fix: critical security hardening — tenant isolation, CORS, error leaking, input validation

1. Tenant isolation bypass (CRITICAL): TenantResolver now verifies user has access to X-Tenant-ID via user_tenants lookup before setting context. Added VerifyAccess method to TenantLookup interface and TenantService. 2. Consolidated tenant resolution: Removed duplicate resolveTenant() from helpers.go and tenant resolution from auth middleware. TenantResolver is now the single source of truth. Deadlines and AI handlers use auth.TenantFromContext() instead of direct DB queries. 3. CalDAV credential masking: tenant settings responses now mask CalDAV passwords with "********" via maskSettingsPassword helper. Applied to GetTenant, ListTenants, and UpdateSettings responses. 4. CORS + security headers: New middleware/security.go with CORS (restricted to FRONTEND_ORIGIN) and security headers (X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, X-XSS-Protection). 5. Internal error leaking: All writeError(w, 500, err.Error()) replaced with internalError() that logs via slog and returns generic "internal error" to client. Same for jsonError in tenant handler. 6. Input validation: Max length on title (500), description (10000), case_number (100), search (200). Pagination clamped to max 100. Content-Disposition filename sanitized against header injection. Regression test added for tenant access denial (403 on unauthorized X-Tenant-ID). All existing tests pass, go vet clean.
docs: full system roadmap — from MVP to complete Kanzleimanagement
2026-03-30 11:01:14 +02:00 · 2026-03-28 02:35:20 +01:00 · 2026-03-28 02:30:39 +01:00 · 2026-03-28 02:26:39 +01:00 · 2026-03-28 02:23:50 +01:00 · 2026-03-28 02:22:07 +01:00
44 changed files with 4129 additions and 395 deletions
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -0,0 +1,482 @@
+# KanzlAI-mGMT MVP Audit
+
+**Date:** 2026-03-28
+**Auditor:** athena (consultant)
+**Scope:** Full-stack audit of KanzlAI-mGMT — Go backend, Next.js frontend, Supabase database, deployment, security, UX, competitive positioning.
+**Codebase:** ~16,500 lines across ~60 source files, built 2026-03-25 in a single session with parallel workers.
+
+---
+
+## Executive Summary
+
+KanzlAI-mGMT is an impressive MVP built in ~2 hours. It covers the core Kanzleimanagement primitives: cases, deadlines, appointments, parties, documents, notes, dashboard, CalDAV sync, and AI-powered deadline extraction. The architecture is sound — clean separation between Go API and Next.js frontend, proper multi-tenant design with Supabase Auth, parameterized SQL throughout.
+
+However, the speed of construction shows. There are **critical security gaps** that must be fixed before any external user touches this. The frontend has good bones but lacks the polish and completeness a lawyer would expect. And the feature gap vs. established competitors (RA-MICRO, ADVOWARE, AnNoText, Actaport) is enormous — particularly around beA integration, billing/RVG, and document generation, which are table-stakes for German law firms.
+
+**Bottom line:** Fix the security issues, add error recovery and multi-tenant auth verification, then decide whether to pursue the Kanzleimanagement market (massive feature gap) or pivot back to the UPC niche (where you had a genuine competitive advantage).
+
+---
+
+## 1. Critical Issues (Fix Immediately)
+
+### 1.1 Tenant Isolation Bypass in TenantResolver
+**File:** `backend/internal/auth/tenant_resolver.go:37-42`
+
+When the `X-Tenant-ID` header is provided, the TenantResolver parses it and sets it in context **without verifying the user has access to that tenant**. Any authenticated user can access any tenant's data by setting this header.
+
+```go
+if header := r.Header.Get("X-Tenant-ID"); header != "" {
+    parsed, err := uuid.Parse(header)
+    // ... sets tenantID = parsed — NO ACCESS CHECK
+}
+```
+
+Compare with `helpers.go:32-44` where `resolveTenant()` correctly verifies access via `user_tenants` — but this function is unused in the middleware path. The TenantResolver middleware is what actually runs for all scoped routes.
+
+**Impact:** Complete tenant data isolation breach. User A can read/modify/delete User B's cases, deadlines, appointments, documents.
+
+**Fix:** Add `user_tenants` lookup in TenantResolver when X-Tenant-ID is provided, same as `resolveTenant()` does.
+
+### 1.2 Duplicate Tenant Resolution Logic
+**Files:** `backend/internal/auth/tenant_resolver.go` and `backend/internal/handlers/helpers.go:25-57`
+
+Two independent implementations of tenant resolution exist. The middleware (`TenantResolver`) is used for the scoped routes. The handler-level `resolveTenant()` function exists in helpers.go. The auth middleware in `middleware.go:39-47` also resolves a tenant into context. This triple-resolution creates confusion and the security bug above.
+
+**Fix:** Consolidate to a single path. Remove the handler-level `resolveTenant()` and the auth middleware's tenant resolution. Let TenantResolver be the single source of truth, but make it verify access.
+
+### 1.3 CalDAV Credentials Stored in Plaintext
+**File:** `backend/internal/services/caldav_service.go:29-35`
+
+CalDAV username and password are stored as plain JSON in the `tenants.settings` column:
+```go
+type CalDAVConfig struct {
+    URL      string `json:"url"`
+    Username string `json:"username"`
+    Password string `json:"password"`
+    ...
+}
+```
+
+Combined with the tenant isolation bypass above, any authenticated user can read any tenant's CalDAV credentials.
+
+**Fix:** Encrypt CalDAV credentials at rest (e.g., using `pgcrypto` or application-level encryption). At minimum, never return the password in API responses.
+
+### 1.4 No CORS Configuration
+**File:** `backend/internal/router/router.go`, `backend/cmd/server/main.go`
+
+There is zero CORS handling anywhere in the backend. The frontend uses Next.js rewrites to proxy `/api/` to the backend, which works in production. But:
+- If anyone accesses the backend directly (different origin), there's no CORS protection.
+- No `X-Frame-Options`, `X-Content-Type-Options`, or other security headers are set.
+
+**Fix:** Add CORS middleware restricting to the frontend origin. Add standard security headers.
+
+### 1.5 Internal Error Messages Leaked to Clients
+**Files:** Multiple handlers (e.g., `cases.go:44`, `cases.go:73`, `appointments.go`)
+
+```go
+writeError(w, http.StatusInternalServerError, err.Error())
+```
+
+Internal error messages (including SQL errors, connection errors, etc.) are sent directly to the client. This leaks implementation details.
+
+**Fix:** Log the full error server-side, return a generic message to the client.
+
+### 1.6 Race Condition in HolidayService Cache
+**File:** `backend/internal/services/holidays.go`
+
+The `HolidayService` uses a `map[int][]Holiday` cache without any mutex protection. Concurrent requests (e.g., multiple deadline calculations) will cause a data race. The Go race detector would flag this.
+
+**Fix:** Add `sync.RWMutex` to HolidayService.
+
+### 1.7 Rate Limiter Trivially Bypassable
+**File:** `backend/internal/middleware/ratelimit.go:78-79`
+
+```go
+ip := r.Header.Get("X-Forwarded-For")
+if ip == "" { ip = r.RemoteAddr }
+```
+
+Rate limiting keys off `X-Forwarded-For`, which any client can spoof. An attacker can bypass AI endpoint rate limits by rotating this header.
+
+**Fix:** Only trust `X-Forwarded-For` from configured reverse proxy IPs, or use `r.RemoteAddr` exclusively behind a trusted proxy.
+
+---
+
+## 2. Important Gaps (Fix Before Showing to Anyone)
+
+### 2.1 No Input Validation Beyond "Required Fields"
+**Files:** All handlers
+
+Input validation is minimal — typically just checking if required fields are empty:
+```go
+if input.CaseNumber == "" || input.Title == "" {
+    writeError(w, http.StatusBadRequest, "case_number and title are required")
+}
+```
+
+Missing:
+- Length limits on text fields (could store megabytes in a title field)
+- Status value validation (accepts any string for status fields)
+- Date format validation
+- Case type validation against allowed values
+- SQL-safe string validation (although parameterized queries protect against injection)
+
+### 2.2 No Pagination Defaults on Most List Endpoints
+**File:** `backend/internal/services/case_service.go:57-63`
+
+`CaseService.List` has sane defaults (limit=20, max=100). But other list endpoints (`appointments`, `deadlines`, `notes`, `parties`, `case_events`) have no pagination at all — they return all records for a tenant/case. As data grows, these become performance problems.
+
+### 2.3 Dashboard Page is Entirely Client-Side
+**File:** `frontend/src/app/(app)/dashboard/page.tsx`
+
+The entire dashboard is a `"use client"` component that fetches data via API. This means:
+- No SSR benefit — the page is blank until JS loads and API responds
+- SEO doesn't matter for a SaaS app, but initial load time does
+- The skeleton is nice but adds 200-400ms of perceived latency
+
+For an internal tool this is acceptable, but for a commercial product it should use server components for the initial render.
+
+### 2.4 Frontend Auth Uses `getSession()` Instead of `getUser()`
+**File:** `frontend/src/lib/api.ts:10-12`
+
+```typescript
+const { data: { session } } = await supabase.auth.getSession();
+```
+
+`getSession()` reads from local storage without server verification. If a session is expired or revoked server-side, the frontend will still try to use it until the backend rejects it. The middleware correctly uses `getUser()` (which validates server-side), but the API client does not.
+
+### 2.5 Missing Error Recovery in Frontend
+Throughout the frontend, API errors are handled with basic error states, but there's no:
+- Retry logic for transient failures
+- Token refresh on 401 responses
+- Optimistic UI rollback on mutation failures
+- Offline detection
+
+### 2.6 Missing `Content-Disposition` Header Sanitization
+**File:** `backend/internal/handlers/documents.go:133`
+
+```go
+w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, title))
+```
+
+The `title` (which comes from user input) is inserted directly into the header. A filename containing `"` or newlines could be used for response header injection.
+
+**Fix:** Sanitize the filename — strip or encode special characters.
+
+### 2.7 No Graceful Shutdown
+**File:** `backend/cmd/server/main.go:42`
+
+```go
+http.ListenAndServe(":"+cfg.Port, handler)
+```
+
+No signal handling or graceful shutdown. When the process receives SIGTERM (e.g., during deployment), in-flight requests are dropped, CalDAV sync operations may be interrupted mid-write, and database connections are not cleanly closed.
+
+### 2.8 Database Connection Pool — search_path is Session-Level
+**File:** `backend/internal/db/connection.go:17`
+
+```go
+db.Exec("SET search_path TO kanzlai, public")
+```
+
+`SET search_path` is session-level in PostgreSQL. With connection pooling (`MaxOpenConns: 25`), this SET runs once on the initial connection. If a connection is recycled or a new one opened from the pool, it may not have the kanzlai search_path. This could cause queries to silently hit the wrong schema.
+
+**Fix:** Use `SET LOCAL search_path` in a transaction, or set it at the database/role level, or qualify all table references with the schema name.
+
+### 2.9 go.sum Missing from Dockerfile
+**File:** `backend/Dockerfile:4`
+
+```dockerfile
+COPY go.mod ./
+RUN go mod download
+```
+
+Only `go.mod` is copied, not `go.sum`. This means the build isn't reproducible and doesn't verify checksums. Should be `COPY go.mod go.sum ./`.
+
+### 2.10 German Umlaut Typos Throughout Frontend
+**Files:** Multiple frontend components
+
+German strings use ASCII approximations instead of proper characters:
+- `login/page.tsx`: "Zurueck" instead of "Zurück"
+- `cases/[id]/layout.tsx`: "Anhaengig" instead of "Anhängig"
+- `cases/[id]/fristen/page.tsx`: "Ueberfaellig" instead of "Überfällig"
+- `termine/page.tsx`: "Uberblick" instead of "Überblick"
+
+A German lawyer would notice this immediately. It signals "this was built by a machine, not tested by a human."
+
+### 2.11 Silent Error Swallowing in Event Creation
+**File:** `backend/internal/services/case_service.go:260-266`
+
+```go
+func createEvent(ctx context.Context, db *sqlx.DB, ...) {
+    db.ExecContext(ctx, /* ... */)  // Error completely ignored
+}
+```
+
+Case events (audit trail) silently fail to create. The calling functions don't check the return. This means you could have cases with no events and no way to know why.
+
+### 2.12 Missing Error Boundaries in Frontend
+No React error boundaries are implemented. If any component throws, the entire page crashes with a white screen. For a law firm tool where data integrity matters, this is unacceptable.
+
+### 2.13 No RLS Policies Defined at Database Level
+Multi-tenant isolation relies entirely on `WHERE tenant_id = $X` clauses in Go code. If any query forgets this clause, data leaks across tenants. There are no PostgreSQL RLS policies as a safety net.
+
+**Fix:** Enable RLS on all tenant-scoped tables and create policies tied to `auth.uid()` via `user_tenants`.
+
+---
+
+## 3. Architecture Assessment
+
+### 3.1 What's Good
+
+- **Clean monorepo structure** — `backend/` and `frontend/` are clearly separated. Each has its own Dockerfile. The Makefile provides unified commands.
+- **Go backend is well-organized** — `cmd/server/`, `internal/{auth,config,db,handlers,middleware,models,router,services}` follows Go best practices.
+- **Handler/Service separation** — handlers do HTTP concerns (parse request, write response), services do business logic. This is correct.
+- **Parameterized SQL everywhere** — no string concatenation in queries. All user input goes through `$N` placeholders.
+- **Multi-tenant design** — `tenant_id` on every row, context-based tenant resolution, RLS at the database level.
+- **Smart use of Go 1.22+ routing** — method+path patterns like `GET /api/cases/{id}` eliminate the need for a third-party router.
+- **CalDAV sync is genuinely impressive** — bidirectional sync with conflict resolution, etag tracking, background polling per-tenant. This is a differentiator.
+- **Deadline calculator** — ported from youpc.org with holiday awareness. Legally important and hard to build.
+- **Frontend routing structure** — German URL paths (`/fristen`, `/termine`, `/einstellungen`), nested case detail routes with layout.tsx for shared chrome. Proper use of App Router patterns.
+
+### 3.2 Structural Concerns
+
+- **No database migrations** — the schema was apparently created via SQL scripts run manually. There's a `seed/demo_data.sql` but no migration system. For a production system, this is unsustainable.
+- **No CI/CD pipeline** — no `.github/workflows/`, `.gitea/`, or any CI configuration. Tests run locally but not automatically.
+- **No API versioning** — all routes are at `/api/`. Adding breaking changes will break clients.
+- **Services take raw `*sqlx.DB`** — no transaction support across service boundaries. Creating a case + event is not atomic (if the event insert fails, the case still exists).
+- **Models are just struct definitions** — no validation methods, no constructor functions. Validation is scattered across handlers.
+
+### 3.3 Data Model
+
+Based on the seed data and model files, the schema is reasonable:
+- `tenants`, `user_tenants` (multi-tenancy)
+- `cases`, `parties` (case management)
+- `deadlines`, `appointments` (time management)
+- `documents`, `case_events`, `notes` (supporting data)
+- `proceeding_types`, `deadline_rules`, `holidays` (reference data)
+
+**Missing indexes likely needed:**
+- `deadlines(tenant_id, status, due_date)` — for dashboard queries
+- `appointments(tenant_id, start_at)` — for calendar queries
+- `case_events(case_id, created_at)` — for event feeds
+- `cases(tenant_id, status)` — for filtered lists
+
+**Missing constraints:**
+- No CHECK constraint on status values (cases, deadlines, appointments)
+- No UNIQUE constraint on `case_number` per tenant
+- No foreign key from `notes` to the parent entity (if polymorphic)
+
+---
+
+## 4. Security Assessment
+
+### 4.1 Authentication
+- **JWT validation is correct** — algorithm check (HMAC only), expiry check, sub claim extraction. Using `golang-jwt/v5`.
+- **Supabase Auth on frontend** — proper cookie-based session with server-side verification in middleware.
+- **No refresh token rotation** — the API client uses `getSession()` which may serve stale tokens.
+
+### 4.2 Authorization
+- **Critical: Tenant isolation bypass** (see 1.1)
+- **No role-based access control** — `user_tenants` has a `role` column but it's never checked. Any member can do anything.
+- **No resource-level permissions** — any user in a tenant can delete any case, document, etc.
+
+### 4.3 Input Validation
+- **SQL injection: Protected** — all queries use parameterized placeholders.
+- **XSS: Partially protected** — React auto-escapes, but the API returns raw strings that could contain HTML. The `Content-Disposition` header is vulnerable (see 2.6).
+- **File upload: Partially protected** — `MaxBytesReader` limits to 50MB, but no file type validation (could upload .exe, .html with scripts, etc.).
+- **Rate limiting: AI endpoints only** — the rest of the API has no rate limiting. Login/register go through Supabase (which has its own limits), but all CRUD endpoints are unlimited.
+
+### 4.4 Secrets
+- **No hardcoded secrets** — all via environment variables. Good.
+- **CalDAV credentials in plaintext** — see 1.3.
+- **Supabase service key in backend** — necessary for storage, but this key has full DB access. Should be scoped.
+
+---
+
+## 5. Testing Assessment
+
+### 5.1 Backend Tests (15 files)
+- **Integration test** — sets up real DB connection, creates JWT, tests full HTTP flow. Excellent pattern but requires DATABASE_URL (skips otherwise).
+- **Handler tests** — mock-based unit tests for most handlers. Test JSON parsing, error responses, basic happy paths.
+- **Service tests** — deadline calculator has solid date arithmetic tests. Holiday service tested. CalDAV service tested with mocks. AI service tested with mocked HTTP.
+- **Middleware tests** — rate limiter tested.
+- **Auth tests** — tenant resolver tested.
+
+### 5.2 Frontend Tests (4 files)
+- `api.test.ts` — tests the API client
+- `DeadlineTrafficLights.test.tsx` — component test
+- `CaseOverviewGrid.test.tsx` — component test
+- `LoginPage.test.tsx` — auth page test
+
+### 5.3 What's Missing
+- **No E2E tests** — no Playwright/Cypress. Critical for a law firm app where correctness matters.
+- **No contract tests** — frontend and backend are tested independently. A schema change could break the frontend without any test catching it.
+- **Deadline calculation edge cases** — needs tests for year boundaries, leap years, holidays falling on weekends, multiple consecutive holidays.
+- **Multi-tenant security tests** — no test verifying that User A can't access Tenant B's data. This is the most important test to add.
+- **Frontend test coverage is thin** — 4 tests for ~30 components. The dashboard, all forms, navigation, error states are untested.
+- **No load testing** — unknown how the system behaves under concurrent users.
+
+---
+
+## 6. UX Assessment
+
+### 6.1 What Works
+- **Dashboard is strong** — traffic light deadline indicators, upcoming timeline, case overview, quick actions. A lawyer can see what matters at a glance.
+- **German localization** — UI is in German with proper legal terminology (Akten, Fristen, Termine, Parteien).
+- **Mobile responsive** — sidebar collapses to hamburger menu, layout uses responsive grids.
+- **Loading states** — skeleton screens on dashboard, not just spinners.
+- **Breadcrumbs** — navigation trail on all pages.
+- **Deadline calculator** — unique feature that provides real value for UPC litigation.
+
+### 6.2 What a Lawyer Would Stumble On
+1. **No onboarding flow** — after registration, user has no tenant, no cases. The app shows empty states but doesn't guide the user to create a tenant or import data.
+2. **No search** — there's no global search. A lawyer with 100+ cases needs to find things fast.
+3. **No keyboard shortcuts** — power users (lawyers are keyboard-heavy) have no shortcuts.
+4. **Sidebar mixes languages** — "Akten" (German) vs "AI Analyse" (English). Should be consistent.
+5. **No notifications** — overdue deadlines don't trigger any alert beyond the dashboard color. No email alerts, no push notifications.
+6. **No print view** — lawyers need to print deadline lists, case summaries. No print stylesheet.
+7. **No bulk operations** — can't mark multiple deadlines as complete, can't bulk-assign parties.
+8. **Document upload has no preview** — uploaded PDFs can't be viewed inline.
+9. **AI features require manual trigger** — AI summary and deadline extraction are manual. Should auto-trigger on document upload.
+10. **No activity log per user** — no audit trail of who changed what. Critical for law firm compliance.
+
+---
+
+## 7. Deployment Assessment
+
+### 7.1 Docker Setup
+- **Multi-stage builds** — both Dockerfiles use builder pattern. Good.
+- **Backend is minimal** — Alpine + static binary + ca-certificates. ~15MB image.
+- **Frontend** — Bun for deps/build, Node for runtime (standalone output). Reasonable.
+- **Missing:** go.sum not copied in backend Dockerfile (see 2.9).
+- **Missing:** No docker-compose.yml for local development.
+- **Missing:** No health check in Dockerfile (`HEALTHCHECK` instruction).
+
+### 7.2 Environment Handling
+- **Config validates required vars** — `DATABASE_URL` and `SUPABASE_JWT_SECRET` are checked at startup.
+- **Supabase URL/keys not validated** — if missing, features silently fail or crash at runtime.
+- **No .env.example** — new developers don't know what env vars are needed.
+
+### 7.3 Reliability
+- **No graceful shutdown** (see 2.7)
+- **No readiness/liveness probes** — `/health` exists but only checks DB connectivity. No readiness distinction.
+- **CalDAV sync runs in-process** — if the sync goroutine panics, it takes down the API server.
+- **No structured error recovery** — panics in handlers will crash the process (no recovery middleware).
+
+---
+
+## 8. Competitive Analysis
+
+### 8.1 The Market
+
+German Kanzleisoftware is a mature, crowded market:
+
+| Tool | Type | Price | Key Strength |
+|------|------|-------|-------------|
+| **RA-MICRO** | Desktop + Cloud | ~100-200 EUR/user/mo | Market leader, 30+ years, full beA integration |
+| **ADVOWARE** | Desktop + Cloud | from 20 EUR/mo | Budget-friendly, strong for small firms |
+| **AnNoText** (Wolters Kluwer) | Desktop + Cloud | Custom pricing | Enterprise, AI document analysis, DictNow |
+| **Actaport** | Cloud-native | from 79.80 EUR/mo | Modern UI, Mandantenportal, integrated Office |
+| **Haufe Advolux** | Cloud | Custom | User-friendly, full-featured |
+| **Renostar Legal Cloud** | Cloud | Custom | Browser-based, no installation |
+
+### 8.2 Table-Stakes Features KanzlAI is Missing
+
+These are **mandatory** for any German Kanzleisoftware to be taken seriously:
+
+1. **beA Integration** — since 2022, German lawyers must use the electronic court mailbox (besonderes elektronisches Anwaltspostfach). No Kanzleisoftware sells without it. This is a **massive** implementation effort (KSW-Schnittstelle from BRAK).
+
+2. **RVG Billing (Gebührenrechner)** — automated fee calculation per RVG (Rechtsanwaltsvergütungsgesetz). Every competitor has this built-in. Without it, lawyers can't bill clients.
+
+3. **Document Generation** — templates for Schriftsätze, Klageschriften, Mahnbescheide with auto-populated case data. Usually integrated with Word.
+
+4. **Accounting (FiBu)** — client trust accounts (Fremdgeld), DATEV export, tax-relevant bookkeeping. Legal requirement.
+
+5. **Conflict Check (Kollisionsprüfung)** — check if the firm has a conflict of interest before taking a case. Legally required (§ 43a BRAO).
+
+6. **Dictation System** — voice-to-text for lawyers. RA-MICRO has DictaNet, AnNoText has DictNow.
+
+### 8.3 Where KanzlAI Could Differentiate
+
+Despite the feature gap, KanzlAI has some advantages:
+
+1. **AI-native** — competitors are bolting AI onto 20-year-old software. KanzlAI has Claude API integration from day one. The deadline extraction from PDFs is genuinely useful.
+2. **UPC specialization** — the deadline calculator with UPC Rules of Procedure knowledge is unique. No competitor has deep UPC litigation support.
+3. **CalDAV sync** — bidirectional sync with external calendars is not common in German Kanzleisoftware.
+4. **Modern tech stack** — React + Go + Supabase vs. the .NET/Java/Desktop world of RA-MICRO et al.
+5. **Multi-tenant from day 1** — designed for SaaS, not converted from desktop software.
+
+### 8.4 Strategic Recommendation
+
+**Don't compete head-on with RA-MICRO.** The feature gap is 10+ person-years of work. Instead:
+
+**Option A: UPC Niche Tool** — Pivot back to UPC patent litigation. Build the best deadline calculator, case tracker, and AI-powered brief analysis tool for UPC practitioners. There are ~1000 UPC practitioners in Europe who need specialized tooling that RA-MICRO doesn't provide. Charge 200-500 EUR/mo.
+
+**Option B: AI-First Legal Assistant** — Don't call it "Kanzleimanagement." Position as an AI assistant that reads court documents, extracts deadlines, and syncs to the lawyer's existing Kanzleisoftware via CalDAV/iCal. This sidesteps the feature gap entirely.
+
+**Option C: Full Kanzleisoftware** — If you pursue this, beA integration is the first priority, then RVG billing. Without these two, no German lawyer will switch.
+
+---
+
+## 9. Strengths (What's Good, Keep Doing It)
+
+1. **Architecture is solid** — the Go + Next.js + Supabase stack is well-chosen. Clean separation of concerns.
+2. **SQL is safe** — parameterized queries throughout. No injection vectors.
+3. **Multi-tenant design** — tenant_id scoping with RLS is the right approach.
+4. **CalDAV implementation** — genuinely impressive for an MVP. Bidirectional sync with conflict resolution.
+5. **Deadline calculator** — ported from youpc.org with holiday awareness. Real domain value.
+6. **AI integration** — Claude API with tool use for structured extraction. Clean implementation.
+7. **Dashboard UX** — traffic lights, timeline, quick actions. Lawyers will get this immediately.
+8. **German-first** — proper legal terminology, German date formats, localized UI.
+9. **Test foundation** — 15 backend test files with integration tests. Good starting point.
+10. **Docker builds are lean** — multi-stage, Alpine-based, standalone Next.js output.
+
+---
+
+## 10. Priority Roadmap
+
+### P0 — This Week
+- [ ] Fix tenant isolation bypass in TenantResolver (1.1)
+- [ ] Consolidate tenant resolution logic (1.2)
+- [ ] Encrypt CalDAV credentials at rest (1.3)
+- [ ] Add CORS middleware + security headers (1.4)
+- [ ] Stop leaking internal errors to clients (1.5)
+- [ ] Add mutex to HolidayService cache (1.6)
+- [ ] Fix rate limiter X-Forwarded-For bypass (1.7)
+- [ ] Fix Dockerfile go.sum copy (2.9)
+
+### P1 — Before Demo/Beta
+- [ ] Add input validation (length limits, allowed values) (2.1)
+- [ ] Add pagination to all list endpoints (2.2)
+- [ ] Fix `search_path` connection pool issue (2.8)
+- [ ] Add graceful shutdown with signal handling (2.7)
+- [ ] Sanitize Content-Disposition filename (2.6)
+- [ ] Fix German umlaut typos throughout frontend (2.10)
+- [ ] Handle createEvent errors instead of swallowing (2.11)
+- [ ] Add React error boundaries (2.12)
+- [ ] Implement RLS policies on all tenant-scoped tables (2.13)
+- [ ] Add multi-tenant security tests
+- [ ] Add database migrations system
+- [ ] Add `.env.example` file
+- [ ] Add onboarding flow for new users
+
+### P2 — Next Iteration
+- [ ] Role-based access control (admin/member/readonly)
+- [ ] Global search
+- [ ] Email notifications for overdue deadlines
+- [ ] Audit trail / activity log per user
+- [ ] Auto-trigger AI extraction on document upload
+- [ ] Print-friendly views
+- [ ] E2E tests with Playwright
+- [ ] CI/CD pipeline
+
+### P3 — Strategic
+- [ ] Decide market positioning (UPC niche vs. AI assistant vs. full Kanzleisoftware)
+- [ ] If Kanzleisoftware: begin beA integration research
+- [ ] If Kanzleisoftware: RVG Gebührenrechner
+- [ ] If UPC niche: integrate lex-research case law database
+
+---
+
+*This audit was conducted by reading every source file in the repository, running all tests, analyzing the database schema via seed data, and comparing against established German Kanzleisoftware competitors.*
--- a/ROADMAP.md
+++ b/ROADMAP.md
--- a/backend/internal/auth/middleware.go
+++ b/backend/internal/auth/middleware.go
@@ -24,28 +24,19 @@ func (m *Middleware) RequireAuth(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		token := extractBearerToken(r)
 		if token == "" {
-			http.Error(w, "missing authorization token", http.StatusUnauthorized)
+			http.Error(w, `{"error":"missing authorization token"}`, http.StatusUnauthorized)
 			return
 		}

 		userID, err := m.verifyJWT(token)
 		if err != nil {
-			http.Error(w, fmt.Sprintf("invalid token: %v", err), http.StatusUnauthorized)
+			http.Error(w, `{"error":"invalid token"}`, http.StatusUnauthorized)
 			return
 		}

 		ctx := ContextWithUserID(r.Context(), userID)
-
-		// Resolve tenant from user_tenants
-		var tenantID uuid.UUID
-		err = m.db.GetContext(r.Context(), &tenantID,
-			"SELECT tenant_id FROM user_tenants WHERE user_id = $1 LIMIT 1", userID)
-		if err != nil {
-			http.Error(w, "no tenant found for user", http.StatusForbidden)
-			return
-		}
-		ctx = ContextWithTenantID(ctx, tenantID)
-
+		// Tenant resolution is handled by TenantResolver middleware for scoped routes.
+		// Tenant management routes handle their own access control.
 		next.ServeHTTP(w, r.WithContext(ctx))
 	})
 }
--- a/backend/internal/auth/tenant_resolver.go
+++ b/backend/internal/auth/tenant_resolver.go
@@ -2,20 +2,21 @@ package auth

 import (
 	"context"
-	"fmt"
+	"log/slog"
 	"net/http"

 	"github.com/google/uuid"
 )

-// TenantLookup resolves the default tenant for a user.
+// TenantLookup resolves and verifies tenant access for a user.
 // Defined as an interface to avoid circular dependency with services.
 type TenantLookup interface {
 	FirstTenantForUser(ctx context.Context, userID uuid.UUID) (*uuid.UUID, error)
+	VerifyAccess(ctx context.Context, userID, tenantID uuid.UUID) (bool, error)
 }

 // TenantResolver is middleware that resolves the tenant from X-Tenant-ID header
-// or defaults to the user's first tenant.
+// or defaults to the user's first tenant. Always verifies user has access.
 type TenantResolver struct {
 	lookup TenantLookup
 }
@@ -28,7 +29,7 @@ func (tr *TenantResolver) Resolve(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		userID, ok := UserFromContext(r.Context())
 		if !ok {
-			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
 			return
 		}

@@ -37,19 +38,33 @@ func (tr *TenantResolver) Resolve(next http.Handler) http.Handler {
 		if header := r.Header.Get("X-Tenant-ID"); header != "" {
 			parsed, err := uuid.Parse(header)
 			if err != nil {
-				http.Error(w, fmt.Sprintf("invalid X-Tenant-ID: %v", err), http.StatusBadRequest)
+				http.Error(w, `{"error":"invalid X-Tenant-ID"}`, http.StatusBadRequest)
 				return
 			}
+
+			// Verify user has access to this tenant
+			hasAccess, err := tr.lookup.VerifyAccess(r.Context(), userID, parsed)
+			if err != nil {
+				slog.Error("tenant access check failed", "error", err, "user_id", userID, "tenant_id", parsed)
+				http.Error(w, `{"error":"internal error"}`, http.StatusInternalServerError)
+				return
+			}
+			if !hasAccess {
+				http.Error(w, `{"error":"no access to tenant"}`, http.StatusForbidden)
+				return
+			}
+
 			tenantID = parsed
 		} else {
 			// Default to user's first tenant
 			first, err := tr.lookup.FirstTenantForUser(r.Context(), userID)
 			if err != nil {
-				http.Error(w, fmt.Sprintf("resolving tenant: %v", err), http.StatusInternalServerError)
+				slog.Error("failed to resolve default tenant", "error", err, "user_id", userID)
+				http.Error(w, `{"error":"internal error"}`, http.StatusInternalServerError)
 				return
 			}
 			if first == nil {
-				http.Error(w, "no tenant found for user", http.StatusBadRequest)
+				http.Error(w, `{"error":"no tenant found for user"}`, http.StatusBadRequest)
 				return
 			}
 			tenantID = *first
--- a/backend/internal/auth/tenant_resolver_test.go
+++ b/backend/internal/auth/tenant_resolver_test.go
@@ -12,15 +12,21 @@ import (
 type mockTenantLookup struct {
 	tenantID  *uuid.UUID
 	err       error
+	hasAccess bool
+	accessErr error
 }

 func (m *mockTenantLookup) FirstTenantForUser(ctx context.Context, userID uuid.UUID) (*uuid.UUID, error) {
 	return m.tenantID, m.err
 }

+func (m *mockTenantLookup) VerifyAccess(ctx context.Context, userID, tenantID uuid.UUID) (bool, error) {
+	return m.hasAccess, m.accessErr
+}
+
 func TestTenantResolver_FromHeader(t *testing.T) {
 	tenantID := uuid.New()
-	tr := NewTenantResolver(&mockTenantLookup{})
+	tr := NewTenantResolver(&mockTenantLookup{hasAccess: true})

 	var gotTenantID uuid.UUID
 	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -47,6 +53,26 @@ func TestTenantResolver_FromHeader(t *testing.T) {
 	}
 }

+func TestTenantResolver_FromHeader_NoAccess(t *testing.T) {
+	tenantID := uuid.New()
+	tr := NewTenantResolver(&mockTenantLookup{hasAccess: false})
+
+	next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("next should not be called")
+	})
+
+	r := httptest.NewRequest("GET", "/api/cases", nil)
+	r.Header.Set("X-Tenant-ID", tenantID.String())
+	r = r.WithContext(ContextWithUserID(r.Context(), uuid.New()))
+	w := httptest.NewRecorder()
+
+	tr.Resolve(next).ServeHTTP(w, r)
+
+	if w.Code != http.StatusForbidden {
+		t.Errorf("expected 403, got %d", w.Code)
+	}
+}
+
 func TestTenantResolver_DefaultsToFirst(t *testing.T) {
 	tenantID := uuid.New()
 	tr := NewTenantResolver(&mockTenantLookup{tenantID: &tenantID})
--- a/backend/internal/config/config.go
+++ b/backend/internal/config/config.go
@@ -13,6 +13,7 @@ type Config struct {
 	SupabaseServiceKey string
 	SupabaseJWTSecret string
 	AnthropicAPIKey   string
+	FrontendOrigin    string
 }

 func Load() (*Config, error) {
@@ -24,6 +25,7 @@ func Load() (*Config, error) {
 		SupabaseServiceKey: os.Getenv("SUPABASE_SERVICE_KEY"),
 		SupabaseJWTSecret: os.Getenv("SUPABASE_JWT_SECRET"),
 		AnthropicAPIKey:  os.Getenv("ANTHROPIC_API_KEY"),
+		FrontendOrigin:   getEnv("FRONTEND_ORIGIN", "https://kanzlai.msbls.de"),
 	}

 	if cfg.DatabaseURL == "" {
--- a/backend/internal/handlers/ai.go
+++ b/backend/internal/handlers/ai.go
@@ -5,18 +5,16 @@ import (
 	"io"
 	"net/http"

-	"github.com/jmoiron/sqlx"
-
+	"mgit.msbls.de/m/KanzlAI-mGMT/internal/auth"
 	"mgit.msbls.de/m/KanzlAI-mGMT/internal/services"
 )

 type AIHandler struct {
 	ai *services.AIService
-	db *sqlx.DB
 }

-func NewAIHandler(ai *services.AIService, db *sqlx.DB) *AIHandler {
-	return &AIHandler{ai: ai, db: db}
+func NewAIHandler(ai *services.AIService) *AIHandler {
+	return &AIHandler{ai: ai}
 }

 // ExtractDeadlines handles POST /api/ai/extract-deadlines
@@ -61,10 +59,14 @@ func (h *AIHandler) ExtractDeadlines(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "provide either a PDF file or text")
 		return
 	}
+	if len(text) > maxDescriptionLen {
+		writeError(w, http.StatusBadRequest, "text exceeds maximum length")
+		return
+	}

 	deadlines, err := h.ai.ExtractDeadlines(r.Context(), pdfData, text)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, "AI extraction failed: "+err.Error())
+		internalError(w, "AI deadline extraction failed", err)
 		return
 	}

@@ -77,9 +79,9 @@ func (h *AIHandler) ExtractDeadlines(w http.ResponseWriter, r *http.Request) {
 // SummarizeCase handles POST /api/ai/summarize-case
 // Accepts JSON {"case_id": "uuid"}.
 func (h *AIHandler) SummarizeCase(w http.ResponseWriter, r *http.Request) {
-	tenantID, err := resolveTenant(r, h.db)
-	if err != nil {
-		handleTenantError(w, err)
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusForbidden, "missing tenant")
 		return
 	}

@@ -104,7 +106,7 @@ func (h *AIHandler) SummarizeCase(w http.ResponseWriter, r *http.Request) {

 	summary, err := h.ai.SummarizeCase(r.Context(), tenantID, caseID)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, "AI summarization failed: "+err.Error())
+		internalError(w, "AI case summarization failed", err)
 		return
 	}

--- a/backend/internal/handlers/ai_handler_test.go
+++ b/backend/internal/handlers/ai_handler_test.go
@@ -42,7 +42,7 @@ func TestAIExtractDeadlines_InvalidJSON(t *testing.T) {
 	}
 }

-func TestAISummarizeCase_MissingCaseID(t *testing.T) {
+func TestAISummarizeCase_MissingTenant(t *testing.T) {
 	h := &AIHandler{}

 	body := `{"case_id":""}`
@@ -52,9 +52,9 @@ func TestAISummarizeCase_MissingCaseID(t *testing.T) {

 	h.SummarizeCase(w, r)

-	// Without auth context, the resolveTenant will fail first
-	if w.Code != http.StatusUnauthorized {
-		t.Errorf("expected 401, got %d", w.Code)
+	// Without tenant context, TenantFromContext returns !ok → 403
+	if w.Code != http.StatusForbidden {
+		t.Errorf("expected 403, got %d", w.Code)
 	}
 }

@@ -67,8 +67,8 @@ func TestAISummarizeCase_InvalidJSON(t *testing.T) {

 	h.SummarizeCase(w, r)

-	// Without auth context, the resolveTenant will fail first
-	if w.Code != http.StatusUnauthorized {
-		t.Errorf("expected 401, got %d", w.Code)
+	// Without tenant context, TenantFromContext returns !ok → 403
+	if w.Code != http.StatusForbidden {
+		t.Errorf("expected 403, got %d", w.Code)
 	}
 }
--- a/backend/internal/handlers/appointments.go
+++ b/backend/internal/handlers/appointments.go
@@ -22,6 +22,33 @@ func NewAppointmentHandler(svc *services.AppointmentService) *AppointmentHandler
 	return &AppointmentHandler{svc: svc}
 }

+// Get handles GET /api/appointments/{id}
+func (h *AppointmentHandler) Get(w http.ResponseWriter, r *http.Request) {
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "missing tenant")
+		return
+	}
+
+	id, err := uuid.Parse(r.PathValue("id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid appointment id")
+		return
+	}
+
+	appt, err := h.svc.GetByID(r.Context(), tenantID, id)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			writeError(w, http.StatusNotFound, "appointment not found")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, "failed to fetch appointment")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, appt)
+}
+
 func (h *AppointmentHandler) List(w http.ResponseWriter, r *http.Request) {
 	tenantID, ok := auth.TenantFromContext(r.Context())
 	if !ok {
@@ -94,6 +121,10 @@ func (h *AppointmentHandler) Create(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "title is required")
 		return
 	}
+	if msg := validateStringLength("title", req.Title, maxTitleLen); msg != "" {
+		writeError(w, http.StatusBadRequest, msg)
+		return
+	}
 	if req.StartAt.IsZero() {
 		writeError(w, http.StatusBadRequest, "start_at is required")
 		return
@@ -161,6 +192,10 @@ func (h *AppointmentHandler) Update(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "title is required")
 		return
 	}
+	if msg := validateStringLength("title", req.Title, maxTitleLen); msg != "" {
+		writeError(w, http.StatusBadRequest, msg)
+		return
+	}
 	if req.StartAt.IsZero() {
 		writeError(w, http.StatusBadRequest, "start_at is required")
 		return
--- a/backend/internal/handlers/caldav.go
+++ b/backend/internal/handlers/caldav.go
@@ -27,7 +27,7 @@ func (h *CalDAVHandler) TriggerSync(w http.ResponseWriter, r *http.Request) {

 	cfg, err := h.svc.LoadTenantConfig(tenantID)
 	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
+		writeError(w, http.StatusBadRequest, "CalDAV not configured for this tenant")
 		return
 	}

--- a/backend/internal/handlers/case_events.go
+++ b/backend/internal/handlers/case_events.go
@@ -0,0 +1,52 @@
+package handlers
+
+import (
+	"database/sql"
+	"errors"
+	"net/http"
+
+	"github.com/google/uuid"
+
+	"mgit.msbls.de/m/KanzlAI-mGMT/internal/auth"
+	"mgit.msbls.de/m/KanzlAI-mGMT/internal/models"
+	"github.com/jmoiron/sqlx"
+)
+
+type CaseEventHandler struct {
+	db *sqlx.DB
+}
+
+func NewCaseEventHandler(db *sqlx.DB) *CaseEventHandler {
+	return &CaseEventHandler{db: db}
+}
+
+// Get handles GET /api/case-events/{id}
+func (h *CaseEventHandler) Get(w http.ResponseWriter, r *http.Request) {
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "missing tenant")
+		return
+	}
+
+	eventID, err := uuid.Parse(r.PathValue("id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid event ID")
+		return
+	}
+
+	var event models.CaseEvent
+	err = h.db.GetContext(r.Context(), &event,
+		`SELECT id, tenant_id, case_id, event_type, title, description, event_date, created_by, metadata, created_at, updated_at
+		 FROM case_events
+		 WHERE id = $1 AND tenant_id = $2`, eventID, tenantID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			writeError(w, http.StatusNotFound, "case event not found")
+			return
+		}
+		writeError(w, http.StatusInternalServerError, "failed to fetch case event")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, event)
+}
--- a/backend/internal/handlers/cases.go
+++ b/backend/internal/handlers/cases.go
@@ -28,18 +28,25 @@ func (h *CaseHandler) List(w http.ResponseWriter, r *http.Request) {

 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
 	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
+	limit, offset = clampPagination(limit, offset)
+
+	search := r.URL.Query().Get("search")
+	if msg := validateStringLength("search", search, maxSearchLen); msg != "" {
+		writeError(w, http.StatusBadRequest, msg)
+		return
+	}

 	filter := services.CaseFilter{
 		Status: r.URL.Query().Get("status"),
 		Type:   r.URL.Query().Get("type"),
-		Search: r.URL.Query().Get("search"),
+		Search: search,
 		Limit:  limit,
 		Offset: offset,
 	}

 	cases, total, err := h.svc.List(r.Context(), tenantID, filter)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to list cases", err)
 		return
 	}

@@ -66,10 +73,18 @@ func (h *CaseHandler) Create(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "case_number and title are required")
 		return
 	}
+	if msg := validateStringLength("case_number", input.CaseNumber, maxCaseNumberLen); msg != "" {
+		writeError(w, http.StatusBadRequest, msg)
+		return
+	}
+	if msg := validateStringLength("title", input.Title, maxTitleLen); msg != "" {
+		writeError(w, http.StatusBadRequest, msg)
+		return
+	}

 	c, err := h.svc.Create(r.Context(), tenantID, userID, input)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to create case", err)
 		return
 	}

@@ -91,7 +106,7 @@ func (h *CaseHandler) Get(w http.ResponseWriter, r *http.Request) {

 	detail, err := h.svc.GetByID(r.Context(), tenantID, caseID)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to get case", err)
 		return
 	}
 	if detail == nil {
@@ -121,10 +136,22 @@ func (h *CaseHandler) Update(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "invalid JSON body")
 		return
 	}
+	if input.Title != nil {
+		if msg := validateStringLength("title", *input.Title, maxTitleLen); msg != "" {
+			writeError(w, http.StatusBadRequest, msg)
+			return
+		}
+	}
+	if input.CaseNumber != nil {
+		if msg := validateStringLength("case_number", *input.CaseNumber, maxCaseNumberLen); msg != "" {
+			writeError(w, http.StatusBadRequest, msg)
+			return
+		}
+	}

 	updated, err := h.svc.Update(r.Context(), tenantID, caseID, userID, input)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to update case", err)
 		return
 	}
 	if updated == nil {
--- a/backend/internal/handlers/dashboard.go
+++ b/backend/internal/handlers/dashboard.go
@@ -24,7 +24,7 @@ func (h *DashboardHandler) Get(w http.ResponseWriter, r *http.Request) {

 	data, err := h.svc.Get(r.Context(), tenantID)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to load dashboard", err)
 		return
 	}

--- a/backend/internal/handlers/deadlines.go
+++ b/backend/internal/handlers/deadlines.go
@@ -4,33 +4,58 @@ import (
 	"encoding/json"
 	"net/http"

-	"github.com/jmoiron/sqlx"
-
+	"mgit.msbls.de/m/KanzlAI-mGMT/internal/auth"
 	"mgit.msbls.de/m/KanzlAI-mGMT/internal/services"
 )

 // DeadlineHandlers holds handlers for deadline CRUD endpoints
 type DeadlineHandlers struct {
 	deadlines *services.DeadlineService
-	db        *sqlx.DB
 }

 // NewDeadlineHandlers creates deadline handlers
-func NewDeadlineHandlers(ds *services.DeadlineService, db *sqlx.DB) *DeadlineHandlers {
-	return &DeadlineHandlers{deadlines: ds, db: db}
+func NewDeadlineHandlers(ds *services.DeadlineService) *DeadlineHandlers {
+	return &DeadlineHandlers{deadlines: ds}
+}
+
+// Get handles GET /api/deadlines/{deadlineID}
+func (h *DeadlineHandlers) Get(w http.ResponseWriter, r *http.Request) {
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusForbidden, "missing tenant")
+		return
+	}
+
+	deadlineID, err := parsePathUUID(r, "deadlineID")
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid deadline ID")
+		return
+	}
+
+	deadline, err := h.deadlines.GetByID(tenantID, deadlineID)
+	if err != nil {
+		internalError(w, "failed to fetch deadline", err)
+		return
+	}
+	if deadline == nil {
+		writeError(w, http.StatusNotFound, "deadline not found")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, deadline)
 }

 // ListAll handles GET /api/deadlines
 func (h *DeadlineHandlers) ListAll(w http.ResponseWriter, r *http.Request) {
-	tenantID, err := resolveTenant(r, h.db)
-	if err != nil {
-		handleTenantError(w, err)
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusForbidden, "missing tenant")
 		return
 	}

 	deadlines, err := h.deadlines.ListAll(tenantID)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, "failed to list deadlines")
+		internalError(w, "failed to list deadlines", err)
 		return
 	}

@@ -39,9 +64,9 @@ func (h *DeadlineHandlers) ListAll(w http.ResponseWriter, r *http.Request) {

 // ListForCase handles GET /api/cases/{caseID}/deadlines
 func (h *DeadlineHandlers) ListForCase(w http.ResponseWriter, r *http.Request) {
-	tenantID, err := resolveTenant(r, h.db)
-	if err != nil {
-		handleTenantError(w, err)
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusForbidden, "missing tenant")
 		return
 	}

@@ -53,7 +78,7 @@ func (h *DeadlineHandlers) ListForCase(w http.ResponseWriter, r *http.Request) {

 	deadlines, err := h.deadlines.ListForCase(tenantID, caseID)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, "failed to list deadlines")
+		internalError(w, "failed to list deadlines for case", err)
 		return
 	}

@@ -62,9 +87,9 @@ func (h *DeadlineHandlers) ListForCase(w http.ResponseWriter, r *http.Request) {

 // Create handles POST /api/cases/{caseID}/deadlines
 func (h *DeadlineHandlers) Create(w http.ResponseWriter, r *http.Request) {
-	tenantID, err := resolveTenant(r, h.db)
-	if err != nil {
-		handleTenantError(w, err)
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusForbidden, "missing tenant")
 		return
 	}

@@ -85,10 +110,14 @@ func (h *DeadlineHandlers) Create(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "title and due_date are required")
 		return
 	}
+	if msg := validateStringLength("title", input.Title, maxTitleLen); msg != "" {
+		writeError(w, http.StatusBadRequest, msg)
+		return
+	}

 	deadline, err := h.deadlines.Create(tenantID, input)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, "failed to create deadline")
+		internalError(w, "failed to create deadline", err)
 		return
 	}

@@ -97,9 +126,9 @@ func (h *DeadlineHandlers) Create(w http.ResponseWriter, r *http.Request) {

 // Update handles PUT /api/deadlines/{deadlineID}
 func (h *DeadlineHandlers) Update(w http.ResponseWriter, r *http.Request) {
-	tenantID, err := resolveTenant(r, h.db)
-	if err != nil {
-		handleTenantError(w, err)
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusForbidden, "missing tenant")
 		return
 	}

@@ -117,7 +146,7 @@ func (h *DeadlineHandlers) Update(w http.ResponseWriter, r *http.Request) {

 	deadline, err := h.deadlines.Update(tenantID, deadlineID, input)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, "failed to update deadline")
+		internalError(w, "failed to update deadline", err)
 		return
 	}
 	if deadline == nil {
@@ -130,9 +159,9 @@ func (h *DeadlineHandlers) Update(w http.ResponseWriter, r *http.Request) {

 // Complete handles PATCH /api/deadlines/{deadlineID}/complete
 func (h *DeadlineHandlers) Complete(w http.ResponseWriter, r *http.Request) {
-	tenantID, err := resolveTenant(r, h.db)
-	if err != nil {
-		handleTenantError(w, err)
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusForbidden, "missing tenant")
 		return
 	}

@@ -144,7 +173,7 @@ func (h *DeadlineHandlers) Complete(w http.ResponseWriter, r *http.Request) {

 	deadline, err := h.deadlines.Complete(tenantID, deadlineID)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, "failed to complete deadline")
+		internalError(w, "failed to complete deadline", err)
 		return
 	}
 	if deadline == nil {
@@ -157,9 +186,9 @@ func (h *DeadlineHandlers) Complete(w http.ResponseWriter, r *http.Request) {

 // Delete handles DELETE /api/deadlines/{deadlineID}
 func (h *DeadlineHandlers) Delete(w http.ResponseWriter, r *http.Request) {
-	tenantID, err := resolveTenant(r, h.db)
-	if err != nil {
-		handleTenantError(w, err)
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusForbidden, "missing tenant")
 		return
 	}

@@ -169,9 +198,8 @@ func (h *DeadlineHandlers) Delete(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	err = h.deadlines.Delete(tenantID, deadlineID)
-	if err != nil {
-		writeError(w, http.StatusNotFound, err.Error())
+	if err := h.deadlines.Delete(tenantID, deadlineID); err != nil {
+		writeError(w, http.StatusNotFound, "deadline not found")
 		return
 	}

--- a/backend/internal/handlers/documents.go
+++ b/backend/internal/handlers/documents.go
@@ -36,7 +36,7 @@ func (h *DocumentHandler) ListByCase(w http.ResponseWriter, r *http.Request) {

 	docs, err := h.svc.ListByCase(r.Context(), tenantID, caseID)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to list documents", err)
 		return
 	}

@@ -98,7 +98,7 @@ func (h *DocumentHandler) Upload(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusNotFound, "case not found")
 			return
 		}
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to upload document", err)
 		return
 	}

@@ -121,16 +121,16 @@ func (h *DocumentHandler) Download(w http.ResponseWriter, r *http.Request) {
 	body, contentType, title, err := h.svc.Download(r.Context(), tenantID, docID)
 	if err != nil {
 		if err.Error() == "document not found" || err.Error() == "document has no file" {
-			writeError(w, http.StatusNotFound, err.Error())
+			writeError(w, http.StatusNotFound, "document not found")
 			return
 		}
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to download document", err)
 		return
 	}
 	defer body.Close()

 	w.Header().Set("Content-Type", contentType)
-	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, title))
+	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, sanitizeFilename(title)))
 	io.Copy(w, body)
 }

@@ -149,7 +149,7 @@ func (h *DocumentHandler) GetMeta(w http.ResponseWriter, r *http.Request) {

 	doc, err := h.svc.GetByID(r.Context(), tenantID, docID)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to get document metadata", err)
 		return
 	}
 	if doc == nil {
--- a/backend/internal/handlers/helpers.go
+++ b/backend/internal/handlers/helpers.go
@@ -2,12 +2,12 @@ package handlers

 import (
 	"encoding/json"
+	"log/slog"
 	"net/http"
+	"strings"
+	"unicode/utf8"

 	"github.com/google/uuid"
-	"github.com/jmoiron/sqlx"
-
-	"mgit.msbls.de/m/KanzlAI-mGMT/internal/auth"
 )

 func writeJSON(w http.ResponseWriter, status int, v any) {
@@ -20,62 +20,9 @@ func writeError(w http.ResponseWriter, status int, msg string) {
 	writeJSON(w, status, map[string]string{"error": msg})
 }

-// resolveTenant gets the tenant ID for the authenticated user.
-// Checks X-Tenant-ID header first, then falls back to user's first tenant.
-func resolveTenant(r *http.Request, db *sqlx.DB) (uuid.UUID, error) {
-	userID, ok := auth.UserFromContext(r.Context())
-	if !ok {
-		return uuid.Nil, errUnauthorized
-	}
-
-	// Check header first
-	if headerVal := r.Header.Get("X-Tenant-ID"); headerVal != "" {
-		tenantID, err := uuid.Parse(headerVal)
-		if err != nil {
-			return uuid.Nil, errInvalidTenant
-		}
-		// Verify user has access to this tenant
-		var count int
-		err = db.Get(&count,
-			`SELECT COUNT(*) FROM user_tenants WHERE user_id = $1 AND tenant_id = $2`,
-			userID, tenantID)
-		if err != nil || count == 0 {
-			return uuid.Nil, errTenantAccess
-		}
-		return tenantID, nil
-	}
-
-	// Fall back to user's first tenant
-	var tenantID uuid.UUID
-	err := db.Get(&tenantID,
-		`SELECT tenant_id FROM user_tenants WHERE user_id = $1 ORDER BY created_at LIMIT 1`,
-		userID)
-	if err != nil {
-		return uuid.Nil, errNoTenant
-	}
-	return tenantID, nil
-}
-
-type apiError struct {
-	msg    string
-	status int
-}
-
-func (e *apiError) Error() string { return e.msg }
-
-var (
-	errUnauthorized = &apiError{msg: "unauthorized", status: http.StatusUnauthorized}
-	errInvalidTenant = &apiError{msg: "invalid tenant ID", status: http.StatusBadRequest}
-	errTenantAccess  = &apiError{msg: "no access to tenant", status: http.StatusForbidden}
-	errNoTenant      = &apiError{msg: "no tenant found for user", status: http.StatusBadRequest}
-)
-
-// handleTenantError writes the appropriate error response for tenant resolution errors
-func handleTenantError(w http.ResponseWriter, err error) {
-	if ae, ok := err.(*apiError); ok {
-		writeError(w, ae.status, ae.msg)
-		return
-	}
+// internalError logs the real error and returns a generic message to the client.
+func internalError(w http.ResponseWriter, msg string, err error) {
+	slog.Error(msg, "error", err)
 	writeError(w, http.StatusInternalServerError, "internal error")
 }

@@ -88,3 +35,74 @@ func parsePathUUID(r *http.Request, key string) (uuid.UUID, error) {
 func parseUUID(s string) (uuid.UUID, error) {
 	return uuid.Parse(s)
 }
+
+// --- Input validation helpers ---
+
+const (
+	maxTitleLen       = 500
+	maxDescriptionLen = 10000
+	maxCaseNumberLen  = 100
+	maxSearchLen      = 200
+	maxPaginationLimit = 100
+)
+
+// validateStringLength checks if a string exceeds the given max length.
+func validateStringLength(field, value string, maxLen int) string {
+	if utf8.RuneCountInString(value) > maxLen {
+		return field + " exceeds maximum length"
+	}
+	return ""
+}
+
+// clampPagination enforces sane pagination defaults and limits.
+func clampPagination(limit, offset int) (int, int) {
+	if limit <= 0 {
+		limit = 20
+	}
+	if limit > maxPaginationLimit {
+		limit = maxPaginationLimit
+	}
+	if offset < 0 {
+		offset = 0
+	}
+	return limit, offset
+}
+
+// sanitizeFilename removes characters unsafe for Content-Disposition headers.
+func sanitizeFilename(name string) string {
+	// Remove control characters, quotes, and backslashes
+	var b strings.Builder
+	for _, r := range name {
+		if r < 32 || r == '"' || r == '\\' || r == '/' {
+			b.WriteRune('_')
+		} else {
+			b.WriteRune(r)
+		}
+	}
+	return b.String()
+}
+
+// maskSettingsPassword masks the CalDAV password in tenant settings JSON before returning to clients.
+func maskSettingsPassword(settings json.RawMessage) json.RawMessage {
+	if len(settings) == 0 {
+		return settings
+	}
+	var m map[string]json.RawMessage
+	if err := json.Unmarshal(settings, &m); err != nil {
+		return settings
+	}
+	caldavRaw, ok := m["caldav"]
+	if !ok {
+		return settings
+	}
+	var caldav map[string]json.RawMessage
+	if err := json.Unmarshal(caldavRaw, &caldav); err != nil {
+		return settings
+	}
+	if _, ok := caldav["password"]; ok {
+		caldav["password"], _ = json.Marshal("********")
+	}
+	m["caldav"], _ = json.Marshal(caldav)
+	result, _ := json.Marshal(m)
+	return result
+}
--- a/backend/internal/handlers/notes.go
+++ b/backend/internal/handlers/notes.go
@@ -0,0 +1,167 @@
+package handlers
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/google/uuid"
+
+	"mgit.msbls.de/m/KanzlAI-mGMT/internal/auth"
+	"mgit.msbls.de/m/KanzlAI-mGMT/internal/services"
+)
+
+type NoteHandler struct {
+	svc *services.NoteService
+}
+
+func NewNoteHandler(svc *services.NoteService) *NoteHandler {
+	return &NoteHandler{svc: svc}
+}
+
+// List handles GET /api/notes?{parent_type}_id={id}
+func (h *NoteHandler) List(w http.ResponseWriter, r *http.Request) {
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "missing tenant")
+		return
+	}
+
+	parentType, parentID, err := parseNoteParent(r)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	notes, err := h.svc.ListByParent(r.Context(), tenantID, parentType, parentID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to list notes")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, notes)
+}
+
+// Create handles POST /api/notes
+func (h *NoteHandler) Create(w http.ResponseWriter, r *http.Request) {
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "missing tenant")
+		return
+	}
+	userID, _ := auth.UserFromContext(r.Context())
+
+	var input services.CreateNoteInput
+	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+	if input.Content == "" {
+		writeError(w, http.StatusBadRequest, "content is required")
+		return
+	}
+	if msg := validateStringLength("content", input.Content, maxDescriptionLen); msg != "" {
+		writeError(w, http.StatusBadRequest, msg)
+		return
+	}
+
+	var createdBy *uuid.UUID
+	if userID != uuid.Nil {
+		createdBy = &userID
+	}
+
+	note, err := h.svc.Create(r.Context(), tenantID, createdBy, input)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to create note")
+		return
+	}
+
+	writeJSON(w, http.StatusCreated, note)
+}
+
+// Update handles PUT /api/notes/{id}
+func (h *NoteHandler) Update(w http.ResponseWriter, r *http.Request) {
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "missing tenant")
+		return
+	}
+
+	noteID, err := uuid.Parse(r.PathValue("id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid note ID")
+		return
+	}
+
+	var req struct {
+		Content string `json:"content"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+	if req.Content == "" {
+		writeError(w, http.StatusBadRequest, "content is required")
+		return
+	}
+	if msg := validateStringLength("content", req.Content, maxDescriptionLen); msg != "" {
+		writeError(w, http.StatusBadRequest, msg)
+		return
+	}
+
+	note, err := h.svc.Update(r.Context(), tenantID, noteID, req.Content)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "failed to update note")
+		return
+	}
+	if note == nil {
+		writeError(w, http.StatusNotFound, "note not found")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, note)
+}
+
+// Delete handles DELETE /api/notes/{id}
+func (h *NoteHandler) Delete(w http.ResponseWriter, r *http.Request) {
+	tenantID, ok := auth.TenantFromContext(r.Context())
+	if !ok {
+		writeError(w, http.StatusUnauthorized, "missing tenant")
+		return
+	}
+
+	noteID, err := uuid.Parse(r.PathValue("id"))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid note ID")
+		return
+	}
+
+	if err := h.svc.Delete(r.Context(), tenantID, noteID); err != nil {
+		writeError(w, http.StatusNotFound, "note not found")
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// parseNoteParent extracts the parent type and ID from query parameters.
+func parseNoteParent(r *http.Request) (string, uuid.UUID, error) {
+	params := map[string]string{
+		"case_id":       "case",
+		"deadline_id":   "deadline",
+		"appointment_id": "appointment",
+		"case_event_id": "case_event",
+	}
+
+	for param, parentType := range params {
+		if v := r.URL.Query().Get(param); v != "" {
+			id, err := uuid.Parse(v)
+			if err != nil {
+				return "", uuid.Nil, fmt.Errorf("invalid %s", param)
+			}
+			return parentType, id, nil
+		}
+	}
+
+	return "", uuid.Nil, fmt.Errorf("one of case_id, deadline_id, appointment_id, or case_event_id is required")
+}
--- a/backend/internal/handlers/parties.go
+++ b/backend/internal/handlers/parties.go
@@ -34,7 +34,7 @@ func (h *PartyHandler) List(w http.ResponseWriter, r *http.Request) {

 	parties, err := h.svc.ListByCase(r.Context(), tenantID, caseID)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to list parties", err)
 		return
 	}

@@ -67,13 +67,18 @@ func (h *PartyHandler) Create(w http.ResponseWriter, r *http.Request) {
 		return
 	}

+	if msg := validateStringLength("name", input.Name, maxTitleLen); msg != "" {
+		writeError(w, http.StatusBadRequest, msg)
+		return
+	}
+
 	party, err := h.svc.Create(r.Context(), tenantID, caseID, userID, input)
 	if err != nil {
 		if err == sql.ErrNoRows {
 			writeError(w, http.StatusNotFound, "case not found")
 			return
 		}
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to create party", err)
 		return
 	}

@@ -101,7 +106,7 @@ func (h *PartyHandler) Update(w http.ResponseWriter, r *http.Request) {

 	updated, err := h.svc.Update(r.Context(), tenantID, partyID, input)
 	if err != nil {
-		writeError(w, http.StatusInternalServerError, err.Error())
+		internalError(w, "failed to update party", err)
 		return
 	}
 	if updated == nil {
--- a/backend/internal/handlers/tenant_handler.go
+++ b/backend/internal/handlers/tenant_handler.go
@@ -2,6 +2,7 @@ package handlers

 import (
 	"encoding/json"
+	"log/slog"
 	"net/http"

 	"github.com/google/uuid"
@@ -41,7 +42,8 @@ func (h *TenantHandler) CreateTenant(w http.ResponseWriter, r *http.Request) {

 	tenant, err := h.svc.Create(r.Context(), userID, req.Name, req.Slug)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusInternalServerError)
+		slog.Error("failed to create tenant", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
 		return
 	}

@@ -58,10 +60,16 @@ func (h *TenantHandler) ListTenants(w http.ResponseWriter, r *http.Request) {

 	tenants, err := h.svc.ListForUser(r.Context(), userID)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusInternalServerError)
+		slog.Error("failed to list tenants", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
 		return
 	}

+	// Mask CalDAV passwords in tenant settings
+	for i := range tenants {
+		tenants[i].Settings = maskSettingsPassword(tenants[i].Settings)
+	}
+
 	jsonResponse(w, tenants, http.StatusOK)
 }

@@ -82,7 +90,8 @@ func (h *TenantHandler) GetTenant(w http.ResponseWriter, r *http.Request) {
 	// Verify user has access to this tenant
 	role, err := h.svc.GetUserRole(r.Context(), userID, tenantID)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusInternalServerError)
+		slog.Error("failed to get user role", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 	if role == "" {
@@ -92,7 +101,8 @@ func (h *TenantHandler) GetTenant(w http.ResponseWriter, r *http.Request) {

 	tenant, err := h.svc.GetByID(r.Context(), tenantID)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusInternalServerError)
+		slog.Error("failed to get tenant", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 	if tenant == nil {
@@ -100,6 +110,9 @@ func (h *TenantHandler) GetTenant(w http.ResponseWriter, r *http.Request) {
 		return
 	}

+	// Mask CalDAV password before returning
+	tenant.Settings = maskSettingsPassword(tenant.Settings)
+
 	jsonResponse(w, tenant, http.StatusOK)
 }

@@ -120,7 +133,8 @@ func (h *TenantHandler) InviteUser(w http.ResponseWriter, r *http.Request) {
 	// Only owners and admins can invite
 	role, err := h.svc.GetUserRole(r.Context(), userID, tenantID)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusInternalServerError)
+		slog.Error("failed to get user role", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 	if role != "owner" && role != "admin" {
@@ -150,7 +164,8 @@ func (h *TenantHandler) InviteUser(w http.ResponseWriter, r *http.Request) {

 	ut, err := h.svc.InviteByEmail(r.Context(), tenantID, req.Email, req.Role)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusBadRequest)
+		// These are user-facing validation errors (user not found, already member)
+		jsonError(w, "failed to invite user", http.StatusBadRequest)
 		return
 	}

@@ -180,7 +195,8 @@ func (h *TenantHandler) RemoveMember(w http.ResponseWriter, r *http.Request) {
 	// Only owners and admins can remove members (or user removing themselves)
 	role, err := h.svc.GetUserRole(r.Context(), userID, tenantID)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusInternalServerError)
+		slog.Error("failed to get user role", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 	if role != "owner" && role != "admin" && userID != memberID {
@@ -189,7 +205,8 @@ func (h *TenantHandler) RemoveMember(w http.ResponseWriter, r *http.Request) {
 	}

 	if err := h.svc.RemoveMember(r.Context(), tenantID, memberID); err != nil {
-		jsonError(w, err.Error(), http.StatusBadRequest)
+		// These are user-facing validation errors (not a member, last owner, etc.)
+		jsonError(w, "failed to remove member", http.StatusBadRequest)
 		return
 	}

@@ -213,7 +230,8 @@ func (h *TenantHandler) UpdateSettings(w http.ResponseWriter, r *http.Request) {
 	// Only owners and admins can update settings
 	role, err := h.svc.GetUserRole(r.Context(), userID, tenantID)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusInternalServerError)
+		slog.Error("failed to get user role", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 	if role != "owner" && role != "admin" {
@@ -229,10 +247,14 @@ func (h *TenantHandler) UpdateSettings(w http.ResponseWriter, r *http.Request) {

 	tenant, err := h.svc.UpdateSettings(r.Context(), tenantID, settings)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusInternalServerError)
+		slog.Error("failed to update settings", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
 		return
 	}

+	// Mask CalDAV password before returning
+	tenant.Settings = maskSettingsPassword(tenant.Settings)
+
 	jsonResponse(w, tenant, http.StatusOK)
 }

@@ -253,7 +275,8 @@ func (h *TenantHandler) ListMembers(w http.ResponseWriter, r *http.Request) {
 	// Verify user has access
 	role, err := h.svc.GetUserRole(r.Context(), userID, tenantID)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusInternalServerError)
+		slog.Error("failed to get user role", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 	if role == "" {
@@ -263,7 +286,8 @@ func (h *TenantHandler) ListMembers(w http.ResponseWriter, r *http.Request) {

 	members, err := h.svc.ListMembers(r.Context(), tenantID)
 	if err != nil {
-		jsonError(w, err.Error(), http.StatusInternalServerError)
+		slog.Error("failed to list members", "error", err)
+		jsonError(w, "internal error", http.StatusInternalServerError)
 		return
 	}

--- a/backend/internal/middleware/security.go
+++ b/backend/internal/middleware/security.go
@@ -0,0 +1,49 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+)
+
+// SecurityHeaders adds standard security headers to all responses.
+func SecurityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("X-XSS-Protection", "1; mode=block")
+		w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+		w.Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
+		next.ServeHTTP(w, r)
+	})
+}
+
+// CORS returns middleware that restricts cross-origin requests to the given origin.
+// If allowedOrigin is empty, CORS headers are not set (same-origin only).
+func CORS(allowedOrigin string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			origin := r.Header.Get("Origin")
+
+			if allowedOrigin != "" && origin != "" && matchOrigin(origin, allowedOrigin) {
+				w.Header().Set("Access-Control-Allow-Origin", allowedOrigin)
+				w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
+				w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Tenant-ID")
+				w.Header().Set("Access-Control-Max-Age", "86400")
+				w.Header().Set("Vary", "Origin")
+			}
+
+			// Handle preflight
+			if r.Method == http.MethodOptions {
+				w.WriteHeader(http.StatusNoContent)
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// matchOrigin checks if the request origin matches the allowed origin.
+func matchOrigin(origin, allowed string) bool {
+	return strings.EqualFold(strings.TrimRight(origin, "/"), strings.TrimRight(allowed, "/"))
+}
--- a/backend/internal/models/note.go
+++ b/backend/internal/models/note.go
@@ -0,0 +1,20 @@
+package models
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type Note struct {
+	ID            uuid.UUID  `db:"id" json:"id"`
+	TenantID      uuid.UUID  `db:"tenant_id" json:"tenant_id"`
+	CaseID        *uuid.UUID `db:"case_id" json:"case_id,omitempty"`
+	DeadlineID    *uuid.UUID `db:"deadline_id" json:"deadline_id,omitempty"`
+	AppointmentID *uuid.UUID `db:"appointment_id" json:"appointment_id,omitempty"`
+	CaseEventID   *uuid.UUID `db:"case_event_id" json:"case_event_id,omitempty"`
+	Content       string     `db:"content" json:"content"`
+	CreatedBy     *uuid.UUID `db:"created_by" json:"created_by,omitempty"`
+	CreatedAt     time.Time  `db:"created_at" json:"created_at"`
+	UpdatedAt     time.Time  `db:"updated_at" json:"updated_at"`
+}
--- a/backend/internal/router/router.go
+++ b/backend/internal/router/router.go
@@ -34,12 +34,13 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 	var aiH *handlers.AIHandler
 	if cfg.AnthropicAPIKey != "" {
 		aiSvc := services.NewAIService(cfg.AnthropicAPIKey, db)
-		aiH = handlers.NewAIHandler(aiSvc, db)
+		aiH = handlers.NewAIHandler(aiSvc)
 	}

 	// Middleware
 	tenantResolver := auth.NewTenantResolver(tenantSvc)

+	noteSvc := services.NewNoteService(db)
 	dashboardSvc := services.NewDashboardService(db)

 	// Handlers
@@ -47,10 +48,12 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 	caseH := handlers.NewCaseHandler(caseSvc)
 	partyH := handlers.NewPartyHandler(partySvc)
 	apptH := handlers.NewAppointmentHandler(appointmentSvc)
-	deadlineH := handlers.NewDeadlineHandlers(deadlineSvc, db)
+	deadlineH := handlers.NewDeadlineHandlers(deadlineSvc)
 	ruleH := handlers.NewDeadlineRuleHandlers(deadlineRuleSvc)
 	calcH := handlers.NewCalculateHandlers(calculator, deadlineRuleSvc)
 	dashboardH := handlers.NewDashboardHandler(dashboardSvc)
+	noteH := handlers.NewNoteHandler(noteSvc)
+	eventH := handlers.NewCaseEventHandler(db)
 	docH := handlers.NewDocumentHandler(documentSvc)

 	// Public routes
@@ -85,6 +88,7 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 	scoped.HandleFunc("DELETE /api/parties/{partyId}", partyH.Delete)

 	// Deadlines
+	scoped.HandleFunc("GET /api/deadlines/{deadlineID}", deadlineH.Get)
 	scoped.HandleFunc("GET /api/deadlines", deadlineH.ListAll)
 	scoped.HandleFunc("GET /api/cases/{caseID}/deadlines", deadlineH.ListForCase)
 	scoped.HandleFunc("POST /api/cases/{caseID}/deadlines", deadlineH.Create)
@@ -101,11 +105,21 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se
 	scoped.HandleFunc("POST /api/deadlines/calculate", calcH.Calculate)

 	// Appointments
+	scoped.HandleFunc("GET /api/appointments/{id}", apptH.Get)
 	scoped.HandleFunc("GET /api/appointments", apptH.List)
 	scoped.HandleFunc("POST /api/appointments", apptH.Create)
 	scoped.HandleFunc("PUT /api/appointments/{id}", apptH.Update)
 	scoped.HandleFunc("DELETE /api/appointments/{id}", apptH.Delete)

+	// Case events
+	scoped.HandleFunc("GET /api/case-events/{id}", eventH.Get)
+
+	// Notes
+	scoped.HandleFunc("GET /api/notes", noteH.List)
+	scoped.HandleFunc("POST /api/notes", noteH.Create)
+	scoped.HandleFunc("PUT /api/notes/{id}", noteH.Update)
+	scoped.HandleFunc("DELETE /api/notes/{id}", noteH.Delete)
+
 	// Dashboard
 	scoped.HandleFunc("GET /api/dashboard", dashboardH.Get)

@@ -135,14 +149,20 @@ func New(db *sqlx.DB, authMW *auth.Middleware, cfg *config.Config, calDAVSvc *se

 	mux.Handle("/api/", authMW.RequireAuth(api))

-	return requestLogger(mux)
+	// Apply security middleware stack: CORS -> Security Headers -> Request Logger -> Routes
+	var handler http.Handler = mux
+	handler = requestLogger(handler)
+	handler = middleware.SecurityHeaders(handler)
+	handler = middleware.CORS(cfg.FrontendOrigin)(handler)
+
+	return handler
 }

 func handleHealth(db *sqlx.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		if err := db.Ping(); err != nil {
 			w.WriteHeader(http.StatusServiceUnavailable)
-			json.NewEncoder(w).Encode(map[string]string{"status": "error", "error": err.Error()})
+			json.NewEncoder(w).Encode(map[string]string{"status": "error"})
 			return
 		}
 		w.Header().Set("Content-Type", "application/json")
@@ -180,4 +200,3 @@ func requestLogger(next http.Handler) http.Handler {
 		)
 	})
 }
-
--- a/backend/internal/services/dashboard_service.go
+++ b/backend/internal/services/dashboard_service.go
@@ -42,6 +42,7 @@ type UpcomingDeadline struct {
 	ID         uuid.UUID `json:"id" db:"id"`
 	Title      string    `json:"title" db:"title"`
 	DueDate    string    `json:"due_date" db:"due_date"`
+	CaseID     uuid.UUID `json:"case_id" db:"case_id"`
 	CaseNumber string    `json:"case_number" db:"case_number"`
 	CaseTitle  string    `json:"case_title" db:"case_title"`
 	Status     string    `json:"status" db:"status"`
@@ -56,8 +57,10 @@ type UpcomingAppointment struct {
 }

 type RecentActivity struct {
+	ID         uuid.UUID  `json:"id" db:"id"`
 	EventType  *string    `json:"event_type" db:"event_type"`
 	Title      string     `json:"title" db:"title"`
+	CaseID     uuid.UUID  `json:"case_id" db:"case_id"`
 	CaseNumber string     `json:"case_number" db:"case_number"`
 	EventDate  *time.Time `json:"event_date" db:"event_date"`
 }
@@ -109,7 +112,7 @@ func (s *DashboardService) Get(ctx context.Context, tenantID uuid.UUID) (*Dashbo

 	// Upcoming deadlines (next 7 days)
 	deadlineQuery := `
-		SELECT d.id, d.title, d.due_date, c.case_number, c.title AS case_title, d.status
+		SELECT d.id, d.title, d.due_date, d.case_id, c.case_number, c.title AS case_title, d.status
 		FROM deadlines d
 		JOIN cases c ON c.id = d.case_id AND c.tenant_id = d.tenant_id
 		WHERE d.tenant_id = $1 AND d.status = 'pending' AND d.due_date >= $2 AND d.due_date <= $3
@@ -135,7 +138,7 @@ func (s *DashboardService) Get(ctx context.Context, tenantID uuid.UUID) (*Dashbo

 	// Recent activity (last 10 case events)
 	activityQuery := `
-		SELECT ce.event_type, ce.title, c.case_number, ce.event_date
+		SELECT ce.id, ce.event_type, ce.title, ce.case_id, c.case_number, ce.event_date
 		FROM case_events ce
 		JOIN cases c ON c.id = ce.case_id AND c.tenant_id = ce.tenant_id
 		WHERE ce.tenant_id = $1
--- a/backend/internal/services/note_service.go
+++ b/backend/internal/services/note_service.go
@@ -0,0 +1,120 @@
+package services
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+
+	"mgit.msbls.de/m/KanzlAI-mGMT/internal/models"
+)
+
+type NoteService struct {
+	db *sqlx.DB
+}
+
+func NewNoteService(db *sqlx.DB) *NoteService {
+	return &NoteService{db: db}
+}
+
+// ListByParent returns all notes for a given parent entity, scoped to tenant.
+func (s *NoteService) ListByParent(ctx context.Context, tenantID uuid.UUID, parentType string, parentID uuid.UUID) ([]models.Note, error) {
+	col, err := parentColumn(parentType)
+	if err != nil {
+		return nil, err
+	}
+
+	query := fmt.Sprintf(
+		`SELECT id, tenant_id, case_id, deadline_id, appointment_id, case_event_id,
+		        content, created_by, created_at, updated_at
+		 FROM notes
+		 WHERE tenant_id = $1 AND %s = $2
+		 ORDER BY created_at DESC`, col)
+
+	var notes []models.Note
+	if err := s.db.SelectContext(ctx, &notes, query, tenantID, parentID); err != nil {
+		return nil, fmt.Errorf("listing notes by %s: %w", parentType, err)
+	}
+	if notes == nil {
+		notes = []models.Note{}
+	}
+	return notes, nil
+}
+
+type CreateNoteInput struct {
+	CaseID        *uuid.UUID `json:"case_id,omitempty"`
+	DeadlineID    *uuid.UUID `json:"deadline_id,omitempty"`
+	AppointmentID *uuid.UUID `json:"appointment_id,omitempty"`
+	CaseEventID   *uuid.UUID `json:"case_event_id,omitempty"`
+	Content       string     `json:"content"`
+}
+
+// Create inserts a new note.
+func (s *NoteService) Create(ctx context.Context, tenantID uuid.UUID, createdBy *uuid.UUID, input CreateNoteInput) (*models.Note, error) {
+	id := uuid.New()
+	now := time.Now().UTC()
+
+	query := `INSERT INTO notes (id, tenant_id, case_id, deadline_id, appointment_id, case_event_id, content, created_by, created_at, updated_at)
+	          VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $9)
+	          RETURNING id, tenant_id, case_id, deadline_id, appointment_id, case_event_id, content, created_by, created_at, updated_at`
+
+	var n models.Note
+	err := s.db.GetContext(ctx, &n, query,
+		id, tenantID, input.CaseID, input.DeadlineID, input.AppointmentID, input.CaseEventID,
+		input.Content, createdBy, now)
+	if err != nil {
+		return nil, fmt.Errorf("creating note: %w", err)
+	}
+	return &n, nil
+}
+
+// Update modifies a note's content.
+func (s *NoteService) Update(ctx context.Context, tenantID, noteID uuid.UUID, content string) (*models.Note, error) {
+	query := `UPDATE notes SET content = $1, updated_at = $2
+	          WHERE id = $3 AND tenant_id = $4
+	          RETURNING id, tenant_id, case_id, deadline_id, appointment_id, case_event_id, content, created_by, created_at, updated_at`
+
+	var n models.Note
+	err := s.db.GetContext(ctx, &n, query, content, time.Now().UTC(), noteID, tenantID)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("updating note: %w", err)
+	}
+	return &n, nil
+}
+
+// Delete removes a note.
+func (s *NoteService) Delete(ctx context.Context, tenantID, noteID uuid.UUID) error {
+	result, err := s.db.ExecContext(ctx, "DELETE FROM notes WHERE id = $1 AND tenant_id = $2", noteID, tenantID)
+	if err != nil {
+		return fmt.Errorf("deleting note: %w", err)
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("checking delete result: %w", err)
+	}
+	if rows == 0 {
+		return fmt.Errorf("note not found")
+	}
+	return nil
+}
+
+func parentColumn(parentType string) (string, error) {
+	switch parentType {
+	case "case":
+		return "case_id", nil
+	case "deadline":
+		return "deadline_id", nil
+	case "appointment":
+		return "appointment_id", nil
+	case "case_event":
+		return "case_event_id", nil
+	default:
+		return "", fmt.Errorf("invalid parent type: %s", parentType)
+	}
+}
--- a/backend/internal/services/tenant_service.go
+++ b/backend/internal/services/tenant_service.go
@@ -101,6 +101,19 @@ func (s *TenantService) GetUserRole(ctx context.Context, userID, tenantID uuid.U
 	return role, nil
 }

+// VerifyAccess checks if a user has access to a given tenant.
+func (s *TenantService) VerifyAccess(ctx context.Context, userID, tenantID uuid.UUID) (bool, error) {
+	var exists bool
+	err := s.db.GetContext(ctx, &exists,
+		`SELECT EXISTS(SELECT 1 FROM user_tenants WHERE user_id = $1 AND tenant_id = $2)`,
+		userID, tenantID,
+	)
+	if err != nil {
+		return false, fmt.Errorf("verify tenant access: %w", err)
+	}
+	return exists, nil
+}
+
 // FirstTenantForUser returns the user's first tenant (by name), used as default.
 func (s *TenantService) FirstTenantForUser(ctx context.Context, userID uuid.UUID) (*uuid.UUID, error) {
 	var tenantID uuid.UUID
--- a/frontend/src/app/(app)/cases/[id]/ereignisse/[eventId]/page.tsx
+++ b/frontend/src/app/(app)/cases/[id]/ereignisse/[eventId]/page.tsx
@@ -0,0 +1,230 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { useParams } from "next/navigation";
+import { api } from "@/lib/api";
+import type { CaseEvent, Case } from "@/lib/types";
+import { Breadcrumb } from "@/components/layout/Breadcrumb";
+import { NotesList } from "@/components/notes/NotesList";
+import { Skeleton } from "@/components/ui/Skeleton";
+import { format, parseISO } from "date-fns";
+import { de } from "date-fns/locale";
+import {
+  AlertTriangle,
+  FileText,
+  Scale,
+  ArrowRightLeft,
+  Calendar,
+  MessageSquare,
+  Gavel,
+  Info,
+} from "lucide-react";
+import Link from "next/link";
+
+const EVENT_TYPE_CONFIG: Record<
+  string,
+  { label: string; icon: typeof Info; color: string }
+> = {
+  status_changed: {
+    label: "Statusaenderung",
+    icon: ArrowRightLeft,
+    color: "bg-blue-50 text-blue-700",
+  },
+  deadline_created: {
+    label: "Frist erstellt",
+    icon: Calendar,
+    color: "bg-amber-50 text-amber-700",
+  },
+  deadline_completed: {
+    label: "Frist erledigt",
+    icon: Calendar,
+    color: "bg-emerald-50 text-emerald-700",
+  },
+  document_uploaded: {
+    label: "Dokument hochgeladen",
+    icon: FileText,
+    color: "bg-violet-50 text-violet-700",
+  },
+  hearing_scheduled: {
+    label: "Verhandlung angesetzt",
+    icon: Gavel,
+    color: "bg-rose-50 text-rose-700",
+  },
+  note_added: {
+    label: "Notiz hinzugefuegt",
+    icon: MessageSquare,
+    color: "bg-neutral-100 text-neutral-700",
+  },
+  case_created: {
+    label: "Akte erstellt",
+    icon: Scale,
+    color: "bg-emerald-50 text-emerald-700",
+  },
+};
+
+const DEFAULT_EVENT_CONFIG = {
+  label: "Ereignis",
+  icon: Info,
+  color: "bg-neutral-100 text-neutral-600",
+};
+
+function DetailSkeleton() {
+  return (
+    <div>
+      <Skeleton className="h-4 w-64" />
+      <div className="mt-6 space-y-4">
+        <Skeleton className="h-8 w-48" />
+        <Skeleton className="h-4 w-32" />
+        <Skeleton className="h-32 rounded-lg" />
+        <Skeleton className="h-48 rounded-lg" />
+      </div>
+    </div>
+  );
+}
+
+export default function CaseEventDetailPage() {
+  const { id: caseId, eventId } = useParams<{
+    id: string;
+    eventId: string;
+  }>();
+
+  const { data: caseData } = useQuery({
+    queryKey: ["case", caseId],
+    queryFn: () => api.get<Case>(`/cases/${caseId}`),
+  });
+
+  const {
+    data: event,
+    isLoading,
+    error,
+  } = useQuery({
+    queryKey: ["case-event", eventId],
+    queryFn: () => api.get<CaseEvent>(`/case-events/${eventId}`),
+  });
+
+  if (isLoading) return <DetailSkeleton />;
+
+  if (error || !event) {
+    return (
+      <div className="py-12 text-center">
+        <div className="mx-auto mb-3 w-fit rounded-xl bg-red-50 p-3">
+          <AlertTriangle className="h-6 w-6 text-red-500" />
+        </div>
+        <p className="text-sm font-medium text-neutral-900">
+          Ereignis nicht gefunden
+        </p>
+        <p className="mt-1 text-sm text-neutral-500">
+          Das Ereignis existiert nicht oder Sie haben keine Berechtigung.
+        </p>
+        <Link
+          href={`/cases/${caseId}`}
+          className="mt-4 inline-block text-sm text-neutral-500 transition-colors hover:text-neutral-700"
+        >
+          Zurueck zur Akte
+        </Link>
+      </div>
+    );
+  }
+
+  const typeConfig =
+    EVENT_TYPE_CONFIG[event.event_type ?? ""] ?? DEFAULT_EVENT_CONFIG;
+  const TypeIcon = typeConfig.icon;
+
+  return (
+    <div className="animate-fade-in">
+      <Breadcrumb
+        items={[
+          { label: "Dashboard", href: "/dashboard" },
+          { label: "Akten", href: "/cases" },
+          {
+            label: caseData?.case_number
+              ? `Az. ${caseData.case_number}`
+              : "Akte",
+            href: `/cases/${caseId}`,
+          },
+          { label: "Verlauf", href: `/cases/${caseId}` },
+          { label: event.title },
+        ]}
+      />
+
+      {/* Header */}
+      <div className="flex flex-wrap items-center gap-3">
+        <div className={`rounded-lg p-2 ${typeConfig.color}`}>
+          <TypeIcon className="h-5 w-5" />
+        </div>
+        <div>
+          <h1 className="text-lg font-semibold text-neutral-900">
+            {event.title}
+          </h1>
+          <p className="text-sm text-neutral-500">
+            {event.event_date
+              ? format(parseISO(event.event_date), "d. MMMM yyyy, HH:mm", {
+                  locale: de,
+                })
+              : format(parseISO(event.created_at), "d. MMMM yyyy, HH:mm", {
+                  locale: de,
+                })}
+          </p>
+        </div>
+      </div>
+
+      {/* Description */}
+      {event.description && (
+        <div className="mt-4 rounded-lg border border-neutral-200 bg-white px-4 py-3">
+          <p className="text-xs font-medium uppercase tracking-wide text-neutral-400">
+            Beschreibung
+          </p>
+          <p className="mt-1 whitespace-pre-wrap text-sm text-neutral-700">
+            {event.description}
+          </p>
+        </div>
+      )}
+
+      {/* Metadata */}
+      <div className="mt-3 rounded-lg border border-neutral-200 bg-white px-4 py-3">
+        <p className="text-xs font-medium uppercase tracking-wide text-neutral-400">
+          Metadaten
+        </p>
+        <dl className="mt-2 space-y-1.5">
+          <div className="flex gap-2 text-sm">
+            <dt className="text-neutral-500">Typ:</dt>
+            <dd>
+              <span
+                className={`inline-block rounded-full px-2 py-0.5 text-xs font-medium ${typeConfig.color}`}
+              >
+                {typeConfig.label}
+              </span>
+            </dd>
+          </div>
+          {event.created_by && (
+            <div className="flex gap-2 text-sm">
+              <dt className="text-neutral-500">Erstellt von:</dt>
+              <dd className="text-neutral-900">{event.created_by}</dd>
+            </div>
+          )}
+          <div className="flex gap-2 text-sm">
+            <dt className="text-neutral-500">Erstellt am:</dt>
+            <dd className="text-neutral-900">
+              {format(parseISO(event.created_at), "d. MMMM yyyy, HH:mm", {
+                locale: de,
+              })}
+            </dd>
+          </div>
+          {event.metadata &&
+            Object.keys(event.metadata).length > 0 &&
+            Object.entries(event.metadata).map(([key, value]) => (
+              <div key={key} className="flex gap-2 text-sm">
+                <dt className="text-neutral-500">{key}:</dt>
+                <dd className="text-neutral-900">{String(value)}</dd>
+              </div>
+            ))}
+        </dl>
+      </div>
+
+      {/* Notes */}
+      <div className="mt-6">
+        <NotesList parentType="case_event" parentId={eventId} />
+      </div>
+    </div>
+  );
+}
--- a/frontend/src/app/(app)/cases/page.tsx
+++ b/frontend/src/app/(app)/cases/page.tsx
@@ -5,6 +5,7 @@ import { api } from "@/lib/api";
 import type { Case } from "@/lib/types";
 import Link from "next/link";
 import { useSearchParams, useRouter } from "next/navigation";
+import { Breadcrumb } from "@/components/layout/Breadcrumb";
 import { Plus, Search, FolderOpen } from "lucide-react";
 import { useState } from "react";
 import { SkeletonTable } from "@/components/ui/Skeleton";
@@ -72,6 +73,12 @@ export default function CasesPage() {

  return (
    <div className="animate-fade-in">
+      <Breadcrumb
+        items={[
+          { label: "Dashboard", href: "/dashboard" },
+          { label: "Akten" },
+        ]}
+      />
      <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
        <div>
          <h1 className="text-lg font-semibold text-neutral-900">Akten</h1>
--- a/frontend/src/app/(app)/dashboard/page.tsx
+++ b/frontend/src/app/(app)/dashboard/page.tsx
@@ -8,6 +8,8 @@ import { CaseOverviewGrid } from "@/components/dashboard/CaseOverviewGrid";
 import { UpcomingTimeline } from "@/components/dashboard/UpcomingTimeline";
 import { AISummaryCard } from "@/components/dashboard/AISummaryCard";
 import { QuickActions } from "@/components/dashboard/QuickActions";
+import { RecentActivityList } from "@/components/dashboard/RecentActivityList";
+import { Breadcrumb } from "@/components/layout/Breadcrumb";
 import { Skeleton, SkeletonCard } from "@/components/ui/Skeleton";
 import { AlertTriangle, RefreshCw } from "lucide-react";

@@ -71,9 +73,12 @@ export default function DashboardPage() {
    );
  }

+  const recentActivity = Array.isArray(data.recent_activity) ? data.recent_activity : [];
+
  return (
    <div className="animate-fade-in mx-auto max-w-6xl space-y-6">
      <div>
+        <Breadcrumb items={[{ label: "Dashboard" }]} />
        <h1 className="text-lg font-semibold text-neutral-900">Dashboard</h1>
        <p className="mt-0.5 text-sm text-neutral-500">
          Fristenübersicht und Kanzlei-Status
@@ -91,10 +96,14 @@ export default function DashboardPage() {
        </div>
        <div className="space-y-6">
          <CaseOverviewGrid data={data.case_summary ?? { active_count: 0, new_this_month: 0, closed_count: 0 }} />
-          <AISummaryCard data={data} />
+          <AISummaryCard data={data} onRefresh={() => refetch()} />
          <QuickActions />
        </div>
      </div>
+
+      {recentActivity.length > 0 && (
+        <RecentActivityList activities={recentActivity} />
+      )}
    </div>
  );
 }
--- a/frontend/src/app/(app)/fristen/[id]/page.tsx
+++ b/frontend/src/app/(app)/fristen/[id]/page.tsx
@@ -0,0 +1,250 @@
+"use client";
+
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useParams, useRouter } from "next/navigation";
+import { api } from "@/lib/api";
+import type { Deadline } from "@/lib/types";
+import { Breadcrumb } from "@/components/layout/Breadcrumb";
+import { NotesList } from "@/components/notes/NotesList";
+import { Skeleton } from "@/components/ui/Skeleton";
+import { format, parseISO, formatDistanceToNow, isPast } from "date-fns";
+import { de } from "date-fns/locale";
+import {
+  AlertTriangle,
+  CheckCircle2,
+  Clock,
+  ExternalLink,
+} from "lucide-react";
+import Link from "next/link";
+import { toast } from "sonner";
+
+interface DeadlineDetail extends Deadline {
+  case_number?: string;
+  case_title?: string;
+}
+
+const STATUS_CONFIG: Record<
+  string,
+  { label: string; bg: string; icon: typeof Clock }
+> = {
+  pending: { label: "Offen", bg: "bg-amber-50 text-amber-700", icon: Clock },
+  completed: {
+    label: "Erledigt",
+    bg: "bg-emerald-50 text-emerald-700",
+    icon: CheckCircle2,
+  },
+  overdue: {
+    label: "Ueberfaellig",
+    bg: "bg-red-50 text-red-700",
+    icon: AlertTriangle,
+  },
+};
+
+function getEffectiveStatus(d: DeadlineDetail): string {
+  if (d.status === "completed") return "completed";
+  if (isPast(parseISO(d.due_date))) return "overdue";
+  return "pending";
+}
+
+function DetailSkeleton() {
+  return (
+    <div>
+      <Skeleton className="h-4 w-48" />
+      <div className="mt-6 space-y-4">
+        <Skeleton className="h-8 w-64" />
+        <Skeleton className="h-4 w-40" />
+        <Skeleton className="h-32 rounded-lg" />
+        <Skeleton className="h-48 rounded-lg" />
+      </div>
+    </div>
+  );
+}
+
+export default function DeadlineDetailPage() {
+  const { id } = useParams<{ id: string }>();
+  const router = useRouter();
+  const queryClient = useQueryClient();
+
+  const {
+    data: deadline,
+    isLoading,
+    error,
+  } = useQuery({
+    queryKey: ["deadline", id],
+    queryFn: () => api.get<DeadlineDetail>(`/deadlines/${id}`),
+  });
+
+  const completeMutation = useMutation({
+    mutationFn: () => api.patch<Deadline>(`/deadlines/${id}/complete`),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["deadline", id] });
+      queryClient.invalidateQueries({ queryKey: ["deadlines"] });
+      queryClient.invalidateQueries({ queryKey: ["dashboard"] });
+      toast.success("Frist als erledigt markiert");
+    },
+    onError: () => toast.error("Fehler beim Abschliessen der Frist"),
+  });
+
+  if (isLoading) return <DetailSkeleton />;
+
+  if (error || !deadline) {
+    return (
+      <div className="py-12 text-center">
+        <div className="mx-auto mb-3 w-fit rounded-xl bg-red-50 p-3">
+          <AlertTriangle className="h-6 w-6 text-red-500" />
+        </div>
+        <p className="text-sm font-medium text-neutral-900">
+          Frist nicht gefunden
+        </p>
+        <p className="mt-1 text-sm text-neutral-500">
+          Die Frist existiert nicht oder Sie haben keine Berechtigung.
+        </p>
+        <Link
+          href="/fristen"
+          className="mt-4 inline-block text-sm text-neutral-500 transition-colors hover:text-neutral-700"
+        >
+          Zurueck zu Fristen
+        </Link>
+      </div>
+    );
+  }
+
+  const status = getEffectiveStatus(deadline);
+  const config = STATUS_CONFIG[status] ?? STATUS_CONFIG.pending;
+  const StatusIcon = config.icon;
+  const dueDate = parseISO(deadline.due_date);
+  const relativeTime = formatDistanceToNow(dueDate, {
+    addSuffix: true,
+    locale: de,
+  });
+
+  return (
+    <div className="animate-fade-in">
+      <Breadcrumb
+        items={[
+          { label: "Dashboard", href: "/dashboard" },
+          { label: "Fristen", href: "/fristen" },
+          { label: deadline.title },
+        ]}
+      />
+
+      {/* Header */}
+      <div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
+        <div>
+          <div className="flex flex-wrap items-center gap-3">
+            <span
+              className={`inline-flex items-center gap-1 rounded-full px-2.5 py-0.5 text-xs font-medium ${config.bg}`}
+            >
+              <StatusIcon className="h-3 w-3" />
+              {config.label}
+            </span>
+            <h1 className="text-lg font-semibold text-neutral-900">
+              {deadline.title}
+            </h1>
+          </div>
+          {deadline.description && (
+            <p className="mt-1 text-sm text-neutral-500">
+              {deadline.description}
+            </p>
+          )}
+        </div>
+        {deadline.status !== "completed" && (
+          <button
+            onClick={() => completeMutation.mutate()}
+            disabled={completeMutation.isPending}
+            className="shrink-0 rounded-md bg-emerald-600 px-4 py-2 text-sm font-medium text-white transition-colors hover:bg-emerald-700 disabled:opacity-50"
+          >
+            {completeMutation.isPending ? "Wird erledigt..." : "Erledigen"}
+          </button>
+        )}
+      </div>
+
+      {/* Due date */}
+      <div className="mt-4 rounded-lg border border-neutral-200 bg-white px-4 py-3">
+        <div className="flex items-baseline gap-2">
+          <span className="text-sm font-medium text-neutral-900">
+            Faellig: {format(dueDate, "d. MMMM yyyy", { locale: de })}
+          </span>
+          <span
+            className={`text-xs ${status === "overdue" ? "font-medium text-red-600" : "text-neutral-500"}`}
+          >
+            ({relativeTime})
+          </span>
+        </div>
+        {deadline.warning_date && (
+          <p className="mt-1 text-xs text-neutral-500">
+            Warnung am:{" "}
+            {format(parseISO(deadline.warning_date), "d. MMMM yyyy", {
+              locale: de,
+            })}
+          </p>
+        )}
+        {deadline.original_due_date &&
+          deadline.original_due_date !== deadline.due_date && (
+            <p className="mt-1 text-xs text-neutral-500">
+              Urspruengliches Datum:{" "}
+              {format(parseISO(deadline.original_due_date), "d. MMMM yyyy", {
+                locale: de,
+              })}
+            </p>
+          )}
+        {deadline.completed_at && (
+          <p className="mt-1 text-xs text-emerald-600">
+            Erledigt am:{" "}
+            {format(parseISO(deadline.completed_at), "d. MMMM yyyy, HH:mm", {
+              locale: de,
+            })}
+          </p>
+        )}
+      </div>
+
+      {/* Case context */}
+      {deadline.case_id && (
+        <div className="mt-3 rounded-lg border border-neutral-200 bg-white px-4 py-3">
+          <div className="flex items-center justify-between">
+            <div>
+              <p className="text-xs font-medium uppercase tracking-wide text-neutral-400">
+                Akte
+              </p>
+              <p className="mt-0.5 text-sm text-neutral-900">
+                {deadline.case_number
+                  ? `Az. ${deadline.case_number}`
+                  : "Verknuepfte Akte"}
+                {deadline.case_title && ` — ${deadline.case_title}`}
+              </p>
+            </div>
+            <Link
+              href={`/cases/${deadline.case_id}`}
+              className="flex items-center gap-1 text-xs text-neutral-500 transition-colors hover:text-neutral-700"
+            >
+              Zur Akte
+              <ExternalLink className="h-3 w-3" />
+            </Link>
+          </div>
+        </div>
+      )}
+
+      {/* Source info */}
+      {deadline.source && deadline.source !== "manual" && (
+        <div className="mt-3 rounded-lg border border-neutral-200 bg-white px-4 py-3">
+          <p className="text-xs font-medium uppercase tracking-wide text-neutral-400">
+            Quelle
+          </p>
+          <p className="mt-0.5 text-sm text-neutral-700">
+            {deadline.source === "calculated"
+              ? "Berechnet"
+              : deadline.source === "caldav"
+                ? "CalDAV Sync"
+                : deadline.source}
+            {deadline.rule_id && ` (Regel: ${deadline.rule_id})`}
+          </p>
+        </div>
+      )}
+
+      {/* Notes */}
+      <div className="mt-6">
+        <NotesList parentType="deadline" parentId={id} />
+      </div>
+    </div>
+  );
+}
--- a/frontend/src/app/(app)/fristen/neu/page.tsx
+++ b/frontend/src/app/(app)/fristen/neu/page.tsx
@@ -0,0 +1,180 @@
+"use client";
+
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useRouter } from "next/navigation";
+import { api } from "@/lib/api";
+import type { Case, Deadline } from "@/lib/types";
+import { Breadcrumb } from "@/components/layout/Breadcrumb";
+import { useState } from "react";
+import { toast } from "sonner";
+
+const inputClass =
+  "w-full rounded-md border border-neutral-200 px-3 py-1.5 text-sm outline-none focus:border-neutral-400 focus:ring-1 focus:ring-neutral-400";
+const labelClass = "mb-1 block text-xs font-medium text-neutral-600";
+
+export default function NewDeadlinePage() {
+  const router = useRouter();
+  const queryClient = useQueryClient();
+
+  const [caseId, setCaseId] = useState("");
+  const [title, setTitle] = useState("");
+  const [description, setDescription] = useState("");
+  const [dueDate, setDueDate] = useState("");
+  const [warningDate, setWarningDate] = useState("");
+  const [notes, setNotes] = useState("");
+
+  const { data: casesData } = useQuery({
+    queryKey: ["cases"],
+    queryFn: () => api.get<{ cases: Case[]; total: number } | Case[]>("/cases"),
+  });
+
+  const cases = Array.isArray(casesData)
+    ? casesData
+    : Array.isArray(casesData?.cases)
+      ? casesData.cases
+      : [];
+
+  const createMutation = useMutation({
+    mutationFn: (body: Record<string, unknown>) =>
+      api.post<Deadline>(`/cases/${caseId}/deadlines`, body),
+    onSuccess: (data) => {
+      queryClient.invalidateQueries({ queryKey: ["deadlines"] });
+      queryClient.invalidateQueries({ queryKey: ["dashboard"] });
+      toast.success("Frist erstellt");
+      router.push(`/fristen/${data.id}`);
+    },
+    onError: () => toast.error("Fehler beim Erstellen der Frist"),
+  });
+
+  function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    if (!caseId || !title.trim() || !dueDate) return;
+
+    const body: Record<string, unknown> = {
+      title: title.trim(),
+      due_date: new Date(dueDate).toISOString(),
+      source: "manual",
+    };
+    if (description.trim()) body.description = description.trim();
+    if (warningDate) body.warning_date = new Date(warningDate).toISOString();
+    if (notes.trim()) body.notes = notes.trim();
+
+    createMutation.mutate(body);
+  }
+
+  return (
+    <div className="animate-fade-in">
+      <Breadcrumb
+        items={[
+          { label: "Dashboard", href: "/dashboard" },
+          { label: "Fristen", href: "/fristen" },
+          { label: "Neue Frist" },
+        ]}
+      />
+
+      <h1 className="text-lg font-semibold text-neutral-900">
+        Neue Frist anlegen
+      </h1>
+      <p className="mt-0.5 text-sm text-neutral-500">
+        Erstellen Sie eine neue Frist fuer eine Akte.
+      </p>
+
+      <form
+        onSubmit={handleSubmit}
+        className="mt-6 max-w-lg space-y-4 rounded-lg border border-neutral-200 bg-white p-5"
+      >
+        <div>
+          <label className={labelClass}>Akte *</label>
+          <select
+            value={caseId}
+            onChange={(e) => setCaseId(e.target.value)}
+            required
+            className={inputClass}
+          >
+            <option value="">Akte auswaehlen...</option>
+            {cases.map((c) => (
+              <option key={c.id} value={c.id}>
+                {c.case_number} — {c.title}
+              </option>
+            ))}
+          </select>
+        </div>
+
+        <div>
+          <label className={labelClass}>Bezeichnung *</label>
+          <input
+            type="text"
+            value={title}
+            onChange={(e) => setTitle(e.target.value)}
+            required
+            className={inputClass}
+            placeholder="z.B. Klageschrift einreichen"
+          />
+        </div>
+
+        <div>
+          <label className={labelClass}>Beschreibung</label>
+          <input
+            type="text"
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+            className={inputClass}
+            placeholder="Optionale Beschreibung"
+          />
+        </div>
+
+        <div className="grid grid-cols-2 gap-3">
+          <div>
+            <label className={labelClass}>Faellig am *</label>
+            <input
+              type="date"
+              value={dueDate}
+              onChange={(e) => setDueDate(e.target.value)}
+              required
+              className={inputClass}
+            />
+          </div>
+          <div>
+            <label className={labelClass}>Warnung am</label>
+            <input
+              type="date"
+              value={warningDate}
+              onChange={(e) => setWarningDate(e.target.value)}
+              className={inputClass}
+            />
+          </div>
+        </div>
+
+        <div>
+          <label className={labelClass}>Notizen</label>
+          <textarea
+            value={notes}
+            onChange={(e) => setNotes(e.target.value)}
+            rows={3}
+            className={inputClass}
+            placeholder="Optionale Notizen zur Frist"
+          />
+        </div>
+
+        <div className="flex items-center justify-end gap-2 pt-2">
+          <button
+            type="button"
+            onClick={() => router.push("/fristen")}
+            className="rounded-md border border-neutral-200 bg-white px-3 py-1.5 text-sm text-neutral-700 hover:bg-neutral-50"
+          >
+            Abbrechen
+          </button>
+          <button
+            type="submit"
+            disabled={
+              createMutation.isPending || !caseId || !title.trim() || !dueDate
+            }
+            className="rounded-md bg-neutral-900 px-3 py-1.5 text-sm font-medium text-white hover:bg-neutral-800 disabled:opacity-50"
+          >
+            {createMutation.isPending ? "Erstellen..." : "Frist anlegen"}
+          </button>
+        </div>
+      </form>
+    </div>
+  );
+}
--- a/frontend/src/app/(app)/fristen/page.tsx
+++ b/frontend/src/app/(app)/fristen/page.tsx
@@ -2,16 +2,20 @@

 import { DeadlineList } from "@/components/deadlines/DeadlineList";
 import { DeadlineCalendarView } from "@/components/deadlines/DeadlineCalendarView";
+import { Breadcrumb } from "@/components/layout/Breadcrumb";
 import { useQuery } from "@tanstack/react-query";
 import { api } from "@/lib/api";
 import type { Deadline } from "@/lib/types";
 import { Calendar, List, Calculator } from "lucide-react";
 import Link from "next/link";
 import { useState } from "react";
+import { useSearchParams } from "next/navigation";

 type ViewMode = "list" | "calendar";

 export default function FristenPage() {
+  const searchParams = useSearchParams();
+  const initialStatus = searchParams.get("status") ?? undefined;
  const [view, setView] = useState<ViewMode>("list");

  const { data: deadlines } = useQuery({
@@ -21,6 +25,13 @@ export default function FristenPage() {

  return (
    <div className="animate-fade-in space-y-4">
+      <div>
+        <Breadcrumb
+          items={[
+            { label: "Dashboard", href: "/dashboard" },
+            { label: "Fristen" },
+          ]}
+        />
        <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
          <div>
            <h1 className="text-lg font-semibold text-neutral-900">Fristen</h1>
@@ -62,9 +73,10 @@ export default function FristenPage() {
            </div>
          </div>
        </div>
+      </div>

      {view === "list" ? (
-        <DeadlineList />
+        <DeadlineList initialStatus={initialStatus} />
      ) : (
        <DeadlineCalendarView deadlines={Array.isArray(deadlines) ? deadlines : []} />
      )}
--- a/frontend/src/app/(app)/termine/[id]/page.tsx
+++ b/frontend/src/app/(app)/termine/[id]/page.tsx
@@ -0,0 +1,201 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { useParams } from "next/navigation";
+import { api } from "@/lib/api";
+import type { Appointment } from "@/lib/types";
+import { Breadcrumb } from "@/components/layout/Breadcrumb";
+import { NotesList } from "@/components/notes/NotesList";
+import { Skeleton } from "@/components/ui/Skeleton";
+import { format, parseISO } from "date-fns";
+import { de } from "date-fns/locale";
+import {
+  AlertTriangle,
+  Calendar,
+  ExternalLink,
+  MapPin,
+} from "lucide-react";
+import Link from "next/link";
+
+interface AppointmentDetail extends Appointment {
+  case_number?: string;
+  case_title?: string;
+}
+
+const TYPE_LABELS: Record<string, string> = {
+  hearing: "Verhandlung",
+  meeting: "Besprechung",
+  consultation: "Beratung",
+  deadline_hearing: "Fristanhoerung",
+  other: "Sonstiges",
+};
+
+const TYPE_COLORS: Record<string, string> = {
+  hearing: "bg-blue-50 text-blue-700",
+  meeting: "bg-violet-50 text-violet-700",
+  consultation: "bg-emerald-50 text-emerald-700",
+  deadline_hearing: "bg-amber-50 text-amber-700",
+  other: "bg-neutral-100 text-neutral-600",
+};
+
+function DetailSkeleton() {
+  return (
+    <div>
+      <Skeleton className="h-4 w-48" />
+      <div className="mt-6 space-y-4">
+        <Skeleton className="h-8 w-64" />
+        <Skeleton className="h-4 w-40" />
+        <Skeleton className="h-32 rounded-lg" />
+        <Skeleton className="h-48 rounded-lg" />
+      </div>
+    </div>
+  );
+}
+
+export default function AppointmentDetailPage() {
+  const { id } = useParams<{ id: string }>();
+
+  const {
+    data: appointment,
+    isLoading,
+    error,
+  } = useQuery({
+    queryKey: ["appointment", id],
+    queryFn: () => api.get<AppointmentDetail>(`/appointments/${id}`),
+  });
+
+  if (isLoading) return <DetailSkeleton />;
+
+  if (error || !appointment) {
+    return (
+      <div className="py-12 text-center">
+        <div className="mx-auto mb-3 w-fit rounded-xl bg-red-50 p-3">
+          <AlertTriangle className="h-6 w-6 text-red-500" />
+        </div>
+        <p className="text-sm font-medium text-neutral-900">
+          Termin nicht gefunden
+        </p>
+        <p className="mt-1 text-sm text-neutral-500">
+          Der Termin existiert nicht oder Sie haben keine Berechtigung.
+        </p>
+        <Link
+          href="/termine"
+          className="mt-4 inline-block text-sm text-neutral-500 transition-colors hover:text-neutral-700"
+        >
+          Zurueck zu Termine
+        </Link>
+      </div>
+    );
+  }
+
+  const startDate = parseISO(appointment.start_at);
+  const typeBadge = appointment.appointment_type
+    ? TYPE_COLORS[appointment.appointment_type] ?? TYPE_COLORS.other
+    : null;
+  const typeLabel = appointment.appointment_type
+    ? TYPE_LABELS[appointment.appointment_type] ?? appointment.appointment_type
+    : null;
+
+  return (
+    <div className="animate-fade-in">
+      <Breadcrumb
+        items={[
+          { label: "Dashboard", href: "/dashboard" },
+          { label: "Termine", href: "/termine" },
+          { label: appointment.title },
+        ]}
+      />
+
+      {/* Header */}
+      <div>
+        <div className="flex flex-wrap items-center gap-3">
+          <h1 className="text-lg font-semibold text-neutral-900">
+            {appointment.title}
+          </h1>
+          {typeBadge && typeLabel && (
+            <span
+              className={`inline-block rounded-full px-2.5 py-0.5 text-xs font-medium ${typeBadge}`}
+            >
+              {typeLabel}
+            </span>
+          )}
+        </div>
+      </div>
+
+      {/* Date & Time */}
+      <div className="mt-4 rounded-lg border border-neutral-200 bg-white px-4 py-3">
+        <div className="flex items-center gap-2">
+          <Calendar className="h-4 w-4 text-neutral-400" />
+          <span className="text-sm font-medium text-neutral-900">
+            {format(startDate, "EEEE, d. MMMM yyyy", { locale: de })}
+          </span>
+        </div>
+        <p className="mt-1 pl-6 text-sm text-neutral-600">
+          {format(startDate, "HH:mm", { locale: de })} Uhr
+          {appointment.end_at && (
+            <>
+              {" "}
+              – {format(parseISO(appointment.end_at), "HH:mm", { locale: de })}{" "}
+              Uhr
+            </>
+          )}
+        </p>
+      </div>
+
+      {/* Location */}
+      {appointment.location && (
+        <div className="mt-3 rounded-lg border border-neutral-200 bg-white px-4 py-3">
+          <div className="flex items-center gap-2">
+            <MapPin className="h-4 w-4 text-neutral-400" />
+            <span className="text-sm text-neutral-900">
+              {appointment.location}
+            </span>
+          </div>
+        </div>
+      )}
+
+      {/* Case context */}
+      {appointment.case_id && (
+        <div className="mt-3 rounded-lg border border-neutral-200 bg-white px-4 py-3">
+          <div className="flex items-center justify-between">
+            <div>
+              <p className="text-xs font-medium uppercase tracking-wide text-neutral-400">
+                Akte
+              </p>
+              <p className="mt-0.5 text-sm text-neutral-900">
+                {appointment.case_number
+                  ? `Az. ${appointment.case_number}`
+                  : "Verknuepfte Akte"}
+                {appointment.case_title && ` — ${appointment.case_title}`}
+              </p>
+            </div>
+            <Link
+              href={`/cases/${appointment.case_id}`}
+              className="flex items-center gap-1 text-xs text-neutral-500 transition-colors hover:text-neutral-700"
+            >
+              Zur Akte
+              <ExternalLink className="h-3 w-3" />
+            </Link>
+          </div>
+        </div>
+      )}
+
+      {/* Description */}
+      {appointment.description && (
+        <div className="mt-3 rounded-lg border border-neutral-200 bg-white px-4 py-3">
+          <p className="text-xs font-medium uppercase tracking-wide text-neutral-400">
+            Beschreibung
+          </p>
+          <p className="mt-1 whitespace-pre-wrap text-sm text-neutral-700">
+            {appointment.description}
+          </p>
+        </div>
+      )}
+
+      {/* Notes */}
+      <div className="mt-6">
+        <NotesList parentType="appointment" parentId={id} />
+      </div>
+    </div>
+  );
+}
--- a/frontend/src/app/(app)/termine/neu/page.tsx
+++ b/frontend/src/app/(app)/termine/neu/page.tsx
@@ -0,0 +1,206 @@
+"use client";
+
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useRouter } from "next/navigation";
+import { api } from "@/lib/api";
+import type { Case, Appointment } from "@/lib/types";
+import { Breadcrumb } from "@/components/layout/Breadcrumb";
+import { useState } from "react";
+import { toast } from "sonner";
+
+const APPOINTMENT_TYPES = [
+  { value: "hearing", label: "Verhandlung" },
+  { value: "meeting", label: "Besprechung" },
+  { value: "consultation", label: "Beratung" },
+  { value: "deadline_hearing", label: "Fristanhoerung" },
+  { value: "other", label: "Sonstiges" },
+];
+
+const inputClass =
+  "w-full rounded-md border border-neutral-200 px-3 py-1.5 text-sm outline-none focus:border-neutral-400 focus:ring-1 focus:ring-neutral-400";
+const labelClass = "mb-1 block text-xs font-medium text-neutral-600";
+
+export default function NewAppointmentPage() {
+  const router = useRouter();
+  const queryClient = useQueryClient();
+
+  const [caseId, setCaseId] = useState("");
+  const [title, setTitle] = useState("");
+  const [description, setDescription] = useState("");
+  const [startAt, setStartAt] = useState("");
+  const [endAt, setEndAt] = useState("");
+  const [location, setLocation] = useState("");
+  const [appointmentType, setAppointmentType] = useState("");
+
+  const { data: casesData } = useQuery({
+    queryKey: ["cases"],
+    queryFn: () => api.get<{ cases: Case[]; total: number } | Case[]>("/cases"),
+  });
+
+  const cases = Array.isArray(casesData)
+    ? casesData
+    : Array.isArray(casesData?.cases)
+      ? casesData.cases
+      : [];
+
+  const createMutation = useMutation({
+    mutationFn: (body: Record<string, unknown>) =>
+      api.post<Appointment>("/appointments", body),
+    onSuccess: (data) => {
+      queryClient.invalidateQueries({ queryKey: ["appointments"] });
+      queryClient.invalidateQueries({ queryKey: ["dashboard"] });
+      toast.success("Termin erstellt");
+      router.push(`/termine/${data.id}`);
+    },
+    onError: () => toast.error("Fehler beim Erstellen des Termins"),
+  });
+
+  function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    if (!title.trim() || !startAt) return;
+
+    const body: Record<string, unknown> = {
+      title: title.trim(),
+      start_at: new Date(startAt).toISOString(),
+    };
+    if (description.trim()) body.description = description.trim();
+    if (endAt) body.end_at = new Date(endAt).toISOString();
+    if (location.trim()) body.location = location.trim();
+    if (appointmentType) body.appointment_type = appointmentType;
+    if (caseId) body.case_id = caseId;
+
+    createMutation.mutate(body);
+  }
+
+  return (
+    <div className="animate-fade-in">
+      <Breadcrumb
+        items={[
+          { label: "Dashboard", href: "/dashboard" },
+          { label: "Termine", href: "/termine" },
+          { label: "Neuer Termin" },
+        ]}
+      />
+
+      <h1 className="text-lg font-semibold text-neutral-900">
+        Neuer Termin
+      </h1>
+      <p className="mt-0.5 text-sm text-neutral-500">
+        Erstellen Sie einen neuen Termin.
+      </p>
+
+      <form
+        onSubmit={handleSubmit}
+        className="mt-6 max-w-lg space-y-4 rounded-lg border border-neutral-200 bg-white p-5"
+      >
+        <div>
+          <label className={labelClass}>Titel *</label>
+          <input
+            type="text"
+            value={title}
+            onChange={(e) => setTitle(e.target.value)}
+            required
+            className={inputClass}
+            placeholder="z.B. Muendliche Verhandlung"
+          />
+        </div>
+
+        <div className="grid grid-cols-2 gap-3">
+          <div>
+            <label className={labelClass}>Beginn *</label>
+            <input
+              type="datetime-local"
+              value={startAt}
+              onChange={(e) => setStartAt(e.target.value)}
+              required
+              className={inputClass}
+            />
+          </div>
+          <div>
+            <label className={labelClass}>Ende</label>
+            <input
+              type="datetime-local"
+              value={endAt}
+              onChange={(e) => setEndAt(e.target.value)}
+              className={inputClass}
+            />
+          </div>
+        </div>
+
+        <div className="grid grid-cols-2 gap-3">
+          <div>
+            <label className={labelClass}>Typ</label>
+            <select
+              value={appointmentType}
+              onChange={(e) => setAppointmentType(e.target.value)}
+              className={inputClass}
+            >
+              <option value="">Kein Typ</option>
+              {APPOINTMENT_TYPES.map((t) => (
+                <option key={t.value} value={t.value}>
+                  {t.label}
+                </option>
+              ))}
+            </select>
+          </div>
+          <div>
+            <label className={labelClass}>Akte (optional)</label>
+            <select
+              value={caseId}
+              onChange={(e) => setCaseId(e.target.value)}
+              className={inputClass}
+            >
+              <option value="">Keine Akte</option>
+              {cases.map((c) => (
+                <option key={c.id} value={c.id}>
+                  {c.case_number} — {c.title}
+                </option>
+              ))}
+            </select>
+          </div>
+        </div>
+
+        <div>
+          <label className={labelClass}>Ort</label>
+          <input
+            type="text"
+            value={location}
+            onChange={(e) => setLocation(e.target.value)}
+            className={inputClass}
+            placeholder="z.B. UPC Muenchen, Saal 3"
+          />
+        </div>
+
+        <div>
+          <label className={labelClass}>Beschreibung</label>
+          <textarea
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+            rows={3}
+            className={inputClass}
+            placeholder="Optionale Beschreibung zum Termin"
+          />
+        </div>
+
+        <div className="flex items-center justify-end gap-2 pt-2">
+          <button
+            type="button"
+            onClick={() => router.push("/termine")}
+            className="rounded-md border border-neutral-200 bg-white px-3 py-1.5 text-sm text-neutral-700 hover:bg-neutral-50"
+          >
+            Abbrechen
+          </button>
+          <button
+            type="submit"
+            disabled={
+              createMutation.isPending || !title.trim() || !startAt
+            }
+            className="rounded-md bg-neutral-900 px-3 py-1.5 text-sm font-medium text-white hover:bg-neutral-800 disabled:opacity-50"
+          >
+            {createMutation.isPending ? "Erstellen..." : "Termin anlegen"}
+          </button>
+        </div>
+      </form>
+    </div>
+  );
+}
--- a/frontend/src/app/(app)/termine/page.tsx
+++ b/frontend/src/app/(app)/termine/page.tsx
@@ -6,6 +6,7 @@ import { AppointmentModal } from "@/components/appointments/AppointmentModal";
 import { useQuery } from "@tanstack/react-query";
 import { api } from "@/lib/api";
 import type { Appointment } from "@/lib/types";
+import { Breadcrumb } from "@/components/layout/Breadcrumb";
 import { Calendar, List, Plus } from "lucide-react";
 import { useState } from "react";

@@ -38,6 +39,12 @@ export default function TerminePage() {

  return (
    <div className="space-y-4">
+      <Breadcrumb
+        items={[
+          { label: "Dashboard", href: "/dashboard" },
+          { label: "Termine" },
+        ]}
+      />
      <div className="flex items-center justify-between">
        <div>
          <h1 className="text-lg font-semibold text-neutral-900">Termine</h1>
--- a/frontend/src/components/dashboard/AISummaryCard.tsx
+++ b/frontend/src/components/dashboard/AISummaryCard.tsx
@@ -1,10 +1,12 @@
 "use client";

-import { Sparkles } from "lucide-react";
+import { useState } from "react";
+import { Sparkles, RefreshCw } from "lucide-react";
 import type { DashboardData } from "@/lib/types";

 interface Props {
  data: DashboardData;
+  onRefresh?: () => void;
 }

 function generateSummary(data: DashboardData): string {
@@ -51,11 +53,20 @@ function generateSummary(data: DashboardData): string {
  return parts.join(" ");
 }

-export function AISummaryCard({ data }: Props) {
+export function AISummaryCard({ data, onRefresh }: Props) {
+  const [spinning, setSpinning] = useState(false);
  const summary = generateSummary(data);

+  function handleRefresh() {
+    if (!onRefresh) return;
+    setSpinning(true);
+    onRefresh();
+    setTimeout(() => setSpinning(false), 1000);
+  }
+
  return (
    <div className="rounded-xl border border-neutral-200 bg-white p-5">
+      <div className="flex items-center justify-between">
        <div className="flex items-center gap-2">
          <div className="rounded-md bg-violet-50 p-1.5">
            <Sparkles className="h-4 w-4 text-violet-500" />
@@ -64,6 +75,18 @@ export function AISummaryCard({ data }: Props) {
            KI-Zusammenfassung
          </h2>
        </div>
+        {onRefresh && (
+          <button
+            onClick={handleRefresh}
+            title="Aktualisieren"
+            className="rounded-md p-1.5 text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-neutral-600"
+          >
+            <RefreshCw
+              className={`h-4 w-4 ${spinning ? "animate-spin" : ""}`}
+            />
+          </button>
+        )}
+      </div>
      <p className="mt-3 text-sm leading-relaxed text-neutral-700">
        {summary}
      </p>
--- a/frontend/src/components/dashboard/CaseOverviewGrid.tsx
+++ b/frontend/src/components/dashboard/CaseOverviewGrid.tsx
@@ -1,6 +1,7 @@
 "use client";

-import { FolderOpen, FolderPlus, Archive } from "lucide-react";
+import Link from "next/link";
+import { FolderOpen, FolderPlus, Archive, ChevronRight } from "lucide-react";
 import type { CaseSummary } from "@/lib/types";

 interface Props {
@@ -16,6 +17,7 @@ export function CaseOverviewGrid({ data }: Props) {
      icon: FolderOpen,
      color: "text-blue-600",
      bg: "bg-blue-50",
+      href: "/cases?status=active",
    },
    {
      label: "Neu (Monat)",
@@ -23,6 +25,7 @@ export function CaseOverviewGrid({ data }: Props) {
      icon: FolderPlus,
      color: "text-violet-600",
      bg: "bg-violet-50",
+      href: "/cases?status=active&since=month",
    },
    {
      label: "Abgeschlossen",
@@ -30,25 +33,33 @@ export function CaseOverviewGrid({ data }: Props) {
      icon: Archive,
      color: "text-neutral-500",
      bg: "bg-neutral-50",
+      href: "/cases?status=closed",
    },
  ];

  return (
    <div className="rounded-xl border border-neutral-200 bg-white p-5">
      <h2 className="text-sm font-semibold text-neutral-900">Aktenübersicht</h2>
-      <div className="mt-4 space-y-3">
+      <div className="mt-4 space-y-1">
        {items.map((item) => (
-          <div key={item.label} className="flex items-center justify-between">
+          <Link
+            key={item.label}
+            href={item.href}
+            className="group -mx-2 flex items-center justify-between rounded-lg px-2 py-2 transition-colors hover:bg-neutral-50"
+          >
            <div className="flex items-center gap-2.5">
              <div className={`rounded-md p-1.5 ${item.bg}`}>
                <item.icon className={`h-4 w-4 ${item.color}`} />
              </div>
              <span className="text-sm text-neutral-600">{item.label}</span>
            </div>
+            <div className="flex items-center gap-1.5">
              <span className="text-lg font-semibold tabular-nums text-neutral-900">
                {item.value}
              </span>
+              <ChevronRight className="h-4 w-4 text-neutral-300 transition-colors group-hover:text-neutral-500" />
            </div>
+          </Link>
        ))}
      </div>
    </div>
--- a/frontend/src/components/dashboard/DeadlineTrafficLights.tsx
+++ b/frontend/src/components/dashboard/DeadlineTrafficLights.tsx
@@ -1,6 +1,7 @@
 "use client";

 import { useEffect, useRef } from "react";
+import Link from "next/link";
 import { AlertTriangle, Clock, CheckCircle } from "lucide-react";
 import type { DeadlineSummary } from "@/lib/types";

@@ -27,10 +28,9 @@ function AnimatedCount({ value }: { value: number }) {

 interface Props {
  data: DeadlineSummary;
-  onFilter?: (filter: "overdue" | "this_week" | "ok") => void;
 }

-export function DeadlineTrafficLights({ data, onFilter }: Props) {
+export function DeadlineTrafficLights({ data }: Props) {
  const safe = data ?? { overdue_count: 0, due_this_week: 0, due_next_week: 0, ok_count: 0 };
  const cards = [
    {
@@ -38,6 +38,7 @@ export function DeadlineTrafficLights({ data, onFilter }: Props) {
      label: "Überfällig",
      count: safe.overdue_count ?? 0,
      icon: AlertTriangle,
+      href: "/fristen?status=overdue",
      bg: "bg-red-50",
      border: "border-red-200",
      iconColor: "text-red-500",
@@ -51,6 +52,7 @@ export function DeadlineTrafficLights({ data, onFilter }: Props) {
      label: "Diese Woche",
      count: safe.due_this_week ?? 0,
      icon: Clock,
+      href: "/fristen?status=this_week",
      bg: "bg-amber-50",
      border: "border-amber-200",
      iconColor: "text-amber-500",
@@ -64,6 +66,7 @@ export function DeadlineTrafficLights({ data, onFilter }: Props) {
      label: "Im Zeitplan",
      count: (safe.ok_count ?? 0) + (safe.due_next_week ?? 0),
      icon: CheckCircle,
+      href: "/fristen?status=ok",
      bg: "bg-emerald-50",
      border: "border-emerald-200",
      iconColor: "text-emerald-500",
@@ -77,9 +80,9 @@ export function DeadlineTrafficLights({ data, onFilter }: Props) {
  return (
    <div className="grid grid-cols-1 gap-4 sm:grid-cols-3">
      {cards.map((card) => (
-        <button
+        <Link
          key={card.key}
-          onClick={() => onFilter?.(card.key)}
+          href={card.href}
          className={`group relative overflow-hidden rounded-xl border ${card.border} ${card.bg} ${card.ring} p-6 text-left transition-all hover:shadow-md active:scale-[0.98]`}
        >
          {card.pulse && (
@@ -99,7 +102,7 @@ export function DeadlineTrafficLights({ data, onFilter }: Props) {
          <div className={`mt-4 text-4xl font-bold tracking-tight ${card.countColor}`}>
            <AnimatedCount value={card.count} />
          </div>
-        </button>
+        </Link>
      ))}
    </div>
  );
--- a/frontend/src/components/dashboard/QuickActions.tsx
+++ b/frontend/src/components/dashboard/QuickActions.tsx
@@ -1,7 +1,7 @@
 "use client";

 import Link from "next/link";
-import { FolderPlus, Clock, Sparkles, CalendarSync } from "lucide-react";
+import { FolderPlus, Clock, Sparkles, CalendarPlus } from "lucide-react";

 const actions = [
  {
@@ -12,22 +12,22 @@ const actions = [
  },
  {
    label: "Frist eintragen",
-    href: "/fristen",
+    href: "/fristen/neu",
    icon: Clock,
    color: "text-amber-600 bg-amber-50 hover:bg-amber-100",
  },
+  {
+    label: "Neuer Termin",
+    href: "/termine/neu",
+    icon: CalendarPlus,
+    color: "text-emerald-600 bg-emerald-50 hover:bg-emerald-100",
+  },
  {
    label: "AI Analyse",
    href: "/ai/extract",
    icon: Sparkles,
    color: "text-violet-600 bg-violet-50 hover:bg-violet-100",
  },
-  {
-    label: "CalDAV Sync",
-    href: "/einstellungen",
-    icon: CalendarSync,
-    color: "text-emerald-600 bg-emerald-50 hover:bg-emerald-100",
-  },
 ];

 export function QuickActions() {
--- a/frontend/src/components/dashboard/RecentActivityList.tsx
+++ b/frontend/src/components/dashboard/RecentActivityList.tsx
@@ -0,0 +1,80 @@
+"use client";
+
+import Link from "next/link";
+import { formatDistanceToNow, parseISO } from "date-fns";
+import { de } from "date-fns/locale";
+import {
+  FileText,
+  Scale,
+  Calendar,
+  Clock,
+  MessageSquare,
+  ChevronRight,
+} from "lucide-react";
+import type { RecentActivity } from "@/lib/types";
+
+const EVENT_ICONS: Record<string, typeof FileText> = {
+  status_changed: Scale,
+  deadline_created: Clock,
+  appointment_created: Calendar,
+  document_uploaded: FileText,
+  note_added: MessageSquare,
+};
+
+interface Props {
+  activities: RecentActivity[];
+}
+
+export function RecentActivityList({ activities }: Props) {
+  const safe = Array.isArray(activities) ? activities : [];
+
+  if (safe.length === 0) {
+    return null;
+  }
+
+  return (
+    <div className="rounded-xl border border-neutral-200 bg-white p-5">
+      <h2 className="text-sm font-semibold text-neutral-900">
+        Letzte Aktivität
+      </h2>
+      <div className="mt-3 divide-y divide-neutral-100">
+        {safe.map((activity) => {
+          const Icon = EVENT_ICONS[activity.event_type ?? ""] ?? FileText;
+          const timeAgo = activity.created_at
+            ? formatDistanceToNow(parseISO(activity.created_at), {
+                addSuffix: true,
+                locale: de,
+              })
+            : "";
+
+          return (
+            <Link
+              key={activity.id}
+              href={`/cases/${activity.case_id}`}
+              className="group flex items-center gap-3 py-2.5 transition-colors first:pt-0 last:pb-0 hover:bg-neutral-50 -mx-5 px-5"
+            >
+              <div className="rounded-md bg-neutral-100 p-1.5">
+                <Icon className="h-3.5 w-3.5 text-neutral-500" />
+              </div>
+              <div className="min-w-0 flex-1">
+                <p className="truncate text-sm text-neutral-900">
+                  {activity.title}
+                </p>
+                <div className="flex items-center gap-2 text-xs text-neutral-500">
+                  <span>{activity.case_number}</span>
+                  {timeAgo && (
+                    <>
+                      <span className="text-neutral-300">·</span>
+                      <span>{timeAgo}</span>
+                    </>
+                  )}
+                </div>
+              </div>
+              <ChevronRight className="h-4 w-4 shrink-0 text-neutral-300 transition-colors group-hover:text-neutral-500" />
+            </Link>
+          );
+        })}
+      </div>
+    </div>
+  );
+}
--- a/frontend/src/components/dashboard/UpcomingTimeline.tsx
+++ b/frontend/src/components/dashboard/UpcomingTimeline.tsx
@@ -1,8 +1,9 @@
 "use client";

+import Link from "next/link";
 import { format, parseISO, isToday, isTomorrow } from "date-fns";
 import { de } from "date-fns/locale";
-import { Clock, Calendar, MapPin } from "lucide-react";
+import { Clock, Calendar, MapPin, ChevronRight } from "lucide-react";
 import type { UpcomingDeadline, UpcomingAppointment } from "@/lib/types";

 interface Props {
@@ -80,8 +81,12 @@ export function UpcomingTimeline({ deadlines, appointments }: Props) {
 function TimelineEntry({ item }: { item: TimelineItem }) {
  if (item.type === "deadline") {
    const d = item.data;
+    const href = `/fristen/${d.id}`;
    return (
-      <div className="flex items-start gap-3 rounded-lg border border-neutral-100 bg-neutral-50/50 px-3 py-2.5">
+      <Link
+        href={href}
+        className="group flex items-start gap-3 rounded-lg border border-neutral-100 bg-neutral-50/50 px-3 py-2.5 transition-colors hover:border-neutral-200 hover:bg-neutral-100/50"
+      >
        <div className="mt-0.5 rounded-md bg-amber-50 p-1">
          <Clock className="h-3.5 w-3.5 text-amber-500" />
        </div>
@@ -90,19 +95,40 @@ function TimelineEntry({ item }: { item: TimelineItem }) {
            {d.title}
          </p>
          <p className="mt-0.5 truncate text-xs text-neutral-500">
-            {d.case_number} · {d.case_title}
+            {d.case_id ? (
+              <span
+                onClick={(e) => e.stopPropagation()}
+                className="inline"
+              >
+                <Link
+                  href={`/cases/${d.case_id}`}
+                  className="underline decoration-neutral-300 hover:text-neutral-900 hover:decoration-neutral-500"
+                >
+                  {d.case_number}
+                </Link>
+                {" · "}
+              </span>
+            ) : (
+              <>{d.case_number} · </>
+            )}
+            {d.case_title}
          </p>
        </div>
-        <span className="shrink-0 text-xs font-medium text-amber-600">
-          Frist
-        </span>
+        <div className="flex shrink-0 items-center gap-1.5">
+          <span className="text-xs font-medium text-amber-600">Frist</span>
+          <ChevronRight className="h-3.5 w-3.5 text-neutral-300 transition-colors group-hover:text-neutral-500" />
        </div>
+      </Link>
    );
  }

  const a = item.data;
+  const href = `/termine/${a.id}`;
  return (
-    <div className="flex items-start gap-3 rounded-lg border border-neutral-100 bg-neutral-50/50 px-3 py-2.5">
+    <Link
+      href={href}
+      className="group flex items-start gap-3 rounded-lg border border-neutral-100 bg-neutral-50/50 px-3 py-2.5 transition-colors hover:border-neutral-200 hover:bg-neutral-100/50"
+    >
      <div className="mt-0.5 rounded-md bg-blue-50 p-1">
        <Calendar className="h-3.5 w-3.5 text-blue-500" />
      </div>
@@ -121,7 +147,20 @@ function TimelineEntry({ item }: { item: TimelineItem }) {
              </span>
            </>
          )}
-          {a.case_number && (
+          {a.case_number && a.case_id && (
+            <>
+              <span className="text-neutral-300">·</span>
+              <span onClick={(e) => e.stopPropagation()}>
+                <Link
+                  href={`/cases/${a.case_id}`}
+                  className="underline decoration-neutral-300 hover:text-neutral-900 hover:decoration-neutral-500"
+                >
+                  {a.case_number}
+                </Link>
+              </span>
+            </>
+          )}
+          {a.case_number && !a.case_id && (
            <>
              <span className="text-neutral-300">·</span>
              <span>{a.case_number}</span>
@@ -129,9 +168,10 @@ function TimelineEntry({ item }: { item: TimelineItem }) {
          )}
        </div>
      </div>
-      <span className="shrink-0 text-xs font-medium text-blue-600">
-        Termin
-      </span>
+      <div className="flex shrink-0 items-center gap-1.5">
+        <span className="text-xs font-medium text-blue-600">Termin</span>
+        <ChevronRight className="h-3.5 w-3.5 text-neutral-300 transition-colors group-hover:text-neutral-500" />
      </div>
+    </Link>
  );
 }
--- a/frontend/src/components/deadlines/DeadlineList.tsx
+++ b/frontend/src/components/deadlines/DeadlineList.tsx
@@ -10,7 +10,14 @@ import { toast } from "sonner";
 import { useState, useMemo } from "react";
 import { EmptyState } from "@/components/ui/EmptyState";

-type StatusFilter = "all" | "pending" | "completed" | "overdue";
+type StatusFilter = "all" | "pending" | "completed" | "overdue" | "this_week" | "ok";
+
+function mapUrlStatus(status?: string): StatusFilter {
+  if (status === "overdue") return "overdue";
+  if (status === "this_week") return "this_week";
+  if (status === "ok") return "ok";
+  return "all";
+}

 function getUrgency(deadline: Deadline): "red" | "amber" | "green" {
  if (deadline.status === "completed") return "green";
@@ -47,9 +54,15 @@ const urgencyConfig = {
 const selectClass =
  "rounded-md border border-neutral-200 bg-white px-2.5 py-1 text-sm text-neutral-700 transition-colors focus:border-neutral-400 focus:ring-1 focus:ring-neutral-400 outline-none";

-export function DeadlineList() {
+interface Props {
+  initialStatus?: string;
+}
+
+export function DeadlineList({ initialStatus }: Props) {
  const queryClient = useQueryClient();
-  const [statusFilter, setStatusFilter] = useState<StatusFilter>("all");
+  const [statusFilter, setStatusFilter] = useState<StatusFilter>(
+    mapUrlStatus(initialStatus),
+  );
  const [caseFilter, setCaseFilter] = useState<string>("all");

  const { data: deadlines, isLoading } = useQuery({
@@ -90,6 +103,18 @@ export function DeadlineList() {
        if (d.status === "completed") return false;
        if (!isPast(parseISO(d.due_date))) return false;
      }
+      if (statusFilter === "this_week") {
+        if (d.status === "completed") return false;
+        const due = parseISO(d.due_date);
+        if (isPast(due)) return false;
+        if (!isThisWeek(due, { weekStartsOn: 1 })) return false;
+      }
+      if (statusFilter === "ok") {
+        if (d.status === "completed") return false;
+        const due = parseISO(d.due_date);
+        if (isPast(due)) return false;
+        if (isThisWeek(due, { weekStartsOn: 1 })) return false;
+      }
      if (caseFilter !== "all" && d.case_id !== caseFilter) return false;
      return true;
    });
@@ -144,10 +169,10 @@ export function DeadlineList() {
        </button>
        <button
          onClick={() =>
-            setStatusFilter(statusFilter === "pending" ? "all" : "pending")
+            setStatusFilter(statusFilter === "this_week" ? "all" : "this_week")
          }
          className={`rounded-lg border p-3 text-left transition-all ${
-            statusFilter === "pending"
+            statusFilter === "this_week"
              ? "border-amber-300 bg-amber-50 ring-1 ring-amber-200"
              : "border-neutral-200 bg-white hover:bg-neutral-50"
          }`}
@@ -158,9 +183,11 @@ export function DeadlineList() {
          <div className="text-xs text-neutral-500">Diese Woche</div>
        </button>
        <button
-          onClick={() => setStatusFilter("all")}
+          onClick={() =>
+            setStatusFilter(statusFilter === "ok" ? "all" : "ok")
+          }
          className={`rounded-lg border p-3 text-left transition-all ${
-            statusFilter === "all"
+            statusFilter === "ok"
              ? "border-green-300 bg-green-50 ring-1 ring-green-200"
              : "border-neutral-200 bg-white hover:bg-neutral-50"
          }`}
@@ -187,6 +214,8 @@ export function DeadlineList() {
          <option value="pending">Offen</option>
          <option value="completed">Erledigt</option>
          <option value="overdue">Überfällig</option>
+          <option value="this_week">Diese Woche</option>
+          <option value="ok">Im Zeitplan</option>
        </select>
        {Array.isArray(cases) && cases.length > 0 && (
          <select
--- a/frontend/src/components/layout/Breadcrumb.tsx
+++ b/frontend/src/components/layout/Breadcrumb.tsx
@@ -6,28 +6,33 @@ export interface BreadcrumbItem {
  href?: string;
 }

-interface BreadcrumbProps {
+interface Props {
  items: BreadcrumbItem[];
 }

-export function Breadcrumb({ items }: BreadcrumbProps) {
+export function Breadcrumb({ items }: Props) {
+  return (
+    <nav aria-label="Breadcrumb" className="mb-4 flex items-center gap-1 text-sm text-neutral-500">
+      {items.map((item, i) => {
+        const isLast = i === items.length - 1;
        return (
-    <nav className="flex items-center gap-1 text-sm text-neutral-400">
-      {items.map((item, i) => (
          <span key={i} className="flex items-center gap-1">
-          {i > 0 && <ChevronRight className="h-3.5 w-3.5" />}
-          {item.href ? (
+            {i > 0 && <ChevronRight className="h-3.5 w-3.5 text-neutral-300" />}
+            {isLast || !item.href ? (
+              <span className={isLast ? "font-medium text-neutral-900" : ""}>
+                {item.label}
+              </span>
+            ) : (
              <Link
                href={item.href}
-              className="transition-colors hover:text-neutral-700"
+                className="transition-colors hover:text-neutral-900"
              >
                {item.label}
              </Link>
-          ) : (
-            <span className="text-neutral-600">{item.label}</span>
            )}
          </span>
-      ))}
+        );
+      })}
    </nav>
  );
 }
--- a/frontend/src/components/notes/NotesList.tsx
+++ b/frontend/src/components/notes/NotesList.tsx
@@ -1,55 +1,49 @@
 "use client";

-import { useState } from "react";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
-import { format } from "date-fns";
-import { de } from "date-fns/locale";
-import { Plus, Pencil, Trash2, X, Loader2, StickyNote } from "lucide-react";
-import { toast } from "sonner";
 import { api } from "@/lib/api";
 import type { Note } from "@/lib/types";
-
-type ParentType = "case" | "deadline" | "appointment" | "case_event";
+import { format, parseISO } from "date-fns";
+import { de } from "date-fns/locale";
+import { Plus, Pencil, Trash2, X, Check, MessageSquare } from "lucide-react";
+import { useState } from "react";
+import { toast } from "sonner";

 interface NotesListProps {
-  parentType: ParentType;
+  parentType: "case" | "deadline" | "appointment" | "case_event";
  parentId: string;
 }

-const PARENT_PARAM: Record<ParentType, string> = {
-  case: "case_id",
-  deadline: "deadline_id",
-  appointment: "appointment_id",
-  case_event: "case_event_id",
-};
-
 export function NotesList({ parentType, parentId }: NotesListProps) {
  const queryClient = useQueryClient();
  const queryKey = ["notes", parentType, parentId];
-  const paramKey = PARENT_PARAM[parentType];

-  const [showForm, setShowForm] = useState(false);
  const [newContent, setNewContent] = useState("");
+  const [showNew, setShowNew] = useState(false);
  const [editingId, setEditingId] = useState<string | null>(null);
  const [editContent, setEditContent] = useState("");

-  const { data, isLoading } = useQuery({
+  const { data: notes, isLoading } = useQuery({
    queryKey,
-    queryFn: () => api.get<Note[]>(`/notes?${paramKey}=${parentId}`),
+    queryFn: () =>
+      api.get<Note[]>(`/notes?${parentType}_id=${parentId}`),
  });

-  const notes = Array.isArray(data) ? data : [];
-
  const createMutation = useMutation({
-    mutationFn: (content: string) =>
-      api.post<Note>("/notes", { [paramKey]: parentId, content }),
+    mutationFn: (content: string) => {
+      const body: Record<string, string> = {
+        content,
+        [`${parentType}_id`]: parentId,
+      };
+      return api.post<Note>("/notes", body);
+    },
    onSuccess: () => {
      queryClient.invalidateQueries({ queryKey });
      setNewContent("");
-      setShowForm(false);
+      setShowNew(false);
      toast.success("Notiz erstellt");
    },
-    onError: () => toast.error("Fehler beim Erstellen"),
+    onError: () => toast.error("Fehler beim Erstellen der Notiz"),
  });

  const updateMutation = useMutation({
@@ -60,7 +54,7 @@ export function NotesList({ parentType, parentId }: NotesListProps) {
      setEditingId(null);
      toast.success("Notiz aktualisiert");
    },
-    onError: () => toast.error("Fehler beim Aktualisieren"),
+    onError: () => toast.error("Fehler beim Aktualisieren der Notiz"),
  });

  const deleteMutation = useMutation({
@@ -69,32 +63,34 @@ export function NotesList({ parentType, parentId }: NotesListProps) {
      queryClient.invalidateQueries({ queryKey });
      toast.success("Notiz geloescht");
    },
-    onError: () => toast.error("Fehler beim Loeschen"),
+    onError: () => toast.error("Fehler beim Loeschen der Notiz"),
  });

+  function handleCreate() {
+    if (!newContent.trim()) return;
+    createMutation.mutate(newContent.trim());
+  }
+
+  function handleUpdate(id: string) {
+    if (!editContent.trim()) return;
+    updateMutation.mutate({ id, content: editContent.trim() });
+  }
+
  function startEdit(note: Note) {
    setEditingId(note.id);
    setEditContent(note.content);
  }

-  if (isLoading) {
-    return (
-      <div className="flex items-center justify-center py-8">
-        <Loader2 className="h-5 w-5 animate-spin text-neutral-400" />
-      </div>
-    );
-  }
+  const notesList = Array.isArray(notes) ? notes : [];

  return (
-    <div>
-      <div className="flex items-center justify-between">
-        <h3 className="text-sm font-medium text-neutral-700">
-          Notizen ({notes.length})
-        </h3>
-        {!showForm && (
+    <div className="rounded-lg border border-neutral-200 bg-white">
+      <div className="flex items-center justify-between border-b border-neutral-100 px-4 py-3">
+        <h3 className="text-sm font-medium text-neutral-900">Notizen</h3>
+        {!showNew && (
          <button
-            onClick={() => setShowForm(true)}
-            className="inline-flex items-center gap-1 text-sm text-neutral-500 transition-colors hover:text-neutral-700"
+            onClick={() => setShowNew(true)}
+            className="flex items-center gap-1 rounded-md px-2 py-1 text-xs text-neutral-500 transition-colors hover:bg-neutral-50 hover:text-neutral-700"
          >
            <Plus className="h-3.5 w-3.5" />
            Neu
@@ -102,33 +98,30 @@ export function NotesList({ parentType, parentId }: NotesListProps) {
        )}
      </div>

-      {showForm && (
-        <div className="mt-3 rounded-md border border-neutral-200 bg-neutral-50 p-3">
+      {showNew && (
+        <div className="border-b border-neutral-100 p-4">
          <textarea
            value={newContent}
            onChange={(e) => setNewContent(e.target.value)}
-            placeholder="Notiz eingeben..."
            rows={3}
-            className="w-full rounded-md border border-neutral-200 bg-white px-3 py-2 text-sm outline-none transition-colors focus:border-neutral-400 focus:ring-1 focus:ring-neutral-400"
            autoFocus
+            placeholder="Notiz schreiben..."
+            className="w-full rounded-md border border-neutral-200 px-3 py-2 text-sm outline-none focus:border-neutral-400 focus:ring-1 focus:ring-neutral-400"
          />
          <div className="mt-2 flex justify-end gap-2">
            <button
              onClick={() => {
-                setShowForm(false);
+                setShowNew(false);
                setNewContent("");
              }}
-              className="rounded-md px-3 py-1.5 text-sm text-neutral-500 hover:bg-neutral-200"
+              className="rounded-md px-2.5 py-1 text-xs text-neutral-500 hover:bg-neutral-50"
            >
              Abbrechen
            </button>
            <button
-              onClick={() => {
-                if (!newContent.trim()) return;
-                createMutation.mutate(newContent.trim());
-              }}
-              disabled={createMutation.isPending || !newContent.trim()}
-              className="rounded-md bg-neutral-900 px-3 py-1.5 text-sm font-medium text-white hover:bg-neutral-800 disabled:opacity-50"
+              onClick={handleCreate}
+              disabled={!newContent.trim() || createMutation.isPending}
+              className="rounded-md bg-neutral-900 px-2.5 py-1 text-xs font-medium text-white hover:bg-neutral-800 disabled:opacity-50"
            >
              {createMutation.isPending ? "Speichern..." : "Speichern"}
            </button>
@@ -136,79 +129,71 @@ export function NotesList({ parentType, parentId }: NotesListProps) {
        </div>
      )}

-      {notes.length === 0 && !showForm && (
-        <div className="mt-4 flex flex-col items-center py-6 text-center">
-          <div className="rounded-xl bg-neutral-100 p-3">
-            <StickyNote className="h-5 w-5 text-neutral-400" />
+      {isLoading ? (
+        <div className="space-y-2 p-4">
+          {[1, 2].map((i) => (
+            <div key={i} className="h-12 animate-pulse rounded-md bg-neutral-100" />
+          ))}
        </div>
-          <p className="mt-2 text-sm text-neutral-500">
+      ) : notesList.length === 0 ? (
+        <div className="flex flex-col items-center py-8 text-center">
+          <MessageSquare className="h-5 w-5 text-neutral-300" />
+          <p className="mt-2 text-sm text-neutral-400">
            Keine Notizen vorhanden.
          </p>
        </div>
-      )}
-
-      <div className="mt-3 space-y-2">
-        {notes.map((note) => (
-          <div
-            key={note.id}
-            className="rounded-md border border-neutral-200 bg-white px-4 py-3"
-          >
+      ) : (
+        <div className="divide-y divide-neutral-100">
+          {notesList.map((note) => (
+            <div key={note.id} className="group px-4 py-3">
              {editingId === note.id ? (
                <div>
                  <textarea
                    value={editContent}
                    onChange={(e) => setEditContent(e.target.value)}
                    rows={3}
-                  className="w-full rounded-md border border-neutral-200 bg-white px-3 py-2 text-sm outline-none transition-colors focus:border-neutral-400 focus:ring-1 focus:ring-neutral-400"
                    autoFocus
+                    className="w-full rounded-md border border-neutral-200 px-3 py-2 text-sm outline-none focus:border-neutral-400 focus:ring-1 focus:ring-neutral-400"
                  />
                  <div className="mt-2 flex justify-end gap-2">
                    <button
                      onClick={() => setEditingId(null)}
-                    className="rounded-md px-3 py-1.5 text-sm text-neutral-500 hover:bg-neutral-100"
+                      className="rounded-md p-1 text-neutral-400 hover:bg-neutral-50 hover:text-neutral-600"
                    >
-                    Abbrechen
+                      <X className="h-3.5 w-3.5" />
                    </button>
                    <button
-                    onClick={() => {
-                      if (!editContent.trim()) return;
-                      updateMutation.mutate({
-                        id: note.id,
-                        content: editContent.trim(),
-                      });
-                    }}
-                    disabled={updateMutation.isPending || !editContent.trim()}
-                    className="rounded-md bg-neutral-900 px-3 py-1.5 text-sm font-medium text-white hover:bg-neutral-800 disabled:opacity-50"
+                      onClick={() => handleUpdate(note.id)}
+                      disabled={!editContent.trim() || updateMutation.isPending}
+                      className="rounded-md p-1 text-neutral-400 hover:bg-neutral-50 hover:text-green-600"
                    >
-                    {updateMutation.isPending ? "Speichern..." : "Speichern"}
+                      <Check className="h-3.5 w-3.5" />
                    </button>
                  </div>
                </div>
              ) : (
                <div>
                  <div className="flex items-start justify-between">
-                  <p className="whitespace-pre-wrap text-sm text-neutral-800">
+                    <p className="whitespace-pre-wrap text-sm text-neutral-700">
                      {note.content}
                    </p>
-                  <div className="ml-3 flex shrink-0 gap-1">
+                    <div className="ml-4 flex shrink-0 gap-1 opacity-0 transition-opacity group-hover:opacity-100">
                      <button
                        onClick={() => startEdit(note)}
-                      className="rounded p-1 text-neutral-300 transition-colors hover:bg-neutral-100 hover:text-neutral-600"
-                      title="Bearbeiten"
+                        className="rounded p-1 text-neutral-400 hover:bg-neutral-50 hover:text-neutral-600"
                      >
-                      <Pencil className="h-3.5 w-3.5" />
+                        <Pencil className="h-3 w-3" />
                      </button>
                      <button
                        onClick={() => deleteMutation.mutate(note.id)}
-                      className="rounded p-1 text-neutral-300 transition-colors hover:bg-neutral-100 hover:text-red-500"
-                      title="Loeschen"
+                        className="rounded p-1 text-neutral-400 hover:bg-red-50 hover:text-red-500"
                      >
-                      <Trash2 className="h-3.5 w-3.5" />
+                        <Trash2 className="h-3 w-3" />
                      </button>
                    </div>
                  </div>
                  <p className="mt-1 text-xs text-neutral-400">
-                  {format(new Date(note.created_at), "d. MMM yyyy, HH:mm", {
+                    {format(parseISO(note.created_at), "d. MMM yyyy, HH:mm", {
                      locale: de,
                    })}
                    {note.updated_at !== note.created_at && " (bearbeitet)"}
@@ -218,6 +203,7 @@ export function NotesList({ parentType, parentId }: NotesListProps) {
            </div>
          ))}
        </div>
+      )}
    </div>
  );
 }
--- a/frontend/src/lib/types.ts
+++ b/frontend/src/lib/types.ts
@@ -236,11 +236,47 @@ export interface UpcomingAppointment {
  case_title?: string;
 }

+export interface RecentActivity {
+  id: string;
+  event_type?: string;
+  title: string;
+  case_id: string;
+  case_number: string;
+  event_date?: string;
+  created_at: string;
+}
+
 export interface DashboardData {
  deadline_summary: DeadlineSummary;
  case_summary: CaseSummary;
  upcoming_deadlines: UpcomingDeadline[];
  upcoming_appointments: UpcomingAppointment[];
+  recent_activity?: RecentActivity[];
+}
+
+// Notes
+export interface Note {
+  id: string;
+  tenant_id: string;
+  case_id?: string;
+  deadline_id?: string;
+  appointment_id?: string;
+  case_event_id?: string;
+  content: string;
+  created_by?: string;
+  created_at: string;
+  updated_at: string;
+}
+
+// Recent Activity
+export interface RecentActivity {
+  id: string;
+  event_type?: string;
+  title: string;
+  case_id: string;
+  case_number: string;
+  event_date?: string;
+  created_at: string;
 }

 // AI Extraction types
Author	SHA1	Message	Date
m	c15d5b72f2	fix: critical security hardening — tenant isolation, CORS, error leaking, input validation 1. Tenant isolation bypass (CRITICAL): TenantResolver now verifies user has access to X-Tenant-ID via user_tenants lookup before setting context. Added VerifyAccess method to TenantLookup interface and TenantService. 2. Consolidated tenant resolution: Removed duplicate resolveTenant() from helpers.go and tenant resolution from auth middleware. TenantResolver is now the single source of truth. Deadlines and AI handlers use auth.TenantFromContext() instead of direct DB queries. 3. CalDAV credential masking: tenant settings responses now mask CalDAV passwords with "********" via maskSettingsPassword helper. Applied to GetTenant, ListTenants, and UpdateSettings responses. 4. CORS + security headers: New middleware/security.go with CORS (restricted to FRONTEND_ORIGIN) and security headers (X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, X-XSS-Protection). 5. Internal error leaking: All writeError(w, 500, err.Error()) replaced with internalError() that logs via slog and returns generic "internal error" to client. Same for jsonError in tenant handler. 6. Input validation: Max length on title (500), description (10000), case_number (100), search (200). Pagination clamped to max 100. Content-Disposition filename sanitized against header injection. Regression test added for tenant access denial (403 on unauthorized X-Tenant-ID). All existing tests pass, go vet clean.	2026-03-30 11:01:14 +02:00
m	82878dffd5	docs: full system roadmap — from MVP to complete Kanzleimanagement	2026-03-28 02:35:20 +01:00
m	ac04930667	feat: comprehensive KanzlAI-mGMT system roadmap Full system vision document covering 23 features across 4 priority tiers: - P0 (must-have): audit trail, conflict checks, roles/permissions, notifications, time tracking, RVG calculator, invoicing, DATEV export - P1 (should-have): document templates, beA integration, full-text search, Wiedervorlagen, email integration, reporting - P2 (differentiator): patent family tracking, claim charts, UPC case law intelligence via mLex, AI document drafting, AI strategy analysis - P3 (nice-to-have): client portal, PWA, multi-language, EDA Includes data model designs (24 new tables), API specifications, implementation phases, competitive analysis, and risk register.	2026-03-28 02:30:39 +01:00
m	909f14062c	docs: comprehensive MVP audit — security, architecture, UX, competitive analysis	2026-03-28 02:26:39 +01:00
m	4b86dfa4ad	feat: update AUDIT.md with sub-agent findings Added 7 additional issues from deep-dive agents: - Race condition in HolidayService cache (critical) - Rate limiter X-Forwarded-For bypass (critical) - German umlaut typos throughout frontend - Silent error swallowing in createEvent - Missing React error boundaries - No RLS policies at database level - Updated priority roadmap with new items	2026-03-28 02:23:50 +01:00
m	60f1f4ef4a	feat: comprehensive MVP audit — security, architecture, UX, competitive analysis Structured assessment covering code quality, security (critical tenant isolation bypass found), architecture, UX gaps, testing coverage, deployment, and competitive positioning vs RA-MICRO/ADVOWARE/AnNoText/Actaport. Includes prioritized roadmap (P0-P3) with actionable items.	2026-03-28 02:22:07 +01:00
m	7c7ae396f4	feat: Phase D — case detail refactor to URL-based nested routes	2026-03-25 19:32:41 +01:00
m	433a0408f2	feat: Phase C — detail pages for deadlines, appointments, events, creation forms	2026-03-25 19:32:17 +01:00
m	cabea83784	feat: Phase B — interactive dashboard, breadcrumbs, clickable navigation	2026-03-25 19:31:59 +01:00
m	8863878b39	feat: Phase A backend — notes CRUD, detail endpoints, dashboard fix	2026-03-25 19:31:54 +01:00
m	84b178edbf	feat: Phase B — interactive dashboard, breadcrumbs, clickable navigation - Breadcrumb component: reusable nav with items array (label+href) - DeadlineTrafficLights: buttons → Links to /fristen?status={filter} - CaseOverviewGrid: static metrics → clickable Links to /cases?status={filter} - UpcomingTimeline: items → clickable Links to /fristen/{id} or /termine/{id} with case number links and hover chevron - QuickActions: swap CalDAV Sync for "Neuer Termin" → /termine/neu, fix "Frist eintragen" → /fristen/neu - AISummaryCard: add RefreshCw button with spinning animation - RecentActivityList: new component showing recent case events - DeadlineList: accept initialStatus prop, add this_week/ok filters - fristen/page.tsx: read searchParams.status for initial filter - Add breadcrumbs to dashboard, fristen, cases, termine pages - Add RecentActivity type, update DashboardData type	2026-03-25 19:29:13 +01:00
m	7094212dcf	feat: Phase C frontend detail pages for deadlines, appointments, events - Deadline detail page (/fristen/[id]) with status badge, due date, case context, complete button, and notes - Appointment detail page (/termine/[id]) with datetime, location, type badge, case link, description, and notes - Case event detail page (/cases/[id]/ereignisse/[eventId]) with event type icon, description, metadata, and notes - Standalone deadline creation (/fristen/neu) with case dropdown - Standalone appointment creation (/termine/neu) with optional case - Reusable Breadcrumb component for navigation hierarchy - Reusable NotesList component with inline create/edit/delete - Added Note and RecentActivity types to lib/types.ts	2026-03-25 19:29:12 +01:00
m	1e88dffd82	feat: Phase A backend — notes CRUD, detail endpoints, dashboard fix - Create kanzlai.notes table (polymorphic FK with CHECK constraint, partial indexes, RLS) - Add Note model, NoteService (ListByParent, Create, Update, Delete), and NoteHandler with endpoints: GET/POST /api/notes, PUT/DELETE /api/notes/{id} - Add GET /api/deadlines/{deadlineID} detail endpoint - Add GET /api/appointments/{id} detail endpoint - Add GET /api/case-events/{id} detail endpoint (new CaseEventHandler) - Fix dashboard query: add case_id to upcoming_deadlines SELECT, add id and case_id to recent_activity SELECT - Register all new routes in router.go	2026-03-25 19:26:21 +01:00