diff --git a/.gitea/workflows/apply-supabase-profile-migrations.yml b/.gitea/workflows/apply-supabase-profile-migrations.yml
new file mode 100644
index 00000000..d804daab
--- /dev/null
+++ b/.gitea/workflows/apply-supabase-profile-migrations.yml
@@ -0,0 +1,60 @@
+name: Apply Supabase profile migrations
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: supabase-profile-migrations
+  cancel-in-progress: false
+
+env:
+  GITEA_SHA: ${{ gitea.sha }}
+  DEPLOY_HOST: 103.117.123.53
+  DEPLOY_PORT: '22000'
+  DEPLOY_USER: root
+  DEPLOY_PATH: /opt/jyotisha-app
+
+jobs:
+  apply:
+    runs-on: xiaoxin
+    timeout-minutes: 15
+    steps:
+      - name: Checkout current Gitea revision
+        run: |
+          set -euo pipefail
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin https://git.copse.top/root/Jyotisha.git
+          git fetch --no-tags origin "$GITEA_SHA" main
+          git checkout --detach --force "$GITEA_SHA"
+      - name: Verify runner toolchain and require current main
+        run: |
+          set -euo pipefail
+          python3 --version
+          node --version
+          npm --version
+          docker version
+          test "$(git rev-parse HEAD)" = "$(git ls-remote origin refs/heads/main | awk '{print $1}')"
+      - name: Configure SSH and apply reviewed files
+        env: { SSH_PRIVATE_KEY: '${{ secrets.PRODUCTION_SSH_PRIVATE_KEY }}' }
+        run: |
+          set -euo pipefail
+          install -m 700 -d ~/.ssh
+          printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/jyotisha-production; chmod 600 ~/.ssh/jyotisha-production
+          printf '%s\n' '[103.117.123.53]:22000 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQJvN2Mo3Yq8e6ZIK4P2blJ5Vjj0HbknEuk7TyjhMbO' > ~/.ssh/known_hosts
+          SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
+          remote="$DEPLOY_PATH/tmp/profile-migrations/$GITEA_RUN_NUMBER"
+          ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" "install -m 700 -d '$remote'"
+          rsync -az -e "ssh $SSH_OPTIONS" frontend/supabase/migrations/20260718*.sql frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql "$DEPLOY_USER@$DEPLOY_HOST:$remote/"
+          ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" "cd '$DEPLOY_PATH' && REMOTE_DIR='$remote' bash -s" <<'REMOTE'
+          set -euo pipefail
+          set +x
+          trap 'rm -rf "$REMOTE_DIR"' EXIT
+          set -a; . .env.production; set +a
+          DB_URL="${SUPABASE_DB_URL:-${DATABASE_URL:-}}"
+          test -n "$DB_URL"
+          for sql_file in "$REMOTE_DIR"/*.sql; do
+            echo "applying $(basename "$sql_file")"
+            docker run --rm -i postgres:16-alpine psql "$DB_URL" --set ON_ERROR_STOP=1 --quiet < "$sql_file"
+          done
+          REMOTE
diff --git a/.gitea/workflows/backend-quality-gate.yml b/.gitea/workflows/backend-quality-gate.yml
new file mode 100644
index 00000000..3e430e22
--- /dev/null
+++ b/.gitea/workflows/backend-quality-gate.yml
@@ -0,0 +1,147 @@
+name: Staging Backend Quality Gate
+
+on:
+  pull_request:
+    paths:
+      - '.gitea/workflows/backend-quality-gate.yml'
+      - '.gitea/workflows/deploy-staging.yml'
+      - '.gitea/workflows/migrate-staging-database.yml'
+      - 'deploy/**'
+      - 'frontend/**'
+      - 'jyotish_vedic/**'
+      - 'scripts/**'
+      - 'tests/**'
+      - 'mcp_server.py'
+      - 'pyproject.toml'
+      - 'requirements*.txt'
+  push:
+    branches: [staging]
+  workflow_dispatch:
+
+concurrency:
+  group: staging-quality-${{ gitea.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  actions: write
+
+jobs:
+  validate:
+    runs-on: xiaoxin
+    timeout-minutes: 45
+    env:
+      GITEA_SHA: ${{ gitea.sha }}
+    steps:
+      - name: Checkout exact Gitea revision
+        run: |
+          set -euo pipefail
+          [[ "$GITEA_SHA" =~ ^[0-9a-f]{40}$ ]]
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin https://git.copse.top/root/Jyotisha.git
+          git -c http.connectTimeout=15 -c http.lowSpeedLimit=1024 -c http.lowSpeedTime=30 \
+            fetch --depth=1 --no-tags origin "$GITEA_SHA"
+          git checkout --detach --force "$GITEA_SHA"
+          git clean -ffdx
+          test "$(git rev-parse HEAD)" = "$GITEA_SHA"
+          test -z "$(git status --porcelain --untracked-files=all)"
+
+      - name: Verify Linux runner toolchain
+        run: |
+          set -euo pipefail
+          python3 --version
+          node --version
+          npm --version
+          docker version
+
+      - name: Install dependencies
+        run: |
+          set -euo pipefail
+          python3 -m venv .venv
+          export PATH="$PWD/.venv/bin:$PATH"
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements.txt -r requirements-dev.txt playwright
+          python -m playwright install --with-deps chromium
+          npm ci --prefix frontend
+
+      - name: Validate backend, package, frontend, and database contracts
+        run: |
+          set -euo pipefail
+          export PATH="$PWD/.venv/bin:$PATH"
+          ruff check scripts/run_quality_gate.py tests/test_varga_bphs.py \
+            tests/test_ashtakavarga_invariants.py tests/test_cli_smoke.py \
+            tests/test_yoga_rules_integrity.py
+          python -m py_compile scripts/*.py jyotish_vedic/*.py mcp_server.py
+          python scripts/run_quality_gate.py \
+            --profile quick --skip-yoga-logic --skip-frontend-runtime
+          python scripts/commercial_privacy_artifact_scan.py --json
+          python -m build
+          npm test --prefix frontend
+          npm run lint --prefix frontend
+          npm run build --prefix frontend
+
+  publish:
+    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/staging'
+    needs: validate
+    runs-on: xiaoxin
+    timeout-minutes: 45
+    env:
+      GITEA_SHA: ${{ gitea.sha }}
+      GITEA_RUN_ATTEMPT: ${{ gitea.run_attempt }}
+      REGISTRY_HOST: crpi-d1feco6itet73spp.cn-hongkong.personal.cr.aliyuncs.com
+      IMAGE_REPOSITORY: crpi-d1feco6itet73spp.cn-hongkong.personal.cr.aliyuncs.com/copse/jyotisha
+    steps:
+      - name: Checkout exact Gitea revision
+        run: |
+          set -euo pipefail
+          [[ "$GITEA_SHA" =~ ^[0-9a-f]{40}$ ]]
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin https://git.copse.top/root/Jyotisha.git
+          git -c http.connectTimeout=15 -c http.lowSpeedLimit=1024 -c http.lowSpeedTime=30 \
+            fetch --depth=1 --no-tags origin "$GITEA_SHA"
+          git checkout --detach --force "$GITEA_SHA"
+          git clean -ffdx
+          test "$(git rev-parse HEAD)" = "$GITEA_SHA"
+          test -z "$(git status --porcelain --untracked-files=all)"
+
+      - name: Build and publish exact-SHA ACR images
+        env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          set -euo pipefail
+          cleanup() { docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true; }
+          trap cleanup EXIT
+          printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" --username "$REGISTRY_USERNAME" --password-stdin
+          docker build -f deploy/railway-api.Dockerfile -t "$IMAGE_REPOSITORY:api-$GITEA_SHA" .
+          docker build -f deploy/railway-web.Dockerfile -t "$IMAGE_REPOSITORY:web-$GITEA_SHA" .
+          docker push "$IMAGE_REPOSITORY:api-$GITEA_SHA"
+          docker push "$IMAGE_REPOSITORY:web-$GITEA_SHA"
+
+      - name: Record immutable linux-amd64 image manifest
+        run: |
+          set -euo pipefail
+          [[ "$GITEA_SHA" =~ ^[0-9a-f]{40}$ ]]
+          [[ "$GITEA_RUN_ATTEMPT" =~ ^[0-9]+$ ]]
+          select_digest='import json,sys; d=json.load(sys.stdin); xs=d if isinstance(d,list) else [d]; xs=[x for x in xs if isinstance(x,dict) and isinstance(x.get("Descriptor",x),dict)]; x=next((x for x in xs if x.get("Descriptor",x).get("platform",{}).get("os")=="linux" and x.get("Descriptor",x).get("platform",{}).get("architecture")=="amd64"),None); print(x.get("Descriptor",x).get("digest","") if x else "")'
+          api_digest="$(docker manifest inspect "$IMAGE_REPOSITORY:api-$GITEA_SHA" --verbose | python3 -c "$select_digest")"
+          web_digest="$(docker manifest inspect "$IMAGE_REPOSITORY:web-$GITEA_SHA" --verbose | python3 -c "$select_digest")"
+          [[ "$api_digest" =~ ^sha256:[0-9a-f]{64}$ ]]
+          [[ "$web_digest" =~ ^sha256:[0-9a-f]{64}$ ]]
+          install -d -m 700 artifacts/staging-images
+          umask 077
+          printf 'git_sha=%s\napi_digest=%s\nweb_digest=%s\n' \
+            "$GITEA_SHA" "$api_digest" "$web_digest" \
+            > artifacts/staging-images/manifest.env
+          node frontend/scripts/staging-image-manifest.mjs \
+            artifacts/staging-images/manifest.env "$GITEA_SHA" "$IMAGE_REPOSITORY" >/dev/null
+
+      - name: Upload immutable staging image manifest
+        uses: https://gitea.com/actions/upload-artifact@v4
+        with:
+          name: staging-image-manifest-${{ gitea.sha }}-${{ gitea.run_attempt }}
+          path: artifacts/staging-images/manifest.env
+          if-no-files-found: error
+          retention-days: 30
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 00000000..dc13e1b1
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,46 @@
+name: Jyotish Skill CI (manual)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: xiaoxin
+    timeout-minutes: 30
+    env:
+      GITEA_SHA: ${{ gitea.sha }}
+    steps:
+      - name: Checkout current Gitea revision
+        run: |
+          set -euo pipefail
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin https://git.copse.top/root/Jyotisha.git
+          git fetch --no-tags origin "$GITEA_SHA"
+          git checkout --detach --force "$GITEA_SHA"
+      - name: Verify runner toolchain
+        run: |
+          set -euo pipefail
+          python3 --version
+          node --version
+          npm --version
+          docker version
+      - name: Install and validate
+        env:
+          NEXT_PUBLIC_SUPABASE_URL: https://ci-placeholder.supabase.co
+          NEXT_PUBLIC_SUPABASE_ANON_KEY: ci-placeholder
+        run: |
+          set -euo pipefail
+          python3 -m venv .venv
+          export PATH="$PWD/.venv/bin:$PATH"
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements.txt -r requirements-dev.txt
+          npm ci --prefix frontend
+          ruff check scripts/run_quality_gate.py tests/test_varga_bphs.py tests/test_ashtakavarga_invariants.py tests/test_cli_smoke.py tests/test_yoga_rules_integrity.py
+          python -m py_compile scripts/*.py jyotish_vedic/*.py mcp_server.py
+          python scripts/run_quality_gate.py --profile quick --skip-yoga-logic --skip-frontend-runtime
+          python scripts/commercial_privacy_artifact_scan.py --json
+          npm test --prefix frontend
+          npm run lint --prefix frontend
+          npm run build --prefix frontend
+          python -m build
diff --git a/.gitea/workflows/deploy-production.yml b/.gitea/workflows/deploy-production.yml
new file mode 100644
index 00000000..7ef96484
--- /dev/null
+++ b/.gitea/workflows/deploy-production.yml
@@ -0,0 +1,59 @@
+name: Deploy production (manual only)
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: production
+  cancel-in-progress: false
+
+env:
+  GITEA_SHA: ${{ gitea.sha }}
+  DEPLOY_HOST: 103.117.123.53
+  DEPLOY_PORT: '22000'
+  DEPLOY_USER: root
+  DEPLOY_PATH: /opt/jyotisha-app
+
+jobs:
+  deploy:
+    runs-on: xiaoxin
+    timeout-minutes: 30
+    steps:
+      - name: Checkout current Gitea revision
+        run: |
+          set -euo pipefail
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin https://git.copse.top/root/Jyotisha.git
+          git fetch --no-tags origin "$GITEA_SHA" main
+          git checkout --detach --force "$GITEA_SHA"
+      - name: Verify runner toolchain and current main
+        run: |
+          set -euo pipefail
+          python3 --version
+          node --version
+          npm --version
+          docker version
+          test "$(git rev-parse HEAD)" = "$(git ls-remote origin refs/heads/main | awk '{print $1}')"
+      - name: Configure pinned production SSH
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.PRODUCTION_SSH_PRIVATE_KEY }}
+        run: |
+          set -euo pipefail
+          install -m 700 -d ~/.ssh
+          printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/jyotisha-production
+          chmod 600 ~/.ssh/jyotisha-production
+          printf '%s\n' '[103.117.123.53]:22000 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQJvN2Mo3Yq8e6ZIK4P2blJ5Vjj0HbknEuk7TyjhMbO' > ~/.ssh/known_hosts
+      - name: Sync and rebuild reviewed revision
+        run: |
+          set -euo pipefail
+          SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
+          rsync -az --delete --exclude='.git/' --exclude='.env.production' --exclude='frontend/node_modules/' --exclude='frontend/.next/' -e "ssh $SSH_OPTIONS" ./ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/"
+          ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" "cd '$DEPLOY_PATH' && GITHUB_SHA='$GITEA_SHA' docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build --remove-orphans"
+      - name: Verify production
+        run: |
+          set -euo pipefail
+          curl -fsS --retry 12 --retry-delay 5 https://jyotisha.chat/login >/dev/null
+          test "$(curl -sS -o /dev/null -w '%{http_code}' https://jyotisha.chat/api/account)" = 401
+          SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
+          ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" "cd '$DEPLOY_PATH' && docker compose --env-file .env.production -f deploy/docker-compose.server.yml exec -T web node -e 'fetch(\"http://api:5200/api/health\").then(async r=>{const b=await r.json();if(!r.ok||b.status!==\"ok\"||b.swisseph_available!==true)process.exit(1)})'"
diff --git a/.gitea/workflows/deploy-staging.yml b/.gitea/workflows/deploy-staging.yml
new file mode 100644
index 00000000..0fc142f1
--- /dev/null
+++ b/.gitea/workflows/deploy-staging.yml
@@ -0,0 +1,188 @@
+name: Deploy staging
+
+on:
+  workflow_run:
+    workflows: ["Staging Backend Quality Gate"]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      deploy_sha:
+        description: Exact tested 40-character staging commit SHA
+        required: true
+        type: string
+      allow_rollback:
+        description: Explicitly permit a manual rollback to an older tested SHA
+        required: true
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: staging-mutation
+  cancel-in-progress: false
+  queue: max
+
+jobs:
+  deploy:
+    if: gitea.event_name == 'workflow_dispatch' || (gitea.event.workflow_run.conclusion == 'success' && gitea.event.workflow_run.event == 'push' && gitea.event.workflow_run.head_branch == 'staging')
+    runs-on: xiaoxin
+    timeout-minutes: 30
+    env:
+      GITEA_SHA: ${{ gitea.sha }}
+      GITEA_API_URL: ${{ gitea.api_url }}
+      GITEA_REPOSITORY: ${{ gitea.repository }}
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      REGISTRY_HOST: crpi-d1feco6itet73spp.cn-hongkong.personal.cr.aliyuncs.com
+      IMAGE_REPOSITORY: crpi-d1feco6itet73spp.cn-hongkong.personal.cr.aliyuncs.com/copse/jyotisha
+      DEPLOY_HOST: ${{ vars.STAGING_HOST }}
+      DEPLOY_PORT: ${{ vars.STAGING_PORT }}
+      DEPLOY_USER: ${{ vars.STAGING_USER }}
+      DEPLOY_PATH: ${{ vars.STAGING_PATH }}
+      STAGING_URL: ${{ vars.STAGING_URL }}
+      STAGING_KNOWN_HOSTS: ${{ vars.STAGING_KNOWN_HOSTS }}
+    steps:
+      - name: Validate tested revision and gate run
+        id: revision
+        env:
+          REQUESTED_SHA: ${{ gitea.event.workflow_run.head_sha || inputs.deploy_sha }}
+          WORKFLOW_RUN_ID: ${{ gitea.event.workflow_run.id }}
+          WORKFLOW_RUN_ATTEMPT: ${{ gitea.event.workflow_run.run_attempt }}
+          REQUESTED_ROLLBACK: ${{ inputs.allow_rollback || 'false' }}
+          GITEA_EVENT_NAME: ${{ gitea.event_name }}
+        run: |
+          set -euo pipefail
+          [[ "$REQUESTED_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo "deploy_sha must be a lowercase full commit SHA" >&2; exit 1; }
+          allow_rollback=false
+          if [[ "$REQUESTED_ROLLBACK" == true ]]; then
+            [[ "$GITEA_EVENT_NAME" == workflow_dispatch ]] || { echo "rollback authorization is manual-only" >&2; exit 1; }
+            allow_rollback=true
+          fi
+
+          gate_run_id="${WORKFLOW_RUN_ID:-}"
+          gate_run_attempt="${WORKFLOW_RUN_ATTEMPT:-}"
+          if [[ "$GITEA_EVENT_NAME" == workflow_dispatch ]]; then
+            runs="$(curl --fail --silent --show-error \
+              --header "Authorization: token $GITEA_TOKEN" \
+              "$GITEA_API_URL/repos/$GITEA_REPOSITORY/actions/runs?head_sha=$REQUESTED_SHA&branch=staging&event=push&status=success&limit=100")"
+            selected_run="$(jq -cer --arg sha "$REQUESTED_SHA" '
+              [.workflow_runs[] | select(
+                (.path | split("@")[0] | endswith("backend-quality-gate.yml")) and
+                .head_sha == $sha and .head_branch == "staging" and
+                .event == "push" and .conclusion == "success"
+              )] | sort_by(.id) | reverse | first
+            ' <<<"$runs")"
+            gate_run_id="$(jq -er '.id' <<<"$selected_run")"
+            gate_run_attempt="$(jq -er '.run_attempt // 0' <<<"$selected_run")"
+          fi
+          [[ "$gate_run_id" =~ ^[0-9]+$ ]] || { echo "no successful exact-SHA staging quality gate run found" >&2; exit 1; }
+          [[ "$gate_run_attempt" =~ ^[0-9]+$ ]] || { echo "invalid staging quality gate run attempt" >&2; exit 1; }
+
+          staging_head="$(git ls-remote https://git.copse.top/root/Jyotisha.git refs/heads/staging | awk '{print $1}')"
+          [[ "$staging_head" =~ ^[0-9a-f]{40}$ ]]
+          if [[ "$allow_rollback" == false && "$REQUESTED_SHA" != "$staging_head" ]]; then
+            echo "stale staging revision refused; use explicit manual rollback only when intended" >&2
+            exit 1
+          fi
+          {
+            echo "sha=$REQUESTED_SHA"
+            echo "gate_run_id=$gate_run_id"
+            echo "gate_run_attempt=$gate_run_attempt"
+            echo "allow_rollback=$allow_rollback"
+          } >>"$GITHUB_OUTPUT"
+
+      - name: Checkout trusted main controller
+        env:
+          DEPLOY_SHA: ${{ steps.revision.outputs.sha }}
+        run: |
+          set -euo pipefail
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin https://git.copse.top/root/Jyotisha.git
+          git fetch --no-tags origin main "$DEPLOY_SHA"
+          git checkout --detach --force origin/main
+          git merge-base --is-ancestor "$DEPLOY_SHA" HEAD || { echo "staging revision is not in trusted main history" >&2; exit 1; }
+
+      - name: Download gate-produced image manifest
+        env:
+          GATE_RUN_ID: ${{ steps.revision.outputs.gate_run_id }}
+          GATE_RUN_ATTEMPT: ${{ steps.revision.outputs.gate_run_attempt }}
+          DEPLOY_SHA: ${{ steps.revision.outputs.sha }}
+        run: |
+          set -euo pipefail
+          artifact_name="staging-image-manifest-$DEPLOY_SHA-$GATE_RUN_ATTEMPT"
+          artifacts="$(curl --fail --silent --show-error \
+            --header "Authorization: token $GITEA_TOKEN" \
+            "$GITEA_API_URL/repos/$GITEA_REPOSITORY/actions/runs/$GATE_RUN_ID/artifacts?name=$artifact_name")"
+          artifact_id="$(jq -er --arg name "$artifact_name" '[.artifacts[] | select(.name == $name and .expired == false)] | first | .id' <<<"$artifacts")"
+          [[ "$artifact_id" =~ ^[0-9]+$ ]]
+          install -d -m 700 artifacts/staging-image
+          curl --fail --silent --show-error --location \
+            --header "Authorization: token $GITEA_TOKEN" \
+            "$GITEA_API_URL/repos/$GITEA_REPOSITORY/actions/artifacts/$artifact_id/zip" \
+            --output "${RUNNER_TEMP}/staging-image-manifest.zip"
+          unzip -q "${RUNNER_TEMP}/staging-image-manifest.zip" -d artifacts/staging-image
+          [[ -f artifacts/staging-image/manifest.env ]]
+
+      - name: Validate immutable image manifest
+        id: images
+        env:
+          DEPLOY_SHA: ${{ steps.revision.outputs.sha }}
+        run: |
+          set -euo pipefail
+          node frontend/scripts/staging-image-manifest.mjs \
+            artifacts/staging-image/manifest.env "$DEPLOY_SHA" "$IMAGE_REPOSITORY" >>"$GITHUB_OUTPUT"
+
+      - name: Deploy exact image digests under pinned SSH identity
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          DEPLOY_SHA: ${{ steps.revision.outputs.sha }}
+          API_IMAGE: ${{ steps.images.outputs.api_image }}
+          WEB_IMAGE: ${{ steps.images.outputs.web_image }}
+          ALLOW_ROLLBACK: ${{ steps.revision.outputs.allow_rollback }}
+        run: |
+          set -euo pipefail
+          ssh_root="${RUNNER_TEMP}/staging-ssh"
+          key_path="$ssh_root/id_ed25519"
+          known_hosts_path="$ssh_root/known_hosts"
+          incoming=""
+          install -m 700 -d "$ssh_root"
+          printf '%s\n' "$SSH_PRIVATE_KEY" | tr -d '\r' > "$key_path"
+          printf '%s\n' "$STAGING_KNOWN_HOSTS" | tr -d '\r' > "$known_hosts_path"
+          chmod 600 "$key_path" "$known_hosts_path"
+          ssh_options=(-i "$key_path" -p "$DEPLOY_PORT" -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o "UserKnownHostsFile=$known_hosts_path")
+          remote="$DEPLOY_USER@$DEPLOY_HOST"
+          require_current_staging_head() {
+            [[ "$ALLOW_ROLLBACK" == true ]] && return
+            current_head="$(git ls-remote https://git.copse.top/root/Jyotisha.git refs/heads/staging | awk '{print $1}')"
+            [[ "$current_head" == "$DEPLOY_SHA" ]] || { echo "staging advanced during deployment; refusing stale mutation" >&2; exit 1; }
+          }
+          cleanup() {
+            if [[ -n "$incoming" ]]; then
+              ssh "${ssh_options[@]}" "$remote" "sudo -n docker --config '$incoming/.docker' logout '$REGISTRY_HOST' >/dev/null 2>&1 || true; sudo -n rm -rf -- '$incoming'" >/dev/null 2>&1 || true
+            fi
+            rm -rf -- "$ssh_root"
+          }
+          trap cleanup EXIT
+          incoming="$(ssh "${ssh_options[@]}" "$remote" "mktemp -d /tmp/jyotisha-staging.XXXXXXXXXX")"
+          [[ "$incoming" == /tmp/jyotisha-staging.* ]]
+          ssh "${ssh_options[@]}" "$remote" "install -d -m 700 '$incoming/.docker'"
+          tar -cf "${RUNNER_TEMP}/deploy.tar" deploy
+          scp -i "$key_path" -P "$DEPLOY_PORT" -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o "UserKnownHostsFile=$known_hosts_path" "${RUNNER_TEMP}/deploy.tar" "$remote:$incoming/deploy.tar"
+          ssh "${ssh_options[@]}" "$remote" "tar -xf '$incoming/deploy.tar' -C '$incoming' && rm -f -- '$incoming/deploy.tar'"
+          previous_sha="$(ssh "${ssh_options[@]}" "$remote" "state='$DEPLOY_PATH/.state/deployed-revision'; if [ -f \"\$state\" ]; then cat \"\$state\"; else id=\$(sudo -n docker ps -aq --filter 'label=com.docker.compose.project=jyotisha-staging' --filter 'label=com.docker.compose.service=web' | head -n 1); if [ -n \"\$id\" ]; then sudo -n docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' \"\$id\" | sed -n 's/^GITHUB_SHA=//p' | head -n 1; else printf not-deployed; fi; fi")"
+          [[ "$previous_sha" == not-deployed || "$previous_sha" =~ ^[0-9a-f]{40}$ ]] || exit 1
+          forward_verified=false
+          if [[ "$previous_sha" != not-deployed && "$previous_sha" != "$DEPLOY_SHA" && "$ALLOW_ROLLBACK" != true ]]; then
+            git cat-file -e "${previous_sha}^{commit}" 2>/dev/null || git fetch origin "$previous_sha"
+            git merge-base --is-ancestor "$previous_sha" "$DEPLOY_SHA" || { echo "automatic staging rollback or divergent deploy refused" >&2; exit 1; }
+            forward_verified=true
+          fi
+          require_current_staging_head
+          printf '%s' "$REGISTRY_PASSWORD" | ssh "${ssh_options[@]}" "$remote" "sudo -n docker --config '$incoming/.docker' login '$REGISTRY_HOST' --username '$REGISTRY_USERNAME' --password-stdin"
+          ssh "${ssh_options[@]}" "$remote" "sudo -n env INCOMING_PATH='$incoming' DEPLOY_PATH='$DEPLOY_PATH' API_IMAGE='$API_IMAGE' WEB_IMAGE='$WEB_IMAGE' DEPLOY_SHA='$DEPLOY_SHA' EXPECTED_PREVIOUS_SHA='$previous_sha' ALLOW_ROLLBACK='$ALLOW_ROLLBACK' FORWARD_REVISION_VERIFIED='$forward_verified' DOCKER_CONFIG='$incoming/.docker' DOCKER_BIN='docker' STAGING_URL='$STAGING_URL' bash '$incoming/deploy/run-staging-deploy.sh'"
+          require_current_staging_head
diff --git a/.gitea/workflows/migrate-staging-database.yml b/.gitea/workflows/migrate-staging-database.yml
new file mode 100644
index 00000000..c985af96
--- /dev/null
+++ b/.gitea/workflows/migrate-staging-database.yml
@@ -0,0 +1,158 @@
+name: Migrate Staging Database (manual only)
+
+on:
+  workflow_dispatch:
+    inputs:
+      deploy_sha:
+        description: Full current staging SHA to migrate
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: staging-mutation
+  cancel-in-progress: false
+  queue: max
+
+jobs:
+  migrate:
+    runs-on: xiaoxin
+    timeout-minutes: 20
+    env:
+      GITEA_SHA: ${{ gitea.sha }}
+      GITEA_API_URL: ${{ gitea.api_url }}
+      GITEA_REPOSITORY: ${{ gitea.repository }}
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      REGISTRY_HOST: crpi-d1feco6itet73spp.cn-hongkong.personal.cr.aliyuncs.com
+      IMAGE_REPOSITORY: crpi-d1feco6itet73spp.cn-hongkong.personal.cr.aliyuncs.com/copse/jyotisha
+      DEPLOY_HOST: ${{ vars.STAGING_HOST }}
+      DEPLOY_PORT: ${{ vars.STAGING_PORT }}
+      DEPLOY_USER: ${{ vars.STAGING_USER }}
+      DEPLOY_PATH: ${{ vars.STAGING_PATH }}
+      STAGING_KNOWN_HOSTS: ${{ vars.STAGING_KNOWN_HOSTS }}
+    steps:
+      - name: Validate current staging revision and successful gate
+        id: revision
+        env:
+          DEPLOY_SHA: ${{ inputs.deploy_sha }}
+        run: |
+          set -euo pipefail
+          [[ "$DEPLOY_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo "deploy_sha must be a lowercase full commit SHA" >&2; exit 1; }
+          staging_head="$(git ls-remote https://git.copse.top/root/Jyotisha.git refs/heads/staging | awk '{print $1}')"
+          [[ "$staging_head" == "$DEPLOY_SHA" ]] || { echo "migration requires current staging head" >&2; exit 1; }
+          runs="$(curl --fail --silent --show-error \
+            --header "Authorization: token $GITEA_TOKEN" \
+            "$GITEA_API_URL/repos/$GITEA_REPOSITORY/actions/runs?head_sha=$DEPLOY_SHA&branch=staging&event=push&status=success&limit=100")"
+          selected_run="$(jq -cer --arg sha "$DEPLOY_SHA" '
+            [.workflow_runs[] | select(
+              (.path | split("@")[0] | endswith("backend-quality-gate.yml")) and
+              .head_sha == $sha and .head_branch == "staging" and
+              .event == "push" and .conclusion == "success"
+            )] | sort_by(.id) | reverse | first
+          ' <<<"$runs")"
+          gate_run_id="$(jq -er '.id' <<<"$selected_run")"
+          gate_run_attempt="$(jq -er '.run_attempt // 0' <<<"$selected_run")"
+          [[ "$gate_run_id" =~ ^[0-9]+$ ]]
+          [[ "$gate_run_attempt" =~ ^[0-9]+$ ]]
+          {
+            echo "sha=$DEPLOY_SHA"
+            echo "gate_run_id=$gate_run_id"
+            echo "gate_run_attempt=$gate_run_attempt"
+          } >>"$GITHUB_OUTPUT"
+
+      - name: Checkout trusted main controller
+        env:
+          DEPLOY_SHA: ${{ steps.revision.outputs.sha }}
+        run: |
+          set -euo pipefail
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin https://git.copse.top/root/Jyotisha.git
+          git fetch --no-tags origin main "$DEPLOY_SHA"
+          git checkout --detach --force origin/main
+          git merge-base --is-ancestor "$DEPLOY_SHA" HEAD || { echo "staging revision is not in trusted main history" >&2; exit 1; }
+
+      - name: Download gate-produced migration manifest
+        env:
+          GATE_RUN_ID: ${{ steps.revision.outputs.gate_run_id }}
+          GATE_RUN_ATTEMPT: ${{ steps.revision.outputs.gate_run_attempt }}
+          DEPLOY_SHA: ${{ steps.revision.outputs.sha }}
+        run: |
+          set -euo pipefail
+          artifact_name="staging-image-manifest-$DEPLOY_SHA-$GATE_RUN_ATTEMPT"
+          artifacts="$(curl --fail --silent --show-error \
+            --header "Authorization: token $GITEA_TOKEN" \
+            "$GITEA_API_URL/repos/$GITEA_REPOSITORY/actions/runs/$GATE_RUN_ID/artifacts?name=$artifact_name")"
+          artifact_id="$(jq -er --arg name "$artifact_name" '[.artifacts[] | select(.name == $name and .expired == false)] | first | .id' <<<"$artifacts")"
+          [[ "$artifact_id" =~ ^[0-9]+$ ]]
+          install -d -m 700 artifacts/staging-image
+          curl --fail --silent --show-error --location \
+            --header "Authorization: token $GITEA_TOKEN" \
+            "$GITEA_API_URL/repos/$GITEA_REPOSITORY/actions/artifacts/$artifact_id/zip" \
+            --output "${RUNNER_TEMP}/staging-image-manifest.zip"
+          unzip -q "${RUNNER_TEMP}/staging-image-manifest.zip" -d artifacts/staging-image
+          [[ -f artifacts/staging-image/manifest.env ]]
+
+      - name: Validate digest-pinned migration image
+        id: image
+        env:
+          DEPLOY_SHA: ${{ steps.revision.outputs.sha }}
+        run: |
+          set -euo pipefail
+          node frontend/scripts/staging-image-manifest.mjs \
+            artifacts/staging-image/manifest.env "$DEPLOY_SHA" "$IMAGE_REPOSITORY" >>"$GITHUB_OUTPUT"
+
+      - name: Apply digest-pinned migration under host lock
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+          DEPLOY_SHA: ${{ steps.revision.outputs.sha }}
+          WEB_IMAGE: ${{ steps.image.outputs.web_image }}
+        run: |
+          set -euo pipefail
+          ssh_root="${RUNNER_TEMP}/staging-migration-ssh"
+          key_path="$ssh_root/id_ed25519"
+          known_hosts_path="$ssh_root/known_hosts"
+          incoming=""
+          install -m 700 -d "$ssh_root"
+          printf '%s\n' "$SSH_PRIVATE_KEY" | tr -d '\r' > "$key_path"
+          printf '%s\n' "$STAGING_KNOWN_HOSTS" | tr -d '\r' > "$known_hosts_path"
+          chmod 600 "$key_path" "$known_hosts_path"
+          ssh_options=(-i "$key_path" -p "$DEPLOY_PORT" -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o "UserKnownHostsFile=$known_hosts_path")
+          remote="$DEPLOY_USER@$DEPLOY_HOST"
+          require_current_staging_head() {
+            current_head="$(git ls-remote https://git.copse.top/root/Jyotisha.git refs/heads/staging | awk '{print $1}')"
+            [[ "$current_head" == "$DEPLOY_SHA" ]] || { echo "staging advanced during migration; refusing stale mutation" >&2; exit 1; }
+          }
+          cleanup() {
+            if [[ -n "$incoming" ]]; then
+              ssh "${ssh_options[@]}" "$remote" "sudo -n docker --config '$incoming/.docker' logout '$REGISTRY_HOST' >/dev/null 2>&1 || true; sudo -n rm -rf -- '$incoming'" >/dev/null 2>&1 || true
+            fi
+            rm -rf -- "$ssh_root"
+          }
+          trap cleanup EXIT
+          incoming="$(ssh "${ssh_options[@]}" "$remote" "mktemp -d /tmp/jyotisha-staging.XXXXXXXXXX")"
+          [[ "$incoming" == /tmp/jyotisha-staging.* ]]
+          ssh "${ssh_options[@]}" "$remote" "install -d -m 700 '$incoming/.docker'"
+          tar -cf "${RUNNER_TEMP}/deploy.tar" deploy
+          scp -i "$key_path" -P "$DEPLOY_PORT" -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o "UserKnownHostsFile=$known_hosts_path" "${RUNNER_TEMP}/deploy.tar" "$remote:$incoming/deploy.tar"
+          ssh "${ssh_options[@]}" "$remote" "tar -xf '$incoming/deploy.tar' -C '$incoming' && rm -f -- '$incoming/deploy.tar'"
+          previous_sha="$(ssh "${ssh_options[@]}" "$remote" "state='$DEPLOY_PATH/.state/deployed-revision'; if [ -f \"\$state\" ]; then cat \"\$state\"; else id=\$(sudo -n docker ps -aq --filter 'label=com.docker.compose.project=jyotisha-staging' --filter 'label=com.docker.compose.service=web' | head -n 1); if [ -n \"\$id\" ]; then sudo -n docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' \"\$id\" | sed -n 's/^GITHUB_SHA=//p' | head -n 1; else printf not-deployed; fi; fi")"
+          [[ "$previous_sha" == not-deployed || "$previous_sha" =~ ^[0-9a-f]{40}$ ]] || exit 1
+          forward_verified=false
+          if [[ "$previous_sha" != not-deployed && "$previous_sha" != "$DEPLOY_SHA" ]]; then
+            git cat-file -e "${previous_sha}^{commit}" 2>/dev/null || git fetch origin "$previous_sha"
+            git merge-base --is-ancestor "$previous_sha" "$DEPLOY_SHA" || { echo "migration rollback or divergence refused" >&2; exit 1; }
+            forward_verified=true
+          fi
+          require_current_staging_head
+          printf '%s' "$REGISTRY_PASSWORD" | ssh "${ssh_options[@]}" "$remote" "sudo -n docker --config '$incoming/.docker' login '$REGISTRY_HOST' --username '$REGISTRY_USERNAME' --password-stdin"
+          ssh "${ssh_options[@]}" "$remote" "sudo -n env INCOMING_PATH='$incoming' DEPLOY_PATH='$DEPLOY_PATH' WEB_IMAGE='$WEB_IMAGE' DEPLOY_SHA='$DEPLOY_SHA' EXPECTED_PREVIOUS_SHA='$previous_sha' FORWARD_REVISION_VERIFIED='$forward_verified' DOCKER_CONFIG='$incoming/.docker' DOCKER_BIN='docker' bash '$incoming/deploy/run-staging-migration.sh'"
+          require_current_staging_head
+
+      - name: Operator action
+        run: echo 'Migration complete. Start Deploy staging manually with this exact SHA.'
diff --git a/.gitea/workflows/publish-pypi.yml b/.gitea/workflows/publish-pypi.yml
new file mode 100644
index 00000000..f127b587
--- /dev/null
+++ b/.gitea/workflows/publish-pypi.yml
@@ -0,0 +1,43 @@
+name: Publish to PyPI (manual only)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build-and-publish:
+    runs-on: xiaoxin
+    env:
+      GITEA_SHA: ${{ gitea.sha }}
+    steps:
+      - name: Checkout current Gitea revision
+        run: |
+          set -euo pipefail
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin https://git.copse.top/root/Jyotisha.git
+          git fetch --no-tags origin "$GITEA_SHA"
+          git checkout --detach --force "$GITEA_SHA"
+      - name: Verify runner toolchain
+        run: |
+          set -euo pipefail
+          python3 --version
+          node --version
+          npm --version
+          docker version
+      - name: Build and check package
+        run: |
+          set -euo pipefail
+          python3 -m venv .venv
+          export PATH="$PWD/.venv/bin:$PATH"
+          python -m pip install --upgrade pip
+          python -m pip install build twine
+          python -m build
+          python -m twine check dist/*
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        run: |
+          set -euo pipefail
+          export PATH="$PWD/.venv/bin:$PATH"
+          python -m twine upload --skip-existing dist/*
diff --git a/.gitea/workflows/release-quality-gate.yml b/.gitea/workflows/release-quality-gate.yml
new file mode 100644
index 00000000..b235097f
--- /dev/null
+++ b/.gitea/workflows/release-quality-gate.yml
@@ -0,0 +1,40 @@
+name: Jyotish Release Quality Gate (manual only)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release-quality-gate:
+    runs-on: xiaoxin
+    timeout-minutes: 45
+    env:
+      GITEA_SHA: ${{ gitea.sha }}
+    steps:
+      - name: Checkout current Gitea revision
+        run: |
+          set -euo pipefail
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin https://git.copse.top/root/Jyotisha.git
+          git fetch --no-tags origin "$GITEA_SHA"
+          git checkout --detach --force "$GITEA_SHA"
+      - name: Verify runner toolchain
+        run: |
+          set -euo pipefail
+          python3 --version
+          node --version
+          npm --version
+          docker version
+      - name: Install dependencies and run release gate
+        env:
+          NEXT_PUBLIC_SUPABASE_URL: https://ci-placeholder.supabase.co
+          NEXT_PUBLIC_SUPABASE_ANON_KEY: ci-placeholder
+        run: |
+          set -euo pipefail
+          python3 -m venv .venv
+          export PATH="$PWD/.venv/bin:$PATH"
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements.txt -r requirements-dev.txt playwright
+          python -m playwright install --with-deps chromium
+          npm ci --prefix frontend
+          python scripts/run_quality_gate.py --profile release
diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
new file mode 100644
index 00000000..9e9c3dfd
--- /dev/null
+++ b/.gitea/workflows/test.yml
@@ -0,0 +1,42 @@
+name: Jyotish Skill Tests (manual only)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: xiaoxin
+    env:
+      GITEA_SHA: ${{ gitea.sha }}
+    steps:
+      - name: Checkout current Gitea revision
+        run: |
+          set -euo pipefail
+          git init .
+          git remote remove origin 2>/dev/null || true
+          git remote add origin https://git.copse.top/root/Jyotisha.git
+          git fetch --no-tags origin "$GITEA_SHA"
+          git checkout --detach --force "$GITEA_SHA"
+      - name: Verify runner toolchain
+        run: |
+          set -euo pipefail
+          python3 --version
+          node --version
+          npm --version
+          docker version
+      - name: Install dependencies and run tests
+        env:
+          NEXT_PUBLIC_SUPABASE_URL: https://ci-placeholder.supabase.co
+          NEXT_PUBLIC_SUPABASE_ANON_KEY: ci-placeholder
+        run: |
+          set -euo pipefail
+          python3 -m venv .venv
+          export PATH="$PWD/.venv/bin:$PATH"
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements.txt -r requirements-dev.txt
+          npm ci --prefix frontend
+          python -m pytest -vv --maxfail=1
+          python tests/run_all.py
+          npm test --prefix frontend
+          npm run lint --prefix frontend
+          npm run build --prefix frontend
diff --git a/AGENTS.md b/AGENTS.md
index ced21830..8b463b81 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7,7 +7,7 @@
 任何部署、线上故障、域名、登录或环境变量任务，先读取 `deploy/README.md`，不要重新猜测架构。
 
 - Production domain: `https://jyotisha.chat`
-- Source: `https://github.com/jesse-ux/Jyotisha.git`
+- Primary source: `https://git.copse.top/root/Jyotisha.git`; GitHub upstream/mirror: `https://github.com/jesse-ux/Jyotisha.git`
 - Server: Hong Kong Ubuntu 22.04 VPS, `103.117.123.53`, SSH port `22000`
 - Runtime: `/opt/jyotisha-app`, Docker Compose file `deploy/docker-compose.server.yml`
 - Secrets: `/opt/jyotisha-app/.env.production`; never print, copy into chat, or commit
diff --git a/README.md b/README.md
index c003365a..eed91019 100644
--- a/README.md
+++ b/README.md
@@ -34,7 +34,7 @@ Current production infrastructure:
 - Compose file: `deploy/docker-compose.server.yml`
 - Production environment: `/opt/jyotisha-app/.env.production` (`0600`, never commit)
 - Supabase project: `vtvnfqmonbfuxmqkqdlc`
-- Source repository: `https://github.com/jesse-ux/Jyotisha.git`
+- Primary source repository: `https://git.copse.top/root/Jyotisha.git`; GitHub upstream/mirror: `https://github.com/jesse-ux/Jyotisha.git`
 
 Deployment, recovery, DNS, HTTPS, update and verification commands are documented in [`deploy/README.md`](deploy/README.md). Railway/Vercel remain optional alternatives, not the current production topology.
 
diff --git a/deploy/.env.staging.identity.example b/deploy/.env.staging.identity.example
index c74373bb..fb5f7365 100644
--- a/deploy/.env.staging.identity.example
+++ b/deploy/.env.staging.identity.example
@@ -3,20 +3,19 @@
 APP_ENV_FILE=../.env.staging
 CADDYFILE_PATH=./Caddyfile.staging
 SITE_ADDRESS=https://staging.jyotisha.chat
-ADMIN_SITE_ADDRESS=https://admin.staging.jyotisha.chat
 
 # Staging-only cutover: identity and business data both use the private local
 # PostgreSQL service. Production remains on Supabase until a separate cutover.
 AUTH_PROVIDER=self-hosted
 SELF_HOSTED_IDENTITY_ENABLED=true
 AUTH_USER_ORIGIN=https://staging.jyotisha.chat
-AUTH_ADMIN_ORIGIN=https://admin.staging.jyotisha.chat
 IDENTITY_DATABASE_URL=postgresql://identity_runtime:<percent-encoded-identity-runtime-password>@postgres:5432/jyotisha
 APP_DATABASE_URL=postgresql://app_runtime:<percent-encoded-app-runtime-password>@postgres:5432/jyotisha
 ADMIN_DATABASE_URL=postgresql://admin_runtime:<percent-encoded-admin-runtime-password>@postgres:5432/jyotisha
 BETTER_AUTH_USER_SECRET=<independent-openssl-rand-base64-32-output>
-BETTER_AUTH_ADMIN_SECRET=<different-openssl-rand-base64-32-output>
 RESEND_API_KEY=<staging-only-resend-api-key>
 RESEND_FROM_EMAIL=Jyotisha Staging <login@staging.jyotisha.chat>
 ADMIN_EMAILS=<comma-separated-staging-admin-emails>
+EPAY_CONFIG_ENCRYPTION_KEY=<independent-openssl-rand-base64-32-output>
+EPAY_CHAT_ENABLED=false
 JYOTISH_DYNAMIC_RECTIFICATION_TOKEN=<independent-openssl-rand-base64-32-output>
diff --git a/deploy/Caddyfile.staging b/deploy/Caddyfile.staging
index 0daab86e..66bbb59c 100644
--- a/deploy/Caddyfile.staging
+++ b/deploy/Caddyfile.staging
@@ -1,21 +1,4 @@
 {$SITE_ADDRESS:https://staging.jyotisha.chat} {
     encode zstd gzip
-
-    @adminPaths path /admin /admin/* /api/admin/*
-    respond @adminPaths "Not found" 404
-
     reverse_proxy web:3000
 }
-
-{$ADMIN_SITE_ADDRESS:https://admin.staging.jyotisha.chat} {
-    encode zstd gzip
-
-    @adminRoot path /
-    redir @adminRoot /admin/codes 302
-
-    @adminSurface path /login /admin /admin/* /api/admin/* /api/auth/* /_next/* /jyotish-logo.png /favicon.ico
-    handle @adminSurface {
-        reverse_proxy web:3000
-    }
-    respond "Not found" 404
-}
diff --git a/deploy/README.md b/deploy/README.md
index 80bf1127..5c5475bb 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -14,7 +14,8 @@ This file is the operational source of truth for the current Jyotisha demo deplo
 | Capacity | 1 vCPU / 2 GB RAM / 40 GB disk / 5 Mbps |
 | App directory | `/opt/jyotisha-app` |
 | Environment file | `/opt/jyotisha-app/.env.production` (`0600`) |
-| Source repository | `https://github.com/jesse-ux/Jyotisha.git` |
+| Primary source repository | `https://git.copse.top/root/Jyotisha.git` |
+| GitHub upstream/mirror | `https://github.com/jesse-ux/Jyotisha.git` |
 | Supabase project | `vtvnfqmonbfuxmqkqdlc` |
 
 This machine is suitable for a client demo and low concurrency. Supabase and the model provider stay managed externally; do not self-host them on this VPS.
@@ -73,6 +74,14 @@ NEXT_PUBLIC_SUPABASE_ANON_KEY=...
 SUPABASE_SERVICE_ROLE_KEY=...
 ADMIN_EMAILS=...
 
+# Required to save/read database-backed 易支付 settings. Base64 decoding must
+# produce exactly 32 random bytes. Generate independently; never reuse auth keys.
+EPAY_CONFIG_ENCRYPTION_KEY=<independent-base64-encoded-32-byte-key>
+# Legacy EPAY_GATEWAY_URL / EPAY_PID / EPAY_KEY / EPAY_NOTIFY_URL /
+# EPAY_RETURN_URL / EPAY_SITE_NAME remain fallback-only when no database row exists.
+# Online packages stay hidden by default; only explicit true enables the fallback.
+EPAY_CHAT_ENABLED=false
+
 # Conversational birth-time rectification rollout controls.
 # Keep migrations false until the ordered database gate below has passed.
 RECTIFICATION_PRICE_CREDITS=3
@@ -164,11 +173,11 @@ Staging is isolated from production:
 | PostgreSQL | private Compose network; no published host port |
 | Business database | local private PostgreSQL (`jyotisha-staging` Compose project) |
 | Identity | Better Auth + Resend OTP on the same private PostgreSQL cluster |
-| GitHub Environment | `staging` |
+| Actions control plane | Gitea 1.26.2 (`git.copse.top`) |
 
-The GitHub `staging` Environment contains the secret `STAGING_SSH_PRIVATE_KEY` and the variables `STAGING_HOST`, `STAGING_PORT`, `STAGING_USER`, `STAGING_PATH`, `STAGING_URL`, and `STAGING_KNOWN_HOSTS`. Its deployment branch policy allows the `main` controller branch: GitHub's `workflow_run` event executes from the default branch while the workflow separately requires the successfully tested upstream branch to be `staging`. The controller checks out only `main` with full history, requires the requested staging SHA to be an ancestor of that reviewed history, and uploads only the allowlisted `deploy/` control files. It never executes deployment validators or remote orchestration scripts from the target/rollback revision. The staging key, database, Resend key, and model-provider keys must not be shared with production. Staging image publishing has no Supabase build variables.
+Gitea is the primary source repository and Actions control plane. Gitea automatically injects the per-job `${{ secrets.GITEA_TOKEN }}` token; its access is limited by each workflow's `permissions` block and it must not be configured as a repository secret. Configure repository Actions secrets `REGISTRY_USERNAME`, `REGISTRY_PASSWORD`, and `STAGING_SSH_PRIVATE_KEY`, plus variables `STAGING_HOST`, `STAGING_PORT`, `STAGING_USER`, `STAGING_PATH`, `STAGING_URL`, and `STAGING_KNOWN_HOSTS`. The `workflow_run` controller is loaded from the default `main` branch while separately requiring the successfully tested upstream branch to be `staging`. The controller checks out only `main` with full history, requires the requested staging SHA to be an ancestor of that reviewed history, and uploads only the allowlisted `deploy/` control files. It never executes deployment validators or remote orchestration scripts from the target/rollback revision. The staging key, database, Resend key, and model-provider keys must not be shared with production. Staging image publishing has no Supabase build variables. GitHub workflows are upstream/mirror fallback only, not the normal staging release path.
 
-`Staging Backend Quality Gate` runs for relevant `pull_request` paths, pushes to `staging`, and `workflow_dispatch`. It validates the Python/database/frontend contract; only a successful push to `staging` publishes the API/web images and a run-bound manifest containing their `sha256` digests. `.github/workflows/deploy-staging.yml` consumes that exact successful run, validates its manifest against the full 40-character commit, and deploys digest references rather than trusting the discoverability tags.
+`Staging Backend Quality Gate` runs for relevant `pull_request` paths, pushes to `staging`, and `workflow_dispatch`. It validates the Python/database/frontend contract; only a successful push to `staging` publishes the API/web images and a run-bound manifest containing their `sha256` digests. `.gitea/workflows/deploy-staging.yml` consumes that exact successful run, validates its manifest against the full 40-character commit, and deploys digest references rather than trusting the discoverability tags.
 
 The staging env file must include these non-secret selectors so Compose cannot fall back to production paths:
 
@@ -176,22 +185,21 @@ The staging env file must include these non-secret selectors so Compose cannot f
 APP_ENV_FILE=../.env.staging
 CADDYFILE_PATH=./Caddyfile.staging
 SITE_ADDRESS=https://staging.jyotisha.chat
-ADMIN_SITE_ADDRESS=https://admin.staging.jyotisha.chat
 ```
 
-Staging is fully self-hosted: set `AUTH_PROVIDER=self-hosted` and `SELF_HOSTED_IDENTITY_ENABLED=true`. Add the three role-specific server-only database URLs, separate user/admin Better Auth secrets, origins, and staging-only Resend settings listed in `deploy/.env.staging.identity.example`. Browser code uses same-origin APIs; it receives neither database credentials nor Supabase keys. Production remains on Supabase and is not changed by the staging workflow. See `docs/operations/self-hosted-identity.md` for validation and rollback commands.
+Staging is fully self-hosted: set `AUTH_PROVIDER=self-hosted` and `SELF_HOSTED_IDENTITY_ENABLED=true`. Add the three role-specific server-only database URLs, the single `AUTH_USER_ORIGIN` and `BETTER_AUTH_USER_SECRET`, and staging-only Resend settings listed in `deploy/.env.staging.identity.example`. The main-site Better Auth user session is also used by `/admin`; persisted `identity.users.role=admin` is the only self-hosted backend role, while `viewer` and ordinary users are denied. Browser code uses same-origin APIs; it receives neither database credentials nor Supabase keys. Production remains on Supabase and is not changed by the staging workflow. See `docs/operations/self-hosted-identity.md` for validation and rollback commands.
 
 After source sync and before `up`, the workflow validates `.env.staging` mode/selectors, explicitly pins the three staging selectors against ambient shell overrides, and runs `docker compose --env-file .env.staging -f deploy/docker-compose.server.yml config --quiet`. For later manual inspections, run the same checks only after the tracked deployment files exist on the server. Do not use a manual gate run from `main` as the first publishing path: publishing requires a successful push to `staging`, while manual `Deploy staging` requires a successful gate run for the exact SHA.
 
 ### First-deploy sequence
 
-1. Complete the server and GitHub bootstrap: create both mode-`0600` env files, preload the reviewed `postgres:17-alpine` image, and configure the staging Environment variables/secrets. No repository-level Supabase variables are required. Deployment and migration workflows use `--pull never` for PostgreSQL, so database image upgrades remain an explicit operator-controlled maintenance action rather than an application-deploy side effect.
-2. Merge the reviewed change to `main`, then fast-forward/push that exact reviewed SHA to `staging`; do not create a staging-only target or rely on a `main` workflow dispatch to publish images.
+1. Complete the server and Gitea bootstrap: create both mode-`0600` env files, preload the reviewed `postgres:17-alpine` image, and configure the listed Actions variables/secrets. No repository-level Supabase variables are required. Deployment and migration workflows use `--pull never` for PostgreSQL, so database image upgrades remain an explicit operator-controlled maintenance action rather than an application-deploy side effect.
+2. Open a PR and merge the reviewed change to `main`, then fast-forward/push that same exact SHA to `staging`; do not create a staging-only target or rely on a `main` workflow dispatch to publish images.
 3. The `Staging Backend Quality Gate` runs for that push and, when successful, publishes API/web images plus an artifact binding the exact SHA to both immutable image digests.
-4. The automatic `Deploy staging` workflow downloads that gate-run artifact, syncs only the trusted `main` controller's allowlisted `deploy/` files under the shared staging host lock, and validates both `.env.staging` and `.env.staging.database` before any app change. The target application's code is carried only by the digest-pinned images.
+4. The automatic `Deploy staging` workflow downloads that gate-run artifact, syncs only the trusted default-`main` controller's allowlisted `deploy/` files under the shared staging host lock, and validates both `.env.staging` and `.env.staging.database` before any app change. The target application's code is carried only by the digest-pinned images.
 5. If environment validation fails, fix the server-side env files without committing or copying secrets, then manually rerun `Deploy staging` from `main` with the same successful SHA in `deploy_sha`; the workflow rechecks a successful staging gate for that exact SHA.
-6. If the read-only checker reports a pending migration, stop app deployment and run `Migrate Staging Database` manually with the same full SHA; a successful migration re-dispatches `Deploy staging` with that same SHA.
-7. Confirm `https://staging.jyotisha.chat/api/health` reports the exact SHA and private API health.
+6. If the read-only checker reports a pending migration, stop app deployment and run `Migrate Staging Database` manually with the same full SHA. Migration success does not dispatch deployment.
+7. After migration succeeds, the operator must manually start `Deploy staging` from `main` with that same exact SHA, then confirm `https://staging.jyotisha.chat/api/health` reports it and private API health.
 
 After the exact-SHA deployment and migrations are verified, use the manual `Configure Staging Rectification Rollout` workflow to change new-case creation. Supply the SHA currently reported by `/api/health`; choose `public` to open all staging accounts, `smoke_only` with canonical test-account UUIDs for a canary, or `paused` to close creation. The workflow updates only the four `RECTIFICATION_V3_*` rollout variables under the shared host lock, recreates `web` and `rectification-v4-worker` with the already deployed image, and rolls back the env file if health does not match the requested audience. Do not edit or print `.env.staging` through CI logs.
 
@@ -252,11 +260,11 @@ PostgreSQL is private: `deploy/docker-compose.postgres.yml` has no `ports` mappi
 
 Use this order for every staging revision:
 
-1. Merge the reviewed revision to `main`, then fast-forward/push that same exact SHA to `staging`.
+1. Open a PR and merge the reviewed revision to `main`, then fast-forward/push that same exact SHA to `staging`.
 2. Wait for `Staging Backend Quality Gate` to pass and publish that exact full SHA's API/web digest manifest.
 3. The automatic `Deploy staging` workflow checks the exact SHA in read-only migration-check mode before changing API, web, or Caddy. If it reports pending or drifted migrations, stop; do not retry the application deployment as if it were a migration.
 4. Open **Migrate Staging Database -> Run workflow**, select **Use workflow from: main**, and enter the reported full lowercase 40-character SHA in `deploy_sha`. The controller validates that exact SHA against a successful `staging` gate and reviewed `main` history, starts only PostgreSQL, and runs the digest-pinned migrator without executing scripts from the target revision.
-5. A successful migration rechecks that `staging` still points at the same exact SHA, prints the ordered migration ledger, and dispatches the `main` controller for digest-pinned deployment with `allow_rollback=false`. If `staging` advanced during migration, it refuses the stale dispatch. Do not substitute a branch name, a short SHA, or a newer commit.
+5. A successful migration rechecks that `staging` still points at the same exact SHA and prints the ordered migration ledger, but does not dispatch deployment. The operator must then open **Deploy staging -> Run workflow**, select **Use workflow from: main**, and enter the same exact SHA in `deploy_sha` with `allow_rollback=false`. If `staging` advanced, stop rather than substituting a branch name, short SHA, or newer commit.
 6. Confirm `https://staging.jyotisha.chat/api/health` and verify that its deployment SHA is the SHA from step 2.
 7. After health verification, create the local encrypted backup described below.
 
diff --git a/deploy/configure-staging-rectification-rollout.sh b/deploy/configure-staging-rectification-rollout.sh
index 75cd5bd1..10ef3fd6 100755
--- a/deploy/configure-staging-rectification-rollout.sh
+++ b/deploy/configure-staging-rectification-rollout.sh
@@ -144,7 +144,6 @@ export APP_ENV_FILE='../.env.staging'
 export DATABASE_ENV_FILE='../.env.staging.database'
 export CADDYFILE_PATH='./Caddyfile.staging'
 export SITE_ADDRESS='https://staging.jyotisha.chat'
-export ADMIN_SITE_ADDRESS='https://admin.staging.jyotisha.chat'
 export GITHUB_SHA="$EXPECTED_DEPLOY_SHA"
 compose=(docker compose -p jyotisha-staging --env-file .env.staging "${compose_files[@]}")
 
diff --git a/deploy/docker-compose.server.yml b/deploy/docker-compose.server.yml
index 2ceab51d..04222ca2 100644
--- a/deploy/docker-compose.server.yml
+++ b/deploy/docker-compose.server.yml
@@ -53,7 +53,6 @@ services:
     restart: unless-stopped
     environment:
       SITE_ADDRESS: ${SITE_ADDRESS:-https://jyotisha.chat}
-      ADMIN_SITE_ADDRESS: ${ADMIN_SITE_ADDRESS:-https://admin.staging.jyotisha.chat}
     ports:
       - "80:80"
       - "443:443"
diff --git a/deploy/railway-api.Dockerfile b/deploy/railway-api.Dockerfile
index 23131945..48f8561f 100644
--- a/deploy/railway-api.Dockerfile
+++ b/deploy/railway-api.Dockerfile
@@ -1,11 +1,14 @@
-FROM python:3.12-slim
+FROM m.daocloud.io/docker.io/library/python:3.12-slim
 
 ENV PYTHONUNBUFFERED=1 \
-    PIP_NO_CACHE_DIR=1
+    PIP_NO_CACHE_DIR=1 \
+    PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/ \
+    PIP_DEFAULT_TIMEOUT=60
 WORKDIR /app
 
 COPY requirements.txt ./
-RUN apt-get update \
+RUN sed -i 's|http://deb.debian.org|https://mirrors.aliyun.com|g' /etc/apt/sources.list.d/debian.sources \
+    && apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 update \
     && apt-get install -y --no-install-recommends build-essential \
     && python -m pip install -r requirements.txt \
     && apt-get purge -y --auto-remove build-essential \
diff --git a/deploy/railway-web.Dockerfile b/deploy/railway-web.Dockerfile
index 5926686d..cf44ea5b 100644
--- a/deploy/railway-web.Dockerfile
+++ b/deploy/railway-web.Dockerfile
@@ -1,4 +1,4 @@
-FROM node:22-alpine
+FROM swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-alpine
 
 WORKDIR /app/frontend
 COPY frontend/package.json frontend/package-lock.json ./
diff --git a/deploy/run-staging-deploy.sh b/deploy/run-staging-deploy.sh
index 580c8dfc..44a4e685 100755
--- a/deploy/run-staging-deploy.sh
+++ b/deploy/run-staging-deploy.sh
@@ -6,6 +6,11 @@ required=(
   INCOMING_PATH DEPLOY_PATH API_IMAGE WEB_IMAGE DEPLOY_SHA
   EXPECTED_PREVIOUS_SHA ALLOW_ROLLBACK DOCKER_CONFIG STAGING_URL
 )
+case "${DOCKER_BIN:-docker}" in
+  docker) docker_command=(docker) ;;
+  "sudo -n docker") docker_command=(sudo -n docker --config "$DOCKER_CONFIG") ;;
+  *) echo "unsafe staging Docker command" >&2; exit 1 ;;
+esac
 for key in "${required[@]}"; do
   if [ -z "${!key:-}" ]; then
     echo "required staging deployment input is missing: $key" >&2
@@ -14,7 +19,7 @@ for key in "${required[@]}"; do
 done
 
 sha_pattern='^[0-9a-f]{40}$'
-digest_pattern='^ghcr\.io/jesse-ux/jyotisha-(api|web)@sha256:[0-9a-f]{64}$'
+digest_pattern='^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[1-9][0-9]{0,4})?(/[a-z0-9]+([._-][a-z0-9]+)*)+@sha256:[0-9a-f]{64}$'
 image_id_pattern='^sha256:[0-9a-f]{64}$'
 if [[ ! "$DEPLOY_SHA" =~ $sha_pattern ]] ||
   [[ ! "$API_IMAGE" =~ $digest_pattern ]] ||
@@ -22,12 +27,14 @@ if [[ ! "$DEPLOY_SHA" =~ $sha_pattern ]] ||
   echo "unsafe staging image identity" >&2
   exit 1
 fi
+api_repository="${API_IMAGE%@sha256:*}"
+web_repository="${WEB_IMAGE%@sha256:*}"
 if [ "$ALLOW_ROLLBACK" != "true" ] && [ "$ALLOW_ROLLBACK" != "false" ]; then
   echo "invalid rollback authorization" >&2
   exit 1
 fi
 case "$INCOMING_PATH" in
-  "$DEPLOY_PATH"/.incoming/*) ;;
+  /tmp/jyotisha-staging.*) ;;
   *) echo "unsafe incoming staging path" >&2; exit 1 ;;
 esac
 
@@ -43,11 +50,11 @@ current_sha="not-deployed"
 if [ -f "$state_directory/deployed-revision" ]; then
   current_sha="$(<"$state_directory/deployed-revision")"
 else
-  existing_web="$(docker ps -aq \
+  existing_web="$("${docker_command[@]}" ps -aq \
     --filter 'label=com.docker.compose.project=jyotisha-staging' \
     --filter 'label=com.docker.compose.service=web' | head -n 1)"
   if [ -n "$existing_web" ]; then
-    discovered_sha="$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' \
+    discovered_sha="$("${docker_command[@]}" inspect --format '{{range .Config.Env}}{{println .}}{{end}}' \
       "$existing_web" | sed -n 's/^GITHUB_SHA=//p' | head -n 1)"
     if [ -n "$discovered_sha" ]; then current_sha="$discovered_sha"; fi
   fi
@@ -69,7 +76,7 @@ if [ "$ALLOW_ROLLBACK" = "false" ] &&
 fi
 
 container_id() {
-  docker ps -aq \
+  "${docker_command[@]}" ps -aq \
     --filter 'label=com.docker.compose.project=jyotisha-staging' \
     --filter "label=com.docker.compose.service=$1" | head -n 1
 }
@@ -80,20 +87,20 @@ repo_digest_for_container() {
   local id image_id
   id="$(container_id "$service")"
   [ -n "$id" ] || return 0
-  image_id="$(docker inspect --format '{{.Image}}' "$id")"
-  docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$image_id" |
+  image_id="$("${docker_command[@]}" inspect --format '{{.Image}}' "$id")"
+  "${docker_command[@]}" image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$image_id" |
     awk -v prefix="$repository@sha256:" 'index($0, prefix) == 1 { print; exit }'
 }
 
-previous_api_image="$(repo_digest_for_container api ghcr.io/jesse-ux/jyotisha-api)"
-previous_web_image="$(repo_digest_for_container web ghcr.io/jesse-ux/jyotisha-web)"
+previous_api_image="$(repo_digest_for_container api "$api_repository")"
+previous_web_image="$(repo_digest_for_container web "$web_repository")"
 previous_api_id=""
 previous_web_id=""
 if [ -n "$(container_id api)" ]; then
-  previous_api_id="$(docker inspect --format '{{.Image}}' "$(container_id api)")"
+  previous_api_id="$("${docker_command[@]}" inspect --format '{{.Image}}' "$(container_id api)")"
 fi
 if [ -n "$(container_id web)" ]; then
-  previous_web_id="$(docker inspect --format '{{.Image}}' "$(container_id web)")"
+  previous_web_id="$("${docker_command[@]}" inspect --format '{{.Image}}' "$(container_id web)")"
 fi
 
 rollback_image() {
@@ -118,7 +125,7 @@ bash deploy/validate-staging-env.sh \
 bash deploy/validate-staging-database-env.sh .env.staging.database
 
 compose=(
-  docker compose -p jyotisha-staging --env-file .env.staging
+  "${docker_command[@]}" compose -p jyotisha-staging --env-file .env.staging
   -f deploy/docker-compose.server.yml -f deploy/docker-compose.postgres.yml
   -f deploy/docker-compose.staging.yml
 )
@@ -126,7 +133,6 @@ export APP_ENV_FILE='../.env.staging'
 export DATABASE_ENV_FILE='../.env.staging.database'
 export CADDYFILE_PATH='./Caddyfile.staging'
 export SITE_ADDRESS='https://staging.jyotisha.chat'
-export ADMIN_SITE_ADDRESS='https://admin.staging.jyotisha.chat'
 export GITHUB_SHA="$DEPLOY_SHA"
 
 "${compose[@]}" config --quiet
@@ -172,10 +178,10 @@ verify_container_image() {
   local id expected_id running_id repo_digests
   id="$(container_id "$service")"
   [ -n "$id" ]
-  expected_id="$(docker image inspect --format '{{.Id}}' "$expected_ref")"
-  running_id="$(docker inspect --format '{{.Image}}' "$id")"
+  expected_id="$("${docker_command[@]}" image inspect --format '{{.Id}}' "$expected_ref")"
+  running_id="$("${docker_command[@]}" inspect --format '{{.Image}}' "$id")"
   [ "$running_id" = "$expected_id" ]
-  repo_digests="$(docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$expected_id")"
+  repo_digests="$("${docker_command[@]}" image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$expected_id")"
   grep -Fqx "$expected_ref" <<<"$repo_digests"
 }
 verify_container_image api "$API_IMAGE"
@@ -184,7 +190,6 @@ verify_container_image rectification-v4-worker "$WEB_IMAGE"
 
 "${compose[@]}" exec -T \
   -e EXPECTED_SHA="$DEPLOY_SHA" -e STAGING_URL="$STAGING_URL" \
-  -e STAGING_ADMIN_URL="https://admin.staging.jyotisha.chat" \
   web node --input-type=module <<'NODE'
 const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 let login;
@@ -196,15 +201,10 @@ for (let attempt = 0; attempt < 12; attempt += 1) {
   await delay(5_000);
 }
 if (!login?.ok) process.exit(1);
-const adminLogin = await fetch(`${process.env.STAGING_ADMIN_URL}/login`);
-if (!adminLogin.ok) process.exit(1);
-const adminRoot = await fetch(process.env.STAGING_ADMIN_URL, { redirect: "manual" });
-if (
-  adminRoot.status !== 302 ||
-  adminRoot.headers.get("location") !== "/admin/codes"
-) process.exit(1);
-const adminSession = await fetch(`${process.env.STAGING_ADMIN_URL}/api/auth/get-session`);
-if (!adminSession.ok) process.exit(1);
+const adminPage = await fetch(`${process.env.STAGING_URL}/admin`, { redirect: "manual" });
+if (adminPage.status !== 307 || adminPage.headers.get("location") !== "/login") process.exit(1);
+const adminApi = await fetch(`${process.env.STAGING_URL}/api/admin/session`);
+if (adminApi.status !== 401) process.exit(1);
 const account = await fetch(`${process.env.STAGING_URL}/api/account`);
 if (account.status !== 401) process.exit(1);
 const publicHealth = await fetch(`${process.env.STAGING_URL}/api/health`);
diff --git a/deploy/run-staging-migration.sh b/deploy/run-staging-migration.sh
index 00d611f7..1c859f40 100755
--- a/deploy/run-staging-migration.sh
+++ b/deploy/run-staging-migration.sh
@@ -6,6 +6,11 @@ required=(
   INCOMING_PATH DEPLOY_PATH WEB_IMAGE DEPLOY_SHA EXPECTED_PREVIOUS_SHA
   DOCKER_CONFIG
 )
+case "${DOCKER_BIN:-docker}" in
+  docker) docker_command=(docker) ;;
+  "sudo -n docker") docker_command=(sudo -n docker --config "$DOCKER_CONFIG") ;;
+  *) echo "unsafe staging Docker command" >&2; exit 1 ;;
+esac
 for key in "${required[@]}"; do
   if [ -z "${!key:-}" ]; then
     echo "required staging migration input is missing: $key" >&2
@@ -17,12 +22,13 @@ done
   echo "unsafe staging migration revision" >&2
   exit 1
 }
-[[ "$WEB_IMAGE" =~ ^ghcr\.io/jesse-ux/jyotisha-web@sha256:[0-9a-f]{64}$ ]] || {
+image_pattern='^crpi-d1feco6itet73spp\.cn-hongkong\.personal\.cr\.aliyuncs\.com/copse/jyotisha@sha256:[0-9a-f]{64}$'
+[[ "$WEB_IMAGE" =~ $image_pattern ]] || {
   echo "unsafe staging migration image" >&2
   exit 1
 }
 case "$INCOMING_PATH" in
-  "$DEPLOY_PATH"/.incoming/*) ;;
+  /tmp/jyotisha-staging.*) ;;
   *) echo "unsafe incoming staging path" >&2; exit 1 ;;
 esac
 
@@ -38,11 +44,11 @@ current_sha="not-deployed"
 if [ -f "$state_directory/deployed-revision" ]; then
   current_sha="$(<"$state_directory/deployed-revision")"
 else
-  existing_web="$(docker ps -aq \
+  existing_web="$("${docker_command[@]}" ps -aq \
     --filter 'label=com.docker.compose.project=jyotisha-staging' \
     --filter 'label=com.docker.compose.service=web' | head -n 1)"
   if [ -n "$existing_web" ]; then
-    discovered_sha="$(docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' \
+    discovered_sha="$("${docker_command[@]}" inspect --format '{{range .Config.Env}}{{println .}}{{end}}' \
       "$existing_web" | sed -n 's/^GITHUB_SHA=//p' | head -n 1)"
     if [ -n "$discovered_sha" ]; then current_sha="$discovered_sha"; fi
   fi
@@ -71,8 +77,8 @@ bash deploy/validate-staging-env.sh \
 bash deploy/validate-staging-database-env.sh .env.staging.database
 
 export DATABASE_ENV_FILE='../.env.staging.database'
-compose=(docker compose -p jyotisha-staging -f deploy/docker-compose.postgres.yml)
-docker pull "$WEB_IMAGE"
+compose=("${docker_command[@]}" compose -p jyotisha-staging -f deploy/docker-compose.postgres.yml)
+"${docker_command[@]}" pull "$WEB_IMAGE"
 "${compose[@]}" up -d --no-build --pull never --wait postgres
 "${compose[@]}" exec -T postgres psql -v ON_ERROR_STOP=1 -U postgres -d jyotisha \
   -f /dev/stdin < deploy/postgres/002-ensure-business-compatibility-roles.sql
diff --git a/deploy/validate-staging-env.sh b/deploy/validate-staging-env.sh
index d54605cb..807af650 100755
--- a/deploy/validate-staging-env.sh
+++ b/deploy/validate-staging-env.sh
@@ -41,11 +41,9 @@ require_selector() {
 require_selector APP_ENV_FILE ../.env.staging
 require_selector CADDYFILE_PATH ./Caddyfile.staging
 require_selector SITE_ADDRESS https://staging.jyotisha.chat
-require_selector ADMIN_SITE_ADDRESS https://admin.staging.jyotisha.chat
 require_selector AUTH_PROVIDER self-hosted
 require_selector SELF_HOSTED_IDENTITY_ENABLED true
 require_selector AUTH_USER_ORIGIN https://staging.jyotisha.chat
-require_selector AUTH_ADMIN_ORIGIN https://admin.staging.jyotisha.chat
 
 require_literal() {
   local key="$1"
@@ -88,13 +86,6 @@ if ! [[ "$admin_database_url" =~ ^postgresql://admin_runtime:([A-Za-z0-9._~-]|%[
 fi
 
 require_literal BETTER_AUTH_USER_SECRET 32
-user_secret="$LITERAL_VALUE"
-require_literal BETTER_AUTH_ADMIN_SECRET 32
-admin_secret="$LITERAL_VALUE"
-if [ "$user_secret" = "$admin_secret" ]; then
-  echo "staging identity secrets must be different" >&2
-  exit 1
-fi
 require_literal RESEND_API_KEY 10
 require_literal RESEND_FROM_EMAIL 5
 if [[ "$LITERAL_VALUE" != *@* ]]; then
@@ -106,6 +97,13 @@ if [[ "$LITERAL_VALUE" != *@* ]]; then
   echo "invalid staging identity setting: ADMIN_EMAILS" >&2
   exit 1
 fi
+require_literal EPAY_CONFIG_ENCRYPTION_KEY 44
+if [ "${#LITERAL_VALUE}" -ne 44 ] ||
+  [[ ! "$LITERAL_VALUE" =~ ^[A-Za-z0-9+/]{43}=$ ]]; then
+  echo "invalid staging identity setting: EPAY_CONFIG_ENCRYPTION_KEY" >&2
+  exit 1
+fi
+require_selector EPAY_CHAT_ENABLED false
 require_literal JYOTISH_DYNAMIC_RECTIFICATION_TOKEN 32
 
 echo "staging environment selectors: valid"
diff --git a/docs/BUG_HISTORY.md b/docs/BUG_HISTORY.md
index 2ceb3075..ea97b5ab 100644
--- a/docs/BUG_HISTORY.md
+++ b/docs/BUG_HISTORY.md
@@ -2113,3 +2113,51 @@
 - 防复发：任何送往旧事件引擎的日期必须由精度契约测试断言；新增日期表示必须先走共享日历校验，不能在调用端自行拼接或仅增加 Agent 重试步数。
 - 相关记录：BUG-116、BUG-118、BUG-120
 - 修复版本：本记录所在 staging 发布提交
+
+## BUG-122 | self-hosted staging 管理员看不到独立后台入口
+
+- 状态：superseded by BUG-123
+- 首次发现：2026-07-29
+- 最近更新：2026-07-29
+- 影响面：self-hosted staging 账户菜单、`GET /api/account`、独立后台入口；不影响后台独立登录与 `requireAdminSession`
+- 用户现象：身份库已持久化 `admin` 或 `viewer` 角色的用户登录主站后，账户菜单不显示后台入口；即使显示旧入口，主站 `/admin` 路径也会返回 404。
+- 触发条件：`AUTH_PROVIDER=self-hosted`，后台部署在与主站不同的 `AUTH_ADMIN_ORIGIN`，用户角色以逗号分隔形式持久化在 `identity.users.role`。
+- 根因：主站 `isAdminUser` 对 self-hosted 模式直接返回 `false`，没有读取持久化角色；侧栏又把入口写死为主站相对路径 `/admin/codes`。既有后台鉴权已按持久化角色执行，但主站入口发现逻辑没有复用同一授权事实，独立域名部署合同也没有进入账户响应。
+- 修复：self-hosted 分支通过现有 `ADMIN_DATABASE_URL` 管理只读连接查询当前用户的 `identity.users.role`，仅 `admin` 或 `viewer` 可见入口，且不使用 `ADMIN_EMAILS` 替代角色授权；`GET /api/account` 在服务端解析身份配置并返回 `AUTH_ADMIN_ORIGIN + /admin/codes`，Supabase 模式继续返回 `/admin/codes`；账户与侧栏类型透传该 URL，并将文案改为“后台管理”。后台独立登录和 `requireAdminSession` 保持不变。
+- 验证：`frontend/tests/admin-contracts.test.ts`、`frontend/tests/admin-users-contract.test.ts`、`frontend/tests/account-api.test.ts`、`frontend/tests/sidebar-contract.test.ts` 锁定持久化角色、独立后台 URL、服务端环境边界和后台写权限门禁；目标 TypeScript、构建与 staging 登录态 smoke 结果另行记录。
+- 防复发：self-hosted 主站入口发现必须以 `identity.users.role` 为授权事实，不能退回邮箱 allowlist；客户端不得读取后台 origin 环境变量或硬编码主站 `/admin` 路径；后台 API 必须继续独立执行 `requireAdminSession`，入口可见性不得被当作授权。
+- 相关记录：BUG-010、BUG-083、BUG-084、BUG-123
+- 复发自：BUG-010
+- 修复版本：已由 BUG-123 的同域单会话架构取代
+
+## BUG-123 | self-hosted staging 双域后台与主站会话模型冲突
+
+- 状态：resolved
+- 首次发现：2026-07-29
+- 最近更新：2026-07-29
+- 影响面：staging Better Auth 配置、后台页面与 API、登录、账户入口、Caddy、部署校验和 smoke；生产配置不变。
+- 用户现象：管理员需要第二套后台域名和浏览器会话才能进入后台，主站登录态不能直接使用；`viewer` 还被当作后台只读角色，与仅数据库 `admin` 可进入的产品合同冲突。
+- 触发条件：self-hosted staging 同时配置用户与后台 origin/secret、Caddy 拆分两个站点，并按 Host 选择 Better Auth 实例。
+- 根因：早期隔离设计把后台浏览器 surface 当成第二套身份系统，导致入口发现、登录、Cookie、部署变量和授权策略重复；同时把入口可见性与 API 权限错误扩展到 `viewer`。
+- 架构决策：后台复用主站 Better Auth user session；`identity.users.role` 的持久化 `admin` 是唯一后台授权事实。Better Auth 插件的 `/api/auth/admin` endpoint 继续在主站 fail-closed `404`，未知 Host 继续 `421`。
+- 修复：删除活动运行时后台 origin/secret 与 `services.admin`，服务端数据 client 和 `requireAdminSession` 统一读取 user session；后台 layout 增加服务端 gate，匿名转 `/login`、非 admin 不渲染；所有后台 API 保留独立 guard，payments/packages 改用 `requireAdminSession`；`isAdminUser`、账户入口和 Refine policy 收敛为 admin-only；登录取消 Host 分流；staging Caddy、Compose、环境校验、部署脚本、工作流和 smoke 收敛为同域。
+- 验证：身份 config/host/auth、admin policy/contracts、account/sidebar/login、部署/工作流与 admin layout/API guard 合同更新；针对性测试、TypeScript、Next build 与 `git diff --check` 结果记录在本次交付报告。生产部署未执行。
+- 防复发：活动运行配置和测试不得重新引入独立后台域名、`AUTH_ADMIN_ORIGIN`、`BETTER_AUTH_ADMIN_SECRET` 或浏览器 admin auth service；`viewer` 对后台入口、页面、读 API 和写 API 均必须为 `403`；入口可见性不能替代 route guard。
+- 相关记录：BUG-010、BUG-083、BUG-084、BUG-122
+- 复发自：BUG-122
+- 修复版本：`435e628806390e7ae138363491e7bae63ee801d4`，staging 已验收
+
+## BUG-124 | 后台支付入口分散且界面风格不一致
+
+- 状态：resolved
+- 首次发现：2026-07-29
+- 最近更新：2026-07-30
+- 影响面：后台 Refine 侧栏、`/admin/payments`、`/admin/packages`、易支付配置与对话页充值入口。
+- 用户现象：支付记录与支付配置占用两个导航项，页面仍使用主站 `standalone-page/admin-header/admin-section` 样式；套餐新增表单常驻页面，后台默认退出入口还会触发登出，管理员难以直接返回对话；对话页支付入口缺少安全默认关闭和服务端创建订单硬门禁。2026-07-29 复发时，Z-Pay 配置不能折叠且占据长页面，后台受全局 `html/body overflow:hidden` 限制无法纵向滚动，套餐 API 与易支付配置 API 仍调用 self-hosted adapter 不支持的 Supabase builder/RPC。2026-07-30 部署 `dd8e2ad9c7e76d0152b4563c43a45b1e26137035` 后，`GET /api/admin/payments` 与套餐管理仍返回 500。
+- 触发条件：进入同域 `/admin` 后管理支付记录或套餐，或点击 Refine 侧栏底部默认 Logout；复发条件为进入支付管理、展开长配置或调用套餐 CRUD / 易支付配置读写。2026-07-30 的数据库权限复发在 `admin_runtime` 通过 `ADMIN_DATABASE_URL` 查询支付表时稳定触发。
+- 根因：首轮支付后台实现依赖 Supabase 专用关联 select、分页、计数和 Admin Auth 查询；self-hosted staging 的本地 PostgreSQL adapter 不支持这些 builder 能力，支付记录因此统一降级为“支付记录服务暂时不可用”。同页套餐设计也不符合最新后台信息架构，易支付配置响应漏投影 `chat_enabled`，chat 创建订单又依赖服务端提交网关后猜测跳转地址，不兼容标准易支付收银台表单页。复发遗漏源于上轮只把支付记录切换到 PostgreSQL，套餐与配置契约测试没有锁定 self-hosted 数据链，且未覆盖聊天全局滚动边界下的后台专用滚动容器。2026-07-30 的直接根因是 `20260727020000_epay_packages_orders.sql` 只向 Supabase 的 `service_role` / `authenticated` 授权，未向 self-hosted 后台实际使用的 `admin_runtime` 授予 `payment_packages`、`payment_orders` 权限，也未添加对应 RLS 策略；因此数据库健康且新 SHA 已部署，后台 SQL 仍被 PostgreSQL权限门禁拒绝。同日还确认 staging 迁移与部署工作流错误地要求目标 SHA 属于 `main` 历史，使完全独立的测试分支被生产分支阻塞；该控制面耦合导致为恢复 staging 而误合并生产 main。
+- 修复：支付记录改为通过 `queryAdminRows` 执行参数化 SQL，联表 `public.payment_orders`、`public.payment_packages` 和 `identity.users`，以窗口计数保留分页合同并用独立聚合 SQL输出统计；不再使用 Supabase builder 或 Admin Auth。后台在支付管理之后新增独立“套餐管理”资源和页面，套餐新增、编辑、停用、错误重试及原字段保持完整，支付页只保留概览、Z-Pay（易支付）渠道配置和支付记录。配置读取补回 `chat_enabled` 与 `chatEnabled`。创建订单完成登录、开关、配置、SSRF、套餐和订单校验后，直接返回带 `sign/sign_type` 的标准 `submit.php` 收银台 URL，不服务端请求网关、不返回商户密钥；对话页用浏览器打开该 URL，套餐加载异常显示安全错误，正常 `enabled=false` 仍静默隐藏。复发修复将 Z-Pay 配置改为默认收起的 Ant Design `Collapse`，展开后才显示表单和操作；为 AdminApp 增加 `admin-app-shell` 的 `100dvh` 独立纵向滚动边界而不改聊天全局规则；套餐 CRUD 全部改用 `queryAdminRows` 参数化 SQL、UUID 校验、`returning` 与 404；易支付读取仅在 PostgreSQL `42P01` 时回退环境变量，保存直接参数化调用 `public.admin_save_epay_settings` 并使用函数返回行，保留原子审计和脱敏响应。2026-07-30 新增前向迁移 `20260730010000_admin_payment_permissions.sql`，向 `admin_runtime` 最小授予套餐读写、订单只读、易支付配置读取及保存函数执行权限，并为启用 RLS 的支付表补齐角色策略；不授予订单写入或删除权限。Gitea 与 GitHub 的 staging 迁移、部署和测试环境运维工作流统一 checkout `staging`，删除 staging SHA 属于 `main` 历史的要求；生产工作流保持不变。误合入 main 的 PR #1 已由 PR #2 的 revert 恢复，恢复后 main 内容树与合并前提交 `43581ac0f75e7f157032503475e878bd53ad161d` 完全一致。针对 run 1309，Gitea 两条远端工作流的 previous-SHA 探测与 registry login/logout 保持 `sudo -n docker`；脚本只接受受控的 `docker` 或 `sudo -n docker` 数组分支并拒绝其他值，不使用 `eval`。run 1313 证明 sudo Docker login 已成功，但 `run-staging-migration.sh` 第 37 行无法写入 root-owned 部署树下的 `/opt/jyotisha-staging/.state/mutation.lock`。因此迁移与部署工作流改为通过 `sudo -n env` 传入受控环境并以 root 启动整个脚本，脚本内固定 `DOCKER_BIN=docker`，`DOCKER_CONFIG` 仍指向 incoming 的 `.docker`；cleanup 使用 `sudo -n rm -rf` 删除脚本可能创建的 root-owned incoming 内容，Docker logout 仍使用 sudo。
+- 验证：`frontend/tests/admin-contracts.test.ts` 锁定支付、套餐资源顺序；`frontend/tests/admin-payments-contract.test.ts` 锁定本地参数化 SQL、`identity.users` 联表、套餐 SQL CRUD/UUID/404、独立套餐页面、默认折叠和后台专用滚动容器；`frontend/tests/epay-settings.test.ts` 锁定 `chatEnabled` 回显、`queryAdminRows` 读取、参数化 `admin_save_epay_settings`、不依赖 Supabase builder/RPC、默认折叠和不泄露 key。2026-07-29 运行三份契约测试共 27 项全部通过；ESLint、TypeScript 与 `git diff --check` 结果记录在本次交付报告。2026-07-30 线上健康响应证明部署 SHA 为 `dd8e2ad9c7e76d0152b4563c43a45b1e26137035` 且本地业务库、身份库均健康；静态权限审计确认支付迁移缺少 `admin_runtime` grant/RLS。新增权限迁移契约后，支付、套餐、配置三组 21 项回归全部通过。首次独立 staging 迁移 run 1300 在镜像校验阶段暴露 `docker manifest inspect --verbose` 对 ACR 返回单元素数组，而解析器只接受对象，触发 `AttributeError: 'list' object has no attribute 'get'`；Gitea staging 迁移与部署已兼容单平台数组并增加聚焦契约测试。run 1309 进一步确认远端 `deploy` 用户对 `/var/run/docker.sock` 无权限；run 1313 的 sudo Docker login 已成功，随后在迁移脚本第 37 行因 deploy 用户不能写 root-owned `/opt/jyotisha-staging/.state/mutation.lock` 而终止，证明仅提升 Docker 命令不足以覆盖部署树写入。工作流回归现锁定整个脚本由 `sudo -n env` 启动、脚本内 `DOCKER_BIN=docker`、incoming Docker 配置不变、root-owned cleanup 使用 sudo，并继续保留 runner 对两种固定 Docker 命令形式的契约。staging 最终部署 SHA 为 `1f44892a2cf210797e7dc74f49721a8f10c8849d`；迁移台账确认 `20260730010000_admin_payment_permissions.sql` 于 2026-07-30 05:58:38 UTC 应用，数据库 ACL/RLS 与 `admin_save_epay_settings` 的 `admin_runtime` 执行权限均已生效，web/api/postgres 容器健康，三个未登录管理 API 正确返回 401，部署后日志无相关 500。支付、套餐与易支付配置 21 项针对性回归通过，管理员随后确认 `/admin/payments` 与 `/admin/packages` 已恢复。
+- 防复发：self-hosted staging 后台查询不得依赖 LocalPostgresDataClient 未实现的 Supabase builder、RPC 或 Admin Auth 能力；支付与套餐必须保持独立资源顺序。套餐与易支付配置契约必须显式拒绝 Supabase builder/RPC 并锁定参数化 SQL、404、原子函数写入和安全错误响应；支付配置必须默认折叠，后台必须拥有独立滚动容器且不得放宽聊天的全局 `overflow:hidden`。易支付配置读写测试必须同时覆盖数据库列和公开字段；创建订单只生成经公网 SSRF 校验的签名收银台 URL，商户密钥只能参与服务端签名，不得进入 URL、响应、日志或审计。对话支付默认关闭，UI 与创建订单 API 必须共享服务端开关；可用性测试不得提交伪订单或返回 URL、PID、密钥、headers/body。
+- 相关记录：BUG-122、BUG-123
+- 修复版本：`d44a414`（权限迁移），staging 部署 `1f44892a2cf210797e7dc74f49721a8f10c8849d`
diff --git a/docs/operations/self-hosted-identity.md b/docs/operations/self-hosted-identity.md
index 2e7009cb..0b1e634d 100644
--- a/docs/operations/self-hosted-identity.md
+++ b/docs/operations/self-hosted-identity.md
@@ -4,29 +4,27 @@ Staging uses Better Auth and the private local PostgreSQL cluster for both ident
 
 ## Staging mode
 
-Keep these two values exactly as shown:
+Keep these values exactly as shown:
 
 ```dotenv
 AUTH_PROVIDER=self-hosted
 SELF_HOSTED_IDENTITY_ENABLED=true
+AUTH_USER_ORIGIN=https://staging.jyotisha.chat
 ```
 
-This makes both login hosts use isolated Better Auth surfaces. Public and admin sessions have different secrets and host-only cookie prefixes. Server routes translate the Better Auth session into PostgreSQL request claims and use the reviewed existing RLS/RPC business contract. The browser uses only same-origin APIs and does not need Supabase configuration.
+Staging has one browser identity surface on the main site. The same Better Auth user session serves ordinary pages and `/admin`; there is no independent admin origin, secret, cookie, or login host. Server routes translate that session into PostgreSQL request claims. Admin authorization then reads the persisted `identity.users.role` value and permits only `admin`; `viewer` and ordinary users receive `403`. The main auth route continues to return `404` for Better Auth `/api/auth/admin` plugin endpoints, and unknown hosts fail closed with `421`.
 
 Use [the tracked staging identity example](../../deploy/.env.staging.identity.example) as a list of names only. Replace bracketed values directly on the server and keep `/opt/jyotisha-staging/.env.staging` owned by `deploy` with mode `0600`.
 
-Generate separate secrets locally on the server:
+Generate `BETTER_AUTH_USER_SECRET` locally on the server:
 
 ```bash
 openssl rand -base64 32
-openssl rand -base64 32
 ```
 
-Do not reuse either value as a PostgreSQL password. `IDENTITY_DATABASE_URL`, `APP_DATABASE_URL`, and `ADMIN_DATABASE_URL` use their matching passwords from `.env.staging.database`, percent-encoded only in each URL password component. All three must point to the private Compose hostname `postgres:5432/jyotisha`; never publish PostgreSQL on a host port.
+Do not reuse it as a PostgreSQL password. `IDENTITY_DATABASE_URL`, `APP_DATABASE_URL`, and `ADMIN_DATABASE_URL` use their matching passwords from `.env.staging.database`, percent-encoded only in each URL password component. All three must point to the private Compose hostname `postgres:5432/jyotisha`; never publish PostgreSQL on a host port.
 
-The Resend key must be staging-only. `RESEND_FROM_EMAIL` must use a sender/domain verified in Resend. CI never receives this key and uses an in-memory sender.
-
-Set `ADMIN_EMAILS` to the staging administrator allowlist. Generate an independent `JYOTISH_DYNAMIC_RECTIFICATION_TOKEN` and place the same value in the shared application env consumed by the web and private API containers; do not reuse a database or Better Auth secret.
+The Resend key must be staging-only. `RESEND_FROM_EMAIL` must use a sender/domain verified in Resend. CI never receives this key and uses an in-memory sender. `ADMIN_EMAILS` remains relevant only to the legacy Supabase production path; it is not self-hosted admin authorization.
 
 Validate without printing values:
 
@@ -38,17 +36,17 @@ bash deploy/validate-staging-env.sh .env.staging
 
 ## Migration and smoke checks
 
-Apply the reviewed PostgreSQL migrations through the existing `Migrate Staging Database` workflow before deploying the web image. The workflow first ensures the compatibility roles exist, then applies the identity schema, the local `auth` compatibility layer, and all reviewed business migrations under the migration ledger. Better Auth users are transactionally projected into `auth.users`, which creates their business profile through the existing trigger.
+Apply the reviewed PostgreSQL migrations through the existing `Migrate Staging Database` workflow before deploying the web image. Better Auth users are transactionally projected into `auth.users`, which creates their business profile through the existing trigger.
 
-After deployment:
+After deployment, verify the single-domain contract:
 
 ```bash
-curl -fsS https://admin.staging.jyotisha.chat/login >/dev/null
-curl -fsS https://admin.staging.jyotisha.chat/api/auth/get-session
-test "$(curl -sS -o /dev/null -w '%{http_code}' https://staging.jyotisha.chat/admin/codes)" = 404
+curl -fsS https://staging.jyotisha.chat/login >/dev/null
+test "$(curl -sS -o /dev/null -w '%{http_code}' https://staging.jyotisha.chat/api/admin/session)" = 401
+test "$(curl -sS -o /dev/null -w '%{http_code}' https://staging.jyotisha.chat/api/account)" = 401
 ```
 
-The admin root redirects to `/admin/codes`; the public host rejects `/admin` and `/api/admin` paths. An unknown or unpromoted email cannot create an admin session. Promote an imported staging user only through a reviewed database/admin operation; the persisted `identity.users.role` value must include `admin` before the admin OTP flow can issue a cookie.
+An anonymous `/admin` request redirects to `/login`. An authenticated non-admin, including a persisted `viewer`, must not render the admin layout and every `/api/admin/*` route must independently return `403`. Promote a staging user only through a reviewed database operation; the persisted role must include `admin` before the main-site session can enter the backend.
 
 ## Optional import rehearsal
 
@@ -75,8 +73,8 @@ Reruns are idempotent by UUID and the whole import is transactional. Duplicate c
 
 ## Rollback and rotation
 
-An application rollback must use a previously validated staging image and does not reverse database migrations. Existing self-hosted sessions and data remain in PostgreSQL; do not delete identity or business rows during application rollback. Returning staging to Supabase would require a separate reviewed data-reconciliation and provider-switch change, not an environment-only toggle.
+An application rollback must use a previously validated staging image and does not reverse database migrations. Existing self-hosted sessions and data remain in PostgreSQL; do not delete identity or business rows during application rollback. Returning staging to Supabase requires a separate reviewed data-reconciliation and provider-switch change.
 
-Rotating either Better Auth secret invalidates only that surface's existing sessions. Rotate user and admin secrets separately, restart the web service, and verify the corresponding host. Rotate a leaked Resend key in Resend first, replace the server value, then restart. Never print the old or new values.
+Rotating `BETTER_AUTH_USER_SECRET` invalidates all self-hosted browser sessions, including admins. Restart the web service and verify login, anonymous admin API rejection, admin access, and viewer rejection. Rotate a leaked Resend key in Resend first, replace the server value, then restart. Never print old or new values.
 
 Production `AUTH_PROVIDER=self-hosted` remains blocked until data reconciliation passes, production backups and restore drills exist, operational monitoring is ready, and a separate reviewed production cutover plan is approved.
diff --git a/docs/superpowers/plans/2026-07-21-self-hosted-identity.md b/docs/superpowers/plans/2026-07-21-self-hosted-identity.md
index aaa37b31..53c61c26 100644
--- a/docs/superpowers/plans/2026-07-21-self-hosted-identity.md
+++ b/docs/superpowers/plans/2026-07-21-self-hosted-identity.md
@@ -1,3 +1,5 @@
+> Superseded 2026-07-29: staging browser identity and admin access now use one main-site Better Auth user session; the dual-domain admin surface in this historical plan is inactive.
+
 # Self-Hosted Identity Implementation Plan
 
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task.
diff --git a/docs/superpowers/specs/2026-07-20-supabase-exit-backend-design.md b/docs/superpowers/specs/2026-07-20-supabase-exit-backend-design.md
index 1484b232..cb86551c 100644
--- a/docs/superpowers/specs/2026-07-20-supabase-exit-backend-design.md
+++ b/docs/superpowers/specs/2026-07-20-supabase-exit-backend-design.md
@@ -1,3 +1,5 @@
+> Superseded 2026-07-29: staging browser identity and admin access now use one main-site Better Auth user session; the dual-domain admin surface in this historical specification is inactive.
+
 # Jyotisha Supabase Exit and Self-Hosted Backend Design
 
 Date: 2026-07-20
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 0adbd951..da1047c3 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -28,6 +28,7 @@
         "react-dom": "19.2.4",
         "react-markdown": "^10.1.0",
         "remark-gfm": "^4.0.1",
+        "server-only": "^0.0.1",
         "sonner": "^2.0.7",
         "tailwind-merge": "^3.6.0",
         "tailwindcss": "^4.3.2",
@@ -10464,6 +10465,12 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/server-only": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/server-only/-/server-only-0.0.1.tgz",
+      "integrity": "sha512-qepMx2JxAa5jjfzxG79yPPq+8BuFToHd1hm7kI+Z4zAq1ftQiP7HcxMhDDItrbtwVeLg/cY2JnKnrcFkmiswNA==",
+      "license": "MIT"
+    },
     "node_modules/sonner": {
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/sonner/-/sonner-2.0.7.tgz",
diff --git a/frontend/package.json b/frontend/package.json
index 4811a6ca..9f1c2ea1 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -42,6 +42,7 @@
     "react-dom": "19.2.4",
     "react-markdown": "^10.1.0",
     "remark-gfm": "^4.0.1",
+    "server-only": "^0.0.1",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.6.0",
     "tailwindcss": "^4.3.2",
diff --git a/frontend/scripts/db-migrate.mjs b/frontend/scripts/db-migrate.mjs
index 446364b6..6b56215d 100644
--- a/frontend/scripts/db-migrate.mjs
+++ b/frontend/scripts/db-migrate.mjs
@@ -7,6 +7,14 @@ import pg from "pg";
 const { Client } = pg;
 const migrationFilenamePattern = /^\d{14}_[a-z0-9_]+\.sql$/;
 const retiredMigrationChecksums = new Map([
+  [
+    "20260727010000_rectification_v4_conversational_turns.sql",
+    "1f4fcd5d14b1dc7a280d31e7023777308be5fcc0c49fa46c0fac10f682044115",
+  ],
+  [
+    "20260727010000_refine_admin_redemption_audit.sql",
+    "df37255ecfd5bffc34600190de84ff53245ab7e5a91226eb745a010467f08104",
+  ],
   [
     "20260727010000_admin_users.sql",
     "785f4fdc65db1028623cc7b5a2571217b913ef9e55f5a17b01658a71612976de",
diff --git a/frontend/scripts/staging-image-manifest.mjs b/frontend/scripts/staging-image-manifest.mjs
index bb27f13d..767c5644 100644
--- a/frontend/scripts/staging-image-manifest.mjs
+++ b/frontend/scripts/staging-image-manifest.mjs
@@ -5,8 +5,14 @@ import { pathToFileURL } from "node:url";
 const shaPattern = /^[0-9a-f]{40}$/;
 const digestPattern = /^sha256:[0-9a-f]{64}$/;
 const expectedKeys = ["git_sha", "api_digest", "web_digest"];
+const defaultRegistry = "ghcr.io/jesse-ux";
+const acrRepository = "crpi-d1feco6itet73spp.cn-hongkong.personal.cr.aliyuncs.com/copse/jyotisha";
+const registryPattern = /^(?:[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::[1-9][0-9]{0,4})?(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/;
 
-export function parseStagingImageManifest(text, expectedSha) {
+export function parseStagingImageManifest(text, expectedSha, registry = defaultRegistry) {
+  if (!registryPattern.test(registry)) {
+    throw new Error("invalid staging image registry");
+  }
   if (!shaPattern.test(expectedSha)) {
     throw new Error("invalid expected staging revision");
   }
@@ -37,12 +43,13 @@ export function parseStagingImageManifest(text, expectedSha) {
     }
   }
 
+  const sharedRepository = registry === acrRepository;
   return {
     gitSha: expectedSha,
     apiDigest: values.get("api_digest"),
     webDigest: values.get("web_digest"),
-    apiImage: `ghcr.io/jesse-ux/jyotisha-api@${values.get("api_digest")}`,
-    webImage: `ghcr.io/jesse-ux/jyotisha-web@${values.get("web_digest")}`,
+    apiImage: `${sharedRepository ? registry : `${registry}/jyotisha-api`}@${values.get("api_digest")}`,
+    webImage: `${sharedRepository ? registry : `${registry}/jyotisha-web`}@${values.get("web_digest")}`,
   };
 }
 
@@ -52,13 +59,14 @@ const invokedPath = process.argv[1]
 
 if (invokedPath === import.meta.url) {
   try {
-    const [manifestPath, expectedSha] = process.argv.slice(2);
+    const [manifestPath, expectedSha, registry] = process.argv.slice(2);
     if (!manifestPath || !expectedSha) {
       throw new Error("manifest path and expected revision are required");
     }
     const manifest = parseStagingImageManifest(
       await readFile(manifestPath, "utf8"),
       expectedSha,
+      registry,
     );
     process.stdout.write(
       [
diff --git a/frontend/src/app/admin/layout.tsx b/frontend/src/app/admin/layout.tsx
index b331ca7b..c7e13d4b 100644
--- a/frontend/src/app/admin/layout.tsx
+++ b/frontend/src/app/admin/layout.tsx
@@ -1,11 +1,21 @@
 import "@refinedev/antd/dist/reset.css";
 import "antd/dist/reset.css";
 import type { ReactNode } from "react";
+import { redirect } from "next/navigation";
 
 import { AdminApp } from "@/components/admin/admin-app";
+import { AdminAuthorizationError, requireAdminSession } from "@/lib/admin/auth";
 
 export const dynamic = "force-dynamic";
 
-export default function AdminLayout({ children }: { children: ReactNode }) {
+export default async function AdminLayout({ children }: { children: ReactNode }) {
+  try {
+    await requireAdminSession("read");
+  } catch (error) {
+    if (error instanceof AdminAuthorizationError) {
+      redirect(error.status === 401 ? "/login" : "/");
+    }
+    throw error;
+  }
   return <AdminApp>{children}</AdminApp>;
 }
diff --git a/frontend/src/app/admin/packages/page.tsx b/frontend/src/app/admin/packages/page.tsx
new file mode 100644
index 00000000..2ab9a048
--- /dev/null
+++ b/frontend/src/app/admin/packages/page.tsx
@@ -0,0 +1,5 @@
+import { PackageManagement } from "@/components/admin/package-management";
+
+export default function AdminPackagesPage() {
+  return <PackageManagement />;
+}
diff --git a/frontend/src/app/admin/payments/page.tsx b/frontend/src/app/admin/payments/page.tsx
new file mode 100644
index 00000000..bf3b1f10
--- /dev/null
+++ b/frontend/src/app/admin/payments/page.tsx
@@ -0,0 +1,5 @@
+import PaymentManagement from "@/components/admin/payment-management";
+
+export default function AdminPaymentsPage() {
+  return <PaymentManagement />;
+}
diff --git a/frontend/src/app/admin/route.ts b/frontend/src/app/admin/route.ts
index 43b0bd97..cc04f81d 100644
--- a/frontend/src/app/admin/route.ts
+++ b/frontend/src/app/admin/route.ts
@@ -1,6 +1,19 @@
-export function GET() {
-  return new Response(null, {
-    status: 307,
-    headers: { location: "/admin/codes" },
-  });
+import { AdminAuthorizationError, requireAdminSession } from "@/lib/admin/auth";
+
+export async function GET() {
+  try {
+    await requireAdminSession("read");
+    return new Response(null, {
+      status: 307,
+      headers: { location: "/admin/codes" },
+    });
+  } catch (error) {
+    if (error instanceof AdminAuthorizationError) {
+      return new Response(null, {
+        status: 307,
+        headers: { location: error.status === 401 ? "/login" : "/" },
+      });
+    }
+    throw error;
+  }
 }
diff --git a/frontend/src/app/admin/users/page.tsx b/frontend/src/app/admin/users/page.tsx
new file mode 100644
index 00000000..d57241a1
--- /dev/null
+++ b/frontend/src/app/admin/users/page.tsx
@@ -0,0 +1,33 @@
+"use client";
+
+import Link from "next/link";
+import { FormEvent, useEffect, useState } from "react";
+
+type AdminUser = { userId: string | null; email: string | null; createdAt: string | null; source: "env" | "database" };
+
+async function loadUsers(): Promise<AdminUser[]> {
+  const response = await fetch("/api/admin/users", { cache: "no-store" });
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(payload?.error || "暂时无法读取管理员列表");
+  return payload.users;
+}
+
+export default function AdminUsersPage() {
+  const [users, setUsers] = useState<AdminUser[]>([]);
+  const [email, setEmail] = useState("");
+  const [error, setError] = useState("");
+  useEffect(() => { void loadUsers().then(setUsers).catch((caught) => setError(caught.message)); }, []);
+  async function add(event: FormEvent) {
+    event.preventDefault(); setError("");
+    const response = await fetch("/api/admin/users", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ email }) });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok) { setError(payload?.error || "添加失败"); return; }
+    setEmail(""); setUsers(await loadUsers());
+  }
+  async function revoke(userId: string) {
+    const response = await fetch("/api/admin/users", { method: "DELETE", headers: { "content-type": "application/json" }, body: JSON.stringify({ userId }) });
+    if (!response.ok) { const payload = await response.json().catch(() => null); setError(payload?.error || "撤销失败"); return; }
+    setUsers(await loadUsers());
+  }
+  return <main className="standalone-page admin-page"><header className="admin-header"><h1>管理员管理</h1><Link className="button-secondary" href="/admin/codes">兑换码管理</Link></header><div className="admin-scroll"><section className="admin-section"><div className="section-title"><div><h2>添加管理员</h2><p>仅能添加已经注册的 Supabase 用户。</p></div></div><form className="code-form" onSubmit={add}><label className="note-field"><span>邮箱</span><input type="email" required value={email} onChange={(event) => setEmail(event.target.value)} /></label><button className="button-primary" type="submit">添加</button></form>{error && <p className="form-error" role="alert">{error}</p>}</section><section className="admin-section"><div className="section-title"><div><h2>当前管理员</h2><p>{users.length} 位</p></div></div><div className="admin-table-wrap"><table className="admin-table"><thead><tr><th>邮箱</th><th>来源</th><th>添加时间</th><th>操作</th></tr></thead><tbody>{users.map((user) => <tr key={`${user.source}-${user.userId ?? user.email}`}><td>{user.email || "—"}</td><td>{user.source === "env" ? "环境配置" : "后台配置"}</td><td>{user.createdAt ? new Date(user.createdAt).toLocaleString("zh-CN") : "—"}</td><td>{user.userId && <button className="button-secondary" type="button" onClick={() => void revoke(user.userId!)}>撤销</button>}</td></tr>)}</tbody></table></div></section></div></main>;
+}
diff --git a/frontend/src/app/api/account/route.ts b/frontend/src/app/api/account/route.ts
index 69ce6d0c..e143cbc6 100644
--- a/frontend/src/app/api/account/route.ts
+++ b/frontend/src/app/api/account/route.ts
@@ -8,7 +8,7 @@ import {
   applyAccountProfileConcurrencyGuards,
   resolveAccountBirthTimeApplicationPatch,
 } from "@/lib/account-profile-patch";
-import { createAdminSupabaseClient, isAdminEmail } from "@/lib/supabase/admin";
+import { createAdminSupabaseClient, isAdminUser } from "@/lib/supabase/admin";
 import {
   isSupabaseConfigurationError,
 } from "@/lib/supabase/config";
@@ -109,11 +109,14 @@ export async function GET() {
       profile,
       Array.isArray(rectificationCaseRows) ? rectificationCaseRows : [],
     );
+    const isAdmin = await isAdminUser(user);
+    const adminUrl = isAdmin ? "/admin/codes" : null;
 
     return NextResponse.json({
       user: { id: user.id, email: user.email ?? null },
       credits: profile.credits,
-      isAdmin: isAdminEmail(user.email),
+      isAdmin,
+      adminUrl,
       rectificationPriceCredits,
       hasConfirmedBirthTime: profile.birth_time_status === "confirmed"
         && typeof profile.active_birth_time === "string",
diff --git a/frontend/src/app/api/admin/epay-settings/route.ts b/frontend/src/app/api/admin/epay-settings/route.ts
new file mode 100644
index 00000000..50cdd7b5
--- /dev/null
+++ b/frontend/src/app/api/admin/epay-settings/route.ts
@@ -0,0 +1,132 @@
+import crypto from "node:crypto";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { requireAdminSession } from "@/lib/admin/auth";
+import { isPostgresError, queryAdminRows } from "@/lib/admin/database";
+import { adminErrorResponse } from "@/lib/admin/http";
+import { suggestedEpayUrls } from "@/lib/epay/config";
+import { encryptEpayKey } from "@/lib/epay/encryption";
+
+export const runtime = "nodejs";
+
+const httpUrl = z.string().trim().min(1).max(2048).url().refine((value) => /^https?:\/\//i.test(value), "必须使用 HTTP(S)");
+const settingsSchema = z.object({
+  gatewayUrl: httpUrl,
+  pid: z.string().trim().min(1).max(200),
+  notifyUrl: httpUrl,
+  returnUrl: httpUrl,
+  siteName: z.string().trim().min(1).max(100),
+  chatEnabled: z.boolean(),
+  newKey: z.string().min(1).max(1000).optional(),
+}).strict();
+
+type SettingsRow = {
+  gateway_url: string;
+  pid: string;
+  encrypted_key: string;
+  notify_url: string;
+  return_url: string;
+  site_name: string;
+  chat_enabled: boolean;
+  updated_at?: Date;
+};
+
+function publicSettings(row: SettingsRow, source: "database" | "environment") {
+  return {
+    gatewayUrl: row.gateway_url,
+    pid: row.pid,
+    notifyUrl: row.notify_url,
+    returnUrl: row.return_url,
+    siteName: row.site_name,
+    chatEnabled: row.chat_enabled,
+    keyConfigured: Boolean(row.encrypted_key),
+    complete: Boolean(row.gateway_url && row.pid && row.encrypted_key && row.notify_url && row.return_url && row.site_name),
+    source,
+    updatedAt: source === "database" ? row.updated_at?.toISOString() ?? null : null,
+  };
+}
+
+function environmentSettings() {
+  const defaults = suggestedEpayUrls();
+  const row: SettingsRow = {
+    gateway_url: process.env.EPAY_GATEWAY_URL?.trim() || "",
+    pid: process.env.EPAY_PID?.trim() || "",
+    encrypted_key: process.env.EPAY_KEY?.trim() ? "configured" : "",
+    notify_url: process.env.EPAY_NOTIFY_URL?.trim() || defaults.notifyUrl,
+    return_url: process.env.EPAY_RETURN_URL?.trim() || defaults.returnUrl,
+    site_name: process.env.EPAY_SITE_NAME?.trim() || "Jyotisha",
+    chat_enabled: ["true", "1"].includes(process.env.EPAY_CHAT_ENABLED?.trim().toLowerCase() || ""),
+  };
+  return publicSettings(row, "environment");
+}
+
+async function databaseRow() {
+  try {
+    const rows = await queryAdminRows<SettingsRow>(`
+      select gateway_url, pid, encrypted_key, notify_url, return_url, site_name, chat_enabled, updated_at
+      from public.epay_settings
+      where id = true
+      limit 1
+    `);
+    return rows[0] ?? null;
+  } catch (error) {
+    if (isPostgresError(error) && error.code === "42P01") return null;
+    throw error;
+  }
+}
+
+export async function GET() {
+  try {
+    await requireAdminSession("read");
+    const row = await databaseRow();
+    if (row) return NextResponse.json(publicSettings(row, "database"));
+    const settings = environmentSettings();
+    return NextResponse.json(settings.complete || settings.keyConfigured
+      ? settings
+      : { ...settings, source: "unconfigured" });
+  } catch (error) {
+    return adminErrorResponse(error);
+  }
+}
+
+export async function PUT(request: Request) {
+  try {
+    const session = await requireAdminSession("write");
+    const parsed = settingsSchema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) return NextResponse.json({ error: "易支付配置参数不正确" }, { status: 400 });
+
+    const existing = await databaseRow();
+    if (!existing && !parsed.data.newKey) {
+      return NextResponse.json({ error: "首次保存数据库配置时必须输入新的商户密钥" }, { status: 400 });
+    }
+    const encryptedKey = parsed.data.newKey
+      ? encryptEpayKey(parsed.data.newKey)
+      : existing!.encrypted_key;
+    try {
+      const rows = await queryAdminRows<SettingsRow>(`
+        select * from public.admin_save_epay_settings(
+          $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12
+        )
+      `, [
+        session.user.id,
+        session.user.email,
+        session.role,
+        crypto.randomUUID(),
+        parsed.data.gatewayUrl.replace(/\/+$/, ""),
+        parsed.data.pid,
+        encryptedKey,
+        parsed.data.notifyUrl,
+        parsed.data.returnUrl,
+        parsed.data.siteName,
+        parsed.data.chatEnabled,
+        Boolean(parsed.data.newKey),
+      ]);
+      if (!rows[0]) return NextResponse.json({ error: "保存易支付配置失败" }, { status: 500 });
+      return NextResponse.json(publicSettings(rows[0], "database"));
+    } catch {
+      return NextResponse.json({ error: "保存易支付配置失败" }, { status: 500 });
+    }
+  } catch (error) {
+    return adminErrorResponse(error);
+  }
+}
diff --git a/frontend/src/app/api/admin/epay-settings/test/route.ts b/frontend/src/app/api/admin/epay-settings/test/route.ts
new file mode 100644
index 00000000..de157d34
--- /dev/null
+++ b/frontend/src/app/api/admin/epay-settings/test/route.ts
@@ -0,0 +1,46 @@
+import { NextResponse } from "next/server";
+import { AdminAuthorizationError, requireAdminSession } from "@/lib/admin/auth";
+import { adminErrorResponse } from "@/lib/admin/http";
+import { epaySubmitUrl, readEpayConfig } from "@/lib/epay/config";
+import { assertPublicGatewayUrl } from "@/lib/epay/gateway-policy";
+
+export const runtime = "nodejs";
+
+function reachableStatus(status: number) {
+  return status >= 200 && status < 500;
+}
+
+export async function POST() {
+  try {
+    await requireAdminSession("write");
+    const config = await readEpayConfig();
+    const submitUrl = epaySubmitUrl(config.gatewayUrl);
+    await assertPublicGatewayUrl(submitUrl);
+    const startedAt = performance.now();
+    let response = await fetch(submitUrl, {
+      method: "HEAD",
+      redirect: "manual",
+      signal: AbortSignal.timeout(8_000),
+    });
+    if (response.status === 405 || response.status === 501) {
+      response = await fetch(submitUrl, {
+        method: "GET",
+        redirect: "manual",
+        signal: AbortSignal.timeout(8_000),
+      });
+    }
+    const available = reachableStatus(response.status);
+    return NextResponse.json({
+      available,
+      message: available ? "当前已保存的易支付配置可访问" : "当前已保存的易支付配置暂不可用",
+      latencyMs: Math.round(performance.now() - startedAt),
+      status: response.status,
+    });
+  } catch (error) {
+    if (error instanceof AdminAuthorizationError) return adminErrorResponse(error);
+    return NextResponse.json({
+      available: false,
+      message: "当前已保存的易支付配置暂不可用",
+    });
+  }
+}
diff --git a/frontend/src/app/api/admin/packages/route.ts b/frontend/src/app/api/admin/packages/route.ts
new file mode 100644
index 00000000..6601686d
--- /dev/null
+++ b/frontend/src/app/api/admin/packages/route.ts
@@ -0,0 +1,114 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { requireAdminSession } from "@/lib/admin/auth";
+import { queryAdminRows } from "@/lib/admin/database";
+import { adminErrorResponse } from "@/lib/admin/http";
+
+export const runtime = "nodejs";
+
+const schema = z.object({
+  name: z.string().trim().min(1).max(80),
+  description: z.string().trim().max(500),
+  priceCents: z.number().int().positive().max(100_000_000),
+  credits: z.number().int().positive().max(10_000_000),
+  sortOrder: z.number().int().min(-100_000).max(100_000),
+  enabled: z.boolean(),
+}).strict();
+const updateSchema = schema.extend({ id: z.string().uuid() });
+const idSchema = z.object({ id: z.string().uuid() }).strict();
+
+type PackageRow = {
+  id: string;
+  name: string;
+  description: string;
+  price_cents: number;
+  credits: number;
+  sort_order: number;
+  enabled: boolean;
+  created_at: Date;
+  updated_at: Date;
+};
+
+function output(row: PackageRow) {
+  return {
+    id: row.id,
+    name: row.name,
+    description: row.description,
+    priceCents: row.price_cents,
+    credits: row.credits,
+    sortOrder: row.sort_order,
+    enabled: row.enabled,
+    createdAt: row.created_at.toISOString(),
+    updatedAt: row.updated_at.toISOString(),
+  };
+}
+
+export async function GET() {
+  try {
+    await requireAdminSession("read");
+    const rows = await queryAdminRows<PackageRow>(`
+      select id, name, description, price_cents, credits, sort_order, enabled, created_at, updated_at
+      from public.payment_packages
+      order by sort_order, created_at
+    `);
+    return NextResponse.json({ packages: rows.map(output) });
+  } catch (error) {
+    return adminErrorResponse(error);
+  }
+}
+
+export async function POST(request: Request) {
+  try {
+    const auth = await requireAdminSession("write");
+    const parsed = schema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) return NextResponse.json({ error: "套餐参数不正确" }, { status: 400 });
+    const p = parsed.data;
+    const rows = await queryAdminRows<PackageRow>(`
+      insert into public.payment_packages
+        (name, description, price_cents, credits, sort_order, enabled, created_by)
+      values ($1, $2, $3, $4, $5, $6, $7)
+      returning id, name, description, price_cents, credits, sort_order, enabled, created_at, updated_at
+    `, [p.name, p.description, p.priceCents, p.credits, p.sortOrder, p.enabled, auth.user.id]);
+    return NextResponse.json({ package: output(rows[0]) }, { status: 201 });
+  } catch (error) {
+    return adminErrorResponse(error);
+  }
+}
+
+export async function PATCH(request: Request) {
+  try {
+    await requireAdminSession("write");
+    const parsed = updateSchema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) return NextResponse.json({ error: "套餐参数不正确" }, { status: 400 });
+    const p = parsed.data;
+    const rows = await queryAdminRows<PackageRow>(`
+      update public.payment_packages
+      set name = $2, description = $3, price_cents = $4, credits = $5,
+          sort_order = $6, enabled = $7, updated_at = clock_timestamp()
+      where id = $1
+      returning id, name, description, price_cents, credits, sort_order, enabled, created_at, updated_at
+    `, [p.id, p.name, p.description, p.priceCents, p.credits, p.sortOrder, p.enabled]);
+    if (!rows[0]) return NextResponse.json({ error: "套餐不存在" }, { status: 404 });
+    return NextResponse.json({ package: output(rows[0]) });
+  } catch (error) {
+    return adminErrorResponse(error);
+  }
+}
+
+export async function DELETE(request: Request) {
+  try {
+    await requireAdminSession("write");
+    const parsed = idSchema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) return NextResponse.json({ error: "套餐参数不正确" }, { status: 400 });
+    const rows = await queryAdminRows<{ id: string }>(`
+      update public.payment_packages
+      set enabled = false, updated_at = clock_timestamp()
+      where id = $1
+      returning id
+    `, [parsed.data.id]);
+    if (!rows[0]) return NextResponse.json({ error: "套餐不存在" }, { status: 404 });
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    return adminErrorResponse(error);
+  }
+}
diff --git a/frontend/src/app/api/admin/payments/route.ts b/frontend/src/app/api/admin/payments/route.ts
new file mode 100644
index 00000000..f0399050
--- /dev/null
+++ b/frontend/src/app/api/admin/payments/route.ts
@@ -0,0 +1,128 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { requireAdminSession } from "@/lib/admin/auth";
+import { queryAdminRows } from "@/lib/admin/database";
+import { adminErrorResponse } from "@/lib/admin/http";
+
+export const runtime = "nodejs";
+
+const querySchema = z.object({
+  status: z.enum(["pending", "paid", "failed", "expired"]).optional(),
+  from: z.string().datetime({ offset: true }).optional(),
+  to: z.string().datetime({ offset: true }).optional(),
+  limit: z.coerce.number().int().min(1).max(100).default(20),
+  offset: z.coerce.number().int().min(0).default(0),
+});
+
+type PaymentOrderRow = {
+  order_no: string;
+  user_email: string | null;
+  package_name: string | null;
+  money_cents: number;
+  credits: number;
+  status: string;
+  epay_trade_no: string | null;
+  created_at: Date;
+  paid_at: Date | null;
+  total_count: string;
+};
+
+type PaymentStatsRow = {
+  total_orders: string;
+  paid_orders: string;
+  pending_orders: string;
+  failed_expired_orders: string;
+  paid_amount_cents: string;
+  granted_credits: string;
+};
+
+export async function GET(request: Request) {
+  try {
+    await requireAdminSession("read");
+
+    const url = new URL(request.url);
+    const parsed = querySchema.safeParse(Object.fromEntries(url.searchParams));
+    if (!parsed.success) return NextResponse.json({ error: "查询参数不正确" }, { status: 400 });
+    const { status, from, to, limit, offset } = parsed.data;
+    if (from && to && new Date(from) > new Date(to)) return NextResponse.json({ error: "开始日期不能晚于结束日期" }, { status: 400 });
+
+    const values: unknown[] = [];
+    const conditions: string[] = [];
+    if (status) {
+      values.push(status);
+      conditions.push(`o.status = $${values.length}`);
+    }
+    if (from) {
+      values.push(from);
+      conditions.push(`o.created_at >= $${values.length}::timestamptz`);
+    }
+    if (to) {
+      values.push(to);
+      conditions.push(`o.created_at <= $${values.length}::timestamptz`);
+    }
+    const statsValues: unknown[] = [];
+    const dateConditions: string[] = [];
+    if (from) {
+      statsValues.push(from);
+      dateConditions.push(`o.created_at >= $${statsValues.length}::timestamptz`);
+    }
+    if (to) {
+      statsValues.push(to);
+      dateConditions.push(`o.created_at <= $${statsValues.length}::timestamptz`);
+    }
+    values.push(limit, offset);
+
+    const [rows, statsRows] = await Promise.all([
+      queryAdminRows<PaymentOrderRow>(`
+        select
+          o.order_no, u.email as user_email, p.name as package_name,
+          o.money_cents, o.credits, o.status, o.epay_trade_no,
+          o.created_at, o.paid_at, count(*) over()::text as total_count
+        from public.payment_orders o
+        left join public.payment_packages p on p.id = o.package_id
+        left join identity.users u on u.id = o.user_id
+        ${conditions.length ? `where ${conditions.join(" and ")}` : ""}
+        order by o.created_at desc, o.order_no asc
+        limit $${values.length - 1} offset $${values.length}
+      `, values),
+      queryAdminRows<PaymentStatsRow>(`
+        select
+          count(*)::text as total_orders,
+          count(*) filter (where o.status = 'paid')::text as paid_orders,
+          count(*) filter (where o.status = 'pending')::text as pending_orders,
+          count(*) filter (where o.status in ('failed', 'expired'))::text as failed_expired_orders,
+          coalesce(sum(o.money_cents) filter (where o.status = 'paid'), 0)::text as paid_amount_cents,
+          coalesce(sum(o.credits) filter (where o.status = 'paid'), 0)::text as granted_credits
+        from public.payment_orders o
+        ${dateConditions.length ? `where ${dateConditions.join(" and ")}` : ""}
+      `, statsValues),
+    ]);
+
+    const orders = rows.map((row) => ({
+      orderNo: row.order_no,
+      userEmail: row.user_email,
+      packageName: row.package_name,
+      moneyCents: row.money_cents,
+      credits: row.credits,
+      status: row.status,
+      epayTradeNo: row.epay_trade_no,
+      createdAt: row.created_at.toISOString(),
+      paidAt: row.paid_at?.toISOString() ?? null,
+    }));
+    const rawStats = statsRows[0];
+    const stats = {
+      totalOrders: Number(rawStats?.total_orders ?? 0),
+      paidOrders: Number(rawStats?.paid_orders ?? 0),
+      pendingOrders: Number(rawStats?.pending_orders ?? 0),
+      failedExpiredOrders: Number(rawStats?.failed_expired_orders ?? 0),
+      paidAmountCents: Number(rawStats?.paid_amount_cents ?? 0),
+      grantedCredits: Number(rawStats?.granted_credits ?? 0),
+    };
+    const total = Number(rows[0]?.total_count ?? 0);
+    return NextResponse.json({ orders, stats, pagination: { limit, offset, total, hasMore: offset + orders.length < total } });
+  } catch (error) {
+    const response = adminErrorResponse(error);
+    if (response.status === 401 || response.status === 403) return response;
+    return NextResponse.json({ error: "支付记录服务暂时不可用" }, { status: 500 });
+  }
+}
diff --git a/frontend/src/app/api/auth/[...all]/route.ts b/frontend/src/app/api/auth/[...all]/route.ts
index 2a25646d..21755f8f 100644
--- a/frontend/src/app/api/auth/[...all]/route.ts
+++ b/frontend/src/app/api/auth/[...all]/route.ts
@@ -24,7 +24,6 @@ async function dispatch(
   const services = getIdentityAuthServices();
   const handlers = createHostIsolatedAuthHandlers(config, {
     user: toNextJsHandler(services.user),
-    admin: toNextJsHandler(services.admin),
   });
   return handlers[method](request);
 }
diff --git a/frontend/src/app/api/payment/epay/create/route.ts b/frontend/src/app/api/payment/epay/create/route.ts
new file mode 100644
index 00000000..9686accb
--- /dev/null
+++ b/frontend/src/app/api/payment/epay/create/route.ts
@@ -0,0 +1,53 @@
+import crypto from "node:crypto";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createAdminSupabaseClient } from "@/lib/supabase/admin";
+import { createServerSupabaseClient } from "@/lib/supabase/server";
+import { epaySign } from "@/lib/epay/sign";
+import { readEpayAvailability } from "@/lib/epay/availability";
+import { epaySubmitUrl, readEpayConfig, EpayConfigurationError } from "@/lib/epay/config";
+import { assertPublicGatewayUrl } from "@/lib/epay/gateway-policy";
+
+export const runtime = "nodejs";
+const schema = z.object({ packageId: z.string().uuid() });
+
+export async function POST(request: Request) {
+  try {
+    const client = await createServerSupabaseClient();
+    const { data: { user } } = await client.auth.getUser();
+    if (!user) return NextResponse.json({ error: "请先登录" }, { status: 401 });
+    const parsed = schema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) return NextResponse.json({ error: "请选择有效套餐" }, { status: 400 });
+
+    const availability = await readEpayAvailability();
+    if (!availability.enabled) return NextResponse.json({ error: "在线支付暂未开放", code: "EPAY_DISABLED" }, { status: 403 });
+    const config = await readEpayConfig();
+    const submitUrl = epaySubmitUrl(config.gatewayUrl);
+    await assertPublicGatewayUrl(submitUrl);
+
+    const admin = createAdminSupabaseClient();
+    const { data: pack, error: packError } = await admin.from("payment_packages").select("id,name,price_cents,credits,enabled").eq("id", parsed.data.packageId).eq("enabled", true).maybeSingle();
+    if (packError || !pack) return NextResponse.json({ error: "套餐不存在或已下架" }, { status: 404 });
+    const orderNo = `JY${Date.now().toString(36)}${crypto.randomBytes(10).toString("hex")}`;
+    const { error: orderError } = await admin.from("payment_orders").insert({ order_no: orderNo, user_id: user.id, package_id: pack.id, money_cents: pack.price_cents, credits: pack.credits });
+    if (orderError) return NextResponse.json({ error: "创建订单失败" }, { status: 500 });
+
+    const params = {
+      money: (pack.price_cents / 100).toFixed(2),
+      name: pack.name,
+      notify_url: config.notifyUrl,
+      out_trade_no: orderNo,
+      pid: config.pid,
+      return_url: config.returnUrl,
+      sitename: config.siteName,
+      type: "alipay",
+    };
+    const signedParams = { ...params, sign: epaySign(params, config.key), sign_type: "MD5" };
+    const payUrl = new URL(submitUrl);
+    for (const [name, value] of Object.entries(signedParams)) payUrl.searchParams.set(name, value);
+    return NextResponse.json({ orderNo, payUrl: payUrl.toString(), qrCode: null });
+  } catch (error) {
+    if (error instanceof EpayConfigurationError) return NextResponse.json({ error: "易支付尚未配置", code: "EPAY_NOT_CONFIGURED" }, { status: 503 });
+    return NextResponse.json({ error: "创建支付失败" }, { status: 500 });
+  }
+}
diff --git a/frontend/src/app/api/payment/epay/notify/route.ts b/frontend/src/app/api/payment/epay/notify/route.ts
new file mode 100644
index 00000000..e7e37cb3
--- /dev/null
+++ b/frontend/src/app/api/payment/epay/notify/route.ts
@@ -0,0 +1,13 @@
+import { createAdminSupabaseClient } from "@/lib/supabase/admin";
+import { readEpayConfig } from "@/lib/epay/config";
+import { createEpayNotifyHandler } from "@/lib/epay/notify-core";
+
+export const runtime = "nodejs";
+
+const notify = createEpayNotifyHandler({
+  readConfig: readEpayConfig,
+  settle: async (args) => await createAdminSupabaseClient().rpc("settle_epay_order", args),
+});
+
+export async function POST(request: Request) { return notify(request); }
+export async function GET(request: Request) { return notify(request); }
diff --git a/frontend/src/app/api/payment/epay/status/route.ts b/frontend/src/app/api/payment/epay/status/route.ts
new file mode 100644
index 00000000..a1451a94
--- /dev/null
+++ b/frontend/src/app/api/payment/epay/status/route.ts
@@ -0,0 +1,5 @@
+import { NextResponse } from "next/server";
+import { createAdminSupabaseClient } from "@/lib/supabase/admin";
+import { createServerSupabaseClient } from "@/lib/supabase/server";
+export const runtime = "nodejs";
+export async function GET(request: Request) { const client = await createServerSupabaseClient(); const { data: { user } } = await client.auth.getUser(); if (!user) return NextResponse.json({ error: "请先登录" }, { status: 401 }); const orderNo = new URL(request.url).searchParams.get("orderNo"); if (!orderNo) return NextResponse.json({ error: "缺少订单号" }, { status: 400 }); const { data, error } = await createAdminSupabaseClient().from("payment_orders").select("order_no,status,credits,paid_at").eq("order_no", orderNo).eq("user_id", user.id).maybeSingle(); if (error) return NextResponse.json({ error: "暂时无法查询订单" }, { status: 500 }); if (!data) return NextResponse.json({ error: "订单不存在" }, { status: 404 }); return NextResponse.json({ orderNo: data.order_no, status: data.status, credits: data.credits, paidAt: data.paid_at }); }
diff --git a/frontend/src/app/api/payment/packages/route.ts b/frontend/src/app/api/payment/packages/route.ts
new file mode 100644
index 00000000..062128af
--- /dev/null
+++ b/frontend/src/app/api/payment/packages/route.ts
@@ -0,0 +1,28 @@
+import { NextResponse } from "next/server";
+import { readEpayAvailability } from "@/lib/epay/availability";
+import { createAdminSupabaseClient } from "@/lib/supabase/admin";
+
+export const runtime = "nodejs";
+
+export async function GET() {
+  const availability = await readEpayAvailability();
+  if (!availability.enabled) return NextResponse.json({ enabled: false, packages: [] });
+
+  const { data, error } = await createAdminSupabaseClient()
+    .from("payment_packages")
+    .select("id,name,description,price_cents,credits,sort_order")
+    .eq("enabled", true)
+    .order("sort_order")
+    .order("created_at");
+  if (error) return NextResponse.json({ enabled: false, packages: [] });
+  return NextResponse.json({
+    enabled: true,
+    packages: (data || []).map((item) => ({
+      id: item.id,
+      name: item.name,
+      description: item.description,
+      priceCents: item.price_cents,
+      credits: item.credits,
+    })),
+  });
+}
diff --git a/frontend/src/app/globals.css b/frontend/src/app/globals.css
index cf39112c..92ff7adc 100644
--- a/frontend/src/app/globals.css
+++ b/frontend/src/app/globals.css
@@ -803,6 +803,8 @@ input:disabled, select:disabled { color: var(--color-ink-tertiary); background:
 .auth-links button { min-height: 32px; padding: 0; color: var(--color-action); }
 
 .admin-page { background: var(--color-canvas-soft); }
+.admin-app-shell { height: 100dvh; min-height: 0; overflow-y: auto; }
+.admin-app-shell > *, .admin-app-shell .ant-layout { min-height: 100%; }
 .admin-header { position: sticky; z-index: 4; top: 0; display: flex; align-items: center; justify-content: space-between; gap: 20px; border-bottom: 1px solid var(--color-border); min-height: 88px; padding: 0 var(--space-8); background: var(--color-frosted); backdrop-filter: saturate(130%) blur(20px); }
 .admin-header h1 { font-size: var(--type-display-md); }
 .admin-scroll { display: grid; width: min(1200px, 100%); gap: var(--space-5); margin: 0 auto; padding: var(--space-8) var(--space-8) var(--space-16); }
@@ -1780,3 +1782,8 @@ input:disabled, select:disabled { color: var(--color-ink-tertiary); background:
   }
   .rectification-candidate { min-height: 122px; padding: 12px; scroll-snap-align: start; }
 }
+
+.payment-qr-wrap { position: relative; width: min(220px, 72vw); aspect-ratio: 1; margin: 14px auto; padding: 10px; border: 1px solid var(--color-border); border-radius: var(--radius-lg); background: #fff; box-shadow: var(--shadow-elevated); }
+.payment-qr-wrap img { display: block; width: 100%; height: 100%; object-fit: contain; }
+.payment-qr-badge { position: absolute; top: 50%; left: 50%; display: grid; width: 44px; height: 44px; padding: 4px; transform: translate(-50%, -50%); border: 4px solid #fff; border-radius: 12px; background: #fff; box-shadow: 0 2px 10px rgb(0 0 0 / 18%); }
+.payment-qr-badge svg { display: block; width: 100%; height: 100%; }
diff --git a/frontend/src/app/login/page.tsx b/frontend/src/app/login/page.tsx
index 38692169..63196fc2 100644
--- a/frontend/src/app/login/page.tsx
+++ b/frontend/src/app/login/page.tsx
@@ -1,35 +1,14 @@
-import { headers } from "next/headers";
-
 import { EmailOtpLogin } from "@/components/email-otp-login";
-import {
-  isSelfHostedIdentityEnabled,
-  readIdentityConfig,
-  readSelfHostedIdentityConfig,
-} from "@/modules/identity/config";
-import { resolveIdentitySurface } from "@/modules/identity/host";
+import { readIdentityConfig } from "@/modules/identity/config";
 
 export const dynamic = "force-dynamic";
 
 export default async function LoginPage() {
   const config = readIdentityConfig(process.env);
-  let provider = config.provider;
-  let passwordEnabled = false;
-  let passwordOnly = false;
-  if (isSelfHostedIdentityEnabled(process.env)) {
-    const selfHosted = readSelfHostedIdentityConfig(process.env);
-    const surface = resolveIdentitySurface(
-      (await headers()).get("host"),
-      selfHosted,
-    );
-    if (surface === "admin") provider = "self-hosted";
-    passwordEnabled = provider === "self-hosted";
-    passwordOnly = surface === "admin";
-  }
   return (
     <EmailOtpLogin
-      provider={provider}
-      passwordEnabled={passwordEnabled}
-      passwordOnly={passwordOnly}
+      provider={config.provider}
+      passwordEnabled={config.provider === "self-hosted"}
     />
   );
 }
diff --git a/frontend/src/app/page.tsx b/frontend/src/app/page.tsx
index 188e9573..c1b4b62b 100644
--- a/frontend/src/app/page.tsx
+++ b/frontend/src/app/page.tsx
@@ -2,7 +2,7 @@
 
 import Link from "next/link";
 import dynamic from "next/dynamic";
-import { ArrowUp, ArrowUpRight, Sparkles, Square, X } from "lucide-react";
+import { ArrowUp, ArrowUpRight, ShieldCheck, Sparkles, Square, X } from "lucide-react";
 import { useGSAP } from "@gsap/react";
 import { gsap } from "gsap";
 import { useEffect, useRef, useState } from "react";
@@ -179,6 +179,7 @@ type Account = {
   user: { id: string; email: string | null };
   credits: number;
   isAdmin: boolean;
+  adminUrl: string | null;
   rectificationPriceCredits: number;
   hasConfirmedBirthTime: boolean;
   hasUsableBirthTime: boolean;
@@ -926,6 +927,11 @@ export default function Home() {
   const [redeemError, setRedeemError] = useState("");
   const [redeemMessage, setRedeemMessage] = useState("");
   const [redeeming, setRedeeming] = useState(false);
+  const [paymentEnabled, setPaymentEnabled] = useState(false);
+  const [paymentPackages, setPaymentPackages] = useState<Array<{ id: string; name: string; description: string; priceCents: number; credits: number }>>([]);
+  const [paymentOrder, setPaymentOrder] = useState<{ orderNo: string; payUrl: string | null; qrCode: string | null; status: string } | null>(null);
+  const [paymentError, setPaymentError] = useState("");
+  const [payingPackageId, setPayingPackageId] = useState<string | null>(null);
   const [signingOut, setSigningOut] = useState(false);
   const [sessions, setSessions] = useState<ChatSession[]>([]);
   const [pinnedSessionIds, setPinnedSessionIds] = useState<string[]>([]);
@@ -1221,6 +1227,7 @@ export default function Home() {
             user: { id: "preview-user", email: "preview@local.test" },
             credits: 8,
             isAdmin: false,
+            adminUrl: null,
             rectificationPriceCredits: 1,
             hasConfirmedBirthTime: previewProfile.birthTimeStatus === "confirmed",
             hasUsableBirthTime: previewProfile.birthTimeStatus === "accepted" || previewProfile.birthTimeStatus === "confirmed",
@@ -1656,6 +1663,10 @@ export default function Home() {
       case "redeem":
         setRedeemError("");
         setRedeemMessage("");
+        setPaymentEnabled(false);
+        setPaymentPackages([]);
+        setPaymentOrder(null);
+        setPaymentError("");
         break;
       case "logout":
         break;
@@ -1929,6 +1940,47 @@ export default function Home() {
     }
   }
 
+  useEffect(() => {
+    if (activeAccountDialog !== "redeem") return;
+    void fetch("/api/payment/packages", { cache: "no-store" }).then(async (response) => {
+      const payload = await response.json().catch(() => null);
+      if (response.ok && payload?.enabled === true) {
+        setPaymentEnabled(true);
+        setPaymentPackages(payload.packages || []);
+        return;
+      }
+      if (!response.ok) setPaymentError("套餐支付暂时不可用，请稍后重试");
+    }).catch(() => {
+      setPaymentError("套餐支付暂时不可用，请稍后重试");
+    });
+  }, [activeAccountDialog]);
+
+  useEffect(() => {
+    if (!paymentOrder || paymentOrder.status === "paid") return;
+    const timer = window.setInterval(() => {
+      void fetch(`/api/payment/epay/status?orderNo=${encodeURIComponent(paymentOrder.orderNo)}`, { cache: "no-store" }).then(async (response) => {
+        const payload = await response.json().catch(() => null);
+        if (!response.ok) return;
+        setPaymentOrder((current) => current ? { ...current, status: payload.status } : current);
+        if (payload.status === "paid") void refreshAccount();
+      });
+    }, 3000);
+    return () => window.clearInterval(timer);
+  }, [paymentOrder]);
+
+  async function createPayment(packageId: string) {
+    if (payingPackageId) return;
+    setPayingPackageId(packageId); setPaymentError("");
+    try {
+      const response = await fetch("/api/payment/epay/create", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ packageId }) });
+      const payload = await response.json().catch(() => null);
+      if (!response.ok) throw new Error(payload?.error || "创建支付失败");
+      if (typeof payload?.orderNo !== "string" || typeof payload?.payUrl !== "string") throw new Error("创建支付失败");
+      setPaymentOrder({ orderNo: payload.orderNo, payUrl: payload.payUrl, qrCode: payload.qrCode ?? null, status: "pending" });
+      window.open(payload.payUrl, "_blank", "noopener,noreferrer");
+    } catch (caught) { setPaymentError(caught instanceof Error ? caught.message : "创建支付失败"); } finally { setPayingPackageId(null); }
+  }
+
   async function redeem(event: FormEvent<HTMLFormElement>) {
     event.preventDefault();
     const code = redeemCode.trim();
@@ -2682,6 +2734,7 @@ export default function Home() {
     email: account.user.email || "尚未读取邮箱",
     credits: account.credits,
     isAdmin: account.isAdmin,
+    adminUrl: account.adminUrl,
     initial: profile.name.trim().slice(0, 1)
       || account.user.email?.slice(0, 1).toUpperCase()
       || "你",
@@ -2765,10 +2818,17 @@ export default function Home() {
                 ? "正在校正出生时间"
                 : personalChartAvailable ? "基于星盘证据回答" : "回答一般占星知识"}</span>
           </div>
-          <button className="credit-button" ref={creditTrigger} type="button" onClick={() => openAccountDialog("redeem", creditTrigger.current)} aria-label={account ? `余额 ${account.credits} 点，兑换点数` : accountError || "读取余额中"}>
-            <Sparkles className="credit-icon" aria-hidden="true" />
-            <span>{account ? account.credits : "—"}</span>
-          </button>
+          <div className="chat-header-actions">
+            {account.isAdmin && account.adminUrl ? (
+              <Link className="admin-button" href={account.adminUrl} aria-label="后台管理" title="后台管理">
+                <ShieldCheck aria-hidden="true" />
+              </Link>
+            ) : null}
+            <button className="credit-button" ref={creditTrigger} type="button" onClick={() => openAccountDialog("redeem", creditTrigger.current)} aria-label={account ? `余额 ${account.credits} 点，兑换点数` : accountError || "读取余额中"}>
+              <Sparkles className="credit-icon" aria-hidden="true" />
+              <span>{account ? account.credits : "—"}</span>
+            </button>
+          </div>
           </header>
 
         {!rectificationSurfaceOpen && (
@@ -3157,6 +3217,12 @@ export default function Home() {
                   {redeemError && <p className="form-error" role="alert">{redeemError}</p>}
                   {redeemMessage && <p className="form-success" role="status">{redeemMessage}</p>}
                 </form>
+                {paymentEnabled && <div className="payment-packages">
+                  <h3>套餐充值</h3>
+                  {paymentPackages.map((item) => <div className="payment-package" key={item.id}><div><strong>{item.name}</strong><span>{item.description || `${item.credits} 点`}</span></div><b>¥{(item.priceCents / 100).toFixed(2)}</b><button className="button-secondary" type="button" onClick={() => void createPayment(item.id)} disabled={Boolean(payingPackageId)}>{payingPackageId === item.id ? "创建中" : "立即支付"}</button></div>)}
+                  {paymentOrder && <div className="payment-status" role="status"><p>订单 {paymentOrder.orderNo}：{paymentOrder.status === "paid" ? "支付成功，点数已到账" : "等待支付"}</p></div>}
+                </div>}
+                {paymentError && <p className="form-error" role="alert">{paymentError}</p>}
               </>
             )}
 
diff --git a/frontend/src/components/admin/admin-app.tsx b/frontend/src/components/admin/admin-app.tsx
index 0f6620b1..045daa24 100644
--- a/frontend/src/components/admin/admin-app.tsx
+++ b/frontend/src/components/admin/admin-app.tsx
@@ -1,16 +1,20 @@
 "use client";
 
 import {
+  ArrowLeftOutlined,
   AuditOutlined,
+  CreditCardOutlined,
   GiftOutlined,
+  ShoppingOutlined,
   MessageOutlined,
   TeamOutlined,
   TransactionOutlined,
 } from "@ant-design/icons";
 import { Authenticated, Refine } from "@refinedev/core";
-import { ErrorComponent, ThemedLayout, useNotificationProvider } from "@refinedev/antd";
+import { ErrorComponent, ThemedLayout, ThemedSider, useNotificationProvider } from "@refinedev/antd";
 import routerProvider from "@refinedev/nextjs-router";
-import { App as AntdApp, ConfigProvider, Spin, theme } from "antd";
+import { App as AntdApp, ConfigProvider, Menu, Spin, theme } from "antd";
+import Link from "next/link";
 import type { ReactNode } from "react";
 
 import {
@@ -19,39 +23,58 @@ import {
   adminDataProvider,
 } from "@/lib/admin/providers";
 
+function AdminSider() {
+  return (
+    <ThemedSider
+      render={({ items, collapsed }) => (
+        <>
+          {items}
+          <Menu.Item key="return-to-chat" icon={<ArrowLeftOutlined />} title="返回对话">
+            <Link href="/" aria-label="返回对话">{collapsed ? null : "返回对话"}</Link>
+          </Menu.Item>
+        </>
+      )}
+    />
+  );
+}
+
 export function AdminApp({ children }: { children: ReactNode }) {
   const notificationProvider = useNotificationProvider();
   return (
-    <ConfigProvider theme={{ algorithm: theme.darkAlgorithm, token: { colorPrimary: "#c8a96b" } }}>
-      <AntdApp>
-        <Refine
-          routerProvider={routerProvider}
-          dataProvider={adminDataProvider}
-          authProvider={adminAuthProvider}
-          accessControlProvider={adminAccessControlProvider}
-          notificationProvider={notificationProvider}
-          resources={[
+    <div className="admin-app-shell">
+      <ConfigProvider theme={{ algorithm: theme.darkAlgorithm, token: { colorPrimary: "#c8a96b" } }}>
+        <AntdApp>
+          <Refine
+            routerProvider={routerProvider}
+            dataProvider={adminDataProvider}
+            authProvider={adminAuthProvider}
+            accessControlProvider={adminAccessControlProvider}
+            notificationProvider={notificationProvider}
+            resources={[
             { name: "codes", list: "/admin/codes", meta: { label: "兑换码", icon: <GiftOutlined /> } },
+            { name: "payments", list: "/admin/payments", meta: { label: "支付管理", icon: <CreditCardOutlined /> } },
+            { name: "packages", list: "/admin/packages", meta: { label: "套餐管理", icon: <ShoppingOutlined /> } },
             { name: "users", list: "/admin/codes?resource=users", meta: { label: "用户资料", icon: <TeamOutlined /> } },
             { name: "credit-transactions", list: "/admin/codes?resource=credit-transactions", meta: { label: "积分流水", icon: <TransactionOutlined /> } },
             { name: "consultations", list: "/admin/codes?resource=consultations", meta: { label: "咨询请求", icon: <MessageOutlined /> } },
             { name: "audit-logs", list: "/admin/codes?resource=audit-logs", meta: { label: "审计日志", icon: <AuditOutlined /> } },
           ]}
-          options={{
-            syncWithLocation: true,
-            warnWhenUnsavedChanges: true,
-            title: { text: "Jyotisha 后台" },
-          }}
-        >
-          <Authenticated
-            key="admin-authenticated"
-            loading={<div className="admin-loading"><Spin size="large" /><span>正在验证后台权限</span></div>}
+            options={{
+              syncWithLocation: true,
+              warnWhenUnsavedChanges: true,
+              title: { text: "Jyotisha 后台" },
+            }}
           >
-            <ThemedLayout>{children}</ThemedLayout>
-          </Authenticated>
-        </Refine>
-      </AntdApp>
-    </ConfigProvider>
+            <Authenticated
+              key="admin-authenticated"
+              loading={<div className="admin-loading"><Spin size="large" /><span>正在验证后台权限</span></div>}
+            >
+              <ThemedLayout Sider={AdminSider}>{children}</ThemedLayout>
+            </Authenticated>
+          </Refine>
+        </AntdApp>
+      </ConfigProvider>
+    </div>
   );
 }
 
diff --git a/frontend/src/components/admin/codes-resource.tsx b/frontend/src/components/admin/codes-resource.tsx
index da2ef5d8..28e14515 100644
--- a/frontend/src/components/admin/codes-resource.tsx
+++ b/frontend/src/components/admin/codes-resource.tsx
@@ -38,7 +38,7 @@ const statusColors: Record<CodeRecord["status"], string> = {
 };
 
 export default function CodesPage() {
-  const { data: role } = usePermissions<"admin" | "viewer">({});
+  const { data: role } = usePermissions<"admin">({});
   const { data: identity } = useGetIdentity<AdminIdentity>();
   const { mutate: createCodes, mutation: createMutation } = useCreate<{ id: string; generated: CodeRecord[] }>();
   const { mutate: updateCode, mutation: updateMutation } = useUpdate<CodeRecord>();
@@ -137,7 +137,7 @@ export default function CodesPage() {
           { label: "已兑换", value: "redeemed" },
           { label: "已撤销", value: "revoked" },
         ]}
-        extra={writable ? <Button type="primary" onClick={() => setCreateOpen(true)}>批量生成</Button> : <Tag>viewer 只读</Tag>}
+        extra={writable ? <Button type="primary" onClick={() => setCreateOpen(true)}>批量生成</Button> : null}
       />
 
       <Modal title="批量生成兑换码" open={createOpen} onCancel={() => setCreateOpen(false)} footer={null} destroyOnHidden>
diff --git a/frontend/src/components/admin/package-management.tsx b/frontend/src/components/admin/package-management.tsx
new file mode 100644
index 00000000..b77d2731
--- /dev/null
+++ b/frontend/src/components/admin/package-management.tsx
@@ -0,0 +1,163 @@
+"use client";
+
+import { PlusOutlined } from "@ant-design/icons";
+import { List } from "@refinedev/antd";
+import { Alert, App, Button, Card, Form, Input, InputNumber, Modal, Popconfirm, Row, Col, Space, Switch, Table, Tag, Typography, type TableColumnsType } from "antd";
+import { useCallback, useEffect, useState } from "react";
+
+const { Text } = Typography;
+
+type PaymentPackage = {
+  id: string;
+  name: string;
+  description: string;
+  priceCents: number;
+  credits: number;
+  sortOrder: number;
+  enabled: boolean;
+};
+
+type PackageFormValues = Omit<PaymentPackage, "id" | "priceCents"> & { priceYuan: number };
+
+function formatMoney(cents: number) {
+  return `¥${(cents / 100).toFixed(2)}`;
+}
+
+async function responsePayload(response: Response) {
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(payload.error || "请求失败");
+  return payload;
+}
+
+export function PackageManagement() {
+  const { message } = App.useApp();
+  const [packageForm] = Form.useForm<PackageFormValues>();
+  const [packages, setPackages] = useState<PaymentPackage[]>([]);
+  const [packagesLoading, setPackagesLoading] = useState(true);
+  const [packagesError, setPackagesError] = useState("");
+  const [modalOpen, setModalOpen] = useState(false);
+  const [editingPackage, setEditingPackage] = useState<PaymentPackage | null>(null);
+  const [saving, setSaving] = useState(false);
+  const [disablingId, setDisablingId] = useState<string | null>(null);
+
+  const loadPackages = useCallback(async () => {
+    setPackagesLoading(true);
+    setPackagesError("");
+    try {
+      const payload = await responsePayload(await fetch("/api/admin/packages", { cache: "no-store" }));
+      setPackages(payload.packages);
+    } catch (error) {
+      setPackagesError(error instanceof Error ? error.message : "读取套餐失败");
+    } finally {
+      setPackagesLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    const timer = window.setTimeout(() => void loadPackages(), 0);
+    return () => window.clearTimeout(timer);
+  }, [loadPackages]);
+
+  function openCreateModal() {
+    setEditingPackage(null);
+    packageForm.setFieldsValue({ name: "", description: "", priceYuan: 1, credits: 10, sortOrder: 0, enabled: true });
+    setModalOpen(true);
+  }
+
+  function openEditModal(item: PaymentPackage) {
+    setEditingPackage(item);
+    packageForm.setFieldsValue({
+      name: item.name,
+      description: item.description,
+      priceYuan: item.priceCents / 100,
+      credits: item.credits,
+      sortOrder: item.sortOrder,
+      enabled: item.enabled,
+    });
+    setModalOpen(true);
+  }
+
+  function closeModal() {
+    if (saving) return;
+    setModalOpen(false);
+    setEditingPackage(null);
+    packageForm.resetFields();
+  }
+
+  async function savePackage(values: PackageFormValues) {
+    setSaving(true);
+    try {
+      await responsePayload(await fetch("/api/admin/packages", {
+        method: editingPackage ? "PATCH" : "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          ...(editingPackage ? { id: editingPackage.id } : {}),
+          name: values.name.trim(),
+          description: values.description?.trim() ?? "",
+          priceCents: Math.round(values.priceYuan * 100),
+          credits: values.credits,
+          sortOrder: values.sortOrder,
+          enabled: values.enabled,
+        }),
+      }));
+      message.success(editingPackage ? "套餐已更新" : "套餐已添加");
+      setModalOpen(false);
+      setEditingPackage(null);
+      packageForm.resetFields();
+      await loadPackages();
+    } catch (error) {
+      message.error(error instanceof Error ? error.message : "保存套餐失败");
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  async function disablePackage(id: string) {
+    setDisablingId(id);
+    try {
+      await responsePayload(await fetch("/api/admin/packages", {
+        method: "DELETE",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ id }),
+      }));
+      message.success("套餐已停用");
+      await loadPackages();
+    } catch (error) {
+      message.error(error instanceof Error ? error.message : "停用套餐失败");
+    } finally {
+      setDisablingId(null);
+    }
+  }
+
+  const columns: TableColumnsType<PaymentPackage> = [
+    { title: "名称", dataIndex: "name", render: (_, item) => <Space direction="vertical" size={0}><Text strong>{item.name}</Text><Text type="secondary">{item.description || "暂无描述"}</Text></Space> },
+    { title: "价格", dataIndex: "priceCents", align: "right", render: formatMoney },
+    { title: "点数", dataIndex: "credits", align: "right" },
+    { title: "排序", dataIndex: "sortOrder", align: "right" },
+    { title: "状态", dataIndex: "enabled", render: (enabled) => <Tag color={enabled ? "green" : "default"}>{enabled ? "启用" : "停用"}</Tag> },
+    { title: "操作", key: "actions", fixed: "right", render: (_, item) => <Space><Button type="link" onClick={() => openEditModal(item)}>编辑</Button>{item.enabled && <Popconfirm title="停用此套餐？" description="停用后用户将无法继续购买。" okText="停用" cancelText="取消" onConfirm={() => disablePackage(item.id)}><Button type="link" danger loading={disablingId === item.id}>停用</Button></Popconfirm>}</Space> },
+  ];
+
+  return (
+    <List title="套餐管理">
+      <Card title="套餐设置" extra={<Button type="primary" icon={<PlusOutlined />} onClick={openCreateModal}>添加套餐</Button>}>
+        <Space direction="vertical" size="middle" style={{ width: "100%" }}>
+          {packagesError && <Alert type="error" showIcon message="套餐列表读取失败" description={packagesError} action={<Button size="small" onClick={() => void loadPackages()}>重试</Button>} />}
+          <Table<PaymentPackage> rowKey="id" columns={columns} dataSource={packages} loading={packagesLoading} pagination={false} scroll={{ x: "max-content" }} />
+        </Space>
+      </Card>
+      <Modal title={editingPackage ? "编辑套餐" : "添加套餐"} open={modalOpen} okText={editingPackage ? "保存修改" : "添加套餐"} cancelText="取消" confirmLoading={saving} onOk={() => packageForm.submit()} onCancel={closeModal} destroyOnHidden afterClose={() => packageForm.resetFields()} maskClosable={!saving} keyboard={!saving}>
+        <Form<PackageFormValues> form={packageForm} layout="vertical" onFinish={savePackage} requiredMark="optional" initialValues={{ priceYuan: 1, credits: 10, sortOrder: 0, enabled: true }}>
+          <Form.Item name="name" label="名称" rules={[{ required: true, message: "请输入套餐名称" }, { max: 80 }]}><Input autoFocus /></Form.Item>
+          <Row gutter={16}>
+            <Col span={12}><Form.Item name="priceYuan" label="价格（元）" extra="保存时转换为 API 的 priceCents" rules={[{ required: true, message: "请输入价格" }]}><InputNumber min={0.01} max={1_000_000} precision={2} step={1} style={{ width: "100%" }} prefix="¥" /></Form.Item></Col>
+            <Col span={12}><Form.Item name="credits" label="点数" rules={[{ required: true, message: "请输入点数" }]}><InputNumber min={1} max={10_000_000} precision={0} style={{ width: "100%" }} /></Form.Item></Col>
+          </Row>
+          <Form.Item name="sortOrder" label="排序" rules={[{ required: true, message: "请输入排序" }]}><InputNumber min={-100_000} max={100_000} precision={0} style={{ width: "100%" }} /></Form.Item>
+          <Form.Item name="description" label="描述" rules={[{ max: 500 }]}><Input.TextArea rows={3} showCount maxLength={500} /></Form.Item>
+          <Form.Item name="enabled" label="启用" valuePropName="checked"><Switch checkedChildren="启用" unCheckedChildren="停用" /></Form.Item>
+        </Form>
+      </Modal>
+    </List>
+  );
+}
diff --git a/frontend/src/components/admin/payment-management.tsx b/frontend/src/components/admin/payment-management.tsx
new file mode 100644
index 00000000..cedadbcd
--- /dev/null
+++ b/frontend/src/components/admin/payment-management.tsx
@@ -0,0 +1,271 @@
+"use client";
+
+import { List } from "@refinedev/antd";
+import {
+  Alert,
+  App,
+  Button,
+  Card,
+  Col,
+  Collapse,
+  DatePicker,
+  Form,
+  Input,
+  Row,
+  Select,
+  Space,
+  Statistic,
+  Switch,
+  Table,
+  Tag,
+  Typography,
+  type TableColumnsType,
+} from "antd";
+import type { Dayjs } from "dayjs";
+import { useCallback, useEffect, useState } from "react";
+
+const { Text } = Typography;
+
+type Order = {
+  orderNo: string;
+  userEmail: string | null;
+  packageName: string | null;
+  moneyCents: number;
+  credits: number;
+  status: string;
+  epayTradeNo: string | null;
+  createdAt: string;
+  paidAt: string | null;
+};
+
+type PaymentStats = {
+  totalOrders: number;
+  paidOrders: number;
+  pendingOrders: number;
+  failedExpiredOrders: number;
+  paidAmountCents: number;
+  grantedCredits: number;
+};
+
+type PaymentFilters = { status?: string; dates?: [Dayjs, Dayjs] };
+type EpaySettings = {
+  gatewayUrl: string;
+  pid: string;
+  notifyUrl: string;
+  returnUrl: string;
+  siteName: string;
+  chatEnabled: boolean;
+  keyConfigured: boolean;
+  complete: boolean;
+  source: "database" | "environment" | "unconfigured";
+};
+type EpaySettingsForm = Pick<EpaySettings, "gatewayUrl" | "pid" | "notifyUrl" | "returnUrl" | "siteName" | "chatEnabled"> & { newKey?: string };
+
+const initialStats: PaymentStats = {
+  totalOrders: 0,
+  paidOrders: 0,
+  pendingOrders: 0,
+  failedExpiredOrders: 0,
+  paidAmountCents: 0,
+  grantedCredits: 0,
+};
+const statusLabels: Record<string, string> = { pending: "待支付", paid: "已支付", failed: "失败", expired: "已过期" };
+const statusColors: Record<string, string> = { pending: "gold", paid: "green", failed: "red", expired: "default" };
+const dateFormatter = new Intl.DateTimeFormat("zh-CN", { dateStyle: "medium", timeStyle: "short", timeZone: "Asia/Shanghai" });
+const pageSize = 20;
+
+function formatDate(value: string | null) {
+  return value ? dateFormatter.format(new Date(value)) : "—";
+}
+
+function formatMoney(cents: number) {
+  return `¥${(cents / 100).toFixed(2)}`;
+}
+
+async function responsePayload(response: Response) {
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok) throw new Error(payload.error || "请求失败");
+  return payload;
+}
+
+export default function PaymentManagement() {
+  const { message } = App.useApp();
+  const [filterForm] = Form.useForm<PaymentFilters>();
+  const [epayForm] = Form.useForm<EpaySettingsForm>();
+  const [orders, setOrders] = useState<Order[]>([]);
+  const [stats, setStats] = useState(initialStats);
+  const [paymentLoading, setPaymentLoading] = useState(true);
+  const [paymentError, setPaymentError] = useState("");
+  const [filters, setFilters] = useState<PaymentFilters>({});
+  const [offset, setOffset] = useState(0);
+  const [total, setTotal] = useState(0);
+  const [epaySettings, setEpaySettings] = useState<EpaySettings | null>(null);
+  const [epayLoading, setEpayLoading] = useState(true);
+  const [epaySaving, setEpaySaving] = useState(false);
+  const [epayTesting, setEpayTesting] = useState(false);
+  const [epayError, setEpayError] = useState("");
+
+  const loadPayments = useCallback(async () => {
+    setPaymentLoading(true);
+    setPaymentError("");
+    const params = new URLSearchParams({ limit: String(pageSize), offset: String(offset) });
+    if (filters.status) params.set("status", filters.status);
+    if (filters.dates?.[0]) params.set("from", filters.dates[0].startOf("day").toISOString());
+    if (filters.dates?.[1]) params.set("to", filters.dates[1].endOf("day").toISOString());
+    try {
+      const payload = await responsePayload(await fetch(`/api/admin/payments?${params}`, { cache: "no-store" }));
+      setOrders(payload.orders);
+      setStats(payload.stats);
+      setTotal(payload.pagination.total);
+    } catch (error) {
+      setPaymentError(error instanceof Error ? error.message : "读取支付记录失败");
+    } finally {
+      setPaymentLoading(false);
+    }
+  }, [filters, offset]);
+
+  const loadEpaySettings = useCallback(async () => {
+    setEpayLoading(true);
+    setEpayError("");
+    try {
+      const payload: EpaySettings = await responsePayload(await fetch("/api/admin/epay-settings", { cache: "no-store" }));
+      setEpaySettings(payload);
+      epayForm.setFieldsValue({
+        gatewayUrl: payload.gatewayUrl,
+        pid: payload.pid,
+        notifyUrl: payload.notifyUrl,
+        returnUrl: payload.returnUrl,
+        siteName: payload.siteName,
+        chatEnabled: payload.chatEnabled,
+        newKey: "",
+      });
+    } catch (error) {
+      setEpayError(error instanceof Error ? error.message : "读取易支付配置失败");
+    } finally {
+      setEpayLoading(false);
+    }
+  }, [epayForm]);
+
+  useEffect(() => {
+    const timer = window.setTimeout(() => void loadPayments(), 0);
+    return () => window.clearTimeout(timer);
+  }, [loadPayments]);
+  useEffect(() => {
+    const timer = window.setTimeout(() => void loadEpaySettings(), 0);
+    return () => window.clearTimeout(timer);
+  }, [loadEpaySettings]);
+
+  async function testEpayAvailability() {
+    setEpayTesting(true);
+    try {
+      const payload = await responsePayload(await fetch("/api/admin/epay-settings/test", { method: "POST" }));
+      if (payload.available) message.success(`${payload.message}（${payload.status}，${payload.latencyMs}ms）`);
+      else message.error(payload.message || "当前已保存的易支付配置暂不可用");
+    } catch (error) {
+      message.error(error instanceof Error ? error.message : "当前已保存的易支付配置暂不可用");
+    } finally {
+      setEpayTesting(false);
+    }
+  }
+
+  async function saveEpaySettings(values: EpaySettingsForm) {
+    setEpaySaving(true);
+    try {
+      await responsePayload(await fetch("/api/admin/epay-settings", {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ ...values, newKey: values.newKey || undefined }),
+      }));
+      epayForm.setFieldValue("newKey", "");
+      message.success("Z-Pay（易支付）配置已保存");
+      await loadEpaySettings();
+    } catch (error) {
+      message.error(error instanceof Error ? error.message : "保存易支付配置失败");
+    } finally {
+      setEpaySaving(false);
+    }
+  }
+
+  const orderColumns: TableColumnsType<Order> = [
+    { title: "订单号", dataIndex: "orderNo", render: (value) => <Text code copyable>{value}</Text> },
+    { title: "用户邮箱", dataIndex: "userEmail", render: (value) => value || "—" },
+    { title: "套餐", dataIndex: "packageName", render: (value) => value || "—" },
+    { title: "金额", dataIndex: "moneyCents", align: "right", render: formatMoney },
+    { title: "点数", dataIndex: "credits", align: "right" },
+    { title: "状态", dataIndex: "status", render: (value) => <Tag color={statusColors[value]}>{statusLabels[value] || value}</Tag> },
+    { title: "易支付交易号", dataIndex: "epayTradeNo", render: (value) => value || "—" },
+    { title: "创建时间", dataIndex: "createdAt", render: formatDate },
+    { title: "支付时间", dataIndex: "paidAt", render: formatDate },
+  ];
+  return (
+    <List title="支付管理">
+      <Space direction="vertical" size="large" style={{ width: "100%" }}>
+        <Card title="支付概览">
+          <Row gutter={[16, 16]}>
+            <Col xs={12} md={8} xl={4}><Statistic title="总订单" value={stats.totalOrders} /></Col>
+            <Col xs={12} md={8} xl={4}><Statistic title="已支付" value={stats.paidOrders} /></Col>
+            <Col xs={12} md={8} xl={4}><Statistic title="待支付" value={stats.pendingOrders} /></Col>
+            <Col xs={12} md={8} xl={4}><Statistic title="失败 / 过期" value={stats.failedExpiredOrders} /></Col>
+            <Col xs={12} md={8} xl={4}><Statistic title="已支付金额" value={stats.paidAmountCents / 100} precision={2} prefix="¥" /></Col>
+            <Col xs={12} md={8} xl={4}><Statistic title="已赠送点数" value={stats.grantedCredits} /></Col>
+          </Row>
+        </Card>
+
+        <Collapse
+          defaultActiveKey={[]}
+          items={[{
+            key: "epay-settings",
+            label: "Z-Pay（易支付）渠道配置",
+            children: (
+              <Card
+                loading={epayLoading}
+                extra={<Space><Button disabled={!epaySettings?.keyConfigured || !epaySettings.complete} loading={epayTesting} onClick={() => void testEpayAvailability()}>测试可用性（当前已保存配置）</Button><Button type="primary" loading={epaySaving} onClick={() => epayForm.submit()}>保存配置</Button></Space>}
+              >
+                <Space direction="vertical" size="middle" style={{ width: "100%" }}>
+                  <Text type="secondary">配置兼容标准 Z-Pay / 易支付协议的支付网关、商户凭据、回调地址与对话页开关。</Text>
+                  {epaySettings && <Space wrap><Tag color={epaySettings.source === "database" ? "blue" : "default"}>来源：{{ database: "数据库", environment: "环境变量", unconfigured: "未配置" }[epaySettings.source]}</Tag><Tag color={epaySettings.complete ? "green" : "orange"}>{epaySettings.complete ? "配置完整" : "配置不完整"}</Tag><Tag color={epaySettings.keyConfigured ? "green" : "orange"}>{epaySettings.keyConfigured ? "密钥已配置" : "密钥未配置"}</Tag><Tag color={epaySettings.chatEnabled ? "green" : "default"}>{epaySettings.chatEnabled ? "对话支付开放" : "对话支付关闭"}</Tag></Space>}
+                  {epayError && <Alert type="error" showIcon message="易支付配置读取失败" description={epayError} action={<Button size="small" onClick={() => void loadEpaySettings()}>重试</Button>} />}
+                  <Alert type="info" showIcon message="商户密钥不会回显" description="密钥输入框始终为空；更新现有数据库配置时留空会保留原密钥。首次从环境变量迁移到数据库时必须重新输入密钥。" />
+                  <Form<EpaySettingsForm> form={epayForm} layout="vertical" onFinish={saveEpaySettings} requiredMark="optional">
+                    <Row gutter={16}>
+                      <Col xs={24} lg={12}><Form.Item name="gatewayUrl" label="网关地址" rules={[{ required: true, message: "请输入网关地址" }, { type: "url", message: "请输入有效 URL" }]}><Input placeholder="https://pay.example.com" /></Form.Item></Col>
+                      <Col xs={24} lg={12}><Form.Item name="pid" label="商户 ID" rules={[{ required: true, message: "请输入商户 ID" }, { max: 200 }]}><Input /></Form.Item></Col>
+                    </Row>
+                    <Form.Item name="newKey" label="商户密钥" extra="留空保持当前数据库密钥；系统绝不预填或回显密钥。"><Input.Password autoComplete="new-password" placeholder="留空保持原密钥" /></Form.Item>
+                    <Row gutter={16}>
+                      <Col xs={24} lg={12}><Form.Item name="notifyUrl" label="异步通知地址" rules={[{ required: true, message: "请输入异步通知地址" }, { type: "url", message: "请输入有效 URL" }]}><Input /></Form.Item></Col>
+                      <Col xs={24} lg={12}><Form.Item name="returnUrl" label="支付完成返回地址" rules={[{ required: true, message: "请输入支付完成返回地址" }, { type: "url", message: "请输入有效 URL" }]}><Input /></Form.Item></Col>
+                    </Row>
+                    <Form.Item name="siteName" label="网站名称" rules={[{ required: true, message: "请输入网站名称" }, { max: 100 }]}><Input /></Form.Item>
+                    <Form.Item name="chatEnabled" label="在对话页开放支付" valuePropName="checked"><Switch checkedChildren="开放" unCheckedChildren="关闭" /></Form.Item>
+                  </Form>
+                </Space>
+              </Card>
+            ),
+          }]}
+        />
+
+        <Card title="支付记录" extra={<Text type="secondary">共 {total} 条平台订单</Text>}>
+          <Space direction="vertical" size="middle" style={{ width: "100%" }}>
+            <Form form={filterForm} layout="inline" onValuesChange={(_, values) => { setOffset(0); setFilters(values); }}>
+              <Form.Item name="dates" label="创建日期"><DatePicker.RangePicker allowClear /></Form.Item>
+              <Form.Item name="status" label="状态">
+                <Select allowClear placeholder="全部状态" style={{ minWidth: 140 }} options={Object.entries(statusLabels).map(([value, label]) => ({ value, label }))} />
+              </Form.Item>
+              <Button onClick={() => { filterForm.resetFields(); setOffset(0); setFilters({}); }}>重置</Button>
+            </Form>
+            {paymentError && <Alert type="error" showIcon message="支付记录读取失败" description={paymentError} action={<Button size="small" onClick={() => void loadPayments()}>重试</Button>} />}
+            <Table<Order>
+              rowKey="orderNo"
+              columns={orderColumns}
+              dataSource={orders}
+              loading={paymentLoading}
+              scroll={{ x: "max-content" }}
+              pagination={{ current: Math.floor(offset / pageSize) + 1, pageSize, total, showSizeChanger: false, showTotal: (count, range) => `第 ${range[0]}–${range[1]} 条，共 ${count} 条`, onChange: (page) => setOffset((page - 1) * pageSize) }}
+            />
+          </Space>
+        </Card>
+      </Space>
+    </List>
+  );
+}
diff --git a/frontend/src/components/app-sidebar.tsx b/frontend/src/components/app-sidebar.tsx
index e6a9c55f..b3d5f902 100644
--- a/frontend/src/components/app-sidebar.tsx
+++ b/frontend/src/components/app-sidebar.tsx
@@ -1,11 +1,9 @@
 "use client";
 
 import { Menu } from "@base-ui/react/menu";
-import Link from "next/link";
 import {
   ChevronRight,
   Gift,
-  KeyRound,
   LogOut,
   MessageSquareText,
   Plus,
@@ -37,7 +35,6 @@ export type SidebarAccount = {
   name: string;
   email: string;
   credits: number;
-  isAdmin: boolean;
   initial: string;
 };
 
@@ -208,9 +205,6 @@ export function AppSidebar({
                 <Menu.Item className="account-menu-item" onClick={onOpenRedeem}>
                   <Gift aria-hidden="true" /><span>兑换点数</span><small>{account.credits} 点</small>
                 </Menu.Item>
-                {account.isAdmin && <Menu.LinkItem className="account-menu-item" render={<Link href="/admin/codes" />} closeOnClick>
-                  <KeyRound aria-hidden="true" /><span>管理兑换码</span><ChevronRight aria-hidden="true" />
-                </Menu.LinkItem>}
                 <Menu.Separator className="account-menu-separator" />
                 <Menu.Item className="account-menu-item account-menu-danger" onClick={onOpenLogout}>
                   <LogOut aria-hidden="true" /><span>退出登录</span>
diff --git a/frontend/src/components/birth-date-picker.tsx b/frontend/src/components/birth-date-picker.tsx
index 209f3e7a..42f1f9c3 100644
--- a/frontend/src/components/birth-date-picker.tsx
+++ b/frontend/src/components/birth-date-picker.tsx
@@ -1,10 +1,9 @@
 "use client";
 
 import { format } from "date-fns";
-import { zhCN as dateFnsZhCN } from "date-fns/locale";
+import { zhCN } from "date-fns/locale";
 import { CalendarIcon } from "lucide-react";
 import { useId, useState } from "react";
-import { zhCN } from "react-day-picker/locale";
 
 import { Button } from "@/components/ui/button";
 import { Calendar } from "@/components/ui/calendar";
@@ -17,8 +16,6 @@ type BirthDatePickerProps = {
   readonly onChange: (value: string) => void;
 };
 
-const emptyDefaultMonth = new Date(1997, 0, 1);
-
 export function BirthDatePicker({ value, disabled, onChange }: BirthDatePickerProps) {
   const labelId = useId();
   const valueId = useId();
@@ -26,6 +23,7 @@ export function BirthDatePicker({ value, disabled, onChange }: BirthDatePickerPr
   const selected = parseBirthDate(value);
   const today = new Date();
   today.setHours(0, 0, 0, 0);
+  const defaultMonth = new Date(1997, today.getMonth(), 1);
 
   return (
     <div className="grid gap-2">
@@ -45,18 +43,19 @@ export function BirthDatePicker({ value, disabled, onChange }: BirthDatePickerPr
           <span id={valueId}>
             {selected === undefined
               ? "选择出生日期"
-              : format(selected, "PPP", { locale: dateFnsZhCN })}
+              : format(selected, "PPP", { locale: zhCN })}
           </span>
         </PopoverTrigger>
-        <PopoverContent align="start" className="w-auto p-0" aria-label="选择出生日期">
+        <PopoverContent align="start" className="w-auto p-0">
           <Calendar
             key={value || "empty"}
             mode="single"
             className="[--cell-size:2.75rem] [&_button[data-selected-single=true]]:text-primary-foreground!"
             locale={zhCN}
             selected={selected}
-            defaultMonth={selected ?? emptyDefaultMonth}
+            defaultMonth={selected ?? defaultMonth}
             captionLayout="dropdown"
+            navLayout="after"
             startMonth={new Date(1900, 0)}
             endMonth={today}
             reverseYears
diff --git a/frontend/src/components/email-otp-login.tsx b/frontend/src/components/email-otp-login.tsx
index c4796825..9e849d7b 100644
--- a/frontend/src/components/email-otp-login.tsx
+++ b/frontend/src/components/email-otp-login.tsx
@@ -132,7 +132,7 @@ export function EmailOtpLogin({
           });
         if (otpError) throw otpError;
       }
-      window.location.assign(window.location.hostname.startsWith("admin.") && window.location.hostname.includes("staging") ? "/admin" : "/");
+      window.location.assign("/");
     } catch (caught) {
       if (!(caught instanceof Error)) throw caught;
       setError(authMessage(caught));
@@ -149,7 +149,7 @@ export function EmailOtpLogin({
     setNotice("");
     try {
       await selfHostedAuthActions.signInWithPassword(email, password);
-      window.location.assign(window.location.hostname.startsWith("admin.") && window.location.hostname.includes("staging") ? "/admin" : "/");
+      window.location.assign("/");
     } catch (caught) {
       if (!(caught instanceof Error)) throw caught;
       setError(authMessage(caught));
diff --git a/frontend/src/components/ui/calendar.tsx b/frontend/src/components/ui/calendar.tsx
index 2d69b269..f0b0a3de 100644
--- a/frontend/src/components/ui/calendar.tsx
+++ b/frontend/src/components/ui/calendar.tsx
@@ -51,17 +51,17 @@ function Calendar({
         ),
         month: cn("flex w-full flex-col gap-4", defaultClassNames.month),
         nav: cn(
-          "absolute inset-x-0 top-0 flex w-full items-center justify-between gap-1",
+          "pointer-events-none absolute inset-x-0 top-0 flex w-full items-center justify-between gap-1",
           defaultClassNames.nav
         ),
         button_previous: cn(
           buttonVariants({ variant: buttonVariant }),
-          "size-(--cell-size) p-0 select-none aria-disabled:opacity-50",
+          "pointer-events-auto size-(--cell-size) p-0 select-none aria-disabled:opacity-50",
           defaultClassNames.button_previous
         ),
         button_next: cn(
           buttonVariants({ variant: buttonVariant }),
-          "size-(--cell-size) p-0 select-none aria-disabled:opacity-50",
+          "pointer-events-auto size-(--cell-size) p-0 select-none aria-disabled:opacity-50",
           defaultClassNames.button_next
         ),
         month_caption: cn(
diff --git a/frontend/src/lib/admin/auth-policy.ts b/frontend/src/lib/admin/auth-policy.ts
index 08026aef..a9bda407 100644
--- a/frontend/src/lib/admin/auth-policy.ts
+++ b/frontend/src/lib/admin/auth-policy.ts
@@ -1,6 +1,6 @@
 import type { IdentityUser } from "@/modules/identity/contracts";
 
-export type AdminRole = "admin" | "viewer";
+export type AdminRole = "admin";
 
 export type AdminAccessResult =
   | { allowed: true; role: AdminRole }
@@ -11,13 +11,8 @@ export function authorizeAdminAccess(
   access: "read" | "write",
 ): AdminAccessResult {
   if (!user) return { allowed: false, status: 401 };
-  const role: AdminRole | null = user.role.includes("admin")
-    ? "admin"
-    : user.role.includes("viewer")
-      ? "viewer"
-      : null;
-  if (!role || (access === "write" && role !== "admin")) {
+  if (!user.role.includes("admin")) {
     return { allowed: false, status: 403 };
   }
-  return { allowed: true, role };
+  return { allowed: true, role: "admin" };
 }
diff --git a/frontend/src/lib/admin/auth.ts b/frontend/src/lib/admin/auth.ts
index fa28eb8d..57501f19 100644
--- a/frontend/src/lib/admin/auth.ts
+++ b/frontend/src/lib/admin/auth.ts
@@ -34,7 +34,7 @@ export async function requireAdminSession(
 
   try {
     const user = await requireIdentityUser(
-      getIdentityAuthServices().admin.api,
+      getIdentityAuthServices().user.api,
       new Headers(await headers()),
     );
     const authorization = authorizeAdminAccess(user, access);
diff --git a/frontend/src/lib/admin/database.ts b/frontend/src/lib/admin/database.ts
index 433e7319..3adeac35 100644
--- a/frontend/src/lib/admin/database.ts
+++ b/frontend/src/lib/admin/database.ts
@@ -5,35 +5,40 @@ import { Pool, type QueryResultRow } from "pg";
 import { readDatabaseUrl } from "@/lib/db/config";
 
 const poolGlobal = globalThis as typeof globalThis & {
-  jyotishaAdminReadPool?: Pool;
+  jyotishaAdminDatabasePool?: Pool;
 };
 
-export function adminReadPool(): Pool {
+export function adminDatabasePool(): Pool {
   if (
     process.env.AUTH_PROVIDER?.trim() !== "self-hosted"
     || process.env.APP_ENV?.trim() === "production"
   ) {
-    throw new Error("admin reads require the staging self-hosted identity service");
+    throw new Error("admin database requests require the staging self-hosted identity service");
   }
-  poolGlobal.jyotishaAdminReadPool ??= new Pool({
+  poolGlobal.jyotishaAdminDatabasePool ??= new Pool({
     connectionString: readDatabaseUrl(process.env, "ADMIN_DATABASE_URL"),
     max: 10,
     idleTimeoutMillis: 30_000,
     connectionTimeoutMillis: 5_000,
     allowExitOnIdle: true,
-    application_name: "jyotisha-admin-read",
+    application_name: "jyotisha-admin-database",
   });
-  return poolGlobal.jyotishaAdminReadPool;
+  return poolGlobal.jyotishaAdminDatabasePool;
 }
 
 export async function queryAdminRows<T extends QueryResultRow>(
   sql: string,
   values: readonly unknown[] = [],
 ): Promise<T[]> {
-  const result = await adminReadPool().query<T>(sql, [...values]);
+  const result = await adminDatabasePool().query<T>(sql, [...values]);
   return result.rows;
 }
 
+export function isPostgresError(error: unknown): error is { code: string } {
+  return typeof error === "object" && error !== null && "code" in error
+    && typeof (error as { code?: unknown }).code === "string";
+}
+
 export type PageResult<T> = { data: T[]; total: number };
 
 export function pageOffset(page: number, pageSize: number) {
diff --git a/frontend/src/lib/admin/providers.ts b/frontend/src/lib/admin/providers.ts
index d154bba1..b7ec5edb 100644
--- a/frontend/src/lib/admin/providers.ts
+++ b/frontend/src/lib/admin/providers.ts
@@ -18,7 +18,7 @@ export type AdminIdentity = {
   id: string;
   email: string;
   name: string;
-  role: "admin" | "viewer";
+  role: "admin";
 };
 
 const apiBase = "/api/admin";
@@ -165,7 +165,7 @@ export const adminAccessControlProvider: AccessControlProvider = {
     }
     return role === "admin"
       ? { can: true }
-      : { can: false, reason: "viewer 仅可查看" };
+      : { can: false, reason: "无管理员权限" };
   },
   options: {
     buttons: { enableAccessControl: true, hideIfUnauthorized: true },
diff --git a/frontend/src/lib/epay/availability.ts b/frontend/src/lib/epay/availability.ts
new file mode 100644
index 00000000..006a5e0e
--- /dev/null
+++ b/frontend/src/lib/epay/availability.ts
@@ -0,0 +1,43 @@
+import "server-only";
+
+import { createAdminSupabaseClient } from "@/lib/supabase/admin";
+
+function strictEnvironmentChatEnabled() {
+  const value = process.env.EPAY_CHAT_ENABLED?.trim().toLowerCase();
+  return value === "true" || value === "1";
+}
+
+function environmentConfigComplete() {
+  return Boolean(
+    process.env.EPAY_GATEWAY_URL?.trim()
+    && process.env.EPAY_PID?.trim()
+    && process.env.EPAY_KEY?.trim(),
+  );
+}
+
+export async function readEpayAvailability() {
+  try {
+    const { data, error } = await createAdminSupabaseClient()
+      .from("epay_settings")
+      .select("gateway_url,pid,encrypted_key,notify_url,return_url,site_name,chat_enabled")
+      .eq("id", true)
+      .maybeSingle();
+    if (error?.code === "42P01") {
+      return { enabled: strictEnvironmentChatEnabled() && environmentConfigComplete() };
+    }
+    if (error || !data) return { enabled: false };
+    return {
+      enabled: Boolean(
+        data.chat_enabled
+        && data.gateway_url
+        && data.pid
+        && data.encrypted_key
+        && data.notify_url
+        && data.return_url
+        && data.site_name,
+      ),
+    };
+  } catch {
+    return { enabled: false };
+  }
+}
diff --git a/frontend/src/lib/epay/config-core.ts b/frontend/src/lib/epay/config-core.ts
new file mode 100644
index 00000000..0f58f389
--- /dev/null
+++ b/frontend/src/lib/epay/config-core.ts
@@ -0,0 +1,106 @@
+import { decryptEpayKey } from "./encryption-core";
+
+export type EpaySettingsRow = {
+  gateway_url: string;
+  pid: string;
+  encrypted_key: string;
+  notify_url: string;
+  return_url: string;
+  site_name: string;
+  chat_enabled: boolean;
+};
+
+export class EpayConfigurationError extends Error {
+  constructor(message = "易支付配置不可用") {
+    super(message);
+    this.name = "EpayConfigurationError";
+  }
+}
+
+function validHttpUrl(value: string, label: string) {
+  try {
+    const url = new URL(value);
+    if (!/^https?:$/.test(url.protocol)) throw new Error();
+    return url;
+  } catch {
+    throw new EpayConfigurationError(`${label} 无效`);
+  }
+}
+
+export function suggestedEpayUrls(siteAddress = process.env.SITE_ADDRESS) {
+  let base: URL;
+  try {
+    base = new URL(siteAddress?.trim() || "http://localhost:3000");
+    if (!/^https?:$/.test(base.protocol)) throw new Error();
+  } catch {
+    base = new URL("http://localhost:3000");
+  }
+  return {
+    notifyUrl: new URL("/api/payment/epay/notify", base).toString(),
+    returnUrl: new URL("/", base).toString(),
+  };
+}
+
+function environmentChatEnabled(value: string | undefined) {
+  const normalized = value?.trim().toLowerCase();
+  return normalized === "true" || normalized === "1";
+}
+
+function completeConfig(values: {
+  gateway: string;
+  pid: string;
+  key: string;
+  notifyUrl: string;
+  returnUrl: string;
+  siteName: string;
+  chatEnabled: boolean;
+}) {
+  if (!values.gateway || !values.pid || !values.key || !values.notifyUrl || !values.returnUrl || !values.siteName) {
+    throw new EpayConfigurationError();
+  }
+  const gatewayUrl = validHttpUrl(values.gateway.replace(/\/+$/, ""), "易支付网关地址");
+  validHttpUrl(values.notifyUrl, "异步通知地址");
+  validHttpUrl(values.returnUrl, "支付返回地址");
+  return { gatewayUrl, pid: values.pid, key: values.key, notifyUrl: values.notifyUrl, returnUrl: values.returnUrl, siteName: values.siteName, chatEnabled: values.chatEnabled };
+}
+
+export async function resolveEpayConfig(
+  loadDatabaseRow: () => Promise<EpaySettingsRow | null>,
+  env: NodeJS.ProcessEnv = process.env,
+) {
+  let row: EpaySettingsRow | null;
+  try {
+    row = await loadDatabaseRow();
+  } catch {
+    throw new EpayConfigurationError();
+  }
+  if (row) {
+    return completeConfig({
+      gateway: row.gateway_url.trim(),
+      pid: row.pid.trim(),
+      key: decryptEpayKey(row.encrypted_key, env.EPAY_CONFIG_ENCRYPTION_KEY),
+      notifyUrl: row.notify_url.trim(),
+      returnUrl: row.return_url.trim(),
+      siteName: row.site_name.trim(),
+      chatEnabled: row.chat_enabled,
+    });
+  }
+
+  const defaults = suggestedEpayUrls(env.SITE_ADDRESS);
+  return completeConfig({
+    gateway: env.EPAY_GATEWAY_URL?.trim() || "",
+    pid: env.EPAY_PID?.trim() || "",
+    key: env.EPAY_KEY?.trim() || "",
+    notifyUrl: env.EPAY_NOTIFY_URL?.trim() || defaults.notifyUrl,
+    returnUrl: env.EPAY_RETURN_URL?.trim() || defaults.returnUrl,
+    siteName: env.EPAY_SITE_NAME?.trim() || "Jyotisha",
+    chatEnabled: environmentChatEnabled(env.EPAY_CHAT_ENABLED),
+  });
+}
+
+export function epaySubmitUrl(gatewayUrl: URL) {
+  const url = new URL(gatewayUrl.toString());
+  url.pathname = `${url.pathname.replace(/\/$/, "")}/submit.php`;
+  url.search = "";
+  return url;
+}
diff --git a/frontend/src/lib/epay/config.ts b/frontend/src/lib/epay/config.ts
new file mode 100644
index 00000000..3ff3b11d
--- /dev/null
+++ b/frontend/src/lib/epay/config.ts
@@ -0,0 +1,26 @@
+import "server-only";
+
+import { createAdminSupabaseClient } from "@/lib/supabase/admin";
+import {
+  epaySubmitUrl,
+  EpayConfigurationError,
+  resolveEpayConfig,
+  suggestedEpayUrls,
+  type EpaySettingsRow,
+} from "./config-core";
+
+export { epaySubmitUrl, EpayConfigurationError, resolveEpayConfig, suggestedEpayUrls };
+export type { EpaySettingsRow };
+
+export async function readEpayConfig() {
+  return resolveEpayConfig(async () => {
+    const { data, error } = await createAdminSupabaseClient()
+      .from("epay_settings")
+      .select("gateway_url,pid,encrypted_key,notify_url,return_url,site_name,chat_enabled")
+      .eq("id", true)
+      .maybeSingle();
+    if (error?.code === "42P01") return null;
+    if (error) throw new Error();
+    return data as EpaySettingsRow | null;
+  });
+}
diff --git a/frontend/src/lib/epay/encryption-core.ts b/frontend/src/lib/epay/encryption-core.ts
new file mode 100644
index 00000000..015b54a5
--- /dev/null
+++ b/frontend/src/lib/epay/encryption-core.ts
@@ -0,0 +1,46 @@
+import crypto from "node:crypto";
+
+const VERSION = "v1";
+
+export class EpayEncryptionError extends Error {
+  constructor() {
+    super("易支付配置不可用");
+    this.name = "EpayEncryptionError";
+  }
+}
+
+function encryptionKey(value = process.env.EPAY_CONFIG_ENCRYPTION_KEY) {
+  if (!value?.trim()) throw new EpayEncryptionError();
+  try {
+    const key = Buffer.from(value.trim(), "base64");
+    if (key.length !== 32 || key.toString("base64") !== value.trim()) throw new Error();
+    return key;
+  } catch {
+    throw new EpayEncryptionError();
+  }
+}
+
+export function encryptEpayKey(plaintext: string, masterKey?: string) {
+  if (!plaintext) throw new EpayEncryptionError();
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return [VERSION, iv.toString("base64url"), cipher.getAuthTag().toString("base64url"), ciphertext.toString("base64url")].join(".");
+}
+
+export function decryptEpayKey(payload: string, masterKey?: string) {
+  try {
+    const [version, ivValue, tagValue, ciphertextValue, extra] = payload.split(".");
+    if (version !== VERSION || !ivValue || !tagValue || !ciphertextValue || extra) throw new Error();
+    const decipher = crypto.createDecipheriv("aes-256-gcm", encryptionKey(masterKey), Buffer.from(ivValue, "base64url"));
+    decipher.setAuthTag(Buffer.from(tagValue, "base64url"));
+    const plaintext = Buffer.concat([
+      decipher.update(Buffer.from(ciphertextValue, "base64url")),
+      decipher.final(),
+    ]).toString("utf8");
+    if (!plaintext) throw new Error();
+    return plaintext;
+  } catch {
+    throw new EpayEncryptionError();
+  }
+}
diff --git a/frontend/src/lib/epay/encryption.ts b/frontend/src/lib/epay/encryption.ts
new file mode 100644
index 00000000..2b9b4fa9
--- /dev/null
+++ b/frontend/src/lib/epay/encryption.ts
@@ -0,0 +1,3 @@
+import "server-only";
+
+export { decryptEpayKey, encryptEpayKey, EpayEncryptionError } from "./encryption-core";
diff --git a/frontend/src/lib/epay/gateway-policy.ts b/frontend/src/lib/epay/gateway-policy.ts
new file mode 100644
index 00000000..768b4eec
--- /dev/null
+++ b/frontend/src/lib/epay/gateway-policy.ts
@@ -0,0 +1,64 @@
+import { promises as dns } from "node:dns";
+import { isIP } from "node:net";
+
+const blockedHostnames = new Set([
+  "localhost",
+  "localhost.localdomain",
+  "metadata.google.internal",
+]);
+
+function blockedIpv4(address: string) {
+  const parts = address.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return true;
+  const [a, b] = parts;
+  return a === 0
+    || a === 10
+    || a === 127
+    || (a === 100 && b >= 64 && b <= 127)
+    || (a === 169 && b === 254)
+    || (a === 172 && b >= 16 && b <= 31)
+    || (a === 192 && b === 0)
+    || (a === 192 && b === 168)
+    || (a === 198 && (b === 18 || b === 19))
+    || a >= 224;
+}
+
+export function isPublicEpayAddress(address: string) {
+  const version = isIP(address);
+  if (version === 4) return !blockedIpv4(address);
+  if (version !== 6) return false;
+  const normalized = address.toLowerCase().split("%")[0];
+  if (normalized.startsWith("::ffff:")) return isPublicEpayAddress(normalized.slice(7));
+  return normalized !== "::"
+    && normalized !== "::1"
+    && !normalized.startsWith("fc")
+    && !normalized.startsWith("fd")
+    && !/^fe[89ab]/.test(normalized)
+    && !normalized.startsWith("2001:db8:");
+}
+
+export function assertPublicEpayGateway(value: URL | string) {
+  const url = value instanceof URL ? value : new URL(value);
+  const hostname = url.hostname.toLowerCase().replace(/\.$/, "");
+  if (!/^https?:$/.test(url.protocol)
+    || url.username
+    || url.password
+    || blockedHostnames.has(hostname)
+    || hostname.endsWith(".localhost")
+    || hostname.endsWith(".local")
+    || (isIP(hostname) && !isPublicEpayAddress(hostname))) {
+    throw new Error("易支付网关地址不允许指向本机或内网");
+  }
+  return url;
+}
+
+export async function assertPublicGatewayUrl(value: URL | string) {
+  const url = assertPublicEpayGateway(value);
+  if (!isIP(url.hostname)) {
+    const addresses = await dns.lookup(url.hostname, { all: true, verbatim: true });
+    if (!addresses.length || addresses.some(({ address }) => !isPublicEpayAddress(address))) {
+      throw new Error("易支付网关地址不允许解析到本机或内网");
+    }
+  }
+  return url;
+}
diff --git a/frontend/src/lib/epay/notify-core.ts b/frontend/src/lib/epay/notify-core.ts
new file mode 100644
index 00000000..1b2830ec
--- /dev/null
+++ b/frontend/src/lib/epay/notify-core.ts
@@ -0,0 +1,54 @@
+import crypto from "node:crypto";
+import { epaySign, timingSafeSignEqual } from "./sign";
+
+type EpayNotifyConfig = { key: string; pid: string };
+type SettlementResponse = { data: unknown; error: unknown };
+
+type EpayNotifyDependencies = {
+  readConfig: () => Promise<EpayNotifyConfig>;
+  settle: (args: {
+    p_order_no: string;
+    p_trade_no: string;
+    p_money_cents: number;
+    p_payload_hash: string;
+  }) => Promise<SettlementResponse>;
+};
+
+function settlementSucceeded(data: unknown) {
+  const row = Array.isArray(data) ? data[0] : data;
+  return Boolean(row && typeof row === "object" && "success" in row && row.success === true);
+}
+
+export function createEpayNotifyHandler(dependencies: EpayNotifyDependencies) {
+  return async function notify(request: Request) {
+    try {
+      const config = await dependencies.readConfig();
+      const raw = request.method === "GET" ? new URL(request.url).search.slice(1) : await request.text();
+      const params = new URLSearchParams(raw);
+      const values: Record<string, string> = {};
+      params.forEach((value, key) => { values[key] = value; });
+
+      if (!timingSafeSignEqual(values.sign, epaySign(values, config.key))
+        || values.pid !== config.pid
+        || values.trade_status !== "TRADE_SUCCESS"
+        || !values.out_trade_no
+        || !values.money) {
+        return new Response("fail", { status: 400 });
+      }
+
+      const moneyCents = Math.round(Number(values.money) * 100);
+      if (!Number.isSafeInteger(moneyCents) || moneyCents <= 0) return new Response("fail", { status: 400 });
+
+      const result = await dependencies.settle({
+        p_order_no: values.out_trade_no,
+        p_trade_no: values.trade_no || values.transaction_id || values.out_trade_no,
+        p_money_cents: moneyCents,
+        p_payload_hash: crypto.createHash("sha256").update(raw).digest("hex"),
+      });
+      if (result.error || !settlementSucceeded(result.data)) return new Response("fail", { status: 500 });
+      return new Response("success", { status: 200 });
+    } catch {
+      return new Response("fail", { status: 500 });
+    }
+  };
+}
diff --git a/frontend/src/lib/epay/sign.ts b/frontend/src/lib/epay/sign.ts
new file mode 100644
index 00000000..3b4ae36e
--- /dev/null
+++ b/frontend/src/lib/epay/sign.ts
@@ -0,0 +1,18 @@
+import crypto from "node:crypto";
+
+export function epayCanonical(params: Record<string, string | number | null | undefined>) {
+  return Object.entries(params)
+    .filter(([key, value]) => key !== "sign" && key !== "sign_type" && value !== null && value !== undefined && String(value) !== "")
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([key, value]) => `${key}=${value}`)
+    .join("&");
+}
+
+export function epaySign(params: Record<string, string | number | null | undefined>, key: string) {
+  return crypto.createHash("md5").update(`${epayCanonical(params)}${key}`).digest("hex");
+}
+
+export function timingSafeSignEqual(actual: string | null | undefined, expected: string) {
+  if (!actual || actual.length !== expected.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(actual), Buffer.from(expected));
+}
diff --git a/frontend/src/lib/supabase/admin.ts b/frontend/src/lib/supabase/admin.ts
index 01deb76a..7b4e1da5 100644
--- a/frontend/src/lib/supabase/admin.ts
+++ b/frontend/src/lib/supabase/admin.ts
@@ -1,6 +1,42 @@
 import "server-only";
 
-export {
+import { queryAdminRows } from "@/lib/admin/database";
+import {
   createAdminSupabaseClient,
   isAdminEmail,
 } from "./admin-client-core";
+
+export { createAdminSupabaseClient, isAdminEmail };
+
+export async function isAdminUser(user: { id?: string; email?: string | null }) {
+  if (process.env.AUTH_PROVIDER?.trim() === "self-hosted") {
+    if (!user.id) return false;
+    try {
+      const rows = await queryAdminRows<{ role: string }>(
+        "select role from identity.users where id = $1 limit 1",
+        [user.id],
+      );
+      return rows[0]?.role
+        .split(",")
+        .map((role) => role.trim())
+        .some((role) => role === "admin") ?? false;
+    } catch {
+      return false;
+    }
+  }
+  if (isAdminEmail(user.email)) return true;
+  if (!user.id) return false;
+
+  try {
+    const admin = createAdminSupabaseClient();
+    const { data, error } = await admin
+      .from("admin_users")
+      .select("user_id")
+      .eq("user_id", user.id)
+      .is("revoked_at", null)
+      .maybeSingle();
+    return !error && Boolean(data);
+  } catch {
+    return false;
+  }
+}
diff --git a/frontend/src/lib/supabase/server.ts b/frontend/src/lib/supabase/server.ts
index fd7e9f21..7d7b984d 100644
--- a/frontend/src/lib/supabase/server.ts
+++ b/frontend/src/lib/supabase/server.ts
@@ -7,20 +7,15 @@ import { createLocalPostgresDataClient } from "@/lib/db/local-postgres-client";
 import { readDatabaseUrl } from "@/lib/db/config";
 import { getIdentityAuthServices } from "@/modules/identity/auth";
 import { readIdentitySession } from "@/modules/identity/session";
-import { readSelfHostedIdentityConfig } from "@/modules/identity/config";
-import { resolveIdentitySurface } from "@/modules/identity/host";
 import { getSupabasePublicConfig } from "./config";
 
 export async function createServerSupabaseClient() {
   if (process.env.AUTH_PROVIDER?.trim() === "self-hosted") {
     const requestHeaders = new Headers(await headers());
-    const services = getIdentityAuthServices();
-    const surface = resolveIdentitySurface(
-      requestHeaders.get("host"),
-      readSelfHostedIdentityConfig(process.env),
+    const session = await readIdentitySession(
+      getIdentityAuthServices().user.api,
+      requestHeaders,
     );
-    const auth = surface === "admin" ? services.admin : services.user;
-    const session = await readIdentitySession(auth.api, requestHeaders);
     return createLocalPostgresDataClient(
       readDatabaseUrl(process.env, "APP_DATABASE_URL"),
       session ? { id: session.user.id, email: session.user.email } : null,
diff --git a/frontend/src/modules/identity/auth-factory.ts b/frontend/src/modules/identity/auth-factory.ts
index 4367c23f..f82cd940 100644
--- a/frontend/src/modules/identity/auth-factory.ts
+++ b/frontend/src/modules/identity/auth-factory.ts
@@ -1,20 +1,18 @@
 import { createHmac } from "node:crypto";
 import type { Pool } from "pg";
-import { APIError, type BetterAuthOptions } from "better-auth";
+import type { BetterAuthOptions } from "better-auth";
 import { admin, emailOTP, type EmailOTPOptions } from "better-auth/plugins";
 
 import type { SelfHostedIdentityConfig } from "./config.ts";
-import type { EmailOtpSender, IdentitySurface } from "./contracts.ts";
+import type { EmailOtpSender } from "./contracts.ts";
 import { identityModelMapping } from "./model.ts";
 
 export type AdminUserAuthorizer = (userId: string) => Promise<boolean>;
 
 interface BuildAuthOptionsInput {
-  surface: IdentitySurface;
   config: SelfHostedIdentityConfig;
   database: Pool;
   emailSender: EmailOtpSender;
-  authorizeAdminUser?: AdminUserAuthorizer;
 }
 
 function otpIdempotencyKey(
@@ -58,26 +56,17 @@ export function createEmailOtpOptions(
 }
 
 export function buildAuthOptions({
-  surface,
   config,
   database,
   emailSender,
-  authorizeAdminUser,
 }: BuildAuthOptionsInput): BetterAuthOptions {
-  if (surface === "admin" && !authorizeAdminUser) {
-    throw new Error("admin user authorizer is required");
-  }
-
-  const origin = surface === "user" ? config.userOrigin : config.adminOrigin;
-  const secret = surface === "user" ? config.userSecret : config.adminSecret;
-
   return {
     appName: "Jyotisha",
-    baseURL: origin,
+    baseURL: config.userOrigin,
     basePath: "/api/auth",
-    secret,
+    secret: config.userSecret,
     database,
-    trustedOrigins: [origin],
+    trustedOrigins: [config.userOrigin],
     telemetry: { enabled: false },
     user: identityModelMapping.user,
     session: identityModelMapping.session,
@@ -91,8 +80,7 @@ export function buildAuthOptions({
     },
     advanced: {
       database: { generateId: "uuid" },
-      cookiePrefix:
-        surface === "user" ? "jyotisha-user" : "jyotisha-admin",
+      cookiePrefix: "jyotisha-user",
       defaultCookieAttributes: {
         secure: true,
         httpOnly: true,
@@ -108,31 +96,12 @@ export function buildAuthOptions({
       revokeSessionsOnPasswordReset: true,
     },
     plugins: [
-      ...(surface === "user"
-        ? [emailOTP(createEmailOtpOptions(emailSender, secret, false))]
-        : []),
+      emailOTP(createEmailOtpOptions(emailSender, config.userSecret, false)),
       admin({
         defaultRole: "user",
         adminRoles: ["admin"],
         schema: identityModelMapping.admin,
       }),
     ],
-    ...(surface === "admin"
-      ? {
-          databaseHooks: {
-            session: {
-              create: {
-                async before(session: { userId: string }) {
-                  if (!(await authorizeAdminUser!(session.userId))) {
-                    throw new APIError("FORBIDDEN", {
-                      message: "Administrator access required",
-                    });
-                  }
-                },
-              },
-            },
-          },
-        }
-      : {}),
   };
 }
diff --git a/frontend/src/modules/identity/auth.ts b/frontend/src/modules/identity/auth.ts
index 2c7818aa..e315c283 100644
--- a/frontend/src/modules/identity/auth.ts
+++ b/frontend/src/modules/identity/auth.ts
@@ -16,7 +16,7 @@ interface AdminRoleRow {
   ban_expires: Date | null;
 }
 
-export type IdentityAdminSurfaceRole = "admin" | "viewer";
+export type IdentityAdminSurfaceRole = "admin";
 
 export function createIdentityPool(databaseUrl: string): Pool {
   return new Pool({
@@ -68,19 +68,17 @@ export function createDatabaseAdminAuthorizer(
 export function createDatabaseAdminSurfaceAuthorizer(
   pool: Pool,
 ): AdminUserAuthorizer {
-  return createDatabaseRoleAuthorizer(pool, new Set(["admin", "viewer"]));
+  return createDatabaseAdminAuthorizer(pool);
 }
 
 export interface IdentityAuthServices {
   pool: Pool;
   user: ReturnType<typeof betterAuth>;
-  admin: ReturnType<typeof betterAuth>;
 }
 
 interface IdentityAuthDependencies {
   pool?: Pool;
   emailSender?: EmailOtpSender;
-  authorizeAdminUser?: AdminUserAuthorizer;
 }
 
 export function createIdentityAuthServices(
@@ -94,28 +92,15 @@ export function createIdentityAuthServices(
       apiKey: config.resendApiKey,
       from: config.resendFrom,
     });
-  const authorizeAdminUser =
-    dependencies.authorizeAdminUser ?? createDatabaseAdminSurfaceAuthorizer(pool);
-
   return {
     pool,
     user: betterAuth(
       buildAuthOptions({
-        surface: "user",
         config,
         database: pool,
         emailSender,
       }),
     ),
-    admin: betterAuth(
-      buildAuthOptions({
-        surface: "admin",
-        config,
-        database: pool,
-        emailSender,
-        authorizeAdminUser,
-      }),
-    ),
   };
 }
 
diff --git a/frontend/src/modules/identity/config.ts b/frontend/src/modules/identity/config.ts
index ca1eae26..a0e29009 100644
--- a/frontend/src/modules/identity/config.ts
+++ b/frontend/src/modules/identity/config.ts
@@ -8,9 +8,7 @@ export interface SelfHostedIdentityConfig {
   provider: "self-hosted";
   databaseUrl: string;
   userOrigin: string;
-  adminOrigin: string;
   userSecret: string;
-  adminSecret: string;
   resendApiKey: string;
   resendFrom: string;
 }
@@ -95,24 +93,13 @@ export function readSelfHostedIdentityConfig(
   env: IdentityEnvironment,
 ): SelfHostedIdentityConfig {
   const userOrigin = readOrigin(env, "AUTH_USER_ORIGIN");
-  const adminOrigin = readOrigin(env, "AUTH_ADMIN_ORIGIN");
-  if (userOrigin === adminOrigin) {
-    throw new Error("user and admin origins must be different");
-  }
-
   const userSecret = readSecret(env, "BETTER_AUTH_USER_SECRET");
-  const adminSecret = readSecret(env, "BETTER_AUTH_ADMIN_SECRET");
-  if (userSecret === adminSecret) {
-    throw new Error("user and admin secrets must be different");
-  }
 
   return {
     provider: "self-hosted",
     databaseUrl: readPostgresUrl(env),
     userOrigin,
-    adminOrigin,
     userSecret,
-    adminSecret,
     resendApiKey: required(env, "RESEND_API_KEY"),
     resendFrom: readSender(env),
   };
diff --git a/frontend/src/modules/identity/contracts.ts b/frontend/src/modules/identity/contracts.ts
index c78ce393..d30920ef 100644
--- a/frontend/src/modules/identity/contracts.ts
+++ b/frontend/src/modules/identity/contracts.ts
@@ -1,5 +1,3 @@
-export type IdentitySurface = "user" | "admin";
-
 export type EmailOtpType =
   | "sign-in"
   | "email-verification"
diff --git a/frontend/src/modules/identity/host.ts b/frontend/src/modules/identity/host.ts
index 7a7435da..33b563e9 100644
--- a/frontend/src/modules/identity/host.ts
+++ b/frontend/src/modules/identity/host.ts
@@ -1,5 +1,4 @@
 import type { SelfHostedIdentityConfig } from "./config.ts";
-import type { IdentitySurface } from "./contracts.ts";
 
 export type IdentityRequestHandler = (
   request: Request,
@@ -33,15 +32,11 @@ function normalizeHost(value: string | null): string | null {
 export function resolveIdentitySurface(
   hostHeader: string | null,
   config: SelfHostedIdentityConfig,
-): IdentitySurface | null {
+): "user" | null {
   const host = normalizeHost(hostHeader);
   if (!host) return null;
 
-  const userHost = new URL(config.userOrigin).host.toLowerCase();
-  const adminHost = new URL(config.adminOrigin).host.toLowerCase();
-  if (host === userHost) return "user";
-  if (host === adminHost) return "admin";
-  return null;
+  return host === new URL(config.userOrigin).host.toLowerCase() ? "user" : null;
 }
 
 function isAdminEndpoint(request: Request): boolean {
@@ -55,7 +50,7 @@ function isAdminEndpoint(request: Request): boolean {
 
 export function createHostIsolatedAuthHandlers(
   config: SelfHostedIdentityConfig,
-  handlers: Record<IdentitySurface, IdentityAuthHandlers>,
+  handlers: { user: IdentityAuthHandlers },
 ): IdentityAuthHandlers {
   const dispatch =
     (method: keyof IdentityAuthHandlers): IdentityRequestHandler =>
@@ -64,10 +59,10 @@ export function createHostIsolatedAuthHandlers(
       if (!surface) {
         return new Response("Unrecognized identity host", { status: 421 });
       }
-      if (surface === "user" && isAdminEndpoint(request)) {
+      if (isAdminEndpoint(request)) {
         return new Response("Not found", { status: 404 });
       }
-      return handlers[surface][method](request);
+      return handlers.user[method](request);
     };
 
   return { GET: dispatch("GET"), POST: dispatch("POST") };
diff --git a/frontend/supabase/migrations/20260727010000_refine_admin_redemption_audit.sql b/frontend/supabase/migrations/20260805010000_reconcile_admin_redemption_audit.sql
similarity index 100%
rename from frontend/supabase/migrations/20260727010000_refine_admin_redemption_audit.sql
rename to frontend/supabase/migrations/20260805010000_reconcile_admin_redemption_audit.sql
diff --git a/frontend/supabase/migrations/20260805020000_reconcile_payment_admin_schema.sql b/frontend/supabase/migrations/20260805020000_reconcile_payment_admin_schema.sql
new file mode 100644
index 00000000..cb36fa1b
--- /dev/null
+++ b/frontend/supabase/migrations/20260805020000_reconcile_payment_admin_schema.sql
@@ -0,0 +1,244 @@
+create table if not exists public.admin_users (
+  user_id uuid primary key references auth.users(id) on delete cascade,
+  created_at timestamptz not null default now(),
+  created_by uuid not null references auth.users(id),
+  revoked_at timestamptz,
+  revoked_by uuid references auth.users(id)
+);
+
+alter table public.admin_users enable row level security;
+revoke all on table public.admin_users from anon, authenticated;
+grant select, insert, update on table public.admin_users to service_role;
+
+alter table public.credit_transactions drop constraint if exists credit_transactions_transaction_type_check;
+alter table public.credit_transactions add constraint credit_transactions_transaction_type_check
+  check (transaction_type in ('redeem', 'reserve', 'refund', 'payment'));
+alter table public.credit_transactions drop constraint if exists credit_transactions_amount_check;
+alter table public.credit_transactions add constraint credit_transactions_amount_check
+  check ((transaction_type = 'reserve' and amount < 0) or (transaction_type in ('redeem', 'refund', 'payment') and amount > 0));
+
+create table if not exists public.payment_packages (
+  id uuid primary key default gen_random_uuid(),
+  name text not null check (char_length(name) between 1 and 80),
+  description text not null default '' check (char_length(description) <= 500),
+  price_cents integer not null check (price_cents > 0),
+  credits integer not null check (credits > 0),
+  sort_order integer not null default 0,
+  enabled boolean not null default true,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  created_by uuid references auth.users(id) on delete set null
+);
+
+create table if not exists public.payment_orders (
+  id uuid primary key default gen_random_uuid(),
+  order_no text not null unique check (char_length(order_no) between 16 and 100),
+  user_id uuid not null references auth.users(id) on delete cascade,
+  package_id uuid not null references public.payment_packages(id) on delete restrict,
+  money_cents integer not null check (money_cents > 0),
+  credits integer not null check (credits > 0),
+  status text not null default 'pending' check (status in ('pending', 'paid', 'failed', 'expired')),
+  epay_trade_no text,
+  raw_notify_payload_hash text,
+  paid_at timestamptz,
+  created_at timestamptz not null default now()
+);
+
+create unique index if not exists payment_orders_trade_no_idx on public.payment_orders(epay_trade_no) where epay_trade_no is not null;
+create index if not exists payment_orders_user_created_idx on public.payment_orders(user_id, created_at desc);
+create index if not exists payment_orders_created_status_idx on public.payment_orders(created_at desc, status);
+
+alter table public.payment_packages enable row level security;
+alter table public.payment_orders enable row level security;
+revoke all on public.payment_packages, public.payment_orders from anon, authenticated;
+grant select on public.payment_orders to authenticated;
+drop policy if exists payment_orders_select_own on public.payment_orders;
+create policy payment_orders_select_own on public.payment_orders for select to authenticated using ((select auth.uid()) = user_id);
+grant all on public.payment_packages, public.payment_orders to service_role;
+
+create or replace function public.settle_epay_order(p_order_no text, p_trade_no text, p_money_cents integer, p_payload_hash text)
+returns table (success boolean, status text, credits integer)
+language plpgsql security definer set search_path = public, pg_temp
+as $$
+declare v_order public.payment_orders%rowtype; v_balance integer;
+begin
+  select * into v_order from public.payment_orders where order_no = btrim(p_order_no) for update;
+  if not found or v_order.money_cents <> p_money_cents then return query select false, 'invalid'::text, null::integer; return; end if;
+  if v_order.status = 'paid' then return query select true, 'paid'::text, v_order.credits; return; end if;
+  select credits into v_balance from public.profiles where id = v_order.user_id for update;
+  if not found then return query select false, 'profile_missing'::text, null::integer; return; end if;
+  update public.profiles set credits = credits + v_order.credits, updated_at = now() where id = v_order.user_id returning credits into v_balance;
+  insert into public.credit_transactions(user_id, transaction_type, amount, balance_after, request_id)
+    values (v_order.user_id, 'payment', v_order.credits, v_balance, v_order.order_no)
+    on conflict (user_id, transaction_type, request_id) do nothing;
+  update public.payment_orders set status='paid', epay_trade_no=p_trade_no, raw_notify_payload_hash=p_payload_hash, paid_at=now() where id=v_order.id;
+  return query select true, 'paid'::text, v_order.credits;
+end;
+$$;
+revoke all on function public.settle_epay_order(text, text, integer, text) from public, anon, authenticated;
+grant execute on function public.settle_epay_order(text, text, integer, text) to service_role;
+
+create or replace function public.get_payment_order_stats(p_from timestamptz default null, p_to timestamptz default null)
+returns table (total_orders bigint, paid_orders bigint, pending_orders bigint, failed_expired_orders bigint, paid_amount_cents bigint, granted_credits bigint)
+language sql security definer set search_path = public, pg_temp
+as $$
+  select
+    count(*)::bigint,
+    count(*) filter (where status = 'paid')::bigint,
+    count(*) filter (where status = 'pending')::bigint,
+    count(*) filter (where status in ('failed', 'expired'))::bigint,
+    coalesce(sum(money_cents) filter (where status = 'paid'), 0)::bigint,
+    coalesce(sum(credits) filter (where status = 'paid'), 0)::bigint
+  from public.payment_orders
+  where (p_from is null or created_at >= p_from)
+    and (p_to is null or created_at <= p_to);
+$$;
+revoke all on function public.get_payment_order_stats(timestamptz, timestamptz) from public, anon, authenticated;
+grant execute on function public.get_payment_order_stats(timestamptz, timestamptz) to service_role;
+
+create table if not exists public.epay_settings (
+  id boolean primary key default true check (id),
+  gateway_url text not null,
+  pid text not null,
+  encrypted_key text not null,
+  notify_url text not null,
+  return_url text not null,
+  site_name text not null,
+  chat_enabled boolean not null default false,
+  updated_by uuid not null,
+  updated_at timestamptz not null default clock_timestamp()
+);
+
+alter table public.epay_settings enable row level security;
+revoke all on table public.epay_settings from public, anon, authenticated, service_role;
+grant select on table public.epay_settings to service_role;
+
+alter table audit.admin_audit_logs
+  drop constraint if exists admin_audit_logs_action_check,
+  drop constraint if exists admin_audit_logs_target_type_check;
+alter table audit.admin_audit_logs
+  add constraint admin_audit_logs_action_check check (
+    action in ('redemption_code.create', 'redemption_code.update', 'redemption_code.revoke', 'epay_settings.update')
+  ),
+  add constraint admin_audit_logs_target_type_check check (
+    target_type in ('redemption_code', 'epay_settings')
+  );
+
+create or replace function public.admin_save_epay_settings(
+  p_actor_user_id uuid,
+  p_actor_email text,
+  p_actor_role text,
+  p_request_id text,
+  p_gateway_url text,
+  p_pid text,
+  p_encrypted_key text,
+  p_notify_url text,
+  p_return_url text,
+  p_site_name text,
+  p_chat_enabled boolean,
+  p_key_changed boolean
+)
+returns public.epay_settings
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_email text;
+  v_before public.epay_settings;
+  v_after public.epay_settings;
+  v_target_id constant uuid := '00000000-0000-0000-0000-000000000001';
+begin
+  v_email := public.admin_verified_actor_email(p_actor_user_id, p_actor_email, p_actor_role);
+
+  select * into v_before from public.epay_settings where id = true for update;
+
+  insert into public.epay_settings (
+    id, gateway_url, pid, encrypted_key, notify_url, return_url,
+    site_name, chat_enabled, updated_by, updated_at
+  ) values (
+    true, p_gateway_url, p_pid, p_encrypted_key, p_notify_url, p_return_url,
+    p_site_name, p_chat_enabled, p_actor_user_id, clock_timestamp()
+  )
+  on conflict (id) do update set
+    gateway_url = excluded.gateway_url,
+    pid = excluded.pid,
+    encrypted_key = excluded.encrypted_key,
+    notify_url = excluded.notify_url,
+    return_url = excluded.return_url,
+    site_name = excluded.site_name,
+    chat_enabled = excluded.chat_enabled,
+    updated_by = excluded.updated_by,
+    updated_at = excluded.updated_at
+  returning * into v_after;
+
+  insert into audit.admin_audit_logs (
+    actor_user_id, actor_email, actor_role, action, target_type,
+    target_id, before_value, after_value, request_id
+  ) values (
+    p_actor_user_id, v_email, p_actor_role, 'epay_settings.update', 'epay_settings',
+    v_target_id,
+    case when v_before.id is null then null else jsonb_build_object(
+      'gatewayUrl', v_before.gateway_url,
+      'pid', v_before.pid,
+      'notifyUrl', v_before.notify_url,
+      'returnUrl', v_before.return_url,
+      'siteName', v_before.site_name,
+      'chatEnabled', v_before.chat_enabled,
+      'keyConfigured', true,
+      'keyChanged', false
+    ) end,
+    jsonb_build_object(
+      'gatewayUrl', v_after.gateway_url,
+      'pid', v_after.pid,
+      'notifyUrl', v_after.notify_url,
+      'returnUrl', v_after.return_url,
+      'siteName', v_after.site_name,
+      'chatEnabled', v_after.chat_enabled,
+      'keyConfigured', true,
+      'keyChanged', p_key_changed
+    ),
+    p_request_id
+  );
+
+  return v_after;
+end;
+$$;
+
+revoke all on function public.admin_save_epay_settings(uuid, text, text, text, text, text, text, text, text, text, boolean, boolean)
+  from public, anon, authenticated;
+grant execute on function public.admin_save_epay_settings(uuid, text, text, text, text, text, text, text, text, text, boolean, boolean)
+  to service_role;
+
+do $$
+begin
+  if exists (select 1 from pg_roles where rolname = 'admin_runtime') then
+    grant select, insert, update on table public.payment_packages to admin_runtime;
+    grant select on table public.payment_orders to admin_runtime;
+    grant select on table public.epay_settings to admin_runtime;
+    grant execute on function public.admin_save_epay_settings(
+      uuid, text, text, text, text, text, text, text, text, text, boolean, boolean
+    ) to admin_runtime;
+
+    drop policy if exists payment_packages_admin_select on public.payment_packages;
+    create policy payment_packages_admin_select on public.payment_packages
+      for select to admin_runtime using (true);
+
+    drop policy if exists payment_packages_admin_insert on public.payment_packages;
+    create policy payment_packages_admin_insert on public.payment_packages
+      for insert to admin_runtime with check (true);
+
+    drop policy if exists payment_packages_admin_update on public.payment_packages;
+    create policy payment_packages_admin_update on public.payment_packages
+      for update to admin_runtime using (true) with check (true);
+
+    drop policy if exists payment_orders_admin_select on public.payment_orders;
+    create policy payment_orders_admin_select on public.payment_orders
+      for select to admin_runtime using (true);
+
+    drop policy if exists epay_settings_admin_read on public.epay_settings;
+    create policy epay_settings_admin_read on public.epay_settings
+      for select to admin_runtime using (id = true);
+  end if;
+end;
+$$;
diff --git a/frontend/supabase/migrations/20260727010000_rectification_v4_conversational_turns.sql b/frontend/supabase/migrations/20260805030000_reconcile_rectification_v4_conversational_turns.sql
similarity index 93%
rename from frontend/supabase/migrations/20260727010000_rectification_v4_conversational_turns.sql
rename to frontend/supabase/migrations/20260805030000_reconcile_rectification_v4_conversational_turns.sql
index 10ca1fc4..ada60067 100644
--- a/frontend/supabase/migrations/20260727010000_rectification_v4_conversational_turns.sql
+++ b/frontend/supabase/migrations/20260805030000_reconcile_rectification_v4_conversational_turns.sql
@@ -1,14 +1,12 @@
-begin;
-
 alter table public.birth_time_rectification_v4_turns
-  add column model_id text
+  add column if not exists model_id text
   check (model_id is null or length(btrim(model_id)) between 1 and 120);
 
-drop function public.submit_birth_time_rectification_v4_answer(
+drop function if exists public.submit_birth_time_rectification_v4_answer(
   uuid, uuid, uuid, bigint, uuid, uuid, text, uuid, text, text, uuid, timestamptz
 );
 
-create function public.submit_birth_time_rectification_v4_answer(
+create or replace function public.submit_birth_time_rectification_v4_answer(
   p_user_id uuid, p_case_id uuid, p_action_id uuid, p_expected_version bigint,
   p_turn_id uuid, p_question_id uuid, p_question_domain text, p_question_target_event_id uuid, p_question text,
   p_answer text, p_model_id text, p_job_id uuid, p_now timestamptz
@@ -54,5 +52,3 @@ revoke all on function public.submit_birth_time_rectification_v4_answer(
 grant execute on function public.submit_birth_time_rectification_v4_answer(
   uuid, uuid, uuid, bigint, uuid, uuid, text, uuid, text, text, text, uuid, timestamptz
 ) to service_role;
-
-commit;
diff --git a/frontend/tests/account-api.test.ts b/frontend/tests/account-api.test.ts
index 0cbc529c..02c7d4a3 100644
--- a/frontend/tests/account-api.test.ts
+++ b/frontend/tests/account-api.test.ts
@@ -32,6 +32,12 @@ test("account API separates engine confirmation from an accepted usable chart ti
   assert.match(source, /hasUsableBirthTime:\s*\(profile\.birth_time_status === "accepted" \|\| profile\.birth_time_status === "confirmed"\)/);
 });
 
+test("account API returns the same-origin admin entry URL", () => {
+  assert.match(source, /const adminUrl = isAdmin \? "\/admin\/codes" : null/);
+  assert.match(source, /adminUrl,/);
+  assert.doesNotMatch(source, /NEXT_PUBLIC_ADMIN|AUTH_ADMIN_ORIGIN|adminOrigin/);
+});
+
 test("account API projects only the minimum case state needed by the homepage", () => {
   const caseSelect = source.match(/\.from\("birth_time_rectification_cases"\)[\s\S]*?\.limit\(\d+\)/)?.[0] ?? "";
 
diff --git a/frontend/tests/admin-auth.test.ts b/frontend/tests/admin-auth.test.ts
index f3831bfb..75fa5b94 100644
--- a/frontend/tests/admin-auth.test.ts
+++ b/frontend/tests/admin-auth.test.ts
@@ -22,10 +22,10 @@ test("anonymous admin access is 401", () => {
   });
 });
 
-test("viewer may read but may not write", () => {
+test("viewer may neither read nor write", () => {
   assert.deepEqual(authorizeAdminAccess(user(["user", "viewer"]), "read"), {
-    allowed: true,
-    role: "viewer",
+    allowed: false,
+    status: 403,
   });
   assert.deepEqual(authorizeAdminAccess(user(["viewer"]), "write"), {
     allowed: false,
diff --git a/frontend/tests/admin-contracts.test.ts b/frontend/tests/admin-contracts.test.ts
index 58fa8f2c..fcc36f34 100644
--- a/frontend/tests/admin-contracts.test.ts
+++ b/frontend/tests/admin-contracts.test.ts
@@ -3,30 +3,73 @@ import { readFileSync } from "node:fs";
 import test from "node:test";
 
 const migration = readFileSync(
-  new URL("../supabase/migrations/20260727010000_refine_admin_redemption_audit.sql", import.meta.url),
+  new URL("../supabase/migrations/20260805010000_reconcile_admin_redemption_audit.sql", import.meta.url),
   "utf8",
 );
 const auth = readFileSync(new URL("../src/lib/admin/auth.ts", import.meta.url), "utf8");
 const authPolicy = readFileSync(new URL("../src/lib/admin/auth-policy.ts", import.meta.url), "utf8");
+const adminUser = readFileSync(new URL("../src/lib/supabase/admin.ts", import.meta.url), "utf8");
 const codesRoute = readFileSync(new URL("../src/app/api/admin/codes/route.ts", import.meta.url), "utf8");
 const codeRoute = readFileSync(new URL("../src/app/api/admin/codes/[id]/route.ts", import.meta.url), "utf8");
 const providers = readFileSync(new URL("../src/lib/admin/providers.ts", import.meta.url), "utf8");
+const adminLayout = readFileSync(new URL("../src/app/admin/layout.tsx", import.meta.url), "utf8");
+const adminApp = readFileSync(new URL("../src/components/admin/admin-app.tsx", import.meta.url), "utf8");
+const adminRootRoute = readFileSync(new URL("../src/app/admin/route.ts", import.meta.url), "utf8");
 const readonlyRoutes = ["users", "credit-transactions", "consultations", "audit-logs"].map((resource) =>
   readFileSync(new URL(`../src/app/api/admin/${resource}/route.ts`, import.meta.url), "utf8"),
 );
 const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 
-test("admin APIs use persisted Better Auth roles with admin and viewer boundaries", () => {
+test("admin APIs use persisted Better Auth roles with admin-only boundaries", () => {
   assert.match(auth, /requireIdentityUser/);
+  assert.match(auth, /getIdentityAuthServices\(\)\.user\.api/);
   assert.match(authPolicy, /user\.role\.includes\("admin"\)/);
-  assert.match(authPolicy, /user\.role\.includes\("viewer"\)/);
-  assert.match(authPolicy, /access === "write" && role !== "admin"/);
+  assert.doesNotMatch(authPolicy, /viewer/);
   assert.doesNotMatch(auth, /ADMIN_EMAILS|isAdminEmail/);
   assert.match(auth, /APP_ENV\?\.trim\(\) === "production"/);
   assert.match(codesRoute, /requireAdminSession\("write"\)/);
   assert.match(codeRoute, /requireAdminSession\("write"\)/g);
 });
 
+test("self-hosted account entry checks only the persisted admin role", () => {
+  const selfHostedBranch = adminUser.slice(
+    adminUser.indexOf('process.env.AUTH_PROVIDER?.trim() === "self-hosted"'),
+    adminUser.indexOf("if (isAdminEmail"),
+  );
+
+  assert.match(selfHostedBranch, /queryAdminRows/);
+  assert.match(selfHostedBranch, /select role from identity\.users where id = \$1 limit 1/);
+  assert.match(selfHostedBranch, /role === "admin"/);
+  assert.doesNotMatch(selfHostedBranch, /viewer|isAdminEmail|ADMIN_EMAILS/);
+  assert.match(auth, /authorizeAdminAccess\(user, access\)/);
+});
+
+test("admin navigation exposes payment and package resources", () => {
+  assert.match(adminApp, /name: "payments", list: "\/admin\/payments", meta: \{ label: "支付管理"/);
+  assert.match(adminApp, /name: "packages", list: "\/admin\/packages", meta: \{ label: "套餐管理"/);
+  assert.match(adminApp, /CreditCardOutlined/);
+  assert.match(adminApp, /ShoppingOutlined/);
+});
+
+test("admin sider replaces logout with a collapsed-aware return-to-chat link", () => {
+  assert.match(adminApp, /ThemedLayout Sider=\{AdminSider\}/);
+  assert.match(adminApp, /ThemedSider/);
+  assert.match(adminApp, /render=\{\(\{ items, collapsed \}\)/);
+  assert.match(adminApp, /\{items\}/);
+  assert.match(adminApp, /ArrowLeftOutlined/);
+  assert.match(adminApp, /<Link href="\/" aria-label="返回对话">\{collapsed \? null : "返回对话"\}<\/Link>/);
+  assert.doesNotMatch(adminApp, /logout\s*[,(}]|authProvider\.logout/);
+});
+
+test("admin pages and root route are server-gated before rendering or redirecting", () => {
+  assert.match(adminLayout, /await requireAdminSession\("read"\)/);
+  assert.match(adminLayout, /error\.status === 401 \? "\/login" : "\/"/);
+  assert.match(adminLayout, /redirect\(/);
+  assert.match(adminRootRoute, /await requireAdminSession\("read"\)/);
+  assert.match(adminRootRoute, /error\.status === 401 \? "\/login" : "\/"/);
+  assert.match(adminRootRoute, /headers: \{ location: "\/admin\/codes" \}/);
+});
+
 test("readonly resources cannot be mutated through Refine access control", () => {
   for (const resource of ["users", "credit-transactions", "consultations", "audit-logs"]) {
     assert.match(providers, new RegExp(`"${resource}"`));
diff --git a/frontend/tests/admin-database.test.ts b/frontend/tests/admin-database.test.ts
index 3c1cf4b1..90518bc7 100644
--- a/frontend/tests/admin-database.test.ts
+++ b/frontend/tests/admin-database.test.ts
@@ -30,7 +30,7 @@ test("admin code functions reject immutable codes, revoked redemption, and roll
       },
     });
     assert.equal(migration.status, 0, migration.stderr);
-    assert.match(migration.stdout, /20260727010000_refine_admin_redemption_audit\.sql/);
+    assert.match(migration.stdout, /20260805010000_reconcile_admin_redemption_audit\.sql/);
 
     fixture.psqlAs("identity_runtime", "identity-runtime-test-password", `
       insert into identity.users (id, name, email, email_verified, email_verified_at, role)
diff --git a/frontend/tests/admin-payments-contract.test.ts b/frontend/tests/admin-payments-contract.test.ts
new file mode 100644
index 00000000..5ff9c475
--- /dev/null
+++ b/frontend/tests/admin-payments-contract.test.ts
@@ -0,0 +1,94 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+
+const root = new URL("../", import.meta.url);
+const route = readFileSync(new URL("src/app/api/admin/payments/route.ts", root), "utf8");
+const packagesRoute = readFileSync(new URL("src/app/api/admin/packages/route.ts", root), "utf8");
+const paymentPage = readFileSync(new URL("src/app/admin/payments/page.tsx", root), "utf8");
+const packagesPage = readFileSync(new URL("src/app/admin/packages/page.tsx", root), "utf8");
+const paymentManagement = readFileSync(new URL("src/components/admin/payment-management.tsx", root), "utf8");
+const packageManagement = readFileSync(new URL("src/components/admin/package-management.tsx", root), "utf8");
+const adminApp = readFileSync(new URL("src/components/admin/admin-app.tsx", root), "utf8");
+const globalsCss = readFileSync(new URL("src/app/globals.css", root), "utf8");
+
+test("支付后台接口使用 self-hosted PostgreSQL 联表且不依赖 Supabase builder", () => {
+  assert.match(route, /requireAdminSession\("read"\)/);
+  assert.match(route, /queryAdminRows<PaymentOrderRow>/);
+  assert.match(route, /from public\.payment_orders o/);
+  assert.match(route, /left join public\.payment_packages p on p\.id = o\.package_id/);
+  assert.match(route, /left join identity\.users u on u\.id = o\.user_id/);
+  assert.match(route, /count\(\*\) over\(\)::text as total_count/);
+  assert.match(route, /order by o\.created_at desc, o\.order_no asc/);
+  assert.doesNotMatch(route, /createAdminSupabaseClient|auth\.admin|\.from\(|\.range\(|count: "exact"/);
+  assert.doesNotMatch(route, /userId|user_id:|raw_notify_payload|SUPABASE_SERVICE_ROLE_KEY/);
+});
+
+test("支付接口使用参数化筛选、独立日期统计与 ISO 日期输出", () => {
+  for (const field of ["status", "from", "to", "limit", "offset"]) assert.match(route, new RegExp(field));
+  for (const field of ["totalOrders", "paidOrders", "pendingOrders", "failedExpiredOrders", "paidAmountCents", "grantedCredits"]) assert.match(route, new RegExp(field));
+  assert.match(route, /max\(100\)/);
+  assert.match(route, /\$\$\{values\.length\}/);
+  assert.match(route, /statsValues/);
+  assert.match(route, /created_at\.toISOString\(\)/);
+  assert.match(route, /paid_at\?\.toISOString\(\) \?\? null/);
+  assert.match(route, /支付记录服务暂时不可用/);
+  assert.match(route, /hasMore/);
+});
+
+test("支付管理页只保留概览、默认折叠的 Z-Pay 配置与支付记录", () => {
+  assert.match(paymentPage, /PaymentManagement/);
+  for (const component of ["List", "Card", "Collapse", "Table", "Form", "Tag", "Alert", "Statistic"]) assert.match(paymentManagement, new RegExp(`\\b${component}\\b`));
+  assert.match(paymentManagement, /支付概览/);
+  assert.match(paymentManagement, /<Collapse[\s\S]*defaultActiveKey=\{\[\]\}[\s\S]*label: "Z-Pay（易支付）渠道配置"/);
+  assert.match(paymentManagement, /children: \([\s\S]*测试可用性（当前已保存配置）[\s\S]*保存配置[\s\S]*<Form<EpaySettingsForm>/);
+  assert.match(paymentManagement, /支付记录/);
+  assert.match(paymentManagement, /\/api\/admin\/payments/);
+  assert.doesNotMatch(paymentManagement, /套餐列表|套餐设置|添加套餐|\/api\/admin\/packages|PackageManagement/);
+});
+
+test("套餐管理是支付管理之后的独立资源和页面", () => {
+  assert.match(adminApp, /name: "payments", list: "\/admin\/payments"[\s\S]*name: "packages", list: "\/admin\/packages", meta: \{ label: "套餐管理"[\s\S]*name: "users"/);
+  assert.match(adminApp, /ShoppingOutlined/);
+  assert.match(packagesPage, /PackageManagement/);
+  assert.doesNotMatch(packagesPage, /redirect/);
+  assert.match(packageManagement, /<List title="套餐管理">/);
+  assert.match(packageManagement, /<Card title="套餐设置"/);
+});
+
+test("套餐完整设置、加载重试及新增编辑停用操作保留", () => {
+  for (const field of ["名称", "描述", "价格（元）", "点数", "排序", "启用"]) assert.match(packageManagement, new RegExp(field));
+  assert.match(packageManagement, /套餐列表读取失败/);
+  assert.match(packageManagement, /loadPackages\(\)/);
+  assert.match(packageManagement, />重试<\/Button>/);
+  assert.match(packageManagement, /<Modal/);
+  assert.match(packageManagement, /title=\{editingPackage \? "编辑套餐" : "添加套餐"\}/);
+  assert.match(packageManagement, /priceCents: Math\.round\(values\.priceYuan \* 100\)/);
+  for (const method of ["POST", "PATCH", "DELETE"]) assert.match(packageManagement, new RegExp(`method: .*${method}`));
+  assert.match(packageManagement, /message\.success/);
+  assert.match(packageManagement, /message\.error/);
+  assert.match(packageManagement, /packageForm\.resetFields\(\)/);
+  assert.match(packagesRoute, /requireAdminSession\("read"\)/);
+  assert.match(packagesRoute, /requireAdminSession\("write"\)/);
+});
+
+test("套餐 API 使用直接参数化 PostgreSQL CRUD、UUID 校验与未找到响应", () => {
+  assert.match(packagesRoute, /queryAdminRows<PackageRow>/);
+  assert.match(packagesRoute, /from public\.payment_packages[\s\S]*order by sort_order, created_at/);
+  assert.match(packagesRoute, /insert into public\.payment_packages[\s\S]*values \(\$1, \$2, \$3, \$4, \$5, \$6, \$7\)[\s\S]*returning/);
+  assert.match(packagesRoute, /created_by[\s\S]*auth\.user\.id/);
+  assert.match(packagesRoute, /updateSchema = schema\.extend\(\{ id: z\.string\(\)\.uuid\(\) \}\)/);
+  assert.match(packagesRoute, /update public\.payment_packages[\s\S]*where id = \$1[\s\S]*returning/);
+  assert.match(packagesRoute, /set enabled = false, updated_at = clock_timestamp\(\)[\s\S]*returning id/);
+  assert.match(packagesRoute, /套餐不存在" \}, \{ status: 404 \}/g);
+  assert.match(packagesRoute, /created_at\.toISOString\(\)/);
+  assert.match(packagesRoute, /updated_at\.toISOString\(\)/);
+  assert.doesNotMatch(packagesRoute, /createAdminSupabaseClient|\.from\(|\.insert\(|\.update\(|\.eq\(|\.select\(/);
+});
+
+test("后台使用独立的全视口纵向滚动容器而不修改全局聊天溢出边界", () => {
+  assert.match(adminApp, /<div className="admin-app-shell">[\s\S]*<ConfigProvider/);
+  assert.match(globalsCss, /html, body \{[^}]*overflow: hidden;/);
+  assert.match(globalsCss, /\.admin-app-shell \{ height: 100dvh; min-height: 0; overflow-y: auto; \}/);
+  assert.match(globalsCss, /\.admin-app-shell > \*, \.admin-app-shell \.ant-layout \{ min-height: 100%; \}/);
+});
diff --git a/frontend/tests/admin-users-contract.test.ts b/frontend/tests/admin-users-contract.test.ts
new file mode 100644
index 00000000..735414cb
--- /dev/null
+++ b/frontend/tests/admin-users-contract.test.ts
@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+
+const root = new URL("../", import.meta.url);
+const adminSource = readFileSync(new URL("src/lib/supabase/admin.ts", root), "utf8");
+const adminCoreSource = readFileSync(new URL("src/lib/supabase/admin-client-core.ts", root), "utf8");
+const codesSource = readFileSync(new URL("src/app/api/admin/codes/route.ts", root), "utf8");
+const sessionSource = readFileSync(new URL("src/app/api/admin/session/route.ts", root), "utf8");
+const accountSource = readFileSync(new URL("src/app/api/account/route.ts", root), "utf8");
+const usersSource = readFileSync(new URL("src/app/api/admin/users/route.ts", root), "utf8");
+const migration = readFileSync(new URL("supabase/migrations/20260805020000_reconcile_payment_admin_schema.sql", root), "utf8");
+
+test("ADMIN_EMAILS remains a case-insensitive comma-separated allowlist", () => {
+  assert.match(adminCoreSource, /configured/);
+  assert.match(adminCoreSource, /split\(","\)/);
+  assert.match(adminCoreSource, /toLowerCase/);
+  assert.match(adminCoreSource, /export function isAdminEmail/);
+});
+
+test("admin surfaces await database-backed administrator checks", () => {
+  assert.match(adminSource, /export async function isAdminUser/);
+  assert.match(adminSource, /from\("admin_users"\)/);
+  assert.match(sessionSource, /await requireAdminSession\(\)/);
+  assert.match(codesSource, /await requireAdminSession\("write"\)/);
+  assert.match(accountSource, /const isAdmin = await isAdminUser\(user\)/);
+  assert.match(accountSource, /isAdmin,/);
+});
+
+test("admin_users migration is service-role-only and auditable", () => {
+  assert.match(migration, /user_id uuid primary key references auth\.users\(id\)/);
+  assert.match(migration, /created_at timestamptz/);
+  assert.match(migration, /created_by uuid/);
+  assert.match(migration, /revoked_at timestamptz/);
+  assert.match(migration, /revoked_by uuid/);
+  assert.match(migration, /enable row level security/);
+  assert.match(migration, /revoke all on table public\.admin_users from anon, authenticated/);
+  assert.match(migration, /grant select, insert, update on table public\.admin_users to service_role/);
+});
+
+test("admin users route exposes a guarded list and rejects mutations", () => {
+  assert.match(usersSource, /export async function GET/);
+  assert.match(usersSource, /await requireAdminSession\(\)/);
+  assert.match(usersSource, /export const POST = readonlyAdminMutation/);
+  assert.match(usersSource, /export const PATCH = readonlyAdminMutation/);
+  assert.match(usersSource, /export const DELETE = readonlyAdminMutation/);
+});
diff --git a/frontend/tests/birth-date-picker-contract.test.ts b/frontend/tests/birth-date-picker-contract.test.ts
index 91d92bd2..f4db70f8 100644
--- a/frontend/tests/birth-date-picker-contract.test.ts
+++ b/frontend/tests/birth-date-picker-contract.test.ts
@@ -5,6 +5,7 @@ import test from "node:test"
 const packageJson = readFileSync(new URL("../package.json", import.meta.url), "utf8")
 const intake = readFileSync(new URL("../src/components/birth-time-intake.tsx", import.meta.url), "utf8")
 const pickerUrl = new URL("../src/components/birth-date-picker.tsx", import.meta.url)
+const calendarUrl = new URL("../src/components/ui/calendar.tsx", import.meta.url)
 
 test("provides the shadcn calendar and popover primitives", () => {
   assert.equal(existsSync(new URL("../src/components/ui/calendar.tsx", import.meta.url)), true)
@@ -21,25 +22,15 @@ test("replaces the native birth date input with the shadcn date picker", () => {
   assert.match(picker, /render=\{<Button/)
   assert.match(picker, /<Calendar/)
   assert.match(picker, /captionLayout="dropdown"/)
+  assert.match(picker, /const defaultMonth = new Date\(1997, today\.getMonth\(\), 1\)/)
+  assert.match(picker, /defaultMonth=\{selected \?\? defaultMonth\}/)
   assert.match(picker, /startMonth=\{new Date\(1900, 0\)\}/)
   assert.match(picker, /reverseYears/)
 })
 
-test("keeps the shadcn date-of-birth dropdown navigation order", () => {
-  // Given the shadcn Date of Birth composition
-  const picker = readFileSync(pickerUrl, "utf8")
+test("keeps the month and year dropdowns clickable above calendar navigation", () => {
+  const calendar = readFileSync(calendarUrl, "utf8")
 
-  // When dropdown captions are enabled
-  // Then the picker must not move the full-width nav after the caption selects
-  assert.doesNotMatch(picker, /navLayout="after"/)
-})
-
-test("opens an empty birth date picker at 1997 instead of the current year", () => {
-  // Given: a new user has not selected a birth date yet.
-  const picker = readFileSync(pickerUrl, "utf8")
-
-  // When: the popover chooses its initial visible month.
-  // Then: it starts in 1997 so common birth years are nearby.
-  assert.match(picker, /const emptyDefaultMonth = new Date\(1997, 0, 1\)/)
-  assert.match(picker, /defaultMonth=\{selected \?\? emptyDefaultMonth\}/)
+  assert.match(calendar, /pointer-events-none absolute inset-x-0 top-0/)
+  assert.match(calendar, /pointer-events-auto size-\(--cell-size\)/)
 })
diff --git a/frontend/tests/database-local-business.test.ts b/frontend/tests/database-local-business.test.ts
index f13fcd35..50eb4464 100644
--- a/frontend/tests/database-local-business.test.ts
+++ b/frontend/tests/database-local-business.test.ts
@@ -35,6 +35,9 @@ test("local PostgreSQL applies the reviewed business schema and serves authentic
     assert.match(migration.stdout, /applied 20260728020000_rectification_agent_v5\.sql/);
     assert.match(migration.stdout, /applied 20260804010000_agentic_rectification_candidate_acceptance\.sql/);
     assert.match(migration.stdout, /applied 20260804020000_preserve_reported_birth_time_on_candidate_acceptance\.sql/);
+    assert.match(migration.stdout, /applied 20260805010000_reconcile_admin_redemption_audit\.sql/);
+    assert.match(migration.stdout, /applied 20260805020000_reconcile_payment_admin_schema\.sql/);
+    assert.match(migration.stdout, /applied 20260805030000_reconcile_rectification_v4_conversational_turns\.sql/);
 
     assert.equal(
       fixture.psql(`
@@ -80,6 +83,7 @@ test("local PostgreSQL applies the reviewed business schema and serves authentic
         where schemaname = 'public'
       `),
       [
+        "admin_users",
         "agentic_rectification_results",
         "birth_time_rectification_action_receipts",
         "birth_time_rectification_agent_runs",
@@ -111,6 +115,9 @@ test("local PostgreSQL applies the reviewed business schema and serves authentic
         "consultation_requests",
         "credit_request_cancellations",
         "credit_transactions",
+        "epay_settings",
+        "payment_orders",
+        "payment_packages",
         "profiles",
         "redemption_codes",
         "synastry_reports",
diff --git a/frontend/tests/epay-payment-contract.test.ts b/frontend/tests/epay-payment-contract.test.ts
new file mode 100644
index 00000000..4b3dc123
--- /dev/null
+++ b/frontend/tests/epay-payment-contract.test.ts
@@ -0,0 +1,54 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { test } from "node:test";
+import { epayCanonical, epaySign } from "../src/lib/epay/sign";
+import { createEpayNotifyHandler } from "../src/lib/epay/notify-core";
+
+const migration = readFileSync(new URL("../supabase/migrations/20260805020000_reconcile_payment_admin_schema.sql", import.meta.url), "utf8");
+
+test("易支付签名过滤空值并按键排序", () => {
+  const params = { money: "10.00", pid: "10001", name: "套餐", empty: "", sign_type: "MD5" };
+  assert.equal(epayCanonical(params), "money=10.00&name=套餐&pid=10001");
+  assert.equal(epaySign(params, "secret"), "79dd3a13f9fd32622fa2197c0a2d7b66");
+});
+
+test("支付迁移包含套餐、订单、payment 类型与原子结算", () => {
+  assert.match(migration, /create table if not exists public\.payment_packages/);
+  assert.match(migration, /create table if not exists public\.payment_orders/);
+  assert.match(migration, /transaction_type in \('redeem', 'reserve', 'refund', 'payment'\)/);
+  assert.match(migration, /settle_epay_order/);
+  assert.match(migration, /on conflict \(user_id, transaction_type, request_id\) do nothing/);
+});
+
+test("self-hosted 管理角色具有支付后台最小权限", () => {
+  assert.match(migration, /grant select, insert, update on table public\.payment_packages to admin_runtime/);
+  assert.match(migration, /grant select on table public\.payment_orders to admin_runtime/);
+  assert.doesNotMatch(migration, /grant (?:all|insert|update|delete) on table public\.payment_orders to admin_runtime/);
+  assert.match(migration, /grant select on table public\.epay_settings to admin_runtime/);
+  assert.match(migration, /grant execute on function public\.admin_save_epay_settings\([\s\S]*\) to admin_runtime/);
+});
+
+
+test("支付通知只在原子结算成功后确认网关", async () => {
+  const values = { pid: "10001", trade_status: "TRADE_SUCCESS", out_trade_no: "ORDER-1234567890", trade_no: "TRADE-1", money: "10.00" };
+  const body = new URLSearchParams({ ...values, sign: epaySign(values, "secret"), sign_type: "MD5" }).toString();
+  const request = () => new Request("https://example.test/api/payment/epay/notify", { method: "POST", body });
+  const handler = (result: { data: unknown; error: unknown } | Error) => createEpayNotifyHandler({
+    readConfig: async () => ({ pid: "10001", key: "secret" }),
+    settle: async () => { if (result instanceof Error) throw result; return result; },
+  });
+
+  for (const failed of [
+    { data: null, error: new Error("database unavailable") },
+    { data: [{ success: false, status: "profile_missing", credits: null }], error: null },
+    new Error("database unavailable"),
+  ]) {
+    const response = await handler(failed)(request());
+    assert.equal(response.status, 500);
+    assert.equal(await response.text(), "fail");
+  }
+
+  const response = await handler({ data: [{ success: true, status: "paid", credits: 100 }], error: null })(request());
+  assert.equal(response.status, 200);
+  assert.equal(await response.text(), "success");
+});
diff --git a/frontend/tests/epay-settings.test.ts b/frontend/tests/epay-settings.test.ts
new file mode 100644
index 00000000..6bd167b8
--- /dev/null
+++ b/frontend/tests/epay-settings.test.ts
@@ -0,0 +1,185 @@
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import { readFileSync } from "node:fs";
+import test from "node:test";
+import { decryptEpayKey, encryptEpayKey, EpayEncryptionError } from "../src/lib/epay/encryption-core";
+import { resolveEpayConfig } from "../src/lib/epay/config-core";
+import { assertPublicEpayGateway, isPublicEpayAddress } from "../src/lib/epay/gateway-policy";
+
+const root = new URL("../", import.meta.url);
+const route = readFileSync(new URL("src/app/api/admin/epay-settings/route.ts", root), "utf8");
+const management = readFileSync(new URL("src/components/admin/payment-management.tsx", root), "utf8");
+const createRoute = readFileSync(new URL("src/app/api/payment/epay/create/route.ts", root), "utf8");
+const notifyRoute = readFileSync(new URL("src/app/api/payment/epay/notify/route.ts", root), "utf8");
+const notifyCore = readFileSync(new URL("src/lib/epay/notify-core.ts", root), "utf8");
+const configRoute = readFileSync(new URL("src/lib/epay/config.ts", root), "utf8");
+const availability = readFileSync(new URL("src/lib/epay/availability.ts", root), "utf8");
+const packagesRoute = readFileSync(new URL("src/app/api/payment/packages/route.ts", root), "utf8");
+const testRoute = readFileSync(new URL("src/app/api/admin/epay-settings/test/route.ts", root), "utf8");
+const page = readFileSync(new URL("src/app/page.tsx", root), "utf8");
+const migration = readFileSync(new URL("supabase/migrations/20260805020000_reconcile_payment_admin_schema.sql", root), "utf8");
+
+const key = crypto.randomBytes(32).toString("base64");
+
+test("易支付密钥 AES-256-GCM 往返、篡改与错误主密钥", () => {
+  const encrypted = encryptEpayKey("merchant-secret", key);
+  assert.match(encrypted, /^v1\.[^.]+\.[^.]+\.[^.]+$/);
+  assert.equal(decryptEpayKey(encrypted, key), "merchant-secret");
+  const tampered = `${encrypted.slice(0, -1)}${encrypted.endsWith("A") ? "B" : "A"}`;
+  assert.throws(() => decryptEpayKey(tampered, key), EpayEncryptionError);
+  assert.throws(() => decryptEpayKey(encrypted, crypto.randomBytes(32).toString("base64")), EpayEncryptionError);
+  assert.throws(() => encryptEpayKey("merchant-secret", "not-base64"), EpayEncryptionError);
+});
+
+test("配置解析数据库优先且无行时回退环境变量", async () => {
+  const encrypted = encryptEpayKey("database-secret", key);
+  const database = await resolveEpayConfig(async () => ({
+    gateway_url: "https://database-pay.example.com/",
+    pid: "database-pid",
+    encrypted_key: encrypted,
+    notify_url: "https://staging.example.com/api/payment/epay/notify",
+    return_url: "https://staging.example.com/",
+    site_name: "Staging",
+    chat_enabled: false,
+  }), {
+    NODE_ENV: "test",
+    EPAY_CONFIG_ENCRYPTION_KEY: key,
+    EPAY_GATEWAY_URL: "https://environment-pay.example.com",
+    EPAY_PID: "environment-pid",
+    EPAY_KEY: "environment-secret",
+  });
+  assert.equal(database.gatewayUrl.toString(), "https://database-pay.example.com/");
+  assert.equal(database.pid, "database-pid");
+  assert.equal(database.key, "database-secret");
+  assert.equal(database.chatEnabled, false);
+
+  const environment = await resolveEpayConfig(async () => null, {
+    NODE_ENV: "test",
+    SITE_ADDRESS: "https://staging.example.com",
+    EPAY_GATEWAY_URL: "https://environment-pay.example.com",
+    EPAY_PID: "environment-pid",
+    EPAY_KEY: "environment-secret",
+    EPAY_CHAT_ENABLED: "1",
+  });
+  assert.equal(environment.chatEnabled, true);
+  assert.equal(environment.notifyUrl, "https://staging.example.com/api/payment/epay/notify");
+  assert.equal(environment.returnUrl, "https://staging.example.com/");
+});
+
+test("管理员 API 不回显任何密钥并强制首次显式录入", () => {
+  assert.match(route, /requireAdminSession\("read"\)/);
+  assert.match(route, /requireAdminSession\("write"\)/);
+  assert.match(route, /\.strict\(\)/);
+  assert.match(route, /crypto\.randomUUID\(\)/);
+  assert.match(route, /首次保存数据库配置时必须输入新的商户密钥/);
+  assert.match(route, /chatEnabled: z\.boolean\(\)/);
+  assert.match(route, /chatEnabled: row\.chat_enabled/);
+  assert.match(route, /queryAdminRows<SettingsRow>/);
+  assert.match(route, /select gateway_url, pid, encrypted_key, notify_url, return_url, site_name, chat_enabled, updated_at[\s\S]*from public\.epay_settings[\s\S]*where id = true[\s\S]*limit 1/);
+  assert.match(route, /select \* from public\.admin_save_epay_settings\([\s\S]*\$1, \$2, \$3, \$4, \$5, \$6, \$7, \$8, \$9, \$10, \$11, \$12/);
+  assert.match(route, /parsed\.data\.chatEnabled,[\s\S]*Boolean\(parsed\.data\.newKey\)/);
+  assert.match(route, /keyConfigured/);
+  assert.doesNotMatch(route, /createAdminSupabaseClient|\.from\(|\.rpc\(/);
+  assert.doesNotMatch(route, /NextResponse\.json\([^\n]*(?:encrypted_key|newKey|encryptedKey|maskedKey|keyMask)/);
+  assert.doesNotMatch(route, /BETTER_AUTH_SECRET/);
+});
+
+test("迁移前仅在配置表不存在时继续使用环境变量", () => {
+  assert.match(configRoute, /error\?\.code === "42P01"/);
+  assert.match(route, /isPostgresError\(error\) && error\.code === "42P01"/);
+  assert.match(route, /throw error/);
+  assert.match(configRoute, /if \(error\) throw new Error\(\)/);
+});
+
+test("支付调用点等待异步数据库配置", () => {
+  assert.match(createRoute, /await readEpayConfig\(\)/);
+  assert.match(notifyRoute, /readConfig: readEpayConfig/);
+  assert.match(notifyCore, /await dependencies\.readConfig\(\)/);
+  assert.match(notifyRoute, /export async function POST/);
+  assert.match(notifyRoute, /export async function GET/);
+});
+
+test("统一支付页面含默认折叠的 Z-Pay 渠道配置与永不预填的 Password", () => {
+  assert.match(management, /<Collapse[\s\S]*defaultActiveKey=\{\[\]\}[\s\S]*label: "Z-Pay（易支付）渠道配置"/);
+  assert.match(management, /children: \([\s\S]*<Card[\s\S]*测试可用性（当前已保存配置）[\s\S]*保存配置/);
+  assert.match(management, /\/api\/admin\/epay-settings/);
+  assert.match(management, /<Input\.Password/);
+  assert.match(management, /placeholder="留空保持原密钥"/);
+  assert.match(management, /setFieldValue\("newKey", ""\)/);
+  assert.doesNotMatch(management, /value=\{.*(?:key|secret)/i);
+});
+
+test("支付开关贯通迁移、公共套餐 API、创建订单和对话页", () => {
+  assert.match(migration, /chat_enabled boolean not null default false/);
+  assert.match(migration, /p_chat_enabled boolean/);
+  assert.match(migration, /'chatEnabled'/);
+  assert.match(availability, /EPAY_CHAT_ENABLED/);
+  assert.doesNotMatch(availability, /EPAY_CONFIG_ENCRYPTION_KEY|decryptEpayKey/);
+  assert.match(packagesRoute, /enabled: false, packages: \[\]/);
+  assert.match(packagesRoute, /enabled: true/);
+  assert.match(createRoute, /在线支付暂未开放/);
+  assert.match(createRoute, /EPAY_DISABLED/);
+  assert.match(createRoute, /await readEpayAvailability\(\)/);
+  assert.ok(createRoute.indexOf("availability.enabled") < createRoute.indexOf("await readEpayConfig()"));
+  assert.ok(createRoute.indexOf("availability.enabled") < createRoute.indexOf("payment_packages"));
+  assert.match(management, /在对话页开放支付/);
+  assert.match(page, /paymentEnabled && <div className="payment-packages">/);
+  assert.match(page, /setPaymentEnabled\(false\)[\s\S]*setPaymentPackages\(\[\]\)[\s\S]*setPaymentOrder\(null\)[\s\S]*setPaymentError\(""\)/);
+});
+
+test("创建订单返回已签名收银台 URL 且不服务端请求网关", () => {
+  assert.match(createRoute, /assertPublicGatewayUrl\(submitUrl\)/);
+  assert.match(createRoute, /const signedParams = \{ \.\.\.params, sign: epaySign\(params, config\.key\), sign_type: "MD5" \}/);
+  assert.match(createRoute, /const payUrl = new URL\(submitUrl\)/);
+  assert.match(createRoute, /payUrl\.searchParams\.set\(name, value\)/);
+  assert.match(createRoute, /NextResponse\.json\(\{ orderNo, payUrl: payUrl\.toString\(\), qrCode: null \}\)/);
+  for (const field of ["money", "name", "notify_url", "out_trade_no", "pid", "return_url", "sitename", "type", "sign", "sign_type"]) assert.match(createRoute, new RegExp(field));
+  assert.doesNotMatch(createRoute, /fetch\(submitUrl|document\.createElement\("form"\)|submitUrl:|fields[, }]/);
+  assert.doesNotMatch(createRoute, /NextResponse\.json\([^\n]*config\.key|searchParams\.set\([^\n]*config\.key/);
+
+  assert.match(page, /window\.open\(payload\.payUrl, "_blank", "noopener,noreferrer"\)/);
+  assert.match(page, /<h3>套餐充值<\/h3>/);
+  assert.match(page, /立即支付/);
+  assert.match(page, /套餐支付暂时不可用，请稍后重试/);
+  assert.doesNotMatch(page, /document\.createElement\("form"\)|payload\.submitUrl|payload\.fields/);
+});
+
+test("网关探测只使用 HEAD/GET、受限响应且共享 SSRF 门禁", () => {
+  assert.match(testRoute, /requireAdminSession\("write"\)/);
+  assert.match(testRoute, /method: "HEAD"/);
+  assert.match(testRoute, /response\.status === 405 \|\| response\.status === 501/);
+  assert.match(testRoute, /method: "GET"/);
+  assert.doesNotMatch(testRoute, /method: "POST"|payment_orders|\.text\(\)|\.json\(\)/);
+  assert.match(testRoute, /AbortSignal\.timeout\(8_000\)/);
+  assert.match(testRoute, /redirect: "manual"/);
+  assert.match(testRoute, /available,[\s\S]*message:[\s\S]*latencyMs:[\s\S]*status:/);
+  assert.doesNotMatch(testRoute, /pid:|key:|gatewayUrl:|headers:|body:|payment_orders/);
+  assert.match(testRoute, /assertPublicGatewayUrl\(submitUrl\)/);
+  assert.match(createRoute, /assertPublicGatewayUrl\(submitUrl\)/);
+});
+
+test("纯地址判断拒绝私网、回环、链路本地并接受公网", () => {
+  for (const address of ["127.0.0.1", "10.0.0.1", "172.16.0.1", "192.168.1.1", "169.254.1.1", "::1", "fc00::1", "fe80::1", "2001:db8::1"]) {
+    assert.equal(isPublicEpayAddress(address), false, address);
+  }
+  for (const address of ["8.8.8.8", "1.1.1.1", "2606:4700:4700::1111"]) {
+    assert.equal(isPublicEpayAddress(address), true, address);
+  }
+  assert.throws(() => assertPublicEpayGateway("http://localhost/pay"));
+  assert.throws(() => assertPublicEpayGateway("http://127.0.0.1/pay"));
+  assert.doesNotThrow(() => assertPublicEpayGateway("https://pay.example.com"));
+});
+
+test("迁移锁定单行、RLS、最小权限与脱敏原子审计", () => {
+  assert.match(migration, /create table if not exists public\.epay_settings/);
+  assert.match(migration, /id boolean primary key default true check \(id\)/);
+  assert.match(migration, /alter table public\.epay_settings enable row level security/);
+  assert.match(migration, /revoke all on table public\.epay_settings from public, anon, authenticated, service_role/);
+  assert.match(migration, /grant select on table public\.epay_settings to service_role/);
+  assert.match(migration, /security definer/);
+  assert.match(migration, /insert into audit\.admin_audit_logs/);
+  assert.match(migration, /'keyConfigured'/);
+  assert.match(migration, /'keyChanged'/);
+  const auditBlock = migration.slice(migration.indexOf("insert into audit.admin_audit_logs"));
+  assert.doesNotMatch(auditBlock, /'encryptedKey'|'encrypted_key'|'secret'|jsonb_build_object\([\s\S]*?'key'/);
+});
diff --git a/frontend/tests/health-deployment.test.ts b/frontend/tests/health-deployment.test.ts
index cfe10d89..aea3b45f 100644
--- a/frontend/tests/health-deployment.test.ts
+++ b/frontend/tests/health-deployment.test.ts
@@ -104,10 +104,7 @@ test("server compose accepts staging paths while preserving production defaults"
     compose,
     /SITE_ADDRESS: \$\{SITE_ADDRESS:-https:\/\/jyotisha\.chat\}/,
   );
-  assert.match(
-    compose,
-    /ADMIN_SITE_ADDRESS: \$\{ADMIN_SITE_ADDRESS:-https:\/\/admin\.staging\.jyotisha\.chat\}/,
-  );
+  assert.doesNotMatch(compose, /ADMIN_SITE_ADDRESS|AUTH_ADMIN_ORIGIN|BETTER_AUTH_ADMIN_SECRET/);
 });
 
 test("server compose defaults to local images without removing either build", () => {
@@ -156,22 +153,15 @@ test("server compose defaults to local images without removing either build", ()
   }
 });
 
-test("staging Caddy isolates the business admin surface from the public host", () => {
+test("staging Caddy serves admin on the main site", () => {
   const caddy = readFileSync(
     new URL("../../deploy/Caddyfile.staging", import.meta.url),
     "utf8",
   );
 
   assert.match(caddy, /\{\$SITE_ADDRESS:https:\/\/staging\.jyotisha\.chat\}/);
-  assert.match(
-    caddy,
-    /\{\$ADMIN_SITE_ADDRESS:https:\/\/admin\.staging\.jyotisha\.chat\}/,
-  );
   assert.match(caddy, /reverse_proxy web:3000/);
-  assert.match(caddy, /@adminPaths path \/admin \/admin\/\* \/api\/admin\/\*/);
-  assert.match(caddy, /redir @adminRoot \/admin\/codes 302/);
-  assert.match(caddy, /@adminSurface path \/login \/admin \/admin\/\* \/api\/admin\/\* \/api\/auth\/\*/);
-  assert.match(caddy, /respond "Not found" 404/);
+  assert.doesNotMatch(caddy, /ADMIN_SITE_ADDRESS|admin\.staging\.jyotisha\.chat|@adminSurface|@adminPaths/);
   assert.doesNotMatch(caddy, /www\.jyotisha\.chat/);
 });
 
@@ -246,19 +236,18 @@ test("staging env validator rejects selector drift, duplicates, and unsafe permi
     "APP_ENV_FILE=../.env.staging",
     "CADDYFILE_PATH=./Caddyfile.staging",
     "SITE_ADDRESS=https://staging.jyotisha.chat",
-    "ADMIN_SITE_ADDRESS=https://admin.staging.jyotisha.chat",
     "AUTH_PROVIDER=self-hosted",
     "SELF_HOSTED_IDENTITY_ENABLED=true",
     "AUTH_USER_ORIGIN=https://staging.jyotisha.chat",
-    "AUTH_ADMIN_ORIGIN=https://admin.staging.jyotisha.chat",
     "IDENTITY_DATABASE_URL=postgresql://identity_runtime:identity-runtime-test-password@postgres:5432/jyotisha",
     "APP_DATABASE_URL=postgresql://app_runtime:app-runtime-test-password@postgres:5432/jyotisha",
     "ADMIN_DATABASE_URL=postgresql://admin_runtime:admin-runtime-test-password@postgres:5432/jyotisha",
     "BETTER_AUTH_USER_SECRET=user-secret-that-is-at-least-32-bytes-long",
-    "BETTER_AUTH_ADMIN_SECRET=admin-secret-that-is-at-least-32-bytes-long",
     "RESEND_API_KEY=re_test_key_that_must_not_be_printed",
     "RESEND_FROM_EMAIL=Jyotisha Staging <login@staging.jyotisha.chat>",
     "ADMIN_EMAILS=admin@example.com",
+    "EPAY_CONFIG_ENCRYPTION_KEY=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
+    "EPAY_CHAT_ENABLED=false",
     "JYOTISH_DYNAMIC_RECTIFICATION_TOKEN=dynamic-token-that-is-at-least-32-bytes",
   ];
   const run = () =>
@@ -282,6 +271,13 @@ test("staging env validator rejects selector drift, duplicates, and unsafe permi
     );
     writeEnv(validSelectors);
     assert.equal(run().status, 0);
+
+    writeEnv(validSelectors.map((line) => line.startsWith("EPAY_CONFIG_ENCRYPTION_KEY=") ? "EPAY_CONFIG_ENCRYPTION_KEY=invalid" : line));
+    assert.notEqual(run().status, 0);
+    writeEnv(validSelectors.map((line) => line.startsWith("EPAY_CHAT_ENABLED=") ? "EPAY_CHAT_ENABLED=true" : line));
+    assert.notEqual(run().status, 0);
+    writeEnv(validSelectors);
+
     const shellOverride = spawnSync(
       "docker",
       [
diff --git a/frontend/tests/identity-auth-factory.test.ts b/frontend/tests/identity-auth-factory.test.ts
index 8320d600..9851f4d8 100644
--- a/frontend/tests/identity-auth-factory.test.ts
+++ b/frontend/tests/identity-auth-factory.test.ts
@@ -1,250 +1,46 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import type { Pool } from "pg";
-
-import {
-  buildAuthOptions,
-  createEmailOtpOptions,
-  type AdminUserAuthorizer,
-} from "../src/modules/identity/auth-factory.ts";
-import {
-  createDatabaseAdminAuthorizer,
-  createIdentityPool,
-} from "../src/modules/identity/auth.ts";
+import { buildAuthOptions, createEmailOtpOptions } from "../src/modules/identity/auth-factory.ts";
+import { createDatabaseAdminAuthorizer, createIdentityPool } from "../src/modules/identity/auth.ts";
 import { FakeEmailOtpSender } from "../src/modules/identity/email/fake-email-otp-sender.ts";
 import type { SelfHostedIdentityConfig } from "../src/modules/identity/config.ts";
 
-const config: SelfHostedIdentityConfig = {
-  provider: "self-hosted",
-  databaseUrl:
-    "postgresql://identity_runtime:test-password@postgres:5432/jyotisha",
-  userOrigin: "https://staging.jyotisha.chat",
-  adminOrigin: "https://admin.staging.jyotisha.chat",
-  userSecret: "user-secret-that-is-at-least-32-bytes-long",
-  adminSecret: "admin-secret-that-is-at-least-32-bytes-long",
-  resendApiKey: "re_test_key",
-  resendFrom: "Jyotisha <login@staging.jyotisha.chat>",
-};
-
+const config: SelfHostedIdentityConfig = { provider: "self-hosted", databaseUrl: "postgresql://identity_runtime:test-password@postgres:5432/jyotisha", userOrigin: "https://staging.jyotisha.chat", userSecret: "user-secret-that-is-at-least-32-bytes-long", resendApiKey: "re_test", resendFrom: "Jyotisha <login@staging.jyotisha.chat>" };
 const database = { kind: "pool" } as unknown as Pool;
 
-test("Better Auth model mappings match the identity migration", () => {
-  const options = buildAuthOptions({
-    surface: "user",
-    config,
-    database,
-    emailSender: new FakeEmailOtpSender(),
-  });
-
-  assert.equal(options.database, database);
-  assert.equal(options.user?.modelName, "users");
-  assert.deepEqual(options.user?.fields, {
-    emailVerified: "email_verified",
-    createdAt: "created_at",
-    updatedAt: "updated_at",
-  });
-  assert.equal(options.session?.modelName, "sessions");
-  assert.deepEqual(options.session?.fields, {
-    expiresAt: "expires_at",
-    createdAt: "created_at",
-    updatedAt: "updated_at",
-    ipAddress: "ip_address",
-    userAgent: "user_agent",
-    userId: "user_id",
-  });
-  assert.equal(options.account?.modelName, "accounts");
-  assert.equal(options.account?.fields?.accountId, "account_id");
-  assert.equal(options.account?.fields?.providerId, "provider_id");
-  assert.equal(options.account?.fields?.accessTokenExpiresAt, "access_token_expires_at");
-  assert.equal(options.verification?.modelName, "verifications");
-  assert.equal(options.verification?.fields?.expiresAt, "expires_at");
-  assert.equal(options.rateLimit?.modelName, "otp_rate_limits");
-  assert.equal(options.rateLimit?.storage, "database");
-  assert.equal(options.advanced?.database?.generateId, "uuid");
+test("Better Auth uses one user origin, secret, and cookie", () => {
+  const options = buildAuthOptions({ config, database, emailSender: new FakeEmailOtpSender() });
+  assert.equal(options.baseURL, config.userOrigin);
+  assert.equal(options.secret, config.userSecret);
+  assert.equal(options.advanced?.cookiePrefix, "jyotisha-user");
+  assert.deepEqual(options.trustedOrigins, [config.userOrigin]);
+  assert.ok(options.plugins?.some((plugin) => plugin.id === "email-otp"));
+  assert.ok(options.plugins?.some((plugin) => plugin.id === "admin"));
+  assert.equal(options.databaseHooks, undefined);
 });
 
-test("OTP policy hashes values, rotates resends, and builds opaque idempotency keys", async () => {
+test("OTP policy remains hashed and bounded", async () => {
   const sender = new FakeEmailOtpSender();
-  const otpOptions = createEmailOtpOptions(sender, config.userSecret, false);
-
-  assert.equal(otpOptions.otpLength, 6);
-  assert.equal(otpOptions.expiresIn, 300);
-  assert.equal(otpOptions.allowedAttempts, 3);
-  assert.equal(otpOptions.resendStrategy, "rotate");
-  assert.equal(otpOptions.storeOTP, "hashed");
-  assert.deepEqual(otpOptions.rateLimit, { window: 60, max: 3 });
-  assert.equal(otpOptions.disableSignUp, false);
-
-  await otpOptions.sendVerificationOTP({
-    email: "person@example.com",
-    otp: "123456",
-    type: "sign-in",
-  });
-  assert.equal(sender.messages.length, 1);
+  const options = createEmailOtpOptions(sender, config.userSecret, false);
+  assert.equal(options.storeOTP, "hashed");
+  assert.equal(options.allowedAttempts, 3);
+  await options.sendVerificationOTP({ email: "person@example.com", otp: "123456", type: "sign-in" });
   assert.match(sender.messages[0].idempotencyKey, /^otp-[0-9a-f]{64}$/);
-  assert.doesNotMatch(sender.messages[0].idempotencyKey, /123456|person/);
-});
-
-test("user and admin auth surfaces have host-only isolated cookies", () => {
-  const authorizer: AdminUserAuthorizer = async () => true;
-  const userOptions = buildAuthOptions({
-    surface: "user",
-    config,
-    database,
-    emailSender: new FakeEmailOtpSender(),
-  });
-  const adminOptions = buildAuthOptions({
-    surface: "admin",
-    config,
-    database,
-    emailSender: new FakeEmailOtpSender(),
-    authorizeAdminUser: authorizer,
-  });
-
-  assert.equal(userOptions.baseURL, config.userOrigin);
-  assert.equal(adminOptions.baseURL, config.adminOrigin);
-  assert.equal(userOptions.secret, config.userSecret);
-  assert.equal(adminOptions.secret, config.adminSecret);
-  assert.equal(userOptions.advanced?.cookiePrefix, "jyotisha-user");
-  assert.equal(adminOptions.advanced?.cookiePrefix, "jyotisha-admin");
-  assert.deepEqual(userOptions.emailAndPassword, {
-    enabled: true,
-    disableSignUp: true,
-    minPasswordLength: 8,
-    maxPasswordLength: 128,
-    revokeSessionsOnPasswordReset: true,
-  });
-  assert.deepEqual(
-    adminOptions.emailAndPassword,
-    userOptions.emailAndPassword,
-  );
-  for (const options of [userOptions, adminOptions]) {
-    const attributes = options.advanced?.defaultCookieAttributes;
-    assert.equal(attributes?.secure, true);
-    assert.equal(attributes?.httpOnly, true);
-    assert.equal(attributes?.sameSite, "lax");
-    assert.equal(attributes?.path, "/");
-    assert.equal(attributes && "domain" in attributes, false);
-    assert.equal(options.advanced?.crossSubDomainCookies, undefined);
-  }
-});
-
-test("admin surface is password-only and rejects non-admin session creation", async () => {
-  const checkedUserIds: string[] = [];
-  const options = buildAuthOptions({
-    surface: "admin",
-    config,
-    database,
-    emailSender: new FakeEmailOtpSender(),
-    authorizeAdminUser: async (userId) => {
-      checkedUserIds.push(userId);
-      return userId === "admin-user-id";
-    },
-  });
-  const emailPlugin = options.plugins?.find(
-    (plugin) => plugin.id === "email-otp",
-  );
-  assert.equal(emailPlugin, undefined);
-  assert.equal(options.emailAndPassword?.enabled, true);
-  assert.equal(options.emailAndPassword?.disableSignUp, true);
-
-  const before = options.databaseHooks?.session?.create?.before;
-  assert.ok(before);
-  const session = {
-    id: "session-id",
-    token: "session-token",
-    userId: "ordinary-user-id",
-    expiresAt: new Date(Date.now() + 60_000),
-    createdAt: new Date(),
-    updatedAt: new Date(),
-  };
-  await assert.rejects(
-    before(session, null),
-    /Administrator access required/,
-  );
-  assert.equal(
-    await before({ ...session, userId: "admin-user-id" }, null),
-    undefined,
-  );
-  assert.deepEqual(checkedUserIds, ["ordinary-user-id", "admin-user-id"]);
-
-});
-
-test("admin surface requires a server-side persisted-role authorizer", () => {
-  assert.throws(
-    () =>
-      buildAuthOptions({
-        surface: "admin",
-        config,
-        database,
-        emailSender: new FakeEmailOtpSender(),
-      }),
-    /admin user authorizer is required/,
-  );
 });
 
 test("identity pool forces the identity search path", async () => {
   const pool = createIdentityPool(config.databaseUrl);
-
-  try {
-    assert.equal(pool.options.connectionString, config.databaseUrl);
-    assert.equal(pool.options.options, "-c search_path=identity,pg_catalog");
-    assert.equal(pool.options.max, 10);
-  } finally {
-    await pool.end();
-  }
+  try { assert.equal(pool.options.options, "-c search_path=identity,pg_catalog"); } finally { await pool.end(); }
 });
 
-test("database admin authorizer requires a current persisted admin role", async () => {
-  const rowsByUser = new Map<string, Record<string, unknown>>([
+test("database admin authorizer accepts only persisted admin", async () => {
+  const rows = new Map<string, Record<string, unknown>>([
     ["admin", { role: "user,admin", banned: false, ban_expires: null }],
-    ["user", { role: "user", banned: false, ban_expires: null }],
-    ["banned", { role: "admin", banned: true, ban_expires: null }],
-    [
-      "expired-ban",
-      {
-        role: "admin",
-        banned: true,
-        ban_expires: new Date(Date.now() - 60_000),
-      },
-    ],
+    ["viewer", { role: "viewer", banned: false, ban_expires: null }],
   ]);
-  const queries: Array<{ sql: string; values: unknown[] }> = [];
-  const pool = {
-    async query(sql: string, values: unknown[]) {
-      queries.push({ sql, values });
-      const row = rowsByUser.get(String(values[0]));
-      return { rows: row ? [row] : [] };
-    },
-  } as unknown as Pool;
+  const pool = { async query(_sql: string, values: unknown[]) { const row = rows.get(String(values[0])); return { rows: row ? [row] : [] }; } } as unknown as Pool;
   const authorize = createDatabaseAdminAuthorizer(pool);
-
   assert.equal(await authorize("admin"), true);
-  assert.equal(await authorize("user"), false);
-  assert.equal(await authorize("banned"), false);
-  assert.equal(await authorize("expired-ban"), true);
-  assert.equal(await authorize("missing"), false);
-  assert.equal(queries.length, 5);
-  assert.match(queries[0].sql, /from identity\.users/);
-  assert.deepEqual(queries[0].values, ["admin"]);
-});
-
-test("admin surface authorizer allows persisted admin and viewer roles", async () => {
-  const { createDatabaseAdminSurfaceAuthorizer } = await import("../src/modules/identity/auth.ts");
-  const rowsByUser = new Map<string, Record<string, unknown>>([
-    ["admin", { role: "admin", banned: false, ban_expires: null }],
-    ["viewer", { role: "user,viewer", banned: false, ban_expires: null }],
-    ["user", { role: "user", banned: false, ban_expires: null }],
-  ]);
-  const pool = {
-    async query(_sql: string, values: unknown[]) {
-      const row = rowsByUser.get(String(values[0]));
-      return { rows: row ? [row] : [] };
-    },
-  } as unknown as Pool;
-  const authorize = createDatabaseAdminSurfaceAuthorizer(pool);
-
-  assert.equal(await authorize("admin"), true);
-  assert.equal(await authorize("viewer"), true);
-  assert.equal(await authorize("user"), false);
+  assert.equal(await authorize("viewer"), false);
 });
diff --git a/frontend/tests/identity-auth-integration.test.ts b/frontend/tests/identity-auth-integration.test.ts
index 407719be..1f5af954 100644
--- a/frontend/tests/identity-auth-integration.test.ts
+++ b/frontend/tests/identity-auth-integration.test.ts
@@ -24,7 +24,6 @@ const migrationsDirectory = fileURLToPath(
   new URL("../db/migrations", import.meta.url),
 );
 const userHost = "staging.jyotisha.chat";
-const adminHost = "admin.staging.jyotisha.chat";
 
 function request(
   host: string,
@@ -54,14 +53,12 @@ const envKeys = [
   "SELF_HOSTED_IDENTITY_ENABLED",
   "IDENTITY_DATABASE_URL",
   "AUTH_USER_ORIGIN",
-  "AUTH_ADMIN_ORIGIN",
   "BETTER_AUTH_USER_SECRET",
-  "BETTER_AUTH_ADMIN_SECRET",
   "RESEND_API_KEY",
   "RESEND_FROM_EMAIL",
 ] as const;
 
-test("Better Auth supports user OTP/password flows and password-only admin login", async () => {
+test("Better Auth supports shared user OTP/password sessions for admins", async () => {
   const fixture = startPostgresFixture();
   const migration = spawnSync(process.execPath, [runnerPath], {
     encoding: "utf8",
@@ -83,9 +80,7 @@ test("Better Auth supports user OTP/password flows and password-only admin login
       "identity-runtime-test-password",
     ),
     userOrigin: `https://${userHost}`,
-    adminOrigin: `https://${adminHost}`,
     userSecret: "user-secret-that-is-at-least-32-bytes-long",
-    adminSecret: "admin-secret-that-is-at-least-32-bytes-long",
     resendApiKey: "re_test",
     resendFrom: "Jyotisha <login@staging.jyotisha.chat>",
   };
@@ -97,9 +92,7 @@ test("Better Auth supports user OTP/password flows and password-only admin login
     SELF_HOSTED_IDENTITY_ENABLED: "true",
     IDENTITY_DATABASE_URL: config.databaseUrl,
     AUTH_USER_ORIGIN: config.userOrigin,
-    AUTH_ADMIN_ORIGIN: config.adminOrigin,
     BETTER_AUTH_USER_SECRET: config.userSecret,
-    BETTER_AUTH_ADMIN_SECRET: config.adminSecret,
     RESEND_API_KEY: config.resendApiKey,
     RESEND_FROM_EMAIL: config.resendFrom,
   });
@@ -117,7 +110,6 @@ test("Better Auth supports user OTP/password flows and password-only admin login
   });
   const handlers = createHostIsolatedAuthHandlers(config, {
     user: toNextJsHandler(services.user),
-    admin: toNextJsHandler(services.admin),
   });
 
   async function otpSignIn(email: string): Promise<string> {
@@ -300,22 +292,13 @@ test("Better Auth supports user OTP/password flows and password-only admin login
       /^(?:__Secure-)?jyotisha-user\.session_token=/,
     );
 
-    const nonAdminPasswordLogin = await handlers.POST(
-      request(adminHost, "/api/auth/sign-in/email", {
-        email: newEmail,
-        password: resetPassword,
-      }),
-    );
-    assert.notEqual(nonAdminPasswordLogin.status, 200);
-    assert.equal(nonAdminPasswordLogin.headers.has("set-cookie"), false);
-
     fixture.psqlAs(
       "identity_runtime",
       "identity-runtime-test-password",
       "update identity.users set role = 'user,admin' where email = 'new-user@example.com'",
     );
     const adminPasswordLogin = await handlers.POST(
-      request(adminHost, "/api/auth/sign-in/email", {
+      request(userHost, "/api/auth/sign-in/email", {
         email: newEmail,
         password: resetPassword,
       }),
@@ -323,30 +306,14 @@ test("Better Auth supports user OTP/password flows and password-only admin login
     assert.equal(adminPasswordLogin.status, 200);
     assert.match(
       sessionCookie(adminPasswordLogin),
-      /^(?:__Secure-)?jyotisha-admin\.session_token=/,
+      /^(?:__Secure-)?jyotisha-user\.session_token=/,
     );
-
-    const sentMessageCount = sender.messages.length;
-    const adminSend = await handlers.POST(
-      request(adminHost, "/api/auth/email-otp/send-verification-otp", {
-        email: newEmail,
-        type: "sign-in",
-      }),
-    );
-    assert.notEqual(adminSend.status, 200);
-    assert.equal(sender.messages.length, sentMessageCount);
-
-    const adminPasswordRoute = await setAccountPassword(
-      request(
-        adminHost,
-        "/api/account/password",
-        { newPassword: "admin-must-not-set-password" },
-        sessionCookie(adminPasswordLogin),
-      ),
-    );
-    assert.equal(adminPasswordRoute.status, 401);
   } finally {
-    const globalServices = (globalThis as typeof identityGlobal).jyotishaIdentityAuth;
+    const globalServices = (
+      globalThis as typeof globalThis & {
+        jyotishaIdentityAuth?: ReturnType<typeof createIdentityAuthServices>;
+      }
+    ).jyotishaIdentityAuth;
     if (globalServices) {
       await globalServices.pool.end();
       delete identityGlobal.jyotishaIdentityAuth;
diff --git a/frontend/tests/identity-config.test.ts b/frontend/tests/identity-config.test.ts
index 60f049c3..55267d31 100644
--- a/frontend/tests/identity-config.test.ts
+++ b/frontend/tests/identity-config.test.ts
@@ -1,154 +1,54 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import {
-  isSelfHostedIdentityEnabled,
-  readIdentityConfig,
-  readSelfHostedIdentityConfig,
-} from "../src/modules/identity/config.ts";
+import { isSelfHostedIdentityEnabled, readIdentityConfig, readSelfHostedIdentityConfig } from "../src/modules/identity/config.ts";
 
 const selfHostedEnvironment = {
   AUTH_PROVIDER: "self-hosted",
   SELF_HOSTED_IDENTITY_ENABLED: "true",
-  IDENTITY_DATABASE_URL:
-    "postgresql://identity_runtime:test-password@postgres:5432/jyotisha?options=-csearch_path%3Didentity",
+  IDENTITY_DATABASE_URL: "postgresql://identity_runtime:test-password@postgres:5432/jyotisha",
   AUTH_USER_ORIGIN: "https://staging.jyotisha.chat",
-  AUTH_ADMIN_ORIGIN: "https://admin.staging.jyotisha.chat",
   BETTER_AUTH_USER_SECRET: "user-secret-that-is-at-least-32-bytes-long",
-  BETTER_AUTH_ADMIN_SECRET: "admin-secret-that-is-at-least-32-bytes-long",
   RESEND_API_KEY: "re_test_key_that_must_not_be_printed",
   RESEND_FROM_EMAIL: "Jyotisha Staging <login@staging.jyotisha.chat>",
 };
 
-test("identity provider defaults to supabase without self-hosted settings", () => {
+test("identity provider defaults to supabase", () => {
   assert.deepEqual(readIdentityConfig({}), { provider: "supabase" });
   assert.equal(isSelfHostedIdentityEnabled({}), false);
 });
 
-test("self-hosted identity can be enabled alongside the Supabase default", () => {
-  const environment = {
-    ...selfHostedEnvironment,
-    AUTH_PROVIDER: "supabase",
-  };
-
-  assert.deepEqual(readIdentityConfig(environment), { provider: "supabase" });
-  assert.equal(isSelfHostedIdentityEnabled(environment), true);
-  assert.equal(
-    readSelfHostedIdentityConfig(environment).databaseUrl,
-    selfHostedEnvironment.IDENTITY_DATABASE_URL,
-  );
-});
-
-test("identity config accepts a complete self-hosted environment", () => {
+test("identity config accepts one self-hosted user origin and secret", () => {
   const config = readIdentityConfig(selfHostedEnvironment);
-
   assert.equal(config.provider, "self-hosted");
-  if (config.provider !== "self-hosted") {
-    assert.fail("expected self-hosted identity configuration");
-  }
+  if (config.provider !== "self-hosted") assert.fail();
   assert.equal(config.userOrigin, "https://staging.jyotisha.chat");
-  assert.equal(config.adminOrigin, "https://admin.staging.jyotisha.chat");
-  assert.equal(config.resendFrom, selfHostedEnvironment.RESEND_FROM_EMAIL);
+  assert.equal(config.userSecret, selfHostedEnvironment.BETTER_AUTH_USER_SECRET);
+  assert.equal("adminOrigin" in config, false);
+  assert.equal("adminSecret" in config, false);
 });
 
-test("identity config rejects unknown providers", () => {
-  assert.throws(
-    () => readIdentityConfig({ AUTH_PROVIDER: "firebase" }),
-    /AUTH_PROVIDER must be supabase or self-hosted/,
-  );
-});
-
-test("self-hosted provider requires its independent service flag", () => {
-  assert.throws(
-    () =>
-      readIdentityConfig({
-        ...selfHostedEnvironment,
-        SELF_HOSTED_IDENTITY_ENABLED: "false",
-      }),
-    /SELF_HOSTED_IDENTITY_ENABLED must be true/,
-  );
-  assert.throws(
-    () => isSelfHostedIdentityEnabled({ SELF_HOSTED_IDENTITY_ENABLED: "yes" }),
-    /must be true or false/,
-  );
-});
-
-test("self-hosted identity reports missing keys without leaking configured secrets", () => {
-  const secret = "this-secret-must-never-appear-in-an-error";
-
-  assert.throws(
-    () =>
-      readIdentityConfig({
-        ...selfHostedEnvironment,
-        BETTER_AUTH_USER_SECRET: secret,
-        RESEND_API_KEY: "",
-      }),
-    (error: unknown) => {
-      assert.ok(error instanceof Error);
-      assert.match(error.message, /RESEND_API_KEY is required/);
-      assert.doesNotMatch(error.message, new RegExp(secret));
-      return true;
-    },
-  );
-});
-
-test("self-hosted identity validates database URL, origins, secrets, and sender", () => {
-  const invalidCases: Array<[string, Record<string, string>, RegExp]> = [
-    [
-      "database URL",
-      { IDENTITY_DATABASE_URL: "https://database.invalid" },
-      /IDENTITY_DATABASE_URL must be a PostgreSQL URL/,
-    ],
-    [
-      "production HTTP origin",
-      { AUTH_USER_ORIGIN: "http://staging.jyotisha.chat" },
-      /AUTH_USER_ORIGIN must use HTTPS/,
-    ],
-    [
-      "origin path",
-      { AUTH_ADMIN_ORIGIN: "https://admin.staging.jyotisha.chat/login" },
-      /AUTH_ADMIN_ORIGIN must be an origin without a path/,
-    ],
-    [
-      "short secret",
-      { BETTER_AUTH_ADMIN_SECRET: "too-short" },
-      /BETTER_AUTH_ADMIN_SECRET must be at least 32 characters/,
-    ],
-    [
-      "shared secret",
-      {
-        BETTER_AUTH_ADMIN_SECRET:
-          selfHostedEnvironment.BETTER_AUTH_USER_SECRET,
-      },
-      /user and admin secrets must be different/,
-    ],
-    [
-      "shared origin",
-      { AUTH_ADMIN_ORIGIN: selfHostedEnvironment.AUTH_USER_ORIGIN },
-      /user and admin origins must be different/,
-    ],
-    [
-      "invalid sender",
-      { RESEND_FROM_EMAIL: "Jyotisha Staging" },
-      /RESEND_FROM_EMAIL must contain a valid email address/,
-    ],
-  ];
-
-  for (const [name, override, expected] of invalidCases) {
-    assert.throws(
-      () => readIdentityConfig({ ...selfHostedEnvironment, ...override }),
-      expected,
-      name,
-    );
-  }
-});
-
-test("localhost origins may use HTTP for local development", () => {
-  const config = readIdentityConfig({
+test("self-hosted identity ignores retired admin-surface variables", () => {
+  const config = readSelfHostedIdentityConfig({
     ...selfHostedEnvironment,
-    AUTH_USER_ORIGIN: "http://localhost:3000",
-    AUTH_ADMIN_ORIGIN: "http://admin.localhost:3000",
+    AUTH_ADMIN_ORIGIN: "invalid-retired-value",
+    BETTER_AUTH_ADMIN_SECRET: "short",
   });
+  assert.equal(config.userOrigin, selfHostedEnvironment.AUTH_USER_ORIGIN);
+});
 
+test("self-hosted provider requires its enable flag", () => {
+  assert.throws(() => readIdentityConfig({ ...selfHostedEnvironment, SELF_HOSTED_IDENTITY_ENABLED: "false" }), /must be true/);
+});
+
+test("self-hosted identity validates active database, origin, secret, and sender", () => {
+  assert.throws(() => readIdentityConfig({ ...selfHostedEnvironment, IDENTITY_DATABASE_URL: "https://invalid" }), /PostgreSQL URL/);
+  assert.throws(() => readIdentityConfig({ ...selfHostedEnvironment, AUTH_USER_ORIGIN: "http://staging.jyotisha.chat" }), /must use HTTPS/);
+  assert.throws(() => readIdentityConfig({ ...selfHostedEnvironment, BETTER_AUTH_USER_SECRET: "short" }), /at least 32/);
+  assert.throws(() => readIdentityConfig({ ...selfHostedEnvironment, RESEND_FROM_EMAIL: "invalid" }), /valid email/);
+});
+
+test("localhost may use HTTP", () => {
+  const config = readIdentityConfig({ ...selfHostedEnvironment, AUTH_USER_ORIGIN: "http://localhost:3000" });
   assert.equal(config.provider, "self-hosted");
 });
diff --git a/frontend/tests/identity-host-routing.test.ts b/frontend/tests/identity-host-routing.test.ts
index 3cca107f..3b5ae6ca 100644
--- a/frontend/tests/identity-host-routing.test.ts
+++ b/frontend/tests/identity-host-routing.test.ts
@@ -1,130 +1,47 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-
 import type { SelfHostedIdentityConfig } from "../src/modules/identity/config.ts";
-import {
-  createHostIsolatedAuthHandlers,
-  resolveIdentitySurface,
-} from "../src/modules/identity/host.ts";
+import { createHostIsolatedAuthHandlers, resolveIdentitySurface } from "../src/modules/identity/host.ts";
 
 const config: SelfHostedIdentityConfig = {
   provider: "self-hosted",
   databaseUrl: "postgresql://identity_runtime:test@postgres:5432/jyotisha",
   userOrigin: "https://staging.jyotisha.chat",
-  adminOrigin: "https://admin.staging.jyotisha.chat",
   userSecret: "user-secret-that-is-at-least-32-bytes-long",
-  adminSecret: "admin-secret-that-is-at-least-32-bytes-long",
   resendApiKey: "re_test",
   resendFrom: "Jyotisha <login@staging.jyotisha.chat>",
 };
 
-test("identity surface matching is exact, case-insensitive, and port-normalized", () => {
+test("identity host accepts only the configured user origin", () => {
   assert.equal(resolveIdentitySurface("staging.jyotisha.chat", config), "user");
   assert.equal(resolveIdentitySurface("STAGING.JYOTISHA.CHAT:443", config), "user");
-  assert.equal(
-    resolveIdentitySurface("admin.staging.jyotisha.chat", config),
-    "admin",
-  );
-
-  for (const host of [
-    null,
-    "",
-    "evil-staging.jyotisha.chat",
-    "staging.jyotisha.chat.evil.example",
-    "staging.jyotisha.chat,evil.example",
-    "staging.jyotisha.chat/path",
-    "user@staging.jyotisha.chat",
-    " staging.jyotisha.chat",
-  ]) {
-    assert.equal(resolveIdentitySurface(host, config), null, String(host));
+  for (const host of [null, "", "admin.staging.jyotisha.chat", "staging.jyotisha.chat.evil.example", "staging.jyotisha.chat,evil.example"]) {
+    assert.equal(resolveIdentitySurface(host, config), null);
   }
 });
 
-test("auth route dispatches only to the exact matching host", async () => {
-  const calls: string[] = [];
-  const handlers = createHostIsolatedAuthHandlers(config, {
-    user: {
-      GET: async () => {
-        calls.push("user:get");
-        return new Response("user");
-      },
-      POST: async () => {
-        calls.push("user:post");
-        return new Response("user");
-      },
-    },
-    admin: {
-      GET: async () => {
-        calls.push("admin:get");
-        return new Response("admin");
-      },
-      POST: async () => {
-        calls.push("admin:post");
-        return new Response("admin");
-      },
-    },
-  });
-
-  const userResponse = await handlers.POST(
-    new Request("https://internal/api/auth/email-otp/send-verification-otp", {
-      method: "POST",
-      headers: { host: "staging.jyotisha.chat" },
-    }),
-  );
-  assert.equal(await userResponse.text(), "user");
-
-  const adminResponse = await handlers.GET(
-    new Request("https://internal/api/auth/get-session", {
-      headers: { host: "admin.staging.jyotisha.chat" },
-    }),
-  );
-  assert.equal(await adminResponse.text(), "admin");
-  assert.deepEqual(calls, ["user:post", "admin:get"]);
+test("auth route dispatches only to the user service", async () => {
+  let calls = 0;
+  const handlers = createHostIsolatedAuthHandlers(config, { user: { GET: async () => { calls += 1; return new Response("user"); }, POST: async () => { calls += 1; return new Response("user"); } } });
+  const response = await handlers.GET(new Request("https://internal/api/auth/get-session", { headers: { host: "staging.jyotisha.chat" } }));
+  assert.equal(await response.text(), "user");
+  assert.equal(calls, 1);
 });
 
-test("unknown hosts fail closed before an auth handler reads cookies", async () => {
+test("unknown hosts remain fail-closed with 421", async () => {
   let calls = 0;
-  const handler = async () => {
-    calls += 1;
-    return new Response("unexpected");
-  };
-  const handlers = createHostIsolatedAuthHandlers(config, {
-    user: { GET: handler, POST: handler },
-    admin: { GET: handler, POST: handler },
-  });
-
-  const response = await handlers.GET(
-    new Request("https://internal/api/auth/get-session", {
-      headers: {
-        host: "staging.jyotisha.chat.evil.example",
-        cookie: "jyotisha-admin.session_token=attacker-controlled",
-      },
-    }),
-  );
-
+  const handler = async () => { calls += 1; return new Response("unexpected"); };
+  const handlers = createHostIsolatedAuthHandlers(config, { user: { GET: handler, POST: handler } });
+  const response = await handlers.GET(new Request("https://internal/api/auth/get-session", { headers: { host: "unknown.example" } }));
   assert.equal(response.status, 421);
   assert.equal(calls, 0);
-  assert.equal(response.headers.has("set-cookie"), false);
 });
 
-test("user host cannot reach Better Auth admin endpoints", async () => {
+test("main auth surface keeps Better Auth admin endpoints closed", async () => {
   let calls = 0;
-  const handler = async () => {
-    calls += 1;
-    return new Response("unexpected");
-  };
-  const handlers = createHostIsolatedAuthHandlers(config, {
-    user: { GET: handler, POST: handler },
-    admin: { GET: handler, POST: handler },
-  });
-
-  const response = await handlers.POST(
-    new Request("https://internal/api/auth/admin/set-role", {
-      method: "POST",
-      headers: { host: "staging.jyotisha.chat" },
-    }),
-  );
-
+  const handler = async () => { calls += 1; return new Response("unexpected"); };
+  const handlers = createHostIsolatedAuthHandlers(config, { user: { GET: handler, POST: handler } });
+  const response = await handlers.POST(new Request("https://internal/api/auth/admin/set-role", { method: "POST", headers: { host: "staging.jyotisha.chat" } }));
   assert.equal(response.status, 404);
   assert.equal(calls, 0);
 });
diff --git a/frontend/tests/identity-login-provider.test.ts b/frontend/tests/identity-login-provider.test.ts
index 93ba111d..abbd21e1 100644
--- a/frontend/tests/identity-login-provider.test.ts
+++ b/frontend/tests/identity-login-provider.test.ts
@@ -4,7 +4,7 @@ import test from "node:test";
 
 import { createSelfHostedAuthActions } from "../src/modules/identity/client.ts";
 
-test("login page uses password-only mode on the self-hosted admin surface", () => {
+test("login page uses one self-hosted user surface", () => {
   const page = readFileSync(
     new URL("../src/app/login/page.tsx", import.meta.url),
     "utf8",
@@ -13,17 +13,8 @@ test("login page uses password-only mode on the self-hosted admin surface", () =
   assert.doesNotMatch(page, /["']use client["']/);
   assert.match(page, /export const dynamic = "force-dynamic"/);
   assert.match(page, /readIdentityConfig\(process\.env\)/);
-  assert.match(page, /isSelfHostedIdentityEnabled\(process\.env\)/);
-  assert.match(page, /resolveIdentitySurface/);
-  assert.match(page, /surface === "admin"/);
-  assert.match(
-    page,
-    /passwordEnabled = provider === "self-hosted"/,
-  );
-  assert.match(page, /passwordOnly = surface === "admin"/);
-  assert.match(page, /passwordEnabled=\{passwordEnabled\}/);
-  assert.match(page, /passwordOnly=\{passwordOnly\}/);
-  assert.doesNotMatch(page, /NEXT_PUBLIC_AUTH_PROVIDER/);
+  assert.match(page, /passwordEnabled=\{config\.provider === "self-hosted"\}/);
+  assert.doesNotMatch(page, /resolveIdentitySurface|passwordOnly|surface === "admin"|NEXT_PUBLIC_AUTH_PROVIDER/);
 });
 
 test("self-hosted auth actions call Better Auth without browser token storage", async () => {
diff --git a/frontend/tests/migration-retired-ledger.test.ts b/frontend/tests/migration-retired-ledger.test.ts
index d8b38706..3b6477cd 100644
--- a/frontend/tests/migration-retired-ledger.test.ts
+++ b/frontend/tests/migration-retired-ledger.test.ts
@@ -4,6 +4,14 @@ import test from "node:test";
 import { assertLedgerFilesPresent } from "../scripts/db-migrate.mjs";
 
 const retiredMigrations = new Map([
+  [
+    "20260727010000_rectification_v4_conversational_turns.sql",
+    "1f4fcd5d14b1dc7a280d31e7023777308be5fcc0c49fa46c0fac10f682044115",
+  ],
+  [
+    "20260727010000_refine_admin_redemption_audit.sql",
+    "df37255ecfd5bffc34600190de84ff53245ab7e5a91226eb745a010467f08104",
+  ],
   [
     "20260727010000_admin_users.sql",
     "785f4fdc65db1028623cc7b5a2571217b913ef9e55f5a17b01658a71612976de",
diff --git a/frontend/tests/rectification-v4-migration.test.ts b/frontend/tests/rectification-v4-migration.test.ts
index c03dc8f4..ba441295 100644
--- a/frontend/tests/rectification-v4-migration.test.ts
+++ b/frontend/tests/rectification-v4-migration.test.ts
@@ -3,7 +3,7 @@ import test from "node:test";
 import { readFileSync } from "node:fs";
 
 const sql = readFileSync(new URL("../supabase/migrations/20260726020000_birth_time_rectification_v4.sql", import.meta.url), "utf8");
-const conversationalSql = readFileSync(new URL("../supabase/migrations/20260727010000_rectification_v4_conversational_turns.sql", import.meta.url), "utf8");
+const conversationalSql = readFileSync(new URL("../supabase/migrations/20260805030000_reconcile_rectification_v4_conversational_turns.sql", import.meta.url), "utf8");
 const regenerationSql = readFileSync(new URL("../supabase/migrations/20260729020000_rectification_v4_current_question_regeneration.sql", import.meta.url), "utf8");
 const pendingResolutionSql = readFileSync(new URL("../supabase/migrations/20260730020000_pending_evidence_resolution.sql", import.meta.url), "utf8");
 
@@ -23,7 +23,7 @@ test("v4 migration creates canonical append-only storage and leased jobs", () =>
 });
 
 test("v4 conversational migration persists the selected model with each turn", () => {
-  assert.match(conversationalSql, /add column model_id text/i);
+  assert.match(conversationalSql, /add column if not exists model_id text/i);
   assert.match(conversationalSql, /p_model_id text/i);
   assert.match(conversationalSql, /question, answer, model_id, action_id/i);
   assert.match(conversationalSql, /grant execute on function public\.submit_birth_time_rectification_v4_answer/i);
diff --git a/frontend/tests/sidebar-contract.test.ts b/frontend/tests/sidebar-contract.test.ts
index a5141f06..611cb89c 100644
--- a/frontend/tests/sidebar-contract.test.ts
+++ b/frontend/tests/sidebar-contract.test.ts
@@ -158,6 +158,19 @@ test("keeps app sidebar props as product data and callbacks", () => {
   assert.doesNotMatch(appSidebar, /supabase|fetch\(|\/api\//i);
 });
 
+test("renders the server-provided admin entry beside the credit control", () => {
+  const appSidebar = readProjectFile("src/components/app-sidebar.tsx");
+  const page = readProjectFile("src/app/page.tsx");
+
+  assert.doesNotMatch(appSidebar, /adminUrl|account\.isAdmin|后台管理|KeyRound/);
+  assert.match(page, /className="chat-header-actions"/);
+  assert.match(page, /account\.isAdmin && account\.adminUrl/);
+  assert.match(page, /className="admin-button" href=\{account\.adminUrl\}/);
+  assert.match(page, /aria-label="后台管理" title="后台管理"/);
+  assert.match(page, /<ShieldCheck aria-hidden="true" \/>/);
+  assert.match(page, /className="admin-button"[\s\S]*className="credit-button"/);
+});
+
 test("composes the chat page with the app sidebar shell", () => {
   const page = readProjectFile("src/app/page.tsx");
 
diff --git a/frontend/tests/staging-backend-workflows.test.ts b/frontend/tests/staging-backend-workflows.test.ts
index 2e17807c..7433ed09 100644
--- a/frontend/tests/staging-backend-workflows.test.ts
+++ b/frontend/tests/staging-backend-workflows.test.ts
@@ -18,6 +18,22 @@ const migrationWorkflow = new URL(
   "../../.github/workflows/migrate-staging-database.yml",
   import.meta.url,
 );
+const giteaQualityWorkflow = new URL(
+  "../../.gitea/workflows/backend-quality-gate.yml",
+  import.meta.url,
+);
+const giteaDeployWorkflow = new URL(
+  "../../.gitea/workflows/deploy-staging.yml",
+  import.meta.url,
+);
+const giteaMigrationWorkflow = new URL(
+  "../../.gitea/workflows/migrate-staging-database.yml",
+  import.meta.url,
+);
+const giteaProductionWorkflow = new URL(
+  "../../.gitea/workflows/deploy-production.yml",
+  import.meta.url,
+);
 const rolloutWorkflow = new URL(
   "../../.github/workflows/configure-staging-rectification-rollout.yml",
   import.meta.url,
@@ -57,7 +73,15 @@ function assertOrder(text: string, labels: string[]): void {
 }
 
 test("changed staging workflows are syntactically valid YAML", () => {
-  for (const workflow of [qualityWorkflow, deployWorkflow, migrationWorkflow, rolloutWorkflow]) {
+  for (const workflow of [
+    qualityWorkflow,
+    deployWorkflow,
+    migrationWorkflow,
+    rolloutWorkflow,
+    giteaQualityWorkflow,
+    giteaDeployWorkflow,
+    giteaMigrationWorkflow,
+  ]) {
     const result = spawnSync(
       "ruby",
       ["-e", "require 'yaml'; YAML.parse_file(ARGV.fetch(0))", fileURLToPath(workflow)],
@@ -90,6 +114,37 @@ test("quality gate validates relevant changes once and publishes a digest manife
   assert.doesNotMatch(workflow, /(?:^|:)latest$/m);
 });
 
+test("Gitea quality gate validates before publishing an immutable ACR manifest", () => {
+  const workflow = read(giteaQualityWorkflow);
+
+  assert.match(workflow, /pull_request:\n\s+paths:/);
+  assert.match(workflow, /push:\n\s+branches: \[staging\]/);
+  assert.match(workflow, /workflow_dispatch:/);
+  assert.match(workflow, /runs-on: xiaoxin/);
+  assert.match(workflow, /GITEA_SHA: \$\{\{ gitea\.sha \}\}/);
+  assert.equal((workflow.match(/git clean -ffdx/g) ?? []).length, 2);
+  assert.equal((workflow.match(/git status --porcelain --untracked-files=all/g) ?? []).length, 2);
+  assert.match(workflow, /python3 -m venv \.venv/);
+  assert.match(workflow, /python -m playwright install --with-deps chromium/);
+  assert.equal((workflow.match(/npm test --prefix frontend/g) ?? []).length, 1);
+  assert.equal((workflow.match(/npm run lint --prefix frontend/g) ?? []).length, 1);
+  assert.equal((workflow.match(/npm run build --prefix frontend/g) ?? []).length, 1);
+  assert.match(workflow, /needs: validate/);
+  assert.match(workflow, /IMAGE_REPOSITORY: crpi-[^\n]+\/copse\/jyotisha/);
+  assert.match(workflow, /\$IMAGE_REPOSITORY:api-\$GITEA_SHA/);
+  assert.match(workflow, /\$IMAGE_REPOSITORY:web-\$GITEA_SHA/);
+  assert.match(workflow, /docker manifest inspect/);
+  assert.match(workflow, /xs=d if isinstance\(d,list\) else \[d\]/);
+  assert.match(workflow, /get\("os"\)=="linux"/);
+  assert.match(workflow, /get\("architecture"\)=="amd64"/);
+  assert.match(workflow, /node frontend\/scripts\/staging-image-manifest\.mjs/);
+  assert.match(workflow, /uses: https:\/\/gitea\.com\/actions\/upload-artifact@v4/);
+  assert.match(workflow, /name: staging-image-manifest-\$\{\{ gitea\.sha \}\}-\$\{\{ gitea\.run_attempt \}\}/);
+  assert.match(workflow, /\[\[ "\$GITEA_RUN_ATTEMPT" =~ \^\[0-9\]\+\$ \]\]/);
+  assert.doesNotMatch(workflow, /STAGING_SSH_PRIVATE_KEY|run-staging-deploy\.sh|curl[^\n]+STAGING_URL/);
+  assert.doesNotMatch(workflow, /(?:^|:)latest$/m);
+});
+
 test("quality gate builds the Python package with its declared backend dependencies", () => {
   const workflow = read(qualityWorkflow);
 
@@ -231,8 +286,11 @@ test("all staging mutations share Actions serialization and one host lock", () =
     assert.match(runner, /state_directory="\$DEPLOY_PATH\/\.state"/);
     assert.match(runner, /state_directory\/mutation\.lock/);
     assert.match(runner, /flock -n 9/);
-    assert.ok(runner.indexOf("flock -n 9") < runner.indexOf("docker"));
   }
+  for (const runner of [deployRunner, migrationRunner]) {
+    assert.ok(runner.indexOf("flock -n 9") < runner.indexOf('"${docker_command[@]}"'));
+  }
+  assert.ok(rolloutRunner.indexOf("flock -n 9") < rolloutRunner.indexOf("docker"));
   for (const runner of [deployRunner, migrationRunner]) {
     assert.ok(runner.indexOf("flock -n 9") < runner.indexOf("sync-staging-tree.sh"));
   }
@@ -255,18 +313,119 @@ test("deploy and migration consume the exact successful gate artifact", () => {
   }
 });
 
-test("main owns the deployment control plane and target revisions are data only", () => {
+test("main remains the trusted GitHub deployment controller", () => {
   for (const workflow of [read(deployWorkflow), read(migrationWorkflow)]) {
     assert.match(workflow, /name: Checkout trusted main controller[\s\S]*ref: main/);
     assert.match(workflow, /fetch-depth: 0/);
     assert.match(workflow, /git merge-base --is-ancestor "\$DEPLOY_SHA" HEAD/);
+    assert.match(workflow, /reviewed main history/);
     assert.match(workflow, /--include='\/deploy\/' --include='\/deploy\/\*\*\*' --exclude='\*'/);
     assert.doesNotMatch(workflow, /ref: \$\{\{ steps\.revision\.outputs\.sha \}\}/);
   }
 });
 
+test("Gitea deploy and migration consume the exact successful gate artifact", () => {
+  for (const workflow of [read(giteaDeployWorkflow), read(giteaMigrationWorkflow)]) {
+    assert.match(workflow, /actions\/runs\?head_sha=\$[A-Z_]+&branch=staging&event=push&status=success/);
+    assert.match(workflow, /\.path \| split\("@"\)\[0\] \| endswith\("backend-quality-gate\.yml"\)/);
+    assert.match(workflow, /\.head_branch == "staging"/);
+    assert.match(workflow, /\.event == "push"/);
+    assert.match(workflow, /\.conclusion == "success"/);
+    assert.match(workflow, /\.run_attempt \/\/ 0/);
+    assert.match(workflow, /\[\[ "\$gate_run_attempt" =~ \^\[0-9\]\+\$ \]\]/);
+    assert.match(workflow, /sort_by\(\.id\) \| reverse \| first/);
+    assert.match(workflow, /actions\/runs\/\$GATE_RUN_ID\/artifacts\?name=\$artifact_name/);
+    assert.match(workflow, /actions\/artifacts\/\$artifact_id\/zip/);
+    assert.match(workflow, /node frontend\/scripts\/staging-image-manifest\.mjs/);
+    assert.match(workflow, /name: Checkout trusted main controller/);
+    assert.match(workflow, /git fetch --no-tags origin main "\$DEPLOY_SHA"/);
+    assert.match(workflow, /git checkout --detach --force origin\/main/);
+    assert.match(workflow, /git merge-base --is-ancestor "\$DEPLOY_SHA" HEAD/);
+    assert.doesNotMatch(workflow, /docker manifest inspect/);
+    assert.doesNotMatch(workflow, /\$IMAGE_REPOSITORY:(?:api|web)-\$DEPLOY_SHA/);
+  }
+});
+
+test("Gitea deployment follows only a successful staging push gate and keeps rollback manual", () => {
+  const workflow = read(giteaDeployWorkflow);
+
+  assert.match(workflow, /workflow_run:\n\s+workflows: \["Staging Backend Quality Gate"\]/);
+  assert.match(workflow, /workflow_dispatch:/);
+  assert.match(workflow, /workflow_run\.conclusion == 'success'/);
+  assert.match(workflow, /workflow_run\.event == 'push'/);
+  assert.match(workflow, /workflow_run\.head_branch == 'staging'/);
+  assert.match(workflow, /concurrency:\n\s+group: staging-mutation\n\s+cancel-in-progress: false\n\s+queue: max/);
+  assert.match(workflow, /rollback authorization is manual-only/);
+  assert.match(workflow, /stale staging revision refused/);
+  assert.match(workflow, /staging advanced during deployment; refusing stale mutation/);
+  assert.match(workflow, /git merge-base --is-ancestor "\$previous_sha" "\$DEPLOY_SHA"/);
+  assert.match(workflow, /API_IMAGE: \$\{\{ steps\.images\.outputs\.api_image \}\}/);
+  assert.match(workflow, /WEB_IMAGE: \$\{\{ steps\.images\.outputs\.web_image \}\}/);
+});
+
+test("Gitea migration remains manual and consumes only the gate-pinned web image", () => {
+  const workflow = read(giteaMigrationWorkflow);
+
+  assert.match(workflow, /^on:\n\s+workflow_dispatch:/m);
+  assert.doesNotMatch(workflow, /workflow_run:|\n\s+push:/);
+  assert.match(workflow, /concurrency:\n\s+group: staging-mutation\n\s+cancel-in-progress: false\n\s+queue: max/);
+  assert.match(workflow, /migration requires current staging head/);
+  assert.match(workflow, /staging advanced during migration; refusing stale mutation/);
+  assert.match(workflow, /WEB_IMAGE: \$\{\{ steps\.image\.outputs\.web_image \}\}/);
+  assert.doesNotMatch(workflow, /API_IMAGE:/);
+  assert.match(workflow, /run-staging-migration\.sh/);
+  assert.doesNotMatch(workflow, /run-staging-deploy\.sh/);
+});
+
+test("Gitea staging mutations use deploy-owned temporary paths", () => {
+  for (const workflow of [read(giteaDeployWorkflow), read(giteaMigrationWorkflow)]) {
+    assert.match(workflow, /mktemp -d \/tmp\/jyotisha-staging\.XXXXXXXXXX/);
+    assert.match(workflow, /\[\[ "\$incoming" == \/tmp\/jyotisha-staging\.\* \]\]/);
+    assert.doesNotMatch(workflow, /GITEA_RUN_NUMBER/);
+  }
+  for (const script of [read(deployScript), read(migrationScript)]) {
+    assert.match(script, /\/tmp\/jyotisha-staging\.\*\) ;;/);
+  }
+});
+
+test("Gitea remote staging mutations run as root with controlled Docker configuration", () => {
+  for (const workflow of [read(giteaDeployWorkflow), read(giteaMigrationWorkflow)]) {
+    assert.match(workflow, /sudo -n docker ps -aq/);
+    assert.match(workflow, /sudo -n docker inspect/);
+    assert.match(workflow, /sudo -n docker --config '\$incoming\/\.docker' login/);
+    assert.match(workflow, /sudo -n docker --config '\$incoming\/\.docker' logout/);
+    assert.match(workflow, /sudo -n rm -rf -- '\$incoming'/);
+    assert.match(
+      workflow,
+      /sudo -n env INCOMING_PATH='\$incoming'[\s\S]*DOCKER_CONFIG='\$incoming\/\.docker' DOCKER_BIN='docker'[\s\S]*bash '\$incoming\/deploy\/run-staging-(?:deploy|migration)\.sh'/,
+    );
+    assert.doesNotMatch(workflow, /DOCKER_BIN='sudo -n docker'/);
+    assert.doesNotMatch(
+      workflow,
+      /"INCOMING_PATH='\$incoming'[^"]*bash '\$incoming\/deploy\/run-staging-(?:deploy|migration)\.sh'"/,
+    );
+    assert.doesNotMatch(workflow, /DOCKER_CONFIG='\$incoming\/\.docker' docker (?:login|logout)/);
+  }
+});
+
+test("staging runners accept only controlled Docker command forms without eval", () => {
+  for (const script of [read(deployScript), read(migrationScript)]) {
+    assert.match(script, /case "\$\{DOCKER_BIN:-docker\}" in/);
+    assert.match(script, /docker\) docker_command=\(docker\)/);
+    assert.match(script, /"sudo -n docker"\) docker_command=\(sudo -n docker --config "\$DOCKER_CONFIG"\)/);
+    assert.match(script, /\*\) echo "unsafe staging Docker command"/);
+    assert.match(script, /"\$\{docker_command\[@\]\}"/);
+    assert.doesNotMatch(script, /\beval\b/);
+  }
+});
+
 test("staging mutations retain every pending deployment and migration", () => {
-  for (const workflow of [read(deployWorkflow), read(migrationWorkflow)]) {
+  for (const workflow of [
+    read(deployWorkflow),
+    read(migrationWorkflow),
+    read(giteaDeployWorkflow),
+    read(giteaMigrationWorkflow),
+  ]) {
     assert.match(
       workflow,
       /concurrency:\n  group: staging-mutation\n  cancel-in-progress: false\n  queue: max/,
@@ -291,8 +450,8 @@ test("automatic staging paths reject stale and divergent revisions", () => {
 test("remote deployment verifies running image IDs, RepoDigests, and application SHA", () => {
   const runner = read(deployScript);
 
-  assert.match(runner, /docker inspect --format '\{\{\.Image\}\}'/);
-  assert.match(runner, /docker image inspect --format '\{\{\.Id\}\}' "\$expected_ref"/);
+  assert.match(runner, /"\$\{docker_command\[@\]\}" inspect --format '\{\{\.Image\}\}'/);
+  assert.match(runner, /"\$\{docker_command\[@\]\}" image inspect --format '\{\{\.Id\}\}' "\$expected_ref"/);
   assert.match(runner, /RepoDigests/);
   assert.match(runner, /grep -Fqx "\$expected_ref"/);
   assert.match(runner, /publicBody\.deployment\?\.gitCommit !== process\.env\.EXPECTED_SHA/);
@@ -308,7 +467,7 @@ test("remote deployment verifies running image IDs, RepoDigests, and application
 test("first immutable deployment rolls back to validated local image IDs", () => {
   const root = mkdtempSync(join(tmpdir(), "jyotisha-local-image-rollback-"));
   const deploymentPath = join(root, "live");
-  const incomingPath = join(deploymentPath, ".incoming", "run-1");
+  const incomingPath = mkdtempSync("/tmp/jyotisha-staging.");
   const incomingDeploy = join(incomingPath, "deploy");
   const liveDeploy = join(deploymentPath, "deploy");
   const mockBin = join(root, "bin");
@@ -392,6 +551,7 @@ test("first immutable deployment rolls back to validated local image IDs", () =>
     assert.match(attempts[1], /api web rectification-v4-worker caddy$/);
   } finally {
     rmSync(root, { recursive: true, force: true });
+    rmSync(incomingPath, { recursive: true, force: true });
   }
 });
 
@@ -410,8 +570,9 @@ test("normal deployment checks migrations but never applies them", () => {
   assert.doesNotMatch(runner, /npm\s+run\s+db:migrate(?!:check)/);
   assert.doesNotMatch(runner, /pull api web postgres/);
   assert.match(runner, /verify_container_image rectification-v4-worker \"\$WEB_IMAGE\"/);
-  assert.match(runner, /adminRoot\.status !== 302/);
-  assert.match(runner, /adminRoot\.headers\.get\("location"\) !== "\/admin\/codes"/);
+  assert.match(runner, /adminPage\.status !== 307/);
+  assert.match(runner, /adminPage\.headers\.get\("location"\) !== "\/login"/);
+  assert.match(runner, /adminApi\.status !== 401/);
 });
 
 test("staging runs the rectification V4 worker from the immutable web image", () => {
@@ -428,7 +589,7 @@ test("manual migration uses only PostgreSQL and the digest-pinned migrator", ()
 
   assert.match(workflow, /^on:\n\s+workflow_dispatch:/m);
   assert.doesNotMatch(workflow, /workflow_run:|\n\s+push:/);
-  assert.match(runner, /docker pull "\$WEB_IMAGE"/);
+  assert.match(runner, /"\$\{docker_command\[@\]\}" pull "\$WEB_IMAGE"/);
   assert.match(runner, /up -d --no-build --pull never --wait postgres/);
   assert.match(runner, /-f deploy\/docker-compose\.postgres\.yml/);
   assertOrder(runner, [
@@ -457,13 +618,14 @@ test("run-local registry state and incoming trees are always cleaned up", () =>
 });
 
 test("production remains manual-only and separate from staging database automation", () => {
-  const production = readFileSync(
-    new URL("../../.github/workflows/deploy-production.yml", import.meta.url),
-    "utf8",
-  );
-  assert.match(production, /^on:\n\s+workflow_dispatch:/m);
-  assert.doesNotMatch(production, /workflow_run:|\n\s+push:/);
-  assert.doesNotMatch(production, /docker-compose\.postgres\.yml|db:migrate/);
+  for (const production of [
+    readFileSync(new URL("../../.github/workflows/deploy-production.yml", import.meta.url), "utf8"),
+    read(giteaProductionWorkflow),
+  ]) {
+    assert.match(production, /^on:\n\s+workflow_dispatch:/m);
+    assert.doesNotMatch(production, /workflow_run:|\n\s+push:/);
+    assert.doesNotMatch(production, /docker-compose\.postgres\.yml|db:migrate/);
+  }
 });
 
 
@@ -484,19 +646,18 @@ test("public rectification rollout enables the semantic agent and recreates web
       "APP_ENV_FILE=../.env.staging",
       "CADDYFILE_PATH=./Caddyfile.staging",
       "SITE_ADDRESS=https://staging.jyotisha.chat",
-      "ADMIN_SITE_ADDRESS=https://admin.staging.jyotisha.chat",
       "AUTH_PROVIDER=self-hosted",
       "SELF_HOSTED_IDENTITY_ENABLED=true",
       "AUTH_USER_ORIGIN=https://staging.jyotisha.chat",
-      "AUTH_ADMIN_ORIGIN=https://admin.staging.jyotisha.chat",
       `IDENTITY_DATABASE_URL=postgresql://identity_runtime:${"i".repeat(40)}@postgres:5432/jyotisha`,
       `APP_DATABASE_URL=postgresql://app_runtime:${"a".repeat(40)}@postgres:5432/jyotisha`,
       `ADMIN_DATABASE_URL=postgresql://admin_runtime:${"d".repeat(40)}@postgres:5432/jyotisha`,
       `BETTER_AUTH_USER_SECRET=${"u".repeat(32)}`,
-      `BETTER_AUTH_ADMIN_SECRET=${"v".repeat(32)}`,
       "RESEND_API_KEY=re_test_key",
       "RESEND_FROM_EMAIL=test@example.com",
       "ADMIN_EMAILS=admin@example.com",
+      "EPAY_CONFIG_ENCRYPTION_KEY=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
+      "EPAY_CHAT_ENABLED=false",
       `JYOTISH_DYNAMIC_RECTIFICATION_TOKEN=${"t".repeat(32)}`,
       "KEEP_ME=unchanged",
       "RECTIFICATION_V3_CREATE_ENABLED=false",
diff --git a/frontend/tests/staging-image-manifest.test.ts b/frontend/tests/staging-image-manifest.test.ts
index 2fc9e656..4494002e 100644
--- a/frontend/tests/staging-image-manifest.test.ts
+++ b/frontend/tests/staging-image-manifest.test.ts
@@ -25,6 +25,18 @@ test("manifest produces immutable GHCR digest references", () => {
   });
 });
 
+test("manifest produces immutable shared ACR repository references", () => {
+  const repository =
+    "crpi-d1feco6itet73spp.cn-hongkong.personal.cr.aliyuncs.com/copse/jyotisha";
+  assert.deepEqual(parseStagingImageManifest(validManifest(), gitSha, repository), {
+    gitSha,
+    apiDigest,
+    webDigest,
+    apiImage: `${repository}@${apiDigest}`,
+    webImage: `${repository}@${webDigest}`,
+  });
+});
+
 test("manifest rejects revision drift, mutable tags, duplicates, extras, and malformed digests", () => {
   const invalid = [
     validManifest().replace(gitSha, "f".repeat(40)),
@@ -41,4 +53,14 @@ test("manifest rejects revision drift, mutable tags, duplicates, extras, and mal
   for (const contents of invalid) {
     assert.throws(() => parseStagingImageManifest(contents, gitSha));
   }
+  for (const registry of [
+    "https://git.copse.top/root",
+    "git.copse.top/root;touch /tmp/pwned",
+    "git.copse.top/Root",
+    "git.copse.top/root@evil.example",
+    "git.copse.top/root/../evil",
+    "",
+  ]) {
+    assert.throws(() => parseStagingImageManifest(validManifest(), gitSha, registry));
+  }
 });
diff --git a/frontend/tests/starter-questions.test.ts b/frontend/tests/starter-questions.test.ts
index ee6410d1..fc6852ca 100644
--- a/frontend/tests/starter-questions.test.ts
+++ b/frontend/tests/starter-questions.test.ts
@@ -140,7 +140,9 @@ test("keeps admin navigation separate from account task dialogs", () => {
   // Given: the administrator-only route and the new account menu.
   // When: their source relationship is inspected.
   // Then: code management stays a guarded navigation action rather than a modal.
-  assert.match(appSidebarSource, /account\.isAdmin\s*&&\s*<Menu\.LinkItem[^>]+render=\{<Link href="\/admin\/codes" \/>\}/);
+  assert.doesNotMatch(appSidebarSource, /adminUrl|account\.isAdmin|后台管理/);
+  assert.match(pageSource, /account\.isAdmin && account\.adminUrl/);
+  assert.match(pageSource, /className="admin-button" href=\{account\.adminUrl\}/);
 });
 
 test("keeps the empty starter home at the top instead of auto-scrolling", () => {
diff --git a/scripts/jyotish_engine.py b/scripts/jyotish_engine.py
index 72fc2958..ebb85d6f 100644
--- a/scripts/jyotish_engine.py
+++ b/scripts/jyotish_engine.py
@@ -73,6 +73,8 @@ from ayanamsa_utils import (
 # ============================================================================
 SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
 ROOT_DIR = os.path.dirname(SCRIPT_DIR)
+if ROOT_DIR not in sys.path:
+    sys.path.insert(0, ROOT_DIR)
 HOME_DIR = os.path.expanduser('~')
 CLAW_DIR = os.path.join(HOME_DIR, 'WorkBuddy', 'Claw')
 DB_PATH = os.path.join(CLAW_DIR, 'vedic_astrology_validation.db')
@@ -868,7 +870,8 @@ def _oracle_progress_snapshot():
 
         root = Path(__file__).resolve().parents[1]
         oracle_file = root / 'references' / 'oracle' / 'dasha_shadbala_oracle_cases.json'
-        with tempfile.NamedTemporaryFile('w+', suffix='.json', delete=True, encoding='utf-8') as handle:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            queue_path = Path(temp_dir) / 'oracle-queue.json'
             queue = subprocess.run(
                 [sys.executable, 'scripts/oracle_collection_queue.py', '--oracle-file', str(oracle_file), '--format', 'json'],
                 cwd=root,
@@ -879,10 +882,9 @@ def _oracle_progress_snapshot():
             )
             if queue.returncode != 0:
                 raise RuntimeError(queue.stderr.strip() or queue.stdout.strip())
-            handle.write(queue.stdout)
-            handle.flush()
+            queue_path.write_text(queue.stdout, encoding='utf-8')
             validation = subprocess.run(
-                [sys.executable, 'scripts/oracle_evidence_validator.py', '--queue-file', handle.name],
+                [sys.executable, 'scripts/oracle_evidence_validator.py', '--queue-file', str(queue_path)],
                 cwd=root,
                 text=True,
                 capture_output=True,
@@ -1749,12 +1751,12 @@ def _build_ai_prompt_pack(report):
         'oracle_progress': oracle_progress,
         'functional_benefic_malefic': functional_layer,
         'interpretation_source_pack': {
-            'status': interpretation_source_audit.get('status') or 'blocked',
-            'source': interpretation_source_audit.get('source') or 'repo_existing_interpretation_sources',
-            'core_rule_source_refs': interpretation_source_audit.get('core_rule_source_refs') or [],
-            'promote_batch2_source_refs': interpretation_source_audit.get('promote_batch2_source_refs') or [],
-            'reference_only_source_refs': interpretation_source_audit.get('reference_only_source_refs') or [],
-            'missing_refs': interpretation_source_audit.get('missing_refs') or [],
+            'status': interpretation_source_audit.get('status') or fallback_source_pack.get('status') or 'blocked',
+            'source': interpretation_source_audit.get('source') or fallback_source_pack.get('source') or 'repo_existing_interpretation_sources',
+            'core_rule_source_refs': interpretation_source_audit.get('core_rule_source_refs') or fallback_source_pack.get('core_rule_source_layer', {}).get('source_refs') or [],
+            'promote_batch2_source_refs': interpretation_source_audit.get('promote_batch2_source_refs') or fallback_source_pack.get('promote_batch2_topic_layer', {}).get('source_refs') or [],
+            'reference_only_source_refs': interpretation_source_audit.get('reference_only_source_refs') or fallback_source_pack.get('reference_only_conflict_layer', {}).get('source_refs') or [],
+            'missing_refs': interpretation_source_audit.get('missing_refs') or fallback_source_pack.get('missing_refs') or [],
         },
         'prediction_boundary_contract': primary_prediction_boundary_contract or {},
         'domain_invocation_layers': primary_domain_invocation_layers or fallback_domain_layers or {},
diff --git a/scripts/run_quality_gate.py b/scripts/run_quality_gate.py
index 3a44e9ed..ff19ed09 100644
--- a/scripts/run_quality_gate.py
+++ b/scripts/run_quality_gate.py
@@ -164,7 +164,7 @@ DASHA_REFERENCE_AUDIT_CMD = [
     PYTHON,
     "scripts/dasha_reference_audit.py",
     "--year",
-    "REDACTED_YEAR",
+    "1990",
     "--month",
     "4",
     "--day",
@@ -182,9 +182,9 @@ DASHA_REFERENCE_AUDIT_CMD = [
     "--tz",
     "8",
     "--target-start-date",
-    "1986-05-18",
+    "2021-05-18",
     "--target-source",
-    "private_chart_reference.pdf",
+    "synthetic_fixture",
 ]
 
 ORACLE_BOUNDARY_AUDIT_CMD = [
diff --git a/tests/test_api_server_security.py b/tests/test_api_server_security.py
index 3f868ef6..6ae2ba11 100644
--- a/tests/test_api_server_security.py
+++ b/tests/test_api_server_security.py
@@ -1567,7 +1567,14 @@ def test_capability_audit_scans_registry_and_local_sources() -> None:
     assert audit['local_open_source']['source_count'] >= 3
     assert any(source['name'] == 'dashaflow' for source in audit['local_open_source']['sources'])
     assert all(gap.get('command') != 'varga-full' for gap in audit['priority_gaps'])
-    assert audit['surfaces']['app_routes'] == ['admin/codes', 'home', 'login']
+    assert audit['surfaces']['app_routes'] == [
+        'admin/codes',
+        'admin/packages',
+        'admin/payments',
+        'admin/users',
+        'home',
+        'login',
+    ]
     assert set(audit['surfaces']['app_visible_topics']) == {
         'Birth Rectification',
         'Case Validation',
diff --git a/tests/test_railway_deployment.py b/tests/test_railway_deployment.py
index d490dd78..3f8d0b93 100644
--- a/tests/test_railway_deployment.py
+++ b/tests/test_railway_deployment.py
@@ -12,10 +12,13 @@ def test_railway_services_use_the_product_frontend_and_dynamic_ports() -> None:
     assert "--hostname 0.0.0.0" in web and "${PORT:-3000}" in web
     assert "next-env.d.ts" not in web
 
+    assert "FROM m.daocloud.io/docker.io/library/python:3.12-slim" in api
     assert "COPY SKILL.md mcp_server.py" in api
     assert "--host 0.0.0.0" in api and "${PORT:-5200}" in api
     assert "http.server" not in api
 
+    assert "FROM swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/node:22-alpine" in web
+
 
 def test_web_image_copies_postcss_config_before_building_frontend() -> None:
     web = (ROOT / "deploy" / "railway-web.Dockerfile").read_text(encoding="utf-8")
diff --git a/tests/test_release_hygiene_contract.py b/tests/test_release_hygiene_contract.py
index d66e7bcd..15c0f344 100644
--- a/tests/test_release_hygiene_contract.py
+++ b/tests/test_release_hygiene_contract.py
@@ -8,3 +8,9 @@ def test_release_profile_requires_privacy_and_renderer_probes() -> None:
     assert '"scripts/three_engine_parity_replay_validator.py"' in source
     assert '"--require-external-parity"' in source
     assert 'parity_command.append("--require-pass")' in source
+
+
+def test_release_dasha_audit_uses_runnable_public_fixture() -> None:
+    source = (Path(__file__).resolve().parents[1] / "scripts" / "run_quality_gate.py").read_text(encoding="utf-8")
+    assert '"REDACTED_YEAR"' not in source
+    assert '"synthetic_fixture"' in source
diff --git a/tests/test_shadbala_complete.py b/tests/test_shadbala_complete.py
index cc7e88e0..9569d8d1 100644
--- a/tests/test_shadbala_complete.py
+++ b/tests/test_shadbala_complete.py
@@ -3,6 +3,7 @@
 
 from __future__ import annotations
 import json
+from pathlib import Path
 import sys, os, pytest
 
 SCRIPTS = os.path.join(os.path.dirname(__file__), '..', 'scripts')
@@ -221,8 +222,9 @@ class TestDrikBala:
 
 class TestShadbalaFull:
     def test_shadbala_module_exposes_reference_constants_path(self):
-        assert SHADBALA_CONSTANTS_PATH.endswith('references/shat_bala_constants.json')
-        assert os.path.exists(SHADBALA_CONSTANTS_PATH)
+        constants_path = Path(SHADBALA_CONSTANTS_PATH).resolve()
+        assert constants_path.parts[-2:] == ('references', 'shat_bala_constants.json')
+        assert constants_path.exists()
 
     def test_static_shadbala_constants_are_loaded_from_reference_json(self):
         constants = _shadbala_constants()