `wefa-vue-frontend` for repo-specific maintainer guidance in this `vue/` workspace.
+- `wefa-vue-frontend` adds only repo-specific rules for exports, Storybook and MDX docs, demo wiring, generated artifacts, frontend tests, and the package quality gate.
+- For TanStack Query setup, query or mutation flows, invalidation, or wrapper-choice work, also use `wefa-tanstack-query`.
+- [`.github/copilot-instructions.md`](.github/copilot-instructions.md) is a compatibility pointer only, not the source of truth.
 
-- New public components should include the SFC, colocated Storybook stories, colocated unit tests, and consumer-facing MDX docs when usage or accessibility guidance is non-trivial.
-- Storybook stories should demonstrate meaningful states and interactions; do not add the `autodocs` tag unless the Storybook setup changes to require it.
-- Use Storybook for isolated manual validation when component behavior, visual states, or accessibility affordances change.
-
-## Localization, Exports, And Generated Code
+## UI And Composition Rules
 
-- Route user-facing literals through the library i18n helpers, including labels, placeholders, validation copy, titles, and accessibility text.
-- Add or update locale resources under `src/locales/<locale>/` when library copy changes.
-- When adding public surface, update nearest `index.ts` files and shared entrypoints such as `src/lib.ts` or `src/containers/index.ts`.
-- Do not hand-edit generated OpenAPI client artifacts. Regenerate them with the existing script when needed.
-- Prefer existing network wrappers: `typedApiClient` for generated callables, `apiClient` for URL-based flows, and direct TanStack hooks only when wrappers cannot model the behavior cleanly.
+- Treat public WeFa components as an enhancement layer over PrimeVue.
+- Reuse hierarchy is strict: WeFa component or container first, then PrimeVue composition, then native HTML only when neither higher layer fits cleanly.
+- Reuse public-surface exports first. Start discovery at `src/lib.ts`, `src/containers/index.ts`, and nearby feature `index.ts` files.
+- Prefer Tailwind utility classes for routine styling. Do not add new CSS imports for routine work.
+- Use scoped styles only when an existing local pattern or unavoidable layout math makes Tailwind impractical.
+- Follow adjacent component patterns for props, emits, tests, stories, docs, and file naming.
+- Keep user-facing literals translated, including labels, placeholders, validation copy, `title`, and accessibility text.
 
-## Stories, Docs, And Tests
+## Repo-Specific Rules
 
-- New or changed components need Storybook stories and tests matching the nearby feature style.
-- Add MDX docs when usage, accessibility, states, or props need consumer-facing guidance.
-- Update demo wiring when routed or integrated flows change.
-- Keep Storybook docs and README-facing examples consistent with implementation.
-- Place tests in the layer that owns the behavior: component tests beside component folders, network wrapper tests under `src/network/__tests__`, store/router/locales tests near their modules, and Playwright specs under `e2e/`.
-- Mock the highest stable boundary in tests: feature tests should usually mock WeFa network helpers, while network wrapper tests may mock transport or TanStack Query internals directly.
-- Codex guidance should come from `AGENTS.md` files and skills, not generated assistant instruction artifacts.
+- New or changed public components usually need source, stories, tests, and MDX docs when consumer guidance is non-trivial.
+- Update nearest `index.ts` files and shared entrypoints when public surface changes.
+- Treat `src/demo/` as a manual-validation surface, not as a home for reusable library logic.
+- Do not hand-edit generated demo OpenAPI client artifacts; regenerate them through the existing script.
+- Keep Storybook docs, demo flows, and README-facing examples aligned with implementation changes.
+- SFC block order is enforced: `<template>` then `<script>` then `<style>`.
+- Storybook stories should not add the `autodocs` tag unless the Storybook setup itself changes.
 
 ## Validation Commands
 
 Run from `vue/` unless noted:
 
 ```bash
-npm run type-check
+npm install
 npm run lint-check
+npm run type-check
 npm run format-check
 npm run test:unit -- --reporter=dot --silent
 npm run build
-npm run test:package-types
 npm run test:e2e -- --reporter=dot
-npm run knip -- --exclude exports,unlisted,duplicates,devDependencies,files
-npm audit --audit-level high
+npm run test:package-types
 ```
 
 Use `npm run test:e2e` when routing, demo flows, browser behavior, or integration paths change. Use `npm run test:package-types` when exports, packaging, declaration generation, or subpaths change. If running a subset, state what remains unrun.
diff --git a/vue/CONTRIBUTE.md b/vue/CONTRIBUTE.md
index 2dd0d110..b2b66950 100644
--- a/vue/CONTRIBUTE.md
+++ b/vue/CONTRIBUTE.md
@@ -4,6 +4,15 @@ Thanks for helping shape the WeFa (Web Factory) frontend library. This guide cov
 
 > **Namespace note**: the package is still published as `@nside/wefa` while we complete the rename. File paths and commands below use that scope until the transition lands.
 
+## Agent Guidance
+
+This document is for maintaining the Vue library inside this repository.
+
+- `../.agents/skills/wefa-vue-cookbook/SKILL.md` is the shared cookbook used by consuming projects that depend on `@nside/wefa`, and it is also the shared base guidance for this workspace.
+- `../.agents/skills/wefa-vue-frontend/SKILL.md` is the maintainer skill for this `vue/` workspace. Use it after the cookbook for repo-specific library work such as exports, Storybook or MDX docs, demo wiring, generated artifacts, and the Vue quality gate.
+
+See [AGENTS.md](AGENTS.md) for the workspace routing summary.
+
 ## Table of Contents
 
 - [Development Environment](#development-environment)
diff --git a/vue/README.md b/vue/README.md
index 1f08202b..c1711bd0 100644
--- a/vue/README.md
+++ b/vue/README.md
@@ -33,6 +33,15 @@ The library is built on top of the following ecosystem:
 
 A demo playground lives alongside the library so you can experiment locally while developing components.
 
+## Agent Guidance
+
+For AI-agent work, the Vue guidance is split intentionally:
+
+- `../.agents/skills/wefa-vue-cookbook/SKILL.md` is the shared cookbook. It is the base guidance for consuming projects that use `@nside/wefa`, and it is also the first skill to load when working inside this `vue/` workspace.
+- `../.agents/skills/wefa-vue-frontend/SKILL.md` is the maintainer skill for this repository's Vue library. Load it after the cookbook when the task is specific to maintaining the library itself, such as exports, Storybook or MDX docs, demo wiring, generated artifacts, or the Vue quality gate.
+
+See [AGENTS.md](AGENTS.md) for the workspace routing rules and [CONTRIBUTE.md](CONTRIBUTE.md) for the maintainer workflow.
+
 ## Feature Highlights
 
 - Rich component catalogue following the WeFa design language