chore : bump version to 0.2.2

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat(ui) : add create task button on my-tasks and responsive kanban columns
2026-03-16 16:35:08 +01:00 · 2026-03-16 16:35:02 +01:00 · 2026-03-16 14:41:38 +01:00 · 2026-03-16 14:29:41 +01:00 · 2026-03-16 14:28:31 +01:00 · 2026-03-16 14:28:31 +01:00
91 changed files with 3198 additions and 747 deletions
--- a/.gitea/workflows/release-artefact.yml
+++ b/.gitea/workflows/release-artefact.yml
@@ -45,6 +45,7 @@ jobs:
          set -euo pipefail
          mkdir -p release
          tar -czf "release/lesstime-${GITHUB_REF_NAME}.tar.gz" \
+            .env \
            bin \
            config \
            migrations \
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -12,9 +12,11 @@ Application de gestion de projet. Monorepo Symfony 8 (API Platform 4) + Nuxt 4.
 ## Structure

 ```
-src/Entity/          # Entités Doctrine (User, Client, Project, Task, TaskStatus, TaskEffort, TaskPriority, TaskTag, TaskGroup, TimeEntry, GiteaConfiguration)
+src/Entity/          # Entités Doctrine (User, Client, Project, Task, TaskStatus, TaskEffort, TaskPriority, TaskTag, TaskGroup, TimeEntry, GiteaConfiguration, ClientTicket, Notification, TaskDocument)
 src/ApiResource/     # Ressources API Platform (si découplées des entités)
-src/State/           # Providers et Processors API Platform (MeProvider, AppVersionProvider, ActiveTimeEntryProvider, UserPasswordHasherProcessor, TaskNumberProcessor, Gitea*Provider, Gitea*Processor)
+src/State/           # Providers et Processors API Platform (MeProvider, AppVersionProvider, ActiveTimeEntryProvider, UserPasswordHasherProcessor, TaskNumberProcessor, ClientTicket*Provider/Processor, NotificationProvider, Gitea*Provider, Gitea*Processor)
+src/Service/         # Services métier (NotificationService)
+src/Controller/      # Controllers custom Symfony (NotificationUnreadCountController, MarkAllReadController, UserAvatarController, TaskDocumentDownloadController)
 src/Mcp/Tool/        # MCP tools organisés par domaine (Project/, Task/, TaskMeta/, TimeEntry/, Reference/)
 src/Security/        # Authenticators custom (ApiTokenAuthenticator pour MCP HTTP)
 src/Command/         # Commandes console (GenerateApiTokenCommand)
@@ -26,12 +28,12 @@ migrations/          # Migrations Doctrine
 docs/plans/          # Plans d'implémentation
 docs/superpowers/    # Plans et specs superpowers
 frontend/            # App Nuxt 4
-frontend/pages/      # Pages (index, login, my-tasks, projects, projects/[id], projects/[id]/groups, projects/[id]/archives, time-tracking, admin)
-frontend/layouts/    # Layouts (pas "layout")
-frontend/components/ # Composants Vue organisés en sous-dossiers (ui/, client/, project/, task/, user/, admin/, time-tracking/)
-frontend/composables/# Composables (useApi, useAppVersion)
+frontend/pages/      # Pages (index, login, my-tasks, profile, projects, projects/[id], projects/[id]/groups, projects/[id]/archives, time-tracking, admin, portal/, portal/projects/[id], portal/projects/[id]/new-ticket)
+frontend/layouts/    # Layouts (default, portal)
+frontend/components/ # Composants Vue organisés en sous-dossiers (ui/, client/, project/, task/, user/, admin/, time-tracking/, client-ticket/, notification/)
+frontend/composables/# Composables (useApi, useAppVersion, useNotifications, useClientTicketHelpers, useAvatarService)
 frontend/stores/     # Stores Pinia (auth, ui, timer)
-frontend/services/   # Services API (auth, clients, gitea, projects, tasks, task-statuses, task-efforts, task-groups, task-priorities, task-tags, users, time-entries)
+frontend/services/   # Services API (auth, clients, gitea, projects, tasks, task-statuses, task-efforts, task-groups, task-priorities, task-tags, users, time-entries, client-tickets, notifications, task-documents)
 frontend/services/dto/ # Types TypeScript
 frontend/i18n/locales/ # Fichiers de traduction (langDir résolu depuis i18n/)
 ```
@@ -73,6 +75,13 @@ Exemples : `feat : add login page`, `fix(auth) : prevent null token crash`
 - Routes API préfixées `/api` (via `config/routes/api_platform.yaml`)
 - Le login (`/login_check`) est hors prefix `/api`, nginx réécrit `REQUEST_URI` vers `/login_check`
 - PHP CS Fixer : règles Symfony + PSR-12 + strict types
+- Rôles : `ROLE_ADMIN`, `ROLE_USER`, `ROLE_CLIENT` — hiérarchie dans `security.yaml`
+- `User::getRoles()` n'ajoute PAS `ROLE_USER` si l'user a `ROLE_CLIENT` (isolation)
+- PostgreSQL : `LIKE` sur colonne JSON ne marche pas → utiliser `roles::text LIKE` via native SQL
+- Controllers custom sous `/api/` : ajouter `priority: 1` sur `#[Route]` pour éviter le conflit avec API Platform `{id}`
+- Serialization : pour embarquer une relation (pas IRI), ajouter le groupe du parent aux propriétés de l'entité cible
+- Upload fichiers : utiliser `$file->getMimeType()` (pas `getClientMimeType()`) pour valider côté serveur — nécessite `symfony/mime`
+- Auth endpoints mixtes (ROLE_USER + ROLE_CLIENT) : utiliser `#[IsGranted('IS_AUTHENTICATED_FULLY')]` au lieu d'un rôle spécifique

 ### Frontend

@@ -82,6 +91,9 @@ Exemples : `feat : add login page`, `fix(auth) : prevent null token crash`
 - Middleware global `auth.global.ts` protège les routes
 - Traductions dans `frontend/i18n/locales/` (le module résout `langDir` depuis `i18n/`)
 - 4 espaces d'indentation
+- MalioSelect : options `{ label: string, value: number | null }` uniquement — pas de string values, utiliser `<select>` natif pour les enums string
+- Portal client : pages sous `/portal/`, layout `portal.vue`, middleware redirige `ROLE_CLIENT` (sans `ROLE_ADMIN`) vers `/portal`
+- Users admin+client : ne pas bloquer — vérifier `ROLE_CLIENT && !ROLE_ADMIN` pour les restrictions

 ### MCP Server

@@ -111,4 +123,6 @@ Exemples : `feat : add login page`, `fix(auth) : prevent null token crash`
 ## Fixtures

 - User admin : `admin` / `admin` (ROLE_ADMIN)
+- Users internes : `alice` / `alice`, `bob` / `bob`, `charlie` / `charlie` (ROLE_USER)
+- Users client : `client-liot` / `client` (ROLE_CLIENT, client LIOT → SIRH), `client-acme` / `client` (ROLE_CLIENT, client ACME → CRM)
 - API token admin (dev) : `dev-mcp-token-for-testing-only-do-not-use-in-production`
--- a/README.md
+++ b/README.md
@@ -1,10 +1,173 @@
 # Lesstime

-Application de gestion de projet. Symfony 8 + API Platform 4 + Nuxt 4.
+Application de gestion de projet avec suivi du temps et portail client.

-## MCP Server
+## Stack

-Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistants IA (Claude Code, ChatGPT, Codex) d'interagir avec les projets, tâches et le suivi du temps.
+| Couche | Technologies |
+|--------|-------------|
+| **Backend** | PHP 8.4, Symfony 8, API Platform 4, Doctrine ORM |
+| **Frontend** | Nuxt 4 (SPA), Vue 3, Pinia, Tailwind CSS |
+| **Base de données** | PostgreSQL 16 |
+| **Auth** | JWT HTTP-only cookie (lexik/jwt-authentication-bundle) |
+| **Infrastructure** | Docker (PHP-FPM, Nginx, PostgreSQL) |
+
+## Fonctionnalités
+
+- Gestion de projets et tâches (kanban, groupes, priorités, tags, efforts)
+- Suivi du temps (timer, calendrier, vue liste)
+- Portail client avec tickets (bug, amélioration, autre)
+- Gestion de documents (upload, prévisualisation, téléchargement)
+- Profil utilisateur avec avatar (crop circulaire)
+- Notifications temps réel
+- Intégration Gitea (issues, repos)
+- Serveur MCP pour assistants IA
+- Multi-langue (i18n)
+
+## Prérequis
+
+- Docker & Docker Compose
+- Git
+
+## Installation
+
+```bash
+# 1. Cloner le repo
+git clone <url> && cd lesstime
+
+# 2. Démarrer les containers
+make start
+
+# 3. Installation complète (composer, migrations, fixtures, build Nuxt)
+make install
+```
+
+L'application est accessible sur **http://localhost:8082**.
+
+### Comptes de test (fixtures)
+
+| Utilisateur | Mot de passe | Rôle | Détails |
+|-------------|-------------|------|---------|
+| `admin` | `admin` | ROLE_ADMIN | Administrateur |
+| `alice` | `alice` | ROLE_USER | Utilisateur interne |
+| `bob` | `bob` | ROLE_USER | Utilisateur interne |
+| `charlie` | `charlie` | ROLE_USER | Utilisateur interne |
+| `client-liot` | `client` | ROLE_CLIENT | Client LIOT (projet SIRH) |
+| `client-acme` | `client` | ROLE_CLIENT | Client ACME (projet CRM) |
+
+## Commandes
+
+### Docker
+
+```bash
+make start              # Démarrer les containers
+make stop               # Arrêter les containers
+make restart            # Redémarrer les containers
+make shell              # Shell dans le container PHP
+make shell-root         # Shell root dans le container PHP
+```
+
+### Développement
+
+```bash
+make dev-nuxt           # Dev server Nuxt (hot reload, port 3002)
+make cache-clear        # Vider le cache Symfony
+make logs-dev           # Tail logs Symfony
+```
+
+### Base de données
+
+```bash
+make migration-migrate  # Lancer les migrations
+make fixtures           # Charger les fixtures
+make db-reset           # Reset BDD + migrations + fixtures (⚠️ supprime les données)
+```
+
+### Tests & Qualité
+
+```bash
+make test                       # PHPUnit
+make php-cs-fixer-allow-risky   # Fix code style PHP (Symfony + PSR-12)
+```
+
+### Installation complète
+
+```bash
+make install            # Composer + migrations + fixtures + build Nuxt
+make reset              # Tout supprimer et réinstaller (⚠️ supprime la BDD)
+```
+
+## Architecture
+
+```
+src/
+├── Entity/             # Entités Doctrine
+├── ApiResource/        # Ressources API Platform (découplées)
+├── State/              # Providers et Processors API Platform
+├── Controller/         # Controllers custom Symfony
+├── Service/            # Services métier
+├── EventListener/      # Listeners Doctrine
+├── Exception/          # Exceptions custom
+├── Security/           # Authenticators custom
+├── Repository/         # Repositories Doctrine
+├── Command/            # Commandes console
+├── DataFixtures/       # Fixtures
+└── Mcp/Tool/           # MCP tools par domaine
+    ├── Project/
+    ├── Task/
+    ├── TaskMeta/
+    ├── TimeEntry/
+    └── Reference/
+
+frontend/
+├── pages/              # Pages Nuxt (routing auto)
+│   ├── portal/         # Pages portail client
+│   └── projects/       # Pages projets
+├── layouts/            # Layouts (default, portal)
+├── components/         # Composants Vue
+│   ├── ui/             # Composants génériques
+│   ├── task/           # Tâches
+│   ├── user/           # Utilisateur (avatar, etc.)
+│   ├── project/        # Projets
+│   ├── client/         # Clients
+│   ├── client-ticket/  # Tickets client
+│   ├── admin/          # Administration
+│   ├── notification/   # Notifications
+│   └── time-tracking/  # Suivi du temps
+├── composables/        # Composables (useApi, useNotifications, etc.)
+├── stores/             # Stores Pinia (auth, ui, timer)
+├── services/           # Services API
+│   └── dto/            # Types TypeScript
+├── plugins/            # Plugins Nuxt
+├── utils/              # Utilitaires
+├── i18n/locales/       # Traductions
+└── middleware/          # Middleware auth
+
+config/                 # Config Symfony
+migrations/             # Migrations Doctrine
+docker/                 # Dockerfiles et config Nginx
+```
+
+## Docker
+
+| Container | Port | Description |
+|-----------|------|-------------|
+| `php-lesstime-fpm` | 3002 (dev Nuxt) | PHP-FPM + Node 24 |
+| `nginx-lesstime` | 8082 | Nginx reverse proxy |
+| PostgreSQL | 5435 | Base de données |
+
+Configuration : `docker/.env.docker` (override local : `docker/.env.docker.local`)
+
+## API
+
+Toutes les routes API sont préfixées `/api` (API Platform).
+
+- Documentation auto-générée : **http://localhost:8082/api**
+- Auth : `POST /login_check` avec `{ username, password }` → cookie JWT `BEARER`
+
+## Serveur MCP
+
+Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistants IA d'interagir avec les données.

 ### Tools disponibles (22)

@@ -16,13 +179,6 @@ Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistant
 | TaskMeta | `list-statuses`, `list-priorities`, `list-efforts`, `list-tags`, `list-groups`, `create-group`, `update-group` |
 | TimeEntry | `list-time-entries`, `create-time-entry`, `update-time-entry`, `delete-time-entry` |

-### Transports
-
-| Transport | Usage | Auth |
-|-----------|-------|------|
-| **STDIO** | Claude Code sur la machine locale | Aucune |
-| **HTTP** (`/_mcp`) | Clients MCP sur le réseau local | API token (`Authorization: Bearer <token>`) |
-
 ### Configuration locale (STDIO)

 ```json
@@ -55,17 +211,19 @@ Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistant
 ### Gestion des tokens API

 ```bash
-# Générer un token pour un utilisateur
 docker exec -u www-data php-lesstime-fpm php bin/console app:generate-api-token <username>
 ```

-### Mise en production (réseau local)
+## Déploiement

 1. Déployer le code sur le serveur
 2. `composer install --no-dev --optimize-autoloader`
 3. `php bin/console doctrine:migrations:migrate --no-interaction`
 4. `php bin/console cache:clear --env=prod`
-5. `docker restart nginx-lesstime`
-6. `php bin/console app:generate-api-token admin` — noter le token
-7. Ouvrir le port 8082 sur le firewall du serveur (LAN uniquement)
-8. Configurer les clients MCP avec l'URL `http://<ip-serveur>:8082/_mcp` + le token
+5. `cd frontend && npm install && npm run build:dist`
+6. `docker restart nginx-lesstime`
+7. Ouvrir le port 8082 sur le firewall (LAN uniquement)
+
+## Licence
+
+Propriétaire — Tous droits réservés.
--- a/composer.json
+++ b/composer.json
@@ -25,6 +25,7 @@
        "symfony/framework-bundle": "8.0.*",
        "symfony/http-client": "8.0.*",
        "symfony/mcp-bundle": "^0.6.0",
+        "symfony/mime": "8.0.*",
        "symfony/property-access": "8.0.*",
        "symfony/property-info": "8.0.*",
        "symfony/runtime": "8.0.*",
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "75b9dbecf38167d0554dfd64a986a40e",
+    "content-hash": "3e2146f74bbda750c75ab52eb437d2d4",
    "packages": [
        {
            "name": "api-platform/doctrine-common",
@@ -5703,6 +5703,92 @@
            ],
            "time": "2026-03-04T16:39:24+00:00"
        },
+        {
+            "name": "symfony/mime",
+            "version": "v8.0.7",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/mime.git",
+                "reference": "5d26d1958aeeba2ace8cc64a3a93d4f5d8f8022b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/mime/zipball/5d26d1958aeeba2ace8cc64a3a93d4f5d8f8022b",
+                "reference": "5d26d1958aeeba2ace8cc64a3a93d4f5d8f8022b",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.4",
+                "symfony/polyfill-intl-idn": "^1.10",
+                "symfony/polyfill-mbstring": "^1.0"
+            },
+            "conflict": {
+                "egulias/email-validator": "~3.0.0",
+                "phpdocumentor/reflection-docblock": "<5.2|>=7",
+                "phpdocumentor/type-resolver": "<1.5.1"
+            },
+            "require-dev": {
+                "egulias/email-validator": "^2.1.10|^3.1|^4",
+                "league/html-to-markdown": "^5.0",
+                "phpdocumentor/reflection-docblock": "^5.2|^6.0",
+                "symfony/dependency-injection": "^7.4|^8.0",
+                "symfony/process": "^7.4|^8.0",
+                "symfony/property-access": "^7.4|^8.0",
+                "symfony/property-info": "^7.4|^8.0",
+                "symfony/serializer": "^7.4|^8.0"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Component\\Mime\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Fabien Potencier",
+                    "email": "fabien@symfony.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Allows manipulating MIME messages",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "mime",
+                "mime-type"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/mime/tree/v8.0.7"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-03-06T13:17:40+00:00"
+        },
        {
            "name": "symfony/password-hasher",
            "version": "v8.0.6",
@@ -5858,6 +5944,93 @@
            ],
            "time": "2025-06-27T09:58:17+00:00"
        },
+        {
+            "name": "symfony/polyfill-intl-idn",
+            "version": "v1.33.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/polyfill-intl-idn.git",
+                "reference": "9614ac4d8061dc257ecc64cba1b140873dce8ad3"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-idn/zipball/9614ac4d8061dc257ecc64cba1b140873dce8ad3",
+                "reference": "9614ac4d8061dc257ecc64cba1b140873dce8ad3",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.2",
+                "symfony/polyfill-intl-normalizer": "^1.10"
+            },
+            "suggest": {
+                "ext-intl": "For best performance"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "bootstrap.php"
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Intl\\Idn\\": ""
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Laurent Bassin",
+                    "email": "laurent@bassin.info"
+                },
+                {
+                    "name": "Trevor Rowbotham",
+                    "email": "trevor.rowbotham@pm.me"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Symfony polyfill for intl's idn_to_ascii and idn_to_utf8 functions",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "compatibility",
+                "idn",
+                "intl",
+                "polyfill",
+                "portable",
+                "shim"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/polyfill-intl-idn/tree/v1.33.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2024-09-10T14:38:51+00:00"
+        },
        {
            "name": "symfony/polyfill-intl-normalizer",
            "version": "v1.33.0",
--- a/config/services.yaml
+++ b/config/services.yaml
@@ -8,6 +8,7 @@
 # https://symfony.com/doc/current/best_practices.html#use-parameters-for-application-configuration
 parameters:
    task_document_upload_dir: '%kernel.project_dir%/var/uploads/documents'
+    avatar_upload_dir: '%kernel.project_dir%/var/uploads/avatars'

 imports:
    - { resource: version.yaml }
@@ -39,3 +40,7 @@ services:
    App\Controller\TaskDocumentDownloadController:
        arguments:
            $uploadDir: '%task_document_upload_dir%'
+
+    App\Controller\UserAvatarController:
+        arguments:
+            $avatarUploadDir: '%avatar_upload_dir%'
--- a/config/version.yaml
+++ b/config/version.yaml
@@ -1,2 +1,2 @@
 parameters:
-    app.version: '0.1.0'
+    app.version: '0.2.2'
--- a/deploy/nginx/lesstime.conf
+++ b/deploy/nginx/lesstime.conf
@@ -0,0 +1,50 @@
+server {
+  listen 80;
+  listen [::]:80;
+  server_name project.malio-dev.fr;
+
+  root /var/www/lesstime/frontend/.output/public;
+  index index.html;
+
+  client_max_body_size 55m;
+
+    location ^~ /api/ {
+        root /var/www/lesstime/public;
+        try_files $uri /index.php?$query_string;
+    }
+
+    location ^~ /bundles/ {
+        root /var/www/lesstime/public;
+        try_files $uri =404;
+    }
+
+    location = /api/login_check {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/lesstime/public/index.php;
+        fastcgi_param DOCUMENT_ROOT /var/www/lesstime/public;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param PATH_INFO /login_check;
+        fastcgi_param REQUEST_URI /login_check;
+        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
+    }
+
+    location ^~ /_mcp {
+        root /var/www/lesstime/public;
+        try_files $uri /index.php?$query_string;
+    }
+
+    location ~ ^/index\.php(/|$) {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/lesstime/public/index.php;
+        fastcgi_param DOCUMENT_ROOT /var/www/lesstime/public;
+        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
+    }
+
+  location ~ \.php$ {
+      return 404;
+  }
+
+  location / {
+      try_files $uri $uri/ /index.html;
+  }
+}
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -0,0 +1,213 @@
+# Deploiement sur serveur Ubuntu (sans Docker)
+
+## Prerequis
+
+- Ubuntu 22.04+ avec PHP 8.4, Node 24, PostgreSQL 16, Nginx
+- Acces root ou sudo sur le serveur
+
+## 1. Preparer la BDD
+
+```bash
+sudo -u postgres createuser lesstime
+sudo -u postgres createdb -O lesstime lesstime
+sudo -u postgres psql -c "ALTER USER lesstime WITH PASSWORD 'ton-mdp';"
+```
+
+## 2. Creer les dossiers
+
+```bash
+sudo mkdir -p /var/www/lesstime/var/log /var/www/lesstime/var/cache /var/www/lesstime/config/jwt
+sudo chown -R www-data:www-data /var/www/lesstime
+```
+
+## 3. Configurer l'environnement
+
+```bash
+sudo nano /var/www/lesstime/.env
+```
+
+Contenu minimal :
+```ini
+APP_ENV=prod
+```
+
+```bash
+sudo nano /var/www/lesstime/.env.local
+```
+
+Contenu :
+```ini
+APP_ENV=prod
+APP_SECRET=<random-hex-32>
+APP_DEBUG=0
+
+DEFAULT_URI=http://project.malio-dev.fr/
+CORS_ALLOW_ORIGIN='^https?://project\.malio-dev\.fr$'
+
+DATABASE_URL="postgresql://lesstime:<mdp>@localhost:5432/lesstime?serverVersion=16&charset=utf8"
+
+JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
+JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
+JWT_PASSPHRASE=<passphrase>
+JWT_COOKIE_SECURE=0
+JWT_TOKEN_TTL=86400
+JWT_COOKIE_TTL=86400
+
+ENCRYPTION_KEY=<random-hex-32>
+```
+
+> `JWT_COOKIE_SECURE=0` car HTTP. Passer a `1` si HTTPS.
+
+## 4. Installer le script de deploy
+
+```bash
+sudo cp script/deploy-release.sh /usr/local/bin/deploy-lesstime
+sudo chmod +x /usr/local/bin/deploy-lesstime
+```
+
+Si le repo Gitea est prive, configurer un token :
+```bash
+echo "ton-token-gitea" | sudo tee /etc/lesstime-release-token
+sudo chmod 600 /etc/lesstime-release-token
+```
+
+## 5. Deployer une release
+
+```bash
+sudo /usr/local/bin/deploy-lesstime v0.2.1
+```
+
+Le script telecharge l'artefact, extrait les fichiers, clear le cache et lance les migrations.
+
+## 6. Generer les cles JWT
+
+```bash
+cd /var/www/lesstime
+sudo -u www-data php bin/console lexik:jwt:generate-keypair --skip-if-exists --env=prod
+```
+
+## 7. Configurer Nginx
+
+```bash
+sudo cp deploy/nginx/lesstime.conf /etc/nginx/sites-available/lesstime
+sudo ln -sf /etc/nginx/sites-available/lesstime /etc/nginx/sites-enabled/
+sudo nginx -t && sudo systemctl reload nginx
+```
+
+## 8. Creer le premier user admin
+
+Hasher un mot de passe :
+```bash
+php /var/www/lesstime/bin/console security:hash-password --env=prod
+```
+
+Choisir `App\Entity\User`, taper le mdp, copier le hash. Puis :
+```bash
+sudo -u postgres psql lesstime -c "INSERT INTO \"user\" (username, roles, password, created_at) VALUES ('admin', '[\"ROLE_ADMIN\"]', '<le-hash>', NOW());"
+```
+
+## 9. Tester
+
+```bash
+curl http://project.malio-dev.fr/api/version
+curl http://project.malio-dev.fr/
+```
+
+---
+
+# Connecter le serveur MCP a Claude Code
+
+Le serveur MCP expose 22 tools (projets, taches, time tracking avec liaison tickets client, metadonnees) via le endpoint HTTP `/_mcp`.
+
+## 1. Generer un token API
+
+Sur le serveur (ou en local via Docker) :
+
+```bash
+# Production (serveur)
+php /var/www/lesstime/bin/console app:generate-api-token admin --env=prod
+
+# Dev (Docker)
+docker exec -it php-lesstime-fpm php bin/console app:generate-api-token admin
+```
+
+La commande affiche un token de 64 caracteres. Ce token est lie a l'utilisateur et stocke en base (champ `apiToken` de l'entite `User`).
+
+## 2. Configurer Claude Code
+
+### Transport HTTP (recommande pour la prod)
+
+Creer ou modifier `.mcp.json` a la racine du projet :
+
+```json
+{
+    "mcpServers": {
+        "lesstime": {
+            "type": "http",
+            "url": "http://project.malio-dev.fr/_mcp",
+            "headers": {
+                "Authorization": "Bearer <ton-token>"
+            }
+        }
+    }
+}
+```
+
+### Transport STDIO (dev local via Docker)
+
+```json
+{
+    "mcpServers": {
+        "lesstime-local": {
+            "command": "docker",
+            "args": [
+                "exec",
+                "-i",
+                "php-lesstime-fpm",
+                "php",
+                "bin/console",
+                "mcp:server"
+            ]
+        }
+    }
+}
+```
+
+### Transport STDIO via SSH (prod sans endpoint HTTP)
+
+```json
+{
+    "mcpServers": {
+        "lesstime": {
+            "command": "ssh",
+            "args": [
+                "user@serveur",
+                "php",
+                "/var/www/lesstime/bin/console",
+                "mcp:server",
+                "--env=prod"
+            ]
+        }
+    }
+}
+```
+
+## 3. Redemarrer Claude Code
+
+Apres modification de `.mcp.json`, relancer Claude Code pour qu'il detecte le serveur.
+
+## 4. Verifier
+
+Demander a Claude d'utiliser un outil MCP, par exemple :
+- "Liste les projets sur Lesstime"
+- "Cree une tache dans le projet LT"
+
+## Tools disponibles
+
+| Domaine | Tools |
+|---------|-------|
+| Projets | list-projects, get-project, create-project, update-project |
+| Taches | list-tasks, get-task, create-task, update-task, delete-task |
+| Metadonnees | list-statuses, list-priorities, list-efforts, list-tags, list-groups, create-group, update-group |
+| Time tracking | list-time-entries, create-time-entry, update-time-entry, delete-time-entry (supporte clientTicketId) |
+| Reference | list-users, list-clients |
--- a/docs/superpowers/plans/2026-03-15-user-avatar.md
+++ b/docs/superpowers/plans/2026-03-15-user-avatar.md
@@ -0,0 +1,802 @@
+# User Avatar Implementation Plan
+
+> **For agentic workers:** REQUIRED: Use superpowers:subagent-driven-development (if subagents available) or superpowers:executing-plans to implement this plan. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Let users upload a cropped profile avatar that replaces initials everywhere in the app.
+
+**Architecture:** New `avatarFileName` column on User entity, dedicated upload/serve/delete controllers, `UserAvatar.vue` component with `vue-advanced-cropper` for circular crop, and a `/profile` page for management.
+
+**Tech Stack:** PHP 8.4/Symfony 8, Doctrine migration, `vue-advanced-cropper`, Nuxt 4 SPA
+
+---
+
+## File Structure
+
+### Backend (create)
+- `src/Controller/UserAvatarController.php` — upload, serve, delete avatar (3 routes)
+
+### Backend (modify)
+- `src/Entity/User.php` — add `avatarFileName` field + `getAvatarUrl()` virtual getter
+- `config/services.yaml` — add `avatar_upload_dir` parameter + wire controller
+
+### Frontend (create)
+- `frontend/components/user/UserAvatar.vue` — reusable avatar display (image or initials fallback)
+- `frontend/components/user/AvatarCropper.vue` — crop modal using `vue-advanced-cropper`
+- `frontend/services/avatar.ts` — avatar API service (upload, remove, getUrl)
+- `frontend/pages/profile.vue` — profile page with avatar management
+
+### Frontend (modify)
+- `frontend/services/dto/user-data.ts` — add `avatarUrl` to `UserData`
+- `frontend/stores/auth.ts` — add `refreshUser()` action
+- `frontend/components/ui/AppTopNav.vue` — use `UserAvatar` + link "Mon profil" to `/profile`
+- `frontend/components/task/TaskCard.vue:47-59` — replace initials with `UserAvatar`
+- `frontend/pages/projects/[id]/archives.vue:49-55` — replace initials with `UserAvatar`
+- `frontend/components/admin/AdminClientTicketTab.vue:82` — use `UserAvatar` for submitter
+- `frontend/middleware/auth.global.ts` — allow `/profile` for all authenticated users
+
+---
+
+## Task 1: Backend — User entity + migration
+
+**Files:**
+- Modify: `src/Entity/User.php`
+- Create: migration file (generated)
+
+- [ ] **Step 1: Add `avatarFileName` field to User entity**
+
+In `src/Entity/User.php`, add after the `$apiToken` field:
+
+```php
+#[ORM\Column(length: 255, nullable: true)]
+#[Groups(['me:read', 'user:list'])]
+private ?string $avatarFileName = null;
+```
+
+Add getter/setter:
+
+```php
+public function getAvatarFileName(): ?string
+{
+    return $this->avatarFileName;
+}
+
+public function setAvatarFileName(?string $avatarFileName): static
+{
+    $this->avatarFileName = $avatarFileName;
+
+    return $this;
+}
+```
+
+Add virtual `avatarUrl` getter (serialized, read-only):
+
+```php
+#[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read'])]
+public function getAvatarUrl(): ?string
+{
+    if (null === $this->avatarFileName) {
+        return null;
+    }
+
+    return '/api/users/' . $this->id . '/avatar';
+}
+```
+
+- [ ] **Step 2: Generate and run migration**
+
+```bash
+docker exec -t php-lesstime-fpm php bin/console doctrine:migrations:diff
+docker exec -t php-lesstime-fpm php bin/console doctrine:migrations:migrate --no-interaction
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/Entity/User.php migrations/
+git commit -m "feat(avatar) : add avatarFileName field to User entity"
+```
+
+---
+
+## Task 2: Backend — Avatar controller
+
+**Files:**
+- Create: `src/Controller/UserAvatarController.php`
+- Modify: `config/services.yaml`
+
+- [ ] **Step 1: Add `avatar_upload_dir` parameter in `config/services.yaml`**
+
+Add to `parameters:` section:
+
+```yaml
+avatar_upload_dir: '%kernel.project_dir%/var/uploads/avatars'
+```
+
+Add service wiring:
+
+```yaml
+App\Controller\UserAvatarController:
+    arguments:
+        $avatarUploadDir: '%avatar_upload_dir%'
+```
+
+- [ ] **Step 2: Create `UserAvatarController.php`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use App\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Component\Uid\Uuid;
+
+class UserAvatarController extends AbstractController
+{
+    private const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5 MB
+    private const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly string $avatarUploadDir,
+    ) {}
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_upload', methods: ['POST'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function upload(int $id, Request $request): JsonResponse
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $file = $request->files->get('file');
+
+        if (null === $file || !$file->isValid()) {
+            throw new BadRequestHttpException('No valid file uploaded.');
+        }
+
+        if ($file->getSize() > self::MAX_FILE_SIZE) {
+            throw new BadRequestHttpException('File size exceeds 5 MB limit.');
+        }
+
+        $mimeType = $file->getClientMimeType();
+
+        if (!in_array($mimeType, self::ALLOWED_MIME_TYPES, true)) {
+            throw new BadRequestHttpException('Invalid file type. Allowed: JPEG, PNG, WebP, GIF.');
+        }
+
+        // Delete previous avatar file if exists
+        $this->deleteAvatarFile($user);
+
+        $extension = $file->guessExtension() ?? 'bin';
+        $fileName = Uuid::v4()->toRfc4122() . '.' . $extension;
+
+        if (!is_dir($this->avatarUploadDir)) {
+            mkdir($this->avatarUploadDir, 0o775, true);
+        }
+
+        $file->move($this->avatarUploadDir, $fileName);
+
+        $user->setAvatarFileName($fileName);
+        $this->entityManager->flush();
+
+        return new JsonResponse(['avatarUrl' => $user->getAvatarUrl()]);
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_serve', methods: ['GET'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function serve(int $id): BinaryFileResponse
+    {
+        $user = $this->findUserOrFail($id);
+
+        if (null === $user->getAvatarFileName()) {
+            throw new NotFoundHttpException('No avatar set.');
+        }
+
+        $filePath = $this->avatarUploadDir . '/' . $user->getAvatarFileName();
+
+        if (!file_exists($filePath)) {
+            throw new NotFoundHttpException('Avatar file not found on disk.');
+        }
+
+        $response = new BinaryFileResponse($filePath);
+        $response->setContentDisposition(ResponseHeaderBag::DISPOSITION_INLINE, $user->getAvatarFileName());
+        $extension = pathinfo($user->getAvatarFileName(), PATHINFO_EXTENSION);
+        $mimeMap = ['jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png', 'webp' => 'image/webp', 'gif' => 'image/gif'];
+        $response->headers->set('Content-Type', $mimeMap[$extension] ?? 'application/octet-stream');
+        $response->headers->set('Cache-Control', 'public, max-age=86400');
+
+        return $response;
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_delete', methods: ['DELETE'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function delete(int $id): Response
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $this->deleteAvatarFile($user);
+        $user->setAvatarFileName(null);
+        $this->entityManager->flush();
+
+        return new Response(null, Response::HTTP_NO_CONTENT);
+    }
+
+    private function findUserOrFail(int $id): User
+    {
+        $user = $this->entityManager->getRepository(User::class)->find($id);
+
+        if (null === $user) {
+            throw new NotFoundHttpException('User not found.');
+        }
+
+        return $user;
+    }
+
+    private function assertCanManageAvatar(User $user): void
+    {
+        $currentUser = $this->getUser();
+
+        if ($currentUser !== $user && !$this->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedHttpException('You can only manage your own avatar.');
+        }
+    }
+
+    private function deleteAvatarFile(User $user): void
+    {
+        if (null === $user->getAvatarFileName()) {
+            return;
+        }
+
+        $filePath = $this->avatarUploadDir . '/' . $user->getAvatarFileName();
+
+        if (file_exists($filePath)) {
+            unlink($filePath);
+        }
+    }
+}
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/Controller/UserAvatarController.php config/services.yaml
+git commit -m "feat(avatar) : add avatar upload/serve/delete controller"
+```
+
+---
+
+## Task 3: Frontend — Install vue-advanced-cropper + DTO + service
+
+**Files:**
+- Modify: `frontend/services/dto/user-data.ts`
+- Create: `frontend/services/avatar.ts`
+- Modify: `frontend/stores/auth.ts`
+
+- [ ] **Step 1: Install vue-advanced-cropper**
+
+```bash
+cd frontend && npm install vue-advanced-cropper
+```
+
+- [ ] **Step 2: Update `UserData` DTO**
+
+In `frontend/services/dto/user-data.ts`, add `avatarUrl` to `UserData`:
+
+```typescript
+export type UserData = {
+    id: number
+    '@id'?: string
+    username: string
+    roles: string[]
+    client?: { id: number; name: string } | null
+    allowedProjects?: Project[]
+    avatarUrl?: string | null
+}
+```
+
+- [ ] **Step 3: Create `frontend/services/avatar.ts`**
+
+```typescript
+export function useAvatarService() {
+    const api = useApi()
+
+    async function upload(userId: number, file: Blob): Promise<{ avatarUrl: string }> {
+        const formData = new FormData()
+        formData.append('file', file, 'avatar.png')
+
+        return $fetch(`/api/users/${userId}/avatar`, {
+            method: 'POST',
+            body: formData,
+            credentials: 'include',
+        })
+    }
+
+    async function remove(userId: number): Promise<void> {
+        await api.delete(`/users/${userId}/avatar`)
+    }
+
+    function getUrl(userId: number): string {
+        return `/api/users/${userId}/avatar`
+    }
+
+    return { upload, remove, getUrl }
+}
+```
+
+- [ ] **Step 4: Add `refreshUser` to auth store**
+
+In `frontend/stores/auth.ts`, add to actions:
+
+```typescript
+async refreshUser() {
+    try {
+        const me = await getCurrentUser()
+        this.user = me
+    } catch {
+        // Silently fail — user session might have expired
+    }
+}
+```
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add frontend/package.json frontend/package-lock.json frontend/services/dto/user-data.ts frontend/services/avatar.ts frontend/stores/auth.ts
+git commit -m "feat(avatar) : add avatar service, DTO update, and cropper dependency"
+```
+
+---
+
+## Task 4: Frontend — UserAvatar component
+
+**Files:**
+- Create: `frontend/components/user/UserAvatar.vue`
+
+- [ ] **Step 1: Create `UserAvatar.vue`**
+
+```vue
+<template>
+    <span
+        class="inline-flex shrink-0 items-center justify-center rounded-full"
+        :class="sizeClasses"
+        :title="user.username"
+    >
+        <img
+            v-if="user.avatarUrl && !imgError"
+            :src="user.avatarUrl"
+            :alt="user.username"
+            class="h-full w-full rounded-full object-cover"
+            @error="imgError = true"
+        />
+        <span
+            v-else
+            class="flex h-full w-full items-center justify-center rounded-full bg-primary-500 font-bold text-white"
+            :class="textSizeClass"
+        >
+            {{ user.username.substring(0, 2).toUpperCase() }}
+        </span>
+    </span>
+</template>
+
+<script setup lang="ts">
+const props = defineProps<{
+    user: { id?: number; username: string; avatarUrl?: string | null }
+    size?: 'xs' | 'sm' | 'md' | 'lg'
+}>()
+
+const imgError = ref(false)
+
+watch(() => props.user.avatarUrl, () => {
+    imgError.value = false
+})
+
+const sizeClasses = computed(() => {
+    const map = {
+        xs: 'h-5 w-5',
+        sm: 'h-6 w-6',
+        md: 'h-8 w-8',
+        lg: 'h-12 w-12',
+    }
+    return map[props.size ?? 'sm']
+})
+
+const textSizeClass = computed(() => {
+    const map = {
+        xs: 'text-[10px]',
+        sm: 'text-xs',
+        md: 'text-sm',
+        lg: 'text-base',
+    }
+    return map[props.size ?? 'sm']
+})
+</script>
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add frontend/components/user/UserAvatar.vue
+git commit -m "feat(avatar) : add UserAvatar component with image/initials fallback"
+```
+
+---
+
+## Task 5: Frontend — AvatarCropper component
+
+**Files:**
+- Create: `frontend/components/user/AvatarCropper.vue`
+
+- [ ] **Step 1: Create `AvatarCropper.vue`**
+
+```vue
+<template>
+    <Teleport to="body">
+        <div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
+            <div class="w-full max-w-md rounded-xl bg-white p-6 shadow-2xl">
+                <h3 class="mb-4 text-lg font-bold text-neutral-900">
+                    {{ $t('profile.cropAvatar') }}
+                </h3>
+
+                <div class="mx-auto mb-4 h-72 w-72">
+                    <Cropper
+                        ref="cropperRef"
+                        :src="imageSrc"
+                        :stencil-component="CircleStencil"
+                        :stencil-props="{ aspectRatio: 1 }"
+                        :canvas="{ width: 256, height: 256 }"
+                        class="h-full w-full"
+                    />
+                </div>
+
+                <div class="flex justify-end gap-3">
+                    <button
+                        type="button"
+                        class="rounded-lg border border-neutral-300 px-4 py-2 text-sm font-medium text-neutral-700 hover:bg-neutral-50"
+                        @click="emit('cancel')"
+                    >
+                        {{ $t('common.cancel') }}
+                    </button>
+                    <button
+                        type="button"
+                        class="rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white hover:bg-secondary-500"
+                        :disabled="cropping"
+                        @click="onConfirm"
+                    >
+                        {{ $t('common.confirm') }}
+                    </button>
+                </div>
+            </div>
+        </div>
+    </Teleport>
+</template>
+
+<script setup lang="ts">
+import { Cropper, CircleStencil } from 'vue-advanced-cropper'
+import 'vue-advanced-cropper/dist/style.css'
+
+const props = defineProps<{
+    imageFile: File
+}>()
+
+const emit = defineEmits<{
+    (e: 'crop', blob: Blob): void
+    (e: 'cancel'): void
+}>()
+
+const cropperRef = ref()
+const cropping = ref(false)
+const imageSrc = ref('')
+
+onMounted(() => {
+    imageSrc.value = URL.createObjectURL(props.imageFile)
+})
+
+onUnmounted(() => {
+    if (imageSrc.value) {
+        URL.revokeObjectURL(imageSrc.value)
+    }
+})
+
+async function onConfirm() {
+    cropping.value = true
+
+    try {
+        const { canvas } = cropperRef.value.getResult()
+
+        if (!canvas) return
+
+        const blob = await new Promise<Blob | null>((resolve) => {
+            canvas.toBlob(resolve, 'image/png')
+        })
+
+        if (blob) {
+            emit('crop', blob)
+        }
+    } finally {
+        cropping.value = false
+    }
+}
+</script>
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add frontend/components/user/AvatarCropper.vue
+git commit -m "feat(avatar) : add AvatarCropper modal with vue-advanced-cropper"
+```
+
+---
+
+## Task 6: Frontend — Profile page
+
+**Files:**
+- Create: `frontend/pages/profile.vue`
+- Modify: `frontend/middleware/auth.global.ts`
+
+- [ ] **Step 1: Create `frontend/pages/profile.vue`**
+
+```vue
+<template>
+    <div class="mx-auto max-w-lg px-4 py-10">
+        <h1 class="mb-8 text-2xl font-bold text-neutral-900">{{ $t('profile.title') }}</h1>
+
+        <div class="flex flex-col items-center gap-6 rounded-xl border border-neutral-200 bg-white p-8 shadow-sm">
+            <!-- Current avatar -->
+            <UserAvatar
+                v-if="auth.user"
+                :user="auth.user"
+                size="lg"
+            />
+
+            <p class="text-lg font-semibold text-neutral-800">{{ auth.user?.username }}</p>
+
+            <div class="flex gap-3">
+                <label
+                    class="cursor-pointer rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-secondary-500"
+                >
+                    {{ $t('profile.changeAvatar') }}
+                    <input
+                        type="file"
+                        accept="image/jpeg,image/png,image/webp,image/gif"
+                        class="hidden"
+                        @change="onFileSelect"
+                    />
+                </label>
+
+                <button
+                    v-if="auth.user?.avatarUrl"
+                    type="button"
+                    class="rounded-lg border border-red-300 px-4 py-2 text-sm font-medium text-red-600 hover:bg-red-50"
+                    :disabled="removing"
+                    @click="onRemove"
+                >
+                    {{ $t('profile.removeAvatar') }}
+                </button>
+            </div>
+        </div>
+
+        <!-- Crop modal -->
+        <AvatarCropper
+            v-if="selectedFile"
+            :image-file="selectedFile"
+            @crop="onCrop"
+            @cancel="selectedFile = null"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+const auth = useAuthStore()
+const { upload, remove } = useAvatarService()
+
+const selectedFile = ref<File | null>(null)
+const removing = ref(false)
+
+function onFileSelect(event: Event) {
+    const input = event.target as HTMLInputElement
+    const file = input.files?.[0]
+    if (file) {
+        selectedFile.value = file
+    }
+    input.value = ''
+}
+
+async function onCrop(blob: Blob) {
+    selectedFile.value = null
+    if (!auth.user) return
+
+    await upload(auth.user.id, blob)
+    await auth.refreshUser()
+}
+
+async function onRemove() {
+    if (!auth.user) return
+    removing.value = true
+
+    try {
+        await remove(auth.user.id)
+        await auth.refreshUser()
+    } finally {
+        removing.value = false
+    }
+}
+</script>
+```
+
+- [ ] **Step 2: Allow `/profile` for ROLE_CLIENT in middleware**
+
+In `frontend/middleware/auth.global.ts`, update the client redirect block to also allow `/profile`:
+
+Change:
+```typescript
+if (!isPortalRoute && !isLoginRoute) {
+```
+To:
+```typescript
+const isProfileRoute = to.path === '/profile'
+if (!isPortalRoute && !isLoginRoute && !isProfileRoute) {
+```
+
+- [ ] **Step 3: Add i18n keys**
+
+In `frontend/i18n/locales/fr.json`, add under a `"profile"` key:
+
+```json
+"profile": {
+    "title": "Mon profil",
+    "changeAvatar": "Changer l'avatar",
+    "removeAvatar": "Supprimer l'avatar",
+    "cropAvatar": "Recadrer l'avatar"
+}
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add frontend/pages/profile.vue frontend/middleware/auth.global.ts frontend/i18n/locales/fr.json
+git commit -m "feat(avatar) : add profile page with avatar upload and crop"
+```
+
+---
+
+## Task 7: Frontend — Replace initials everywhere
+
+**Files:**
+- Modify: `frontend/components/ui/AppTopNav.vue`
+- Modify: `frontend/components/task/TaskCard.vue`
+- Modify: `frontend/pages/projects/[id]/archives.vue`
+- Modify: `frontend/components/admin/AdminClientTicketTab.vue`
+
+- [ ] **Step 1: Update `AppTopNav.vue`**
+
+Replace the icon + username display (lines 12-14):
+
+```vue
+<Icon name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
+```
+
+With:
+
+```vue
+<UserAvatar v-if="user" :user="user" size="md" class="cursor-pointer" />
+<Icon v-else name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
+```
+
+Make "Mon profil" button navigate to `/profile`:
+
+```vue
+<button
+    type="button"
+    class="block w-full px-3 py-2 text-left hover:bg-neutral-100"
+    @click="navigateTo('/profile')"
+>
+    Mon profil
+</button>
+```
+
+- [ ] **Step 2: Update `TaskCard.vue`**
+
+Replace lines 47-59 (the assignee initials span + empty state):
+
+```vue
+<UserAvatar
+    v-if="task.assignee"
+    :user="task.assignee"
+    size="xs"
+    class="ml-auto"
+/>
+<span
+    v-else
+    class="ml-auto flex h-5 w-5 items-center justify-center rounded-full bg-neutral-200 text-neutral-400"
+>
+    <Icon name="mdi:account-outline" size="14" />
+</span>
+```
+
+- [ ] **Step 3: Update `archives.vue`**
+
+Replace lines 49-55 (the assignee initials span):
+
+```vue
+<UserAvatar
+    v-if="task.assignee"
+    :user="task.assignee"
+    size="xs"
+/>
+```
+
+- [ ] **Step 4: Update `AdminClientTicketTab.vue`**
+
+Replace the submitter `<td>` at line 82. The `getSubmitterName` function returns a username string. We need to look up the full user to get `avatarUrl`. Modify the function and display:
+
+Change the `<td>`:
+```vue
+<td class="px-3 py-3 text-neutral-600">
+    <div class="flex items-center gap-2">
+        <UserAvatar
+            v-if="getSubmitterUser(ticket.submittedBy)"
+            :user="getSubmitterUser(ticket.submittedBy)!"
+            size="sm"
+        />
+        {{ getSubmitterName(ticket.submittedBy) }}
+    </div>
+</td>
+```
+
+Add helper function:
+```typescript
+function getSubmitterUser(iri: string | null): UserData | undefined {
+    if (!iri) return undefined
+    const match = iri.match(/\/api\/users\/(\d+)/)
+    if (!match) return undefined
+    const id = Number(match[1])
+    return users.value.find(u => u.id === id)
+}
+```
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add frontend/components/ui/AppTopNav.vue frontend/components/task/TaskCard.vue frontend/pages/projects/[id]/archives.vue frontend/components/admin/AdminClientTicketTab.vue
+git commit -m "feat(avatar) : replace initials with UserAvatar component everywhere"
+```
+
+---
+
+## Task 8: Manual testing
+
+- [ ] **Step 1: Rebuild and test**
+
+```bash
+make dev-nuxt
+```
+
+- [ ] **Step 2: Test flow**
+
+1. Login as `admin` / `admin`
+2. Navigate to profile via header dropdown → "Mon profil"
+3. Upload an image → verify crop modal appears with circular stencil
+4. Confirm crop → verify avatar appears on profile page
+5. Check header — avatar should replace the icon
+6. Navigate to a project board — assignee cards should show avatar
+7. Navigate to archives — same check
+8. Go to admin ticket tab — submitter should show avatar + name
+9. Remove avatar → verify initials return everywhere
+10. Login as `client-liot` / `client` → verify profile page accessible from portal
+
+- [ ] **Step 3: Final commit if any fixes needed**
--- a/docs/superpowers/specs/2026-03-15-user-avatar-design.md
+++ b/docs/superpowers/specs/2026-03-15-user-avatar-design.md
@@ -0,0 +1,112 @@
+# User Avatar — Design Spec
+
+## Goal
+
+Allow users to upload a profile avatar image (with client-side circular crop) that replaces initials everywhere in the app.
+
+## Backend
+
+### Entity Changes
+
+**User** — add nullable field:
+- `avatarFileName: ?string` (length 255) — UUID-based filename stored on disk
+
+### Storage
+
+- Directory: `var/uploads/avatars/`
+- Parameter in `services.yaml`: `avatar_upload_dir`
+
+### Endpoints
+
+All under `/api/users/{id}/avatar`:
+
+| Method | Description | Auth |
+|--------|-------------|------|
+| `POST` | Upload avatar (multipart file) | Owner or ROLE_ADMIN |
+| `GET` | Serve avatar image (inline) | ROLE_USER or ROLE_CLIENT |
+| `DELETE` | Remove avatar | Owner or ROLE_ADMIN |
+
+**POST** accepts a single `file` field. Validates: image MIME (jpeg, png, webp, gif), max 5 MB. Stores with UUID filename, updates `avatarFileName`. Deletes previous file if exists.
+
+**GET** returns the image with proper `Content-Type`. Returns 404 if no avatar.
+
+**DELETE** removes file from disk, sets `avatarFileName` to null.
+
+These are custom Symfony controllers (not API Platform resources) under `/api/` with `priority: 1`.
+
+### Serialization
+
+Add a virtual `avatarUrl` field to User serialization (group `user:read`):
+- If `avatarFileName` is set: `/api/users/{id}/avatar`
+- If null: `null`
+
+This way the frontend knows if an avatar exists from any user payload.
+
+### Migration
+
+- Add `avatar_file_name` column (VARCHAR 255, nullable) to `user` table.
+
+## Frontend
+
+### New Components
+
+**`UserAvatar.vue`** (`frontend/components/user/UserAvatar.vue`):
+- Props: `user: { id: number, username: string, avatarUrl?: string | null }`, `size: 'xs' | 'sm' | 'md' | 'lg'`
+- Sizes: xs=20px, sm=24px, md=32px, lg=48px
+- If `avatarUrl`: `<img>` rounded-full, object-cover
+- Else: initials badge (current bg-primary-500 style), 2 first chars of username uppercased
+- Handles `@error` on img to fallback to initials (broken image)
+
+**`AvatarCropper.vue`** (`frontend/components/user/AvatarCropper.vue`):
+- Uses `vue-advanced-cropper` with `CircleStencil`
+- Props: `imageFile: File`
+- Emits: `crop(blob: Blob)`, `cancel`
+- Fixed output size: 256x256px
+- Modal overlay with crop area + confirm/cancel buttons
+
+### New Page
+
+**`/profile`** (`frontend/pages/profile.vue`):
+- Shows current avatar (large) with "Change" button
+- File input triggers AvatarCropper modal
+- On confirm: POST blob to `/api/users/{id}/avatar`
+- On success: refresh auth store user data
+- "Remove avatar" button if avatar exists
+- Accessible from "Mon profil" button in AppTopNav dropdown
+
+### New Service
+
+**`frontend/services/avatar.ts`**:
+- `upload(userId: number, file: Blob): Promise<void>` — POST multipart
+- `remove(userId: number): Promise<void>` — DELETE
+- `getUrl(userId: number): string` — returns URL path
+
+### DTO Update
+
+**`UserData`** — add: `avatarUrl?: string | null`
+
+### Replacement Points
+
+Replace initials/icon with `<UserAvatar>` in:
+
+| File | Current display | Size |
+|------|----------------|------|
+| `TaskCard.vue:48-53` | Initials badge (h-5 w-5) | xs |
+| `archives.vue:50-55` | Initials badge (h-5 w-5) | xs |
+| `AppTopNav.vue:13` | `mdi:account-circle-outline` icon | md |
+| `AdminClientTicketTab.vue` | Username text for submitter | sm |
+| `ClientTicketDetailModal.vue` | submittedBy display | sm |
+
+### Auth Store
+
+After avatar upload/delete, re-fetch current user data so `avatarUrl` updates everywhere reactively.
+
+## Dependencies
+
+- `vue-advanced-cropper` — npm install in frontend/
+
+## Out of Scope
+
+- Server-side image processing/resize
+- Multiple image formats conversion
+- Avatar for clients (entities), only users
--- a/frontend/components/admin/AdminBookStackTab.vue
+++ b/frontend/components/admin/AdminBookStackTab.vue
@@ -10,15 +10,13 @@
                input-class="w-full"
            />

-            <div>
-                <MalioInputText
-                    v-model="form.tokenId"
-                    :label="$t('bookstack.settings.tokenId')"
-                    :placeholder="$t('bookstack.settings.tokenIdPlaceholder')"
-                    input-class="w-full"
-                    type="password"
-                />
-            </div>
+            <MalioInputText
+                v-model="form.tokenId"
+                :label="$t('bookstack.settings.tokenId')"
+                :placeholder="$t('bookstack.settings.tokenIdPlaceholder')"
+                input-class="w-full"
+                type="password"
+            />

            <div>
                <MalioInputText
--- a/frontend/components/admin/AdminClientTicketTab.vue
+++ b/frontend/components/admin/AdminClientTicketTab.vue
@@ -79,7 +79,16 @@
                            </span>
                        </td>
                        <td class="px-3 py-3 text-neutral-600">{{ getProjectName(ticket.project) }}</td>
-                        <td class="px-3 py-3 text-neutral-600">{{ getSubmitterName(ticket.submittedBy) }}</td>
+                        <td class="px-3 py-3 text-neutral-600">
+                            <div class="flex items-center gap-2">
+                                <UserAvatar
+                                    v-if="getSubmitterUser(ticket.submittedBy)"
+                                    :user="getSubmitterUser(ticket.submittedBy)!"
+                                    size="sm"
+                                />
+                                {{ getSubmitterName(ticket.submittedBy) }}
+                            </div>
+                        </td>
                        <td class="px-3 py-3 text-neutral-400">{{ formatDate(ticket.createdAt) }}</td>
                        <td class="px-3 py-3">
                            <div class="flex items-center gap-2">
@@ -216,7 +225,7 @@ const { t } = useI18n()
 const clientTicketService = useClientTicketService()
 const projectService = useProjectService()
 const userService = useUserService()
-const { typeBadgeClass, statusBadgeClass, formatDate } = useClientTicketHelpers()
+const { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions } = useClientTicketHelpers()

 const tickets = ref<ClientTicket[]>([])
 const projects = ref<Project[]>([])
@@ -261,19 +270,7 @@ const detailTicket = ref<ClientTicket | null>(null)

 const availableStatusTransitions = computed(() => {
    if (!statusTarget.value) return []
-    const current = statusTarget.value.status
-    const allStatuses: { label: string; value: ClientTicketStatus }[] = [
-        { label: t('clientTicket.status.new'), value: 'new' },
-        { label: t('clientTicket.status.in_progress'), value: 'in_progress' },
-        { label: t('clientTicket.status.done'), value: 'done' },
-        { label: t('clientTicket.status.rejected'), value: 'rejected' },
-    ]
-    // Filter out forbidden transitions
-    return allStatuses.filter(s => {
-        if (s.value === current) return false
-        if ((current === 'done' || current === 'rejected') && s.value === 'new') return false
-        return true
-    })
+    return getAvailableStatusTransitions(statusTarget.value.status, t)
 })

 function getProjectName(iri: string): string {
@@ -291,6 +288,14 @@ function getSubmitterName(iri: string | null): string {
    return users.value.find(u => u.id === id)?.username ?? ''
 }

+function getSubmitterUser(iri: string | null): UserData | undefined {
+    if (!iri) return undefined
+    const match = iri.match(/\/api\/users\/(\d+)/)
+    if (!match) return undefined
+    const id = Number(match[1])
+    return users.value.find(u => u.id === id)
+}
+
 function openDetail(ticket: ClientTicket) {
    detailTicket.value = ticket
    detailOpen.value = true
--- a/frontend/components/client-ticket/ClientTicketDetailModal.vue
+++ b/frontend/components/client-ticket/ClientTicketDetailModal.vue
@@ -239,9 +239,12 @@ const canEdit = computed(() => {
    if (status === 'done' || status === 'rejected') return false
    const userId = auth.user?.id
    if (!userId) return false
-    const submittedByIri = props.ticket.submittedBy
-    if (!submittedByIri) return false
-    return submittedByIri === `/api/users/${userId}`
+    const sub = props.ticket.submittedBy
+    if (!sub) return false
+    // submittedBy can be an IRI string or an embedded object
+    if (typeof sub === 'string') return sub === `/api/users/${userId}`
+    if (typeof sub === 'object' && 'id' in sub) return (sub as any).id === userId
+    return false
 })

 function startEdit() {
--- a/frontend/components/client-ticket/ProjectClientTickets.vue
+++ b/frontend/components/client-ticket/ProjectClientTickets.vue
@@ -211,7 +211,7 @@ const props = defineProps<{

 const { t } = useI18n()
 const clientTicketService = useClientTicketService()
-const { typeBadgeClass, statusBadgeClass, formatDate } = useClientTicketHelpers()
+const { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions } = useClientTicketHelpers()

 const isOpen = ref(false)
 const isLoading = ref(false)
@@ -238,18 +238,7 @@ const isUpdatingStatus = ref(false)

 const availableStatusTransitions = computed(() => {
    if (!statusTarget.value) return []
-    const current = statusTarget.value.status
-    const allStatuses: { label: string; value: ClientTicketStatus }[] = [
-        { label: t('clientTicket.status.new'), value: 'new' },
-        { label: t('clientTicket.status.in_progress'), value: 'in_progress' },
-        { label: t('clientTicket.status.done'), value: 'done' },
-        { label: t('clientTicket.status.rejected'), value: 'rejected' },
-    ]
-    return allStatuses.filter(s => {
-        if (s.value === current) return false
-        if ((current === 'done' || current === 'rejected') && s.value === 'new') return false
-        return true
-    })
+    return getAvailableStatusTransitions(statusTarget.value.status, t)
 })

 async function loadTickets() {
--- a/frontend/components/project/ProjectGroupTab.vue
+++ b/frontend/components/project/ProjectGroupTab.vue
@@ -117,7 +117,7 @@ async function loadItems() {
        const [g, t, at] = await Promise.all([
            groupService.getByProject(props.projectId),
            taskService.getByProject(props.projectId),
-            taskService.getByProjectArchived(props.projectId),
+            taskService.getByProject(props.projectId, true),
        ])
        allGroups.value = g
        activeTasks.value = t
--- a/frontend/components/task/TaskCard.vue
+++ b/frontend/components/task/TaskCard.vue
@@ -44,13 +44,12 @@
            >
                {{ tag.label }}
            </span>
-            <span
+            <UserAvatar
                v-if="task.assignee"
-                class="ml-auto flex h-5 w-5 items-center justify-center rounded-full bg-primary-500 text-[10px] font-bold text-white"
-                :title="task.assignee.username"
-            >
-                {{ task.assignee.username.substring(0, 2).toUpperCase() }}
-            </span>
+                :user="task.assignee"
+                size="xs"
+                class="ml-auto"
+            />
            <span
                v-else
                class="ml-auto flex h-5 w-5 items-center justify-center rounded-full bg-neutral-200 text-neutral-400"
--- a/frontend/components/task/TaskDocumentList.vue
+++ b/frontend/components/task/TaskDocumentList.vue
@@ -28,12 +28,13 @@
                <!-- File info -->
                <div class="min-w-0 flex-1">
                    <p class="truncate text-xs font-medium text-neutral-700">{{ doc.originalName }}</p>
-                    <p class="text-xs text-neutral-400">{{ formatSize(doc.size) }}</p>
+                    <p class="text-xs text-neutral-400">{{ formatFileSize(doc.size) }}</p>
                </div>

                <!-- Delete button -->
                <button
                    v-if="isAdmin"
+                    type="button"
                    class="absolute right-1 top-1 hidden rounded p-0.5 text-neutral-400 transition-colors hover:bg-red-50 hover:text-red-500 group-hover:block"
                    @click.stop="$emit('delete', doc)"
                >
@@ -47,6 +48,7 @@
 <script setup lang="ts">
 import type { TaskDocument } from '~/services/dto/task-document'
 import { useTaskDocumentService } from '~/services/task-documents'
+import { formatFileSize } from '~/utils/format'

 defineProps<{
    documents: TaskDocument[]
@@ -72,9 +74,4 @@ function getIconForMime(mimeType: string): string {
    return 'heroicons:paper-clip'
 }

-function formatSize(bytes: number): string {
-    if (bytes < 1024) return `${bytes} o`
-    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} Ko`
-    return `${(bytes / (1024 * 1024)).toFixed(1)} Mo`
-}
 </script>
--- a/frontend/components/task/TaskDocumentPreview.vue
+++ b/frontend/components/task/TaskDocumentPreview.vue
@@ -56,7 +56,7 @@
                    <div v-else class="flex flex-col items-center gap-4 rounded-xl bg-white p-10">
                        <Icon name="heroicons:document" class="h-16 w-16 text-neutral-400" />
                        <p class="max-w-xs truncate text-lg font-medium text-neutral-700">{{ document.originalName }}</p>
-                        <p class="text-sm text-neutral-400">{{ formatSize(document.size) }}</p>
+                        <p class="text-sm text-neutral-400">{{ formatFileSize(document.size) }}</p>
                        <a
                            :href="downloadUrl"
                            download
@@ -77,6 +77,7 @@
 <script setup lang="ts">
 import type { TaskDocument } from '~/services/dto/task-document'
 import { useTaskDocumentService } from '~/services/task-documents'
+import { formatFileSize } from '~/utils/format'

 const props = defineProps<{
    document: TaskDocument | null
@@ -98,12 +99,6 @@ const downloadUrl = computed(() => props.document ? getDownloadUrl(props.documen
 const isImage = computed(() => props.document?.mimeType.startsWith('image/') ?? false)
 const isPdf = computed(() => props.document?.mimeType === 'application/pdf')

-function formatSize(bytes: number): string {
-    if (bytes < 1024) return `${bytes} o`
-    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} Ko`
-    return `${(bytes / (1024 * 1024)).toFixed(1)} Mo`
-}
-
 // Focus overlay for keyboard events
 watch(() => props.document, (doc) => {
    if (doc) {
--- a/frontend/components/task/TaskModal.vue
+++ b/frontend/components/task/TaskModal.vue
@@ -65,6 +65,20 @@
                            @blur="touched.title = true"
                        />

+                        <!-- Project select (create mode with project list) -->
+                        <div v-if="showProjectSelect" class="mt-4">
+                            <MalioSelect
+                                v-model="form.projectId"
+                                :options="projectOptions"
+                                label="Projet *"
+                                empty-option-label="Sélectionner un projet"
+                                min-width="w-full"
+                            />
+                            <p v-if="touched.project && !form.projectId" class="mt-1 text-xs text-red-500">
+                                Le projet est requis
+                            </p>
+                        </div>
+
                        <!-- Two-column selects -->
                        <div class="mt-4 grid grid-cols-1 gap-x-6 gap-y-4 sm:grid-cols-2">
                            <MalioSelect
@@ -154,7 +168,7 @@
                        />
                        <TaskDocumentList
                            v-if="isEditing && task"
-                            :documents="documents"
+                            :documents="localDocuments"
                            :is-admin="isAdmin"
                            @preview="openPreview"
                            @delete="handleDeleteDocument"
@@ -164,7 +178,7 @@
                        <TaskDocumentPreview
                            :document="previewDoc"
                            :has-prev="previewIndex > 0"
-                            :has-next="previewIndex < documents.length - 1"
+                            :has-next="previewIndex < localDocuments.length - 1"
                            @close="previewDoc = null"
                            @prev="prevPreview"
                            @next="nextPreview"
@@ -266,6 +280,8 @@ import type { TaskGroup } from '~/services/dto/task-group'
 import type { UserData } from '~/services/dto/user-data'
 import { useTaskService } from '~/services/tasks'

+import type { Project } from '~/services/dto/project'
+
 const props = defineProps<{
    modelValue: boolean
    task: Task | null
@@ -276,6 +292,7 @@ const props = defineProps<{
    tags: TaskTag[]
    groups: TaskGroup[]
    users: UserData[]
+    projects?: Project[]
 }>()

 const emit = defineEmits<{
@@ -289,6 +306,7 @@ const isOpen = computed({
 })

 function close() {
+    if (confirmDeleteDocOpen.value || confirmDeleteOpen.value) return
    isOpen.value = false
 }

@@ -317,10 +335,12 @@ const form = reactive({
    groupId: null as number | null,
    tagIds: [] as number[],
    clientTicketId: null as number | null,
+    projectId: null as number | null,
 })

 const touched = reactive({
    title: false,
+    project: false,
 })

 const statusOptions = computed(() =>
@@ -339,8 +359,22 @@ const userOptions = computed(() =>
    props.users.map(u => ({ label: u.username, value: u.id }))
 )

-const groupOptions = computed(() =>
-    props.groups.map(g => ({ label: g.title, value: g.id }))
+const groupOptions = computed(() => {
+    let filtered = props.groups
+    if (showProjectSelect.value && form.projectId) {
+        filtered = filtered.filter(g => g.project?.id === form.projectId)
+    }
+    return filtered.map(g => ({ label: g.title, value: g.id }))
+})
+
+const showProjectSelect = computed(() => !!props.projects?.length && !isEditing.value)
+
+const projectOptions = computed(() =>
+    (props.projects ?? []).map(p => ({ label: p.name, value: p.id }))
+)
+
+const resolvedProjectId = computed(() =>
+    showProjectSelect.value ? form.projectId : props.projectId
 )

 const canArchive = computed(() => {
@@ -384,18 +418,35 @@ function populateForm(task: Task | null) {
        form.groupId = null
        form.tagIds = []
        form.clientTicketId = null
+        form.projectId = null
    }
    touched.title = false
+    touched.project = false
 }

 watch(() => props.modelValue, async (open) => {
    if (open) {
+        confirmDeleteDocOpen.value = false
+        documentToDelete.value = null
        populateForm(props.task)
-        try {
-            clientTickets.value = await clientTicketService.getAll({ project: props.projectId })
-        } catch {
+        const pid = resolvedProjectId.value
+        if (pid) {
+            try {
+                clientTickets.value = await clientTicketService.getAll({ project: pid })
+            } catch {
+                clientTickets.value = []
+            }
+        } else {
            clientTickets.value = []
        }
+        if (props.task?.project?.giteaOwner && props.task?.project?.giteaRepo && !giteaUrl.value) {
+            try {
+                const settings = await getGiteaSettings()
+                giteaUrl.value = settings.url ?? ''
+            } catch {
+                // Gitea not available
+            }
+        }
    }
 })

@@ -405,17 +456,6 @@ watch(() => props.task, (task) => {
    }
 })

-watch(() => props.modelValue, async (open) => {
-    if (open && props.task?.project?.giteaOwner && props.task?.project?.giteaRepo && !giteaUrl.value) {
-        try {
-            const settings = await getGiteaSettings()
-            giteaUrl.value = settings.url ?? ''
-        } catch {
-            // Gitea not available
-        }
-    }
-})
-
 const { create, update, remove } = useTaskService()
 const { remove: removeDocument, getByTask: getDocumentsByTask } = useTaskDocumentService()
 const clientTicketService = useClientTicketService()
@@ -426,6 +466,22 @@ const clientTicketOptions = computed(() =>
    clientTickets.value.map(ct => ({ label: `CT-${String(ct.number).padStart(3, '0')} — ${ct.title}`, value: ct.id }))
 )

+// Reset group and reload client tickets when project changes in create mode
+watch(() => form.projectId, async (pid) => {
+    if (!showProjectSelect.value) return
+    form.groupId = null
+    form.clientTicketId = null
+    if (pid) {
+        try {
+            clientTickets.value = await clientTicketService.getAll({ project: pid })
+        } catch {
+            clientTickets.value = []
+        }
+    } else {
+        clientTickets.value = []
+    }
+})
+
 const authStore = useAuthStore()
 const isAdmin = computed(() => authStore.user?.roles?.includes('ROLE_ADMIN') ?? false)

@@ -440,7 +496,6 @@ function ticketStatusClass(status: string): string {
 }

 const localDocuments = ref<TaskDocument[]>([])
-const documents = computed(() => localDocuments.value)
 const previewDoc = ref<TaskDocument | null>(null)

 // Sync documents from task prop when modal opens or task changes
@@ -455,7 +510,7 @@ async function refreshDocuments() {

 const previewIndex = computed(() => {
    if (!previewDoc.value) return -1
-    return documents.value.findIndex(d => d.id === previewDoc.value!.id)
+    return localDocuments.value.findIndex(d => d.id === previewDoc.value!.id)
 })

 function openPreview(doc: TaskDocument) {
@@ -464,13 +519,13 @@ function openPreview(doc: TaskDocument) {

 function prevPreview() {
    if (previewIndex.value > 0) {
-        previewDoc.value = documents.value[previewIndex.value - 1]
+        previewDoc.value = localDocuments.value[previewIndex.value - 1]
    }
 }

 function nextPreview() {
-    if (previewIndex.value < documents.value.length - 1) {
-        previewDoc.value = documents.value[previewIndex.value + 1]
+    if (previewIndex.value < localDocuments.value.length - 1) {
+        previewDoc.value = localDocuments.value[previewIndex.value + 1]
    }
 }

@@ -542,7 +597,9 @@ async function handleUnarchive() {

 async function handleSubmit() {
    touched.title = true
+    touched.project = true
    if (!form.title.trim()) return
+    if (showProjectSelect.value && !form.projectId) return

    isSubmitting.value = true
    try {
@@ -554,7 +611,7 @@ async function handleSubmit() {
            priority: form.priorityId ? `/api/task_priorities/${form.priorityId}` : null,
            assignee: form.assigneeId ? `/api/users/${form.assigneeId}` : null,
            group: form.groupId ? `/api/task_groups/${form.groupId}` : null,
-            project: `/api/projects/${props.projectId}`,
+            project: `/api/projects/${resolvedProjectId.value}`,
            tags: form.tagIds.map(id => `/api/task_tags/${id}`),
            clientTicket: form.clientTicketId ? `/api/client_tickets/${form.clientTicketId}` : null,
        }
--- a/frontend/components/ui/AppTopNav.vue
+++ b/frontend/components/ui/AppTopNav.vue
@@ -10,14 +10,16 @@
      <div class="ml-auto flex items-center gap-4 text-xl text-white sm:gap-8">
        <NotificationBell />
        <div class="group relative flex gap-2 sm:gap-4">
-          <Icon name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
+          <UserAvatar v-if="user" :user="user" size="md" class="cursor-pointer" />
+          <Icon v-else name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
          <p class="hidden self-center cursor-pointer sm:block">{{ user?.username }}</p>
          <div class="invisible absolute right-0 top-full z-50 mt-2 w-44 rounded-md border border-neutral-200 bg-white py-1 text-sm text-neutral-800 opacity-0 shadow-lg transition-all group-hover:visible group-hover:opacity-100">
            <button
              type="button"
              class="block w-full px-3 py-2 text-left hover:bg-neutral-100"
+              @click="navigateTo('/profile')"
            >
-              Mon profil
+              {{ $t('profile.title') }}
            </button>
            <button
              type="button"
@@ -43,7 +45,7 @@ defineProps<{
 const auth = useAuthStore()
 const ui = useUiStore()

-const handleLogout = async () => {
+async function handleLogout() {
  await auth.logout()
  await navigateTo('/login')
 }
--- a/frontend/components/ui/ConfirmDeleteDocumentModal.vue
+++ b/frontend/components/ui/ConfirmDeleteDocumentModal.vue
@@ -2,7 +2,7 @@
    <Teleport v-if="modelValue" to="body">
        <Transition name="modal" appear>
            <div class="fixed inset-0 z-[70] flex items-center justify-center">
-                <div class="absolute inset-0 bg-black/30" @click="cancel" />
+                <div class="absolute inset-0 bg-black/30" @click.stop="cancel" />
                <div class="relative z-10 w-full max-w-md rounded-lg bg-white p-6 shadow-xl">
                    <h3 class="text-lg font-bold text-neutral-900">{{ $t('taskDocuments.confirmDeleteTitle') }}</h3>
                    <p class="mt-3 text-sm text-neutral-600">
--- a/frontend/components/ui/DateFilter.vue
+++ b/frontend/components/ui/DateFilter.vue
@@ -1,41 +1,57 @@
 <template>
    <div class="date-filter">
        <VueDatePicker
+            ref="datepicker"
            v-model="internalValue"
-            range
+            :week-picker="mode === 'week'"
            :enable-time-picker="false"
            :locale="frLocale"
-            :format="formatDate"
+            :format="formatDisplay"
            auto-apply
            :multi-calendars="false"
            position="left"
+            teleport
            @update:model-value="onUpdate"
        >
-            <template #dp-input="{ value, onInput, onEnter, onTab, onClear, openMenu }">
-                <div class="relative">
-                    <input
-                        :value="value"
-                        class="w-full cursor-pointer rounded-md border border-neutral-300 bg-white px-3 py-[7px] text-sm text-neutral-700 outline-none transition placeholder:text-neutral-400 focus:border-primary-500"
-                        :placeholder="placeholder || t('common.dateFilter')"
-                        readonly
-                        @click="openMenu"
-                        @input="onInput"
-                        @keydown.enter="onEnter"
-                        @keydown.tab="onTab"
-                    />
-                    <button
-                        v-if="value"
-                        class="absolute right-2 top-1/2 -translate-y-1/2 text-neutral-400 hover:text-neutral-600"
-                        @click.stop="onClear"
-                    >
-                        <Icon name="mdi:close-circle" size="16" />
-                    </button>
-                    <Icon
-                        v-else
-                        name="mdi:calendar"
-                        size="16"
-                        class="pointer-events-none absolute right-2 top-1/2 -translate-y-1/2 text-neutral-400"
-                    />
+            <template #trigger>
+                <div class="flex items-center gap-1">
+                    <div class="flex shrink-0 overflow-hidden rounded-md border border-neutral-300">
+                        <button
+                            class="px-2 py-[7px] text-xs font-medium transition"
+                            :class="mode === 'day' ? 'bg-primary-500 text-white' : 'text-neutral-500 hover:bg-neutral-100'"
+                            @click.stop="switchMode('day')"
+                        >
+                            {{ t('common.day') }}
+                        </button>
+                        <button
+                            class="px-2 py-[7px] text-xs font-medium transition"
+                            :class="mode === 'week' ? 'bg-primary-500 text-white' : 'text-neutral-500 hover:bg-neutral-100'"
+                            @click.stop="switchMode('week')"
+                        >
+                            {{ t('common.weekShort') }}
+                        </button>
+                    </div>
+                    <div class="relative cursor-pointer">
+                        <input
+                            :value="displayValue"
+                            class="w-full cursor-pointer rounded-md border border-neutral-300 bg-white px-3 py-[7px] pr-8 text-sm text-neutral-700 outline-none transition placeholder:text-neutral-400 focus:border-primary-500"
+                            :placeholder="t('common.dateFilter')"
+                            readonly
+                        />
+                        <button
+                            v-if="internalValue"
+                            class="absolute right-2 top-1/2 -translate-y-1/2 text-neutral-400 hover:text-neutral-600"
+                            @click.stop="onClear"
+                        >
+                            <Icon name="mdi:close-circle" size="16" />
+                        </button>
+                        <Icon
+                            v-else
+                            name="mdi:calendar"
+                            size="16"
+                            class="pointer-events-none absolute right-2 top-1/2 -translate-y-1/2 text-neutral-400"
+                        />
+                    </div>
                </div>
            </template>

@@ -75,48 +91,87 @@ const emit = defineEmits<{
    'update:modelValue': [value: Date | [Date, Date] | null]
 }>()

-const internalValue = ref<Date[] | null>(null)
+const datepicker = ref<InstanceType<typeof VueDatePicker> | null>(null)
+const mode = ref<'day' | 'week'>('week')
+const internalValue = ref<Date | Date[] | null>(null)

-function formatDate(dates: Date[]): string {
-    if (!dates || dates.length === 0) return ''
-    if (dates.length === 1) return formatSingleDate(dates[0])
-    if (isSameDay(dates[0], dates[1])) return formatSingleDate(dates[0])
-    return `${formatSingleDate(dates[0])} - ${formatSingleDate(dates[1])}`
+const displayValue = computed(() => {
+    if (!internalValue.value) return ''
+    if (internalValue.value instanceof Date) {
+        return formatFullDate(internalValue.value)
+    }
+    if (Array.isArray(internalValue.value) && internalValue.value.length >= 2) {
+        const [start, end] = internalValue.value
+        if (!start || !end) return ''
+        return `${formatShortDate(start)} - ${formatShortDate(end)}`
+    }
+    return ''
+})
+
+function formatDisplay(dates: Date | Date[]): string {
+    if (!dates) return ''
+    if (dates instanceof Date) return formatFullDate(dates)
+    if (!Array.isArray(dates)) return ''
+    const valid = dates.filter((d): d is Date => d instanceof Date && !isNaN(d.getTime()))
+    if (valid.length === 0) return ''
+    if (valid.length === 1) return formatFullDate(valid[0])
+    return `${formatShortDate(valid[0])} - ${formatShortDate(valid[1])}`
 }

-function formatSingleDate(d: Date): string {
+function formatFullDate(d: Date): string {
+    if (!d || !(d instanceof Date) || isNaN(d.getTime())) return ''
    const day = String(d.getDate()).padStart(2, '0')
    const month = String(d.getMonth() + 1).padStart(2, '0')
    const year = d.getFullYear()
    return `${day}/${month}/${year}`
 }

-function isSameDay(a: Date, b: Date): boolean {
-    return a.getFullYear() === b.getFullYear()
-        && a.getMonth() === b.getMonth()
-        && a.getDate() === b.getDate()
+function formatShortDate(d: Date): string {
+    if (!d || !(d instanceof Date) || isNaN(d.getTime())) return ''
+    const day = String(d.getDate()).padStart(2, '0')
+    const month = String(d.getMonth() + 1).padStart(2, '0')
+    return `${day}/${month}`
 }

-function onUpdate(value: Date[] | null) {
-    if (!value || value.length === 0) {
+function switchMode(newMode: 'day' | 'week') {
+    if (mode.value === newMode) return
+    mode.value = newMode
+    internalValue.value = null
+    emit('update:modelValue', null)
+}
+
+function onUpdate(value: Date | Date[] | null) {
+    if (!value) {
        emit('update:modelValue', null)
        return
    }
-    if (value.length === 2 && isSameDay(value[0], value[1])) {
-        emit('update:modelValue', value[0])
-    } else if (value.length === 2) {
-        emit('update:modelValue', [value[0], value[1]])
+
+    if (mode.value === 'week' && Array.isArray(value)) {
+        const valid = value.filter((d): d is Date => d instanceof Date && !isNaN(d.getTime()))
+        if (valid.length >= 2) {
+            emit('update:modelValue', [valid[0], valid[1]])
+        }
+    } else if (mode.value === 'day' && value instanceof Date) {
+        emit('update:modelValue', value)
    }
 }

+function onClear() {
+    internalValue.value = null
+    datepicker.value?.closeMenu()
+    emit('update:modelValue', null)
+}
+
 function selectToday() {
+    mode.value = 'day'
    const today = new Date()
    today.setHours(0, 0, 0, 0)
-    internalValue.value = [today, today]
+    internalValue.value = today
    emit('update:modelValue', today)
 }

 function selectThisWeek() {
+    mode.value = 'week'
    const now = new Date()
    const day = now.getDay()
    const monday = new Date(now)
@@ -135,7 +190,7 @@ watch(() => props.modelValue, (val) => {
    } else if (Array.isArray(val)) {
        internalValue.value = [...val]
    } else {
-        internalValue.value = [val, val]
+        internalValue.value = val
    }
 }, { immediate: true })
 </script>
--- a/frontend/components/user/AvatarCropper.vue
+++ b/frontend/components/user/AvatarCropper.vue
@@ -0,0 +1,88 @@
+<template>
+    <Teleport to="body">
+        <div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
+            <div class="w-full max-w-md rounded-xl bg-white p-6 shadow-2xl">
+                <h3 class="mb-4 text-lg font-bold text-neutral-900">
+                    {{ $t('profile.cropAvatar') }}
+                </h3>
+
+                <div class="mx-auto mb-4 h-72 w-72">
+                    <Cropper
+                        ref="cropperRef"
+                        :src="imageSrc"
+                        :stencil-component="CircleStencil"
+                        :stencil-props="{ aspectRatio: 1 }"
+                        :canvas="{ width: 256, height: 256 }"
+                        class="h-full w-full"
+                    />
+                </div>
+
+                <div class="flex justify-end gap-3">
+                    <button
+                        type="button"
+                        class="rounded-lg border border-neutral-300 px-4 py-2 text-sm font-medium text-neutral-700 hover:bg-neutral-50"
+                        @click="emit('cancel')"
+                    >
+                        {{ $t('common.cancel') }}
+                    </button>
+                    <button
+                        type="button"
+                        class="rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white hover:bg-secondary-500"
+                        :disabled="cropping"
+                        @click="onConfirm"
+                    >
+                        {{ $t('common.confirm') }}
+                    </button>
+                </div>
+            </div>
+        </div>
+    </Teleport>
+</template>
+
+<script setup lang="ts">
+import { Cropper, CircleStencil } from 'vue-advanced-cropper'
+import 'vue-advanced-cropper/dist/style.css'
+
+const props = defineProps<{
+    imageFile: File
+}>()
+
+const emit = defineEmits<{
+    (e: 'crop', blob: Blob): void
+    (e: 'cancel'): void
+}>()
+
+const cropperRef = ref()
+const cropping = ref(false)
+const imageSrc = ref('')
+
+onMounted(() => {
+    imageSrc.value = URL.createObjectURL(props.imageFile)
+})
+
+onUnmounted(() => {
+    if (imageSrc.value) {
+        URL.revokeObjectURL(imageSrc.value)
+    }
+})
+
+async function onConfirm() {
+    cropping.value = true
+
+    try {
+        const { canvas } = cropperRef.value.getResult()
+
+        if (!canvas) return
+
+        const blob = await new Promise<Blob | null>((resolve) => {
+            canvas.toBlob(resolve, 'image/png')
+        })
+
+        if (blob) {
+            emit('crop', blob)
+        }
+    } finally {
+        cropping.value = false
+    }
+}
+</script>
--- a/frontend/components/user/UserAvatar.vue
+++ b/frontend/components/user/UserAvatar.vue
@@ -0,0 +1,55 @@
+<template>
+    <span
+        class="inline-flex shrink-0 items-center justify-center rounded-full"
+        :class="sizeClasses"
+        :title="user.username"
+    >
+        <img
+            v-if="user.avatarUrl && !imgError"
+            :src="user.avatarUrl"
+            :alt="user.username"
+            class="h-full w-full rounded-full object-cover"
+            @error="imgError = true"
+        />
+        <span
+            v-else
+            class="flex h-full w-full items-center justify-center rounded-full bg-primary-500 font-bold text-white"
+            :class="textSizeClass"
+        >
+            {{ user.username.substring(0, 2).toUpperCase() }}
+        </span>
+    </span>
+</template>
+
+<script setup lang="ts">
+const props = defineProps<{
+    user: { id?: number; username: string; avatarUrl?: string | null }
+    size?: 'xs' | 'sm' | 'md' | 'lg'
+}>()
+
+const imgError = ref(false)
+
+watch(() => props.user.avatarUrl, () => {
+    imgError.value = false
+})
+
+const sizeClasses = computed(() => {
+    const map = {
+        xs: 'h-5 w-5',
+        sm: 'h-6 w-6',
+        md: 'h-8 w-8',
+        lg: 'h-12 w-12',
+    }
+    return map[props.size ?? 'sm']
+})
+
+const textSizeClass = computed(() => {
+    const map = {
+        xs: 'text-[10px]',
+        sm: 'text-xs',
+        md: 'text-sm',
+        lg: 'text-base',
+    }
+    return map[props.size ?? 'sm']
+})
+</script>
--- a/frontend/components/user/UserDrawer.vue
+++ b/frontend/components/user/UserDrawer.vue
@@ -121,7 +121,7 @@ const clientOptions = computed(() => [
 const filteredProjects = computed(() => {
    if (form.clientId === null) return []
    return allProjects.value.filter(
-        (p) => p.client !== null && p.client.id === form.clientId,
+        (p) => p.client && typeof p.client === 'object' && 'id' in p.client && p.client.id === form.clientId,
    )
 })

--- a/frontend/composables/useApi.ts
+++ b/frontend/composables/useApi.ts
@@ -29,13 +29,14 @@ export type ApiFetchOptions<ResponseType extends 'json' | 'blob'> =
    toastSuccessKey?: string
  }

-export const useApi = (): ApiClient => {
+let isHandlingUnauthorized = false
+
+export function useApi(): ApiClient {
  const config = useRuntimeConfig()
  const baseURL = config.public.apiBase || '/api'
  const toast = useToast()
  const auth = useAuthStore()
  const nuxtApp = useNuxtApp()
-  let isHandlingUnauthorized = false
  const i18n = nuxtApp.$i18n as
    | {
        t: (key: string) => string
@@ -45,7 +46,7 @@ export const useApi = (): ApiClient => {
  const t = (key: string) => (i18n?.t ? String(i18n.t(key)) : key)
  const te = (key: string) => (i18n?.te ? i18n.te(key) : false)

-  const extractErrorMessage = (error: unknown, responseData?: unknown): string => {
+  function extractErrorMessage(error: unknown, responseData?: unknown): string {
    const data = responseData ?? (error as FetchError)?.data

    if (typeof data === 'string') {
@@ -169,11 +170,11 @@ export const useApi = (): ApiClient => {
    }
  })

-  const request = <T>(
+  function request<T>(
    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
    url: string,
    options: ApiFetchOptions<'json'> = {}
-  ) => {
+  ) {
    const needsJsonBody = method === 'POST' || method === 'PUT'
    const needsMergePatch = method === 'PATCH'

--- a/frontend/composables/useAppVersion.ts
+++ b/frontend/composables/useAppVersion.ts
@@ -1,8 +1,8 @@
-export const useAppVersion = () => {
+export function useAppVersion() {
    const api = useApi()
    const version = useState<string | null>('app-version', () => null)

-    const load = async () => {
+    async function load(): Promise<string | null> {
        if (version.value) {
            return version.value
        }
--- a/frontend/composables/useAvatarService.ts
+++ b/frontend/composables/useAvatarService.ts
@@ -0,0 +1,24 @@
+export function useAvatarService() {
+    const api = useApi()
+
+    async function upload(userId: number, file: Blob): Promise<{ avatarUrl: string }> {
+        const formData = new FormData()
+        formData.append('file', file, 'avatar.png')
+
+        return $fetch(`/api/users/${userId}/avatar`, {
+            method: 'POST',
+            body: formData,
+            credentials: 'include',
+        })
+    }
+
+    async function remove(userId: number): Promise<void> {
+        await api.delete(`/users/${userId}/avatar`)
+    }
+
+    function getUrl(userId: number): string {
+        return `/api/users/${userId}/avatar`
+    }
+
+    return { upload, remove, getUrl }
+}
--- a/frontend/composables/useClientTicketHelpers.ts
+++ b/frontend/composables/useClientTicketHelpers.ts
@@ -1,3 +1,5 @@
+import type { ClientTicketStatus } from '~/services/dto/client-ticket'
+
 export function useClientTicketHelpers() {
    function typeBadgeClass(type: string): string {
        switch (type) {
@@ -25,5 +27,22 @@ export function useClientTicketHelpers() {
        })
    }

-    return { typeBadgeClass, statusBadgeClass, formatDate }
+    function getAvailableStatusTransitions(
+        current: ClientTicketStatus,
+        t: (key: string) => string,
+    ): { label: string; value: ClientTicketStatus }[] {
+        const allStatuses: { label: string; value: ClientTicketStatus }[] = [
+            { label: t('clientTicket.status.new'), value: 'new' },
+            { label: t('clientTicket.status.in_progress'), value: 'in_progress' },
+            { label: t('clientTicket.status.done'), value: 'done' },
+            { label: t('clientTicket.status.rejected'), value: 'rejected' },
+        ]
+        return allStatuses.filter(s => {
+            if (s.value === current) return false
+            if ((current === 'done' || current === 'rejected') && s.value === 'new') return false
+            return true
+        })
+    }
+
+    return { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions }
 }
--- a/frontend/i18n/locales/fr.json
+++ b/frontend/i18n/locales/fr.json
@@ -112,7 +112,8 @@
        "allEfforts": "Tous les efforts",
        "allAssignees": "Tous",
        "noTasks": "Aucune tâche",
-        "backlog": "Backlog"
+        "backlog": "Backlog",
+        "createTask": "Créer une tâche"
    },
    "dashboard": {
        "title": "Tableau de bord",
@@ -172,7 +173,9 @@
        "dateFilter": "Date",
        "today": "Aujourd'hui",
        "thisWeek": "Cette semaine",
-        "clear": "Effacer"
+        "clear": "Effacer",
+        "day": "Jour",
+        "weekShort": "Sem."
    },
    "gitea": {
        "settings": {
@@ -235,6 +238,7 @@
        "new": "Nouveau ticket",
        "created": "Ticket créé avec succès.",
        "deleted": "Ticket supprimé avec succès.",
+        "updated": "Ticket mis à jour avec succès.",
        "statusUpdated": "Statut du ticket mis à jour.",
        "type": {
            "bug": "Bug",
@@ -288,6 +292,12 @@
            "days": "Il y a {n}j"
        }
    },
+    "profile": {
+        "title": "Mon profil",
+        "changeAvatar": "Changer l'avatar",
+        "removeAvatar": "Supprimer l'avatar",
+        "cropAvatar": "Recadrer l'avatar"
+    },
    "bookstack": {
        "settings": {
            "title": "Configuration BookStack",
--- a/frontend/layouts/auth.vue
+++ b/frontend/layouts/auth.vue
@@ -5,7 +5,3 @@
    </main>
  </div>
 </template>
-
-<script setup lang="ts">
-const { version } = useAppVersion()
-</script>
--- a/frontend/layouts/default.vue
+++ b/frontend/layouts/default.vue
@@ -123,9 +123,9 @@
                </div>
            </aside>

-            <div class="h-full flex-1 flex flex-col min-h-0">
+            <div class="h-full flex-1 flex flex-col min-h-0 min-w-0">
                <AppTopNav :user="auth.user" />
-                <main class="flex flex-1 flex-col overflow-y-auto bg-white px-4 pb-24 sm:px-8 lg:px-16">
+                <main class="flex flex-1 flex-col overflow-y-auto overflow-x-hidden bg-white px-4 pb-24 sm:px-8 lg:px-16">
                    <div aria-hidden="true" class="pointer-events-none sticky top-0 z-30 h-8 flex-shrink-0 bg-white sm:h-12" />
                    <slot/>
                </main>
@@ -242,11 +242,6 @@ function onCompleteSaved() {
        timerStore.clearPendingEntry()
    })
 }
-
-const handleLogout = async () => {
-    await auth.logout()
-    await navigateTo('/login')
-}
 </script>

 <style scoped>
--- a/frontend/middleware/auth.global.ts
+++ b/frontend/middleware/auth.global.ts
@@ -10,17 +10,16 @@ export default defineNuxtRouteMiddleware(async (to) => {
        return navigateTo('/login')
    }

+    const isClientOnly = auth.isAuthenticated
+        && auth.user?.roles?.includes('ROLE_CLIENT')
+        && !auth.user?.roles?.includes('ROLE_ADMIN')
+
    if (isLogin && auth.isAuthenticated) {
-        const isClientOnly = auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN')
        return navigateTo(isClientOnly ? '/portal' : '/')
    }

-    // ROLE_CLIENT without ROLE_ADMIN: redirect to /portal, block internal pages
-    if (auth.isAuthenticated && auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN')) {
-        const isPortalRoute = to.path.startsWith('/portal')
-        const isLoginRoute = to.path === '/login'
-        if (!isPortalRoute && !isLoginRoute) {
-            return navigateTo('/portal')
-        }
+    const isProfileRoute = to.path === '/profile'
+    if (isClientOnly && !to.path.startsWith('/portal') && !isProfileRoute) {
+        return navigateTo('/portal')
    }
 })
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -18,6 +18,7 @@
                "nuxt-toast": "^1.4.0",
                "pinia": "^3.0.4",
                "vue": "^3.5.29",
+                "vue-advanced-cropper": "^2.8.9",
                "vue-chartjs": "^5.3.3",
                "vue-router": "^4.6.4"
            }
@@ -6789,6 +6790,12 @@
                "consola": "^3.2.3"
            }
        },
+        "node_modules/classnames": {
+            "version": "2.5.1",
+            "resolved": "https://registry.npmjs.org/classnames/-/classnames-2.5.1.tgz",
+            "integrity": "sha512-saHYOzhIQs6wy2sVxTM6bUDsQO4F50V9RQ22qBpEdCW+I+/Wmke2HOl6lS6dTpdxVhb88/I6+Hs+438c3lfUow==",
+            "license": "MIT"
+        },
        "node_modules/clipboardy": {
            "version": "4.0.0",
            "resolved": "https://registry.npmjs.org/clipboardy/-/clipboardy-4.0.0.tgz",
@@ -7301,6 +7308,12 @@
                }
            }
        },
+        "node_modules/debounce": {
+            "version": "1.2.1",
+            "resolved": "https://registry.npmjs.org/debounce/-/debounce-1.2.1.tgz",
+            "integrity": "sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug==",
+            "license": "MIT"
+        },
        "node_modules/debug": {
            "version": "4.4.3",
            "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -7578,6 +7591,12 @@
            "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
            "license": "MIT"
        },
+        "node_modules/easy-bem": {
+            "version": "1.1.1",
+            "resolved": "https://registry.npmjs.org/easy-bem/-/easy-bem-1.1.1.tgz",
+            "integrity": "sha512-GJRqdiy2h+EXy6a8E6R+ubmqUM08BK0FWNq41k24fup6045biQ8NXxoXimiwegMQvFFV3t1emADdGNL1TlS61A==",
+            "license": "MIT"
+        },
        "node_modules/ee-first": {
            "version": "1.1.1",
            "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
@@ -13869,6 +13888,24 @@
                }
            }
        },
+        "node_modules/vue-advanced-cropper": {
+            "version": "2.8.9",
+            "resolved": "https://registry.npmjs.org/vue-advanced-cropper/-/vue-advanced-cropper-2.8.9.tgz",
+            "integrity": "sha512-1jc5gO674kVGpJKekoaol6ZlwaF5VYDLSBwBOUpViW0IOrrRsyLw6XNszjEqgbavvqinlKNS6Kqlom3B5M72Tw==",
+            "license": "MIT",
+            "dependencies": {
+                "classnames": "^2.2.6",
+                "debounce": "^1.2.0",
+                "easy-bem": "^1.0.2"
+            },
+            "engines": {
+                "node": ">=8",
+                "npm": ">=5"
+            },
+            "peerDependencies": {
+                "vue": "^3.0.0"
+            }
+        },
        "node_modules/vue-bundle-renderer": {
            "version": "2.2.0",
            "resolved": "https://registry.npmjs.org/vue-bundle-renderer/-/vue-bundle-renderer-2.2.0.tgz",
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -22,6 +22,7 @@
        "nuxt-toast": "^1.4.0",
        "pinia": "^3.0.4",
        "vue": "^3.5.29",
+        "vue-advanced-cropper": "^2.8.9",
        "vue-chartjs": "^5.3.3",
        "vue-router": "^4.6.4"
    }
--- a/frontend/pages/login.vue
+++ b/frontend/pages/login.vue
@@ -48,7 +48,6 @@ useHead({
    title: 'Connexion'
 })

-const router = useRouter()
 const auth = useAuthStore()
 const {version} = useAppVersion()

@@ -56,7 +55,7 @@ const username = ref('')
 const password = ref('')
 const isSubmitting = ref(false)

-const handleSubmit = async () => {
+async function handleSubmit() {
    if (isSubmitting.value) return

    isSubmitting.value = true
@@ -64,7 +63,7 @@ const handleSubmit = async () => {
        await auth.login(username.value, password.value)

        const isClient = auth.user?.roles?.includes('ROLE_CLIENT') ?? false
-        await router.push(isClient ? '/portal' : '/')
+        await navigateTo(isClient ? '/portal' : '/')
    } finally {
        isSubmitting.value = false
    }
--- a/frontend/pages/my-tasks.vue
+++ b/frontend/pages/my-tasks.vue
@@ -214,6 +214,11 @@ async function onDropBacklog(event: DragEvent) {
 }

 // Modal
+function openTaskCreate() {
+    selectedTask.value = null
+    taskModalOpen.value = true
+}
+
 function openTaskEdit(task: Task) {
    selectedTask.value = task
    taskModalOpen.value = true
@@ -229,28 +234,37 @@ onMounted(() => {
 </script>

 <template>
-    <div>
+    <div class="min-w-0">
        <!-- Header + Filters -->
        <div class="sticky top-8 z-20 bg-white pb-4 sm:top-12">
            <div class="flex items-center justify-between gap-3">
                <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">{{ $t('myTasks.title') }}</h1>
-                <div class="flex gap-1">
+                <div class="flex items-center gap-2">
                    <button
-                        class="rounded-lg p-2 transition-colors"
-                        :class="viewMode === 'kanban' ? 'bg-primary-500 text-white' : 'text-neutral-400 hover:text-primary-500'"
-                        :title="$t('myTasks.viewKanban')"
-                        @click="viewMode = 'kanban'"
+                        class="flex items-center gap-1.5 rounded-lg bg-primary-500 px-3 py-1.5 text-sm font-semibold text-white transition-colors hover:bg-secondary-500"
+                        @click="openTaskCreate"
                    >
-                        <Icon name="mdi:view-column-outline" size="20" />
-                    </button>
-                    <button
-                        class="rounded-lg p-2 transition-colors"
-                        :class="viewMode === 'list' ? 'bg-primary-500 text-white' : 'text-neutral-400 hover:text-primary-500'"
-                        :title="$t('myTasks.viewList')"
-                        @click="viewMode = 'list'"
-                    >
-                        <Icon name="mdi:view-list-outline" size="20" />
+                        <Icon name="mdi:plus" size="18" />
+                        {{ $t('myTasks.createTask') }}
                    </button>
+                    <div class="flex gap-1">
+                        <button
+                            class="flex items-center justify-center rounded-md p-1.5 transition-colors"
+                            :class="viewMode === 'kanban' ? 'bg-primary-500 text-white' : 'text-neutral-400 hover:text-primary-500'"
+                            :title="$t('myTasks.viewKanban')"
+                            @click="viewMode = 'kanban'"
+                        >
+                            <Icon name="mdi:view-column-outline" size="18" />
+                        </button>
+                        <button
+                            class="flex items-center justify-center rounded-md p-1.5 transition-colors"
+                            :class="viewMode === 'list' ? 'bg-primary-500 text-white' : 'text-neutral-400 hover:text-primary-500'"
+                            :title="$t('myTasks.viewList')"
+                            @click="viewMode = 'list'"
+                        >
+                            <Icon name="mdi:view-list-outline" size="18" />
+                        </button>
+                    </div>
                </div>
            </div>

@@ -314,11 +328,11 @@ onMounted(() => {

        <!-- Kanban View -->
        <div v-if="viewMode === 'kanban'">
-            <div class="mt-6 flex gap-4 overflow-x-auto pb-4">
+            <div class="mt-6 flex gap-3 overflow-x-auto pb-4">
                <div
                    v-for="status in sortedStatuses"
                    :key="status.id"
-                    class="flex w-72 shrink-0 flex-col rounded-lg transition-colors"
+                    class="flex min-w-36 flex-1 flex-col rounded-lg transition-colors"
                    :class="dragOverStatusId === status.id ? 'bg-neutral-200' : 'bg-neutral-50'"
                    @dragover.prevent
                    @dragenter.prevent="onDragEnter(status.id)"
@@ -446,6 +460,7 @@ onMounted(() => {
            :tags="tags"
            :groups="selectedTask?.project?.id ? groups.filter(g => g.project?.id === selectedTask?.project?.id) : groups"
            :users="users"
+            :projects="projects"
            @saved="onSaved"
        />
    </div>
--- a/frontend/pages/portal/index.vue
+++ b/frontend/pages/portal/index.vue
@@ -68,13 +68,12 @@ async function loadData() {
    isLoading.value = true
    try {
        if (auth.user?.roles?.includes('ROLE_ADMIN')) {
-            // Admin sees all projects
-            const allProjects = await projectService.getAll({ archived: false })
-            projects.value = allProjects
+            projects.value = await projectService.getAll({ archived: false })
        } else {
-            // Client sees allowed projects
-            projects.value = auth.user?.allowedProjects ?? []
+            // allowedProjects are embedded objects from /api/me (with me:read group)
+            projects.value = (auth.user?.allowedProjects ?? []) as Project[]
        }
+
        tickets.value = await clientTicketService.getAll()
    } finally {
        isLoading.value = false
--- a/frontend/pages/profile.vue
+++ b/frontend/pages/profile.vue
@@ -0,0 +1,91 @@
+<template>
+    <div class="mx-auto max-w-lg px-4 py-10">
+        <h1 class="mb-8 text-2xl font-bold text-neutral-900">{{ $t('profile.title') }}</h1>
+
+        <div class="flex flex-col items-center gap-6 rounded-xl border border-neutral-200 bg-white p-8 shadow-sm">
+            <!-- Current avatar -->
+            <UserAvatar
+                v-if="auth.user"
+                :user="auth.user"
+                size="lg"
+            />
+
+            <p class="text-lg font-semibold text-neutral-800">{{ auth.user?.username }}</p>
+
+            <div class="flex gap-3">
+                <label
+                    class="cursor-pointer rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-secondary-500"
+                >
+                    {{ $t('profile.changeAvatar') }}
+                    <input
+                        type="file"
+                        accept="image/jpeg,image/png,image/webp,image/gif"
+                        class="hidden"
+                        @change="onFileSelect"
+                    />
+                </label>
+
+                <button
+                    v-if="auth.user?.avatarUrl"
+                    type="button"
+                    class="rounded-lg border border-red-300 px-4 py-2 text-sm font-medium text-red-600 hover:bg-red-50"
+                    :disabled="removing"
+                    @click="onRemove"
+                >
+                    {{ $t('profile.removeAvatar') }}
+                </button>
+            </div>
+        </div>
+
+        <!-- Crop modal -->
+        <AvatarCropper
+            v-if="selectedFile"
+            :image-file="selectedFile"
+            @crop="onCrop"
+            @cancel="selectedFile = null"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+import { useAvatarService } from '~/composables/useAvatarService'
+
+const auth = useAuthStore()
+const { upload, remove } = useAvatarService()
+
+const selectedFile = ref<File | null>(null)
+const removing = ref(false)
+
+function onFileSelect(event: Event) {
+    const input = event.target as HTMLInputElement
+    const file = input.files?.[0]
+    if (file) {
+        selectedFile.value = file
+    }
+    input.value = ''
+}
+
+async function onCrop(blob: Blob) {
+    selectedFile.value = null
+    if (!auth.user) return
+
+    try {
+        await upload(auth.user.id, blob)
+        await auth.refreshUser()
+    } catch {
+        // Upload error — $fetch will throw on non-2xx
+    }
+}
+
+async function onRemove() {
+    if (!auth.user) return
+    removing.value = true
+
+    try {
+        await remove(auth.user.id)
+        await auth.refreshUser()
+    } finally {
+        removing.value = false
+    }
+}
+</script>
--- a/frontend/pages/projects/[id]/archives.vue
+++ b/frontend/pages/projects/[id]/archives.vue
@@ -46,13 +46,11 @@
                        >
                            {{ task.group.title }}
                        </span>
-                        <span
+                        <UserAvatar
                            v-if="task.assignee"
-                            class="flex h-5 w-5 items-center justify-center rounded-full bg-primary-500 text-[10px] font-bold text-white"
-                            :title="task.assignee.username"
-                        >
-                            {{ task.assignee.username.substring(0, 2).toUpperCase() }}
-                        </span>
+                            :user="task.assignee"
+                            size="xs"
+                        />
                    </div>
                </div>
            </div>
@@ -130,7 +128,7 @@ const filteredTasks = computed(() => {
 async function loadData() {
    const [p, t, s, e, pr, ty, g, u] = await Promise.all([
        projectService.getById(projectId.value),
-        taskService.getByProjectArchived(projectId.value),
+        taskService.getByProject(projectId.value, true),
        statusService.getAll(),
        effortService.getAll(),
        priorityService.getAll(),
--- a/frontend/pages/projects/[id]/index.vue
+++ b/frontend/pages/projects/[id]/index.vue
@@ -1,5 +1,5 @@
 <template>
-    <div>
+    <div class="min-w-0">
        <div class="sticky top-8 z-20 bg-white pb-4 sm:top-12">
            <div class="flex items-center justify-between gap-3">
                <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">{{ project?.name ?? '' }}</h1>
@@ -62,11 +62,11 @@
        </div>

        <!-- Kanban -->
-        <div class="mt-6 flex gap-4 overflow-x-auto pb-4">
+        <div class="mt-6 flex gap-3 overflow-x-auto pb-4">
            <div
                v-for="status in statuses"
                :key="status.id"
-                class="flex w-72 shrink-0 flex-col rounded-lg transition-colors"
+                class="flex min-w-36 flex-1 flex-col rounded-lg transition-colors"
                :class="dragOverStatusId === status.id ? 'bg-neutral-200' : 'bg-neutral-50'"
                @dragover.prevent
                @dragenter.prevent="onDragEnter(status.id)"
--- a/frontend/pages/time-tracking.vue
+++ b/frontend/pages/time-tracking.vue
@@ -75,7 +75,7 @@
            </div>
        </div>

-        <div class="mt-4 -mb-24 min-h-0 flex-1">
+        <div class="relative z-0 mt-4 -mb-24 min-h-0 flex-1">
            <TimeEntryList
                v-if="viewMode === 'list'"
                :entries="filteredEntries"
@@ -192,28 +192,6 @@ const filteredEntries = computed(() => {
    if (selectedTagId.value) {
        result = result.filter((e) => e.tags.some((t) => t.id === selectedTagId.value))
    }
-    if (selectedDateFilter.value) {
-        if (Array.isArray(selectedDateFilter.value)) {
-            const [start, end] = selectedDateFilter.value
-            const startDay = new Date(start)
-            startDay.setHours(0, 0, 0, 0)
-            const endDay = new Date(end)
-            endDay.setHours(23, 59, 59, 999)
-            result = result.filter((e) => {
-                const entryDate = new Date(e.startedAt)
-                return entryDate >= startDay && entryDate <= endDay
-            })
-        } else {
-            const day = new Date(selectedDateFilter.value)
-            day.setHours(0, 0, 0, 0)
-            const nextDay = new Date(day)
-            nextDay.setDate(nextDay.getDate() + 1)
-            result = result.filter((e) => {
-                const entryDate = new Date(e.startedAt)
-                return entryDate >= day && entryDate < nextDay
-            })
-        }
-    }
    return result
 })

@@ -306,24 +284,10 @@ async function onPaste() {
    await loadEntries()
 }

-onMounted(() => {
-    updatePageHeaderHeight()
-
-    if (!pageHeaderEl.value || typeof ResizeObserver === 'undefined') {
-        return
-    }
-
-    pageHeaderResizeObserver = new ResizeObserver(() => {
-        updatePageHeaderHeight()
-    })
-    pageHeaderResizeObserver.observe(pageHeaderEl.value)
-})
-
 onBeforeUnmount(() => {
    pageHeaderResizeObserver?.disconnect()
 })

-
 async function onDelete(entry: TimeEntry) {
    await timeEntryService.remove(entry.id)
    await loadEntries()
@@ -355,6 +319,15 @@ async function loadReferenceData() {
 }

 onMounted(async () => {
+    updatePageHeaderHeight()
+
+    if (pageHeaderEl.value && typeof ResizeObserver !== 'undefined') {
+        pageHeaderResizeObserver = new ResizeObserver(() => {
+            updatePageHeaderHeight()
+        })
+        pageHeaderResizeObserver.observe(pageHeaderEl.value)
+    }
+
    await loadReferenceData()
    await loadEntries()
 })
@@ -367,4 +340,16 @@ watch(viewMode, () => {
 watch(selectedUserId, () => {
    loadEntries()
 })
+
+watch(selectedDateFilter, (val) => {
+    if (!val) return
+    if (Array.isArray(val)) {
+        startDate.value = getMonday(val[0])
+        viewMode.value = 'week'
+    } else {
+        startDate.value = val
+        viewMode.value = 'day'
+    }
+    loadEntries()
+})
 </script>
--- a/frontend/services/auth.ts
+++ b/frontend/services/auth.ts
@@ -1,22 +1,22 @@
 import type { UserData } from './dto/user-data'

-export const getCurrentUser = () => {
-  const api = useApi()
-  return api.get<UserData>('/me', {}, { toastErrorKey: 'errors.auth.session' })
+export function getCurrentUser() {
+    const api = useApi()
+    return api.get<UserData>('/me', {}, { toastErrorKey: 'errors.auth.session' })
 }

-export const login = (username: string, password: string) => {
-  const api = useApi()
-  return api.post('/login_check', { username, password }, {
-    toastOn401: true,
-    toastErrorKey: 'errors.auth.login'
-  })
+export function login(username: string, password: string) {
+    const api = useApi()
+    return api.post('/login_check', { username, password }, {
+        toastOn401: true,
+        toastErrorKey: 'errors.auth.login'
+    })
 }

-export const logout = () => {
-  const api = useApi()
-  return api.post('/logout', {}, {
-    toastErrorKey: 'errors.auth.logout',
-    toastSuccessKey: 'success.auth.logout'
-  })
+export function logout() {
+    const api = useApi()
+    return api.post('/logout', {}, {
+        toastErrorKey: 'errors.auth.logout',
+        toastSuccessKey: 'success.auth.logout'
+    })
 }
--- a/frontend/services/client-tickets.ts
+++ b/frontend/services/client-tickets.ts
@@ -32,7 +32,7 @@ export function useClientTicketService() {

    async function update(id: number, data: Partial<ClientTicketWrite>): Promise<ClientTicket> {
        return api.patch<ClientTicket>(`/client_tickets/${id}`, data as Record<string, unknown>, {
-            toastSuccessKey: 'clientTicket.statusUpdated',
+            toastSuccessKey: 'clientTicket.updated',
        })
    }

--- a/frontend/services/dto/user-data.ts
+++ b/frontend/services/dto/user-data.ts
@@ -7,6 +7,7 @@ export type UserData = {
    roles: string[]
    client?: { id: number; name: string } | null
    allowedProjects?: Project[]
+    avatarUrl?: string | null
 }

 export type UserWrite = {
--- a/frontend/services/task-documents.ts
+++ b/frontend/services/task-documents.ts
@@ -15,30 +15,24 @@ export function useTaskDocumentService() {
        return extractHydraMembers(data)
    }

-    async function upload(taskId: number, file: File): Promise<TaskDocument> {
+    async function uploadWithRelation(relationField: string, relationIri: string, file: File): Promise<TaskDocument> {
        const formData = new FormData()
        formData.append('file', file)
-        formData.append('task', `/api/tasks/${taskId}`)
+        formData.append(relationField, relationIri)

-        return await $fetch<TaskDocument>(`${baseURL}/task_documents`, {
+        return $fetch<TaskDocument>(`${baseURL}/task_documents`, {
            method: 'POST',
            body: formData,
            credentials: 'include',
-            // Do NOT set Content-Type — browser sets multipart boundary automatically
        })
    }

-    async function uploadForTicket(clientTicketId: number, file: File): Promise<TaskDocument> {
-        const formData = new FormData()
-        formData.append('file', file)
-        formData.append('clientTicket', `/api/client_tickets/${clientTicketId}`)
+    async function upload(taskId: number, file: File): Promise<TaskDocument> {
+        return uploadWithRelation('task', `/api/tasks/${taskId}`, file)
+    }

-        return await $fetch<TaskDocument>(`${baseURL}/task_documents`, {
-            method: 'POST',
-            body: formData,
-            credentials: 'include',
-            // Do NOT set Content-Type — browser sets multipart boundary automatically
-        })
+    async function uploadForTicket(clientTicketId: number, file: File): Promise<TaskDocument> {
+        return uploadWithRelation('clientTicket', `/api/client_tickets/${clientTicketId}`, file)
    }

    async function getByTicket(clientTicketId: number): Promise<TaskDocument[]> {
--- a/frontend/services/tasks.ts
+++ b/frontend/services/tasks.ts
@@ -10,18 +10,10 @@ export function useTaskService() {
        return extractHydraMembers(data)
    }

-    async function getByProject(projectId: number): Promise<Task[]> {
+    async function getByProject(projectId: number, archived = false): Promise<Task[]> {
        const data = await api.get<HydraCollection<Task>>('/tasks', {
            project: `/api/projects/${projectId}`,
-            archived: false,
-        })
-        return extractHydraMembers(data)
-    }
-
-    async function getByProjectArchived(projectId: number): Promise<Task[]> {
-        const data = await api.get<HydraCollection<Task>>('/tasks', {
-            project: `/api/projects/${projectId}`,
-            archived: true,
+            archived,
        })
        return extractHydraMembers(data)
    }
@@ -49,5 +41,5 @@ export function useTaskService() {
        })
    }

-    return { getAll, getByProject, getByProjectArchived, getFiltered, create, update, remove }
+    return { getAll, getByProject, getFiltered, create, update, remove }
 }
--- a/frontend/stores/auth.ts
+++ b/frontend/stores/auth.ts
@@ -58,6 +58,14 @@ export const useAuthStore = defineStore('auth', {
                this.checked = true
                this.isLoading = false
            }
+        },
+        async refreshUser() {
+            try {
+                const me = await getCurrentUser()
+                this.user = me
+            } catch {
+                // Silently fail — user session might have expired
+            }
        }
    }
 })
--- a/frontend/stores/timer.ts
+++ b/frontend/stores/timer.ts
@@ -66,6 +66,11 @@ export const useTimerStore = defineStore('timer', () => {
        startTicking()
    }

+    function toIri<T extends { '@id'?: string; id: number }>(entity: T | string, prefix: string): string {
+        if (typeof entity === 'string') return entity
+        return entity['@id'] ?? `${prefix}/${entity.id}`
+    }
+
    async function startFromTask(task: Task) {
        const authStore = useAuthStore()
        if (!authStore.user) return
@@ -79,11 +84,9 @@ export const useTimerStore = defineStore('timer', () => {
            startedAt: new Date().toISOString(),
            user: `/api/users/${authStore.user.id}`,
            title: task.title,
-            project: task.project
-                ? (typeof task.project === 'string' ? task.project : (task.project['@id'] ?? (task.project.id ? `/api/projects/${task.project.id}` : null)))
-                : null,
-            task: typeof task === 'string' ? task : (task['@id'] ?? `/api/tasks/${task.id}`),
-            tags: task.tags?.map((t) => typeof t === 'string' ? t : (t['@id'] ?? `/api/task_tags/${t.id}`)) ?? [],
+            project: task.project ? toIri(task.project, '/api/projects') : null,
+            task: toIri(task, '/api/tasks'),
+            tags: task.tags?.map(t => toIri(t, '/api/task_tags')) ?? [],
        })
        startTicking()
    }
--- a/frontend/utils/format.ts
+++ b/frontend/utils/format.ts
@@ -0,0 +1,5 @@
+export function formatFileSize(bytes: number): string {
+    if (bytes < 1024) return `${bytes} o`
+    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} Ko`
+    return `${(bytes / (1024 * 1024)).toFixed(1)} Mo`
+}
--- a/migrations/Version20260315205331.php
+++ b/migrations/Version20260315205331.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260315205331 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE "user" ADD avatar_file_name VARCHAR(255) DEFAULT NULL');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE "user" DROP avatar_file_name');
+    }
+}
--- a/migrations/Version20260315210619.php
+++ b/migrations/Version20260315210619.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260315210619 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('CREATE UNIQUE INDEX uniq_task_project_number ON task (project_id, number)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX uniq_task_project_number');
+    }
+}
--- a/migrations/Version20260316124157.php
+++ b/migrations/Version20260316124157.php
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260316124157 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE time_entry ADD client_ticket_id INT DEFAULT NULL');
+        $this->addSql('ALTER TABLE time_entry ADD CONSTRAINT FK_6E537C0C9B2097DD FOREIGN KEY (client_ticket_id) REFERENCES client_ticket (id) ON DELETE SET NULL NOT DEFERRABLE');
+        $this->addSql('CREATE INDEX IDX_6E537C0C9B2097DD ON time_entry (client_ticket_id)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE time_entry DROP CONSTRAINT FK_6E537C0C9B2097DD');
+        $this->addSql('DROP INDEX IDX_6E537C0C9B2097DD');
+        $this->addSql('ALTER TABLE time_entry DROP client_ticket_id');
+    }
+}
--- a/script/deploy-release.sh
+++ b/script/deploy-release.sh
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage: ./script/deploy-release.sh v0.1.0
+# Requires: curl, tar, (optional) rsync
+#
+# Auth token: set RELEASE_TOKEN env var or create /etc/lesstime-release-token
+umask 002
+
+TAG="${1:-}"
+if [ -z "$TAG" ]; then
+  echo "Usage: $0 v0.1.0" >&2
+  exit 1
+fi
+
+REPO_OWNER="MALIO-DEV"
+REPO_NAME="Lesstime"
+GITEA_API="https://gitea.malio.fr/api/v1"
+DEPLOY_DIR="/var/www/lesstime"
+
+if [ -f /etc/lesstime-release-token ] && [ -z "${RELEASE_TOKEN:-}" ]; then
+  RELEASE_TOKEN="$(cat /etc/lesstime-release-token)"
+fi
+
+tmp_dir="$(mktemp -d)"
+cleanup() {
+  rm -rf "$tmp_dir"
+}
+trap cleanup EXIT
+
+release_json="$tmp_dir/release.json"
+curl_opts=(-sS)
+if [ -n "${RELEASE_TOKEN:-}" ]; then
+  curl_opts+=(-H "Authorization: token ${RELEASE_TOKEN}")
+fi
+curl "${curl_opts[@]}" \
+  "${GITEA_API}/repos/${REPO_OWNER}/${REPO_NAME}/releases/tags/${TAG}" \
+  -o "$release_json"
+
+asset_url="$(python3 - "$release_json" <<'PY'
+import json, sys
+data = json.load(open(sys.argv[1], 'r'))
+assets = data.get("assets", [])
+for a in assets:
+    name = a.get("name", "")
+    if name.startswith("lesstime-") and name.endswith(".tar.gz"):
+        print(a.get("browser_download_url", ""))
+        break
+PY
+)"
+
+if [ -z "$asset_url" ]; then
+  echo "Release asset not found for tag ${TAG}" >&2
+  exit 1
+fi
+
+archive="$tmp_dir/artefact.tar.gz"
+curl "${curl_opts[@]}" -L "$asset_url" -o "$archive"
+
+tar -xzf "$archive" -C "$tmp_dir"
+
+if command -v rsync >/dev/null 2>&1; then
+  rsync -a --delete --no-perms --no-owner --no-group \
+    --exclude ".env" \
+    --exclude ".env.local" \
+    --exclude "config/jwt" \
+    --exclude "var" \
+    "$tmp_dir"/ "$DEPLOY_DIR"/
+else
+  cp -a "$tmp_dir"/. "$DEPLOY_DIR"/
+fi
+
+# Ensure Nginx can traverse the deploy path.
+chmod o+rx "$(dirname "$DEPLOY_DIR")" "$DEPLOY_DIR" 2>/dev/null || true
+
+# Create frontend/dist symlink if needed (nginx serves from frontend/dist)
+if [ -d "${DEPLOY_DIR}/frontend/.output/public" ] && [ ! -L "${DEPLOY_DIR}/frontend/dist" ]; then
+  ln -sfn "${DEPLOY_DIR}/frontend/.output/public" "${DEPLOY_DIR}/frontend/dist"
+fi
+
+echo "Release ${TAG} deployed to ${DEPLOY_DIR}"
+
+if [ -f "${DEPLOY_DIR}/.env.local" ]; then
+  echo "Clearing cache..."
+  php "${DEPLOY_DIR}/bin/console" cache:clear --env=prod --no-debug
+
+  echo "Running migrations (if any)..."
+  php "${DEPLOY_DIR}/bin/console" doctrine:migrations:migrate --no-interaction --env=prod
+else
+  echo "Skip post-deploy: ${DEPLOY_DIR}/.env.local not found" >&2
+fi
--- a/src/Controller/TaskDocumentDownloadController.php
+++ b/src/Controller/TaskDocumentDownloadController.php
@@ -7,8 +7,10 @@ namespace App\Controller;
 use App\Entity\TaskDocument;
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
@@ -17,11 +19,12 @@ class TaskDocumentDownloadController extends AbstractController
 {
    public function __construct(
        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
        private readonly string $uploadDir,
    ) {}

-    #[Route('/api/task_documents/{id}/download', name: 'task_document_download', methods: ['GET'])]
-    #[IsGranted('ROLE_USER')]
+    #[Route('/api/task_documents/{id}/download', name: 'task_document_download', methods: ['GET'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
    public function __invoke(int $id): BinaryFileResponse
    {
        $document = $this->entityManager->getRepository(TaskDocument::class)->find($id);
@@ -30,6 +33,14 @@ class TaskDocumentDownloadController extends AbstractController
            throw new NotFoundHttpException('Document not found.');
        }

+        // ROLE_CLIENT can only download documents from their own tickets
+        if (!$this->security->isGranted('ROLE_ADMIN') && !$this->security->isGranted('ROLE_USER')) {
+            $ticket = $document->getClientTicket();
+            if (null === $ticket || $ticket->getSubmittedBy() !== $this->security->getUser()) {
+                throw new AccessDeniedHttpException('You do not have access to this document.');
+            }
+        }
+
        $filePath = $this->uploadDir.'/'.$document->getFileName();

        if (!file_exists($filePath)) {
--- a/src/Controller/UserAvatarController.php
+++ b/src/Controller/UserAvatarController.php
@@ -0,0 +1,145 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use App\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Component\Uid\Uuid;
+
+class UserAvatarController extends AbstractController
+{
+    private const MAX_FILE_SIZE      = 5 * 1024 * 1024; // 5 MB
+    private const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly string $avatarUploadDir,
+    ) {}
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_upload', methods: ['POST'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function upload(int $id, Request $request): JsonResponse
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $file = $request->files->get('file');
+
+        if (null === $file || !$file->isValid()) {
+            throw new BadRequestHttpException('No valid file uploaded.');
+        }
+
+        if ($file->getSize() > self::MAX_FILE_SIZE) {
+            throw new BadRequestHttpException('File size exceeds 5 MB limit.');
+        }
+
+        $mimeType = $file->getMimeType();
+
+        if (!in_array($mimeType, self::ALLOWED_MIME_TYPES, true)) {
+            throw new BadRequestHttpException('Invalid file type. Allowed: JPEG, PNG, WebP, GIF.');
+        }
+
+        // Delete previous avatar file if exists
+        $this->deleteAvatarFile($user);
+
+        $extension = $file->guessExtension() ?? 'bin';
+        $fileName  = Uuid::v4()->toRfc4122().'.'.$extension;
+
+        if (!is_dir($this->avatarUploadDir)) {
+            mkdir($this->avatarUploadDir, 0o775, true);
+        }
+
+        $file->move($this->avatarUploadDir, $fileName);
+
+        $user->setAvatarFileName($fileName);
+        $this->entityManager->flush();
+
+        return new JsonResponse(['avatarUrl' => $user->getAvatarUrl()]);
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_serve', methods: ['GET'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function serve(int $id): BinaryFileResponse
+    {
+        $user = $this->findUserOrFail($id);
+
+        if (null === $user->getAvatarFileName()) {
+            throw new NotFoundHttpException('No avatar set.');
+        }
+
+        $filePath = $this->avatarUploadDir.'/'.$user->getAvatarFileName();
+
+        if (!file_exists($filePath)) {
+            throw new NotFoundHttpException('Avatar file not found on disk.');
+        }
+
+        $response = new BinaryFileResponse($filePath);
+        $response->setContentDisposition(ResponseHeaderBag::DISPOSITION_INLINE, $user->getAvatarFileName());
+        $extension = pathinfo($user->getAvatarFileName(), PATHINFO_EXTENSION);
+        $mimeMap   = ['jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png', 'webp' => 'image/webp', 'gif' => 'image/gif'];
+        $response->headers->set('Content-Type', $mimeMap[$extension] ?? 'application/octet-stream');
+        $response->headers->set('Cache-Control', 'no-cache, must-revalidate');
+
+        return $response;
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_delete', methods: ['DELETE'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function delete(int $id): Response
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $this->deleteAvatarFile($user);
+        $user->setAvatarFileName(null);
+        $this->entityManager->flush();
+
+        return new Response(null, Response::HTTP_NO_CONTENT);
+    }
+
+    private function findUserOrFail(int $id): User
+    {
+        $user = $this->entityManager->getRepository(User::class)->find($id);
+
+        if (null === $user) {
+            throw new NotFoundHttpException('User not found.');
+        }
+
+        return $user;
+    }
+
+    private function assertCanManageAvatar(User $user): void
+    {
+        $currentUser = $this->getUser();
+
+        if ($currentUser !== $user && !$this->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedHttpException('You can only manage your own avatar.');
+        }
+    }
+
+    private function deleteAvatarFile(User $user): void
+    {
+        if (null === $user->getAvatarFileName()) {
+            return;
+        }
+
+        $filePath = $this->avatarUploadDir.'/'.$user->getAvatarFileName();
+
+        if (file_exists($filePath)) {
+            unlink($filePath);
+        }
+    }
+}
--- a/src/Entity/Project.php
+++ b/src/Entity/Project.php
@@ -20,8 +20,8 @@ use Symfony\Component\Validator\Constraints as Assert;

 #[ApiResource(
    operations: [
-        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
+        new GetCollection(security: "is_granted('ROLE_USER') or is_granted('ROLE_CLIENT')"),
+        new Get(security: "is_granted('ROLE_USER') or is_granted('ROLE_CLIENT')"),
        new Post(
            security: "is_granted('ROLE_ADMIN')",
            denormalizationContext: ['groups' => ['project:write', 'project:create']],
@@ -41,7 +41,7 @@ class Project
    #[ORM\Id]
    #[ORM\GeneratedValue]
    #[ORM\Column]
-    #[Groups(['project:read', 'time_entry:read', 'task:read'])]
+    #[Groups(['project:read', 'time_entry:read', 'task:read', 'me:read'])]
    private ?int $id = null;

    #[ORM\Column(length: 10, unique: true)]
@@ -51,7 +51,7 @@ class Project
    private ?string $code = null;

    #[ORM\Column(length: 255)]
-    #[Groups(['project:read', 'project:write', 'time_entry:read', 'task:read'])]
+    #[Groups(['project:read', 'project:write', 'time_entry:read', 'task:read', 'me:read'])]
    private ?string $name = null;

    #[ORM\Column(type: 'text', nullable: true)]
--- a/src/Entity/Task.php
+++ b/src/Entity/Task.php
@@ -35,6 +35,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[ApiFilter(SearchFilter::class, properties: ['project' => 'exact', 'group' => 'exact', 'assignee' => 'exact', 'priority' => 'exact', 'effort' => 'exact', 'tags' => 'exact', 'status' => 'exact'])]
 #[ApiFilter(BooleanFilter::class, properties: ['archived'])]
 #[ORM\Entity(repositoryClass: TaskRepository::class)]
+#[ORM\Table(name: 'task')]
+#[ORM\UniqueConstraint(name: 'uniq_task_project_number', columns: ['project_id', 'number'])]
 class Task
 {
    #[ORM\Id]
--- a/src/Entity/TimeEntry.php
+++ b/src/Entity/TimeEntry.php
@@ -85,6 +85,11 @@ class TimeEntry
    #[Groups(['time_entry:read', 'time_entry:write'])]
    private ?Task $task = null;

+    #[ORM\ManyToOne(targetEntity: ClientTicket::class)]
+    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
+    #[Groups(['time_entry:read', 'time_entry:write'])]
+    private ?ClientTicket $clientTicket = null;
+
    /** @var Collection<int, TaskTag> */
    #[ORM\ManyToMany(targetEntity: TaskTag::class)]
    #[ORM\JoinTable(
@@ -189,6 +194,18 @@ class TimeEntry
        return $this;
    }

+    public function getClientTicket(): ?ClientTicket
+    {
+        return $this->clientTicket;
+    }
+
+    public function setClientTicket(?ClientTicket $clientTicket): static
+    {
+        $this->clientTicket = $clientTicket;
+
+        return $this;
+    }
+
    /** @return Collection<int, TaskTag> */
    public function getTags(): Collection
    {
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -70,6 +70,9 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
    #[ORM\Column(length: 64, unique: true, nullable: true)]
    private ?string $apiToken = null;

+    #[ORM\Column(length: 255, nullable: true)]
+    private ?string $avatarFileName = null;
+
    #[ORM\ManyToOne(targetEntity: Client::class)]
    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
    #[Groups(['me:read', 'user:list', 'user:write'])]
@@ -199,5 +202,27 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
        return $this;
    }

+    public function getAvatarFileName(): ?string
+    {
+        return $this->avatarFileName;
+    }
+
+    public function setAvatarFileName(?string $avatarFileName): static
+    {
+        $this->avatarFileName = $avatarFileName;
+
+        return $this;
+    }
+
+    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read'])]
+    public function getAvatarUrl(): ?string
+    {
+        if (null === $this->avatarFileName) {
+            return null;
+        }
+
+        return '/api/users/'.$this->id.'/avatar';
+    }
+
    public function eraseCredentials(): void {}
 }
--- a/src/Exception/BookStackApiException.php
+++ b/src/Exception/BookStackApiException.php
@@ -5,12 +5,5 @@ declare(strict_types=1);
 namespace App\Exception;

 use RuntimeException;
-use Throwable;

-final class BookStackApiException extends RuntimeException
-{
-    public function __construct(string $message, int $code = 0, ?Throwable $previous = null)
-    {
-        parent::__construct($message, $code, $previous);
-    }
-}
+final class BookStackApiException extends RuntimeException {}
--- a/src/Exception/GiteaApiException.php
+++ b/src/Exception/GiteaApiException.php
@@ -5,12 +5,5 @@ declare(strict_types=1);
 namespace App\Exception;

 use RuntimeException;
-use Throwable;

-final class GiteaApiException extends RuntimeException
-{
-    public function __construct(string $message, int $code = 0, ?Throwable $previous = null)
-    {
-        parent::__construct($message, $code, $previous);
-    }
-}
+final class GiteaApiException extends RuntimeException {}
--- a/src/Mcp/Tool/Project/CreateProjectTool.php
+++ b/src/Mcp/Tool/Project/CreateProjectTool.php
@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\Project;

 use App\Entity\Project;
+use App\Mcp\Tool\Serializer;
 use App\Repository\ClientRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
@@ -48,17 +49,6 @@ class CreateProjectTool
        $this->entityManager->persist($project);
        $this->entityManager->flush();

-        return json_encode([
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived' => $project->isArchived(),
-        ]);
+        return json_encode(Serializer::project($project));
    }
 }
--- a/src/Mcp/Tool/Project/GetProjectTool.php
+++ b/src/Mcp/Tool/Project/GetProjectTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Project;

+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use InvalidArgumentException;
@@ -45,17 +46,7 @@ class GetProjectTool
            $totalTasks += $count;
        }

-        return json_encode([
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived'    => $project->isArchived(),
+        return json_encode(Serializer::project($project) + [
            'taskSummary' => $statusCounts,
            'totalTasks'  => $totalTasks,
        ]);
--- a/src/Mcp/Tool/Project/ListProjectsTool.php
+++ b/src/Mcp/Tool/Project/ListProjectsTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Project;

+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use Mcp\Capability\Attribute\McpTool;

@@ -18,17 +19,6 @@ class ListProjectsTool
    {
        $projects = $this->projectRepository->findBy(['archived' => $archived], ['name' => 'ASC']);

-        return json_encode(array_map(fn ($project) => [
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived' => $project->isArchived(),
-        ], $projects));
+        return json_encode(array_map(Serializer::project(...), $projects));
    }
 }
--- a/src/Mcp/Tool/Project/UpdateProjectTool.php
+++ b/src/Mcp/Tool/Project/UpdateProjectTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Project;

+use App\Mcp\Tool\Serializer;
 use App\Repository\ClientRepository;
 use App\Repository\ProjectRepository;
 use Doctrine\ORM\EntityManagerInterface;
@@ -61,17 +62,6 @@ class UpdateProjectTool

        $this->entityManager->flush();

-        return json_encode([
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived' => $project->isArchived(),
-        ]);
+        return json_encode(Serializer::project($project));
    }
 }
--- a/src/Mcp/Tool/Serializer.php
+++ b/src/Mcp/Tool/Serializer.php
@@ -0,0 +1,295 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool;
+
+use App\Entity\ClientTicket;
+use App\Entity\Project;
+use App\Entity\Task;
+use App\Entity\TaskDocument;
+use App\Entity\TaskEffort;
+use App\Entity\TaskGroup;
+use App\Entity\TaskPriority;
+use App\Entity\TaskStatus;
+use App\Entity\TaskTag;
+use App\Entity\TimeEntry;
+use App\Entity\User;
+use Doctrine\Common\Collections\Collection;
+
+/**
+ * Shared serialization helpers for MCP tools.
+ *
+ * Keeps JSON output consistent across all tools.
+ */
+final class Serializer
+{
+    /**
+     * @return array{id: ?int, code: ?string, name: ?string}
+     */
+    public static function projectRef(Project $project): array
+    {
+        return [
+            'id'   => $project->getId(),
+            'code' => $project->getCode(),
+            'name' => $project->getName(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function project(Project $project): array
+    {
+        return [
+            'id'          => $project->getId(),
+            'code'        => $project->getCode(),
+            'name'        => $project->getName(),
+            'description' => $project->getDescription(),
+            'color'       => $project->getColor(),
+            'client'      => $project->getClient() ? [
+                'id'   => $project->getClient()->getId(),
+                'name' => $project->getClient()->getName(),
+            ] : null,
+            'archived' => $project->isArchived(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string, color: ?string}
+     */
+    public static function status(?TaskStatus $status): ?array
+    {
+        if (null === $status) {
+            return null;
+        }
+
+        return [
+            'id'    => $status->getId(),
+            'label' => $status->getLabel(),
+            'color' => $status->getColor(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string, color: ?string, isFinal: bool}
+     */
+    public static function statusFull(?TaskStatus $status): ?array
+    {
+        if (null === $status) {
+            return null;
+        }
+
+        return [
+            'id'      => $status->getId(),
+            'label'   => $status->getLabel(),
+            'color'   => $status->getColor(),
+            'isFinal' => $status->getIsFinal(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string, color: ?string}
+     */
+    public static function priority(?TaskPriority $priority): ?array
+    {
+        if (null === $priority) {
+            return null;
+        }
+
+        return [
+            'id'    => $priority->getId(),
+            'label' => $priority->getLabel(),
+            'color' => $priority->getColor(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string}
+     */
+    public static function effort(?TaskEffort $effort): ?array
+    {
+        if (null === $effort) {
+            return null;
+        }
+
+        return [
+            'id'    => $effort->getId(),
+            'label' => $effort->getLabel(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, username: ?string}
+     */
+    public static function user(?User $user): ?array
+    {
+        if (null === $user) {
+            return null;
+        }
+
+        return [
+            'id'       => $user->getId(),
+            'username' => $user->getUsername(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, title: ?string, color: ?string}
+     */
+    public static function group(?TaskGroup $group): ?array
+    {
+        if (null === $group) {
+            return null;
+        }
+
+        return [
+            'id'    => $group->getId(),
+            'title' => $group->getTitle(),
+            'color' => $group->getColor(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, title: ?string}
+     */
+    public static function groupRef(?TaskGroup $group): ?array
+    {
+        if (null === $group) {
+            return null;
+        }
+
+        return [
+            'id'    => $group->getId(),
+            'title' => $group->getTitle(),
+        ];
+    }
+
+    /**
+     * Full group serialization for MCP group tools (includes description, project, archived).
+     *
+     * @return array<string, mixed>
+     */
+    public static function groupFull(TaskGroup $group): array
+    {
+        return [
+            'id'          => $group->getId(),
+            'title'       => $group->getTitle(),
+            'description' => $group->getDescription(),
+            'color'       => $group->getColor(),
+            'project'     => self::projectRef($group->getProject()),
+            'archived'    => $group->isArchived(),
+        ];
+    }
+
+    /**
+     * @param Collection<int, TaskTag> $tags
+     *
+     * @return list<array{id: ?int, label: ?string}>
+     */
+    public static function tags(Collection $tags): array
+    {
+        return $tags->map(fn (TaskTag $t) => [
+            'id'    => $t->getId(),
+            'label' => $t->getLabel(),
+        ])->toArray();
+    }
+
+    /**
+     * @param Collection<int, TaskTag> $tags
+     *
+     * @return list<array{id: ?int, label: ?string, color: ?string}>
+     */
+    public static function tagsWithColor(Collection $tags): array
+    {
+        return $tags->map(fn (TaskTag $t) => [
+            'id'    => $t->getId(),
+            'label' => $t->getLabel(),
+            'color' => $t->getColor(),
+        ])->toArray();
+    }
+
+    /**
+     * Compute duration in minutes between two timestamps, or null if still active.
+     */
+    public static function durationMinutes(TimeEntry $entry): ?int
+    {
+        $started = $entry->getStartedAt();
+        $stopped = $entry->getStoppedAt();
+
+        if (null === $stopped || null === $started) {
+            return null;
+        }
+
+        return (int) round(($stopped->getTimestamp() - $started->getTimestamp()) / 60);
+    }
+
+    /**
+     * @return null|array{id: ?int, number: ?int, title: ?string}
+     */
+    public static function taskRef(?Task $task): ?array
+    {
+        if (null === $task) {
+            return null;
+        }
+
+        return [
+            'id'     => $task->getId(),
+            'number' => $task->getNumber(),
+            'title'  => $task->getTitle(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, number: ?int, title: ?string}
+     */
+    public static function clientTicketRef(?ClientTicket $ticket): ?array
+    {
+        if (null === $ticket) {
+            return null;
+        }
+
+        return [
+            'id'     => $ticket->getId(),
+            'number' => $ticket->getNumber(),
+            'title'  => $ticket->getTitle(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function timeEntry(TimeEntry $entry): array
+    {
+        return [
+            'id'           => $entry->getId(),
+            'title'        => $entry->getTitle(),
+            'description'  => $entry->getDescription(),
+            'startedAt'    => $entry->getStartedAt()?->format('c'),
+            'stoppedAt'    => $entry->getStoppedAt()?->format('c'),
+            'duration'     => self::durationMinutes($entry),
+            'user'         => self::user($entry->getUser()),
+            'project'      => $entry->getProject() ? self::projectRef($entry->getProject()) : null,
+            'task'         => self::taskRef($entry->getTask()),
+            'clientTicket' => self::clientTicketRef($entry->getClientTicket()),
+            'tags'         => self::tags($entry->getTags()),
+        ];
+    }
+
+    /**
+     * @param Collection<int, TaskDocument> $documents
+     *
+     * @return list<array<string, mixed>>
+     */
+    public static function documents(Collection $documents): array
+    {
+        return $documents->map(fn (TaskDocument $doc) => [
+            'id'           => $doc->getId(),
+            'originalName' => $doc->getOriginalName(),
+            'mimeType'     => $doc->getMimeType(),
+            'size'         => $doc->getSize(),
+            'createdAt'    => $doc->getCreatedAt()?->format('c'),
+            'uploadedBy'   => self::user($doc->getUploadedBy()),
+        ])->toArray();
+    }
+}
--- a/src/Mcp/Tool/Task/CreateTaskTool.php
+++ b/src/Mcp/Tool/Task/CreateTaskTool.php
@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\Task;

 use App\Entity\Task;
+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskEffortRepository;
 use App\Repository\TaskGroupRepository;
@@ -53,7 +54,7 @@ class CreateTaskTool
        $task = new Task();
        $task->setProject($project);
        $task->setTitle($title);
-        $task->setNumber($this->taskRepository->findMaxNumberByProject($project) + 1);
+        $task->setNumber($this->taskRepository->findMaxNumberByProjectForUpdate($project) + 1);

        if (null !== $description) {
            $task->setDescription($description);
@@ -111,38 +112,14 @@ class CreateTaskTool
            'number'      => $task->getNumber(),
            'title'       => $task->getTitle(),
            'description' => $task->getDescription(),
-            'status'      => $task->getStatus() ? [
-                'id'    => $task->getStatus()->getId(),
-                'label' => $task->getStatus()->getLabel(),
-                'color' => $task->getStatus()->getColor(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-            ] : null,
-            'project' => [
-                'id'   => $project->getId(),
-                'code' => $project->getCode(),
-                'name' => $project->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-            'archived' => $task->isArchived(),
+            'status'      => Serializer::status($task->getStatus()),
+            'priority'    => Serializer::priority($task->getPriority()),
+            'effort'      => Serializer::effort($task->getEffort()),
+            'assignee'    => Serializer::user($task->getAssignee()),
+            'group'       => Serializer::groupRef($task->getGroup()),
+            'project'     => Serializer::projectRef($project),
+            'tags'        => Serializer::tags($task->getTags()),
+            'archived'    => $task->isArchived(),
        ]);
    }
 }
--- a/src/Mcp/Tool/Task/GetTaskTool.php
+++ b/src/Mcp/Tool/Task/GetTaskTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Task;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskRepository;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
@@ -30,52 +31,15 @@ class GetTaskTool
            'number'      => $task->getNumber(),
            'title'       => $task->getTitle(),
            'description' => $task->getDescription(),
-            'status'      => $task->getStatus() ? [
-                'id'      => $task->getStatus()->getId(),
-                'label'   => $task->getStatus()->getLabel(),
-                'color'   => $task->getStatus()->getColor(),
-                'isFinal' => $task->getStatus()->getIsFinal(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-                'color' => $task->getGroup()->getColor(),
-            ] : null,
-            'project' => [
-                'id'   => $task->getProject()->getId(),
-                'code' => $task->getProject()->getCode(),
-                'name' => $task->getProject()->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-                'color' => $t->getColor(),
-            ])->toArray(),
-            'documents' => $task->getDocuments()->map(fn ($doc) => [
-                'id'           => $doc->getId(),
-                'originalName' => $doc->getOriginalName(),
-                'mimeType'     => $doc->getMimeType(),
-                'size'         => $doc->getSize(),
-                'createdAt'    => $doc->getCreatedAt()?->format('c'),
-                'uploadedBy'   => $doc->getUploadedBy() ? [
-                    'id'       => $doc->getUploadedBy()->getId(),
-                    'username' => $doc->getUploadedBy()->getUsername(),
-                ] : null,
-            ])->toArray(),
-            'archived' => $task->isArchived(),
+            'status'      => Serializer::statusFull($task->getStatus()),
+            'priority'    => Serializer::priority($task->getPriority()),
+            'effort'      => Serializer::effort($task->getEffort()),
+            'assignee'    => Serializer::user($task->getAssignee()),
+            'group'       => Serializer::group($task->getGroup()),
+            'project'     => Serializer::projectRef($task->getProject()),
+            'tags'        => Serializer::tagsWithColor($task->getTags()),
+            'documents'   => Serializer::documents($task->getDocuments()),
+            'archived'    => $task->isArchived(),
        ]);
    }
 }
--- a/src/Mcp/Tool/Task/ListTasksTool.php
+++ b/src/Mcp/Tool/Task/ListTasksTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Task;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskRepository;
 use Mcp\Capability\Attribute\McpTool;

@@ -67,40 +68,16 @@ class ListTasksTool
        }

        return json_encode(array_map(fn ($task) => [
-            'id'     => $task->getId(),
-            'number' => $task->getNumber(),
-            'title'  => $task->getTitle(),
-            'status' => $task->getStatus() ? [
-                'id'    => $task->getStatus()->getId(),
-                'label' => $task->getStatus()->getLabel(),
-                'color' => $task->getStatus()->getColor(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-            ] : null,
-            'project' => [
-                'id'   => $task->getProject()->getId(),
-                'code' => $task->getProject()->getCode(),
-                'name' => $task->getProject()->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
+            'id'       => $task->getId(),
+            'number'   => $task->getNumber(),
+            'title'    => $task->getTitle(),
+            'status'   => Serializer::status($task->getStatus()),
+            'priority' => Serializer::priority($task->getPriority()),
+            'assignee' => Serializer::user($task->getAssignee()),
+            'effort'   => Serializer::effort($task->getEffort()),
+            'group'    => Serializer::groupRef($task->getGroup()),
+            'project'  => Serializer::projectRef($task->getProject()),
+            'tags'     => Serializer::tags($task->getTags()),
            'archived' => $task->isArchived(),
        ], array_values($tasks)));
    }
--- a/src/Mcp/Tool/Task/UpdateTaskTool.php
+++ b/src/Mcp/Tool/Task/UpdateTaskTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Task;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskEffortRepository;
 use App\Repository\TaskGroupRepository;
 use App\Repository\TaskPriorityRepository;
@@ -114,38 +115,14 @@ class UpdateTaskTool
            'number'      => $task->getNumber(),
            'title'       => $task->getTitle(),
            'description' => $task->getDescription(),
-            'status'      => $task->getStatus() ? [
-                'id'    => $task->getStatus()->getId(),
-                'label' => $task->getStatus()->getLabel(),
-                'color' => $task->getStatus()->getColor(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-            ] : null,
-            'project' => [
-                'id'   => $task->getProject()->getId(),
-                'code' => $task->getProject()->getCode(),
-                'name' => $task->getProject()->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-            'archived' => $task->isArchived(),
+            'status'      => Serializer::status($task->getStatus()),
+            'priority'    => Serializer::priority($task->getPriority()),
+            'effort'      => Serializer::effort($task->getEffort()),
+            'assignee'    => Serializer::user($task->getAssignee()),
+            'group'       => Serializer::groupRef($task->getGroup()),
+            'project'     => Serializer::projectRef($task->getProject()),
+            'tags'        => Serializer::tags($task->getTags()),
+            'archived'    => $task->isArchived(),
        ]);
    }
 }
--- a/src/Mcp/Tool/TaskMeta/CreateGroupTool.php
+++ b/src/Mcp/Tool/TaskMeta/CreateGroupTool.php
@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\TaskMeta;

 use App\Entity\TaskGroup;
+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
@@ -45,17 +46,6 @@ class CreateGroupTool
        $this->entityManager->persist($group);
        $this->entityManager->flush();

-        return json_encode([
-            'id'          => $group->getId(),
-            'title'       => $group->getTitle(),
-            'description' => $group->getDescription(),
-            'color'       => $group->getColor(),
-            'project'     => [
-                'id'   => $project->getId(),
-                'code' => $project->getCode(),
-                'name' => $project->getName(),
-            ],
-            'archived' => $group->isArchived(),
-        ]);
+        return json_encode(Serializer::groupFull($group));
    }
 }
--- a/src/Mcp/Tool/TaskMeta/ListGroupsTool.php
+++ b/src/Mcp/Tool/TaskMeta/ListGroupsTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\TaskMeta;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskGroupRepository;
 use Mcp\Capability\Attribute\McpTool;

@@ -23,17 +24,6 @@ class ListGroupsTool

        $groups = $this->taskGroupRepository->findBy($criteria, ['title' => 'ASC']);

-        return json_encode(array_map(fn ($g) => [
-            'id'          => $g->getId(),
-            'title'       => $g->getTitle(),
-            'description' => $g->getDescription(),
-            'color'       => $g->getColor(),
-            'project'     => [
-                'id'   => $g->getProject()->getId(),
-                'code' => $g->getProject()->getCode(),
-                'name' => $g->getProject()->getName(),
-            ],
-            'archived' => $g->isArchived(),
-        ], $groups));
+        return json_encode(array_map(Serializer::groupFull(...), $groups));
    }
 }
--- a/src/Mcp/Tool/TaskMeta/UpdateGroupTool.php
+++ b/src/Mcp/Tool/TaskMeta/UpdateGroupTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\TaskMeta;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskGroupRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
@@ -47,17 +48,6 @@ class UpdateGroupTool

        $this->entityManager->flush();

-        return json_encode([
-            'id'          => $group->getId(),
-            'title'       => $group->getTitle(),
-            'description' => $group->getDescription(),
-            'color'       => $group->getColor(),
-            'project'     => [
-                'id'   => $group->getProject()->getId(),
-                'code' => $group->getProject()->getCode(),
-                'name' => $group->getProject()->getName(),
-            ],
-            'archived' => $group->isArchived(),
-        ]);
+        return json_encode(Serializer::groupFull($group));
    }
 }
--- a/src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php
+++ b/src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php
@@ -5,6 +5,8 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\TimeEntry;

 use App\Entity\TimeEntry;
+use App\Mcp\Tool\Serializer;
+use App\Repository\ClientTicketRepository;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use App\Repository\TaskTagRepository;
@@ -27,6 +29,7 @@ class CreateTimeEntryTool
        private readonly TaskRepository $taskRepository,
        private readonly TaskTagRepository $taskTagRepository,
        private readonly TimeEntryRepository $timeEntryRepository,
+        private readonly ClientTicketRepository $clientTicketRepository,
    ) {}

    public function __invoke(
@@ -38,6 +41,7 @@ class CreateTimeEntryTool
        ?int $taskId = null,
        ?array $tagIds = null,
        ?string $description = null,
+        ?int $clientTicketId = null,
    ): string {
        $user = $this->userRepository->find($userId);
        if (null === $user) {
@@ -79,6 +83,13 @@ class CreateTimeEntryTool
            }
            $entry->setTask($task);
        }
+        if (null !== $clientTicketId) {
+            $clientTicket = $this->clientTicketRepository->find($clientTicketId);
+            if (null === $clientTicket) {
+                throw new InvalidArgumentException(sprintf('ClientTicket with ID %d not found.', $clientTicketId));
+            }
+            $entry->setClientTicket($clientTicket);
+        }
        if (null !== $tagIds) {
            foreach ($tagIds as $tagId) {
                $tag = $this->taskTagRepository->find($tagId);
@@ -92,30 +103,6 @@ class CreateTimeEntryTool
        $this->entityManager->persist($entry);
        $this->entityManager->flush();

-        return json_encode([
-            'id'          => $entry->getId(),
-            'title'       => $entry->getTitle(),
-            'description' => $entry->getDescription(),
-            'startedAt'   => $entry->getStartedAt()?->format('c'),
-            'stoppedAt'   => $entry->getStoppedAt()?->format('c'),
-            'duration'    => $entry->getStoppedAt() && $entry->getStartedAt()
-                ? (int) round(($entry->getStoppedAt()->getTimestamp() - $entry->getStartedAt()->getTimestamp()) / 60)
-                : null,
-            'user'    => ['id' => $user->getId(), 'username' => $user->getUsername()],
-            'project' => $entry->getProject() ? [
-                'id'   => $entry->getProject()->getId(),
-                'code' => $entry->getProject()->getCode(),
-                'name' => $entry->getProject()->getName(),
-            ] : null,
-            'task' => $entry->getTask() ? [
-                'id'     => $entry->getTask()->getId(),
-                'number' => $entry->getTask()->getNumber(),
-                'title'  => $entry->getTask()->getTitle(),
-            ] : null,
-            'tags' => $entry->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-        ]);
+        return json_encode(Serializer::timeEntry($entry));
    }
 }
--- a/src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php
+++ b/src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\TimeEntry;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TimeEntryRepository;
 use DateTimeImmutable;
 use Mcp\Capability\Attribute\McpTool;
@@ -19,6 +20,7 @@ class ListTimeEntriesTool
        ?int $userId = null,
        ?int $projectId = null,
        ?int $taskId = null,
+        ?int $clientTicketId = null,
        ?string $startDate = null,
        ?string $endDate = null,
        int $limit = 100,
@@ -30,6 +32,7 @@ class ListTimeEntriesTool
            ->leftJoin('te.project', 'p')->addSelect('p')
            ->leftJoin('te.task', 't')->addSelect('t')
            ->leftJoin('te.tags', 'tg')->addSelect('tg')
+            ->leftJoin('te.clientTicket', 'ct')->addSelect('ct')
            ->orderBy('te.startedAt', 'DESC')
            ->setMaxResults($limit)
        ;
@@ -43,6 +46,9 @@ class ListTimeEntriesTool
        if (null !== $taskId) {
            $qb->andWhere('t.id = :taskId')->setParameter('taskId', $taskId);
        }
+        if (null !== $clientTicketId) {
+            $qb->andWhere('ct.id = :clientTicketId')->setParameter('clientTicketId', $clientTicketId);
+        }
        if (null !== $startDate) {
            $qb->andWhere('te.startedAt >= :startDate')
                ->setParameter('startDate', new DateTimeImmutable($startDate.' 00:00:00'))
@@ -56,33 +62,6 @@ class ListTimeEntriesTool

        $entries = $qb->getQuery()->getResult();

-        return json_encode(array_map(fn ($entry) => [
-            'id'          => $entry->getId(),
-            'title'       => $entry->getTitle(),
-            'description' => $entry->getDescription(),
-            'startedAt'   => $entry->getStartedAt()?->format('c'),
-            'stoppedAt'   => $entry->getStoppedAt()?->format('c'),
-            'duration'    => $entry->getStoppedAt() && $entry->getStartedAt()
-                ? (int) round(($entry->getStoppedAt()->getTimestamp() - $entry->getStartedAt()->getTimestamp()) / 60)
-                : null,
-            'user' => [
-                'id'       => $entry->getUser()->getId(),
-                'username' => $entry->getUser()->getUsername(),
-            ],
-            'project' => $entry->getProject() ? [
-                'id'   => $entry->getProject()->getId(),
-                'code' => $entry->getProject()->getCode(),
-                'name' => $entry->getProject()->getName(),
-            ] : null,
-            'task' => $entry->getTask() ? [
-                'id'     => $entry->getTask()->getId(),
-                'number' => $entry->getTask()->getNumber(),
-                'title'  => $entry->getTask()->getTitle(),
-            ] : null,
-            'tags' => $entry->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-        ], $entries));
+        return json_encode(array_map(Serializer::timeEntry(...), $entries));
    }
 }
--- a/src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php
+++ b/src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php
@@ -4,6 +4,8 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\TimeEntry;

+use App\Mcp\Tool\Serializer;
+use App\Repository\ClientTicketRepository;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use App\Repository\TaskTagRepository;
@@ -23,6 +25,7 @@ class UpdateTimeEntryTool
        private readonly ProjectRepository $projectRepository,
        private readonly TaskRepository $taskRepository,
        private readonly TaskTagRepository $taskTagRepository,
+        private readonly ClientTicketRepository $clientTicketRepository,
        private readonly EntityManagerInterface $entityManager,
    ) {}

@@ -35,6 +38,7 @@ class UpdateTimeEntryTool
        ?int $taskId = null,
        ?array $tagIds = null,
        ?string $description = null,
+        ?int $clientTicketId = null,
    ): string {
        $entry = $this->timeEntryRepository->find($id);

@@ -68,6 +72,13 @@ class UpdateTimeEntryTool
            }
            $entry->setTask($task);
        }
+        if (null !== $clientTicketId) {
+            $clientTicket = $this->clientTicketRepository->find($clientTicketId);
+            if (null === $clientTicket) {
+                throw new InvalidArgumentException(sprintf('ClientTicket with ID %d not found.', $clientTicketId));
+            }
+            $entry->setClientTicket($clientTicket);
+        }
        if (null !== $tagIds) {
            foreach ($entry->getTags()->toArray() as $existingTag) {
                $entry->removeTag($existingTag);
@@ -83,29 +94,6 @@ class UpdateTimeEntryTool

        $this->entityManager->flush();

-        return json_encode([
-            'id'        => $entry->getId(),
-            'title'     => $entry->getTitle(),
-            'startedAt' => $entry->getStartedAt()?->format('c'),
-            'stoppedAt' => $entry->getStoppedAt()?->format('c'),
-            'duration'  => $entry->getStoppedAt() && $entry->getStartedAt()
-                ? (int) round(($entry->getStoppedAt()->getTimestamp() - $entry->getStartedAt()->getTimestamp()) / 60)
-                : null,
-            'user'    => ['id' => $entry->getUser()->getId(), 'username' => $entry->getUser()->getUsername()],
-            'project' => $entry->getProject() ? [
-                'id'   => $entry->getProject()->getId(),
-                'code' => $entry->getProject()->getCode(),
-                'name' => $entry->getProject()->getName(),
-            ] : null,
-            'task' => $entry->getTask() ? [
-                'id'     => $entry->getTask()->getId(),
-                'number' => $entry->getTask()->getNumber(),
-                'title'  => $entry->getTask()->getTitle(),
-            ] : null,
-            'tags' => $entry->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-        ]);
+        return json_encode(Serializer::timeEntry($entry));
    }
 }
--- a/src/Repository/ClientTicketRepository.php
+++ b/src/Repository/ClientTicketRepository.php
@@ -19,15 +19,18 @@ class ClientTicketRepository extends ServiceEntityRepository
        parent::__construct($registry, ClientTicket::class);
    }

-    public function findNextNumberForProject(Project $project): int
+    /**
+     * Returns the next ticket number for a project, using a row-level lock
+     * to prevent race conditions when creating tickets concurrently.
+     */
+    public function findNextNumberForProjectForUpdate(Project $project): int
    {
-        $result = $this->createQueryBuilder('ct')
-            ->select('MAX(ct.number)')
-            ->where('ct.project = :project')
-            ->setParameter('project', $project)
-            ->getQuery()
-            ->getSingleScalarResult()
-        ;
+        $conn = $this->getEntityManager()->getConnection();
+
+        $result = $conn->fetchOne(
+            'SELECT COALESCE(MAX(number), 0) FROM client_ticket WHERE project_id = :project FOR UPDATE',
+            ['project' => $project->getId()],
+        );

        return ((int) $result) + 1;
    }
--- a/src/Repository/TaskRepository.php
+++ b/src/Repository/TaskRepository.php
@@ -9,6 +9,9 @@ use App\Entity\Task;
 use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
 use Doctrine\Persistence\ManagerRegistry;

+/**
+ * @extends ServiceEntityRepository<Task>
+ */
 class TaskRepository extends ServiceEntityRepository
 {
    public function __construct(ManagerRegistry $registry)
@@ -16,16 +19,19 @@ class TaskRepository extends ServiceEntityRepository
        parent::__construct($registry, Task::class);
    }

-    public function findMaxNumberByProject(Project $project): int
+    /**
+     * Returns the max task number for a project, using a row-level lock
+     * to prevent race conditions when creating tasks concurrently.
+     */
+    public function findMaxNumberByProjectForUpdate(Project $project): int
    {
-        $result = $this->createQueryBuilder('t')
-            ->select('MAX(t.number)')
-            ->where('t.project = :project')
-            ->setParameter('project', $project)
-            ->getQuery()
-            ->getSingleScalarResult()
-        ;
+        $conn = $this->getEntityManager()->getConnection();

-        return (int) ($result ?? 0);
+        $result = $conn->fetchOne(
+            'SELECT COALESCE(MAX(number), 0) FROM task WHERE project_id = :project',
+            ['project' => $project->getId()],
+        );
+
+        return (int) $result;
    }
 }
--- a/src/Service/BookStackApiService.php
+++ b/src/Service/BookStackApiService.php
@@ -59,7 +59,7 @@ final class BookStackApiService
     * Search for pages and books within a specific shelf.
     *
     * Algorithm:
-     * 1. Fetch the shelf's book IDs
+     * 1. Fetch the shelf data (book IDs + slugs)
     * 2. Run two search queries (one for pages, one for books)
     * 3. Filter results: pages must belong to a book on the shelf, books must be on the shelf
     *
@@ -67,17 +67,27 @@ final class BookStackApiService
     */
    public function searchInShelf(int $shelfId, string $query): array
    {
-        $bookIds = $this->getShelfBookIds($shelfId);
+        $shelfData = $this->request('GET', sprintf('/api/shelves/%d', $shelfId));
+        $books     = $shelfData['books'] ?? [];

-        if (empty($bookIds)) {
+        if (empty($books)) {
            return [];
        }

+        $bookIds   = array_map(static fn (array $book): int => $book['id'], $books);
+        $bookSlugs = [];
+        foreach ($books as $book) {
+            $bookSlugs[$book['id']] = $book['slug'] ?? '';
+        }
+
+        // Update cache for getShelfBookIds
+        $this->shelfBookCache[$shelfId] = $bookIds;
+
        $config  = $this->getConfiguration();
        $baseUrl = rtrim($config->getUrl() ?? '', '/');
        $trimmed = trim($query);

-        // BookStack search API accepts {type:X} for one type at a time — run two queries
+        // BookStack search API accepts {type:X} for one type at a time -- run two queries
        $pageResults = $this->request('GET', '/api/search', [
            'query' => ['query' => $trimmed.' {type:page}', 'count' => 50],
        ]);
@@ -87,13 +97,6 @@ final class BookStackApiService

        $allResults = array_merge($pageResults['data'] ?? [], $bookResults['data'] ?? []);

-        // Build a map of bookId → bookSlug for URL construction
-        $shelfData = $this->request('GET', sprintf('/api/shelves/%d', $shelfId));
-        $bookSlugs = [];
-        foreach ($shelfData['books'] ?? [] as $book) {
-            $bookSlugs[$book['id']] = $book['slug'] ?? '';
-        }
-
        $filtered = [];
        foreach ($allResults as $item) {
            $type = $item['type'] ?? '';
@@ -101,23 +104,20 @@ final class BookStackApiService
            if ('page' === $type) {
                $bookId = $item['book_id'] ?? 0;
                if (in_array($bookId, $bookIds, true)) {
-                    $bookSlug   = $bookSlugs[$bookId] ?? '';
                    $filtered[] = [
                        'id'   => $item['id'],
                        'type' => 'page',
                        'name' => $item['name'] ?? '',
-                        'url'  => $baseUrl.'/books/'.$bookSlug.'/page/'.$item['slug'],
-                    ];
-                }
-            } elseif ('book' === $type) {
-                if (in_array($item['id'], $bookIds, true)) {
-                    $filtered[] = [
-                        'id'   => $item['id'],
-                        'type' => 'book',
-                        'name' => $item['name'] ?? '',
-                        'url'  => $baseUrl.'/books/'.$item['slug'],
+                        'url'  => $baseUrl.'/books/'.($bookSlugs[$bookId] ?? '').'/page/'.$item['slug'],
                    ];
                }
+            } elseif ('book' === $type && in_array($item['id'], $bookIds, true)) {
+                $filtered[] = [
+                    'id'   => $item['id'],
+                    'type' => 'book',
+                    'name' => $item['name'] ?? '',
+                    'url'  => $baseUrl.'/books/'.$item['slug'],
+                ];
            }
        }

--- a/src/Service/GiteaApiService.php
+++ b/src/Service/GiteaApiService.php
@@ -126,9 +126,10 @@ final readonly class GiteaApiService

        $regex = sprintf('#^[^/]+/%s($|-.+)#', preg_quote($taskCode, '#'));

-        return array_values(array_filter($allBranches, static function (array $branch) use ($regex): bool {
-            return 1 === preg_match($regex, $branch['name']);
-        }));
+        return array_values(array_filter(
+            $allBranches,
+            static fn (array $branch): bool => 1 === preg_match($regex, $branch['name']),
+        ));
    }

    /**
--- a/src/Service/NotificationService.php
+++ b/src/Service/NotificationService.php
@@ -52,12 +52,12 @@ final readonly class NotificationService
            return;
        }

-        $number      = sprintf('CT-%03d', $ticket->getNumber());
-        $statusLabel = $ticket->getStatus();
-        $message     = 'Nouveau statut : '.$statusLabel;
+        $number        = sprintf('CT-%03d', $ticket->getNumber());
+        $statusComment = $ticket->getStatusComment();
+        $message       = 'Nouveau statut : '.$ticket->getStatus();

-        if (null !== $ticket->getStatusComment() && '' !== $ticket->getStatusComment()) {
-            $message .= ' — '.$ticket->getStatusComment();
+        if (null !== $statusComment && '' !== $statusComment) {
+            $message .= ' — '.$statusComment;
        }

        $notification = new Notification();
--- a/src/Service/TokenEncryptor.php
+++ b/src/Service/TokenEncryptor.php
@@ -17,31 +17,10 @@ final class TokenEncryptor
        #[Autowire('%env(ENCRYPTION_KEY)%')]
        string $encryptionKey,
    ) {
-        if ('' === $encryptionKey) {
-            $this->key        = '';
-            $this->configured = false;
+        $key = $this->tryDecodeKey($encryptionKey);

-            return;
-        }
-
-        try {
-            $key = sodium_hex2bin($encryptionKey);
-        } catch (SodiumException) {
-            $this->key        = '';
-            $this->configured = false;
-
-            return;
-        }
-
-        if (SODIUM_CRYPTO_SECRETBOX_KEYBYTES !== mb_strlen($key, '8bit')) {
-            $this->key        = '';
-            $this->configured = false;
-
-            return;
-        }
-
-        $this->key        = $key;
-        $this->configured = true;
+        $this->key        = $key ?? '';
+        $this->configured = null !== $key;
    }

    public function encrypt(string $plaintext): string
@@ -71,6 +50,25 @@ final class TokenEncryptor
        return $plaintext;
    }

+    private function tryDecodeKey(string $encryptionKey): ?string
+    {
+        if ('' === $encryptionKey) {
+            return null;
+        }
+
+        try {
+            $key = sodium_hex2bin($encryptionKey);
+        } catch (SodiumException) {
+            return null;
+        }
+
+        if (SODIUM_CRYPTO_SECRETBOX_KEYBYTES !== mb_strlen($key, '8bit')) {
+            return null;
+        }
+
+        return $key;
+    }
+
    private function assertConfigured(): void
    {
        if (!$this->configured) {
--- a/src/State/ClientTicketNumberProcessor.php
+++ b/src/State/ClientTicketNumberProcessor.php
@@ -51,12 +51,13 @@ final readonly class ClientTicketNumberProcessor implements ProcessorInterface
            }
        }

-        $nextNumber = $this->clientTicketRepository->findNextNumberForProject($project);
-        $data->setNumber($nextNumber);
+        $now = new DateTimeImmutable();
+
+        $data->setNumber($this->clientTicketRepository->findNextNumberForProjectForUpdate($project));
        $data->setSubmittedBy($user);
        $data->setStatus('new');
-        $data->setCreatedAt(new DateTimeImmutable());
-        $data->setUpdatedAt(new DateTimeImmutable());
+        $data->setCreatedAt($now);
+        $data->setUpdatedAt($now);

        $this->entityManager->persist($data);
        $this->entityManager->flush();
--- a/src/State/ClientTicketProvider.php
+++ b/src/State/ClientTicketProvider.php
@@ -54,17 +54,27 @@ final readonly class ClientTicketProvider implements ProviderInterface
        // Apply filters from query parameters
        $filters = $context['filters'] ?? [];
        if (isset($filters['project'])) {
-            $projectId = is_numeric($filters['project']) ? (int) $filters['project'] : (int) basename($filters['project']);
-            $qb->andWhere('ct.project = :project')->setParameter('project', $projectId);
+            $qb->andWhere('ct.project = :project')
+                ->setParameter('project', self::extractId($filters['project']))
+            ;
        }
        if (isset($filters['status'])) {
            $qb->andWhere('ct.status = :status')->setParameter('status', $filters['status']);
        }
        if (isset($filters['submittedBy']) && $this->security->isGranted('ROLE_ADMIN')) {
-            $submittedById = is_numeric($filters['submittedBy']) ? (int) $filters['submittedBy'] : (int) basename($filters['submittedBy']);
-            $qb->andWhere('ct.submittedBy = :submittedBy')->setParameter('submittedBy', $submittedById);
+            $qb->andWhere('ct.submittedBy = :submittedBy')
+                ->setParameter('submittedBy', self::extractId($filters['submittedBy']))
+            ;
        }

        return $qb->getQuery()->getResult();
    }
+
+    /**
+     * Extract an entity ID from a value that may be a numeric ID or an IRI string.
+     */
+    private static function extractId(string $value): int
+    {
+        return is_numeric($value) ? (int) $value : (int) basename($value);
+    }
 }
--- a/src/State/ClientTicketStatusProcessor.php
+++ b/src/State/ClientTicketStatusProcessor.php
@@ -35,18 +35,21 @@ final readonly class ClientTicketStatusProcessor implements ProcessorInterface

        $originalData = $context['previous_data'] ?? null;

-        // ROLE_CLIENT: can only edit content fields, not status
-        if (!$this->security->isGranted('ROLE_ADMIN') && $originalData instanceof ClientTicket) {
-            $data->setStatus($originalData->getStatus());
-            $data->setStatusComment($originalData->getStatusComment());
-        }
+        $statusChanged = false;

        if ($originalData instanceof ClientTicket) {
+            // ROLE_CLIENT: can only edit content fields, not status
+            if (!$this->security->isGranted('ROLE_ADMIN')) {
+                $data->setStatus($originalData->getStatus());
+                $data->setStatusComment($originalData->getStatusComment());
+            }
+
            $oldStatus = $originalData->getStatus();
            $newStatus = $data->getStatus();

            if ($oldStatus !== $newStatus) {
-                $forbidden = self::FORBIDDEN_TRANSITIONS[$oldStatus] ?? [];
+                $statusChanged = true;
+                $forbidden     = self::FORBIDDEN_TRANSITIONS[$oldStatus] ?? [];
                if (in_array($newStatus, $forbidden, true)) {
                    throw new BadRequestHttpException(sprintf('Transition from "%s" to "%s" is not allowed.', $oldStatus, $newStatus));
                }
@@ -62,7 +65,9 @@ final readonly class ClientTicketStatusProcessor implements ProcessorInterface
        $this->entityManager->persist($data);
        $this->entityManager->flush();

-        $this->notificationService->createForStatusChange($data);
+        if ($statusChanged) {
+            $this->notificationService->createForStatusChange($data);
+        }

        return $data;
    }
--- a/src/State/GiteaBranchNameProvider.php
+++ b/src/State/GiteaBranchNameProvider.php
@@ -15,6 +15,7 @@ use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;

 final readonly class GiteaBranchNameProvider implements ProviderInterface
 {
+    /** @see GiteaBranchProcessor::ALLOWED_TYPES */
    private const array ALLOWED_TYPES = ['feature', 'fix', 'refactor', 'hotfix', 'chore'];

    public function __construct(
--- a/src/State/TaskDocumentProcessor.php
+++ b/src/State/TaskDocumentProcessor.php
@@ -24,6 +24,35 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface
 {
    private const MAX_FILE_SIZE = 50 * 1024 * 1024; // 50 MB

+    private const ALLOWED_MIME_TYPES = [
+        'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/svg+xml',
+        'application/pdf',
+        'application/msword',
+        'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        'application/vnd.ms-excel',
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+        'application/vnd.ms-powerpoint',
+        'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+        'text/plain', 'text/csv',
+        'application/zip', 'application/x-rar-compressed', 'application/gzip',
+        'application/json', 'application/xml', 'text/xml',
+    ];
+
+    private const MIME_TO_EXTENSION = [
+        'image/jpeg'                                                                => 'jpg', 'image/png' => 'png', 'image/gif' => 'gif',
+        'image/webp'                                                                => 'webp', 'image/svg+xml' => 'svg',
+        'application/pdf'                                                           => 'pdf',
+        'application/msword'                                                        => 'doc',
+        'application/vnd.openxmlformats-officedocument.wordprocessingml.document'   => 'docx',
+        'application/vnd.ms-excel'                                                  => 'xls',
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'         => 'xlsx',
+        'application/vnd.ms-powerpoint'                                             => 'ppt',
+        'application/vnd.openxmlformats-officedocument.presentationml.presentation' => 'pptx',
+        'text/plain'                                                                => 'txt', 'text/csv' => 'csv',
+        'application/zip'                                                           => 'zip', 'application/x-rar-compressed' => 'rar', 'application/gzip' => 'gz',
+        'application/json'                                                          => 'json', 'application/xml' => 'xml', 'text/xml' => 'xml',
+    ];
+
    public function __construct(
        private EntityManagerInterface $entityManager,
        private Security $security,
@@ -52,50 +81,48 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface
            throw new BadRequestHttpException('File size exceeds 50 MB limit.');
        }

-        $taskIri         = $request->request->get('task');
-        $clientTicketIri = $request->request->get('clientTicket');
+        $taskIri         = $request->request->get('task', '');
+        $clientTicketIri = $request->request->get('clientTicket', '');

-        if ((null === $taskIri || '' === $taskIri) && (null === $clientTicketIri || '' === $clientTicketIri)) {
+        if ('' === $taskIri && '' === $clientTicketIri) {
            throw new BadRequestHttpException('Either task or clientTicket IRI is required.');
        }

        $task         = null;
        $clientTicket = null;

-        if (null !== $taskIri && '' !== $taskIri) {
-            // Extract task ID from IRI (e.g., "/api/tasks/42" -> 42)
-            $taskId = (int) basename((string) $taskIri);
-            $task   = $this->entityManager->getRepository(Task::class)->find($taskId);
+        if ('' !== $taskIri) {
+            $task = $this->entityManager->getRepository(Task::class)->find((int) basename($taskIri));

            if (null === $task) {
                throw new BadRequestHttpException('Task not found.');
            }
        }

-        if (null !== $clientTicketIri && '' !== $clientTicketIri) {
-            $clientTicketId = (int) basename((string) $clientTicketIri);
-            $clientTicket   = $this->entityManager->getRepository(ClientTicket::class)->find($clientTicketId);
+        if ('' !== $clientTicketIri) {
+            $clientTicket = $this->entityManager->getRepository(ClientTicket::class)->find((int) basename($clientTicketIri));

            if (null === $clientTicket) {
                throw new BadRequestHttpException('Client ticket not found.');
            }

-            // Ownership validation for ROLE_CLIENT
-            if (!$this->security->isGranted('ROLE_ADMIN')) {
-                $currentUser = $this->security->getUser();
-                if ($clientTicket->getSubmittedBy() !== $currentUser) {
-                    throw new AccessDeniedHttpException('You can only upload documents to your own tickets.');
-                }
+            if (!$this->security->isGranted('ROLE_ADMIN') && $clientTicket->getSubmittedBy() !== $this->security->getUser()) {
+                throw new AccessDeniedHttpException('You can only upload documents to your own tickets.');
            }
        }

-        // Capture file metadata BEFORE move() — move invalidates the temp file
+        // Use server-detected MIME type (finfo), not the client-supplied one
        $originalName = $file->getClientOriginalName();
-        $extension    = $file->getClientOriginalExtension() ?: 'bin';
-        $mimeType     = $file->getClientMimeType() ?? 'application/octet-stream';
+        $mimeType     = $file->getMimeType() ?: 'application/octet-stream';
        $fileSize     = $file->getSize();
-        $uuid         = Uuid::v4()->toRfc4122();
-        $fileName     = $uuid.'.'.$extension;
+
+        if (!in_array($mimeType, self::ALLOWED_MIME_TYPES, true)) {
+            throw new BadRequestHttpException(sprintf('File type "%s" is not allowed.', $mimeType));
+        }
+
+        $extension = self::MIME_TO_EXTENSION[$mimeType] ?? 'bin';
+        $uuid      = Uuid::v4()->toRfc4122();
+        $fileName  = $uuid.'.'.$extension;

        if (!is_dir($this->uploadDir)) {
            mkdir($this->uploadDir, 0o775, true);
--- a/src/State/TaskNumberProcessor.php
+++ b/src/State/TaskNumberProcessor.php
@@ -9,6 +9,7 @@ use ApiPlatform\Metadata\Post;
 use ApiPlatform\State\ProcessorInterface;
 use App\Entity\Task;
 use App\Repository\TaskRepository;
+use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Component\DependencyInjection\Attribute\Autowire;

 /**
@@ -23,6 +24,7 @@ final readonly class TaskNumberProcessor implements ProcessorInterface
        #[Autowire(service: 'api_platform.doctrine.orm.state.persist_processor')]
        private ProcessorInterface $persistProcessor,
        private TaskRepository $taskRepository,
+        private EntityManagerInterface $entityManager,
    ) {}

    /**
@@ -31,8 +33,12 @@ final readonly class TaskNumberProcessor implements ProcessorInterface
    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
    {
        if ($operation instanceof Post && null !== $data->getProject()) {
-            $maxNumber = $this->taskRepository->findMaxNumberByProject($data->getProject());
-            $data->setNumber($maxNumber + 1);
+            return $this->entityManager->wrapInTransaction(function () use ($data, $operation, $uriVariables, $context) {
+                $maxNumber = $this->taskRepository->findMaxNumberByProjectForUpdate($data->getProject());
+                $data->setNumber($maxNumber + 1);
+
+                return $this->persistProcessor->process($data, $operation, $uriVariables, $context);
+            });
        }

        return $this->persistProcessor->process($data, $operation, $uriVariables, $context);
--- a/src/State/UserPasswordHasherProcessor.php
+++ b/src/State/UserPasswordHasherProcessor.php
@@ -29,10 +29,10 @@ final readonly class UserPasswordHasherProcessor implements ProcessorInterface
     */
    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
    {
-        if (null !== $data->getPassword() && !str_starts_with($data->getPassword(), '$')) {
-            $data->setPassword(
-                $this->passwordHasher->hashPassword($data, $data->getPassword())
-            );
+        $plainPassword = $data->getPassword();
+
+        if (null !== $plainPassword && !str_starts_with($plainPassword, '$')) {
+            $data->setPassword($this->passwordHasher->hashPassword($data, $plainPassword));
        }

        return $this->persistProcessor->process($data, $operation, $uriVariables, $context);
Author	SHA1	Message	Date
Matthieu	d2e9f9ed65	chore : bump version to 0.2.2 All checks were successful Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Successful in 1m31s Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-16 16:35:08 +01:00
Matthieu	c5898fbf74	feat(ui) : add create task button on my-tasks and responsive kanban columns - Add "Créer une tâche" button on my-tasks page with mandatory project selector - TaskModal now accepts optional projects prop for project selection in create mode - Replace fixed-width kanban columns (w-72 shrink-0) with flexible layout (min-w-36 flex-1) - Add min-w-0 and overflow-x-hidden on default layout to properly contain content - Kanban now adapts to screen size from 1024px to 1920px+ Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-16 16:35:02 +01:00
Matthieu	0180dd3715	chore : bump version to 0.2.1 All checks were successful Auto Tag Develop / tag (push) Successful in 5s Details Build Release Artefact / build (push) Successful in 1m32s Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-16 14:41:38 +01:00
Matthieu	0f99098291	chore : bump version to 0.2.0 and update deploy doc Some checks failed Auto Tag Develop / tag (push) Successful in 5s Details Build Release Artefact / build (push) Failing after 1m25s Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-16 14:29:41 +01:00
Matthieu	1c6f473dff	feat(mcp) : add clientTicket relation to time entries Add ManyToOne relation from TimeEntry to ClientTicket entity. MCP tools create-time-entry, update-time-entry, and list-time-entries now support clientTicketId parameter for linking tickets to time entries. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-16 14:28:31 +01:00
Matthieu	c95fff530c	docs(deploy) : add deployment guide and MCP connection tutorial Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-16 14:28:31 +01:00
gitea-actions	fb0e6c1ea4	chore: bump version to v0.1.2 All checks were successful Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Successful in 1m19s Details	2026-03-16 08:52:02 +00:00
Matthieu	6d3ecc1322	Merge branch 'feature/client-portal' into develop Some checks failed Auto Tag Develop / tag (push) Has been cancelled Details	2026-03-16 09:51:48 +01:00
Matthieu	f5986090c0	feat(deploy) : add deploy script and nginx config for bare Ubuntu server Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-16 09:51:29 +01:00
Matthieu	d6399c20e1	fix : fix MCP create-task tool crashing on task creation CreateTaskTool called nonexistent findMaxNumberByProject instead of findMaxNumberByProjectForUpdate. Also removed FOR UPDATE clause from the query as PostgreSQL does not support it with aggregate functions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-16 09:26:36 +01:00
Matthieu	a972d243f5	style : center and resize view toggle buttons on my-tasks page Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-16 09:26:34 +01:00
Matthieu	56bf88f293	fix : prevent document delete button from submitting the TaskModal form The delete button in TaskDocumentList lacked type="button", causing it to act as a submit button inside the form, which triggered handleSubmit and closed the modal before the confirmation dialog could appear. Also added guards to prevent closing TaskModal while a sub-modal is open. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-16 09:26:32 +01:00
matthieu	9d80e017c2	docs : complete architecture tree in README with all directories Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:27:52 +01:00
matthieu	4e91507158	docs : rewrite README with full project documentation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:25:42 +01:00
matthieu	318f14ea88	docs : update CLAUDE.md with avatar feature context and gotchas Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:21:12 +01:00
matthieu	202b516dc3	fix(avatar) : install symfony/mime for server-side MIME type detection Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:13:18 +01:00
matthieu	98782a9849	fix(avatar) : add explicit import for useAvatarService in profile page Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:12:38 +01:00
matthieu	b978adf9ae	fix(avatar) : move avatar service to composables for Nuxt auto-import Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:11:03 +01:00
matthieu	e4fc34b90f	refactor : simplify codebase and fix critical issues Backend: - Add MCP Serializer to centralize entity-to-array conversion (~300 lines deduped) - Fix race condition in task/ticket number generation (SELECT FOR UPDATE + transaction) - Add unique constraint on task (project_id, number) with migration - Fix MIME type validation: use server-detected finfo instead of client-supplied type - Add allowlist of permitted MIME types for uploads - Fix TaskDocumentDownloadController: allow ROLE_CLIENT access, add priority:1 - Fix notification sent even when ticket status unchanged - Remove redundant exception constructors - Simplify services (BookStackApi double fetch, TokenEncryptor, GiteaApi) - Consolidate duplicate checks in processors Frontend: - Fix useApi isHandlingUnauthorized scope (module-level to prevent double 401 redirect) - Fix client-tickets toast key copy-paste bug - Merge duplicated tasks service methods (getByProject + getByProjectArchived) - Extract shared uploadWithRelation helper in task-documents service - Extract formatFileSize utility from duplicated component code - Extract status transition logic into useClientTicketHelpers composable - Remove dead code (unused router, handleLogout, empty script blocks) - Merge duplicate watchers and onMounted calls - Normalize arrow functions to function declarations per convention Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:09:16 +01:00
matthieu	a5144443a4	fix(avatar) : address review findings — security and UX fixes - Use getMimeType() instead of getClientMimeType() to prevent MIME spoofing - Change IsGranted to IS_AUTHENTICATED_FULLY so ROLE_CLIENT can access avatars - Remove Groups from avatarFileName (only avatarUrl needed by frontend) - Disable aggressive caching to prevent stale avatar images - Add error handling to avatar upload in profile page - Use i18n for "Mon profil" button text Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:02:27 +01:00
matthieu	afd4baed92	feat(avatar) : replace initials with UserAvatar component everywhere Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:58:46 +01:00
matthieu	e8f0202b15	feat(avatar) : add profile page with avatar upload and crop Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:57:55 +01:00
matthieu	962b3d935c	feat(avatar) : add AvatarCropper modal with vue-advanced-cropper Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:56:11 +01:00
matthieu	cea22f977b	feat(avatar) : add UserAvatar component with image/initials fallback Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:55:52 +01:00
matthieu	5613a7c92b	feat(avatar) : add avatar service, DTO update, and cropper dependency Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:55:39 +01:00
matthieu	4d0aa65920	feat(avatar) : add avatar upload/serve/delete controller Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:54:23 +01:00
matthieu	63315c0a15	feat(avatar) : add avatarFileName field to User entity Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:53:43 +01:00
matthieu	cff16611f4	docs : add user avatar implementation plan Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:50:07 +01:00
matthieu	96f5c7c91c	docs : add user avatar feature design spec Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:47:38 +01:00
matthieu	f7a76c9e9b	feat(frontend) : add date filter component to time-tracking page Reusable DateFilter component using @vuepic/vue-datepicker with day/week toggle. Selecting a day switches to day view, selecting a week navigates the calendar to that week. Includes "Aujourd'hui" and "Cette semaine" quick shortcuts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:46:48 +01:00
matthieu	7047f64a6b	fix(portal) : handle submittedBy as object or IRI in canEdit check Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:40:54 +01:00
matthieu	cd8cea45c1	fix(security) : allow ROLE_CLIENT to read projects Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:39:41 +01:00
matthieu	1f31a3a33f	fix(portal) : embed project id/name in /me response for client users Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:37:18 +01:00
matthieu	254f8bc411	fix(admin) : handle null/IRI client in project filter for UserDrawer Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:34:21 +01:00
matthieu	239cd6398e	docs : update CLAUDE.md with client portal context and gotchas Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:26:05 +01:00
gitea-actions	4216f1b5a1	chore: bump version to v0.1.1 All checks were successful Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Successful in 1m17s Details	2026-03-15 18:07:23 +00:00