chore : bump version to 0.2.0 and update deploy doc

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat(mcp) : add clientTicket relation to time entries
2026-03-16 14:29:41 +01:00 · 2026-03-16 14:28:31 +01:00 · 2026-03-16 14:28:31 +01:00 · 2026-03-16 08:52:02 +00:00 · 2026-03-16 09:51:48 +01:00 · 2026-03-16 09:51:29 +01:00
99 changed files with 4770 additions and 760 deletions
--- a/.gitea/workflows/release-artefact.yml
+++ b/.gitea/workflows/release-artefact.yml
@@ -45,6 +45,7 @@ jobs:
          set -euo pipefail
          mkdir -p release
          tar -czf "release/lesstime-${GITHUB_REF_NAME}.tar.gz" \
+            .env \
            bin \
            config \
            migrations \
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -12,9 +12,11 @@ Application de gestion de projet. Monorepo Symfony 8 (API Platform 4) + Nuxt 4.
 ## Structure

 ```
-src/Entity/          # Entités Doctrine (User, Client, Project, Task, TaskStatus, TaskEffort, TaskPriority, TaskTag, TaskGroup, TimeEntry, GiteaConfiguration)
+src/Entity/          # Entités Doctrine (User, Client, Project, Task, TaskStatus, TaskEffort, TaskPriority, TaskTag, TaskGroup, TimeEntry, GiteaConfiguration, ClientTicket, Notification, TaskDocument)
 src/ApiResource/     # Ressources API Platform (si découplées des entités)
-src/State/           # Providers et Processors API Platform (MeProvider, AppVersionProvider, ActiveTimeEntryProvider, UserPasswordHasherProcessor, TaskNumberProcessor, Gitea*Provider, Gitea*Processor)
+src/State/           # Providers et Processors API Platform (MeProvider, AppVersionProvider, ActiveTimeEntryProvider, UserPasswordHasherProcessor, TaskNumberProcessor, ClientTicket*Provider/Processor, NotificationProvider, Gitea*Provider, Gitea*Processor)
+src/Service/         # Services métier (NotificationService)
+src/Controller/      # Controllers custom Symfony (NotificationUnreadCountController, MarkAllReadController, UserAvatarController, TaskDocumentDownloadController)
 src/Mcp/Tool/        # MCP tools organisés par domaine (Project/, Task/, TaskMeta/, TimeEntry/, Reference/)
 src/Security/        # Authenticators custom (ApiTokenAuthenticator pour MCP HTTP)
 src/Command/         # Commandes console (GenerateApiTokenCommand)
@@ -26,12 +28,12 @@ migrations/          # Migrations Doctrine
 docs/plans/          # Plans d'implémentation
 docs/superpowers/    # Plans et specs superpowers
 frontend/            # App Nuxt 4
-frontend/pages/      # Pages (index, login, my-tasks, projects, projects/[id], projects/[id]/groups, projects/[id]/archives, time-tracking, admin)
-frontend/layouts/    # Layouts (pas "layout")
-frontend/components/ # Composants Vue organisés en sous-dossiers (ui/, client/, project/, task/, user/, admin/, time-tracking/)
-frontend/composables/# Composables (useApi, useAppVersion)
+frontend/pages/      # Pages (index, login, my-tasks, profile, projects, projects/[id], projects/[id]/groups, projects/[id]/archives, time-tracking, admin, portal/, portal/projects/[id], portal/projects/[id]/new-ticket)
+frontend/layouts/    # Layouts (default, portal)
+frontend/components/ # Composants Vue organisés en sous-dossiers (ui/, client/, project/, task/, user/, admin/, time-tracking/, client-ticket/, notification/)
+frontend/composables/# Composables (useApi, useAppVersion, useNotifications, useClientTicketHelpers, useAvatarService)
 frontend/stores/     # Stores Pinia (auth, ui, timer)
-frontend/services/   # Services API (auth, clients, gitea, projects, tasks, task-statuses, task-efforts, task-groups, task-priorities, task-tags, users, time-entries)
+frontend/services/   # Services API (auth, clients, gitea, projects, tasks, task-statuses, task-efforts, task-groups, task-priorities, task-tags, users, time-entries, client-tickets, notifications, task-documents)
 frontend/services/dto/ # Types TypeScript
 frontend/i18n/locales/ # Fichiers de traduction (langDir résolu depuis i18n/)
 ```
@@ -73,6 +75,13 @@ Exemples : `feat : add login page`, `fix(auth) : prevent null token crash`
 - Routes API préfixées `/api` (via `config/routes/api_platform.yaml`)
 - Le login (`/login_check`) est hors prefix `/api`, nginx réécrit `REQUEST_URI` vers `/login_check`
 - PHP CS Fixer : règles Symfony + PSR-12 + strict types
+- Rôles : `ROLE_ADMIN`, `ROLE_USER`, `ROLE_CLIENT` — hiérarchie dans `security.yaml`
+- `User::getRoles()` n'ajoute PAS `ROLE_USER` si l'user a `ROLE_CLIENT` (isolation)
+- PostgreSQL : `LIKE` sur colonne JSON ne marche pas → utiliser `roles::text LIKE` via native SQL
+- Controllers custom sous `/api/` : ajouter `priority: 1` sur `#[Route]` pour éviter le conflit avec API Platform `{id}`
+- Serialization : pour embarquer une relation (pas IRI), ajouter le groupe du parent aux propriétés de l'entité cible
+- Upload fichiers : utiliser `$file->getMimeType()` (pas `getClientMimeType()`) pour valider côté serveur — nécessite `symfony/mime`
+- Auth endpoints mixtes (ROLE_USER + ROLE_CLIENT) : utiliser `#[IsGranted('IS_AUTHENTICATED_FULLY')]` au lieu d'un rôle spécifique

 ### Frontend

@@ -82,6 +91,9 @@ Exemples : `feat : add login page`, `fix(auth) : prevent null token crash`
 - Middleware global `auth.global.ts` protège les routes
 - Traductions dans `frontend/i18n/locales/` (le module résout `langDir` depuis `i18n/`)
 - 4 espaces d'indentation
+- MalioSelect : options `{ label: string, value: number | null }` uniquement — pas de string values, utiliser `<select>` natif pour les enums string
+- Portal client : pages sous `/portal/`, layout `portal.vue`, middleware redirige `ROLE_CLIENT` (sans `ROLE_ADMIN`) vers `/portal`
+- Users admin+client : ne pas bloquer — vérifier `ROLE_CLIENT && !ROLE_ADMIN` pour les restrictions

 ### MCP Server

@@ -111,4 +123,6 @@ Exemples : `feat : add login page`, `fix(auth) : prevent null token crash`
 ## Fixtures

 - User admin : `admin` / `admin` (ROLE_ADMIN)
+- Users internes : `alice` / `alice`, `bob` / `bob`, `charlie` / `charlie` (ROLE_USER)
+- Users client : `client-liot` / `client` (ROLE_CLIENT, client LIOT → SIRH), `client-acme` / `client` (ROLE_CLIENT, client ACME → CRM)
 - API token admin (dev) : `dev-mcp-token-for-testing-only-do-not-use-in-production`
--- a/README.md
+++ b/README.md
@@ -1,10 +1,173 @@
 # Lesstime

-Application de gestion de projet. Symfony 8 + API Platform 4 + Nuxt 4.
+Application de gestion de projet avec suivi du temps et portail client.

-## MCP Server
+## Stack

-Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistants IA (Claude Code, ChatGPT, Codex) d'interagir avec les projets, tâches et le suivi du temps.
+| Couche | Technologies |
+|--------|-------------|
+| **Backend** | PHP 8.4, Symfony 8, API Platform 4, Doctrine ORM |
+| **Frontend** | Nuxt 4 (SPA), Vue 3, Pinia, Tailwind CSS |
+| **Base de données** | PostgreSQL 16 |
+| **Auth** | JWT HTTP-only cookie (lexik/jwt-authentication-bundle) |
+| **Infrastructure** | Docker (PHP-FPM, Nginx, PostgreSQL) |
+
+## Fonctionnalités
+
+- Gestion de projets et tâches (kanban, groupes, priorités, tags, efforts)
+- Suivi du temps (timer, calendrier, vue liste)
+- Portail client avec tickets (bug, amélioration, autre)
+- Gestion de documents (upload, prévisualisation, téléchargement)
+- Profil utilisateur avec avatar (crop circulaire)
+- Notifications temps réel
+- Intégration Gitea (issues, repos)
+- Serveur MCP pour assistants IA
+- Multi-langue (i18n)
+
+## Prérequis
+
+- Docker & Docker Compose
+- Git
+
+## Installation
+
+```bash
+# 1. Cloner le repo
+git clone <url> && cd lesstime
+
+# 2. Démarrer les containers
+make start
+
+# 3. Installation complète (composer, migrations, fixtures, build Nuxt)
+make install
+```
+
+L'application est accessible sur **http://localhost:8082**.
+
+### Comptes de test (fixtures)
+
+| Utilisateur | Mot de passe | Rôle | Détails |
+|-------------|-------------|------|---------|
+| `admin` | `admin` | ROLE_ADMIN | Administrateur |
+| `alice` | `alice` | ROLE_USER | Utilisateur interne |
+| `bob` | `bob` | ROLE_USER | Utilisateur interne |
+| `charlie` | `charlie` | ROLE_USER | Utilisateur interne |
+| `client-liot` | `client` | ROLE_CLIENT | Client LIOT (projet SIRH) |
+| `client-acme` | `client` | ROLE_CLIENT | Client ACME (projet CRM) |
+
+## Commandes
+
+### Docker
+
+```bash
+make start              # Démarrer les containers
+make stop               # Arrêter les containers
+make restart            # Redémarrer les containers
+make shell              # Shell dans le container PHP
+make shell-root         # Shell root dans le container PHP
+```
+
+### Développement
+
+```bash
+make dev-nuxt           # Dev server Nuxt (hot reload, port 3002)
+make cache-clear        # Vider le cache Symfony
+make logs-dev           # Tail logs Symfony
+```
+
+### Base de données
+
+```bash
+make migration-migrate  # Lancer les migrations
+make fixtures           # Charger les fixtures
+make db-reset           # Reset BDD + migrations + fixtures (⚠️ supprime les données)
+```
+
+### Tests & Qualité
+
+```bash
+make test                       # PHPUnit
+make php-cs-fixer-allow-risky   # Fix code style PHP (Symfony + PSR-12)
+```
+
+### Installation complète
+
+```bash
+make install            # Composer + migrations + fixtures + build Nuxt
+make reset              # Tout supprimer et réinstaller (⚠️ supprime la BDD)
+```
+
+## Architecture
+
+```
+src/
+├── Entity/             # Entités Doctrine
+├── ApiResource/        # Ressources API Platform (découplées)
+├── State/              # Providers et Processors API Platform
+├── Controller/         # Controllers custom Symfony
+├── Service/            # Services métier
+├── EventListener/      # Listeners Doctrine
+├── Exception/          # Exceptions custom
+├── Security/           # Authenticators custom
+├── Repository/         # Repositories Doctrine
+├── Command/            # Commandes console
+├── DataFixtures/       # Fixtures
+└── Mcp/Tool/           # MCP tools par domaine
+    ├── Project/
+    ├── Task/
+    ├── TaskMeta/
+    ├── TimeEntry/
+    └── Reference/
+
+frontend/
+├── pages/              # Pages Nuxt (routing auto)
+│   ├── portal/         # Pages portail client
+│   └── projects/       # Pages projets
+├── layouts/            # Layouts (default, portal)
+├── components/         # Composants Vue
+│   ├── ui/             # Composants génériques
+│   ├── task/           # Tâches
+│   ├── user/           # Utilisateur (avatar, etc.)
+│   ├── project/        # Projets
+│   ├── client/         # Clients
+│   ├── client-ticket/  # Tickets client
+│   ├── admin/          # Administration
+│   ├── notification/   # Notifications
+│   └── time-tracking/  # Suivi du temps
+├── composables/        # Composables (useApi, useNotifications, etc.)
+├── stores/             # Stores Pinia (auth, ui, timer)
+├── services/           # Services API
+│   └── dto/            # Types TypeScript
+├── plugins/            # Plugins Nuxt
+├── utils/              # Utilitaires
+├── i18n/locales/       # Traductions
+└── middleware/          # Middleware auth
+
+config/                 # Config Symfony
+migrations/             # Migrations Doctrine
+docker/                 # Dockerfiles et config Nginx
+```
+
+## Docker
+
+| Container | Port | Description |
+|-----------|------|-------------|
+| `php-lesstime-fpm` | 3002 (dev Nuxt) | PHP-FPM + Node 24 |
+| `nginx-lesstime` | 8082 | Nginx reverse proxy |
+| PostgreSQL | 5435 | Base de données |
+
+Configuration : `docker/.env.docker` (override local : `docker/.env.docker.local`)
+
+## API
+
+Toutes les routes API sont préfixées `/api` (API Platform).
+
+- Documentation auto-générée : **http://localhost:8082/api**
+- Auth : `POST /login_check` avec `{ username, password }` → cookie JWT `BEARER`
+
+## Serveur MCP
+
+Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistants IA d'interagir avec les données.

 ### Tools disponibles (22)

@@ -16,13 +179,6 @@ Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistant
 | TaskMeta | `list-statuses`, `list-priorities`, `list-efforts`, `list-tags`, `list-groups`, `create-group`, `update-group` |
 | TimeEntry | `list-time-entries`, `create-time-entry`, `update-time-entry`, `delete-time-entry` |

-### Transports
-
-| Transport | Usage | Auth |
-|-----------|-------|------|
-| **STDIO** | Claude Code sur la machine locale | Aucune |
-| **HTTP** (`/_mcp`) | Clients MCP sur le réseau local | API token (`Authorization: Bearer <token>`) |
-
 ### Configuration locale (STDIO)

 ```json
@@ -55,17 +211,19 @@ Lesstime expose un serveur MCP (Model Context Protocol) permettant aux assistant
 ### Gestion des tokens API

 ```bash
-# Générer un token pour un utilisateur
 docker exec -u www-data php-lesstime-fpm php bin/console app:generate-api-token <username>
 ```

-### Mise en production (réseau local)
+## Déploiement

 1. Déployer le code sur le serveur
 2. `composer install --no-dev --optimize-autoloader`
 3. `php bin/console doctrine:migrations:migrate --no-interaction`
 4. `php bin/console cache:clear --env=prod`
-5. `docker restart nginx-lesstime`
-6. `php bin/console app:generate-api-token admin` — noter le token
-7. Ouvrir le port 8082 sur le firewall du serveur (LAN uniquement)
-8. Configurer les clients MCP avec l'URL `http://<ip-serveur>:8082/_mcp` + le token
+5. `cd frontend && npm install && npm run build:dist`
+6. `docker restart nginx-lesstime`
+7. Ouvrir le port 8082 sur le firewall (LAN uniquement)
+
+## Licence
+
+Propriétaire — Tous droits réservés.
--- a/composer.json
+++ b/composer.json
@@ -25,6 +25,7 @@
        "symfony/framework-bundle": "8.0.*",
        "symfony/http-client": "8.0.*",
        "symfony/mcp-bundle": "^0.6.0",
+        "symfony/mime": "8.0.*",
        "symfony/property-access": "8.0.*",
        "symfony/property-info": "8.0.*",
        "symfony/runtime": "8.0.*",
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "75b9dbecf38167d0554dfd64a986a40e",
+    "content-hash": "3e2146f74bbda750c75ab52eb437d2d4",
    "packages": [
        {
            "name": "api-platform/doctrine-common",
@@ -5703,6 +5703,92 @@
            ],
            "time": "2026-03-04T16:39:24+00:00"
        },
+        {
+            "name": "symfony/mime",
+            "version": "v8.0.7",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/mime.git",
+                "reference": "5d26d1958aeeba2ace8cc64a3a93d4f5d8f8022b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/mime/zipball/5d26d1958aeeba2ace8cc64a3a93d4f5d8f8022b",
+                "reference": "5d26d1958aeeba2ace8cc64a3a93d4f5d8f8022b",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.4",
+                "symfony/polyfill-intl-idn": "^1.10",
+                "symfony/polyfill-mbstring": "^1.0"
+            },
+            "conflict": {
+                "egulias/email-validator": "~3.0.0",
+                "phpdocumentor/reflection-docblock": "<5.2|>=7",
+                "phpdocumentor/type-resolver": "<1.5.1"
+            },
+            "require-dev": {
+                "egulias/email-validator": "^2.1.10|^3.1|^4",
+                "league/html-to-markdown": "^5.0",
+                "phpdocumentor/reflection-docblock": "^5.2|^6.0",
+                "symfony/dependency-injection": "^7.4|^8.0",
+                "symfony/process": "^7.4|^8.0",
+                "symfony/property-access": "^7.4|^8.0",
+                "symfony/property-info": "^7.4|^8.0",
+                "symfony/serializer": "^7.4|^8.0"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "Symfony\\Component\\Mime\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Fabien Potencier",
+                    "email": "fabien@symfony.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Allows manipulating MIME messages",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "mime",
+                "mime-type"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/mime/tree/v8.0.7"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-03-06T13:17:40+00:00"
+        },
        {
            "name": "symfony/password-hasher",
            "version": "v8.0.6",
@@ -5858,6 +5944,93 @@
            ],
            "time": "2025-06-27T09:58:17+00:00"
        },
+        {
+            "name": "symfony/polyfill-intl-idn",
+            "version": "v1.33.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/polyfill-intl-idn.git",
+                "reference": "9614ac4d8061dc257ecc64cba1b140873dce8ad3"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-idn/zipball/9614ac4d8061dc257ecc64cba1b140873dce8ad3",
+                "reference": "9614ac4d8061dc257ecc64cba1b140873dce8ad3",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.2",
+                "symfony/polyfill-intl-normalizer": "^1.10"
+            },
+            "suggest": {
+                "ext-intl": "For best performance"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "bootstrap.php"
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Intl\\Idn\\": ""
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Laurent Bassin",
+                    "email": "laurent@bassin.info"
+                },
+                {
+                    "name": "Trevor Rowbotham",
+                    "email": "trevor.rowbotham@pm.me"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Symfony polyfill for intl's idn_to_ascii and idn_to_utf8 functions",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "compatibility",
+                "idn",
+                "intl",
+                "polyfill",
+                "portable",
+                "shim"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/polyfill-intl-idn/tree/v1.33.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2024-09-10T14:38:51+00:00"
+        },
        {
            "name": "symfony/polyfill-intl-normalizer",
            "version": "v1.33.0",
--- a/config/packages/http_discovery.yaml
+++ b/config/packages/http_discovery.yaml
@@ -0,0 +1,10 @@
+services:
+    Psr\Http\Message\RequestFactoryInterface: '@http_discovery.psr17_factory'
+    Psr\Http\Message\ResponseFactoryInterface: '@http_discovery.psr17_factory'
+    Psr\Http\Message\ServerRequestFactoryInterface: '@http_discovery.psr17_factory'
+    Psr\Http\Message\StreamFactoryInterface: '@http_discovery.psr17_factory'
+    Psr\Http\Message\UploadedFileFactoryInterface: '@http_discovery.psr17_factory'
+    Psr\Http\Message\UriFactoryInterface: '@http_discovery.psr17_factory'
+
+    http_discovery.psr17_factory:
+        class: Http\Discovery\Psr17Factory
--- a/config/services.yaml
+++ b/config/services.yaml
@@ -8,6 +8,7 @@
 # https://symfony.com/doc/current/best_practices.html#use-parameters-for-application-configuration
 parameters:
    task_document_upload_dir: '%kernel.project_dir%/var/uploads/documents'
+    avatar_upload_dir: '%kernel.project_dir%/var/uploads/avatars'

 imports:
    - { resource: version.yaml }
@@ -39,3 +40,7 @@ services:
    App\Controller\TaskDocumentDownloadController:
        arguments:
            $uploadDir: '%task_document_upload_dir%'
+
+    App\Controller\UserAvatarController:
+        arguments:
+            $avatarUploadDir: '%avatar_upload_dir%'
--- a/config/version.yaml
+++ b/config/version.yaml
@@ -1,2 +1,2 @@
 parameters:
-    app.version: '0.1.0'
+    app.version: '0.2.0'
--- a/deploy/nginx/lesstime.conf
+++ b/deploy/nginx/lesstime.conf
@@ -0,0 +1,50 @@
+server {
+  listen 80;
+  listen [::]:80;
+  server_name project.malio-dev.fr;
+
+  root /var/www/lesstime/frontend/.output/public;
+  index index.html;
+
+  client_max_body_size 55m;
+
+    location ^~ /api/ {
+        root /var/www/lesstime/public;
+        try_files $uri /index.php?$query_string;
+    }
+
+    location ^~ /bundles/ {
+        root /var/www/lesstime/public;
+        try_files $uri =404;
+    }
+
+    location = /api/login_check {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/lesstime/public/index.php;
+        fastcgi_param DOCUMENT_ROOT /var/www/lesstime/public;
+        fastcgi_param SCRIPT_NAME /index.php;
+        fastcgi_param PATH_INFO /login_check;
+        fastcgi_param REQUEST_URI /login_check;
+        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
+    }
+
+    location ^~ /_mcp {
+        root /var/www/lesstime/public;
+        try_files $uri /index.php?$query_string;
+    }
+
+    location ~ ^/index\.php(/|$) {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /var/www/lesstime/public/index.php;
+        fastcgi_param DOCUMENT_ROOT /var/www/lesstime/public;
+        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
+    }
+
+  location ~ \.php$ {
+      return 404;
+  }
+
+  location / {
+      try_files $uri $uri/ /index.html;
+  }
+}
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -0,0 +1,213 @@
+# Deploiement sur serveur Ubuntu (sans Docker)
+
+## Prerequis
+
+- Ubuntu 22.04+ avec PHP 8.4, Node 24, PostgreSQL 16, Nginx
+- Acces root ou sudo sur le serveur
+
+## 1. Preparer la BDD
+
+```bash
+sudo -u postgres createuser lesstime
+sudo -u postgres createdb -O lesstime lesstime
+sudo -u postgres psql -c "ALTER USER lesstime WITH PASSWORD 'ton-mdp';"
+```
+
+## 2. Creer les dossiers
+
+```bash
+sudo mkdir -p /var/www/lesstime/var/log /var/www/lesstime/var/cache /var/www/lesstime/config/jwt
+sudo chown -R www-data:www-data /var/www/lesstime
+```
+
+## 3. Configurer l'environnement
+
+```bash
+sudo nano /var/www/lesstime/.env
+```
+
+Contenu minimal :
+```ini
+APP_ENV=prod
+```
+
+```bash
+sudo nano /var/www/lesstime/.env.local
+```
+
+Contenu :
+```ini
+APP_ENV=prod
+APP_SECRET=<random-hex-32>
+APP_DEBUG=0
+
+DEFAULT_URI=http://project.malio-dev.fr/
+CORS_ALLOW_ORIGIN='^https?://project\.malio-dev\.fr$'
+
+DATABASE_URL="postgresql://lesstime:<mdp>@localhost:5432/lesstime?serverVersion=16&charset=utf8"
+
+JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
+JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
+JWT_PASSPHRASE=<passphrase>
+JWT_COOKIE_SECURE=0
+JWT_TOKEN_TTL=86400
+JWT_COOKIE_TTL=86400
+
+ENCRYPTION_KEY=<random-hex-32>
+```
+
+> `JWT_COOKIE_SECURE=0` car HTTP. Passer a `1` si HTTPS.
+
+## 4. Installer le script de deploy
+
+```bash
+sudo cp script/deploy-release.sh /usr/local/bin/deploy-lesstime
+sudo chmod +x /usr/local/bin/deploy-lesstime
+```
+
+Si le repo Gitea est prive, configurer un token :
+```bash
+echo "ton-token-gitea" | sudo tee /etc/lesstime-release-token
+sudo chmod 600 /etc/lesstime-release-token
+```
+
+## 5. Deployer une release
+
+```bash
+sudo /usr/local/bin/deploy-lesstime v0.2.0
+```
+
+Le script telecharge l'artefact, extrait les fichiers, clear le cache et lance les migrations.
+
+## 6. Generer les cles JWT
+
+```bash
+cd /var/www/lesstime
+sudo -u www-data php bin/console lexik:jwt:generate-keypair --skip-if-exists --env=prod
+```
+
+## 7. Configurer Nginx
+
+```bash
+sudo cp deploy/nginx/lesstime.conf /etc/nginx/sites-available/lesstime
+sudo ln -sf /etc/nginx/sites-available/lesstime /etc/nginx/sites-enabled/
+sudo nginx -t && sudo systemctl reload nginx
+```
+
+## 8. Creer le premier user admin
+
+Hasher un mot de passe :
+```bash
+php /var/www/lesstime/bin/console security:hash-password --env=prod
+```
+
+Choisir `App\Entity\User`, taper le mdp, copier le hash. Puis :
+```bash
+sudo -u postgres psql lesstime -c "INSERT INTO \"user\" (username, roles, password, created_at) VALUES ('admin', '[\"ROLE_ADMIN\"]', '<le-hash>', NOW());"
+```
+
+## 9. Tester
+
+```bash
+curl http://project.malio-dev.fr/api/version
+curl http://project.malio-dev.fr/
+```
+
+---
+
+# Connecter le serveur MCP a Claude Code
+
+Le serveur MCP expose 22 tools (projets, taches, time tracking avec liaison tickets client, metadonnees) via le endpoint HTTP `/_mcp`.
+
+## 1. Generer un token API
+
+Sur le serveur (ou en local via Docker) :
+
+```bash
+# Production (serveur)
+php /var/www/lesstime/bin/console app:generate-api-token admin --env=prod
+
+# Dev (Docker)
+docker exec -it php-lesstime-fpm php bin/console app:generate-api-token admin
+```
+
+La commande affiche un token de 64 caracteres. Ce token est lie a l'utilisateur et stocke en base (champ `apiToken` de l'entite `User`).
+
+## 2. Configurer Claude Code
+
+### Transport HTTP (recommande pour la prod)
+
+Creer ou modifier `.mcp.json` a la racine du projet :
+
+```json
+{
+    "mcpServers": {
+        "lesstime": {
+            "type": "http",
+            "url": "http://project.malio-dev.fr/_mcp",
+            "headers": {
+                "Authorization": "Bearer <ton-token>"
+            }
+        }
+    }
+}
+```
+
+### Transport STDIO (dev local via Docker)
+
+```json
+{
+    "mcpServers": {
+        "lesstime-local": {
+            "command": "docker",
+            "args": [
+                "exec",
+                "-i",
+                "php-lesstime-fpm",
+                "php",
+                "bin/console",
+                "mcp:server"
+            ]
+        }
+    }
+}
+```
+
+### Transport STDIO via SSH (prod sans endpoint HTTP)
+
+```json
+{
+    "mcpServers": {
+        "lesstime": {
+            "command": "ssh",
+            "args": [
+                "user@serveur",
+                "php",
+                "/var/www/lesstime/bin/console",
+                "mcp:server",
+                "--env=prod"
+            ]
+        }
+    }
+}
+```
+
+## 3. Redemarrer Claude Code
+
+Apres modification de `.mcp.json`, relancer Claude Code pour qu'il detecte le serveur.
+
+## 4. Verifier
+
+Demander a Claude d'utiliser un outil MCP, par exemple :
+- "Liste les projets sur Lesstime"
+- "Cree une tache dans le projet LT"
+
+## Tools disponibles
+
+| Domaine | Tools |
+|---------|-------|
+| Projets | list-projects, get-project, create-project, update-project |
+| Taches | list-tasks, get-task, create-task, update-task, delete-task |
+| Metadonnees | list-statuses, list-priorities, list-efforts, list-tags, list-groups, create-group, update-group |
+| Time tracking | list-time-entries, create-time-entry, update-time-entry, delete-time-entry (supporte clientTicketId) |
+| Reference | list-users, list-clients |
--- a/docs/superpowers/plans/2026-03-15-date-filter.md
+++ b/docs/superpowers/plans/2026-03-15-date-filter.md
@@ -0,0 +1,385 @@
+# Date Filter Component Implementation Plan
+
+> **For agentic workers:** REQUIRED: Use superpowers:subagent-driven-development (if subagents available) or superpowers:executing-plans to implement this plan. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a reusable date filter component to the time-tracking page using `@vuepic/vue-datepicker`, enabling filtering by single day or date range.
+
+**Architecture:** A wrapper component `DateFilter.vue` encapsulates `VueDatePicker` with project-consistent styling. It integrates into the existing filter bar on the time-tracking page. Filtering is client-side, matching the existing project/tag filter pattern.
+
+**Tech Stack:** Vue 3, @vuepic/vue-datepicker, Tailwind CSS, @nuxtjs/i18n
+
+---
+
+## Chunk 1: Setup and Component
+
+### Task 1: Install @vuepic/vue-datepicker and configure Nuxt
+
+**Files:**
+- Modify: `frontend/package.json`
+- Modify: `frontend/nuxt.config.ts:1-66`
+
+- [ ] **Step 1: Install the package**
+
+Run inside the PHP container (where Node is available):
+
+```bash
+cd /home/r-dev/Lesstime/frontend && npm install @vuepic/vue-datepicker
+```
+
+- [ ] **Step 2: Add transpile config to nuxt.config.ts**
+
+In `frontend/nuxt.config.ts`, add `build.transpile` after the `typescript` block:
+
+```typescript
+export default defineNuxtConfig({
+    // ... existing config ...
+    typescript: {
+        strict: true
+    },
+    build: {
+        transpile: ['@vuepic/vue-datepicker']
+    }
+})
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add frontend/package.json frontend/package-lock.json frontend/nuxt.config.ts
+git commit -m "feat(frontend) : add @vuepic/vue-datepicker dependency"
+```
+
+---
+
+### Task 2: Add i18n translations
+
+**Files:**
+- Modify: `frontend/i18n/locales/fr.json:167-170`
+
+- [ ] **Step 1: Add date filter translations to fr.json**
+
+In `frontend/i18n/locales/fr.json`, add keys inside the existing `"common"` block:
+
+```json
+"common": {
+    "cancel": "Annuler",
+    "loading": "Chargement...",
+    "dateFilter": "Date",
+    "today": "Aujourd'hui",
+    "thisWeek": "Cette semaine",
+    "clear": "Effacer"
+}
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add frontend/i18n/locales/fr.json
+git commit -m "feat(frontend) : add date filter i18n translations"
+```
+
+---
+
+### Task 3: Create DateFilter.vue component
+
+**Files:**
+- Create: `frontend/components/ui/DateFilter.vue`
+
+- [ ] **Step 1: Create the component**
+
+Create `frontend/components/ui/DateFilter.vue`:
+
+```vue
+<template>
+    <div class="date-filter">
+        <VueDatePicker
+            v-model="internalValue"
+            :range="isRange"
+            :enable-time-picker="false"
+            :text-input="textInputConfig"
+            :locale="'fr'"
+            :format="formatDate"
+            :preview-format="formatDate"
+            auto-apply
+            :multi-calendars="false"
+            position="left"
+            @update:model-value="onUpdate"
+            @cleared="onClear"
+        >
+            <template #dp-input="{ value, onInput, onEnter, onTab, onClear, openMenu }">
+                <div class="relative">
+                    <input
+                        :value="value"
+                        class="w-full cursor-pointer rounded-md border border-neutral-300 bg-white px-3 py-[7px] text-sm text-neutral-700 outline-none transition placeholder:text-neutral-400 focus:border-primary-500"
+                        :placeholder="placeholder || t('common.dateFilter')"
+                        readonly
+                        @click="openMenu"
+                        @input="onInput"
+                        @keydown.enter="onEnter"
+                        @keydown.tab="onTab"
+                    />
+                    <button
+                        v-if="value"
+                        class="absolute right-2 top-1/2 -translate-y-1/2 text-neutral-400 hover:text-neutral-600"
+                        @click.stop="onClear"
+                    >
+                        <Icon name="mdi:close-circle" size="16" />
+                    </button>
+                    <Icon
+                        v-else
+                        name="mdi:calendar"
+                        size="16"
+                        class="pointer-events-none absolute right-2 top-1/2 -translate-y-1/2 text-neutral-400"
+                    />
+                </div>
+            </template>
+
+            <template #action-buttons>
+                <div class="flex gap-2 px-3 pb-2">
+                    <button
+                        class="rounded px-2 py-1 text-xs font-medium text-primary-500 hover:bg-primary-500/10 transition"
+                        @click="selectToday"
+                    >
+                        {{ t('common.today') }}
+                    </button>
+                    <button
+                        class="rounded px-2 py-1 text-xs font-medium text-primary-500 hover:bg-primary-500/10 transition"
+                        @click="selectThisWeek"
+                    >
+                        {{ t('common.thisWeek') }}
+                    </button>
+                </div>
+            </template>
+        </VueDatePicker>
+    </div>
+</template>
+
+<script setup lang="ts">
+import VueDatePicker from '@vuepic/vue-datepicker'
+import '@vuepic/vue-datepicker/dist/main.css'
+
+const { t } = useI18n()
+
+const props = defineProps<{
+    modelValue?: Date | [Date, Date] | null
+    placeholder?: string
+}>()
+
+const emit = defineEmits<{
+    'update:modelValue': [value: Date | [Date, Date] | null]
+}>()
+
+const isRange = ref(false)
+const internalValue = ref<Date | Date[] | null>(null)
+const firstClick = ref<Date | null>(null)
+
+const textInputConfig = {
+    enterSubmit: true,
+    tabSubmit: true,
+    format: 'dd/MM/yyyy',
+    rangeSeparator: ' - ',
+}
+
+function formatDate(date: Date | Date[]): string {
+    if (Array.isArray(date)) {
+        return date.map(d => formatSingleDate(d)).join(' - ')
+    }
+    return formatSingleDate(date)
+}
+
+function formatSingleDate(d: Date): string {
+    const day = String(d.getDate()).padStart(2, '0')
+    const month = String(d.getMonth() + 1).padStart(2, '0')
+    const year = d.getFullYear()
+    return `${day}/${month}/${year}`
+}
+
+function onUpdate(value: Date | Date[] | null) {
+    if (value === null) {
+        firstClick.value = null
+        isRange.value = false
+        emit('update:modelValue', null)
+        return
+    }
+
+    if (Array.isArray(value) && value.length === 2) {
+        emit('update:modelValue', [value[0], value[1]])
+        return
+    }
+
+    if (value instanceof Date) {
+        if (firstClick.value === null) {
+            // First click — select single day, store for potential range
+            firstClick.value = value
+            emit('update:modelValue', value)
+            // Enable range mode for next click
+            nextTick(() => {
+                isRange.value = true
+            })
+        }
+    }
+}
+
+function onClear() {
+    internalValue.value = null
+    firstClick.value = null
+    isRange.value = false
+    emit('update:modelValue', null)
+}
+
+function selectToday() {
+    const today = new Date()
+    today.setHours(0, 0, 0, 0)
+    isRange.value = false
+    firstClick.value = null
+    internalValue.value = today
+    emit('update:modelValue', today)
+}
+
+function selectThisWeek() {
+    const now = new Date()
+    const day = now.getDay()
+    const monday = new Date(now)
+    monday.setDate(now.getDate() - day + (day === 0 ? -6 : 1))
+    monday.setHours(0, 0, 0, 0)
+    const sunday = new Date(monday)
+    sunday.setDate(monday.getDate() + 6)
+    sunday.setHours(23, 59, 59, 999)
+    isRange.value = true
+    firstClick.value = null
+    internalValue.value = [monday, sunday]
+    emit('update:modelValue', [monday, sunday])
+}
+
+// Sync external modelValue to internal state
+watch(() => props.modelValue, (val) => {
+    if (val === null || val === undefined) {
+        internalValue.value = null
+        firstClick.value = null
+        isRange.value = false
+    } else if (Array.isArray(val)) {
+        isRange.value = true
+        internalValue.value = [...val]
+    } else {
+        isRange.value = false
+        internalValue.value = val
+    }
+}, { immediate: true })
+</script>
+
+<style>
+.date-filter .dp__theme_light {
+    --dp-primary-color: #222783;
+    --dp-primary-text-color: #fff;
+    --dp-border-color: #d4d4d8;
+    --dp-menu-border-color: #d4d4d8;
+    --dp-border-color-hover: #222783;
+    --dp-hover-color: #f3f4f8;
+    --dp-font-size: 0.875rem;
+}
+
+.date-filter .dp__input_wrap {
+    width: auto;
+}
+
+.date-filter .dp__main {
+    font-family: inherit;
+}
+</style>
+```
+
+- [ ] **Step 2: Verify the component renders**
+
+Run `make dev-nuxt` and navigate to the time-tracking page (integration comes in Task 4). Check that no build errors occur.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add frontend/components/ui/DateFilter.vue
+git commit -m "feat(frontend) : create DateFilter reusable component"
+```
+
+---
+
+## Chunk 2: Integration
+
+### Task 4: Integrate DateFilter into time-tracking page
+
+**Files:**
+- Modify: `frontend/pages/time-tracking.vue:15-73` (template filter bar)
+- Modify: `frontend/pages/time-tracking.vue:138` (add ref)
+- Modify: `frontend/pages/time-tracking.vue:184-193` (filteredEntries computed)
+
+- [ ] **Step 1: Add the date filter ref**
+
+In `frontend/pages/time-tracking.vue`, after line 138 (`selectedProjectId`), add:
+
+```typescript
+const selectedDateFilter = ref<Date | [Date, Date] | null>(null)
+```
+
+- [ ] **Step 2: Add DateFilter to the template filter bar**
+
+In the filter bar `<div>` (line 15), after the tag MalioSelect block (after line 72), add:
+
+```vue
+                <DateFilter
+                    v-model="selectedDateFilter"
+                />
+```
+
+- [ ] **Step 3: Add date filtering to filteredEntries computed**
+
+In `frontend/pages/time-tracking.vue`, update the `filteredEntries` computed (around line 184) to include date filtering:
+
+```typescript
+const filteredEntries = computed(() => {
+    let result = entries.value
+    if (selectedProjectId.value) {
+        result = result.filter((e) => e.project?.id === selectedProjectId.value)
+    }
+    if (selectedTagId.value) {
+        result = result.filter((e) => e.tags.some((t) => t.id === selectedTagId.value))
+    }
+    if (selectedDateFilter.value) {
+        if (Array.isArray(selectedDateFilter.value)) {
+            const [start, end] = selectedDateFilter.value
+            const startDay = new Date(start)
+            startDay.setHours(0, 0, 0, 0)
+            const endDay = new Date(end)
+            endDay.setHours(23, 59, 59, 999)
+            result = result.filter((e) => {
+                const entryDate = new Date(e.startedAt)
+                return entryDate >= startDay && entryDate <= endDay
+            })
+        } else {
+            const day = new Date(selectedDateFilter.value)
+            day.setHours(0, 0, 0, 0)
+            const nextDay = new Date(day)
+            nextDay.setDate(nextDay.getDate() + 1)
+            result = result.filter((e) => {
+                const entryDate = new Date(e.startedAt)
+                return entryDate >= day && entryDate < nextDay
+            })
+        }
+    }
+    return result
+})
+```
+
+- [ ] **Step 4: Verify manually**
+
+Run `make dev-nuxt`, navigate to time-tracking page:
+1. Verify DateFilter appears in the filter bar
+2. Click a single day — entries filter to that day
+3. Click a second day — entries filter to the range
+4. Click "Aujourd'hui" — filters to today
+5. Click "Cette semaine" — filters to current week
+6. Clear the filter — all entries show again
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add frontend/pages/time-tracking.vue
+git commit -m "feat(frontend) : integrate date filter into time-tracking page"
+```
--- a/docs/superpowers/plans/2026-03-15-user-avatar.md
+++ b/docs/superpowers/plans/2026-03-15-user-avatar.md
@@ -0,0 +1,802 @@
+# User Avatar Implementation Plan
+
+> **For agentic workers:** REQUIRED: Use superpowers:subagent-driven-development (if subagents available) or superpowers:executing-plans to implement this plan. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Let users upload a cropped profile avatar that replaces initials everywhere in the app.
+
+**Architecture:** New `avatarFileName` column on User entity, dedicated upload/serve/delete controllers, `UserAvatar.vue` component with `vue-advanced-cropper` for circular crop, and a `/profile` page for management.
+
+**Tech Stack:** PHP 8.4/Symfony 8, Doctrine migration, `vue-advanced-cropper`, Nuxt 4 SPA
+
+---
+
+## File Structure
+
+### Backend (create)
+- `src/Controller/UserAvatarController.php` — upload, serve, delete avatar (3 routes)
+
+### Backend (modify)
+- `src/Entity/User.php` — add `avatarFileName` field + `getAvatarUrl()` virtual getter
+- `config/services.yaml` — add `avatar_upload_dir` parameter + wire controller
+
+### Frontend (create)
+- `frontend/components/user/UserAvatar.vue` — reusable avatar display (image or initials fallback)
+- `frontend/components/user/AvatarCropper.vue` — crop modal using `vue-advanced-cropper`
+- `frontend/services/avatar.ts` — avatar API service (upload, remove, getUrl)
+- `frontend/pages/profile.vue` — profile page with avatar management
+
+### Frontend (modify)
+- `frontend/services/dto/user-data.ts` — add `avatarUrl` to `UserData`
+- `frontend/stores/auth.ts` — add `refreshUser()` action
+- `frontend/components/ui/AppTopNav.vue` — use `UserAvatar` + link "Mon profil" to `/profile`
+- `frontend/components/task/TaskCard.vue:47-59` — replace initials with `UserAvatar`
+- `frontend/pages/projects/[id]/archives.vue:49-55` — replace initials with `UserAvatar`
+- `frontend/components/admin/AdminClientTicketTab.vue:82` — use `UserAvatar` for submitter
+- `frontend/middleware/auth.global.ts` — allow `/profile` for all authenticated users
+
+---
+
+## Task 1: Backend — User entity + migration
+
+**Files:**
+- Modify: `src/Entity/User.php`
+- Create: migration file (generated)
+
+- [ ] **Step 1: Add `avatarFileName` field to User entity**
+
+In `src/Entity/User.php`, add after the `$apiToken` field:
+
+```php
+#[ORM\Column(length: 255, nullable: true)]
+#[Groups(['me:read', 'user:list'])]
+private ?string $avatarFileName = null;
+```
+
+Add getter/setter:
+
+```php
+public function getAvatarFileName(): ?string
+{
+    return $this->avatarFileName;
+}
+
+public function setAvatarFileName(?string $avatarFileName): static
+{
+    $this->avatarFileName = $avatarFileName;
+
+    return $this;
+}
+```
+
+Add virtual `avatarUrl` getter (serialized, read-only):
+
+```php
+#[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read'])]
+public function getAvatarUrl(): ?string
+{
+    if (null === $this->avatarFileName) {
+        return null;
+    }
+
+    return '/api/users/' . $this->id . '/avatar';
+}
+```
+
+- [ ] **Step 2: Generate and run migration**
+
+```bash
+docker exec -t php-lesstime-fpm php bin/console doctrine:migrations:diff
+docker exec -t php-lesstime-fpm php bin/console doctrine:migrations:migrate --no-interaction
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/Entity/User.php migrations/
+git commit -m "feat(avatar) : add avatarFileName field to User entity"
+```
+
+---
+
+## Task 2: Backend — Avatar controller
+
+**Files:**
+- Create: `src/Controller/UserAvatarController.php`
+- Modify: `config/services.yaml`
+
+- [ ] **Step 1: Add `avatar_upload_dir` parameter in `config/services.yaml`**
+
+Add to `parameters:` section:
+
+```yaml
+avatar_upload_dir: '%kernel.project_dir%/var/uploads/avatars'
+```
+
+Add service wiring:
+
+```yaml
+App\Controller\UserAvatarController:
+    arguments:
+        $avatarUploadDir: '%avatar_upload_dir%'
+```
+
+- [ ] **Step 2: Create `UserAvatarController.php`**
+
+```php
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use App\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Component\Uid\Uuid;
+
+class UserAvatarController extends AbstractController
+{
+    private const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5 MB
+    private const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly string $avatarUploadDir,
+    ) {}
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_upload', methods: ['POST'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function upload(int $id, Request $request): JsonResponse
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $file = $request->files->get('file');
+
+        if (null === $file || !$file->isValid()) {
+            throw new BadRequestHttpException('No valid file uploaded.');
+        }
+
+        if ($file->getSize() > self::MAX_FILE_SIZE) {
+            throw new BadRequestHttpException('File size exceeds 5 MB limit.');
+        }
+
+        $mimeType = $file->getClientMimeType();
+
+        if (!in_array($mimeType, self::ALLOWED_MIME_TYPES, true)) {
+            throw new BadRequestHttpException('Invalid file type. Allowed: JPEG, PNG, WebP, GIF.');
+        }
+
+        // Delete previous avatar file if exists
+        $this->deleteAvatarFile($user);
+
+        $extension = $file->guessExtension() ?? 'bin';
+        $fileName = Uuid::v4()->toRfc4122() . '.' . $extension;
+
+        if (!is_dir($this->avatarUploadDir)) {
+            mkdir($this->avatarUploadDir, 0o775, true);
+        }
+
+        $file->move($this->avatarUploadDir, $fileName);
+
+        $user->setAvatarFileName($fileName);
+        $this->entityManager->flush();
+
+        return new JsonResponse(['avatarUrl' => $user->getAvatarUrl()]);
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_serve', methods: ['GET'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function serve(int $id): BinaryFileResponse
+    {
+        $user = $this->findUserOrFail($id);
+
+        if (null === $user->getAvatarFileName()) {
+            throw new NotFoundHttpException('No avatar set.');
+        }
+
+        $filePath = $this->avatarUploadDir . '/' . $user->getAvatarFileName();
+
+        if (!file_exists($filePath)) {
+            throw new NotFoundHttpException('Avatar file not found on disk.');
+        }
+
+        $response = new BinaryFileResponse($filePath);
+        $response->setContentDisposition(ResponseHeaderBag::DISPOSITION_INLINE, $user->getAvatarFileName());
+        $extension = pathinfo($user->getAvatarFileName(), PATHINFO_EXTENSION);
+        $mimeMap = ['jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png', 'webp' => 'image/webp', 'gif' => 'image/gif'];
+        $response->headers->set('Content-Type', $mimeMap[$extension] ?? 'application/octet-stream');
+        $response->headers->set('Cache-Control', 'public, max-age=86400');
+
+        return $response;
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_delete', methods: ['DELETE'], priority: 1)]
+    #[IsGranted('ROLE_USER')]
+    public function delete(int $id): Response
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $this->deleteAvatarFile($user);
+        $user->setAvatarFileName(null);
+        $this->entityManager->flush();
+
+        return new Response(null, Response::HTTP_NO_CONTENT);
+    }
+
+    private function findUserOrFail(int $id): User
+    {
+        $user = $this->entityManager->getRepository(User::class)->find($id);
+
+        if (null === $user) {
+            throw new NotFoundHttpException('User not found.');
+        }
+
+        return $user;
+    }
+
+    private function assertCanManageAvatar(User $user): void
+    {
+        $currentUser = $this->getUser();
+
+        if ($currentUser !== $user && !$this->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedHttpException('You can only manage your own avatar.');
+        }
+    }
+
+    private function deleteAvatarFile(User $user): void
+    {
+        if (null === $user->getAvatarFileName()) {
+            return;
+        }
+
+        $filePath = $this->avatarUploadDir . '/' . $user->getAvatarFileName();
+
+        if (file_exists($filePath)) {
+            unlink($filePath);
+        }
+    }
+}
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add src/Controller/UserAvatarController.php config/services.yaml
+git commit -m "feat(avatar) : add avatar upload/serve/delete controller"
+```
+
+---
+
+## Task 3: Frontend — Install vue-advanced-cropper + DTO + service
+
+**Files:**
+- Modify: `frontend/services/dto/user-data.ts`
+- Create: `frontend/services/avatar.ts`
+- Modify: `frontend/stores/auth.ts`
+
+- [ ] **Step 1: Install vue-advanced-cropper**
+
+```bash
+cd frontend && npm install vue-advanced-cropper
+```
+
+- [ ] **Step 2: Update `UserData` DTO**
+
+In `frontend/services/dto/user-data.ts`, add `avatarUrl` to `UserData`:
+
+```typescript
+export type UserData = {
+    id: number
+    '@id'?: string
+    username: string
+    roles: string[]
+    client?: { id: number; name: string } | null
+    allowedProjects?: Project[]
+    avatarUrl?: string | null
+}
+```
+
+- [ ] **Step 3: Create `frontend/services/avatar.ts`**
+
+```typescript
+export function useAvatarService() {
+    const api = useApi()
+
+    async function upload(userId: number, file: Blob): Promise<{ avatarUrl: string }> {
+        const formData = new FormData()
+        formData.append('file', file, 'avatar.png')
+
+        return $fetch(`/api/users/${userId}/avatar`, {
+            method: 'POST',
+            body: formData,
+            credentials: 'include',
+        })
+    }
+
+    async function remove(userId: number): Promise<void> {
+        await api.delete(`/users/${userId}/avatar`)
+    }
+
+    function getUrl(userId: number): string {
+        return `/api/users/${userId}/avatar`
+    }
+
+    return { upload, remove, getUrl }
+}
+```
+
+- [ ] **Step 4: Add `refreshUser` to auth store**
+
+In `frontend/stores/auth.ts`, add to actions:
+
+```typescript
+async refreshUser() {
+    try {
+        const me = await getCurrentUser()
+        this.user = me
+    } catch {
+        // Silently fail — user session might have expired
+    }
+}
+```
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add frontend/package.json frontend/package-lock.json frontend/services/dto/user-data.ts frontend/services/avatar.ts frontend/stores/auth.ts
+git commit -m "feat(avatar) : add avatar service, DTO update, and cropper dependency"
+```
+
+---
+
+## Task 4: Frontend — UserAvatar component
+
+**Files:**
+- Create: `frontend/components/user/UserAvatar.vue`
+
+- [ ] **Step 1: Create `UserAvatar.vue`**
+
+```vue
+<template>
+    <span
+        class="inline-flex shrink-0 items-center justify-center rounded-full"
+        :class="sizeClasses"
+        :title="user.username"
+    >
+        <img
+            v-if="user.avatarUrl && !imgError"
+            :src="user.avatarUrl"
+            :alt="user.username"
+            class="h-full w-full rounded-full object-cover"
+            @error="imgError = true"
+        />
+        <span
+            v-else
+            class="flex h-full w-full items-center justify-center rounded-full bg-primary-500 font-bold text-white"
+            :class="textSizeClass"
+        >
+            {{ user.username.substring(0, 2).toUpperCase() }}
+        </span>
+    </span>
+</template>
+
+<script setup lang="ts">
+const props = defineProps<{
+    user: { id?: number; username: string; avatarUrl?: string | null }
+    size?: 'xs' | 'sm' | 'md' | 'lg'
+}>()
+
+const imgError = ref(false)
+
+watch(() => props.user.avatarUrl, () => {
+    imgError.value = false
+})
+
+const sizeClasses = computed(() => {
+    const map = {
+        xs: 'h-5 w-5',
+        sm: 'h-6 w-6',
+        md: 'h-8 w-8',
+        lg: 'h-12 w-12',
+    }
+    return map[props.size ?? 'sm']
+})
+
+const textSizeClass = computed(() => {
+    const map = {
+        xs: 'text-[10px]',
+        sm: 'text-xs',
+        md: 'text-sm',
+        lg: 'text-base',
+    }
+    return map[props.size ?? 'sm']
+})
+</script>
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add frontend/components/user/UserAvatar.vue
+git commit -m "feat(avatar) : add UserAvatar component with image/initials fallback"
+```
+
+---
+
+## Task 5: Frontend — AvatarCropper component
+
+**Files:**
+- Create: `frontend/components/user/AvatarCropper.vue`
+
+- [ ] **Step 1: Create `AvatarCropper.vue`**
+
+```vue
+<template>
+    <Teleport to="body">
+        <div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
+            <div class="w-full max-w-md rounded-xl bg-white p-6 shadow-2xl">
+                <h3 class="mb-4 text-lg font-bold text-neutral-900">
+                    {{ $t('profile.cropAvatar') }}
+                </h3>
+
+                <div class="mx-auto mb-4 h-72 w-72">
+                    <Cropper
+                        ref="cropperRef"
+                        :src="imageSrc"
+                        :stencil-component="CircleStencil"
+                        :stencil-props="{ aspectRatio: 1 }"
+                        :canvas="{ width: 256, height: 256 }"
+                        class="h-full w-full"
+                    />
+                </div>
+
+                <div class="flex justify-end gap-3">
+                    <button
+                        type="button"
+                        class="rounded-lg border border-neutral-300 px-4 py-2 text-sm font-medium text-neutral-700 hover:bg-neutral-50"
+                        @click="emit('cancel')"
+                    >
+                        {{ $t('common.cancel') }}
+                    </button>
+                    <button
+                        type="button"
+                        class="rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white hover:bg-secondary-500"
+                        :disabled="cropping"
+                        @click="onConfirm"
+                    >
+                        {{ $t('common.confirm') }}
+                    </button>
+                </div>
+            </div>
+        </div>
+    </Teleport>
+</template>
+
+<script setup lang="ts">
+import { Cropper, CircleStencil } from 'vue-advanced-cropper'
+import 'vue-advanced-cropper/dist/style.css'
+
+const props = defineProps<{
+    imageFile: File
+}>()
+
+const emit = defineEmits<{
+    (e: 'crop', blob: Blob): void
+    (e: 'cancel'): void
+}>()
+
+const cropperRef = ref()
+const cropping = ref(false)
+const imageSrc = ref('')
+
+onMounted(() => {
+    imageSrc.value = URL.createObjectURL(props.imageFile)
+})
+
+onUnmounted(() => {
+    if (imageSrc.value) {
+        URL.revokeObjectURL(imageSrc.value)
+    }
+})
+
+async function onConfirm() {
+    cropping.value = true
+
+    try {
+        const { canvas } = cropperRef.value.getResult()
+
+        if (!canvas) return
+
+        const blob = await new Promise<Blob | null>((resolve) => {
+            canvas.toBlob(resolve, 'image/png')
+        })
+
+        if (blob) {
+            emit('crop', blob)
+        }
+    } finally {
+        cropping.value = false
+    }
+}
+</script>
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add frontend/components/user/AvatarCropper.vue
+git commit -m "feat(avatar) : add AvatarCropper modal with vue-advanced-cropper"
+```
+
+---
+
+## Task 6: Frontend — Profile page
+
+**Files:**
+- Create: `frontend/pages/profile.vue`
+- Modify: `frontend/middleware/auth.global.ts`
+
+- [ ] **Step 1: Create `frontend/pages/profile.vue`**
+
+```vue
+<template>
+    <div class="mx-auto max-w-lg px-4 py-10">
+        <h1 class="mb-8 text-2xl font-bold text-neutral-900">{{ $t('profile.title') }}</h1>
+
+        <div class="flex flex-col items-center gap-6 rounded-xl border border-neutral-200 bg-white p-8 shadow-sm">
+            <!-- Current avatar -->
+            <UserAvatar
+                v-if="auth.user"
+                :user="auth.user"
+                size="lg"
+            />
+
+            <p class="text-lg font-semibold text-neutral-800">{{ auth.user?.username }}</p>
+
+            <div class="flex gap-3">
+                <label
+                    class="cursor-pointer rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-secondary-500"
+                >
+                    {{ $t('profile.changeAvatar') }}
+                    <input
+                        type="file"
+                        accept="image/jpeg,image/png,image/webp,image/gif"
+                        class="hidden"
+                        @change="onFileSelect"
+                    />
+                </label>
+
+                <button
+                    v-if="auth.user?.avatarUrl"
+                    type="button"
+                    class="rounded-lg border border-red-300 px-4 py-2 text-sm font-medium text-red-600 hover:bg-red-50"
+                    :disabled="removing"
+                    @click="onRemove"
+                >
+                    {{ $t('profile.removeAvatar') }}
+                </button>
+            </div>
+        </div>
+
+        <!-- Crop modal -->
+        <AvatarCropper
+            v-if="selectedFile"
+            :image-file="selectedFile"
+            @crop="onCrop"
+            @cancel="selectedFile = null"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+const auth = useAuthStore()
+const { upload, remove } = useAvatarService()
+
+const selectedFile = ref<File | null>(null)
+const removing = ref(false)
+
+function onFileSelect(event: Event) {
+    const input = event.target as HTMLInputElement
+    const file = input.files?.[0]
+    if (file) {
+        selectedFile.value = file
+    }
+    input.value = ''
+}
+
+async function onCrop(blob: Blob) {
+    selectedFile.value = null
+    if (!auth.user) return
+
+    await upload(auth.user.id, blob)
+    await auth.refreshUser()
+}
+
+async function onRemove() {
+    if (!auth.user) return
+    removing.value = true
+
+    try {
+        await remove(auth.user.id)
+        await auth.refreshUser()
+    } finally {
+        removing.value = false
+    }
+}
+</script>
+```
+
+- [ ] **Step 2: Allow `/profile` for ROLE_CLIENT in middleware**
+
+In `frontend/middleware/auth.global.ts`, update the client redirect block to also allow `/profile`:
+
+Change:
+```typescript
+if (!isPortalRoute && !isLoginRoute) {
+```
+To:
+```typescript
+const isProfileRoute = to.path === '/profile'
+if (!isPortalRoute && !isLoginRoute && !isProfileRoute) {
+```
+
+- [ ] **Step 3: Add i18n keys**
+
+In `frontend/i18n/locales/fr.json`, add under a `"profile"` key:
+
+```json
+"profile": {
+    "title": "Mon profil",
+    "changeAvatar": "Changer l'avatar",
+    "removeAvatar": "Supprimer l'avatar",
+    "cropAvatar": "Recadrer l'avatar"
+}
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add frontend/pages/profile.vue frontend/middleware/auth.global.ts frontend/i18n/locales/fr.json
+git commit -m "feat(avatar) : add profile page with avatar upload and crop"
+```
+
+---
+
+## Task 7: Frontend — Replace initials everywhere
+
+**Files:**
+- Modify: `frontend/components/ui/AppTopNav.vue`
+- Modify: `frontend/components/task/TaskCard.vue`
+- Modify: `frontend/pages/projects/[id]/archives.vue`
+- Modify: `frontend/components/admin/AdminClientTicketTab.vue`
+
+- [ ] **Step 1: Update `AppTopNav.vue`**
+
+Replace the icon + username display (lines 12-14):
+
+```vue
+<Icon name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
+```
+
+With:
+
+```vue
+<UserAvatar v-if="user" :user="user" size="md" class="cursor-pointer" />
+<Icon v-else name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
+```
+
+Make "Mon profil" button navigate to `/profile`:
+
+```vue
+<button
+    type="button"
+    class="block w-full px-3 py-2 text-left hover:bg-neutral-100"
+    @click="navigateTo('/profile')"
+>
+    Mon profil
+</button>
+```
+
+- [ ] **Step 2: Update `TaskCard.vue`**
+
+Replace lines 47-59 (the assignee initials span + empty state):
+
+```vue
+<UserAvatar
+    v-if="task.assignee"
+    :user="task.assignee"
+    size="xs"
+    class="ml-auto"
+/>
+<span
+    v-else
+    class="ml-auto flex h-5 w-5 items-center justify-center rounded-full bg-neutral-200 text-neutral-400"
+>
+    <Icon name="mdi:account-outline" size="14" />
+</span>
+```
+
+- [ ] **Step 3: Update `archives.vue`**
+
+Replace lines 49-55 (the assignee initials span):
+
+```vue
+<UserAvatar
+    v-if="task.assignee"
+    :user="task.assignee"
+    size="xs"
+/>
+```
+
+- [ ] **Step 4: Update `AdminClientTicketTab.vue`**
+
+Replace the submitter `<td>` at line 82. The `getSubmitterName` function returns a username string. We need to look up the full user to get `avatarUrl`. Modify the function and display:
+
+Change the `<td>`:
+```vue
+<td class="px-3 py-3 text-neutral-600">
+    <div class="flex items-center gap-2">
+        <UserAvatar
+            v-if="getSubmitterUser(ticket.submittedBy)"
+            :user="getSubmitterUser(ticket.submittedBy)!"
+            size="sm"
+        />
+        {{ getSubmitterName(ticket.submittedBy) }}
+    </div>
+</td>
+```
+
+Add helper function:
+```typescript
+function getSubmitterUser(iri: string | null): UserData | undefined {
+    if (!iri) return undefined
+    const match = iri.match(/\/api\/users\/(\d+)/)
+    if (!match) return undefined
+    const id = Number(match[1])
+    return users.value.find(u => u.id === id)
+}
+```
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add frontend/components/ui/AppTopNav.vue frontend/components/task/TaskCard.vue frontend/pages/projects/[id]/archives.vue frontend/components/admin/AdminClientTicketTab.vue
+git commit -m "feat(avatar) : replace initials with UserAvatar component everywhere"
+```
+
+---
+
+## Task 8: Manual testing
+
+- [ ] **Step 1: Rebuild and test**
+
+```bash
+make dev-nuxt
+```
+
+- [ ] **Step 2: Test flow**
+
+1. Login as `admin` / `admin`
+2. Navigate to profile via header dropdown → "Mon profil"
+3. Upload an image → verify crop modal appears with circular stencil
+4. Confirm crop → verify avatar appears on profile page
+5. Check header — avatar should replace the icon
+6. Navigate to a project board — assignee cards should show avatar
+7. Navigate to archives — same check
+8. Go to admin ticket tab — submitter should show avatar + name
+9. Remove avatar → verify initials return everywhere
+10. Login as `client-liot` / `client` → verify profile page accessible from portal
+
+- [ ] **Step 3: Final commit if any fixes needed**
--- a/docs/superpowers/specs/2026-03-15-date-filter-design.md
+++ b/docs/superpowers/specs/2026-03-15-date-filter-design.md
@@ -0,0 +1,86 @@
+# Date Filter Component - Design Spec
+
+## Summary
+
+Add a reusable date filter component to the time-tracking page using `@vuepic/vue-datepicker`. Allows filtering by single day or date range via text input and mini calendar dropdown.
+
+## Behavior
+
+- **Single click** on a day = select that day
+- **Second click** on another day = select range between the two dates
+- **Text input**: type a date (`15/03/2026`) or a range (`15/03/2026 - 20/03/2026`)
+- **Calendar dropdown**: opens on input click/focus
+- **Quick shortcuts**: "Aujourd'hui" and "Cette semaine" buttons in calendar
+- **No time picker**: filter by day granularity only
+- **Format**: `dd/MM/yyyy` (French locale)
+
+## Component: `DateFilter.vue`
+
+Location: `frontend/components/ui/DateFilter.vue`
+
+### Props
+
+| Prop | Type | Default | Description |
+|------|------|---------|-------------|
+| `modelValue` | `Date \| [Date, Date] \| null` | `null` | Selected date or range |
+| `placeholder` | `string` | `t('common.dateFilter')` | Input placeholder |
+
+### Emits
+
+| Event | Payload | Description |
+|-------|---------|-------------|
+| `update:modelValue` | `Date \| [Date, Date] \| null` | Date selection changed |
+
+### Implementation
+
+- Wraps `VueDatePicker` with project-consistent styling
+- Uses `#dp-input` slot for custom input matching MalioSelect style
+- Configures `range` mode with `multi-calendars: false`
+- Sets `text-input` with `format: 'dd/MM/yyyy'`, `rangeSeparator: ' - '`
+- Disables time picker (`enable-time-picker: false`)
+- Applies project primary color (`#222783`) via CSS overrides
+- Responsive width: `!w-44 sm:!w-52`
+
+## Integration: Time Tracking Page
+
+### Filter bar addition
+
+Add `DateFilter` to the existing filter bar in `frontend/pages/time-tracking.vue`, alongside user/project/tag filters.
+
+### Filtering logic
+
+- Client-side filtering (same pattern as project and tag filters)
+- When a single date is selected: show only entries matching that day
+- When a range is selected: show entries within the range (inclusive)
+- When null: show all entries (no date filter)
+
+## Files Impacted
+
+| File | Action | Description |
+|------|--------|-------------|
+| `frontend/components/ui/DateFilter.vue` | Create | Reusable date filter wrapper |
+| `frontend/nuxt.config.ts` | Modify | Add `@vuepic/vue-datepicker` to `build.transpile` |
+| `frontend/pages/time-tracking.vue` | Modify | Integrate DateFilter in filter bar + client-side filtering |
+| `frontend/i18n/locales/fr.json` | Modify | Add French translations |
+| `frontend/i18n/locales/en.json` | Modify | Add English translations |
+| `package.json` | Modify | Add `@vuepic/vue-datepicker` dependency |
+
+## i18n Keys
+
+```json
+{
+    "common": {
+        "dateFilter": "Date",
+        "today": "Aujourd'hui",
+        "thisWeek": "Cette semaine"
+    }
+}
+```
+
+## Style
+
+- Input height and borders match MalioSelect components
+- Text size: `text-sm`
+- Selected date highlight: project primary color `#222783`
+- Calendar dropdown: subtle shadow, rounded corners matching project style
+- Override default vue-datepicker CSS variables to match project theme
--- a/docs/superpowers/specs/2026-03-15-user-avatar-design.md
+++ b/docs/superpowers/specs/2026-03-15-user-avatar-design.md
@@ -0,0 +1,112 @@
+# User Avatar — Design Spec
+
+## Goal
+
+Allow users to upload a profile avatar image (with client-side circular crop) that replaces initials everywhere in the app.
+
+## Backend
+
+### Entity Changes
+
+**User** — add nullable field:
+- `avatarFileName: ?string` (length 255) — UUID-based filename stored on disk
+
+### Storage
+
+- Directory: `var/uploads/avatars/`
+- Parameter in `services.yaml`: `avatar_upload_dir`
+
+### Endpoints
+
+All under `/api/users/{id}/avatar`:
+
+| Method | Description | Auth |
+|--------|-------------|------|
+| `POST` | Upload avatar (multipart file) | Owner or ROLE_ADMIN |
+| `GET` | Serve avatar image (inline) | ROLE_USER or ROLE_CLIENT |
+| `DELETE` | Remove avatar | Owner or ROLE_ADMIN |
+
+**POST** accepts a single `file` field. Validates: image MIME (jpeg, png, webp, gif), max 5 MB. Stores with UUID filename, updates `avatarFileName`. Deletes previous file if exists.
+
+**GET** returns the image with proper `Content-Type`. Returns 404 if no avatar.
+
+**DELETE** removes file from disk, sets `avatarFileName` to null.
+
+These are custom Symfony controllers (not API Platform resources) under `/api/` with `priority: 1`.
+
+### Serialization
+
+Add a virtual `avatarUrl` field to User serialization (group `user:read`):
+- If `avatarFileName` is set: `/api/users/{id}/avatar`
+- If null: `null`
+
+This way the frontend knows if an avatar exists from any user payload.
+
+### Migration
+
+- Add `avatar_file_name` column (VARCHAR 255, nullable) to `user` table.
+
+## Frontend
+
+### New Components
+
+**`UserAvatar.vue`** (`frontend/components/user/UserAvatar.vue`):
+- Props: `user: { id: number, username: string, avatarUrl?: string | null }`, `size: 'xs' | 'sm' | 'md' | 'lg'`
+- Sizes: xs=20px, sm=24px, md=32px, lg=48px
+- If `avatarUrl`: `<img>` rounded-full, object-cover
+- Else: initials badge (current bg-primary-500 style), 2 first chars of username uppercased
+- Handles `@error` on img to fallback to initials (broken image)
+
+**`AvatarCropper.vue`** (`frontend/components/user/AvatarCropper.vue`):
+- Uses `vue-advanced-cropper` with `CircleStencil`
+- Props: `imageFile: File`
+- Emits: `crop(blob: Blob)`, `cancel`
+- Fixed output size: 256x256px
+- Modal overlay with crop area + confirm/cancel buttons
+
+### New Page
+
+**`/profile`** (`frontend/pages/profile.vue`):
+- Shows current avatar (large) with "Change" button
+- File input triggers AvatarCropper modal
+- On confirm: POST blob to `/api/users/{id}/avatar`
+- On success: refresh auth store user data
+- "Remove avatar" button if avatar exists
+- Accessible from "Mon profil" button in AppTopNav dropdown
+
+### New Service
+
+**`frontend/services/avatar.ts`**:
+- `upload(userId: number, file: Blob): Promise<void>` — POST multipart
+- `remove(userId: number): Promise<void>` — DELETE
+- `getUrl(userId: number): string` — returns URL path
+
+### DTO Update
+
+**`UserData`** — add: `avatarUrl?: string | null`
+
+### Replacement Points
+
+Replace initials/icon with `<UserAvatar>` in:
+
+| File | Current display | Size |
+|------|----------------|------|
+| `TaskCard.vue:48-53` | Initials badge (h-5 w-5) | xs |
+| `archives.vue:50-55` | Initials badge (h-5 w-5) | xs |
+| `AppTopNav.vue:13` | `mdi:account-circle-outline` icon | md |
+| `AdminClientTicketTab.vue` | Username text for submitter | sm |
+| `ClientTicketDetailModal.vue` | submittedBy display | sm |
+
+### Auth Store
+
+After avatar upload/delete, re-fetch current user data so `avatarUrl` updates everywhere reactively.
+
+## Dependencies
+
+- `vue-advanced-cropper` — npm install in frontend/
+
+## Out of Scope
+
+- Server-side image processing/resize
+- Multiple image formats conversion
+- Avatar for clients (entities), only users
--- a/frontend/components/admin/AdminBookStackTab.vue
+++ b/frontend/components/admin/AdminBookStackTab.vue
@@ -10,15 +10,13 @@
                input-class="w-full"
            />

-            <div>
-                <MalioInputText
-                    v-model="form.tokenId"
-                    :label="$t('bookstack.settings.tokenId')"
-                    :placeholder="$t('bookstack.settings.tokenIdPlaceholder')"
-                    input-class="w-full"
-                    type="password"
-                />
-            </div>
+            <MalioInputText
+                v-model="form.tokenId"
+                :label="$t('bookstack.settings.tokenId')"
+                :placeholder="$t('bookstack.settings.tokenIdPlaceholder')"
+                input-class="w-full"
+                type="password"
+            />

            <div>
                <MalioInputText
--- a/frontend/components/admin/AdminClientTicketTab.vue
+++ b/frontend/components/admin/AdminClientTicketTab.vue
@@ -79,7 +79,16 @@
                            </span>
                        </td>
                        <td class="px-3 py-3 text-neutral-600">{{ getProjectName(ticket.project) }}</td>
-                        <td class="px-3 py-3 text-neutral-600">{{ getSubmitterName(ticket.submittedBy) }}</td>
+                        <td class="px-3 py-3 text-neutral-600">
+                            <div class="flex items-center gap-2">
+                                <UserAvatar
+                                    v-if="getSubmitterUser(ticket.submittedBy)"
+                                    :user="getSubmitterUser(ticket.submittedBy)!"
+                                    size="sm"
+                                />
+                                {{ getSubmitterName(ticket.submittedBy) }}
+                            </div>
+                        </td>
                        <td class="px-3 py-3 text-neutral-400">{{ formatDate(ticket.createdAt) }}</td>
                        <td class="px-3 py-3">
                            <div class="flex items-center gap-2">
@@ -216,7 +225,7 @@ const { t } = useI18n()
 const clientTicketService = useClientTicketService()
 const projectService = useProjectService()
 const userService = useUserService()
-const { typeBadgeClass, statusBadgeClass, formatDate } = useClientTicketHelpers()
+const { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions } = useClientTicketHelpers()

 const tickets = ref<ClientTicket[]>([])
 const projects = ref<Project[]>([])
@@ -261,19 +270,7 @@ const detailTicket = ref<ClientTicket | null>(null)

 const availableStatusTransitions = computed(() => {
    if (!statusTarget.value) return []
-    const current = statusTarget.value.status
-    const allStatuses: { label: string; value: ClientTicketStatus }[] = [
-        { label: t('clientTicket.status.new'), value: 'new' },
-        { label: t('clientTicket.status.in_progress'), value: 'in_progress' },
-        { label: t('clientTicket.status.done'), value: 'done' },
-        { label: t('clientTicket.status.rejected'), value: 'rejected' },
-    ]
-    // Filter out forbidden transitions
-    return allStatuses.filter(s => {
-        if (s.value === current) return false
-        if ((current === 'done' || current === 'rejected') && s.value === 'new') return false
-        return true
-    })
+    return getAvailableStatusTransitions(statusTarget.value.status, t)
 })

 function getProjectName(iri: string): string {
@@ -291,6 +288,14 @@ function getSubmitterName(iri: string | null): string {
    return users.value.find(u => u.id === id)?.username ?? ''
 }

+function getSubmitterUser(iri: string | null): UserData | undefined {
+    if (!iri) return undefined
+    const match = iri.match(/\/api\/users\/(\d+)/)
+    if (!match) return undefined
+    const id = Number(match[1])
+    return users.value.find(u => u.id === id)
+}
+
 function openDetail(ticket: ClientTicket) {
    detailTicket.value = ticket
    detailOpen.value = true
--- a/frontend/components/client-ticket/ClientTicketDetailModal.vue
+++ b/frontend/components/client-ticket/ClientTicketDetailModal.vue
@@ -27,90 +27,162 @@
                                    {{ $t('portal.ticketDetail') }}
                                </h2>
                            </div>
-                            <button
-                                type="button"
-                                class="flex h-8 w-8 items-center justify-center rounded-lg text-neutral-400 transition-colors hover:bg-neutral-200/60 hover:text-neutral-600"
-                                @click="close"
-                            >
-                                <Icon name="mdi:close" size="20" />
-                            </button>
+                            <div class="flex items-center gap-2">
+                                <!-- Edit button (only for open tickets submitted by current user) -->
+                                <button
+                                    v-if="canEdit && !isEditing"
+                                    type="button"
+                                    class="flex h-8 items-center gap-1.5 rounded-lg px-3 text-sm font-medium text-primary-500 transition-colors hover:bg-primary-50"
+                                    @click="startEdit"
+                                >
+                                    <Icon name="mdi:pencil-outline" size="16" />
+                                    {{ $t('common.edit') }}
+                                </button>
+                                <button
+                                    type="button"
+                                    class="flex h-8 w-8 items-center justify-center rounded-lg text-neutral-400 transition-colors hover:bg-neutral-200/60 hover:text-neutral-600"
+                                    @click="close"
+                                >
+                                    <Icon name="mdi:close" size="20" />
+                                </button>
+                            </div>
                        </div>
                    </div>

                    <!-- Body -->
                    <div v-if="ticket" class="overflow-y-auto px-4 py-4 sm:px-8 sm:py-6">
-                        <!-- Title -->
-                        <h3 class="text-base font-bold text-neutral-900">{{ ticket.title }}</h3>

-                        <!-- Badges -->
-                        <div class="mt-3 flex items-center gap-2">
-                            <span
-                                class="rounded-full px-2 py-0.5 text-xs font-semibold text-white"
-                                :class="typeBadgeClass(ticket.type)"
-                            >
-                                {{ $t(`clientTicket.type.${ticket.type}`) }}
-                            </span>
-                            <span
-                                class="rounded-full px-3 py-1 text-xs font-semibold"
-                                :class="statusBadgeClass(ticket.status)"
-                            >
-                                {{ $t(`clientTicket.status.${ticket.status}`) }}
-                            </span>
-                        </div>
+                        <!-- Edit mode -->
+                        <template v-if="isEditing">
+                            <div>
+                                <label class="mb-1 block text-sm font-medium text-neutral-700">
+                                    {{ $t('clientTicket.fields.title') }}
+                                </label>
+                                <input
+                                    v-model="editForm.title"
+                                    type="text"
+                                    class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
+                                />
+                            </div>

-                        <!-- Description -->
-                        <div class="mt-4">
-                            <p class="text-sm font-medium text-neutral-700">{{ $t('clientTicket.description') }}</p>
-                            <p class="mt-1 whitespace-pre-wrap text-sm text-neutral-600">{{ ticket.description }}</p>
-                        </div>
+                            <div class="mt-4">
+                                <label class="mb-1 block text-sm font-medium text-neutral-700">
+                                    {{ $t('clientTicket.description') }}
+                                </label>
+                                <textarea
+                                    v-model="editForm.description"
+                                    rows="5"
+                                    class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
+                                />
+                            </div>

-                        <!-- URL (if bug) -->
-                        <div v-if="ticket.url" class="mt-4">
-                            <p class="text-sm font-medium text-neutral-700">{{ $t('clientTicket.url') }}</p>
-                            <a
-                                :href="ticket.url"
-                                target="_blank"
-                                class="mt-1 text-sm text-primary-500 underline hover:text-primary-600"
-                            >
-                                {{ ticket.url }}
-                            </a>
-                        </div>
+                            <div v-if="ticket.type === 'bug'" class="mt-4">
+                                <label class="mb-1 block text-sm font-medium text-neutral-700">
+                                    {{ $t('clientTicket.fields.url') }}
+                                </label>
+                                <input
+                                    v-model="editForm.url"
+                                    type="url"
+                                    class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
+                                    :placeholder="$t('clientTicket.fields.urlPlaceholder')"
+                                />
+                            </div>

-                        <!-- Status comment -->
-                        <div v-if="ticket.statusComment" class="mt-4">
-                            <p class="text-sm font-medium text-neutral-700">{{ $t('clientTicket.statusComment') }}</p>
-                            <p class="mt-1 whitespace-pre-wrap rounded-lg bg-neutral-50 p-3 text-sm text-neutral-600">{{ ticket.statusComment }}</p>
-                        </div>
+                            <div class="mt-6 flex justify-end gap-3">
+                                <button
+                                    type="button"
+                                    class="rounded-lg border border-neutral-300 px-4 py-2 text-sm font-semibold text-neutral-700 transition-colors hover:bg-neutral-50"
+                                    @click="cancelEdit"
+                                >
+                                    {{ $t('common.cancel') }}
+                                </button>
+                                <button
+                                    type="button"
+                                    class="rounded-lg bg-primary-500 px-6 py-2 text-sm font-semibold text-white transition-colors hover:bg-secondary-500 disabled:cursor-not-allowed disabled:opacity-50"
+                                    :disabled="isSaving"
+                                    @click="saveEdit"
+                                >
+                                    {{ $t('common.save') }}
+                                </button>
+                            </div>
+                        </template>

-                        <!-- Documents -->
-                        <TaskDocumentList
-                            v-if="localDocuments.length"
-                            :documents="localDocuments"
-                            :is-admin="false"
-                            @preview="openPreview"
-                        />
+                        <!-- View mode -->
+                        <template v-else>
+                            <!-- Title -->
+                            <h3 class="text-base font-bold text-neutral-900">{{ ticket.title }}</h3>

-                        <!-- Document preview -->
-                        <TaskDocumentPreview
-                            :document="previewDoc"
-                            :has-prev="previewIndex > 0"
-                            :has-next="previewIndex < localDocuments.length - 1"
-                            @close="previewDoc = null"
-                            @prev="prevPreview"
-                            @next="nextPreview"
-                        />
+                            <!-- Badges -->
+                            <div class="mt-3 flex items-center gap-2">
+                                <span
+                                    class="rounded-full px-2 py-0.5 text-xs font-semibold text-white"
+                                    :class="typeBadgeClass(ticket.type)"
+                                >
+                                    {{ $t(`clientTicket.type.${ticket.type}`) }}
+                                </span>
+                                <span
+                                    class="rounded-full px-3 py-1 text-xs font-semibold"
+                                    :class="statusBadgeClass(ticket.status)"
+                                >
+                                    {{ $t(`clientTicket.status.${ticket.status}`) }}
+                                </span>
+                            </div>

-                        <!-- Upload zone -->
-                        <TaskDocumentUpload
-                            v-if="ticket"
-                            :client-ticket-id="ticket.id"
-                            @uploaded="refreshDocuments"
-                        />
+                            <!-- Description -->
+                            <div class="mt-4">
+                                <p class="text-sm font-medium text-neutral-700">{{ $t('clientTicket.description') }}</p>
+                                <p class="mt-1 whitespace-pre-wrap text-sm text-neutral-600">{{ ticket.description }}</p>
+                            </div>

-                        <!-- Date -->
-                        <p class="mt-6 text-xs text-neutral-400">
-                            {{ $t('clientTicket.createdAt') }} : {{ formatDate(ticket.createdAt) }}
-                        </p>
+                            <!-- URL (if bug) -->
+                            <div v-if="ticket.url" class="mt-4">
+                                <p class="text-sm font-medium text-neutral-700">{{ $t('clientTicket.url') }}</p>
+                                <a
+                                    :href="ticket.url"
+                                    target="_blank"
+                                    class="mt-1 text-sm text-primary-500 underline hover:text-primary-600"
+                                >
+                                    {{ ticket.url }}
+                                </a>
+                            </div>
+
+                            <!-- Status comment -->
+                            <div v-if="ticket.statusComment" class="mt-4">
+                                <p class="text-sm font-medium text-neutral-700">{{ $t('clientTicket.statusComment') }}</p>
+                                <p class="mt-1 whitespace-pre-wrap rounded-lg bg-neutral-50 p-3 text-sm text-neutral-600">{{ ticket.statusComment }}</p>
+                            </div>
+
+                            <!-- Documents -->
+                            <TaskDocumentList
+                                v-if="localDocuments.length"
+                                :documents="localDocuments"
+                                :is-admin="canEdit"
+                                @preview="openPreview"
+                                @delete="handleDeleteDocument"
+                            />
+
+                            <!-- Document preview -->
+                            <TaskDocumentPreview
+                                :document="previewDoc"
+                                :has-prev="previewIndex > 0"
+                                :has-next="previewIndex < localDocuments.length - 1"
+                                @close="previewDoc = null"
+                                @prev="prevPreview"
+                                @next="nextPreview"
+                            />
+
+                            <!-- Upload zone -->
+                            <TaskDocumentUpload
+                                v-if="ticket"
+                                :client-ticket-id="ticket.id"
+                                @uploaded="refreshDocuments"
+                            />
+
+                            <!-- Date -->
+                            <p class="mt-6 text-xs text-neutral-400">
+                                {{ $t('clientTicket.createdAt') }} : {{ formatDate(ticket.createdAt) }}
+                            </p>
+                        </template>
                    </div>
                </div>
            </div>
@@ -122,6 +194,7 @@
 import type { ClientTicket } from '~/services/dto/client-ticket'
 import type { TaskDocument } from '~/services/dto/task-document'
 import { useTaskDocumentService } from '~/services/task-documents'
+import { useClientTicketService } from '~/services/client-tickets'

 const props = defineProps<{
    modelValue: boolean
@@ -130,6 +203,7 @@ const props = defineProps<{

 const emit = defineEmits<{
    (e: 'update:modelValue', value: boolean): void
+    (e: 'refresh'): void
 }>()

 const isOpen = computed({
@@ -138,12 +212,82 @@ const isOpen = computed({
 })

 function close() {
+    isEditing.value = false
    isOpen.value = false
 }

-const { getByTicket } = useTaskDocumentService()
+const auth = useAuthStore()
+const { getByTicket, remove: removeDocument } = useTaskDocumentService()
+const clientTicketService = useClientTicketService()
 const { typeBadgeClass, statusBadgeClass, formatDate } = useClientTicketHelpers()

+// Edit mode
+const isEditing = ref(false)
+const isSaving = ref(false)
+const editForm = reactive({
+    title: '',
+    description: '',
+    url: '',
+})
+
+const isAdmin = computed(() => auth.user?.roles?.includes('ROLE_ADMIN') ?? false)
+
+const canEdit = computed(() => {
+    if (!props.ticket) return false
+    if (isAdmin.value) return true
+    const status = props.ticket.status
+    if (status === 'done' || status === 'rejected') return false
+    const userId = auth.user?.id
+    if (!userId) return false
+    const sub = props.ticket.submittedBy
+    if (!sub) return false
+    // submittedBy can be an IRI string or an embedded object
+    if (typeof sub === 'string') return sub === `/api/users/${userId}`
+    if (typeof sub === 'object' && 'id' in sub) return (sub as any).id === userId
+    return false
+})
+
+function startEdit() {
+    if (!props.ticket) return
+    editForm.title = props.ticket.title
+    editForm.description = props.ticket.description
+    editForm.url = props.ticket.url ?? ''
+    isEditing.value = true
+}
+
+function cancelEdit() {
+    isEditing.value = false
+}
+
+async function saveEdit() {
+    if (!props.ticket) return
+    isSaving.value = true
+    try {
+        const data: Record<string, unknown> = {
+            title: editForm.title,
+            description: editForm.description,
+        }
+        if (props.ticket.type === 'bug') {
+            data.url = editForm.url || null
+        }
+        await clientTicketService.update(props.ticket.id, data as any)
+        isEditing.value = false
+        emit('refresh')
+    } finally {
+        isSaving.value = false
+    }
+}
+
+// Reset edit mode when ticket changes
+watch(() => props.ticket?.id, () => {
+    isEditing.value = false
+})
+
+async function handleDeleteDocument(doc: TaskDocument) {
+    await removeDocument(doc.id)
+    await refreshDocuments()
+}
+
 async function refreshDocuments() {
    if (!props.ticket) return
    localDocuments.value = await getByTicket(props.ticket.id)
--- a/frontend/components/client-ticket/ProjectClientTickets.vue
+++ b/frontend/components/client-ticket/ProjectClientTickets.vue
@@ -0,0 +1,327 @@
+<template>
+    <div>
+        <!-- Trigger button -->
+        <button
+            class="relative flex shrink-0 items-center gap-2 rounded-md bg-neutral-100 px-3 py-2 text-sm font-semibold text-neutral-700 transition-colors hover:bg-neutral-200 sm:px-4"
+            @click="open"
+        >
+            <Icon name="mdi:ticket-outline" class="size-4 sm:size-5" />
+            <span class="hidden sm:inline">{{ $t('clientTicket.adminTab') }}</span>
+            <span
+                v-if="totalCount > 0"
+                class="flex h-5 min-w-5 items-center justify-center rounded-full bg-primary-500 px-1 text-xs font-bold text-white"
+            >
+                {{ totalCount }}
+            </span>
+        </button>
+
+        <!-- Panel -->
+        <Teleport v-if="isOpen" to="body">
+            <Transition name="ct-panel" appear>
+                <div class="fixed inset-0 z-50 flex justify-end">
+                    <!-- Backdrop -->
+                    <div
+                        class="absolute inset-0 bg-slate-900/40 backdrop-blur-sm"
+                        @click="close"
+                    />
+
+                    <!-- Slide panel -->
+                    <div class="relative z-10 flex h-full w-full max-w-lg flex-col bg-white shadow-2xl">
+                        <!-- Header -->
+                        <div class="flex items-center justify-between border-b border-neutral-200 px-5 py-4">
+                            <div>
+                                <h2 class="text-base font-bold text-neutral-900">{{ $t('clientTicket.adminTab') }}</h2>
+                                <p class="mt-0.5 text-xs text-neutral-400">{{ projectName }}</p>
+                            </div>
+                            <button
+                                type="button"
+                                class="flex h-8 w-8 items-center justify-center rounded-lg text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-neutral-600"
+                                @click="close"
+                            >
+                                <Icon name="mdi:close" size="20" />
+                            </button>
+                        </div>
+
+                        <!-- Filters -->
+                        <div class="flex items-center gap-3 border-b border-neutral-100 px-5 py-3">
+                            <select
+                                v-model="filterStatus"
+                                class="rounded-lg border border-neutral-300 px-3 py-1.5 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
+                            >
+                                <option :value="null">{{ $t('clientTicket.allStatuses') }}</option>
+                                <option value="new">{{ $t('clientTicket.status.new') }}</option>
+                                <option value="in_progress">{{ $t('clientTicket.status.in_progress') }}</option>
+                                <option value="done">{{ $t('clientTicket.status.done') }}</option>
+                                <option value="rejected">{{ $t('clientTicket.status.rejected') }}</option>
+                            </select>
+                        </div>
+
+                        <!-- Content -->
+                        <div class="flex-1 overflow-y-auto px-5 py-4">
+                            <div v-if="isLoading" class="py-8 text-center text-sm text-neutral-400">
+                                {{ $t('common.loading') }}
+                            </div>
+
+                            <div v-else-if="filteredTickets.length === 0" class="py-8 text-center text-sm text-neutral-400">
+                                {{ $t('clientTicket.noTickets') }}
+                            </div>
+
+                            <div v-else class="space-y-2">
+                                <div
+                                    v-for="ticket in filteredTickets"
+                                    :key="ticket.id"
+                                    class="rounded-lg border border-neutral-200 bg-white"
+                                >
+                                    <!-- Ticket row -->
+                                    <div
+                                        class="flex cursor-pointer items-start justify-between gap-3 p-3 transition-colors hover:bg-neutral-50"
+                                        @click="toggleExpand(ticket.id)"
+                                    >
+                                        <div class="min-w-0 flex-1">
+                                            <div class="flex items-center gap-2">
+                                                <span class="text-xs font-bold text-primary-500">CT-{{ String(ticket.number).padStart(3, '0') }}</span>
+                                                <span
+                                                    class="rounded-full px-2 py-0.5 text-xs font-semibold text-white"
+                                                    :class="typeBadgeClass(ticket.type)"
+                                                >
+                                                    {{ $t(`clientTicket.type.${ticket.type}`) }}
+                                                </span>
+                                                <span
+                                                    class="rounded-full px-2 py-0.5 text-xs font-semibold"
+                                                    :class="statusBadgeClass(ticket.status)"
+                                                >
+                                                    {{ $t(`clientTicket.status.${ticket.status}`) }}
+                                                </span>
+                                            </div>
+                                            <p class="mt-1 text-sm font-semibold text-neutral-900 leading-snug">{{ ticket.title }}</p>
+                                            <p class="mt-0.5 text-xs text-neutral-400">{{ formatDate(ticket.createdAt) }}</p>
+                                        </div>
+                                        <div class="flex items-center gap-1">
+                                            <button
+                                                class="rounded p-1 text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-primary-500"
+                                                :title="$t('clientTicket.changeStatus')"
+                                                @click.stop="openStatusChange(ticket)"
+                                            >
+                                                <Icon name="mdi:swap-horizontal" size="16" />
+                                            </button>
+                                            <Icon
+                                                :name="expandedId === ticket.id ? 'mdi:chevron-up' : 'mdi:chevron-down'"
+                                                size="18"
+                                                class="text-neutral-400"
+                                            />
+                                        </div>
+                                    </div>
+
+                                    <!-- Expanded details -->
+                                    <div v-if="expandedId === ticket.id" class="border-t border-neutral-100 px-3 py-3">
+                                        <p class="text-sm text-neutral-600 whitespace-pre-wrap">{{ ticket.description }}</p>
+                                        <div v-if="ticket.url" class="mt-2">
+                                            <a
+                                                :href="ticket.url"
+                                                target="_blank"
+                                                class="text-xs text-primary-500 underline hover:text-primary-600"
+                                            >
+                                                {{ ticket.url }}
+                                            </a>
+                                        </div>
+                                        <div v-if="ticket.statusComment" class="mt-2 rounded-lg bg-neutral-50 p-2 text-xs text-neutral-500">
+                                            {{ ticket.statusComment }}
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </Transition>
+        </Teleport>
+
+        <!-- Status change modal -->
+        <Teleport v-if="statusModalOpen" to="body">
+            <Transition name="ct-modal" appear>
+                <div class="fixed inset-0 z-[60] flex items-center justify-center p-4">
+                    <div
+                        class="absolute inset-0 bg-slate-900/40 backdrop-blur-sm"
+                        @click="statusModalOpen = false"
+                    />
+                    <div class="relative z-10 w-full max-w-md rounded-2xl bg-white p-6 shadow-2xl">
+                        <h3 class="text-lg font-bold text-neutral-900">{{ $t('clientTicket.changeStatus') }}</h3>
+                        <p v-if="statusTarget" class="mt-1 text-sm text-neutral-500">
+                            CT-{{ String(statusTarget.number).padStart(3, '0') }} — {{ statusTarget.title }}
+                        </p>
+
+                        <div class="mt-4">
+                            <label class="mb-1 block text-sm font-medium text-neutral-700">Nouveau statut</label>
+                            <select
+                                v-model="newStatus"
+                                class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
+                            >
+                                <option :value="null" disabled>—</option>
+                                <option
+                                    v-for="s in availableStatusTransitions"
+                                    :key="s.value"
+                                    :value="s.value"
+                                >
+                                    {{ s.label }}
+                                </option>
+                            </select>
+                        </div>
+
+                        <div v-if="newStatus === 'rejected'" class="mt-4">
+                            <MalioInputTextArea
+                                v-model="statusComment"
+                                :label="$t('clientTicket.statusComment')"
+                                :size="3"
+                            />
+                            <p v-if="rejectionError" class="mt-1 text-xs text-red-500">
+                                {{ $t('clientTicket.rejectionRequired') }}
+                            </p>
+                        </div>
+
+                        <div class="mt-6 flex justify-end gap-3">
+                            <button
+                                class="rounded-lg border border-neutral-300 px-4 py-2 text-sm font-semibold text-neutral-700 transition-colors hover:bg-neutral-50"
+                                @click="statusModalOpen = false"
+                            >
+                                {{ $t('common.cancel') }}
+                            </button>
+                            <button
+                                class="rounded-lg bg-primary-500 px-6 py-2 text-sm font-semibold text-white transition-colors hover:bg-secondary-500 disabled:cursor-not-allowed disabled:opacity-50"
+                                :disabled="isUpdatingStatus"
+                                @click="confirmStatusChange"
+                            >
+                                Confirmer
+                            </button>
+                        </div>
+                    </div>
+                </div>
+            </Transition>
+        </Teleport>
+    </div>
+</template>
+
+<script setup lang="ts">
+import type { ClientTicket, ClientTicketStatus } from '~/services/dto/client-ticket'
+import { useClientTicketService } from '~/services/client-tickets'
+
+const props = defineProps<{
+    projectId: number
+    projectName: string
+}>()
+
+const { t } = useI18n()
+const clientTicketService = useClientTicketService()
+const { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions } = useClientTicketHelpers()
+
+const isOpen = ref(false)
+const isLoading = ref(false)
+const tickets = ref<ClientTicket[]>([])
+const filterStatus = ref<string | null>(null)
+const expandedId = ref<number | null>(null)
+
+const totalCount = computed(() =>
+    tickets.value.filter(t => t.status === 'new' || t.status === 'in_progress').length
+)
+
+const filteredTickets = computed(() => {
+    if (!filterStatus.value) return tickets.value
+    return tickets.value.filter(t => t.status === filterStatus.value)
+})
+
+// Status change
+const statusModalOpen = ref(false)
+const statusTarget = ref<ClientTicket | null>(null)
+const newStatus = ref<string | null>(null)
+const statusComment = ref('')
+const rejectionError = ref(false)
+const isUpdatingStatus = ref(false)
+
+const availableStatusTransitions = computed(() => {
+    if (!statusTarget.value) return []
+    return getAvailableStatusTransitions(statusTarget.value.status, t)
+})
+
+async function loadTickets() {
+    isLoading.value = true
+    try {
+        tickets.value = await clientTicketService.getAll({ project: props.projectId })
+    } finally {
+        isLoading.value = false
+    }
+}
+
+function open() {
+    isOpen.value = true
+    loadTickets()
+}
+
+function close() {
+    isOpen.value = false
+    expandedId.value = null
+}
+
+function toggleExpand(id: number) {
+    expandedId.value = expandedId.value === id ? null : id
+}
+
+function openStatusChange(ticket: ClientTicket) {
+    statusTarget.value = ticket
+    newStatus.value = null
+    statusComment.value = ''
+    rejectionError.value = false
+    statusModalOpen.value = true
+}
+
+async function confirmStatusChange() {
+    if (!statusTarget.value || !newStatus.value) return
+
+    if (newStatus.value === 'rejected' && !statusComment.value.trim()) {
+        rejectionError.value = true
+        return
+    }
+
+    isUpdatingStatus.value = true
+    try {
+        await clientTicketService.updateStatus(statusTarget.value.id, {
+            status: newStatus.value as ClientTicketStatus,
+            statusComment: newStatus.value === 'rejected' ? statusComment.value.trim() : null,
+        })
+        statusModalOpen.value = false
+        await loadTickets()
+    } finally {
+        isUpdatingStatus.value = false
+    }
+}
+</script>
+
+<style scoped>
+.ct-panel-enter-active,
+.ct-panel-leave-active {
+    transition: opacity 0.2s ease;
+}
+
+.ct-panel-enter-active > div:last-child,
+.ct-panel-leave-active > div:last-child {
+    transition: transform 0.25s cubic-bezier(0.16, 1, 0.3, 1);
+}
+
+.ct-panel-enter-from,
+.ct-panel-leave-to {
+    opacity: 0;
+}
+
+.ct-panel-enter-from > div:last-child,
+.ct-panel-leave-to > div:last-child {
+    transform: translateX(100%);
+}
+
+.ct-modal-enter-active,
+.ct-modal-leave-active {
+    transition: opacity 0.15s ease;
+}
+
+.ct-modal-enter-from,
+.ct-modal-leave-to {
+    opacity: 0;
+}
+</style>
--- a/frontend/components/project/ProjectGroupTab.vue
+++ b/frontend/components/project/ProjectGroupTab.vue
@@ -117,7 +117,7 @@ async function loadItems() {
        const [g, t, at] = await Promise.all([
            groupService.getByProject(props.projectId),
            taskService.getByProject(props.projectId),
-            taskService.getByProjectArchived(props.projectId),
+            taskService.getByProject(props.projectId, true),
        ])
        allGroups.value = g
        activeTasks.value = t
--- a/frontend/components/task/TaskCard.vue
+++ b/frontend/components/task/TaskCard.vue
@@ -44,13 +44,12 @@
            >
                {{ tag.label }}
            </span>
-            <span
+            <UserAvatar
                v-if="task.assignee"
-                class="ml-auto flex h-5 w-5 items-center justify-center rounded-full bg-primary-500 text-[10px] font-bold text-white"
-                :title="task.assignee.username"
-            >
-                {{ task.assignee.username.substring(0, 2).toUpperCase() }}
-            </span>
+                :user="task.assignee"
+                size="xs"
+                class="ml-auto"
+            />
            <span
                v-else
                class="ml-auto flex h-5 w-5 items-center justify-center rounded-full bg-neutral-200 text-neutral-400"
--- a/frontend/components/task/TaskDocumentList.vue
+++ b/frontend/components/task/TaskDocumentList.vue
@@ -28,12 +28,13 @@
                <!-- File info -->
                <div class="min-w-0 flex-1">
                    <p class="truncate text-xs font-medium text-neutral-700">{{ doc.originalName }}</p>
-                    <p class="text-xs text-neutral-400">{{ formatSize(doc.size) }}</p>
+                    <p class="text-xs text-neutral-400">{{ formatFileSize(doc.size) }}</p>
                </div>

                <!-- Delete button -->
                <button
                    v-if="isAdmin"
+                    type="button"
                    class="absolute right-1 top-1 hidden rounded p-0.5 text-neutral-400 transition-colors hover:bg-red-50 hover:text-red-500 group-hover:block"
                    @click.stop="$emit('delete', doc)"
                >
@@ -47,6 +48,7 @@
 <script setup lang="ts">
 import type { TaskDocument } from '~/services/dto/task-document'
 import { useTaskDocumentService } from '~/services/task-documents'
+import { formatFileSize } from '~/utils/format'

 defineProps<{
    documents: TaskDocument[]
@@ -72,9 +74,4 @@ function getIconForMime(mimeType: string): string {
    return 'heroicons:paper-clip'
 }

-function formatSize(bytes: number): string {
-    if (bytes < 1024) return `${bytes} o`
-    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} Ko`
-    return `${(bytes / (1024 * 1024)).toFixed(1)} Mo`
-}
 </script>
--- a/frontend/components/task/TaskDocumentPreview.vue
+++ b/frontend/components/task/TaskDocumentPreview.vue
@@ -56,7 +56,7 @@
                    <div v-else class="flex flex-col items-center gap-4 rounded-xl bg-white p-10">
                        <Icon name="heroicons:document" class="h-16 w-16 text-neutral-400" />
                        <p class="max-w-xs truncate text-lg font-medium text-neutral-700">{{ document.originalName }}</p>
-                        <p class="text-sm text-neutral-400">{{ formatSize(document.size) }}</p>
+                        <p class="text-sm text-neutral-400">{{ formatFileSize(document.size) }}</p>
                        <a
                            :href="downloadUrl"
                            download
@@ -77,6 +77,7 @@
 <script setup lang="ts">
 import type { TaskDocument } from '~/services/dto/task-document'
 import { useTaskDocumentService } from '~/services/task-documents'
+import { formatFileSize } from '~/utils/format'

 const props = defineProps<{
    document: TaskDocument | null
@@ -98,12 +99,6 @@ const downloadUrl = computed(() => props.document ? getDownloadUrl(props.documen
 const isImage = computed(() => props.document?.mimeType.startsWith('image/') ?? false)
 const isPdf = computed(() => props.document?.mimeType === 'application/pdf')

-function formatSize(bytes: number): string {
-    if (bytes < 1024) return `${bytes} o`
-    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} Ko`
-    return `${(bytes / (1024 * 1024)).toFixed(1)} Mo`
-}
-
 // Focus overlay for keyboard events
 watch(() => props.document, (doc) => {
    if (doc) {
--- a/frontend/components/task/TaskModal.vue
+++ b/frontend/components/task/TaskModal.vue
@@ -102,6 +102,14 @@
                                empty-option-label="Aucun groupe"
                                min-width="w-full"
                            />
+                            <MalioSelect
+                                v-if="clientTicketOptions.length"
+                                v-model="form.clientTicketId"
+                                :options="clientTicketOptions"
+                                label="Ticket client"
+                                empty-option-label="Aucun ticket client"
+                                min-width="w-full"
+                            />
                        </div>

                        <!-- Tags -->
@@ -146,7 +154,7 @@
                        />
                        <TaskDocumentList
                            v-if="isEditing && task"
-                            :documents="documents"
+                            :documents="localDocuments"
                            :is-admin="isAdmin"
                            @preview="openPreview"
                            @delete="handleDeleteDocument"
@@ -156,7 +164,7 @@
                        <TaskDocumentPreview
                            :document="previewDoc"
                            :has-prev="previewIndex > 0"
-                            :has-next="previewIndex < documents.length - 1"
+                            :has-next="previewIndex < localDocuments.length - 1"
                            @close="previewDoc = null"
                            @prev="prevPreview"
                            @next="nextPreview"
@@ -245,8 +253,10 @@
 <script setup lang="ts">
 import type { Task, TaskWrite } from '~/services/dto/task'
 import type { TaskDocument } from '~/services/dto/task-document'
+import type { ClientTicket } from '~/services/dto/client-ticket'
 import { useGiteaService } from '~/services/gitea'
 import { useTaskDocumentService } from '~/services/task-documents'
+import { useClientTicketService } from '~/services/client-tickets'
 import ConfirmDeleteDocumentModal from '~/components/ui/ConfirmDeleteDocumentModal.vue'
 import type { TaskStatus } from '~/services/dto/task-status'
 import type { TaskEffort } from '~/services/dto/task-effort'
@@ -279,6 +289,7 @@ const isOpen = computed({
 })

 function close() {
+    if (confirmDeleteDocOpen.value || confirmDeleteOpen.value) return
    isOpen.value = false
 }

@@ -306,6 +317,7 @@ const form = reactive({
    assigneeId: null as number | null,
    groupId: null as number | null,
    tagIds: [] as number[],
+    clientTicketId: null as number | null,
 })

 const touched = reactive({
@@ -362,6 +374,7 @@ function populateForm(task: Task | null) {
        form.assigneeId = task.assignee?.id ?? null
        form.groupId = task.group?.id ?? null
        form.tagIds = task.tags.map(t => t.id)
+        form.clientTicketId = task.clientTicket?.id ?? null
    } else {
        form.title = ''
        form.description = ''
@@ -371,13 +384,29 @@ function populateForm(task: Task | null) {
        form.assigneeId = null
        form.groupId = null
        form.tagIds = []
+        form.clientTicketId = null
    }
    touched.title = false
 }

-watch(() => props.modelValue, (open) => {
+watch(() => props.modelValue, async (open) => {
    if (open) {
+        confirmDeleteDocOpen.value = false
+        documentToDelete.value = null
        populateForm(props.task)
+        try {
+            clientTickets.value = await clientTicketService.getAll({ project: props.projectId })
+        } catch {
+            clientTickets.value = []
+        }
+        if (props.task?.project?.giteaOwner && props.task?.project?.giteaRepo && !giteaUrl.value) {
+            try {
+                const settings = await getGiteaSettings()
+                giteaUrl.value = settings.url ?? ''
+            } catch {
+                // Gitea not available
+            }
+        }
    }
 })

@@ -387,21 +416,16 @@ watch(() => props.task, (task) => {
    }
 })

-watch(() => props.modelValue, async (open) => {
-    if (open && props.task?.project?.giteaOwner && props.task?.project?.giteaRepo && !giteaUrl.value) {
-        try {
-            const settings = await getGiteaSettings()
-            giteaUrl.value = settings.url ?? ''
-        } catch {
-            // Gitea not available
-        }
-    }
-})
-
 const { create, update, remove } = useTaskService()
 const { remove: removeDocument, getByTask: getDocumentsByTask } = useTaskDocumentService()
+const clientTicketService = useClientTicketService()
 const { t } = useI18n()

+const clientTickets = ref<ClientTicket[]>([])
+const clientTicketOptions = computed(() =>
+    clientTickets.value.map(ct => ({ label: `CT-${String(ct.number).padStart(3, '0')} — ${ct.title}`, value: ct.id }))
+)
+
 const authStore = useAuthStore()
 const isAdmin = computed(() => authStore.user?.roles?.includes('ROLE_ADMIN') ?? false)

@@ -416,7 +440,6 @@ function ticketStatusClass(status: string): string {
 }

 const localDocuments = ref<TaskDocument[]>([])
-const documents = computed(() => localDocuments.value)
 const previewDoc = ref<TaskDocument | null>(null)

 // Sync documents from task prop when modal opens or task changes
@@ -431,7 +454,7 @@ async function refreshDocuments() {

 const previewIndex = computed(() => {
    if (!previewDoc.value) return -1
-    return documents.value.findIndex(d => d.id === previewDoc.value!.id)
+    return localDocuments.value.findIndex(d => d.id === previewDoc.value!.id)
 })

 function openPreview(doc: TaskDocument) {
@@ -440,13 +463,13 @@ function openPreview(doc: TaskDocument) {

 function prevPreview() {
    if (previewIndex.value > 0) {
-        previewDoc.value = documents.value[previewIndex.value - 1]
+        previewDoc.value = localDocuments.value[previewIndex.value - 1]
    }
 }

 function nextPreview() {
-    if (previewIndex.value < documents.value.length - 1) {
-        previewDoc.value = documents.value[previewIndex.value + 1]
+    if (previewIndex.value < localDocuments.value.length - 1) {
+        previewDoc.value = localDocuments.value[previewIndex.value + 1]
    }
 }

@@ -532,6 +555,7 @@ async function handleSubmit() {
            group: form.groupId ? `/api/task_groups/${form.groupId}` : null,
            project: `/api/projects/${props.projectId}`,
            tags: form.tagIds.map(id => `/api/task_tags/${id}`),
+            clientTicket: form.clientTicketId ? `/api/client_tickets/${form.clientTicketId}` : null,
        }

        if (isEditing.value && props.task) {
--- a/frontend/components/ui/AppTopNav.vue
+++ b/frontend/components/ui/AppTopNav.vue
@@ -10,14 +10,16 @@
      <div class="ml-auto flex items-center gap-4 text-xl text-white sm:gap-8">
        <NotificationBell />
        <div class="group relative flex gap-2 sm:gap-4">
-          <Icon name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
+          <UserAvatar v-if="user" :user="user" size="md" class="cursor-pointer" />
+          <Icon v-else name="mdi:account-circle-outline" class="self-center cursor-pointer" size="36" />
          <p class="hidden self-center cursor-pointer sm:block">{{ user?.username }}</p>
          <div class="invisible absolute right-0 top-full z-50 mt-2 w-44 rounded-md border border-neutral-200 bg-white py-1 text-sm text-neutral-800 opacity-0 shadow-lg transition-all group-hover:visible group-hover:opacity-100">
            <button
              type="button"
              class="block w-full px-3 py-2 text-left hover:bg-neutral-100"
+              @click="navigateTo('/profile')"
            >
-              Mon profil
+              {{ $t('profile.title') }}
            </button>
            <button
              type="button"
@@ -43,7 +45,7 @@ defineProps<{
 const auth = useAuthStore()
 const ui = useUiStore()

-const handleLogout = async () => {
+async function handleLogout() {
  await auth.logout()
  await navigateTo('/login')
 }
--- a/frontend/components/ui/ConfirmDeleteDocumentModal.vue
+++ b/frontend/components/ui/ConfirmDeleteDocumentModal.vue
@@ -2,7 +2,7 @@
    <Teleport v-if="modelValue" to="body">
        <Transition name="modal" appear>
            <div class="fixed inset-0 z-[70] flex items-center justify-center">
-                <div class="absolute inset-0 bg-black/30" @click="cancel" />
+                <div class="absolute inset-0 bg-black/30" @click.stop="cancel" />
                <div class="relative z-10 w-full max-w-md rounded-lg bg-white p-6 shadow-xl">
                    <h3 class="text-lg font-bold text-neutral-900">{{ $t('taskDocuments.confirmDeleteTitle') }}</h3>
                    <p class="mt-3 text-sm text-neutral-600">
--- a/frontend/components/ui/DateFilter.vue
+++ b/frontend/components/ui/DateFilter.vue
@@ -0,0 +1,216 @@
+<template>
+    <div class="date-filter">
+        <VueDatePicker
+            ref="datepicker"
+            v-model="internalValue"
+            :week-picker="mode === 'week'"
+            :enable-time-picker="false"
+            :locale="frLocale"
+            :format="formatDisplay"
+            auto-apply
+            :multi-calendars="false"
+            position="left"
+            teleport
+            @update:model-value="onUpdate"
+        >
+            <template #trigger>
+                <div class="flex items-center gap-1">
+                    <div class="flex shrink-0 overflow-hidden rounded-md border border-neutral-300">
+                        <button
+                            class="px-2 py-[7px] text-xs font-medium transition"
+                            :class="mode === 'day' ? 'bg-primary-500 text-white' : 'text-neutral-500 hover:bg-neutral-100'"
+                            @click.stop="switchMode('day')"
+                        >
+                            {{ t('common.day') }}
+                        </button>
+                        <button
+                            class="px-2 py-[7px] text-xs font-medium transition"
+                            :class="mode === 'week' ? 'bg-primary-500 text-white' : 'text-neutral-500 hover:bg-neutral-100'"
+                            @click.stop="switchMode('week')"
+                        >
+                            {{ t('common.weekShort') }}
+                        </button>
+                    </div>
+                    <div class="relative cursor-pointer">
+                        <input
+                            :value="displayValue"
+                            class="w-full cursor-pointer rounded-md border border-neutral-300 bg-white px-3 py-[7px] pr-8 text-sm text-neutral-700 outline-none transition placeholder:text-neutral-400 focus:border-primary-500"
+                            :placeholder="t('common.dateFilter')"
+                            readonly
+                        />
+                        <button
+                            v-if="internalValue"
+                            class="absolute right-2 top-1/2 -translate-y-1/2 text-neutral-400 hover:text-neutral-600"
+                            @click.stop="onClear"
+                        >
+                            <Icon name="mdi:close-circle" size="16" />
+                        </button>
+                        <Icon
+                            v-else
+                            name="mdi:calendar"
+                            size="16"
+                            class="pointer-events-none absolute right-2 top-1/2 -translate-y-1/2 text-neutral-400"
+                        />
+                    </div>
+                </div>
+            </template>
+
+            <template #action-buttons>
+                <div class="flex gap-2 px-3 pb-2">
+                    <button
+                        class="rounded px-2 py-1 text-xs font-medium text-primary-500 hover:bg-primary-500/10 transition"
+                        @click="selectToday"
+                    >
+                        {{ t('common.today') }}
+                    </button>
+                    <button
+                        class="rounded px-2 py-1 text-xs font-medium text-primary-500 hover:bg-primary-500/10 transition"
+                        @click="selectThisWeek"
+                    >
+                        {{ t('common.thisWeek') }}
+                    </button>
+                </div>
+            </template>
+        </VueDatePicker>
+    </div>
+</template>
+
+<script setup lang="ts">
+import { VueDatePicker } from '@vuepic/vue-datepicker'
+import '@vuepic/vue-datepicker/dist/main.css'
+import { fr as frLocale } from 'date-fns/locale'
+
+const { t } = useI18n()
+
+const props = defineProps<{
+    modelValue?: Date | [Date, Date] | null
+    placeholder?: string
+}>()
+
+const emit = defineEmits<{
+    'update:modelValue': [value: Date | [Date, Date] | null]
+}>()
+
+const datepicker = ref<InstanceType<typeof VueDatePicker> | null>(null)
+const mode = ref<'day' | 'week'>('week')
+const internalValue = ref<Date | Date[] | null>(null)
+
+const displayValue = computed(() => {
+    if (!internalValue.value) return ''
+    if (internalValue.value instanceof Date) {
+        return formatFullDate(internalValue.value)
+    }
+    if (Array.isArray(internalValue.value) && internalValue.value.length >= 2) {
+        const [start, end] = internalValue.value
+        if (!start || !end) return ''
+        return `${formatShortDate(start)} - ${formatShortDate(end)}`
+    }
+    return ''
+})
+
+function formatDisplay(dates: Date | Date[]): string {
+    if (!dates) return ''
+    if (dates instanceof Date) return formatFullDate(dates)
+    if (!Array.isArray(dates)) return ''
+    const valid = dates.filter((d): d is Date => d instanceof Date && !isNaN(d.getTime()))
+    if (valid.length === 0) return ''
+    if (valid.length === 1) return formatFullDate(valid[0])
+    return `${formatShortDate(valid[0])} - ${formatShortDate(valid[1])}`
+}
+
+function formatFullDate(d: Date): string {
+    if (!d || !(d instanceof Date) || isNaN(d.getTime())) return ''
+    const day = String(d.getDate()).padStart(2, '0')
+    const month = String(d.getMonth() + 1).padStart(2, '0')
+    const year = d.getFullYear()
+    return `${day}/${month}/${year}`
+}
+
+function formatShortDate(d: Date): string {
+    if (!d || !(d instanceof Date) || isNaN(d.getTime())) return ''
+    const day = String(d.getDate()).padStart(2, '0')
+    const month = String(d.getMonth() + 1).padStart(2, '0')
+    return `${day}/${month}`
+}
+
+function switchMode(newMode: 'day' | 'week') {
+    if (mode.value === newMode) return
+    mode.value = newMode
+    internalValue.value = null
+    emit('update:modelValue', null)
+}
+
+function onUpdate(value: Date | Date[] | null) {
+    if (!value) {
+        emit('update:modelValue', null)
+        return
+    }
+
+    if (mode.value === 'week' && Array.isArray(value)) {
+        const valid = value.filter((d): d is Date => d instanceof Date && !isNaN(d.getTime()))
+        if (valid.length >= 2) {
+            emit('update:modelValue', [valid[0], valid[1]])
+        }
+    } else if (mode.value === 'day' && value instanceof Date) {
+        emit('update:modelValue', value)
+    }
+}
+
+function onClear() {
+    internalValue.value = null
+    datepicker.value?.closeMenu()
+    emit('update:modelValue', null)
+}
+
+function selectToday() {
+    mode.value = 'day'
+    const today = new Date()
+    today.setHours(0, 0, 0, 0)
+    internalValue.value = today
+    emit('update:modelValue', today)
+}
+
+function selectThisWeek() {
+    mode.value = 'week'
+    const now = new Date()
+    const day = now.getDay()
+    const monday = new Date(now)
+    monday.setDate(now.getDate() - day + (day === 0 ? -6 : 1))
+    monday.setHours(0, 0, 0, 0)
+    const sunday = new Date(monday)
+    sunday.setDate(monday.getDate() + 6)
+    sunday.setHours(23, 59, 59, 999)
+    internalValue.value = [monday, sunday]
+    emit('update:modelValue', [monday, sunday])
+}
+
+watch(() => props.modelValue, (val) => {
+    if (val === null || val === undefined) {
+        internalValue.value = null
+    } else if (Array.isArray(val)) {
+        internalValue.value = [...val]
+    } else {
+        internalValue.value = val
+    }
+}, { immediate: true })
+</script>
+
+<style>
+.date-filter .dp__theme_light {
+    --dp-primary-color: #222783;
+    --dp-primary-text-color: #fff;
+    --dp-border-color: #d4d4d8;
+    --dp-menu-border-color: #d4d4d8;
+    --dp-border-color-hover: #222783;
+    --dp-hover-color: #f3f4f8;
+    --dp-font-size: 0.875rem;
+}
+
+.date-filter .dp__input_wrap {
+    width: auto;
+}
+
+.date-filter .dp__main {
+    font-family: inherit;
+}
+</style>
--- a/frontend/components/user/AvatarCropper.vue
+++ b/frontend/components/user/AvatarCropper.vue
@@ -0,0 +1,88 @@
+<template>
+    <Teleport to="body">
+        <div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
+            <div class="w-full max-w-md rounded-xl bg-white p-6 shadow-2xl">
+                <h3 class="mb-4 text-lg font-bold text-neutral-900">
+                    {{ $t('profile.cropAvatar') }}
+                </h3>
+
+                <div class="mx-auto mb-4 h-72 w-72">
+                    <Cropper
+                        ref="cropperRef"
+                        :src="imageSrc"
+                        :stencil-component="CircleStencil"
+                        :stencil-props="{ aspectRatio: 1 }"
+                        :canvas="{ width: 256, height: 256 }"
+                        class="h-full w-full"
+                    />
+                </div>
+
+                <div class="flex justify-end gap-3">
+                    <button
+                        type="button"
+                        class="rounded-lg border border-neutral-300 px-4 py-2 text-sm font-medium text-neutral-700 hover:bg-neutral-50"
+                        @click="emit('cancel')"
+                    >
+                        {{ $t('common.cancel') }}
+                    </button>
+                    <button
+                        type="button"
+                        class="rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white hover:bg-secondary-500"
+                        :disabled="cropping"
+                        @click="onConfirm"
+                    >
+                        {{ $t('common.confirm') }}
+                    </button>
+                </div>
+            </div>
+        </div>
+    </Teleport>
+</template>
+
+<script setup lang="ts">
+import { Cropper, CircleStencil } from 'vue-advanced-cropper'
+import 'vue-advanced-cropper/dist/style.css'
+
+const props = defineProps<{
+    imageFile: File
+}>()
+
+const emit = defineEmits<{
+    (e: 'crop', blob: Blob): void
+    (e: 'cancel'): void
+}>()
+
+const cropperRef = ref()
+const cropping = ref(false)
+const imageSrc = ref('')
+
+onMounted(() => {
+    imageSrc.value = URL.createObjectURL(props.imageFile)
+})
+
+onUnmounted(() => {
+    if (imageSrc.value) {
+        URL.revokeObjectURL(imageSrc.value)
+    }
+})
+
+async function onConfirm() {
+    cropping.value = true
+
+    try {
+        const { canvas } = cropperRef.value.getResult()
+
+        if (!canvas) return
+
+        const blob = await new Promise<Blob | null>((resolve) => {
+            canvas.toBlob(resolve, 'image/png')
+        })
+
+        if (blob) {
+            emit('crop', blob)
+        }
+    } finally {
+        cropping.value = false
+    }
+}
+</script>
--- a/frontend/components/user/UserAvatar.vue
+++ b/frontend/components/user/UserAvatar.vue
@@ -0,0 +1,55 @@
+<template>
+    <span
+        class="inline-flex shrink-0 items-center justify-center rounded-full"
+        :class="sizeClasses"
+        :title="user.username"
+    >
+        <img
+            v-if="user.avatarUrl && !imgError"
+            :src="user.avatarUrl"
+            :alt="user.username"
+            class="h-full w-full rounded-full object-cover"
+            @error="imgError = true"
+        />
+        <span
+            v-else
+            class="flex h-full w-full items-center justify-center rounded-full bg-primary-500 font-bold text-white"
+            :class="textSizeClass"
+        >
+            {{ user.username.substring(0, 2).toUpperCase() }}
+        </span>
+    </span>
+</template>
+
+<script setup lang="ts">
+const props = defineProps<{
+    user: { id?: number; username: string; avatarUrl?: string | null }
+    size?: 'xs' | 'sm' | 'md' | 'lg'
+}>()
+
+const imgError = ref(false)
+
+watch(() => props.user.avatarUrl, () => {
+    imgError.value = false
+})
+
+const sizeClasses = computed(() => {
+    const map = {
+        xs: 'h-5 w-5',
+        sm: 'h-6 w-6',
+        md: 'h-8 w-8',
+        lg: 'h-12 w-12',
+    }
+    return map[props.size ?? 'sm']
+})
+
+const textSizeClass = computed(() => {
+    const map = {
+        xs: 'text-[10px]',
+        sm: 'text-xs',
+        md: 'text-sm',
+        lg: 'text-base',
+    }
+    return map[props.size ?? 'sm']
+})
+</script>
--- a/frontend/components/user/UserDrawer.vue
+++ b/frontend/components/user/UserDrawer.vue
@@ -121,7 +121,7 @@ const clientOptions = computed(() => [
 const filteredProjects = computed(() => {
    if (form.clientId === null) return []
    return allProjects.value.filter(
-        (p) => p.client !== null && p.client.id === form.clientId,
+        (p) => p.client && typeof p.client === 'object' && 'id' in p.client && p.client.id === form.clientId,
    )
 })

--- a/frontend/composables/useApi.ts
+++ b/frontend/composables/useApi.ts
@@ -29,13 +29,14 @@ export type ApiFetchOptions<ResponseType extends 'json' | 'blob'> =
    toastSuccessKey?: string
  }

-export const useApi = (): ApiClient => {
+let isHandlingUnauthorized = false
+
+export function useApi(): ApiClient {
  const config = useRuntimeConfig()
  const baseURL = config.public.apiBase || '/api'
  const toast = useToast()
  const auth = useAuthStore()
  const nuxtApp = useNuxtApp()
-  let isHandlingUnauthorized = false
  const i18n = nuxtApp.$i18n as
    | {
        t: (key: string) => string
@@ -45,7 +46,7 @@ export const useApi = (): ApiClient => {
  const t = (key: string) => (i18n?.t ? String(i18n.t(key)) : key)
  const te = (key: string) => (i18n?.te ? i18n.te(key) : false)

-  const extractErrorMessage = (error: unknown, responseData?: unknown): string => {
+  function extractErrorMessage(error: unknown, responseData?: unknown): string {
    const data = responseData ?? (error as FetchError)?.data

    if (typeof data === 'string') {
@@ -169,11 +170,11 @@ export const useApi = (): ApiClient => {
    }
  })

-  const request = <T>(
+  function request<T>(
    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
    url: string,
    options: ApiFetchOptions<'json'> = {}
-  ) => {
+  ) {
    const needsJsonBody = method === 'POST' || method === 'PUT'
    const needsMergePatch = method === 'PATCH'

--- a/frontend/composables/useAppVersion.ts
+++ b/frontend/composables/useAppVersion.ts
@@ -1,8 +1,8 @@
-export const useAppVersion = () => {
+export function useAppVersion() {
    const api = useApi()
    const version = useState<string | null>('app-version', () => null)

-    const load = async () => {
+    async function load(): Promise<string | null> {
        if (version.value) {
            return version.value
        }
--- a/frontend/composables/useAvatarService.ts
+++ b/frontend/composables/useAvatarService.ts
@@ -0,0 +1,24 @@
+export function useAvatarService() {
+    const api = useApi()
+
+    async function upload(userId: number, file: Blob): Promise<{ avatarUrl: string }> {
+        const formData = new FormData()
+        formData.append('file', file, 'avatar.png')
+
+        return $fetch(`/api/users/${userId}/avatar`, {
+            method: 'POST',
+            body: formData,
+            credentials: 'include',
+        })
+    }
+
+    async function remove(userId: number): Promise<void> {
+        await api.delete(`/users/${userId}/avatar`)
+    }
+
+    function getUrl(userId: number): string {
+        return `/api/users/${userId}/avatar`
+    }
+
+    return { upload, remove, getUrl }
+}
--- a/frontend/composables/useClientTicketHelpers.ts
+++ b/frontend/composables/useClientTicketHelpers.ts
@@ -1,3 +1,5 @@
+import type { ClientTicketStatus } from '~/services/dto/client-ticket'
+
 export function useClientTicketHelpers() {
    function typeBadgeClass(type: string): string {
        switch (type) {
@@ -25,5 +27,22 @@ export function useClientTicketHelpers() {
        })
    }

-    return { typeBadgeClass, statusBadgeClass, formatDate }
+    function getAvailableStatusTransitions(
+        current: ClientTicketStatus,
+        t: (key: string) => string,
+    ): { label: string; value: ClientTicketStatus }[] {
+        const allStatuses: { label: string; value: ClientTicketStatus }[] = [
+            { label: t('clientTicket.status.new'), value: 'new' },
+            { label: t('clientTicket.status.in_progress'), value: 'in_progress' },
+            { label: t('clientTicket.status.done'), value: 'done' },
+            { label: t('clientTicket.status.rejected'), value: 'rejected' },
+        ]
+        return allStatuses.filter(s => {
+            if (s.value === current) return false
+            if ((current === 'done' || current === 'rejected') && s.value === 'new') return false
+            return true
+        })
+    }
+
+    return { typeBadgeClass, statusBadgeClass, formatDate, getAvailableStatusTransitions }
 }
--- a/frontend/i18n/locales/fr.json
+++ b/frontend/i18n/locales/fr.json
@@ -166,7 +166,15 @@
    },
    "common": {
        "cancel": "Annuler",
-        "loading": "Chargement..."
+        "save": "Enregistrer",
+        "edit": "Modifier",
+        "loading": "Chargement...",
+        "dateFilter": "Date",
+        "today": "Aujourd'hui",
+        "thisWeek": "Cette semaine",
+        "clear": "Effacer",
+        "day": "Jour",
+        "weekShort": "Sem."
    },
    "gitea": {
        "settings": {
@@ -229,6 +237,7 @@
        "new": "Nouveau ticket",
        "created": "Ticket créé avec succès.",
        "deleted": "Ticket supprimé avec succès.",
+        "updated": "Ticket mis à jour avec succès.",
        "statusUpdated": "Statut du ticket mis à jour.",
        "type": {
            "bug": "Bug",
@@ -282,6 +291,12 @@
            "days": "Il y a {n}j"
        }
    },
+    "profile": {
+        "title": "Mon profil",
+        "changeAvatar": "Changer l'avatar",
+        "removeAvatar": "Supprimer l'avatar",
+        "cropAvatar": "Recadrer l'avatar"
+    },
    "bookstack": {
        "settings": {
            "title": "Configuration BookStack",
--- a/frontend/layouts/auth.vue
+++ b/frontend/layouts/auth.vue
@@ -5,7 +5,3 @@
    </main>
  </div>
 </template>
-
-<script setup lang="ts">
-const { version } = useAppVersion()
-</script>
--- a/frontend/layouts/default.vue
+++ b/frontend/layouts/default.vue
@@ -242,11 +242,6 @@ function onCompleteSaved() {
        timerStore.clearPendingEntry()
    })
 }
-
-const handleLogout = async () => {
-    await auth.logout()
-    await navigateTo('/login')
-}
 </script>

 <style scoped>
--- a/frontend/middleware/auth.global.ts
+++ b/frontend/middleware/auth.global.ts
@@ -10,17 +10,16 @@ export default defineNuxtRouteMiddleware(async (to) => {
        return navigateTo('/login')
    }

+    const isClientOnly = auth.isAuthenticated
+        && auth.user?.roles?.includes('ROLE_CLIENT')
+        && !auth.user?.roles?.includes('ROLE_ADMIN')
+
    if (isLogin && auth.isAuthenticated) {
-        const isClientOnly = auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN')
        return navigateTo(isClientOnly ? '/portal' : '/')
    }

-    // ROLE_CLIENT without ROLE_ADMIN: redirect to /portal, block internal pages
-    if (auth.isAuthenticated && auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN')) {
-        const isPortalRoute = to.path.startsWith('/portal')
-        const isLoginRoute = to.path === '/login'
-        if (!isPortalRoute && !isLoginRoute) {
-            return navigateTo('/portal')
-        }
+    const isProfileRoute = to.path === '/profile'
+    if (isClientOnly && !to.path.startsWith('/portal') && !isProfileRoute) {
+        return navigateTo('/portal')
    }
 })
--- a/frontend/nuxt.config.ts
+++ b/frontend/nuxt.config.ts
@@ -62,5 +62,8 @@ export default defineNuxtConfig({
    },
    typescript: {
        strict: true
+    },
+    build: {
+        transpile: ['@vuepic/vue-datepicker']
    }
 })
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -12,11 +12,13 @@
                "@nuxtjs/i18n": "^10.2.3",
                "@nuxtjs/tailwindcss": "^6.14.0",
                "@pinia/nuxt": "^0.11.3",
+                "@vuepic/vue-datepicker": "^12.1.0",
                "chart.js": "^4.5.1",
                "nuxt": "^4.3.1",
                "nuxt-toast": "^1.4.0",
                "pinia": "^3.0.4",
                "vue": "^3.5.29",
+                "vue-advanced-cropper": "^2.8.9",
                "vue-chartjs": "^5.3.3",
                "vue-router": "^4.6.4"
            }
@@ -541,6 +543,12 @@
                "postcss-selector-parser": "^7.0.0"
            }
        },
+        "node_modules/@date-fns/tz": {
+            "version": "1.4.1",
+            "resolved": "https://registry.npmjs.org/@date-fns/tz/-/tz-1.4.1.tgz",
+            "integrity": "sha512-P5LUNhtbj6YfI3iJjw5EL9eUAG6OitD0W3fWQcpQjDRc/QIsL0tRNuO1PcDvPccWL1fSTXXdE1ds+l95DV/OFA==",
+            "license": "MIT"
+        },
        "node_modules/@dxup/nuxt": {
            "version": "0.3.2",
            "resolved": "https://registry.npmjs.org/@dxup/nuxt/-/nuxt-0.3.2.tgz",
@@ -1094,6 +1102,68 @@
                "node": "^20.19.0 || ^22.13.0 || >=24"
            }
        },
+        "node_modules/@floating-ui/core": {
+            "version": "1.7.5",
+            "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.7.5.tgz",
+            "integrity": "sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==",
+            "license": "MIT",
+            "dependencies": {
+                "@floating-ui/utils": "^0.2.11"
+            }
+        },
+        "node_modules/@floating-ui/dom": {
+            "version": "1.7.6",
+            "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.7.6.tgz",
+            "integrity": "sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==",
+            "license": "MIT",
+            "dependencies": {
+                "@floating-ui/core": "^1.7.5",
+                "@floating-ui/utils": "^0.2.11"
+            }
+        },
+        "node_modules/@floating-ui/utils": {
+            "version": "0.2.11",
+            "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.11.tgz",
+            "integrity": "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==",
+            "license": "MIT"
+        },
+        "node_modules/@floating-ui/vue": {
+            "version": "1.1.11",
+            "resolved": "https://registry.npmjs.org/@floating-ui/vue/-/vue-1.1.11.tgz",
+            "integrity": "sha512-HzHKCNVxnGS35r9fCHBc3+uCnjw9IWIlCPL683cGgM9Kgj2BiAl8x1mS7vtvP6F9S/e/q4O6MApwSHj8hNLGfw==",
+            "license": "MIT",
+            "dependencies": {
+                "@floating-ui/dom": "^1.7.6",
+                "@floating-ui/utils": "^0.2.11",
+                "vue-demi": ">=0.13.0"
+            }
+        },
+        "node_modules/@floating-ui/vue/node_modules/vue-demi": {
+            "version": "0.14.10",
+            "resolved": "https://registry.npmjs.org/vue-demi/-/vue-demi-0.14.10.tgz",
+            "integrity": "sha512-nMZBOwuzabUO0nLgIcc6rycZEebF6eeUfaiQx9+WSk8e29IbLvPU9feI6tqW4kTo3hvoYAJkMh8n8D0fuISphg==",
+            "hasInstallScript": true,
+            "license": "MIT",
+            "bin": {
+                "vue-demi-fix": "bin/vue-demi-fix.js",
+                "vue-demi-switch": "bin/vue-demi-switch.js"
+            },
+            "engines": {
+                "node": ">=12"
+            },
+            "funding": {
+                "url": "https://github.com/sponsors/antfu"
+            },
+            "peerDependencies": {
+                "@vue/composition-api": "^1.0.0-rc.1",
+                "vue": "^3.0.0-0 || ^2.6.0"
+            },
+            "peerDependenciesMeta": {
+                "@vue/composition-api": {
+                    "optional": true
+                }
+            }
+        },
        "node_modules/@humanfs/core": {
            "version": "0.19.1",
            "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
@@ -5259,6 +5329,12 @@
            "integrity": "sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==",
            "license": "MIT"
        },
+        "node_modules/@types/web-bluetooth": {
+            "version": "0.0.21",
+            "resolved": "https://registry.npmjs.org/@types/web-bluetooth/-/web-bluetooth-0.0.21.tgz",
+            "integrity": "sha512-oIQLCGWtcFZy2JW77j9k8nHzAOpqMHLQejDA48XXMWH6tjCQHz5RCFz1bzsmROyL6PUm+LLnUiI4BCn221inxA==",
+            "license": "MIT"
+        },
        "node_modules/@typescript-eslint/project-service": {
            "version": "8.56.1",
            "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.56.1.tgz",
@@ -5720,6 +5796,62 @@
            "integrity": "sha512-w7SR0A5zyRByL9XUkCfdLs7t9XOHUyJ67qPGQjOou3p6GvBeBW+AVjUUmlxtZ4PIYaRvE+1LmK44O4uajlZwcg==",
            "license": "MIT"
        },
+        "node_modules/@vuepic/vue-datepicker": {
+            "version": "12.1.0",
+            "resolved": "https://registry.npmjs.org/@vuepic/vue-datepicker/-/vue-datepicker-12.1.0.tgz",
+            "integrity": "sha512-QuWcO+CqIGYFoRNCagp9xUY9sMK/OHUlVIDxBYjw7HjCTWXfuE/r3l3loB00faEtb0Teo3DeBn26hT3tYA5pgg==",
+            "license": "MIT",
+            "dependencies": {
+                "@date-fns/tz": "^1.4.1",
+                "@floating-ui/vue": "^1.1.9",
+                "@vueuse/core": "^14.1.0",
+                "date-fns": "^4.1.0"
+            },
+            "engines": {
+                "node": ">=18.12.0"
+            },
+            "peerDependencies": {
+                "vue": ">=3.5.0"
+            }
+        },
+        "node_modules/@vueuse/core": {
+            "version": "14.2.1",
+            "resolved": "https://registry.npmjs.org/@vueuse/core/-/core-14.2.1.tgz",
+            "integrity": "sha512-3vwDzV+GDUNpdegRY6kzpLm4Igptq+GA0QkJ3W61Iv27YWwW/ufSlOfgQIpN6FZRMG0mkaz4gglJRtq5SeJyIQ==",
+            "license": "MIT",
+            "dependencies": {
+                "@types/web-bluetooth": "^0.0.21",
+                "@vueuse/metadata": "14.2.1",
+                "@vueuse/shared": "14.2.1"
+            },
+            "funding": {
+                "url": "https://github.com/sponsors/antfu"
+            },
+            "peerDependencies": {
+                "vue": "^3.5.0"
+            }
+        },
+        "node_modules/@vueuse/metadata": {
+            "version": "14.2.1",
+            "resolved": "https://registry.npmjs.org/@vueuse/metadata/-/metadata-14.2.1.tgz",
+            "integrity": "sha512-1ButlVtj5Sb/HDtIy1HFr1VqCP4G6Ypqt5MAo0lCgjokrk2mvQKsK2uuy0vqu/Ks+sHfuHo0B9Y9jn9xKdjZsw==",
+            "license": "MIT",
+            "funding": {
+                "url": "https://github.com/sponsors/antfu"
+            }
+        },
+        "node_modules/@vueuse/shared": {
+            "version": "14.2.1",
+            "resolved": "https://registry.npmjs.org/@vueuse/shared/-/shared-14.2.1.tgz",
+            "integrity": "sha512-shTJncjV9JTI4oVNyF1FQonetYAiTBd+Qj7cY89SWbXSkx7gyhrgtEdF2ZAVWS1S3SHlaROO6F2IesJxQEkZBw==",
+            "license": "MIT",
+            "funding": {
+                "url": "https://github.com/sponsors/antfu"
+            },
+            "peerDependencies": {
+                "vue": "^3.5.0"
+            }
+        },
        "node_modules/abbrev": {
            "version": "3.0.1",
            "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-3.0.1.tgz",
@@ -6658,6 +6790,12 @@
                "consola": "^3.2.3"
            }
        },
+        "node_modules/classnames": {
+            "version": "2.5.1",
+            "resolved": "https://registry.npmjs.org/classnames/-/classnames-2.5.1.tgz",
+            "integrity": "sha512-saHYOzhIQs6wy2sVxTM6bUDsQO4F50V9RQ22qBpEdCW+I+/Wmke2HOl6lS6dTpdxVhb88/I6+Hs+438c3lfUow==",
+            "license": "MIT"
+        },
        "node_modules/clipboardy": {
            "version": "4.0.0",
            "resolved": "https://registry.npmjs.org/clipboardy/-/clipboardy-4.0.0.tgz",
@@ -7126,6 +7264,16 @@
            "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
            "license": "MIT"
        },
+        "node_modules/date-fns": {
+            "version": "4.1.0",
+            "resolved": "https://registry.npmjs.org/date-fns/-/date-fns-4.1.0.tgz",
+            "integrity": "sha512-Ukq0owbQXxa/U3EGtsdVBkR1w7KOQ5gIBqdH2hkvknzZPYvBxb/aa6E8L7tmjFtkwZBu3UXBbjIgPo/Ez4xaNg==",
+            "license": "MIT",
+            "funding": {
+                "type": "github",
+                "url": "https://github.com/sponsors/kossnocorp"
+            }
+        },
        "node_modules/db0": {
            "version": "0.3.4",
            "resolved": "https://registry.npmjs.org/db0/-/db0-0.3.4.tgz",
@@ -7160,6 +7308,12 @@
                }
            }
        },
+        "node_modules/debounce": {
+            "version": "1.2.1",
+            "resolved": "https://registry.npmjs.org/debounce/-/debounce-1.2.1.tgz",
+            "integrity": "sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug==",
+            "license": "MIT"
+        },
        "node_modules/debug": {
            "version": "4.4.3",
            "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
@@ -7437,6 +7591,12 @@
            "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
            "license": "MIT"
        },
+        "node_modules/easy-bem": {
+            "version": "1.1.1",
+            "resolved": "https://registry.npmjs.org/easy-bem/-/easy-bem-1.1.1.tgz",
+            "integrity": "sha512-GJRqdiy2h+EXy6a8E6R+ubmqUM08BK0FWNq41k24fup6045biQ8NXxoXimiwegMQvFFV3t1emADdGNL1TlS61A==",
+            "license": "MIT"
+        },
        "node_modules/ee-first": {
            "version": "1.1.1",
            "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
@@ -13728,6 +13888,24 @@
                }
            }
        },
+        "node_modules/vue-advanced-cropper": {
+            "version": "2.8.9",
+            "resolved": "https://registry.npmjs.org/vue-advanced-cropper/-/vue-advanced-cropper-2.8.9.tgz",
+            "integrity": "sha512-1jc5gO674kVGpJKekoaol6ZlwaF5VYDLSBwBOUpViW0IOrrRsyLw6XNszjEqgbavvqinlKNS6Kqlom3B5M72Tw==",
+            "license": "MIT",
+            "dependencies": {
+                "classnames": "^2.2.6",
+                "debounce": "^1.2.0",
+                "easy-bem": "^1.0.2"
+            },
+            "engines": {
+                "node": ">=8",
+                "npm": ">=5"
+            },
+            "peerDependencies": {
+                "vue": "^3.0.0"
+            }
+        },
        "node_modules/vue-bundle-renderer": {
            "version": "2.2.0",
            "resolved": "https://registry.npmjs.org/vue-bundle-renderer/-/vue-bundle-renderer-2.2.0.tgz",
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -16,11 +16,13 @@
        "@nuxtjs/i18n": "^10.2.3",
        "@nuxtjs/tailwindcss": "^6.14.0",
        "@pinia/nuxt": "^0.11.3",
+        "@vuepic/vue-datepicker": "^12.1.0",
        "chart.js": "^4.5.1",
        "nuxt": "^4.3.1",
        "nuxt-toast": "^1.4.0",
        "pinia": "^3.0.4",
        "vue": "^3.5.29",
+        "vue-advanced-cropper": "^2.8.9",
        "vue-chartjs": "^5.3.3",
        "vue-router": "^4.6.4"
    }
--- a/frontend/pages/login.vue
+++ b/frontend/pages/login.vue
@@ -48,7 +48,6 @@ useHead({
    title: 'Connexion'
 })

-const router = useRouter()
 const auth = useAuthStore()
 const {version} = useAppVersion()

@@ -56,7 +55,7 @@ const username = ref('')
 const password = ref('')
 const isSubmitting = ref(false)

-const handleSubmit = async () => {
+async function handleSubmit() {
    if (isSubmitting.value) return

    isSubmitting.value = true
@@ -64,7 +63,7 @@ const handleSubmit = async () => {
        await auth.login(username.value, password.value)

        const isClient = auth.user?.roles?.includes('ROLE_CLIENT') ?? false
-        await router.push(isClient ? '/portal' : '/')
+        await navigateTo(isClient ? '/portal' : '/')
    } finally {
        isSubmitting.value = false
    }
--- a/frontend/pages/my-tasks.vue
+++ b/frontend/pages/my-tasks.vue
@@ -236,20 +236,20 @@ onMounted(() => {
                <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">{{ $t('myTasks.title') }}</h1>
                <div class="flex gap-1">
                    <button
-                        class="rounded-lg p-2 transition-colors"
+                        class="flex items-center justify-center rounded-md p-1.5 transition-colors"
                        :class="viewMode === 'kanban' ? 'bg-primary-500 text-white' : 'text-neutral-400 hover:text-primary-500'"
                        :title="$t('myTasks.viewKanban')"
                        @click="viewMode = 'kanban'"
                    >
-                        <Icon name="mdi:view-column-outline" size="20" />
+                        <Icon name="mdi:view-column-outline" size="18" />
                    </button>
                    <button
-                        class="rounded-lg p-2 transition-colors"
+                        class="flex items-center justify-center rounded-md p-1.5 transition-colors"
                        :class="viewMode === 'list' ? 'bg-primary-500 text-white' : 'text-neutral-400 hover:text-primary-500'"
                        :title="$t('myTasks.viewList')"
                        @click="viewMode = 'list'"
                    >
-                        <Icon name="mdi:view-list-outline" size="20" />
+                        <Icon name="mdi:view-list-outline" size="18" />
                    </button>
                </div>
            </div>
--- a/frontend/pages/portal/index.vue
+++ b/frontend/pages/portal/index.vue
@@ -68,13 +68,12 @@ async function loadData() {
    isLoading.value = true
    try {
        if (auth.user?.roles?.includes('ROLE_ADMIN')) {
-            // Admin sees all projects
-            const allProjects = await projectService.getAll({ archived: false })
-            projects.value = allProjects
+            projects.value = await projectService.getAll({ archived: false })
        } else {
-            // Client sees allowed projects
-            projects.value = auth.user?.allowedProjects ?? []
+            // allowedProjects are embedded objects from /api/me (with me:read group)
+            projects.value = (auth.user?.allowedProjects ?? []) as Project[]
        }
+
        tickets.value = await clientTicketService.getAll()
    } finally {
        isLoading.value = false
--- a/frontend/pages/portal/projects/[id]/index.vue
+++ b/frontend/pages/portal/projects/[id]/index.vue
@@ -30,34 +30,56 @@
            {{ $t('clientTicket.noTickets') }}
        </div>

-        <div v-else class="mt-4 space-y-3">
+        <!-- Kanban board -->
+        <div v-else class="mt-4 flex flex-col gap-4 sm:flex-row sm:overflow-x-auto sm:pb-4">
            <div
-                v-for="ticket in tickets"
-                :key="ticket.id"
-                class="flex cursor-pointer items-center justify-between gap-3 rounded-lg border border-neutral-200 bg-white p-4 shadow-sm transition hover:shadow-md"
-                @click="openDetail(ticket)"
+                v-for="col in columns"
+                :key="col.status"
+                class="min-w-0 flex-1 sm:min-w-[280px]"
            >
-                <div class="min-w-0 flex-1">
-                    <div class="flex items-center gap-2">
-                        <span class="text-sm font-bold text-primary-500">CT-{{ String(ticket.number).padStart(3, '0') }}</span>
-                        <span
-                            class="rounded-full px-2 py-0.5 text-xs font-semibold text-white"
-                            :class="typeBadgeClass(ticket.type)"
-                        >
-                            {{ $t(`clientTicket.type.${ticket.type}`) }}
-                        </span>
+                <div class="mb-3 flex items-center gap-2">
+                    <div class="h-2 w-2 rounded-full" :class="col.dotClass" />
+                    <h3 class="text-sm font-bold text-neutral-700">{{ col.label }}</h3>
+                    <span class="ml-auto rounded-full bg-neutral-100 px-2 py-0.5 text-xs font-semibold text-neutral-500">
+                        {{ col.tickets.length }}
+                    </span>
+                </div>
+                <div
+                    class="min-h-[60px] space-y-2 rounded-lg border-2 border-transparent p-1 transition-colors"
+                    :class="dragOverStatus === col.status ? 'border-primary-300 bg-primary-50/50' : ''"
+                    @dragover.prevent="onDragOver(col.status)"
+                    @dragleave="onDragLeave"
+                    @drop.prevent="onDrop(col.status)"
+                >
+                    <div
+                        v-for="ticket in col.tickets"
+                        :key="ticket.id"
+                        class="cursor-pointer rounded-lg border border-neutral-200 bg-white p-3 shadow-sm transition hover:shadow-md"
+                        :class="isAdmin ? 'cursor-grab active:cursor-grabbing' : ''"
+                        :draggable="isAdmin"
+                        @dragstart="onDragStart(ticket)"
+                        @dragend="onDragEnd"
+                        @click="openDetail(ticket)"
+                    >
+                        <div class="flex items-center gap-2">
+                            <span class="text-xs font-bold text-primary-500">CT-{{ String(ticket.number).padStart(3, '0') }}</span>
+                            <span
+                                class="rounded-full px-2 py-0.5 text-xs font-semibold text-white"
+                                :class="typeBadgeClass(ticket.type)"
+                            >
+                                {{ $t(`clientTicket.type.${ticket.type}`) }}
+                            </span>
+                        </div>
+                        <h4 class="mt-1.5 text-sm font-semibold leading-snug text-neutral-900">{{ ticket.title }}</h4>
+                        <p class="mt-1.5 text-xs text-neutral-400">{{ formatDate(ticket.createdAt) }}</p>
                    </div>
-                    <h4 class="mt-1 text-sm font-semibold text-neutral-900">{{ ticket.title }}</h4>
-                    <p class="mt-1 text-xs text-neutral-400">
-                        {{ formatDate(ticket.createdAt) }}
+                    <p
+                        v-if="col.tickets.length === 0"
+                        class="py-4 text-center text-xs text-neutral-400"
+                    >
+                        {{ $t('clientTicket.noTickets') }}
                    </p>
                </div>
-                <span
-                    class="shrink-0 rounded-full px-3 py-1 text-xs font-semibold"
-                    :class="statusBadgeClass(ticket.status)"
-                >
-                    {{ $t(`clientTicket.status.${ticket.status}`) }}
-                </span>
            </div>
        </div>

@@ -65,13 +87,49 @@
        <ClientTicketDetailModal
            v-model="detailOpen"
            :ticket="selectedTicket"
+            @refresh="loadTickets"
        />
+
+        <!-- Reject comment modal -->
+        <Teleport v-if="rejectModalOpen" to="body">
+            <div class="fixed inset-0 z-[60] flex items-center justify-center p-4">
+                <div class="absolute inset-0 bg-slate-900/40 backdrop-blur-sm" @click="cancelReject" />
+                <div class="relative z-10 w-full max-w-md rounded-2xl bg-white p-6 shadow-2xl">
+                    <h3 class="text-lg font-bold text-neutral-900">{{ $t('clientTicket.changeStatus') }}</h3>
+                    <p class="mt-2 text-sm text-neutral-600">{{ $t('clientTicket.rejectionRequired') }}</p>
+                    <textarea
+                        v-model="rejectComment"
+                        rows="3"
+                        class="mt-3 w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500"
+                        :placeholder="$t('clientTicket.rejectComment')"
+                    />
+                    <div class="mt-4 flex justify-end gap-3">
+                        <button
+                            type="button"
+                            class="rounded-lg border border-neutral-300 px-4 py-2 text-sm font-semibold text-neutral-700 hover:bg-neutral-50"
+                            @click="cancelReject"
+                        >
+                            {{ $t('common.cancel') }}
+                        </button>
+                        <button
+                            type="button"
+                            class="rounded-lg bg-red-600 px-4 py-2 text-sm font-semibold text-white hover:bg-red-700 disabled:opacity-50"
+                            :disabled="!rejectComment.trim()"
+                            @click="confirmReject"
+                        >
+                            {{ $t('clientTicket.status.rejected') }}
+                        </button>
+                    </div>
+                </div>
+            </div>
+        </Teleport>
    </div>
 </template>

 <script setup lang="ts">
-import type { ClientTicket } from '~/services/dto/client-ticket'
+import type { ClientTicket, ClientTicketStatus } from '~/services/dto/client-ticket'
 import { useClientTicketService } from '~/services/client-tickets'
+import { useProjectService } from '~/services/projects'

 definePageMeta({
    layout: 'portal',
@@ -84,40 +142,143 @@ const projectId = computed(() => Number(route.params.id))
 useHead({ title: t('portal.title') })

 const clientTicketService = useClientTicketService()
+const projectService = useProjectService()
 const auth = useAuthStore()

 const tickets = ref<ClientTicket[]>([])
+const projectName = ref('')
 const isLoading = ref(true)
 const detailOpen = ref(false)
 const selectedTicket = ref<ClientTicket | null>(null)

-const projectName = computed(() => {
-    const me = auth.user as any
-    if (me?.allowedProjects) {
-        const project = me.allowedProjects.find((p: any) => p.id === projectId.value)
-        return project?.name ?? ''
-    }
-    return ''
-})
+const isClient = computed(() => auth.user?.roles?.includes('ROLE_CLIENT') && !auth.user?.roles?.includes('ROLE_ADMIN'))
+const isAdmin = computed(() => auth.user?.roles?.includes('ROLE_ADMIN') ?? false)
+const { typeBadgeClass, formatDate } = useClientTicketHelpers()

-const isClient = computed(() => auth.user?.roles?.includes('ROLE_CLIENT') ?? false)
-const { typeBadgeClass, statusBadgeClass, formatDate } = useClientTicketHelpers()
+const allStatuses: ClientTicketStatus[] = ['new', 'in_progress', 'done', 'rejected']
+
+function statusDotClass(status: string): string {
+    switch (status) {
+        case 'new': return 'bg-blue-500'
+        case 'in_progress': return 'bg-yellow-500'
+        case 'done': return 'bg-green-500'
+        case 'rejected': return 'bg-red-500'
+        default: return 'bg-neutral-400'
+    }
+}
+
+const columns = computed(() => allStatuses.map(status => ({
+    status,
+    label: t(`clientTicket.status.${status}`),
+    dotClass: statusDotClass(status),
+    tickets: tickets.value.filter(tk => tk.status === status),
+})))
+
+// Drag & drop (admin only)
+const draggedTicket = ref<ClientTicket | null>(null)
+const dragOverStatus = ref<ClientTicketStatus | null>(null)
+
+function onDragStart(ticket: ClientTicket) {
+    draggedTicket.value = ticket
+}
+
+function onDragEnd() {
+    draggedTicket.value = null
+    dragOverStatus.value = null
+}
+
+function onDragOver(status: ClientTicketStatus) {
+    if (!draggedTicket.value) return
+    dragOverStatus.value = status
+}
+
+function onDragLeave() {
+    dragOverStatus.value = null
+}
+
+async function onDrop(newStatus: ClientTicketStatus) {
+    dragOverStatus.value = null
+    const ticket = draggedTicket.value
+    draggedTicket.value = null
+
+    if (!ticket || ticket.status === newStatus) return
+
+    // Rejected requires a comment
+    if (newStatus === 'rejected') {
+        pendingRejectTicket.value = ticket
+        rejectComment.value = ''
+        rejectModalOpen.value = true
+        return
+    }
+
+    // Optimistic update
+    const oldStatus = ticket.status
+    ticket.status = newStatus
+    try {
+        await clientTicketService.updateStatus(ticket.id, { status: newStatus })
+        await loadTickets()
+    } catch {
+        ticket.status = oldStatus
+    }
+}
+
+// Reject modal
+const rejectModalOpen = ref(false)
+const rejectComment = ref('')
+const pendingRejectTicket = ref<ClientTicket | null>(null)
+
+function cancelReject() {
+    rejectModalOpen.value = false
+    pendingRejectTicket.value = null
+    rejectComment.value = ''
+}
+
+async function confirmReject() {
+    const ticket = pendingRejectTicket.value
+    if (!ticket || !rejectComment.value.trim()) return
+
+    const oldStatus = ticket.status
+    ticket.status = 'rejected'
+    rejectModalOpen.value = false
+
+    try {
+        await clientTicketService.updateStatus(ticket.id, {
+            status: 'rejected',
+            statusComment: rejectComment.value.trim(),
+        })
+        await loadTickets()
+    } catch {
+        ticket.status = oldStatus
+    }
+
+    pendingRejectTicket.value = null
+    rejectComment.value = ''
+}

 function openDetail(ticket: ClientTicket) {
    selectedTicket.value = ticket
    detailOpen.value = true
 }

-async function loadTickets() {
+async function loadData() {
    isLoading.value = true
    try {
-        tickets.value = await clientTicketService.getAll({ project: projectId.value })
+        const [ticketList, project] = await Promise.all([
+            clientTicketService.getAll({ project: projectId.value }),
+            projectService.getById(projectId.value),
+        ])
+        tickets.value = ticketList
+        projectName.value = project.name
    } finally {
        isLoading.value = false
    }
 }

+async function loadTickets() {
+    tickets.value = await clientTicketService.getAll({ project: projectId.value })
+}
+
 onMounted(() => {
-    loadTickets()
+    loadData()
 })
 </script>
--- a/frontend/pages/profile.vue
+++ b/frontend/pages/profile.vue
@@ -0,0 +1,91 @@
+<template>
+    <div class="mx-auto max-w-lg px-4 py-10">
+        <h1 class="mb-8 text-2xl font-bold text-neutral-900">{{ $t('profile.title') }}</h1>
+
+        <div class="flex flex-col items-center gap-6 rounded-xl border border-neutral-200 bg-white p-8 shadow-sm">
+            <!-- Current avatar -->
+            <UserAvatar
+                v-if="auth.user"
+                :user="auth.user"
+                size="lg"
+            />
+
+            <p class="text-lg font-semibold text-neutral-800">{{ auth.user?.username }}</p>
+
+            <div class="flex gap-3">
+                <label
+                    class="cursor-pointer rounded-lg bg-primary-500 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-secondary-500"
+                >
+                    {{ $t('profile.changeAvatar') }}
+                    <input
+                        type="file"
+                        accept="image/jpeg,image/png,image/webp,image/gif"
+                        class="hidden"
+                        @change="onFileSelect"
+                    />
+                </label>
+
+                <button
+                    v-if="auth.user?.avatarUrl"
+                    type="button"
+                    class="rounded-lg border border-red-300 px-4 py-2 text-sm font-medium text-red-600 hover:bg-red-50"
+                    :disabled="removing"
+                    @click="onRemove"
+                >
+                    {{ $t('profile.removeAvatar') }}
+                </button>
+            </div>
+        </div>
+
+        <!-- Crop modal -->
+        <AvatarCropper
+            v-if="selectedFile"
+            :image-file="selectedFile"
+            @crop="onCrop"
+            @cancel="selectedFile = null"
+        />
+    </div>
+</template>
+
+<script setup lang="ts">
+import { useAvatarService } from '~/composables/useAvatarService'
+
+const auth = useAuthStore()
+const { upload, remove } = useAvatarService()
+
+const selectedFile = ref<File | null>(null)
+const removing = ref(false)
+
+function onFileSelect(event: Event) {
+    const input = event.target as HTMLInputElement
+    const file = input.files?.[0]
+    if (file) {
+        selectedFile.value = file
+    }
+    input.value = ''
+}
+
+async function onCrop(blob: Blob) {
+    selectedFile.value = null
+    if (!auth.user) return
+
+    try {
+        await upload(auth.user.id, blob)
+        await auth.refreshUser()
+    } catch {
+        // Upload error — $fetch will throw on non-2xx
+    }
+}
+
+async function onRemove() {
+    if (!auth.user) return
+    removing.value = true
+
+    try {
+        await remove(auth.user.id)
+        await auth.refreshUser()
+    } finally {
+        removing.value = false
+    }
+}
+</script>
--- a/frontend/pages/projects/[id]/archives.vue
+++ b/frontend/pages/projects/[id]/archives.vue
@@ -46,13 +46,11 @@
                        >
                            {{ task.group.title }}
                        </span>
-                        <span
+                        <UserAvatar
                            v-if="task.assignee"
-                            class="flex h-5 w-5 items-center justify-center rounded-full bg-primary-500 text-[10px] font-bold text-white"
-                            :title="task.assignee.username"
-                        >
-                            {{ task.assignee.username.substring(0, 2).toUpperCase() }}
-                        </span>
+                            :user="task.assignee"
+                            size="xs"
+                        />
                    </div>
                </div>
            </div>
@@ -130,7 +128,7 @@ const filteredTasks = computed(() => {
 async function loadData() {
    const [p, t, s, e, pr, ty, g, u] = await Promise.all([
        projectService.getById(projectId.value),
-        taskService.getByProjectArchived(projectId.value),
+        taskService.getByProject(projectId.value, true),
        statusService.getAll(),
        effortService.getAll(),
        priorityService.getAll(),
--- a/frontend/pages/projects/[id]/index.vue
+++ b/frontend/pages/projects/[id]/index.vue
@@ -3,13 +3,22 @@
        <div class="sticky top-8 z-20 bg-white pb-4 sm:top-12">
            <div class="flex items-center justify-between gap-3">
                <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">{{ project?.name ?? '' }}</h1>
-                <button
-                    class="shrink-0 rounded-md bg-primary-500 px-3 py-2 text-xs font-semibold text-white hover:bg-secondary-500 sm:px-4 sm:text-sm"
-                    @click="openTaskCreate"
-                >
-                    <span class="hidden sm:inline">+ Ajouter un ticket</span>
-                    <span class="sm:hidden">+ Ticket</span>
-                </button>
+                <div class="flex items-center gap-2">
+                    <button
+                        class="shrink-0 rounded-md bg-primary-500 px-3 py-2 text-xs font-semibold text-white hover:bg-secondary-500 sm:px-4 sm:text-sm"
+                        @click="openTaskCreate"
+                    >
+                        <span class="hidden sm:inline">+ Ajouter un ticket</span>
+                        <span class="sm:hidden">+ Ticket</span>
+                    </button>
+                    <button
+                        class="flex shrink-0 items-center rounded-md bg-neutral-200 px-3 py-2 text-neutral-600 hover:bg-neutral-300 sm:px-4"
+                        title="Paramètres du projet"
+                        @click="projectDrawerOpen = true"
+                    >
+                        <Icon name="heroicons:cog-6-tooth" class="size-4 sm:size-5" />
+                    </button>
+                </div>
            </div>

            <div class="mt-4 flex flex-wrap gap-3">
@@ -120,6 +129,13 @@
            @saved="onSaved"
        />

+        <ProjectDrawer
+            v-model="projectDrawerOpen"
+            :project="project"
+            :clients="clients"
+            @saved="onProjectSaved"
+        />
+
    </div>
 </template>

@@ -132,7 +148,9 @@ import type { TaskPriority } from '~/services/dto/task-priority'
 import type { TaskTag } from '~/services/dto/task-tag'
 import type { TaskGroup } from '~/services/dto/task-group'
 import type { UserData } from '~/services/dto/user-data'
+import type { Client } from '~/services/dto/client'
 import { useProjectService } from '~/services/projects'
+import { useClientService } from '~/services/clients'
 import { useTaskService } from '~/services/tasks'
 import { useTaskStatusService } from '~/services/task-statuses'
 import { useTaskEffortService } from '~/services/task-efforts'
@@ -147,6 +165,7 @@ const projectId = computed(() => Number(route.params.id))
 useHead({ title: 'Projet' })

 const projectService = useProjectService()
+const clientService = useClientService()
 const taskService = useTaskService()
 const statusService = useTaskStatusService()
 const effortService = useTaskEffortService()
@@ -163,6 +182,7 @@ const priorities = ref<TaskPriority[]>([])
 const tags = ref<TaskTag[]>([])
 const groups = ref<TaskGroup[]>([])
 const users = ref<UserData[]>([])
+const clients = ref<Client[]>([])
 const isLoading = ref(true)

 const selectedGroupId = ref<number | null>(null)
@@ -172,6 +192,7 @@ const selectedStatusId = ref<number | null>(null)
 const dragOverStatusId = ref<number | null>(null)
 const dragCounter = ref(0)
 const taskDrawerOpen = ref(false)
+const projectDrawerOpen = ref(false)
 const selectedTask = ref<Task | null>(null)

 const groupFilterOptions = computed(() =>
@@ -218,7 +239,7 @@ const backlogTasks = computed(() =>
 async function loadData() {
    isLoading.value = true
    try {
-        const [p, t, s, e, pr, ty, g, u] = await Promise.all([
+        const [p, t, s, e, pr, ty, g, u, c] = await Promise.all([
            projectService.getById(projectId.value),
            taskService.getByProject(projectId.value),
            statusService.getAll(),
@@ -227,6 +248,7 @@ async function loadData() {
            tagService.getAll(),
            groupService.getByProject(projectId.value),
            userService.getAll(),
+            clientService.getAll(),
        ])
        project.value = p
        tasks.value = t
@@ -236,6 +258,7 @@ async function loadData() {
        tags.value = ty
        groups.value = g
        users.value = u
+        clients.value = c
    } finally {
        isLoading.value = false
    }
@@ -290,6 +313,10 @@ async function onSaved() {
    await loadData()
 }

+async function onProjectSaved() {
+    await loadData()
+}
+
 onMounted(() => {
    loadData()
 })
--- a/frontend/pages/time-tracking.vue
+++ b/frontend/pages/time-tracking.vue
@@ -70,10 +70,12 @@
                        text-value="text-sm"
                    />
                </div>
+
+                <DateFilter v-model="selectedDateFilter" />
            </div>
        </div>

-        <div class="mt-4 -mb-24 min-h-0 flex-1">
+        <div class="relative z-0 mt-4 -mb-24 min-h-0 flex-1">
            <TimeEntryList
                v-if="viewMode === 'list'"
                :entries="filteredEntries"
@@ -136,6 +138,7 @@ const startDate = ref(getMonday(new Date()))
 const selectedUserId = ref<number | null>(authStore.user?.id ?? null)
 const selectedTagId = ref<number | null>(null)
 const selectedProjectId = ref<number | null>(null)
+const selectedDateFilter = ref<Date | [Date, Date] | null>(null)

 const entries = ref<TimeEntry[]>([])
 const users = ref<UserData[]>([])
@@ -281,24 +284,10 @@ async function onPaste() {
    await loadEntries()
 }

-onMounted(() => {
-    updatePageHeaderHeight()
-
-    if (!pageHeaderEl.value || typeof ResizeObserver === 'undefined') {
-        return
-    }
-
-    pageHeaderResizeObserver = new ResizeObserver(() => {
-        updatePageHeaderHeight()
-    })
-    pageHeaderResizeObserver.observe(pageHeaderEl.value)
-})
-
 onBeforeUnmount(() => {
    pageHeaderResizeObserver?.disconnect()
 })

-
 async function onDelete(entry: TimeEntry) {
    await timeEntryService.remove(entry.id)
    await loadEntries()
@@ -330,6 +319,15 @@ async function loadReferenceData() {
 }

 onMounted(async () => {
+    updatePageHeaderHeight()
+
+    if (pageHeaderEl.value && typeof ResizeObserver !== 'undefined') {
+        pageHeaderResizeObserver = new ResizeObserver(() => {
+            updatePageHeaderHeight()
+        })
+        pageHeaderResizeObserver.observe(pageHeaderEl.value)
+    }
+
    await loadReferenceData()
    await loadEntries()
 })
@@ -342,4 +340,16 @@ watch(viewMode, () => {
 watch(selectedUserId, () => {
    loadEntries()
 })
+
+watch(selectedDateFilter, (val) => {
+    if (!val) return
+    if (Array.isArray(val)) {
+        startDate.value = getMonday(val[0])
+        viewMode.value = 'week'
+    } else {
+        startDate.value = val
+        viewMode.value = 'day'
+    }
+    loadEntries()
+})
 </script>
--- a/frontend/services/auth.ts
+++ b/frontend/services/auth.ts
@@ -1,22 +1,22 @@
 import type { UserData } from './dto/user-data'

-export const getCurrentUser = () => {
-  const api = useApi()
-  return api.get<UserData>('/me', {}, { toastErrorKey: 'errors.auth.session' })
+export function getCurrentUser() {
+    const api = useApi()
+    return api.get<UserData>('/me', {}, { toastErrorKey: 'errors.auth.session' })
 }

-export const login = (username: string, password: string) => {
-  const api = useApi()
-  return api.post('/login_check', { username, password }, {
-    toastOn401: true,
-    toastErrorKey: 'errors.auth.login'
-  })
+export function login(username: string, password: string) {
+    const api = useApi()
+    return api.post('/login_check', { username, password }, {
+        toastOn401: true,
+        toastErrorKey: 'errors.auth.login'
+    })
 }

-export const logout = () => {
-  const api = useApi()
-  return api.post('/logout', {}, {
-    toastErrorKey: 'errors.auth.logout',
-    toastSuccessKey: 'success.auth.logout'
-  })
+export function logout() {
+    const api = useApi()
+    return api.post('/logout', {}, {
+        toastErrorKey: 'errors.auth.logout',
+        toastSuccessKey: 'success.auth.logout'
+    })
 }
--- a/frontend/services/client-tickets.ts
+++ b/frontend/services/client-tickets.ts
@@ -30,11 +30,17 @@ export function useClientTicketService() {
        })
    }

+    async function update(id: number, data: Partial<ClientTicketWrite>): Promise<ClientTicket> {
+        return api.patch<ClientTicket>(`/client_tickets/${id}`, data as Record<string, unknown>, {
+            toastSuccessKey: 'clientTicket.updated',
+        })
+    }
+
    async function remove(id: number): Promise<void> {
        await api.delete(`/client_tickets/${id}`, {}, {
            toastSuccessKey: 'clientTicket.deleted',
        })
    }

-    return { getAll, getById, create, updateStatus, remove }
+    return { getAll, getById, create, update, updateStatus, remove }
 }
--- a/frontend/services/dto/task.ts
+++ b/frontend/services/dto/task.ts
@@ -42,4 +42,5 @@ export type TaskWrite = {
    project: string
    tags: string[]
    archived?: boolean
+    clientTicket?: string | null
 }
--- a/frontend/services/dto/user-data.ts
+++ b/frontend/services/dto/user-data.ts
@@ -7,6 +7,7 @@ export type UserData = {
    roles: string[]
    client?: { id: number; name: string } | null
    allowedProjects?: Project[]
+    avatarUrl?: string | null
 }

 export type UserWrite = {
--- a/frontend/services/task-documents.ts
+++ b/frontend/services/task-documents.ts
@@ -15,30 +15,24 @@ export function useTaskDocumentService() {
        return extractHydraMembers(data)
    }

-    async function upload(taskId: number, file: File): Promise<TaskDocument> {
+    async function uploadWithRelation(relationField: string, relationIri: string, file: File): Promise<TaskDocument> {
        const formData = new FormData()
        formData.append('file', file)
-        formData.append('task', `/api/tasks/${taskId}`)
+        formData.append(relationField, relationIri)

-        return await $fetch<TaskDocument>(`${baseURL}/task_documents`, {
+        return $fetch<TaskDocument>(`${baseURL}/task_documents`, {
            method: 'POST',
            body: formData,
            credentials: 'include',
-            // Do NOT set Content-Type — browser sets multipart boundary automatically
        })
    }

-    async function uploadForTicket(clientTicketId: number, file: File): Promise<TaskDocument> {
-        const formData = new FormData()
-        formData.append('file', file)
-        formData.append('clientTicket', `/api/client_tickets/${clientTicketId}`)
+    async function upload(taskId: number, file: File): Promise<TaskDocument> {
+        return uploadWithRelation('task', `/api/tasks/${taskId}`, file)
+    }

-        return await $fetch<TaskDocument>(`${baseURL}/task_documents`, {
-            method: 'POST',
-            body: formData,
-            credentials: 'include',
-            // Do NOT set Content-Type — browser sets multipart boundary automatically
-        })
+    async function uploadForTicket(clientTicketId: number, file: File): Promise<TaskDocument> {
+        return uploadWithRelation('clientTicket', `/api/client_tickets/${clientTicketId}`, file)
    }

    async function getByTicket(clientTicketId: number): Promise<TaskDocument[]> {
--- a/frontend/services/tasks.ts
+++ b/frontend/services/tasks.ts
@@ -10,18 +10,10 @@ export function useTaskService() {
        return extractHydraMembers(data)
    }

-    async function getByProject(projectId: number): Promise<Task[]> {
+    async function getByProject(projectId: number, archived = false): Promise<Task[]> {
        const data = await api.get<HydraCollection<Task>>('/tasks', {
            project: `/api/projects/${projectId}`,
-            archived: false,
-        })
-        return extractHydraMembers(data)
-    }
-
-    async function getByProjectArchived(projectId: number): Promise<Task[]> {
-        const data = await api.get<HydraCollection<Task>>('/tasks', {
-            project: `/api/projects/${projectId}`,
-            archived: true,
+            archived,
        })
        return extractHydraMembers(data)
    }
@@ -49,5 +41,5 @@ export function useTaskService() {
        })
    }

-    return { getAll, getByProject, getByProjectArchived, getFiltered, create, update, remove }
+    return { getAll, getByProject, getFiltered, create, update, remove }
 }
--- a/frontend/stores/auth.ts
+++ b/frontend/stores/auth.ts
@@ -58,6 +58,14 @@ export const useAuthStore = defineStore('auth', {
                this.checked = true
                this.isLoading = false
            }
+        },
+        async refreshUser() {
+            try {
+                const me = await getCurrentUser()
+                this.user = me
+            } catch {
+                // Silently fail — user session might have expired
+            }
        }
    }
 })
--- a/frontend/stores/timer.ts
+++ b/frontend/stores/timer.ts
@@ -66,6 +66,11 @@ export const useTimerStore = defineStore('timer', () => {
        startTicking()
    }

+    function toIri<T extends { '@id'?: string; id: number }>(entity: T | string, prefix: string): string {
+        if (typeof entity === 'string') return entity
+        return entity['@id'] ?? `${prefix}/${entity.id}`
+    }
+
    async function startFromTask(task: Task) {
        const authStore = useAuthStore()
        if (!authStore.user) return
@@ -79,11 +84,9 @@ export const useTimerStore = defineStore('timer', () => {
            startedAt: new Date().toISOString(),
            user: `/api/users/${authStore.user.id}`,
            title: task.title,
-            project: task.project
-                ? (typeof task.project === 'string' ? task.project : (task.project['@id'] ?? (task.project.id ? `/api/projects/${task.project.id}` : null)))
-                : null,
-            task: typeof task === 'string' ? task : (task['@id'] ?? `/api/tasks/${task.id}`),
-            tags: task.tags?.map((t) => typeof t === 'string' ? t : (t['@id'] ?? `/api/task_tags/${t.id}`)) ?? [],
+            project: task.project ? toIri(task.project, '/api/projects') : null,
+            task: toIri(task, '/api/tasks'),
+            tags: task.tags?.map(t => toIri(t, '/api/task_tags')) ?? [],
        })
        startTicking()
    }
--- a/frontend/utils/format.ts
+++ b/frontend/utils/format.ts
@@ -0,0 +1,5 @@
+export function formatFileSize(bytes: number): string {
+    if (bytes < 1024) return `${bytes} o`
+    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(0)} Ko`
+    return `${(bytes / (1024 * 1024)).toFixed(1)} Mo`
+}
--- a/migrations/Version20260315205331.php
+++ b/migrations/Version20260315205331.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260315205331 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE "user" ADD avatar_file_name VARCHAR(255) DEFAULT NULL');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE "user" DROP avatar_file_name');
+    }
+}
--- a/migrations/Version20260315210619.php
+++ b/migrations/Version20260315210619.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260315210619 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('CREATE UNIQUE INDEX uniq_task_project_number ON task (project_id, number)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX uniq_task_project_number');
+    }
+}
--- a/migrations/Version20260316124157.php
+++ b/migrations/Version20260316124157.php
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/**
+ * Auto-generated Migration: Please modify to your needs!
+ */
+final class Version20260316124157 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return '';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE time_entry ADD client_ticket_id INT DEFAULT NULL');
+        $this->addSql('ALTER TABLE time_entry ADD CONSTRAINT FK_6E537C0C9B2097DD FOREIGN KEY (client_ticket_id) REFERENCES client_ticket (id) ON DELETE SET NULL NOT DEFERRABLE');
+        $this->addSql('CREATE INDEX IDX_6E537C0C9B2097DD ON time_entry (client_ticket_id)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE time_entry DROP CONSTRAINT FK_6E537C0C9B2097DD');
+        $this->addSql('DROP INDEX IDX_6E537C0C9B2097DD');
+        $this->addSql('ALTER TABLE time_entry DROP client_ticket_id');
+    }
+}
--- a/script/deploy-release.sh
+++ b/script/deploy-release.sh
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Usage: ./script/deploy-release.sh v0.1.0
+# Requires: curl, tar, (optional) rsync
+#
+# Auth token: set RELEASE_TOKEN env var or create /etc/lesstime-release-token
+umask 002
+
+TAG="${1:-}"
+if [ -z "$TAG" ]; then
+  echo "Usage: $0 v0.1.0" >&2
+  exit 1
+fi
+
+REPO_OWNER="MALIO-DEV"
+REPO_NAME="Lesstime"
+GITEA_API="https://gitea.malio.fr/api/v1"
+DEPLOY_DIR="/var/www/lesstime"
+
+if [ -f /etc/lesstime-release-token ] && [ -z "${RELEASE_TOKEN:-}" ]; then
+  RELEASE_TOKEN="$(cat /etc/lesstime-release-token)"
+fi
+
+tmp_dir="$(mktemp -d)"
+cleanup() {
+  rm -rf "$tmp_dir"
+}
+trap cleanup EXIT
+
+release_json="$tmp_dir/release.json"
+curl_opts=(-sS)
+if [ -n "${RELEASE_TOKEN:-}" ]; then
+  curl_opts+=(-H "Authorization: token ${RELEASE_TOKEN}")
+fi
+curl "${curl_opts[@]}" \
+  "${GITEA_API}/repos/${REPO_OWNER}/${REPO_NAME}/releases/tags/${TAG}" \
+  -o "$release_json"
+
+asset_url="$(python3 - "$release_json" <<'PY'
+import json, sys
+data = json.load(open(sys.argv[1], 'r'))
+assets = data.get("assets", [])
+for a in assets:
+    name = a.get("name", "")
+    if name.startswith("lesstime-") and name.endswith(".tar.gz"):
+        print(a.get("browser_download_url", ""))
+        break
+PY
+)"
+
+if [ -z "$asset_url" ]; then
+  echo "Release asset not found for tag ${TAG}" >&2
+  exit 1
+fi
+
+archive="$tmp_dir/artefact.tar.gz"
+curl "${curl_opts[@]}" -L "$asset_url" -o "$archive"
+
+tar -xzf "$archive" -C "$tmp_dir"
+
+if command -v rsync >/dev/null 2>&1; then
+  rsync -a --delete --no-perms --no-owner --no-group \
+    --exclude ".env" \
+    --exclude ".env.local" \
+    --exclude "config/jwt" \
+    --exclude "var" \
+    "$tmp_dir"/ "$DEPLOY_DIR"/
+else
+  cp -a "$tmp_dir"/. "$DEPLOY_DIR"/
+fi
+
+# Ensure Nginx can traverse the deploy path.
+chmod o+rx "$(dirname "$DEPLOY_DIR")" "$DEPLOY_DIR" 2>/dev/null || true
+
+# Create frontend/dist symlink if needed (nginx serves from frontend/dist)
+if [ -d "${DEPLOY_DIR}/frontend/.output/public" ] && [ ! -L "${DEPLOY_DIR}/frontend/dist" ]; then
+  ln -sfn "${DEPLOY_DIR}/frontend/.output/public" "${DEPLOY_DIR}/frontend/dist"
+fi
+
+echo "Release ${TAG} deployed to ${DEPLOY_DIR}"
+
+if [ -f "${DEPLOY_DIR}/.env.local" ]; then
+  echo "Clearing cache..."
+  php "${DEPLOY_DIR}/bin/console" cache:clear --env=prod --no-debug
+
+  echo "Running migrations (if any)..."
+  php "${DEPLOY_DIR}/bin/console" doctrine:migrations:migrate --no-interaction --env=prod
+else
+  echo "Skip post-deploy: ${DEPLOY_DIR}/.env.local not found" >&2
+fi
--- a/src/Controller/TaskDocumentDownloadController.php
+++ b/src/Controller/TaskDocumentDownloadController.php
@@ -7,8 +7,10 @@ namespace App\Controller;
 use App\Entity\TaskDocument;
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
@@ -17,11 +19,12 @@ class TaskDocumentDownloadController extends AbstractController
 {
    public function __construct(
        private readonly EntityManagerInterface $entityManager,
+        private readonly Security $security,
        private readonly string $uploadDir,
    ) {}

-    #[Route('/api/task_documents/{id}/download', name: 'task_document_download', methods: ['GET'])]
-    #[IsGranted('ROLE_USER')]
+    #[Route('/api/task_documents/{id}/download', name: 'task_document_download', methods: ['GET'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
    public function __invoke(int $id): BinaryFileResponse
    {
        $document = $this->entityManager->getRepository(TaskDocument::class)->find($id);
@@ -30,6 +33,14 @@ class TaskDocumentDownloadController extends AbstractController
            throw new NotFoundHttpException('Document not found.');
        }

+        // ROLE_CLIENT can only download documents from their own tickets
+        if (!$this->security->isGranted('ROLE_ADMIN') && !$this->security->isGranted('ROLE_USER')) {
+            $ticket = $document->getClientTicket();
+            if (null === $ticket || $ticket->getSubmittedBy() !== $this->security->getUser()) {
+                throw new AccessDeniedHttpException('You do not have access to this document.');
+            }
+        }
+
        $filePath = $this->uploadDir.'/'.$document->getFileName();

        if (!file_exists($filePath)) {
--- a/src/Controller/UserAvatarController.php
+++ b/src/Controller/UserAvatarController.php
@@ -0,0 +1,145 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use App\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Component\Uid\Uuid;
+
+class UserAvatarController extends AbstractController
+{
+    private const MAX_FILE_SIZE      = 5 * 1024 * 1024; // 5 MB
+    private const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/webp', 'image/gif'];
+
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly string $avatarUploadDir,
+    ) {}
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_upload', methods: ['POST'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function upload(int $id, Request $request): JsonResponse
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $file = $request->files->get('file');
+
+        if (null === $file || !$file->isValid()) {
+            throw new BadRequestHttpException('No valid file uploaded.');
+        }
+
+        if ($file->getSize() > self::MAX_FILE_SIZE) {
+            throw new BadRequestHttpException('File size exceeds 5 MB limit.');
+        }
+
+        $mimeType = $file->getMimeType();
+
+        if (!in_array($mimeType, self::ALLOWED_MIME_TYPES, true)) {
+            throw new BadRequestHttpException('Invalid file type. Allowed: JPEG, PNG, WebP, GIF.');
+        }
+
+        // Delete previous avatar file if exists
+        $this->deleteAvatarFile($user);
+
+        $extension = $file->guessExtension() ?? 'bin';
+        $fileName  = Uuid::v4()->toRfc4122().'.'.$extension;
+
+        if (!is_dir($this->avatarUploadDir)) {
+            mkdir($this->avatarUploadDir, 0o775, true);
+        }
+
+        $file->move($this->avatarUploadDir, $fileName);
+
+        $user->setAvatarFileName($fileName);
+        $this->entityManager->flush();
+
+        return new JsonResponse(['avatarUrl' => $user->getAvatarUrl()]);
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_serve', methods: ['GET'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function serve(int $id): BinaryFileResponse
+    {
+        $user = $this->findUserOrFail($id);
+
+        if (null === $user->getAvatarFileName()) {
+            throw new NotFoundHttpException('No avatar set.');
+        }
+
+        $filePath = $this->avatarUploadDir.'/'.$user->getAvatarFileName();
+
+        if (!file_exists($filePath)) {
+            throw new NotFoundHttpException('Avatar file not found on disk.');
+        }
+
+        $response = new BinaryFileResponse($filePath);
+        $response->setContentDisposition(ResponseHeaderBag::DISPOSITION_INLINE, $user->getAvatarFileName());
+        $extension = pathinfo($user->getAvatarFileName(), PATHINFO_EXTENSION);
+        $mimeMap   = ['jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png', 'webp' => 'image/webp', 'gif' => 'image/gif'];
+        $response->headers->set('Content-Type', $mimeMap[$extension] ?? 'application/octet-stream');
+        $response->headers->set('Cache-Control', 'no-cache, must-revalidate');
+
+        return $response;
+    }
+
+    #[Route('/api/users/{id}/avatar', name: 'user_avatar_delete', methods: ['DELETE'], priority: 1)]
+    #[IsGranted('IS_AUTHENTICATED_FULLY')]
+    public function delete(int $id): Response
+    {
+        $user = $this->findUserOrFail($id);
+        $this->assertCanManageAvatar($user);
+
+        $this->deleteAvatarFile($user);
+        $user->setAvatarFileName(null);
+        $this->entityManager->flush();
+
+        return new Response(null, Response::HTTP_NO_CONTENT);
+    }
+
+    private function findUserOrFail(int $id): User
+    {
+        $user = $this->entityManager->getRepository(User::class)->find($id);
+
+        if (null === $user) {
+            throw new NotFoundHttpException('User not found.');
+        }
+
+        return $user;
+    }
+
+    private function assertCanManageAvatar(User $user): void
+    {
+        $currentUser = $this->getUser();
+
+        if ($currentUser !== $user && !$this->isGranted('ROLE_ADMIN')) {
+            throw new AccessDeniedHttpException('You can only manage your own avatar.');
+        }
+    }
+
+    private function deleteAvatarFile(User $user): void
+    {
+        if (null === $user->getAvatarFileName()) {
+            return;
+        }
+
+        $filePath = $this->avatarUploadDir.'/'.$user->getAvatarFileName();
+
+        if (file_exists($filePath)) {
+            unlink($filePath);
+        }
+    }
+}
--- a/src/DataFixtures/AppFixtures.php
+++ b/src/DataFixtures/AppFixtures.php
@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\DataFixtures;

 use App\Entity\Client;
+use App\Entity\ClientTicket;
 use App\Entity\Project;
 use App\Entity\Task;
 use App\Entity\TaskEffort;
@@ -28,7 +29,7 @@ class AppFixtures extends Fixture

    public function load(ObjectManager $manager): void
    {
-        // User admin
+        // Users
        $admin = new User();
        $admin->setUsername('admin');
        $admin->setRoles(['ROLE_ADMIN']);
@@ -36,6 +37,24 @@ class AppFixtures extends Fixture
        $admin->setApiToken('dev-mcp-token-for-testing-only-do-not-use-in-production');
        $manager->persist($admin);

+        $userAlice = new User();
+        $userAlice->setUsername('alice');
+        $userAlice->setRoles(['ROLE_USER']);
+        $userAlice->setPassword($this->passwordHasher->hashPassword($userAlice, 'alice'));
+        $manager->persist($userAlice);
+
+        $userBob = new User();
+        $userBob->setUsername('bob');
+        $userBob->setRoles(['ROLE_USER']);
+        $userBob->setPassword($this->passwordHasher->hashPassword($userBob, 'bob'));
+        $manager->persist($userBob);
+
+        $userCharlie = new User();
+        $userCharlie->setUsername('charlie');
+        $userCharlie->setRoles(['ROLE_USER']);
+        $userCharlie->setPassword($this->passwordHasher->hashPassword($userCharlie, 'charlie'));
+        $manager->persist($userCharlie);
+
        // Clients
        $clientLiot = new Client();
        $clientLiot->setName('LIOT');
@@ -251,7 +270,7 @@ class AppFixtures extends Fixture
        $task2->setStatus($statusTodo);
        $task2->setEffort($effortL);
        $task2->setPriority($priorityHigh);
-        $task2->setAssignee($admin);
+        $task2->setAssignee($userAlice);
        $task2->setGroup($groupFrontend);
        $task2->setProject($projectSirh);
        $task2->addTag($tagAuth);
@@ -275,7 +294,7 @@ class AppFixtures extends Fixture
        $task4->setStatus($statusBlocked);
        $task4->setEffort($effortXXL);
        $task4->setPriority($priorityLow);
-        $task4->setAssignee($admin);
+        $task4->setAssignee($userBob);
        $task4->setProject($projectSirh);
        $task4->addTag($tagPassword);
        $manager->persist($task4);
@@ -286,7 +305,7 @@ class AppFixtures extends Fixture
        $task5->setStatus($statusReview);
        $task5->setEffort($effortXXL);
        $task5->setPriority($priorityMedium);
-        $task5->setAssignee($admin);
+        $task5->setAssignee($userCharlie);
        $task5->setProject($projectSirh);
        $task5->addTag($tagCalendar);
        $manager->persist($task5);
@@ -322,7 +341,7 @@ class AppFixtures extends Fixture
        $taskCrm2->setStatus($statusInProgress);
        $taskCrm2->setEffort($effortM);
        $taskCrm2->setPriority($priorityMedium);
-        $taskCrm2->setAssignee($admin);
+        $taskCrm2->setAssignee($userAlice);
        $taskCrm2->setGroup($groupCrmUi);
        $taskCrm2->setProject($projectCrm);
        $manager->persist($taskCrm2);
@@ -344,7 +363,7 @@ class AppFixtures extends Fixture
        $taskCrm4->setStatus($statusInProgress);
        $taskCrm4->setEffort($effortXXL);
        $taskCrm4->setPriority($priorityHigh);
-        $taskCrm4->setAssignee($admin);
+        $taskCrm4->setAssignee($userBob);
        $taskCrm4->setGroup($groupCrmUi);
        $taskCrm4->setProject($projectCrm);
        $taskCrm4->addTag($tagCalendar);
@@ -381,7 +400,7 @@ class AppFixtures extends Fixture
        $taskErp2->setStatus($statusInProgress);
        $taskErp2->setEffort($effortM);
        $taskErp2->setPriority($priorityHigh);
-        $taskErp2->setAssignee($admin);
+        $taskErp2->setAssignee($userCharlie);
        $taskErp2->setGroup($groupErpStock);
        $taskErp2->setProject($projectErp);
        $manager->persist($taskErp2);
@@ -451,7 +470,7 @@ class AppFixtures extends Fixture
        $taskSite2->setStatus($statusInProgress);
        $taskSite2->setEffort($effortL);
        $taskSite2->setPriority($priorityMedium);
-        $taskSite2->setAssignee($admin);
+        $taskSite2->setAssignee($userAlice);
        $taskSite2->setGroup($groupSiteDesign);
        $taskSite2->setProject($projectInterne);
        $manager->persist($taskSite2);
@@ -543,6 +562,94 @@ class AppFixtures extends Fixture
            $manager->persist($entry);
        }

+        // =============================================
+        // Client Users
+        // =============================================
+        $clientUserLiot = new User();
+        $clientUserLiot->setUsername('client-liot');
+        $clientUserLiot->setRoles(['ROLE_CLIENT']);
+        $clientUserLiot->setPassword($this->passwordHasher->hashPassword($clientUserLiot, 'client'));
+        $clientUserLiot->setClient($clientLiot);
+        $clientUserLiot->addAllowedProject($projectSirh);
+        $manager->persist($clientUserLiot);
+
+        $clientUserAcme = new User();
+        $clientUserAcme->setUsername('client-acme');
+        $clientUserAcme->setRoles(['ROLE_CLIENT']);
+        $clientUserAcme->setPassword($this->passwordHasher->hashPassword($clientUserAcme, 'client'));
+        $clientUserAcme->setClient($clientAcme);
+        $clientUserAcme->addAllowedProject($projectCrm);
+        $manager->persist($clientUserAcme);
+
+        // =============================================
+        // Client Tickets
+        // =============================================
+        $ticket1 = new ClientTicket();
+        $ticket1->setNumber(1);
+        $ticket1->setType('bug');
+        $ticket1->setTitle('Erreur 500 sur la page de login');
+        $ticket1->setDescription('Quand je clique sur "Se connecter" avec un mot de passe vide, j\'obtiens une page blanche avec une erreur 500.');
+        $ticket1->setUrl('https://sirh.liot.fr/login');
+        $ticket1->setStatus('new');
+        $ticket1->setProject($projectSirh);
+        $ticket1->setSubmittedBy($clientUserLiot);
+        $ticket1->setCreatedAt(new DateTimeImmutable('-3 days'));
+        $ticket1->setUpdatedAt(new DateTimeImmutable('-3 days'));
+        $manager->persist($ticket1);
+
+        $ticket2 = new ClientTicket();
+        $ticket2->setNumber(2);
+        $ticket2->setType('improvement');
+        $ticket2->setTitle('Ajouter un export PDF des fiches employés');
+        $ticket2->setDescription('Il serait utile de pouvoir exporter les fiches employés au format PDF pour les archiver.');
+        $ticket2->setStatus('in_progress');
+        $ticket2->setProject($projectSirh);
+        $ticket2->setSubmittedBy($clientUserLiot);
+        $ticket2->setCreatedAt(new DateTimeImmutable('-7 days'));
+        $ticket2->setUpdatedAt(new DateTimeImmutable('-2 days'));
+        $manager->persist($ticket2);
+
+        $ticket3 = new ClientTicket();
+        $ticket3->setNumber(3);
+        $ticket3->setType('other');
+        $ticket3->setTitle('Demande de formation sur le module congés');
+        $ticket3->setDescription('Notre équipe RH souhaiterait une formation sur le nouveau module de gestion des congés.');
+        $ticket3->setStatus('done');
+        $ticket3->setStatusComment('Formation planifiée le 20/03. Ticket clos.');
+        $ticket3->setProject($projectSirh);
+        $ticket3->setSubmittedBy($clientUserLiot);
+        $ticket3->setCreatedAt(new DateTimeImmutable('-14 days'));
+        $ticket3->setUpdatedAt(new DateTimeImmutable('-5 days'));
+        $manager->persist($ticket3);
+
+        $ticket4 = new ClientTicket();
+        $ticket4->setNumber(1);
+        $ticket4->setType('bug');
+        $ticket4->setTitle('Doublons dans la liste des contacts');
+        $ticket4->setDescription('Certains contacts apparaissent en double après l\'import CSV. Le problème semble lié aux accents dans les noms.');
+        $ticket4->setStatus('new');
+        $ticket4->setProject($projectCrm);
+        $ticket4->setSubmittedBy($clientUserAcme);
+        $ticket4->setCreatedAt(new DateTimeImmutable('-1 day'));
+        $ticket4->setUpdatedAt(new DateTimeImmutable('-1 day'));
+        $manager->persist($ticket4);
+
+        $ticket5 = new ClientTicket();
+        $ticket5->setNumber(2);
+        $ticket5->setType('improvement');
+        $ticket5->setTitle('Filtre par date sur le pipeline de vente');
+        $ticket5->setDescription('Pouvoir filtrer le pipeline de vente par période (mois, trimestre, année).');
+        $ticket5->setStatus('rejected');
+        $ticket5->setStatusComment('Cette fonctionnalité est déjà prévue dans la prochaine version. Pas besoin de ticket spécifique.');
+        $ticket5->setProject($projectCrm);
+        $ticket5->setSubmittedBy($clientUserAcme);
+        $ticket5->setCreatedAt(new DateTimeImmutable('-10 days'));
+        $ticket5->setUpdatedAt(new DateTimeImmutable('-8 days'));
+        $manager->persist($ticket5);
+
+        // Link a task to a client ticket
+        $task3->setClientTicket($ticket1);
+
        $manager->flush();
    }
 }
--- a/src/Entity/ClientTicket.php
+++ b/src/Entity/ClientTicket.php
@@ -36,7 +36,7 @@ use Symfony\Component\Serializer\Attribute\Groups;
            processor: ClientTicketNumberProcessor::class,
        ),
        new Patch(
-            security: "is_granted('ROLE_ADMIN')",
+            security: "is_granted('ROLE_ADMIN') or (is_granted('ROLE_CLIENT') and object.getSubmittedBy() == user)",
            processor: ClientTicketStatusProcessor::class,
        ),
        new Delete(security: "is_granted('ROLE_ADMIN')"),
--- a/src/Entity/Project.php
+++ b/src/Entity/Project.php
@@ -20,8 +20,8 @@ use Symfony\Component\Validator\Constraints as Assert;

 #[ApiResource(
    operations: [
-        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Get(security: "is_granted('ROLE_USER')"),
+        new GetCollection(security: "is_granted('ROLE_USER') or is_granted('ROLE_CLIENT')"),
+        new Get(security: "is_granted('ROLE_USER') or is_granted('ROLE_CLIENT')"),
        new Post(
            security: "is_granted('ROLE_ADMIN')",
            denormalizationContext: ['groups' => ['project:write', 'project:create']],
@@ -41,7 +41,7 @@ class Project
    #[ORM\Id]
    #[ORM\GeneratedValue]
    #[ORM\Column]
-    #[Groups(['project:read', 'time_entry:read', 'task:read'])]
+    #[Groups(['project:read', 'time_entry:read', 'task:read', 'me:read'])]
    private ?int $id = null;

    #[ORM\Column(length: 10, unique: true)]
@@ -51,7 +51,7 @@ class Project
    private ?string $code = null;

    #[ORM\Column(length: 255)]
-    #[Groups(['project:read', 'project:write', 'time_entry:read', 'task:read'])]
+    #[Groups(['project:read', 'project:write', 'time_entry:read', 'task:read', 'me:read'])]
    private ?string $name = null;

    #[ORM\Column(type: 'text', nullable: true)]
--- a/src/Entity/Task.php
+++ b/src/Entity/Task.php
@@ -35,6 +35,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 #[ApiFilter(SearchFilter::class, properties: ['project' => 'exact', 'group' => 'exact', 'assignee' => 'exact', 'priority' => 'exact', 'effort' => 'exact', 'tags' => 'exact', 'status' => 'exact'])]
 #[ApiFilter(BooleanFilter::class, properties: ['archived'])]
 #[ORM\Entity(repositoryClass: TaskRepository::class)]
+#[ORM\Table(name: 'task')]
+#[ORM\UniqueConstraint(name: 'uniq_task_project_number', columns: ['project_id', 'number'])]
 class Task
 {
    #[ORM\Id]
--- a/src/Entity/TimeEntry.php
+++ b/src/Entity/TimeEntry.php
@@ -85,6 +85,11 @@ class TimeEntry
    #[Groups(['time_entry:read', 'time_entry:write'])]
    private ?Task $task = null;

+    #[ORM\ManyToOne(targetEntity: ClientTicket::class)]
+    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
+    #[Groups(['time_entry:read', 'time_entry:write'])]
+    private ?ClientTicket $clientTicket = null;
+
    /** @var Collection<int, TaskTag> */
    #[ORM\ManyToMany(targetEntity: TaskTag::class)]
    #[ORM\JoinTable(
@@ -189,6 +194,18 @@ class TimeEntry
        return $this;
    }

+    public function getClientTicket(): ?ClientTicket
+    {
+        return $this->clientTicket;
+    }
+
+    public function setClientTicket(?ClientTicket $clientTicket): static
+    {
+        $this->clientTicket = $clientTicket;
+
+        return $this;
+    }
+
    /** @return Collection<int, TaskTag> */
    public function getTags(): Collection
    {
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -70,6 +70,9 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
    #[ORM\Column(length: 64, unique: true, nullable: true)]
    private ?string $apiToken = null;

+    #[ORM\Column(length: 255, nullable: true)]
+    private ?string $avatarFileName = null;
+
    #[ORM\ManyToOne(targetEntity: Client::class)]
    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
    #[Groups(['me:read', 'user:list', 'user:write'])]
@@ -199,5 +202,27 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
        return $this;
    }

+    public function getAvatarFileName(): ?string
+    {
+        return $this->avatarFileName;
+    }
+
+    public function setAvatarFileName(?string $avatarFileName): static
+    {
+        $this->avatarFileName = $avatarFileName;
+
+        return $this;
+    }
+
+    #[Groups(['me:read', 'task:read', 'user:list', 'time_entry:read', 'client_ticket:read'])]
+    public function getAvatarUrl(): ?string
+    {
+        if (null === $this->avatarFileName) {
+            return null;
+        }
+
+        return '/api/users/'.$this->id.'/avatar';
+    }
+
    public function eraseCredentials(): void {}
 }
--- a/src/Exception/BookStackApiException.php
+++ b/src/Exception/BookStackApiException.php
@@ -5,12 +5,5 @@ declare(strict_types=1);
 namespace App\Exception;

 use RuntimeException;
-use Throwable;

-final class BookStackApiException extends RuntimeException
-{
-    public function __construct(string $message, int $code = 0, ?Throwable $previous = null)
-    {
-        parent::__construct($message, $code, $previous);
-    }
-}
+final class BookStackApiException extends RuntimeException {}
--- a/src/Exception/GiteaApiException.php
+++ b/src/Exception/GiteaApiException.php
@@ -5,12 +5,5 @@ declare(strict_types=1);
 namespace App\Exception;

 use RuntimeException;
-use Throwable;

-final class GiteaApiException extends RuntimeException
-{
-    public function __construct(string $message, int $code = 0, ?Throwable $previous = null)
-    {
-        parent::__construct($message, $code, $previous);
-    }
-}
+final class GiteaApiException extends RuntimeException {}
--- a/src/Mcp/Tool/Project/CreateProjectTool.php
+++ b/src/Mcp/Tool/Project/CreateProjectTool.php
@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\Project;

 use App\Entity\Project;
+use App\Mcp\Tool\Serializer;
 use App\Repository\ClientRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
@@ -48,17 +49,6 @@ class CreateProjectTool
        $this->entityManager->persist($project);
        $this->entityManager->flush();

-        return json_encode([
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived' => $project->isArchived(),
-        ]);
+        return json_encode(Serializer::project($project));
    }
 }
--- a/src/Mcp/Tool/Project/GetProjectTool.php
+++ b/src/Mcp/Tool/Project/GetProjectTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Project;

+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use InvalidArgumentException;
@@ -45,17 +46,7 @@ class GetProjectTool
            $totalTasks += $count;
        }

-        return json_encode([
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived'    => $project->isArchived(),
+        return json_encode(Serializer::project($project) + [
            'taskSummary' => $statusCounts,
            'totalTasks'  => $totalTasks,
        ]);
--- a/src/Mcp/Tool/Project/ListProjectsTool.php
+++ b/src/Mcp/Tool/Project/ListProjectsTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Project;

+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use Mcp\Capability\Attribute\McpTool;

@@ -18,17 +19,6 @@ class ListProjectsTool
    {
        $projects = $this->projectRepository->findBy(['archived' => $archived], ['name' => 'ASC']);

-        return json_encode(array_map(fn ($project) => [
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived' => $project->isArchived(),
-        ], $projects));
+        return json_encode(array_map(Serializer::project(...), $projects));
    }
 }
--- a/src/Mcp/Tool/Project/UpdateProjectTool.php
+++ b/src/Mcp/Tool/Project/UpdateProjectTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Project;

+use App\Mcp\Tool\Serializer;
 use App\Repository\ClientRepository;
 use App\Repository\ProjectRepository;
 use Doctrine\ORM\EntityManagerInterface;
@@ -61,17 +62,6 @@ class UpdateProjectTool

        $this->entityManager->flush();

-        return json_encode([
-            'id'          => $project->getId(),
-            'code'        => $project->getCode(),
-            'name'        => $project->getName(),
-            'description' => $project->getDescription(),
-            'color'       => $project->getColor(),
-            'client'      => $project->getClient() ? [
-                'id'   => $project->getClient()->getId(),
-                'name' => $project->getClient()->getName(),
-            ] : null,
-            'archived' => $project->isArchived(),
-        ]);
+        return json_encode(Serializer::project($project));
    }
 }
--- a/src/Mcp/Tool/Serializer.php
+++ b/src/Mcp/Tool/Serializer.php
@@ -0,0 +1,295 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mcp\Tool;
+
+use App\Entity\ClientTicket;
+use App\Entity\Project;
+use App\Entity\Task;
+use App\Entity\TaskDocument;
+use App\Entity\TaskEffort;
+use App\Entity\TaskGroup;
+use App\Entity\TaskPriority;
+use App\Entity\TaskStatus;
+use App\Entity\TaskTag;
+use App\Entity\TimeEntry;
+use App\Entity\User;
+use Doctrine\Common\Collections\Collection;
+
+/**
+ * Shared serialization helpers for MCP tools.
+ *
+ * Keeps JSON output consistent across all tools.
+ */
+final class Serializer
+{
+    /**
+     * @return array{id: ?int, code: ?string, name: ?string}
+     */
+    public static function projectRef(Project $project): array
+    {
+        return [
+            'id'   => $project->getId(),
+            'code' => $project->getCode(),
+            'name' => $project->getName(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function project(Project $project): array
+    {
+        return [
+            'id'          => $project->getId(),
+            'code'        => $project->getCode(),
+            'name'        => $project->getName(),
+            'description' => $project->getDescription(),
+            'color'       => $project->getColor(),
+            'client'      => $project->getClient() ? [
+                'id'   => $project->getClient()->getId(),
+                'name' => $project->getClient()->getName(),
+            ] : null,
+            'archived' => $project->isArchived(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string, color: ?string}
+     */
+    public static function status(?TaskStatus $status): ?array
+    {
+        if (null === $status) {
+            return null;
+        }
+
+        return [
+            'id'    => $status->getId(),
+            'label' => $status->getLabel(),
+            'color' => $status->getColor(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string, color: ?string, isFinal: bool}
+     */
+    public static function statusFull(?TaskStatus $status): ?array
+    {
+        if (null === $status) {
+            return null;
+        }
+
+        return [
+            'id'      => $status->getId(),
+            'label'   => $status->getLabel(),
+            'color'   => $status->getColor(),
+            'isFinal' => $status->getIsFinal(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string, color: ?string}
+     */
+    public static function priority(?TaskPriority $priority): ?array
+    {
+        if (null === $priority) {
+            return null;
+        }
+
+        return [
+            'id'    => $priority->getId(),
+            'label' => $priority->getLabel(),
+            'color' => $priority->getColor(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, label: ?string}
+     */
+    public static function effort(?TaskEffort $effort): ?array
+    {
+        if (null === $effort) {
+            return null;
+        }
+
+        return [
+            'id'    => $effort->getId(),
+            'label' => $effort->getLabel(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, username: ?string}
+     */
+    public static function user(?User $user): ?array
+    {
+        if (null === $user) {
+            return null;
+        }
+
+        return [
+            'id'       => $user->getId(),
+            'username' => $user->getUsername(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, title: ?string, color: ?string}
+     */
+    public static function group(?TaskGroup $group): ?array
+    {
+        if (null === $group) {
+            return null;
+        }
+
+        return [
+            'id'    => $group->getId(),
+            'title' => $group->getTitle(),
+            'color' => $group->getColor(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, title: ?string}
+     */
+    public static function groupRef(?TaskGroup $group): ?array
+    {
+        if (null === $group) {
+            return null;
+        }
+
+        return [
+            'id'    => $group->getId(),
+            'title' => $group->getTitle(),
+        ];
+    }
+
+    /**
+     * Full group serialization for MCP group tools (includes description, project, archived).
+     *
+     * @return array<string, mixed>
+     */
+    public static function groupFull(TaskGroup $group): array
+    {
+        return [
+            'id'          => $group->getId(),
+            'title'       => $group->getTitle(),
+            'description' => $group->getDescription(),
+            'color'       => $group->getColor(),
+            'project'     => self::projectRef($group->getProject()),
+            'archived'    => $group->isArchived(),
+        ];
+    }
+
+    /**
+     * @param Collection<int, TaskTag> $tags
+     *
+     * @return list<array{id: ?int, label: ?string}>
+     */
+    public static function tags(Collection $tags): array
+    {
+        return $tags->map(fn (TaskTag $t) => [
+            'id'    => $t->getId(),
+            'label' => $t->getLabel(),
+        ])->toArray();
+    }
+
+    /**
+     * @param Collection<int, TaskTag> $tags
+     *
+     * @return list<array{id: ?int, label: ?string, color: ?string}>
+     */
+    public static function tagsWithColor(Collection $tags): array
+    {
+        return $tags->map(fn (TaskTag $t) => [
+            'id'    => $t->getId(),
+            'label' => $t->getLabel(),
+            'color' => $t->getColor(),
+        ])->toArray();
+    }
+
+    /**
+     * Compute duration in minutes between two timestamps, or null if still active.
+     */
+    public static function durationMinutes(TimeEntry $entry): ?int
+    {
+        $started = $entry->getStartedAt();
+        $stopped = $entry->getStoppedAt();
+
+        if (null === $stopped || null === $started) {
+            return null;
+        }
+
+        return (int) round(($stopped->getTimestamp() - $started->getTimestamp()) / 60);
+    }
+
+    /**
+     * @return null|array{id: ?int, number: ?int, title: ?string}
+     */
+    public static function taskRef(?Task $task): ?array
+    {
+        if (null === $task) {
+            return null;
+        }
+
+        return [
+            'id'     => $task->getId(),
+            'number' => $task->getNumber(),
+            'title'  => $task->getTitle(),
+        ];
+    }
+
+    /**
+     * @return null|array{id: ?int, number: ?int, title: ?string}
+     */
+    public static function clientTicketRef(?ClientTicket $ticket): ?array
+    {
+        if (null === $ticket) {
+            return null;
+        }
+
+        return [
+            'id'     => $ticket->getId(),
+            'number' => $ticket->getNumber(),
+            'title'  => $ticket->getTitle(),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public static function timeEntry(TimeEntry $entry): array
+    {
+        return [
+            'id'           => $entry->getId(),
+            'title'        => $entry->getTitle(),
+            'description'  => $entry->getDescription(),
+            'startedAt'    => $entry->getStartedAt()?->format('c'),
+            'stoppedAt'    => $entry->getStoppedAt()?->format('c'),
+            'duration'     => self::durationMinutes($entry),
+            'user'         => self::user($entry->getUser()),
+            'project'      => $entry->getProject() ? self::projectRef($entry->getProject()) : null,
+            'task'         => self::taskRef($entry->getTask()),
+            'clientTicket' => self::clientTicketRef($entry->getClientTicket()),
+            'tags'         => self::tags($entry->getTags()),
+        ];
+    }
+
+    /**
+     * @param Collection<int, TaskDocument> $documents
+     *
+     * @return list<array<string, mixed>>
+     */
+    public static function documents(Collection $documents): array
+    {
+        return $documents->map(fn (TaskDocument $doc) => [
+            'id'           => $doc->getId(),
+            'originalName' => $doc->getOriginalName(),
+            'mimeType'     => $doc->getMimeType(),
+            'size'         => $doc->getSize(),
+            'createdAt'    => $doc->getCreatedAt()?->format('c'),
+            'uploadedBy'   => self::user($doc->getUploadedBy()),
+        ])->toArray();
+    }
+}
--- a/src/Mcp/Tool/Task/CreateTaskTool.php
+++ b/src/Mcp/Tool/Task/CreateTaskTool.php
@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\Task;

 use App\Entity\Task;
+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskEffortRepository;
 use App\Repository\TaskGroupRepository;
@@ -53,7 +54,7 @@ class CreateTaskTool
        $task = new Task();
        $task->setProject($project);
        $task->setTitle($title);
-        $task->setNumber($this->taskRepository->findMaxNumberByProject($project) + 1);
+        $task->setNumber($this->taskRepository->findMaxNumberByProjectForUpdate($project) + 1);

        if (null !== $description) {
            $task->setDescription($description);
@@ -111,38 +112,14 @@ class CreateTaskTool
            'number'      => $task->getNumber(),
            'title'       => $task->getTitle(),
            'description' => $task->getDescription(),
-            'status'      => $task->getStatus() ? [
-                'id'    => $task->getStatus()->getId(),
-                'label' => $task->getStatus()->getLabel(),
-                'color' => $task->getStatus()->getColor(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-            ] : null,
-            'project' => [
-                'id'   => $project->getId(),
-                'code' => $project->getCode(),
-                'name' => $project->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-            'archived' => $task->isArchived(),
+            'status'      => Serializer::status($task->getStatus()),
+            'priority'    => Serializer::priority($task->getPriority()),
+            'effort'      => Serializer::effort($task->getEffort()),
+            'assignee'    => Serializer::user($task->getAssignee()),
+            'group'       => Serializer::groupRef($task->getGroup()),
+            'project'     => Serializer::projectRef($project),
+            'tags'        => Serializer::tags($task->getTags()),
+            'archived'    => $task->isArchived(),
        ]);
    }
 }
--- a/src/Mcp/Tool/Task/GetTaskTool.php
+++ b/src/Mcp/Tool/Task/GetTaskTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Task;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskRepository;
 use InvalidArgumentException;
 use Mcp\Capability\Attribute\McpTool;
@@ -30,52 +31,15 @@ class GetTaskTool
            'number'      => $task->getNumber(),
            'title'       => $task->getTitle(),
            'description' => $task->getDescription(),
-            'status'      => $task->getStatus() ? [
-                'id'      => $task->getStatus()->getId(),
-                'label'   => $task->getStatus()->getLabel(),
-                'color'   => $task->getStatus()->getColor(),
-                'isFinal' => $task->getStatus()->getIsFinal(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-                'color' => $task->getGroup()->getColor(),
-            ] : null,
-            'project' => [
-                'id'   => $task->getProject()->getId(),
-                'code' => $task->getProject()->getCode(),
-                'name' => $task->getProject()->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-                'color' => $t->getColor(),
-            ])->toArray(),
-            'documents' => $task->getDocuments()->map(fn ($doc) => [
-                'id'           => $doc->getId(),
-                'originalName' => $doc->getOriginalName(),
-                'mimeType'     => $doc->getMimeType(),
-                'size'         => $doc->getSize(),
-                'createdAt'    => $doc->getCreatedAt()?->format('c'),
-                'uploadedBy'   => $doc->getUploadedBy() ? [
-                    'id'       => $doc->getUploadedBy()->getId(),
-                    'username' => $doc->getUploadedBy()->getUsername(),
-                ] : null,
-            ])->toArray(),
-            'archived' => $task->isArchived(),
+            'status'      => Serializer::statusFull($task->getStatus()),
+            'priority'    => Serializer::priority($task->getPriority()),
+            'effort'      => Serializer::effort($task->getEffort()),
+            'assignee'    => Serializer::user($task->getAssignee()),
+            'group'       => Serializer::group($task->getGroup()),
+            'project'     => Serializer::projectRef($task->getProject()),
+            'tags'        => Serializer::tagsWithColor($task->getTags()),
+            'documents'   => Serializer::documents($task->getDocuments()),
+            'archived'    => $task->isArchived(),
        ]);
    }
 }
--- a/src/Mcp/Tool/Task/ListTasksTool.php
+++ b/src/Mcp/Tool/Task/ListTasksTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Task;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskRepository;
 use Mcp\Capability\Attribute\McpTool;

@@ -67,40 +68,16 @@ class ListTasksTool
        }

        return json_encode(array_map(fn ($task) => [
-            'id'     => $task->getId(),
-            'number' => $task->getNumber(),
-            'title'  => $task->getTitle(),
-            'status' => $task->getStatus() ? [
-                'id'    => $task->getStatus()->getId(),
-                'label' => $task->getStatus()->getLabel(),
-                'color' => $task->getStatus()->getColor(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-            ] : null,
-            'project' => [
-                'id'   => $task->getProject()->getId(),
-                'code' => $task->getProject()->getCode(),
-                'name' => $task->getProject()->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
+            'id'       => $task->getId(),
+            'number'   => $task->getNumber(),
+            'title'    => $task->getTitle(),
+            'status'   => Serializer::status($task->getStatus()),
+            'priority' => Serializer::priority($task->getPriority()),
+            'assignee' => Serializer::user($task->getAssignee()),
+            'effort'   => Serializer::effort($task->getEffort()),
+            'group'    => Serializer::groupRef($task->getGroup()),
+            'project'  => Serializer::projectRef($task->getProject()),
+            'tags'     => Serializer::tags($task->getTags()),
            'archived' => $task->isArchived(),
        ], array_values($tasks)));
    }
--- a/src/Mcp/Tool/Task/UpdateTaskTool.php
+++ b/src/Mcp/Tool/Task/UpdateTaskTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\Task;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskEffortRepository;
 use App\Repository\TaskGroupRepository;
 use App\Repository\TaskPriorityRepository;
@@ -114,38 +115,14 @@ class UpdateTaskTool
            'number'      => $task->getNumber(),
            'title'       => $task->getTitle(),
            'description' => $task->getDescription(),
-            'status'      => $task->getStatus() ? [
-                'id'    => $task->getStatus()->getId(),
-                'label' => $task->getStatus()->getLabel(),
-                'color' => $task->getStatus()->getColor(),
-            ] : null,
-            'priority' => $task->getPriority() ? [
-                'id'    => $task->getPriority()->getId(),
-                'label' => $task->getPriority()->getLabel(),
-                'color' => $task->getPriority()->getColor(),
-            ] : null,
-            'effort' => $task->getEffort() ? [
-                'id'    => $task->getEffort()->getId(),
-                'label' => $task->getEffort()->getLabel(),
-            ] : null,
-            'assignee' => $task->getAssignee() ? [
-                'id'       => $task->getAssignee()->getId(),
-                'username' => $task->getAssignee()->getUsername(),
-            ] : null,
-            'group' => $task->getGroup() ? [
-                'id'    => $task->getGroup()->getId(),
-                'title' => $task->getGroup()->getTitle(),
-            ] : null,
-            'project' => [
-                'id'   => $task->getProject()->getId(),
-                'code' => $task->getProject()->getCode(),
-                'name' => $task->getProject()->getName(),
-            ],
-            'tags' => $task->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-            'archived' => $task->isArchived(),
+            'status'      => Serializer::status($task->getStatus()),
+            'priority'    => Serializer::priority($task->getPriority()),
+            'effort'      => Serializer::effort($task->getEffort()),
+            'assignee'    => Serializer::user($task->getAssignee()),
+            'group'       => Serializer::groupRef($task->getGroup()),
+            'project'     => Serializer::projectRef($task->getProject()),
+            'tags'        => Serializer::tags($task->getTags()),
+            'archived'    => $task->isArchived(),
        ]);
    }
 }
--- a/src/Mcp/Tool/TaskMeta/CreateGroupTool.php
+++ b/src/Mcp/Tool/TaskMeta/CreateGroupTool.php
@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\TaskMeta;

 use App\Entity\TaskGroup;
+use App\Mcp\Tool\Serializer;
 use App\Repository\ProjectRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
@@ -45,17 +46,6 @@ class CreateGroupTool
        $this->entityManager->persist($group);
        $this->entityManager->flush();

-        return json_encode([
-            'id'          => $group->getId(),
-            'title'       => $group->getTitle(),
-            'description' => $group->getDescription(),
-            'color'       => $group->getColor(),
-            'project'     => [
-                'id'   => $project->getId(),
-                'code' => $project->getCode(),
-                'name' => $project->getName(),
-            ],
-            'archived' => $group->isArchived(),
-        ]);
+        return json_encode(Serializer::groupFull($group));
    }
 }
--- a/src/Mcp/Tool/TaskMeta/ListGroupsTool.php
+++ b/src/Mcp/Tool/TaskMeta/ListGroupsTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\TaskMeta;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskGroupRepository;
 use Mcp\Capability\Attribute\McpTool;

@@ -23,17 +24,6 @@ class ListGroupsTool

        $groups = $this->taskGroupRepository->findBy($criteria, ['title' => 'ASC']);

-        return json_encode(array_map(fn ($g) => [
-            'id'          => $g->getId(),
-            'title'       => $g->getTitle(),
-            'description' => $g->getDescription(),
-            'color'       => $g->getColor(),
-            'project'     => [
-                'id'   => $g->getProject()->getId(),
-                'code' => $g->getProject()->getCode(),
-                'name' => $g->getProject()->getName(),
-            ],
-            'archived' => $g->isArchived(),
-        ], $groups));
+        return json_encode(array_map(Serializer::groupFull(...), $groups));
    }
 }
--- a/src/Mcp/Tool/TaskMeta/UpdateGroupTool.php
+++ b/src/Mcp/Tool/TaskMeta/UpdateGroupTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\TaskMeta;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TaskGroupRepository;
 use Doctrine\ORM\EntityManagerInterface;
 use InvalidArgumentException;
@@ -47,17 +48,6 @@ class UpdateGroupTool

        $this->entityManager->flush();

-        return json_encode([
-            'id'          => $group->getId(),
-            'title'       => $group->getTitle(),
-            'description' => $group->getDescription(),
-            'color'       => $group->getColor(),
-            'project'     => [
-                'id'   => $group->getProject()->getId(),
-                'code' => $group->getProject()->getCode(),
-                'name' => $group->getProject()->getName(),
-            ],
-            'archived' => $group->isArchived(),
-        ]);
+        return json_encode(Serializer::groupFull($group));
    }
 }
--- a/src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php
+++ b/src/Mcp/Tool/TimeEntry/CreateTimeEntryTool.php
@@ -5,6 +5,8 @@ declare(strict_types=1);
 namespace App\Mcp\Tool\TimeEntry;

 use App\Entity\TimeEntry;
+use App\Mcp\Tool\Serializer;
+use App\Repository\ClientTicketRepository;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use App\Repository\TaskTagRepository;
@@ -27,6 +29,7 @@ class CreateTimeEntryTool
        private readonly TaskRepository $taskRepository,
        private readonly TaskTagRepository $taskTagRepository,
        private readonly TimeEntryRepository $timeEntryRepository,
+        private readonly ClientTicketRepository $clientTicketRepository,
    ) {}

    public function __invoke(
@@ -38,6 +41,7 @@ class CreateTimeEntryTool
        ?int $taskId = null,
        ?array $tagIds = null,
        ?string $description = null,
+        ?int $clientTicketId = null,
    ): string {
        $user = $this->userRepository->find($userId);
        if (null === $user) {
@@ -79,6 +83,13 @@ class CreateTimeEntryTool
            }
            $entry->setTask($task);
        }
+        if (null !== $clientTicketId) {
+            $clientTicket = $this->clientTicketRepository->find($clientTicketId);
+            if (null === $clientTicket) {
+                throw new InvalidArgumentException(sprintf('ClientTicket with ID %d not found.', $clientTicketId));
+            }
+            $entry->setClientTicket($clientTicket);
+        }
        if (null !== $tagIds) {
            foreach ($tagIds as $tagId) {
                $tag = $this->taskTagRepository->find($tagId);
@@ -92,30 +103,6 @@ class CreateTimeEntryTool
        $this->entityManager->persist($entry);
        $this->entityManager->flush();

-        return json_encode([
-            'id'          => $entry->getId(),
-            'title'       => $entry->getTitle(),
-            'description' => $entry->getDescription(),
-            'startedAt'   => $entry->getStartedAt()?->format('c'),
-            'stoppedAt'   => $entry->getStoppedAt()?->format('c'),
-            'duration'    => $entry->getStoppedAt() && $entry->getStartedAt()
-                ? (int) round(($entry->getStoppedAt()->getTimestamp() - $entry->getStartedAt()->getTimestamp()) / 60)
-                : null,
-            'user'    => ['id' => $user->getId(), 'username' => $user->getUsername()],
-            'project' => $entry->getProject() ? [
-                'id'   => $entry->getProject()->getId(),
-                'code' => $entry->getProject()->getCode(),
-                'name' => $entry->getProject()->getName(),
-            ] : null,
-            'task' => $entry->getTask() ? [
-                'id'     => $entry->getTask()->getId(),
-                'number' => $entry->getTask()->getNumber(),
-                'title'  => $entry->getTask()->getTitle(),
-            ] : null,
-            'tags' => $entry->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-        ]);
+        return json_encode(Serializer::timeEntry($entry));
    }
 }
--- a/src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php
+++ b/src/Mcp/Tool/TimeEntry/ListTimeEntriesTool.php
@@ -4,6 +4,7 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\TimeEntry;

+use App\Mcp\Tool\Serializer;
 use App\Repository\TimeEntryRepository;
 use DateTimeImmutable;
 use Mcp\Capability\Attribute\McpTool;
@@ -19,6 +20,7 @@ class ListTimeEntriesTool
        ?int $userId = null,
        ?int $projectId = null,
        ?int $taskId = null,
+        ?int $clientTicketId = null,
        ?string $startDate = null,
        ?string $endDate = null,
        int $limit = 100,
@@ -30,6 +32,7 @@ class ListTimeEntriesTool
            ->leftJoin('te.project', 'p')->addSelect('p')
            ->leftJoin('te.task', 't')->addSelect('t')
            ->leftJoin('te.tags', 'tg')->addSelect('tg')
+            ->leftJoin('te.clientTicket', 'ct')->addSelect('ct')
            ->orderBy('te.startedAt', 'DESC')
            ->setMaxResults($limit)
        ;
@@ -43,6 +46,9 @@ class ListTimeEntriesTool
        if (null !== $taskId) {
            $qb->andWhere('t.id = :taskId')->setParameter('taskId', $taskId);
        }
+        if (null !== $clientTicketId) {
+            $qb->andWhere('ct.id = :clientTicketId')->setParameter('clientTicketId', $clientTicketId);
+        }
        if (null !== $startDate) {
            $qb->andWhere('te.startedAt >= :startDate')
                ->setParameter('startDate', new DateTimeImmutable($startDate.' 00:00:00'))
@@ -56,33 +62,6 @@ class ListTimeEntriesTool

        $entries = $qb->getQuery()->getResult();

-        return json_encode(array_map(fn ($entry) => [
-            'id'          => $entry->getId(),
-            'title'       => $entry->getTitle(),
-            'description' => $entry->getDescription(),
-            'startedAt'   => $entry->getStartedAt()?->format('c'),
-            'stoppedAt'   => $entry->getStoppedAt()?->format('c'),
-            'duration'    => $entry->getStoppedAt() && $entry->getStartedAt()
-                ? (int) round(($entry->getStoppedAt()->getTimestamp() - $entry->getStartedAt()->getTimestamp()) / 60)
-                : null,
-            'user' => [
-                'id'       => $entry->getUser()->getId(),
-                'username' => $entry->getUser()->getUsername(),
-            ],
-            'project' => $entry->getProject() ? [
-                'id'   => $entry->getProject()->getId(),
-                'code' => $entry->getProject()->getCode(),
-                'name' => $entry->getProject()->getName(),
-            ] : null,
-            'task' => $entry->getTask() ? [
-                'id'     => $entry->getTask()->getId(),
-                'number' => $entry->getTask()->getNumber(),
-                'title'  => $entry->getTask()->getTitle(),
-            ] : null,
-            'tags' => $entry->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-        ], $entries));
+        return json_encode(array_map(Serializer::timeEntry(...), $entries));
    }
 }
--- a/src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php
+++ b/src/Mcp/Tool/TimeEntry/UpdateTimeEntryTool.php
@@ -4,6 +4,8 @@ declare(strict_types=1);

 namespace App\Mcp\Tool\TimeEntry;

+use App\Mcp\Tool\Serializer;
+use App\Repository\ClientTicketRepository;
 use App\Repository\ProjectRepository;
 use App\Repository\TaskRepository;
 use App\Repository\TaskTagRepository;
@@ -23,6 +25,7 @@ class UpdateTimeEntryTool
        private readonly ProjectRepository $projectRepository,
        private readonly TaskRepository $taskRepository,
        private readonly TaskTagRepository $taskTagRepository,
+        private readonly ClientTicketRepository $clientTicketRepository,
        private readonly EntityManagerInterface $entityManager,
    ) {}

@@ -35,6 +38,7 @@ class UpdateTimeEntryTool
        ?int $taskId = null,
        ?array $tagIds = null,
        ?string $description = null,
+        ?int $clientTicketId = null,
    ): string {
        $entry = $this->timeEntryRepository->find($id);

@@ -68,6 +72,13 @@ class UpdateTimeEntryTool
            }
            $entry->setTask($task);
        }
+        if (null !== $clientTicketId) {
+            $clientTicket = $this->clientTicketRepository->find($clientTicketId);
+            if (null === $clientTicket) {
+                throw new InvalidArgumentException(sprintf('ClientTicket with ID %d not found.', $clientTicketId));
+            }
+            $entry->setClientTicket($clientTicket);
+        }
        if (null !== $tagIds) {
            foreach ($entry->getTags()->toArray() as $existingTag) {
                $entry->removeTag($existingTag);
@@ -83,29 +94,6 @@ class UpdateTimeEntryTool

        $this->entityManager->flush();

-        return json_encode([
-            'id'        => $entry->getId(),
-            'title'     => $entry->getTitle(),
-            'startedAt' => $entry->getStartedAt()?->format('c'),
-            'stoppedAt' => $entry->getStoppedAt()?->format('c'),
-            'duration'  => $entry->getStoppedAt() && $entry->getStartedAt()
-                ? (int) round(($entry->getStoppedAt()->getTimestamp() - $entry->getStartedAt()->getTimestamp()) / 60)
-                : null,
-            'user'    => ['id' => $entry->getUser()->getId(), 'username' => $entry->getUser()->getUsername()],
-            'project' => $entry->getProject() ? [
-                'id'   => $entry->getProject()->getId(),
-                'code' => $entry->getProject()->getCode(),
-                'name' => $entry->getProject()->getName(),
-            ] : null,
-            'task' => $entry->getTask() ? [
-                'id'     => $entry->getTask()->getId(),
-                'number' => $entry->getTask()->getNumber(),
-                'title'  => $entry->getTask()->getTitle(),
-            ] : null,
-            'tags' => $entry->getTags()->map(fn ($t) => [
-                'id'    => $t->getId(),
-                'label' => $t->getLabel(),
-            ])->toArray(),
-        ]);
+        return json_encode(Serializer::timeEntry($entry));
    }
 }
--- a/src/Repository/ClientTicketRepository.php
+++ b/src/Repository/ClientTicketRepository.php
@@ -19,15 +19,18 @@ class ClientTicketRepository extends ServiceEntityRepository
        parent::__construct($registry, ClientTicket::class);
    }

-    public function findNextNumberForProject(Project $project): int
+    /**
+     * Returns the next ticket number for a project, using a row-level lock
+     * to prevent race conditions when creating tickets concurrently.
+     */
+    public function findNextNumberForProjectForUpdate(Project $project): int
    {
-        $result = $this->createQueryBuilder('ct')
-            ->select('MAX(ct.number)')
-            ->where('ct.project = :project')
-            ->setParameter('project', $project)
-            ->getQuery()
-            ->getSingleScalarResult()
-        ;
+        $conn = $this->getEntityManager()->getConnection();
+
+        $result = $conn->fetchOne(
+            'SELECT COALESCE(MAX(number), 0) FROM client_ticket WHERE project_id = :project FOR UPDATE',
+            ['project' => $project->getId()],
+        );

        return ((int) $result) + 1;
    }
--- a/src/Repository/TaskRepository.php
+++ b/src/Repository/TaskRepository.php
@@ -9,6 +9,9 @@ use App\Entity\Task;
 use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
 use Doctrine\Persistence\ManagerRegistry;

+/**
+ * @extends ServiceEntityRepository<Task>
+ */
 class TaskRepository extends ServiceEntityRepository
 {
    public function __construct(ManagerRegistry $registry)
@@ -16,16 +19,19 @@ class TaskRepository extends ServiceEntityRepository
        parent::__construct($registry, Task::class);
    }

-    public function findMaxNumberByProject(Project $project): int
+    /**
+     * Returns the max task number for a project, using a row-level lock
+     * to prevent race conditions when creating tasks concurrently.
+     */
+    public function findMaxNumberByProjectForUpdate(Project $project): int
    {
-        $result = $this->createQueryBuilder('t')
-            ->select('MAX(t.number)')
-            ->where('t.project = :project')
-            ->setParameter('project', $project)
-            ->getQuery()
-            ->getSingleScalarResult()
-        ;
+        $conn = $this->getEntityManager()->getConnection();

-        return (int) ($result ?? 0);
+        $result = $conn->fetchOne(
+            'SELECT COALESCE(MAX(number), 0) FROM task WHERE project_id = :project',
+            ['project' => $project->getId()],
+        );
+
+        return (int) $result;
    }
 }
--- a/src/Service/BookStackApiService.php
+++ b/src/Service/BookStackApiService.php
@@ -59,7 +59,7 @@ final class BookStackApiService
     * Search for pages and books within a specific shelf.
     *
     * Algorithm:
-     * 1. Fetch the shelf's book IDs
+     * 1. Fetch the shelf data (book IDs + slugs)
     * 2. Run two search queries (one for pages, one for books)
     * 3. Filter results: pages must belong to a book on the shelf, books must be on the shelf
     *
@@ -67,17 +67,27 @@ final class BookStackApiService
     */
    public function searchInShelf(int $shelfId, string $query): array
    {
-        $bookIds = $this->getShelfBookIds($shelfId);
+        $shelfData = $this->request('GET', sprintf('/api/shelves/%d', $shelfId));
+        $books     = $shelfData['books'] ?? [];

-        if (empty($bookIds)) {
+        if (empty($books)) {
            return [];
        }

+        $bookIds   = array_map(static fn (array $book): int => $book['id'], $books);
+        $bookSlugs = [];
+        foreach ($books as $book) {
+            $bookSlugs[$book['id']] = $book['slug'] ?? '';
+        }
+
+        // Update cache for getShelfBookIds
+        $this->shelfBookCache[$shelfId] = $bookIds;
+
        $config  = $this->getConfiguration();
        $baseUrl = rtrim($config->getUrl() ?? '', '/');
        $trimmed = trim($query);

-        // BookStack search API accepts {type:X} for one type at a time — run two queries
+        // BookStack search API accepts {type:X} for one type at a time -- run two queries
        $pageResults = $this->request('GET', '/api/search', [
            'query' => ['query' => $trimmed.' {type:page}', 'count' => 50],
        ]);
@@ -87,13 +97,6 @@ final class BookStackApiService

        $allResults = array_merge($pageResults['data'] ?? [], $bookResults['data'] ?? []);

-        // Build a map of bookId → bookSlug for URL construction
-        $shelfData = $this->request('GET', sprintf('/api/shelves/%d', $shelfId));
-        $bookSlugs = [];
-        foreach ($shelfData['books'] ?? [] as $book) {
-            $bookSlugs[$book['id']] = $book['slug'] ?? '';
-        }
-
        $filtered = [];
        foreach ($allResults as $item) {
            $type = $item['type'] ?? '';
@@ -101,23 +104,20 @@ final class BookStackApiService
            if ('page' === $type) {
                $bookId = $item['book_id'] ?? 0;
                if (in_array($bookId, $bookIds, true)) {
-                    $bookSlug   = $bookSlugs[$bookId] ?? '';
                    $filtered[] = [
                        'id'   => $item['id'],
                        'type' => 'page',
                        'name' => $item['name'] ?? '',
-                        'url'  => $baseUrl.'/books/'.$bookSlug.'/page/'.$item['slug'],
-                    ];
-                }
-            } elseif ('book' === $type) {
-                if (in_array($item['id'], $bookIds, true)) {
-                    $filtered[] = [
-                        'id'   => $item['id'],
-                        'type' => 'book',
-                        'name' => $item['name'] ?? '',
-                        'url'  => $baseUrl.'/books/'.$item['slug'],
+                        'url'  => $baseUrl.'/books/'.($bookSlugs[$bookId] ?? '').'/page/'.$item['slug'],
                    ];
                }
+            } elseif ('book' === $type && in_array($item['id'], $bookIds, true)) {
+                $filtered[] = [
+                    'id'   => $item['id'],
+                    'type' => 'book',
+                    'name' => $item['name'] ?? '',
+                    'url'  => $baseUrl.'/books/'.$item['slug'],
+                ];
            }
        }

--- a/src/Service/GiteaApiService.php
+++ b/src/Service/GiteaApiService.php
@@ -126,9 +126,10 @@ final readonly class GiteaApiService

        $regex = sprintf('#^[^/]+/%s($|-.+)#', preg_quote($taskCode, '#'));

-        return array_values(array_filter($allBranches, static function (array $branch) use ($regex): bool {
-            return 1 === preg_match($regex, $branch['name']);
-        }));
+        return array_values(array_filter(
+            $allBranches,
+            static fn (array $branch): bool => 1 === preg_match($regex, $branch['name']),
+        ));
    }

    /**
--- a/src/Service/NotificationService.php
+++ b/src/Service/NotificationService.php
@@ -52,12 +52,12 @@ final readonly class NotificationService
            return;
        }

-        $number      = sprintf('CT-%03d', $ticket->getNumber());
-        $statusLabel = $ticket->getStatus();
-        $message     = 'Nouveau statut : '.$statusLabel;
+        $number        = sprintf('CT-%03d', $ticket->getNumber());
+        $statusComment = $ticket->getStatusComment();
+        $message       = 'Nouveau statut : '.$ticket->getStatus();

-        if (null !== $ticket->getStatusComment() && '' !== $ticket->getStatusComment()) {
-            $message .= ' — '.$ticket->getStatusComment();
+        if (null !== $statusComment && '' !== $statusComment) {
+            $message .= ' — '.$statusComment;
        }

        $notification = new Notification();
--- a/src/Service/TokenEncryptor.php
+++ b/src/Service/TokenEncryptor.php
@@ -17,31 +17,10 @@ final class TokenEncryptor
        #[Autowire('%env(ENCRYPTION_KEY)%')]
        string $encryptionKey,
    ) {
-        if ('' === $encryptionKey) {
-            $this->key        = '';
-            $this->configured = false;
+        $key = $this->tryDecodeKey($encryptionKey);

-            return;
-        }
-
-        try {
-            $key = sodium_hex2bin($encryptionKey);
-        } catch (SodiumException) {
-            $this->key        = '';
-            $this->configured = false;
-
-            return;
-        }
-
-        if (SODIUM_CRYPTO_SECRETBOX_KEYBYTES !== mb_strlen($key, '8bit')) {
-            $this->key        = '';
-            $this->configured = false;
-
-            return;
-        }
-
-        $this->key        = $key;
-        $this->configured = true;
+        $this->key        = $key ?? '';
+        $this->configured = null !== $key;
    }

    public function encrypt(string $plaintext): string
@@ -71,6 +50,25 @@ final class TokenEncryptor
        return $plaintext;
    }

+    private function tryDecodeKey(string $encryptionKey): ?string
+    {
+        if ('' === $encryptionKey) {
+            return null;
+        }
+
+        try {
+            $key = sodium_hex2bin($encryptionKey);
+        } catch (SodiumException) {
+            return null;
+        }
+
+        if (SODIUM_CRYPTO_SECRETBOX_KEYBYTES !== mb_strlen($key, '8bit')) {
+            return null;
+        }
+
+        return $key;
+    }
+
    private function assertConfigured(): void
    {
        if (!$this->configured) {
--- a/src/State/ClientTicketNumberProcessor.php
+++ b/src/State/ClientTicketNumberProcessor.php
@@ -51,12 +51,13 @@ final readonly class ClientTicketNumberProcessor implements ProcessorInterface
            }
        }

-        $nextNumber = $this->clientTicketRepository->findNextNumberForProject($project);
-        $data->setNumber($nextNumber);
+        $now = new DateTimeImmutable();
+
+        $data->setNumber($this->clientTicketRepository->findNextNumberForProjectForUpdate($project));
        $data->setSubmittedBy($user);
        $data->setStatus('new');
-        $data->setCreatedAt(new DateTimeImmutable());
-        $data->setUpdatedAt(new DateTimeImmutable());
+        $data->setCreatedAt($now);
+        $data->setUpdatedAt($now);

        $this->entityManager->persist($data);
        $this->entityManager->flush();
--- a/src/State/ClientTicketProvider.php
+++ b/src/State/ClientTicketProvider.php
@@ -54,17 +54,27 @@ final readonly class ClientTicketProvider implements ProviderInterface
        // Apply filters from query parameters
        $filters = $context['filters'] ?? [];
        if (isset($filters['project'])) {
-            $projectId = is_numeric($filters['project']) ? (int) $filters['project'] : (int) basename($filters['project']);
-            $qb->andWhere('ct.project = :project')->setParameter('project', $projectId);
+            $qb->andWhere('ct.project = :project')
+                ->setParameter('project', self::extractId($filters['project']))
+            ;
        }
        if (isset($filters['status'])) {
            $qb->andWhere('ct.status = :status')->setParameter('status', $filters['status']);
        }
        if (isset($filters['submittedBy']) && $this->security->isGranted('ROLE_ADMIN')) {
-            $submittedById = is_numeric($filters['submittedBy']) ? (int) $filters['submittedBy'] : (int) basename($filters['submittedBy']);
-            $qb->andWhere('ct.submittedBy = :submittedBy')->setParameter('submittedBy', $submittedById);
+            $qb->andWhere('ct.submittedBy = :submittedBy')
+                ->setParameter('submittedBy', self::extractId($filters['submittedBy']))
+            ;
        }

        return $qb->getQuery()->getResult();
    }
+
+    /**
+     * Extract an entity ID from a value that may be a numeric ID or an IRI string.
+     */
+    private static function extractId(string $value): int
+    {
+        return is_numeric($value) ? (int) $value : (int) basename($value);
+    }
 }
--- a/src/State/ClientTicketStatusProcessor.php
+++ b/src/State/ClientTicketStatusProcessor.php
@@ -10,6 +10,7 @@ use App\Entity\ClientTicket;
 use App\Service\NotificationService;
 use DateTimeImmutable;
 use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;

 /**
@@ -25,6 +26,7 @@ final readonly class ClientTicketStatusProcessor implements ProcessorInterface
    public function __construct(
        private EntityManagerInterface $entityManager,
        private NotificationService $notificationService,
+        private Security $security,
    ) {}

    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): ClientTicket
@@ -32,12 +34,22 @@ final readonly class ClientTicketStatusProcessor implements ProcessorInterface
        assert($data instanceof ClientTicket);

        $originalData = $context['previous_data'] ?? null;
+
+        $statusChanged = false;
+
        if ($originalData instanceof ClientTicket) {
+            // ROLE_CLIENT: can only edit content fields, not status
+            if (!$this->security->isGranted('ROLE_ADMIN')) {
+                $data->setStatus($originalData->getStatus());
+                $data->setStatusComment($originalData->getStatusComment());
+            }
+
            $oldStatus = $originalData->getStatus();
            $newStatus = $data->getStatus();

            if ($oldStatus !== $newStatus) {
-                $forbidden = self::FORBIDDEN_TRANSITIONS[$oldStatus] ?? [];
+                $statusChanged = true;
+                $forbidden     = self::FORBIDDEN_TRANSITIONS[$oldStatus] ?? [];
                if (in_array($newStatus, $forbidden, true)) {
                    throw new BadRequestHttpException(sprintf('Transition from "%s" to "%s" is not allowed.', $oldStatus, $newStatus));
                }
@@ -53,7 +65,9 @@ final readonly class ClientTicketStatusProcessor implements ProcessorInterface
        $this->entityManager->persist($data);
        $this->entityManager->flush();

-        $this->notificationService->createForStatusChange($data);
+        if ($statusChanged) {
+            $this->notificationService->createForStatusChange($data);
+        }

        return $data;
    }
--- a/src/State/GiteaBranchNameProvider.php
+++ b/src/State/GiteaBranchNameProvider.php
@@ -15,6 +15,7 @@ use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;

 final readonly class GiteaBranchNameProvider implements ProviderInterface
 {
+    /** @see GiteaBranchProcessor::ALLOWED_TYPES */
    private const array ALLOWED_TYPES = ['feature', 'fix', 'refactor', 'hotfix', 'chore'];

    public function __construct(
--- a/src/State/TaskDocumentProcessor.php
+++ b/src/State/TaskDocumentProcessor.php
@@ -24,6 +24,35 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface
 {
    private const MAX_FILE_SIZE = 50 * 1024 * 1024; // 50 MB

+    private const ALLOWED_MIME_TYPES = [
+        'image/jpeg', 'image/png', 'image/gif', 'image/webp', 'image/svg+xml',
+        'application/pdf',
+        'application/msword',
+        'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        'application/vnd.ms-excel',
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+        'application/vnd.ms-powerpoint',
+        'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+        'text/plain', 'text/csv',
+        'application/zip', 'application/x-rar-compressed', 'application/gzip',
+        'application/json', 'application/xml', 'text/xml',
+    ];
+
+    private const MIME_TO_EXTENSION = [
+        'image/jpeg'                                                                => 'jpg', 'image/png' => 'png', 'image/gif' => 'gif',
+        'image/webp'                                                                => 'webp', 'image/svg+xml' => 'svg',
+        'application/pdf'                                                           => 'pdf',
+        'application/msword'                                                        => 'doc',
+        'application/vnd.openxmlformats-officedocument.wordprocessingml.document'   => 'docx',
+        'application/vnd.ms-excel'                                                  => 'xls',
+        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'         => 'xlsx',
+        'application/vnd.ms-powerpoint'                                             => 'ppt',
+        'application/vnd.openxmlformats-officedocument.presentationml.presentation' => 'pptx',
+        'text/plain'                                                                => 'txt', 'text/csv' => 'csv',
+        'application/zip'                                                           => 'zip', 'application/x-rar-compressed' => 'rar', 'application/gzip' => 'gz',
+        'application/json'                                                          => 'json', 'application/xml' => 'xml', 'text/xml' => 'xml',
+    ];
+
    public function __construct(
        private EntityManagerInterface $entityManager,
        private Security $security,
@@ -52,50 +81,48 @@ final readonly class TaskDocumentProcessor implements ProcessorInterface
            throw new BadRequestHttpException('File size exceeds 50 MB limit.');
        }

-        $taskIri         = $request->request->get('task');
-        $clientTicketIri = $request->request->get('clientTicket');
+        $taskIri         = $request->request->get('task', '');
+        $clientTicketIri = $request->request->get('clientTicket', '');

-        if ((null === $taskIri || '' === $taskIri) && (null === $clientTicketIri || '' === $clientTicketIri)) {
+        if ('' === $taskIri && '' === $clientTicketIri) {
            throw new BadRequestHttpException('Either task or clientTicket IRI is required.');
        }

        $task         = null;
        $clientTicket = null;

-        if (null !== $taskIri && '' !== $taskIri) {
-            // Extract task ID from IRI (e.g., "/api/tasks/42" -> 42)
-            $taskId = (int) basename((string) $taskIri);
-            $task   = $this->entityManager->getRepository(Task::class)->find($taskId);
+        if ('' !== $taskIri) {
+            $task = $this->entityManager->getRepository(Task::class)->find((int) basename($taskIri));

            if (null === $task) {
                throw new BadRequestHttpException('Task not found.');
            }
        }

-        if (null !== $clientTicketIri && '' !== $clientTicketIri) {
-            $clientTicketId = (int) basename((string) $clientTicketIri);
-            $clientTicket   = $this->entityManager->getRepository(ClientTicket::class)->find($clientTicketId);
+        if ('' !== $clientTicketIri) {
+            $clientTicket = $this->entityManager->getRepository(ClientTicket::class)->find((int) basename($clientTicketIri));

            if (null === $clientTicket) {
                throw new BadRequestHttpException('Client ticket not found.');
            }

-            // Ownership validation for ROLE_CLIENT
-            if (!$this->security->isGranted('ROLE_ADMIN')) {
-                $currentUser = $this->security->getUser();
-                if ($clientTicket->getSubmittedBy() !== $currentUser) {
-                    throw new AccessDeniedHttpException('You can only upload documents to your own tickets.');
-                }
+            if (!$this->security->isGranted('ROLE_ADMIN') && $clientTicket->getSubmittedBy() !== $this->security->getUser()) {
+                throw new AccessDeniedHttpException('You can only upload documents to your own tickets.');
            }
        }

-        // Capture file metadata BEFORE move() — move invalidates the temp file
+        // Use server-detected MIME type (finfo), not the client-supplied one
        $originalName = $file->getClientOriginalName();
-        $extension    = $file->getClientOriginalExtension() ?: 'bin';
-        $mimeType     = $file->getClientMimeType() ?? 'application/octet-stream';
+        $mimeType     = $file->getMimeType() ?: 'application/octet-stream';
        $fileSize     = $file->getSize();
-        $uuid         = Uuid::v4()->toRfc4122();
-        $fileName     = $uuid.'.'.$extension;
+
+        if (!in_array($mimeType, self::ALLOWED_MIME_TYPES, true)) {
+            throw new BadRequestHttpException(sprintf('File type "%s" is not allowed.', $mimeType));
+        }
+
+        $extension = self::MIME_TO_EXTENSION[$mimeType] ?? 'bin';
+        $uuid      = Uuid::v4()->toRfc4122();
+        $fileName  = $uuid.'.'.$extension;

        if (!is_dir($this->uploadDir)) {
            mkdir($this->uploadDir, 0o775, true);
--- a/src/State/TaskNumberProcessor.php
+++ b/src/State/TaskNumberProcessor.php
@@ -9,6 +9,7 @@ use ApiPlatform\Metadata\Post;
 use ApiPlatform\State\ProcessorInterface;
 use App\Entity\Task;
 use App\Repository\TaskRepository;
+use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Component\DependencyInjection\Attribute\Autowire;

 /**
@@ -23,6 +24,7 @@ final readonly class TaskNumberProcessor implements ProcessorInterface
        #[Autowire(service: 'api_platform.doctrine.orm.state.persist_processor')]
        private ProcessorInterface $persistProcessor,
        private TaskRepository $taskRepository,
+        private EntityManagerInterface $entityManager,
    ) {}

    /**
@@ -31,8 +33,12 @@ final readonly class TaskNumberProcessor implements ProcessorInterface
    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
    {
        if ($operation instanceof Post && null !== $data->getProject()) {
-            $maxNumber = $this->taskRepository->findMaxNumberByProject($data->getProject());
-            $data->setNumber($maxNumber + 1);
+            return $this->entityManager->wrapInTransaction(function () use ($data, $operation, $uriVariables, $context) {
+                $maxNumber = $this->taskRepository->findMaxNumberByProjectForUpdate($data->getProject());
+                $data->setNumber($maxNumber + 1);
+
+                return $this->persistProcessor->process($data, $operation, $uriVariables, $context);
+            });
        }

        return $this->persistProcessor->process($data, $operation, $uriVariables, $context);
--- a/src/State/UserPasswordHasherProcessor.php
+++ b/src/State/UserPasswordHasherProcessor.php
@@ -29,10 +29,10 @@ final readonly class UserPasswordHasherProcessor implements ProcessorInterface
     */
    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
    {
-        if (null !== $data->getPassword() && !str_starts_with($data->getPassword(), '$')) {
-            $data->setPassword(
-                $this->passwordHasher->hashPassword($data, $data->getPassword())
-            );
+        $plainPassword = $data->getPassword();
+
+        if (null !== $plainPassword && !str_starts_with($plainPassword, '$')) {
+            $data->setPassword($this->passwordHasher->hashPassword($data, $plainPassword));
        }

        return $this->persistProcessor->process($data, $operation, $uriVariables, $context);
Author	SHA1	Message	Date
Matthieu	0f99098291	chore : bump version to 0.2.0 and update deploy doc Some checks failed Auto Tag Develop / tag (push) Successful in 5s Details Build Release Artefact / build (push) Failing after 1m25s Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-16 14:29:41 +01:00
Matthieu	1c6f473dff	feat(mcp) : add clientTicket relation to time entries Add ManyToOne relation from TimeEntry to ClientTicket entity. MCP tools create-time-entry, update-time-entry, and list-time-entries now support clientTicketId parameter for linking tickets to time entries. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-16 14:28:31 +01:00
Matthieu	c95fff530c	docs(deploy) : add deployment guide and MCP connection tutorial Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-16 14:28:31 +01:00
gitea-actions	fb0e6c1ea4	chore: bump version to v0.1.2 All checks were successful Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Successful in 1m19s Details	2026-03-16 08:52:02 +00:00
Matthieu	6d3ecc1322	Merge branch 'feature/client-portal' into develop Some checks failed Auto Tag Develop / tag (push) Has been cancelled Details	2026-03-16 09:51:48 +01:00
Matthieu	f5986090c0	feat(deploy) : add deploy script and nginx config for bare Ubuntu server Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-16 09:51:29 +01:00
Matthieu	d6399c20e1	fix : fix MCP create-task tool crashing on task creation CreateTaskTool called nonexistent findMaxNumberByProject instead of findMaxNumberByProjectForUpdate. Also removed FOR UPDATE clause from the query as PostgreSQL does not support it with aggregate functions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-16 09:26:36 +01:00
Matthieu	a972d243f5	style : center and resize view toggle buttons on my-tasks page Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-16 09:26:34 +01:00
Matthieu	56bf88f293	fix : prevent document delete button from submitting the TaskModal form The delete button in TaskDocumentList lacked type="button", causing it to act as a submit button inside the form, which triggered handleSubmit and closed the modal before the confirmation dialog could appear. Also added guards to prevent closing TaskModal while a sub-modal is open. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-16 09:26:32 +01:00
matthieu	9d80e017c2	docs : complete architecture tree in README with all directories Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:27:52 +01:00
matthieu	4e91507158	docs : rewrite README with full project documentation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:25:42 +01:00
matthieu	318f14ea88	docs : update CLAUDE.md with avatar feature context and gotchas Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:21:12 +01:00
matthieu	202b516dc3	fix(avatar) : install symfony/mime for server-side MIME type detection Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:13:18 +01:00
matthieu	98782a9849	fix(avatar) : add explicit import for useAvatarService in profile page Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:12:38 +01:00
matthieu	b978adf9ae	fix(avatar) : move avatar service to composables for Nuxt auto-import Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:11:03 +01:00
matthieu	e4fc34b90f	refactor : simplify codebase and fix critical issues Backend: - Add MCP Serializer to centralize entity-to-array conversion (~300 lines deduped) - Fix race condition in task/ticket number generation (SELECT FOR UPDATE + transaction) - Add unique constraint on task (project_id, number) with migration - Fix MIME type validation: use server-detected finfo instead of client-supplied type - Add allowlist of permitted MIME types for uploads - Fix TaskDocumentDownloadController: allow ROLE_CLIENT access, add priority:1 - Fix notification sent even when ticket status unchanged - Remove redundant exception constructors - Simplify services (BookStackApi double fetch, TokenEncryptor, GiteaApi) - Consolidate duplicate checks in processors Frontend: - Fix useApi isHandlingUnauthorized scope (module-level to prevent double 401 redirect) - Fix client-tickets toast key copy-paste bug - Merge duplicated tasks service methods (getByProject + getByProjectArchived) - Extract shared uploadWithRelation helper in task-documents service - Extract formatFileSize utility from duplicated component code - Extract status transition logic into useClientTicketHelpers composable - Remove dead code (unused router, handleLogout, empty script blocks) - Merge duplicate watchers and onMounted calls - Normalize arrow functions to function declarations per convention Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:09:16 +01:00
matthieu	a5144443a4	fix(avatar) : address review findings — security and UX fixes - Use getMimeType() instead of getClientMimeType() to prevent MIME spoofing - Change IsGranted to IS_AUTHENTICATED_FULLY so ROLE_CLIENT can access avatars - Remove Groups from avatarFileName (only avatarUrl needed by frontend) - Disable aggressive caching to prevent stale avatar images - Add error handling to avatar upload in profile page - Use i18n for "Mon profil" button text Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 22:02:27 +01:00
matthieu	afd4baed92	feat(avatar) : replace initials with UserAvatar component everywhere Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:58:46 +01:00
matthieu	e8f0202b15	feat(avatar) : add profile page with avatar upload and crop Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:57:55 +01:00
matthieu	962b3d935c	feat(avatar) : add AvatarCropper modal with vue-advanced-cropper Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:56:11 +01:00
matthieu	cea22f977b	feat(avatar) : add UserAvatar component with image/initials fallback Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:55:52 +01:00
matthieu	5613a7c92b	feat(avatar) : add avatar service, DTO update, and cropper dependency Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:55:39 +01:00
matthieu	4d0aa65920	feat(avatar) : add avatar upload/serve/delete controller Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:54:23 +01:00
matthieu	63315c0a15	feat(avatar) : add avatarFileName field to User entity Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:53:43 +01:00
matthieu	cff16611f4	docs : add user avatar implementation plan Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:50:07 +01:00
matthieu	96f5c7c91c	docs : add user avatar feature design spec Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:47:38 +01:00
matthieu	f7a76c9e9b	feat(frontend) : add date filter component to time-tracking page Reusable DateFilter component using @vuepic/vue-datepicker with day/week toggle. Selecting a day switches to day view, selecting a week navigates the calendar to that week. Includes "Aujourd'hui" and "Cette semaine" quick shortcuts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:46:48 +01:00
matthieu	7047f64a6b	fix(portal) : handle submittedBy as object or IRI in canEdit check Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:40:54 +01:00
matthieu	cd8cea45c1	fix(security) : allow ROLE_CLIENT to read projects Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:39:41 +01:00
matthieu	1f31a3a33f	fix(portal) : embed project id/name in /me response for client users Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:37:18 +01:00
matthieu	254f8bc411	fix(admin) : handle null/IRI client in project filter for UserDrawer Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:34:21 +01:00
matthieu	239cd6398e	docs : update CLAUDE.md with client portal context and gotchas Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:26:05 +01:00
matthieu	318b6198da	feat(portal) : add drag & drop status change on client ticket kanban Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:16:22 +01:00
matthieu	4e3e854aa2	fix(portal) : allow admin to edit tickets and enable document deletion Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 21:12:55 +01:00
matthieu	49cd971e3e	feat(project) : add client tickets panel to project page Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-15 20:41:28 +01:00
matthieu	ffe4a0117c	feat(portal) : allow client to edit own tickets Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-15 20:41:25 +01:00
matthieu	d2f6d84d03	feat(portal) : replace ticket list with kanban board Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-15 20:41:23 +01:00
matthieu	2a874046d3	feat : allow client to edit own tickets and protect status fields Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 20:35:11 +01:00
matthieu	f09ef67117	feat : date filter, project drawer, and misc frontend improvements Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 20:25:26 +01:00
matthieu	046ee396d3	feat(fixtures) : add users alice/bob/charlie and distribute task assignees Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 20:25:14 +01:00
matthieu	0ba487cfa9	feat(fixtures) : add client users, client tickets, and ticket-task link Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 20:20:27 +01:00
matthieu	a2fc8e6e52	feat(task) : add client ticket selector in TaskModal Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-15 20:14:56 +01:00
gitea-actions	4216f1b5a1	chore: bump version to v0.1.1 All checks were successful Auto Tag Develop / tag (push) Successful in 4s Details Build Release Artefact / build (push) Successful in 1m17s Details	2026-03-15 18:07:23 +00:00