fix: improve friend wishlist navigation layout

Merge pull request 'feat: add friend wishlist link' (#12 ) from feature/friend-wishlist-link into main
Reviewed-on: #12
2026-04-26 23:44:06 +03:00 · 2026-04-26 20:30:23 +00:00 · 2026-04-26 23:29:20 +03:00 · 2026-04-26 19:18:14 +00:00 · 2026-04-26 22:16:59 +03:00 · 2026-04-26 18:52:25 +00:00
63 changed files with 6949 additions and 21 deletions
--- a/.env.example
+++ b/.env.example
@@ -1,12 +1,14 @@
 # ==========================================
 #  Database
 # ==========================================
-POSTGRES_USER=wishlist
-POSTGRES_PASSWORD=change_me
-POSTGRES_DB=family_wishlist
-# DATABASE_URL uses the docker-compose service name `postgres`.
-# When running backend outside docker against docker-postgres use localhost:5432.
-DATABASE_URL=postgresql://wishlist:change_me@postgres:5432/family_wishlist
+DB_HOST=postgres_budget
+DB_PORT=5432
+DB_NAME=db_family
+DB_USER=
+DB_PASSWORD=
+# Fill DATABASE_URL explicitly; .env files do not expand ${...} automatically for the app.
+# For local host-based development, point it to localhost:5432 instead of postgres_budget.
+DATABASE_URL=postgresql://<db_user>:<db_password>@postgres_budget:5432/db_family

 # ==========================================
 #  Users (two fixed accounts)
--- a/README.md
+++ b/README.md
@@ -0,0 +1,248 @@
+# Family Wishlist
+
+A small, private wishlist app for two users. Each user has their own profile, slug, and independent wishlist. Guests see a public page at `/u/<slug>` and can view active and fulfilled wishes.
+
+- **Backend**: Node.js 20, Fastify 4, Prisma 5, PostgreSQL 16
+- **Frontend**: React 18, Vite 5, Tailwind CSS, TanStack Query, React Hook Form + Zod
+- **Monorepo**: pnpm workspaces
+- **Deploy**: Docker Compose (shared Postgres + backend + nginx-served frontend)
+
+---
+
+## Features
+
+- Two fixed accounts (credentials in env), password stored only as a **bcrypt hash**.
+- Wish entity: title, price, currency, link, comment, image (auto-fetched from link or uploaded).
+- Statuses: **Active → Archive / Fulfilled → Trash** (kept for 30 days, then permanently removed by a daily cron job).
+- Restore from archive or trash. Duplicate from fulfilled into a new active wish.
+- Badges on cards:
+  - owner: `new` for wishes under 5 days old; `fulfilled`, `archived`, `trash` states.
+  - guest: `new` if this guest hasn't seen the wish yet (tracked by a cookie-based `guestId`); fulfilled wishes look visually dimmed.
+- Archive and trash are visible **only** to the owner.
+- Profile page at `/u/:slug`, public and readable by anyone with the link.
+
+---
+
+## Repository layout
+
+```
+apps/
+  backend/    Fastify API, Prisma schema, jobs, scripts
+  frontend/   React SPA
+packages/
+  shared/     zod schemas + DTO types shared between backend and frontend
+docker/       Dockerfiles + nginx.conf
+docker-compose.yml        prod stack (shared postgres + backend + frontend)
+docker-compose.dev.yml    dev helper (postgres only)
+.env.example  full env template
+```
+
+### Backend layout (`apps/backend/src`)
+
+```
+config/env.ts                    zod-validated process.env + resolveUsers()
+auth/users.registry.ts           in-memory user registry, single source of truth for credentials
+plugins/                         fastify plugins (auth, cors, cookie, jwt, rate-limit, static, guest, multipart, prisma)
+modules/
+  auth/     login / logout / me
+  profile/  GET / PATCH current user's profile
+  wishes/   CRUD + archive/complete/restore/duplicate + soft-delete
+  images/   OG-image fetcher + multipart upload + reset
+  public/   public profile and wishes + guest view tracking
+  meta/     /api/health + /api/version
+jobs/purge-trash.ts              node-cron daily purge of wishes older than 30 days
+utils/                           errors, bcrypt helpers, version helper
+```
+
+### Database (Prisma)
+
+See `apps/backend/prisma/schema.prisma`. Tables:
+
+- `User`      — `id`, `username`, `slug`, `displayName`, `bio`, `avatarUrl`. **No password hash.**
+- `Wish`      — `userId`, `title`, `price`, `currency`, `url`, `comment`, `imageUrl`, `imageSource`, `status`, timestamps, `sourceWishId` (for duplicates).
+- `GuestView` — `(guestId, wishId)` pairs for "already seen" tracking.
+
+### Password storage
+
+The plain password is **never stored** in this application — not in the database, not in env, not in logs. Storage split:
+
+| Value | Location |
+|---|---|
+| Original password | Owner's password manager only |
+| bcrypt hash       | `.env` (`USER1_PASSWORD_HASH`, `USER2_PASSWORD_HASH`) |
+| Users registry    | Built from env on process start, lives in RAM |
+| DB                | Public fields only (username, slug, displayName) |
+| JWT               | `{ id, username }` — no credentials |
+
+Verification flow (see `apps/backend/src/modules/auth/auth.service.ts`):
+
+1. Client `POST /api/auth/login` with `{ username, password }` over HTTPS.
+2. Server looks up user in the in-memory registry by `username`.
+3. `bcrypt.compare(password, user.passwordHash)` runs unconditionally (dummy compare if the username is unknown) — this prevents username enumeration via response timing.
+4. On success: signed JWT set as an httpOnly cookie (`fw_auth`). Rate limit: 5 logins / 10 minutes per IP.
+5. Fastify logger redacts `req.body.password`, `req.headers.cookie`, `req.headers.authorization`.
+
+---
+
+## Getting started
+
+### Prerequisites
+
+- Node.js 20+
+- pnpm 9+ (`corepack enable && corepack prepare pnpm@9.12.0 --activate`)
+- Docker + Docker Compose (for the full stack)
+- OpenSSL (for generating secrets)
+
+### 1. Initialize git + install deps
+
+```bash
+git init -b main
+pnpm install
+```
+
+### 2. Prepare the environment file
+
+```bash
+cp .env.example .env
+```
+
+Generate two strong secrets:
+
+```bash
+openssl rand -hex 32   # paste into JWT_SECRET
+openssl rand -hex 32   # paste into COOKIE_SECRET
+```
+
+Generate a bcrypt hash for each user's password (the password is only present in your shell history — clear it afterwards if you care):
+
+```bash
+pnpm hash-password "Alice's strong password"
+# => $2b$12$eImiTXuWV...   copy this into USER1_PASSWORD_HASH
+
+pnpm hash-password "Bob's strong password"
+# => $2b$12$aBcDeFgHi...   copy this into USER2_PASSWORD_HASH
+```
+
+Review the rest of `.env`:
+
+- `USER1_USERNAME`, `USER1_SLUG`, `USER1_DISPLAY_NAME`
+- `USER2_USERNAME`, `USER2_SLUG`, `USER2_DISPLAY_NAME`
+- `DB_HOST=postgres_budget`, `DB_PORT=5432`, `DB_NAME=db_family`
+- `DB_USER`, `DB_PASSWORD`, `DATABASE_URL` (sensitive values stay only in `.env`)
+- `PUBLIC_APP_URL` (used for CORS in production)
+
+### 3. Run the shared Docker stack
+
+```bash
+docker compose up --build
+```
+
+Opens:
+
+- Frontend: http://localhost:8080
+- Backend API: http://localhost:8080/api (proxied by nginx) or http://localhost:3000 if you map `family-wishlist-backend`
+
+Before first start, create a dedicated database and user for this project in the existing Postgres host:
+
+- host: `postgres_budget`
+- port: `5432`
+- database: `db_family`
+- user/password: set only in `.env` and do not commit them
+
+On first start, the backend:
+
+1. Runs `prisma db push` against the configured shared Postgres database (creates tables from `schema.prisma`; idempotent).
+2. Seeds/upserts both users from env (public fields only — password hash stays in env).
+3. Starts Fastify on port 3000.
+4. Registers the daily trash-purge cron (runs at 03:17 UTC, also once on startup).
+
+> For a stricter migration workflow, switch to `prisma migrate dev` locally to produce
+> versioned migration files and change the Docker `CMD` to `prisma migrate deploy`.
+
+### 4. Local development (hot reload)
+
+Run Postgres in a container, apps on the host:
+
+```bash
+docker compose -f docker-compose.dev.yml up -d
+# Override DATABASE_URL to point to localhost:
+# DATABASE_URL=postgresql://<DB_USER>:<DB_PASSWORD>@localhost:5432/db_family
+
+pnpm --filter @family-wishlist/backend prisma:push    # apply schema (first time and on schema changes)
+pnpm --filter @family-wishlist/backend seed           # upsert two users from env into DB
+pnpm dev
+```
+
+This starts both apps in parallel:
+
+- Frontend: http://localhost:5173 (proxying `/api` and `/uploads` to http://localhost:3000)
+- Backend: http://localhost:3000
+- Dev Postgres: `localhost:5432` for local-only development data
+
+The dev compose file stays isolated from the shared `postgres_budget` instance. Keep production credentials and local credentials in `.env`, and never hardcode them in compose files or source code.
+
+### 5. Useful scripts
+
+```bash
+pnpm typecheck                         # typecheck all workspaces
+pnpm format                            # prettier on the whole repo
+pnpm hash-password "<password>"        # print bcrypt hash to stdout
+pnpm --filter @family-wishlist/backend prisma:studio   # GUI over DB
+```
+
+---
+
+## API
+
+All responses are JSON. Authenticated endpoints require the `fw_auth` cookie.
+
+| Method | Path | Auth | Description |
+|---|---|---|---|
+| POST   | `/api/auth/login`                  | —     | Returns auth user, sets cookie. Rate-limited. |
+| POST   | `/api/auth/logout`                 | —     | Clears cookie. |
+| GET    | `/api/auth/me`                     | owner | Current user. |
+| GET    | `/api/profile`                     | owner | Own profile. |
+| PATCH  | `/api/profile`                     | owner | Update slug/displayName/bio/avatar. |
+| GET    | `/api/wishes?status=active\|archived\|completed\|deleted` | owner | List own wishes. |
+| POST   | `/api/wishes`                      | owner | Create. |
+| GET    | `/api/wishes/:id`                  | owner | Get own wish. |
+| PATCH  | `/api/wishes/:id`                  | owner | Update. |
+| DELETE | `/api/wishes/:id`                  | owner | Soft-delete (to trash). |
+| POST   | `/api/wishes/:id/archive`          | owner | |
+| POST   | `/api/wishes/:id/complete`         | owner | |
+| POST   | `/api/wishes/:id/restore`          | owner | From archive or trash back to active. |
+| POST   | `/api/wishes/:id/duplicate`        | owner | Copy fulfilled wish into a new active one. |
+| POST   | `/api/wishes/:id/image`            | owner | Multipart image upload. |
+| POST   | `/api/wishes/:id/image/refresh-og` | owner | Re-fetch OG image from link. |
+| DELETE | `/api/wishes/:id/image`            | owner | Reset to default. |
+| GET    | `/api/public/:slug`                | —     | Public profile. |
+| GET    | `/api/public/:slug/wishes`         | —     | Active + fulfilled wishes. Sets `isNewForGuest`. |
+| POST   | `/api/public/:slug/views`          | —     | Body `{ wishIds: [] }`. Marks as seen. |
+| GET    | `/api/health`, `/api/version`      | —     | Meta. |
+
+---
+
+## Versioning
+
+Each package has its own version (`apps/backend/package.json` and `apps/frontend/package.json`). The app footer shows both:
+
+```
+frontend v0.1.0 · backend v0.1.0
+```
+
+Bump them per semver on each change:
+- patch — bug fixes and small non-breaking tweaks,
+- minor — backward-compatible features,
+- major — breaking changes.
+
+---
+
+## Security notes
+
+- Cookies are `httpOnly`, `SameSite=Lax`, `Secure` in production.
+- All auth-scoped routes re-check ownership in the service layer (`userId` vs `req.user.id`).
+- `/api/auth/login` is rate-limited; username enumeration is mitigated by a constant-time dummy compare.
+- Image fetcher has a 10s timeout, a 5 MB cap, and accepts only `image/jpeg|png|webp|gif`.
+- Multipart upload cap: 8 MB, one file per request.
+- Prisma cascades delete `GuestView` rows when their wish is purged.
+- In production, terminate TLS in front of the nginx container (Caddy / Traefik / cloud load balancer).
--- a/apps/backend/package.json
+++ b/apps/backend/package.json
@@ -31,6 +31,7 @@
    "@prisma/client": "^5.19.1",
    "bcryptjs": "^2.4.3",
    "fastify": "^4.28.1",
+    "fastify-plugin": "^4.5.1",
    "fastify-type-provider-zod": "^2.0.0",
    "nanoid": "^5.0.7",
    "node-cron": "^3.0.3",
--- a/apps/backend/src/modules/images/og.service.ts
+++ b/apps/backend/src/modules/images/og.service.ts
@@ -16,6 +16,13 @@ interface DownloadResult {
  contentType: string;
 }

+function getOgImageUrl(ogImage: unknown): string | undefined {
+  const entry = Array.isArray(ogImage) ? ogImage[0] : ogImage;
+  if (!entry || typeof entry !== 'object') return undefined;
+  const { url } = entry as { url?: unknown };
+  return typeof url === 'string' ? url : undefined;
+}
+
 async function downloadImage(url: string): Promise<DownloadResult | null> {
  try {
    const controller = new AbortController();
@@ -27,7 +34,7 @@ async function downloadImage(url: string): Promise<DownloadResult | null> {
        headers: { 'user-agent': 'FamilyWishlistBot/1.0 (+image-fetch)' },
      });
      if (res.statusCode >= 400) return null;
-      const contentType = (res.headers['content-type']?.toString() ?? '').split(';')[0].trim();
+      const contentType = ((res.headers['content-type']?.toString() ?? '').split(';')[0] ?? '').trim();
      if (!ALLOWED_MIME.has(contentType)) return null;
      const chunks: Buffer[] = [];
      let total = 0;
@@ -60,8 +67,7 @@ export async function fetchOgImageForWish(
  try {
    const parsed = await ogs({ url: pageUrl, timeout: FETCH_TIMEOUT_MS });
    if (parsed.error || !parsed.result) return;
-    const imageEntry = parsed.result.ogImage;
-    const imageUrl = Array.isArray(imageEntry) ? imageEntry[0]?.url : imageEntry?.url;
+    const imageUrl = getOgImageUrl(parsed.result.ogImage);
    if (!imageUrl) return;

    const absolute = new URL(imageUrl, pageUrl).toString();
--- a/apps/backend/src/modules/images/storage.service.ts
+++ b/apps/backend/src/modules/images/storage.service.ts
@@ -25,6 +25,20 @@ export async function saveUploadedImage(
  return { imageUrl: relative };
 }

+export async function saveUploadedAvatar(
+  userId: string,
+  mime: string,
+  buffer: Buffer,
+): Promise<{ imageUrl: string }> {
+  const ext = MIME_TO_EXT[mime];
+  if (!ext) throw new ValidationError('Unsupported image type');
+  const filename = `${userId}-${nanoid(8)}.${ext}`;
+  const relative = `/uploads/avatar/${filename}`;
+  const absPath = resolve(env.UPLOADS_DIR, 'avatar', filename);
+  await writeFile(absPath, buffer);
+  return { imageUrl: relative };
+}
+
 export async function deleteLocalImageIfAny(imageUrl: string | null): Promise<void> {
  if (!imageUrl) return;
  if (!imageUrl.startsWith('/uploads/')) return;
--- a/apps/backend/src/modules/profile/profile.routes.ts
+++ b/apps/backend/src/modules/profile/profile.routes.ts
@@ -1,7 +1,11 @@
 import type { FastifyInstance } from 'fastify';
 import { updateProfileSchema } from '@family-wishlist/shared';
-import { ConflictError, NotFoundError } from '../../utils/errors.js';
+import { ConflictError, NotFoundError, ValidationError } from '../../utils/errors.js';
 import { Prisma } from '@prisma/client';
+import { deleteLocalImageIfAny, saveUploadedAvatar } from '../images/storage.service.js';
+import { usersRegistry } from '../../auth/users.registry.js';
+
+const MAX_AVATAR_BYTES = 2 * 1024 * 1024;

 export default async function profileRoutes(app: FastifyInstance) {
  app.addHook('preHandler', app.authenticate);
@@ -12,6 +16,16 @@ export default async function profileRoutes(app: FastifyInstance) {
    return profile;
  });

+  app.get('/friend', async (request) => {
+    const friend = usersRegistry.all().find((u) => u.id !== request.user.id);
+    if (!friend) return null;
+
+    return app.prisma.user.findUnique({
+      where: { id: friend.id },
+      select: { slug: true, displayName: true, avatarUrl: true },
+    });
+  });
+
  app.patch('/', async (request) => {
    const body = updateProfileSchema.parse(request.body);
    try {
@@ -27,4 +41,25 @@ export default async function profileRoutes(app: FastifyInstance) {
      throw err;
    }
  });
+
+  app.post('/avatar', async (request) => {
+    const current = await app.prisma.user.findUnique({ where: { id: request.user.id } });
+    if (!current) throw new NotFoundError('Profile');
+
+    const data = await request.file();
+    if (!data) throw new ValidationError('No file uploaded');
+
+    const buffer = await data.toBuffer();
+    if (buffer.byteLength > MAX_AVATAR_BYTES) {
+      throw new ValidationError('Avatar must be 2 MB or less');
+    }
+
+    const { imageUrl } = await saveUploadedAvatar(request.user.id, data.mimetype, buffer);
+    await deleteLocalImageIfAny(current.avatarUrl);
+
+    return app.prisma.user.update({
+      where: { id: request.user.id },
+      data: { avatarUrl: imageUrl },
+    });
+  });
 }
--- a/apps/backend/src/plugins/auth.ts
+++ b/apps/backend/src/plugins/auth.ts
@@ -1,6 +1,7 @@
 import fp from 'fastify-plugin';
 import fastifyJwt from '@fastify/jwt';
 import fastifyCookie from '@fastify/cookie';
+import type { FastifyReply } from 'fastify';
 import { env } from '../config/env.js';
 import { UnauthorizedError } from '../utils/errors.js';

@@ -28,7 +29,7 @@ export default fp(async (app) => {
  });

  // helpers for routes
-  app.decorate('setAuthCookie', ((reply, token) => {
+  app.decorate('setAuthCookie', ((reply: FastifyReply, token: string) => {
    reply.setCookie(AUTH_COOKIE, token, {
      httpOnly: true,
      secure: env.NODE_ENV === 'production',
@@ -38,7 +39,7 @@ export default fp(async (app) => {
    });
  }) as never);

-  app.decorate('clearAuthCookie', ((reply) => {
+  app.decorate('clearAuthCookie', ((reply: FastifyReply) => {
    reply.clearCookie(AUTH_COOKIE, { path: '/' });
  }) as never);
 });
--- a/apps/backend/tsconfig.build.json
+++ b/apps/backend/tsconfig.build.json
@@ -2,9 +2,9 @@
  "extends": "./tsconfig.json",
  "compilerOptions": {
    "noEmit": false,
-    "rootDir": "./src",
+    "rootDir": "./",
    "outDir": "./dist"
  },
-  "include": ["src/**/*"],
+  "include": ["src/**/*", "prisma/seed.ts"],
  "exclude": ["**/*.test.ts", "dist"]
 }
--- a/apps/frontend/.dockerignore
+++ b/apps/frontend/.dockerignore
@@ -0,0 +1,5 @@
+node_modules
+dist
+.env
+.env.*
+*.log
--- a/apps/frontend/index.html
+++ b/apps/frontend/index.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="color-scheme" content="light" />
+    <link rel="preconnect" href="https://rsms.me/" />
+    <link rel="stylesheet" href="https://rsms.me/inter/inter.css" />
+    <link
+      href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,500;9..144,600;9..144,700&display=swap"
+      rel="stylesheet"
+    />
+    <title>Family Wishlist</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>
--- a/apps/frontend/package.json
+++ b/apps/frontend/package.json
@@ -0,0 +1,39 @@
+{
+  "name": "@family-wishlist/frontend",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite --host 0.0.0.0 --port 5173",
+    "build": "tsc -b && vite build",
+    "preview": "vite preview --host 0.0.0.0 --port 4173",
+    "typecheck": "tsc -b",
+    "lint": "echo 'skip'"
+  },
+  "dependencies": {
+    "@family-wishlist/shared": "workspace:*",
+    "@hookform/resolvers": "^3.9.0",
+    "@tanstack/react-query": "^5.56.2",
+    "clsx": "^2.1.1",
+    "lucide-react": "^0.445.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-hook-form": "^7.53.0",
+    "react-router-dom": "^6.26.2",
+    "sonner": "^1.5.0",
+    "tailwind-merge": "^2.5.2",
+    "zod": "^3.23.8",
+    "zustand": "^4.5.5"
+  },
+  "devDependencies": {
+    "@types/node": "^20.16.5",
+    "@types/react": "^18.3.5",
+    "@types/react-dom": "^18.3.0",
+    "@vitejs/plugin-react": "^4.3.1",
+    "autoprefixer": "^10.4.20",
+    "postcss": "^8.4.47",
+    "tailwindcss": "^3.4.11",
+    "typescript": "^5.6.2",
+    "vite": "^5.4.6"
+  }
+}
--- a/apps/frontend/postcss.config.js
+++ b/apps/frontend/postcss.config.js
@@ -0,0 +1,6 @@
+export default {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+};
--- a/apps/frontend/public/default-gift.svg
+++ b/apps/frontend/public/default-gift.svg
@@ -0,0 +1,37 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 320 240" width="320" height="240" role="img" aria-label="Gift box">
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#FFF2EA" />
+      <stop offset="1" stop-color="#FFE2D1" />
+    </linearGradient>
+    <linearGradient id="box" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#E27896" />
+      <stop offset="1" stop-color="#C85276" />
+    </linearGradient>
+    <linearGradient id="ribbon" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#F4C04E" />
+      <stop offset="1" stop-color="#E0A21A" />
+    </linearGradient>
+  </defs>
+  <rect width="320" height="240" fill="url(#bg)" />
+  <g transform="translate(70 60)">
+    <!-- box body -->
+    <rect x="0" y="40" width="180" height="110" rx="10" fill="url(#box)" />
+    <rect x="0" y="36" width="180" height="16" rx="8" fill="#F2A1B6" />
+    <!-- vertical ribbon -->
+    <rect x="80" y="36" width="20" height="114" fill="url(#ribbon)" />
+    <!-- bow -->
+    <g transform="translate(90 22)">
+      <path d="M0 0 C-28 -24 -46 12 -20 14 L0 14 Z" fill="url(#ribbon)" />
+      <path d="M0 0 C28 -24 46 12 20 14 L0 14 Z" fill="url(#ribbon)" />
+      <circle cx="0" cy="10" r="6" fill="#F4C04E" stroke="#B7830D" stroke-width="1" />
+    </g>
+    <!-- sparkles -->
+    <g fill="#F4C04E" opacity="0.9">
+      <circle cx="-28" cy="18" r="3" />
+      <circle cx="210" cy="48" r="2.5" />
+      <circle cx="-18" cy="120" r="2" />
+      <circle cx="206" cy="130" r="3" />
+    </g>
+  </g>
+</svg>
--- a/apps/frontend/public/empty-state.svg
+++ b/apps/frontend/public/empty-state.svg
@@ -0,0 +1,28 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 260 240" width="260" height="240" role="img" aria-label="Empty wishlist">
+  <defs>
+    <linearGradient id="e-bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#FFF2EA" stop-opacity="0" />
+      <stop offset="1" stop-color="#FFE2D1" stop-opacity="0.9" />
+    </linearGradient>
+  </defs>
+  <rect x="20" y="30" width="220" height="190" rx="20" fill="url(#e-bg)" stroke="#EBD7C6" stroke-dasharray="4 6" />
+  <g transform="translate(130 130)">
+    <circle r="54" fill="#FFE2D1" />
+    <circle r="54" fill="none" stroke="#F4C04E" stroke-opacity="0.5" stroke-width="2" />
+    <g transform="translate(-32 -30)">
+      <rect x="0" y="14" width="64" height="48" rx="6" fill="#E27896" />
+      <rect x="0" y="10" width="64" height="10" rx="4" fill="#F2A1B6" />
+      <rect x="28" y="10" width="8" height="52" fill="#F4C04E" />
+      <g transform="translate(32 4)">
+        <path d="M0 0 C-14 -12 -24 6 -10 8 L0 8 Z" fill="#F4C04E" />
+        <path d="M0 0 C14 -12 24 6 10 8 L0 8 Z" fill="#F4C04E" />
+      </g>
+    </g>
+  </g>
+  <g fill="#F4C04E" opacity="0.85">
+    <circle cx="40" cy="60" r="3" />
+    <circle cx="222" cy="82" r="2.5" />
+    <circle cx="52" cy="200" r="2" />
+    <circle cx="214" cy="186" r="3" />
+  </g>
+</svg>
--- a/apps/frontend/public/favicon.svg
+++ b/apps/frontend/public/favicon.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="14" fill="#E27896" />
+  <g transform="translate(14 18)">
+    <rect x="0" y="12" width="36" height="22" rx="3" fill="#FFF1F6" />
+    <rect x="0" y="9" width="36" height="6" rx="2" fill="#F2A1B6" />
+    <rect x="15" y="9" width="6" height="25" fill="#F4C04E" />
+    <g transform="translate(18 5)">
+      <path d="M0 0 C-8 -7 -14 3 -6 5 L0 5 Z" fill="#F4C04E" />
+      <path d="M0 0 C8 -7 14 3 6 5 L0 5 Z" fill="#F4C04E" />
+    </g>
+  </g>
+</svg>
--- a/apps/frontend/src/App.tsx
+++ b/apps/frontend/src/App.tsx
@@ -0,0 +1,37 @@
+import { useEffect } from 'react';
+import { RouterProvider } from 'react-router-dom';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { Toaster } from 'sonner';
+import { router } from './routes';
+import { useAuthStore } from './features/auth/authStore';
+import { I18nProvider } from './i18n/i18n';
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      refetchOnWindowFocus: false,
+      retry: 1,
+    },
+  },
+});
+
+function AuthBoot({ children }: { children: React.ReactNode }) {
+  const init = useAuthStore((s) => s.init);
+  useEffect(() => {
+    void init();
+  }, [init]);
+  return <>{children}</>;
+}
+
+export function App() {
+  return (
+    <I18nProvider>
+      <QueryClientProvider client={queryClient}>
+        <AuthBoot>
+          <RouterProvider router={router} />
+        </AuthBoot>
+        <Toaster position="top-center" richColors closeButton />
+      </QueryClientProvider>
+    </I18nProvider>
+  );
+}
--- a/apps/frontend/src/components/LanguageSwitcher.tsx
+++ b/apps/frontend/src/components/LanguageSwitcher.tsx
@@ -0,0 +1,41 @@
+import { Languages } from 'lucide-react';
+import { useI18n, type Language } from '@/i18n/i18n';
+import { cn } from '@/lib/cn';
+
+const languages: Array<{ value: Language; label: string }> = [
+  { value: 'ru', label: 'RU' },
+  { value: 'en', label: 'EN' },
+];
+
+export function LanguageSwitcher({ className }: { className?: string }) {
+  const { language, setLanguage, t } = useI18n();
+
+  return (
+    <div
+      className={cn(
+        'inline-flex items-center gap-1 rounded-md border border-border bg-surface/90 p-1 text-xs shadow-card',
+        className,
+      )}
+      aria-label={t('language.switch')}
+    >
+      <Languages className="ml-1 h-3.5 w-3.5 text-muted" aria-hidden />
+      {languages.map((item) => (
+        <button
+          key={item.value}
+          type="button"
+          onClick={() => setLanguage(item.value)}
+          className={cn(
+            'rounded px-2 py-1 font-semibold transition-colors',
+            language === item.value
+              ? 'bg-primary text-primary-foreground'
+              : 'text-muted hover:bg-surface-muted hover:text-ink',
+          )}
+          aria-pressed={language === item.value}
+          title={item.value === 'ru' ? t('language.ru') : t('language.en')}
+        >
+          {item.label}
+        </button>
+      ))}
+    </div>
+  );
+}
--- a/apps/frontend/src/components/Layout/AppShell.tsx
+++ b/apps/frontend/src/components/Layout/AppShell.tsx
@@ -0,0 +1,15 @@
+import { Outlet } from 'react-router-dom';
+import { Header } from './Header';
+import { Footer } from './Footer';
+
+export function AppShell() {
+  return (
+    <div className="flex min-h-screen flex-col">
+      <Header />
+      <main className="container-page flex-1 py-6 sm:py-10">
+        <Outlet />
+      </main>
+      <Footer />
+    </div>
+  );
+}
--- a/apps/frontend/src/components/Layout/Footer.tsx
+++ b/apps/frontend/src/components/Layout/Footer.tsx
@@ -0,0 +1,34 @@
+import { useQuery } from '@tanstack/react-query';
+import { Gift } from 'lucide-react';
+import { api } from '@/lib/api';
+import { FRONTEND_VERSION } from '@/lib/version';
+import { useI18n } from '@/i18n/i18n';
+
+interface VersionInfo {
+  backend: string;
+}
+
+export function Footer() {
+  const { t } = useI18n();
+  const { data } = useQuery({
+    queryKey: ['version'],
+    queryFn: () => api.get<VersionInfo>('/api/version'),
+    staleTime: 10 * 60 * 1000,
+  });
+
+  return (
+    <footer className="container-page mt-10 py-6 text-xs text-muted">
+      <div className="flex flex-col items-center justify-between gap-2 sm:flex-row">
+        <div className="flex items-center gap-2">
+          <Gift className="h-4 w-4" aria-hidden />
+          <span className="font-display text-sm">{t('app.name')}</span>
+        </div>
+        <div className="flex items-center gap-3">
+          <span>{t('footer.frontend', { version: FRONTEND_VERSION })}</span>
+          <span className="opacity-50">·</span>
+          <span>{t('footer.backend', { version: data?.backend ?? '...' })}</span>
+        </div>
+      </div>
+    </footer>
+  );
+}
--- a/apps/frontend/src/components/Layout/Header.tsx
+++ b/apps/frontend/src/components/Layout/Header.tsx
@@ -0,0 +1,119 @@
+import { Link, NavLink, useNavigate } from 'react-router-dom';
+import { Archive, CheckCircle2, Gift, LogOut, Sparkles, Trash2, UserCog, Users } from 'lucide-react';
+import type { ComponentType } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { Button } from '../ui/Button';
+import { useAuthStore } from '@/features/auth/authStore';
+import { cn } from '@/lib/cn';
+import { useI18n, type TranslationKey } from '@/i18n/i18n';
+import { LanguageSwitcher } from '../LanguageSwitcher';
+import { api } from '@/lib/api';
+
+type NavIcon = ComponentType<{ className?: string }>;
+
+interface FriendProfile {
+  slug: string;
+  displayName: string;
+  avatarUrl: string | null;
+}
+
+const links = [
+  { to: '/', label: 'header.active', icon: Sparkles, end: true },
+  { to: '/completed', label: 'header.fulfilled', icon: CheckCircle2 },
+  { to: '/archive', label: 'header.archive', icon: Archive },
+  { to: '/trash', label: 'header.trash', icon: Trash2 },
+] satisfies Array<{
+  to: string;
+  label: TranslationKey;
+  icon: NavIcon;
+  end?: boolean;
+}>;
+
+export function Header() {
+  const user = useAuthStore((s) => s.user);
+  const logout = useAuthStore((s) => s.logout);
+  const navigate = useNavigate();
+  const { t } = useI18n();
+  const friend = useQuery({
+    queryKey: ['profile-friend'],
+    queryFn: () => api.get<FriendProfile | null>('/api/profile/friend'),
+    staleTime: 10 * 60 * 1000,
+    enabled: user != null,
+  });
+
+  if (!user) return null;
+
+  return (
+    <header className="container-page pt-6">
+      <div className="grid grid-cols-1 items-center gap-3 rounded-lg border border-border bg-surface/80 px-4 py-3 backdrop-blur lg:grid-cols-[auto_minmax(0,1fr)_auto]">
+        <Link to="/" className="flex min-w-0 items-center gap-2">
+          <span className="inline-flex h-9 w-9 items-center justify-center rounded-md bg-primary text-primary-foreground shadow-card">
+            <Gift className="h-4 w-4" />
+          </span>
+          <div className="min-w-0">
+            <div className="font-display text-lg leading-tight">{t('app.name')}</div>
+            <div className="truncate text-xs text-muted">
+              {t('header.signedInAs', { name: user.displayName })}
+            </div>
+          </div>
+        </Link>
+
+        <nav className="flex min-w-0 items-center gap-1 overflow-x-auto whitespace-nowrap lg:justify-center">
+          {links.map((l) => (
+            <NavLink
+              key={l.to}
+              to={l.to}
+              end={l.end}
+              className={({ isActive }) =>
+                cn(
+                  'inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-sm font-medium transition-colors',
+                  isActive ? 'bg-primary text-primary-foreground shadow-card' : 'text-ink hover:bg-ink/5',
+                )
+              }
+            >
+              <l.icon className="h-4 w-4" />
+              {t(l.label)}
+            </NavLink>
+          ))}
+          {friend.data && (
+            <NavLink
+              to={`/u/${friend.data.slug}`}
+              className={({ isActive }) =>
+                cn(
+                  'inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-sm font-medium transition-colors',
+                  isActive ? 'bg-primary text-primary-foreground shadow-card' : 'text-ink hover:bg-ink/5',
+                )
+              }
+            >
+              <Users className="h-4 w-4" />
+              {t('header.friendWishes', { name: friend.data.displayName })}
+            </NavLink>
+          )}
+        </nav>
+
+        <div className="flex shrink-0 items-center gap-1 justify-self-start lg:justify-self-end">
+          <LanguageSwitcher />
+          <Button
+            variant="ghost"
+            size="sm"
+            onClick={() => navigate('/settings')}
+            title={t('header.profileSettings')}
+          >
+            <UserCog className="h-4 w-4" />
+            {t('header.profile')}
+          </Button>
+          <Button
+            variant="ghost"
+            size="sm"
+            onClick={() => {
+              void logout().then(() => navigate('/login'));
+            }}
+          >
+            <LogOut className="h-4 w-4" />
+            {t('header.logout')}
+          </Button>
+        </div>
+      </div>
+    </header>
+  );
+}
--- a/apps/frontend/src/components/Layout/ProtectedRoute.tsx
+++ b/apps/frontend/src/components/Layout/ProtectedRoute.tsx
@@ -0,0 +1,21 @@
+import { Navigate, useLocation } from 'react-router-dom';
+import type { ReactNode } from 'react';
+import { useAuthStore } from '@/features/auth/authStore';
+import { useI18n } from '@/i18n/i18n';
+
+export function ProtectedRoute({ children }: { children: ReactNode }) {
+  const { user, status } = useAuthStore();
+  const location = useLocation();
+  const { t } = useI18n();
+  if (status !== 'ready') {
+    return (
+      <div className="flex min-h-[50vh] items-center justify-center text-muted">
+        {t('protected.loading')}
+      </div>
+    );
+  }
+  if (!user) {
+    return <Navigate to="/login" replace state={{ from: location }} />;
+  }
+  return <>{children}</>;
+}
--- a/apps/frontend/src/components/WishBadges/WishBadges.tsx
+++ b/apps/frontend/src/components/WishBadges/WishBadges.tsx
@@ -0,0 +1,53 @@
+import { Check, Sparkles, Archive, Trash2 } from 'lucide-react';
+import type { Wish } from '@family-wishlist/shared';
+import { cn } from '@/lib/cn';
+import { useI18n } from '@/i18n/i18n';
+
+interface Props {
+  wish: Wish & { isNewForOwner?: boolean };
+  view: 'owner' | 'guest';
+  className?: string;
+}
+
+export function WishBadges({ wish, view, className }: Props) {
+  const { t } = useI18n();
+  const badges: JSX.Element[] = [];
+
+  const isNew =
+    view === 'owner' ? wish.isNewForOwner === true : wish.isNewForGuest === true;
+  if (isNew && wish.status === 'ACTIVE') {
+    badges.push(
+      <span className="wish-badge wish-badge--new" key="new">
+        <Sparkles className="h-3 w-3" aria-hidden />
+        {t('wish.badge.new')}
+      </span>,
+    );
+  }
+  if (wish.status === 'COMPLETED') {
+    badges.push(
+      <span className="wish-badge wish-badge--completed" key="done">
+        <Check className="h-3 w-3" aria-hidden />
+        {t('wish.badge.fulfilled')}
+      </span>,
+    );
+  }
+  if (wish.status === 'ARCHIVED' && view === 'owner') {
+    badges.push(
+      <span className="wish-badge wish-badge--archived" key="arch">
+        <Archive className="h-3 w-3" aria-hidden />
+        {t('wish.badge.archived')}
+      </span>,
+    );
+  }
+  if (wish.status === 'DELETED' && view === 'owner') {
+    badges.push(
+      <span className="wish-badge wish-badge--deleted" key="del">
+        <Trash2 className="h-3 w-3" aria-hidden />
+        {t('wish.badge.trash')}
+      </span>,
+    );
+  }
+
+  if (badges.length === 0) return null;
+  return <div className={cn('flex flex-wrap gap-1.5', className)}>{badges}</div>;
+}
--- a/apps/frontend/src/components/WishCard/WishCard.tsx
+++ b/apps/frontend/src/components/WishCard/WishCard.tsx
@@ -0,0 +1,193 @@
+import { memo, useState } from 'react';
+import type { Wish } from '@family-wishlist/shared';
+import {
+  Archive,
+  CheckCircle2,
+  Copy,
+  ExternalLink,
+  MoreHorizontal,
+  Pencil,
+  RotateCcw,
+  Trash2,
+} from 'lucide-react';
+import { WishBadges } from '../WishBadges/WishBadges';
+import { Button } from '../ui/Button';
+import { cn } from '@/lib/cn';
+import { formatPrice } from '@/lib/format';
+import { useI18n } from '@/i18n/i18n';
+
+export type WishCardView = 'owner' | 'guest';
+
+export interface WishCardAction {
+  key: string;
+  icon: React.ComponentType<{ className?: string }>;
+  label: string;
+  onClick: () => void;
+  danger?: boolean;
+}
+
+interface WishCardProps {
+  wish: Wish & { isNewForOwner?: boolean };
+  view: WishCardView;
+  onEdit?: () => void;
+  onArchive?: () => void;
+  onComplete?: () => void;
+  onRestore?: () => void;
+  onDuplicate?: () => void;
+  onDelete?: () => void;
+  footer?: React.ReactNode;
+}
+
+function WishCardInner({
+  wish,
+  view,
+  onEdit,
+  onArchive,
+  onComplete,
+  onRestore,
+  onDuplicate,
+  onDelete,
+  footer,
+}: WishCardProps) {
+  const [menuOpen, setMenuOpen] = useState(false);
+  const { locale, t } = useI18n();
+  const completed = wish.status === 'COMPLETED';
+  const priceLabel = formatPrice(wish.price, wish.currency, locale);
+  const imageSrc = wish.imageUrl ?? '/default-gift.svg';
+
+  const actions: WishCardAction[] = [];
+  if (view === 'owner') {
+    if (wish.status === 'ACTIVE') {
+      if (onEdit) actions.push({ key: 'edit', icon: Pencil, label: t('wish.action.edit'), onClick: onEdit });
+      if (onComplete)
+        actions.push({
+          key: 'complete',
+          icon: CheckCircle2,
+          label: t('wish.action.complete'),
+          onClick: onComplete,
+        });
+      if (onArchive)
+        actions.push({ key: 'archive', icon: Archive, label: t('wish.action.archive'), onClick: onArchive });
+      if (onDelete)
+        actions.push({
+          key: 'delete',
+          icon: Trash2,
+          label: t('wish.action.delete'),
+          onClick: onDelete,
+          danger: true,
+        });
+    } else if (wish.status === 'ARCHIVED') {
+      if (onRestore)
+        actions.push({ key: 'restore', icon: RotateCcw, label: t('wish.action.restore'), onClick: onRestore });
+      if (onDelete)
+        actions.push({
+          key: 'delete',
+          icon: Trash2,
+          label: t('wish.action.delete'),
+          onClick: onDelete,
+          danger: true,
+        });
+    } else if (wish.status === 'COMPLETED') {
+      if (onDuplicate)
+        actions.push({
+          key: 'duplicate',
+          icon: Copy,
+          label: t('wish.action.duplicate'),
+          onClick: onDuplicate,
+        });
+      if (onDelete)
+        actions.push({
+          key: 'delete',
+          icon: Trash2,
+          label: t('wish.action.delete'),
+          onClick: onDelete,
+          danger: true,
+        });
+    } else if (wish.status === 'DELETED') {
+      if (onRestore)
+        actions.push({ key: 'restore', icon: RotateCcw, label: t('wish.action.restore'), onClick: onRestore });
+    }
+  }
+
+  return (
+    <article className={cn('wish-card', completed && 'wish-card--completed')}>
+      <div className="wish-card__image-wrap">
+        <img
+          className="wish-card__image"
+          src={imageSrc}
+          alt={wish.title}
+          loading="lazy"
+          onError={(e) => {
+            (e.currentTarget as HTMLImageElement).src = '/default-gift.svg';
+          }}
+        />
+        <div className="absolute left-3 top-3">
+          <WishBadges wish={wish} view={view} />
+        </div>
+        {actions.length > 0 && (
+          <div className="absolute right-3 top-3">
+            <div className="relative">
+              <Button
+                variant="secondary"
+                size="icon"
+                aria-label={t('wish.actions')}
+                onClick={() => setMenuOpen((v) => !v)}
+              >
+                <MoreHorizontal className="h-4 w-4" />
+              </Button>
+              {menuOpen && (
+                <>
+                  <div
+                    className="fixed inset-0 z-10"
+                    onClick={() => setMenuOpen(false)}
+                    aria-hidden
+                  />
+                  <div className="absolute right-0 z-20 mt-2 w-48 overflow-hidden rounded-md border border-border bg-surface shadow-pop">
+                    {actions.map((a) => (
+                      <button
+                        key={a.key}
+                        type="button"
+                        onClick={() => {
+                          setMenuOpen(false);
+                          a.onClick();
+                        }}
+                        className={cn(
+                          'flex w-full items-center gap-2 px-3 py-2 text-left text-sm transition-colors hover:bg-surface-muted',
+                          a.danger && 'text-danger',
+                        )}
+                      >
+                        <a.icon className="h-4 w-4" />
+                        {a.label}
+                      </button>
+                    ))}
+                  </div>
+                </>
+              )}
+            </div>
+          </div>
+        )}
+      </div>
+      <div className="wish-card__body">
+        <h3 className="wish-card__title">{wish.title}</h3>
+        <div className="flex items-center gap-2">
+          {priceLabel && <span className="wish-card__price">{priceLabel}</span>}
+          {wish.url && (
+            <a
+              href={wish.url}
+              target="_blank"
+              rel="noreferrer noopener"
+              className="inline-flex items-center gap-1 text-xs font-medium text-primary hover:text-primary-600"
+            >
+              <ExternalLink className="h-3 w-3" />
+              {t('wish.openLink')}
+            </a>
+          )}
+        </div>
+        {wish.comment && <p className="wish-card__comment">{wish.comment}</p>}
+        {footer}
+      </div>
+    </article>
+  );
+}
+
+export const WishCard = memo(WishCardInner);
--- a/apps/frontend/src/components/WishForm/WishForm.tsx
+++ b/apps/frontend/src/components/WishForm/WishForm.tsx
@@ -0,0 +1,214 @@
+import { useEffect, useRef, useState } from 'react';
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { createWishSchema, type CreateWishInput, type Wish } from '@family-wishlist/shared';
+import { Button } from '../ui/Button';
+import { Input } from '../ui/Input';
+import { Textarea } from '../ui/Textarea';
+import { Label } from '../ui/Label';
+import { Modal } from '../ui/Modal';
+import { ImageIcon, Loader2, RefreshCcw, Trash2, Upload } from 'lucide-react';
+import {
+  useCreateWish,
+  useRefreshOg,
+  useResetWishImage,
+  useUpdateWish,
+  useUploadWishImage,
+} from '@/features/wishes/wishes.hooks';
+import { translateValidation, useI18n } from '@/i18n/i18n';
+
+interface Props {
+  open: boolean;
+  mode: 'create' | 'edit';
+  initial?: Wish;
+  onClose: () => void;
+}
+
+export function WishForm({ open, mode, initial, onClose }: Props) {
+  const { t } = useI18n();
+  const create = useCreateWish();
+  const update = useUpdateWish();
+  const upload = useUploadWishImage();
+  const refreshOg = useRefreshOg();
+  const resetImage = useResetWishImage();
+
+  const fileInputRef = useRef<HTMLInputElement>(null);
+  const [pendingId, setPendingId] = useState<string | null>(null);
+
+  const {
+    register,
+    handleSubmit,
+    reset,
+    formState: { errors, isSubmitting },
+  } = useForm<CreateWishInput>({
+    resolver: zodResolver(createWishSchema),
+    defaultValues: {
+      title: initial?.title ?? '',
+      price: initial?.price ?? '',
+      currency: initial?.currency ?? 'RUB',
+      url: initial?.url ?? '',
+      comment: initial?.comment ?? '',
+    },
+  });
+
+  useEffect(() => {
+    if (!open) return;
+    reset({
+      title: initial?.title ?? '',
+      price: initial?.price ?? '',
+      currency: initial?.currency ?? 'RUB',
+      url: initial?.url ?? '',
+      comment: initial?.comment ?? '',
+    });
+    setPendingId(initial?.id ?? null);
+  }, [open, initial, reset]);
+
+  const submit = handleSubmit(async (values) => {
+    if (mode === 'create') {
+      const created = await create.mutateAsync(values);
+      setPendingId(created.id);
+    } else if (initial) {
+      await update.mutateAsync({ id: initial.id, input: values });
+    }
+    onClose();
+  });
+
+  const activeId = pendingId ?? initial?.id ?? null;
+  const canEditImage = activeId != null;
+
+  return (
+    <Modal
+      open={open}
+      onClose={onClose}
+      title={mode === 'create' ? t('wishForm.addTitle') : t('wishForm.editTitle')}
+      description={
+        mode === 'create'
+          ? t('wishForm.addDescription')
+          : t('wishForm.editDescription')
+      }
+      size="lg"
+      footer={
+        <>
+          <Button variant="ghost" onClick={onClose}>
+            {t('common.cancel')}
+          </Button>
+          <Button type="submit" form="wish-form" disabled={isSubmitting}>
+            {isSubmitting && <Loader2 className="h-4 w-4 animate-spin" />}
+            {mode === 'create' ? t('wishForm.addSubmit') : t('common.save')}
+          </Button>
+        </>
+      }
+    >
+      <form id="wish-form" className="grid gap-4" onSubmit={submit}>
+        <div className="field">
+          <Label htmlFor="title">{t('wishForm.title')}</Label>
+          <Input id="title" placeholder={t('wishForm.titlePlaceholder')} {...register('title')} />
+          {errors.title && (
+            <span className="field__error">{translateValidation(t, errors.title.message)}</span>
+          )}
+        </div>
+
+        <div className="grid gap-4 sm:grid-cols-[1fr_auto]">
+          <div className="field">
+            <Label htmlFor="price">{t('wishForm.price')}</Label>
+            <Input
+              id="price"
+              placeholder={t('wishForm.pricePlaceholder')}
+              inputMode="decimal"
+              {...register('price')}
+            />
+            {errors.price && (
+              <span className="field__error">
+                {translateValidation(t, errors.price.message as string)}
+              </span>
+            )}
+          </div>
+          <div className="field">
+            <Label htmlFor="currency">{t('wishForm.currency')}</Label>
+            <Input id="currency" maxLength={3} className="uppercase w-24" {...register('currency')} />
+          </div>
+        </div>
+
+        <div className="field">
+          <Label htmlFor="url">{t('wishForm.link')}</Label>
+          <Input id="url" type="url" placeholder="https://..." {...register('url')} />
+          {errors.url && (
+            <span className="field__error">
+              {translateValidation(t, errors.url.message as string)}
+            </span>
+          )}
+          <p className="text-xs text-muted">
+            {t('wishForm.linkHint')}
+          </p>
+        </div>
+
+        <div className="field">
+          <Label htmlFor="comment">{t('wishForm.comment')}</Label>
+          <Textarea
+            id="comment"
+            rows={3}
+            placeholder={t('wishForm.commentPlaceholder')}
+            {...register('comment')}
+          />
+        </div>
+      </form>
+
+      {canEditImage && activeId && (
+        <section className="mt-6 rounded-md border border-border bg-surface-muted p-4">
+          <div className="mb-3 flex items-center gap-2 text-sm font-medium text-ink">
+            <ImageIcon className="h-4 w-4" />
+            {t('wishForm.image')}
+          </div>
+          <div className="flex flex-wrap items-center gap-2">
+            <input
+              ref={fileInputRef}
+              type="file"
+              accept="image/jpeg,image/png,image/webp,image/gif"
+              className="hidden"
+              onChange={(e) => {
+                const file = e.target.files?.[0];
+                if (file) void upload.mutateAsync({ id: activeId, file });
+                e.currentTarget.value = '';
+              }}
+            />
+            <Button
+              variant="secondary"
+              size="sm"
+              onClick={() => fileInputRef.current?.click()}
+              disabled={upload.isPending}
+            >
+              {upload.isPending ? (
+                <Loader2 className="h-4 w-4 animate-spin" />
+              ) : (
+                <Upload className="h-4 w-4" />
+              )}
+              {t('wishForm.uploadCustom')}
+            </Button>
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={() => void refreshOg.mutateAsync(activeId)}
+              disabled={refreshOg.isPending}
+            >
+              {refreshOg.isPending ? (
+                <Loader2 className="h-4 w-4 animate-spin" />
+              ) : (
+                <RefreshCcw className="h-4 w-4" />
+              )}
+              {t('wishForm.refreshFromLink')}
+            </Button>
+            <Button
+              variant="ghost"
+              size="sm"
+              onClick={() => void resetImage.mutateAsync(activeId)}
+              disabled={resetImage.isPending}
+            >
+              <Trash2 className="h-4 w-4" />
+              {t('wishForm.resetImage')}
+            </Button>
+          </div>
+        </section>
+      )}
+    </Modal>
+  );
+}
--- a/apps/frontend/src/components/ui/Button.tsx
+++ b/apps/frontend/src/components/ui/Button.tsx
@@ -0,0 +1,42 @@
+import { forwardRef, type ButtonHTMLAttributes } from 'react';
+import { cn } from '@/lib/cn';
+
+type Variant = 'primary' | 'secondary' | 'ghost' | 'danger' | 'outline';
+type Size = 'sm' | 'md' | 'lg' | 'icon';
+
+const base =
+  'inline-flex items-center justify-center gap-2 rounded-md font-medium transition-all duration-150 focus:outline-none focus-visible:shadow-focus disabled:cursor-not-allowed disabled:opacity-50';
+
+const variants: Record<Variant, string> = {
+  primary: 'bg-primary text-primary-foreground hover:bg-primary-600 shadow-card',
+  secondary: 'bg-surface text-ink shadow-card hover:bg-surface-muted',
+  ghost: 'text-ink hover:bg-ink/5',
+  outline: 'border border-border bg-surface text-ink hover:bg-surface-muted',
+  danger: 'bg-danger text-white hover:brightness-95 shadow-card',
+};
+
+const sizes: Record<Size, string> = {
+  sm: 'h-8 px-3 text-sm',
+  md: 'h-10 px-4 text-sm',
+  lg: 'h-12 px-6 text-base',
+  icon: 'h-9 w-9',
+};
+
+export interface ButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
+  variant?: Variant;
+  size?: Size;
+}
+
+export const Button = forwardRef<HTMLButtonElement, ButtonProps>(function Button(
+  { className, variant = 'primary', size = 'md', type = 'button', ...rest },
+  ref,
+) {
+  return (
+    <button
+      ref={ref}
+      type={type}
+      className={cn(base, variants[variant], sizes[size], className)}
+      {...rest}
+    />
+  );
+});
--- a/apps/frontend/src/components/ui/Input.tsx
+++ b/apps/frontend/src/components/ui/Input.tsx
@@ -0,0 +1,8 @@
+import { forwardRef, type InputHTMLAttributes } from 'react';
+import { cn } from '@/lib/cn';
+
+export const Input = forwardRef<HTMLInputElement, InputHTMLAttributes<HTMLInputElement>>(
+  function Input({ className, ...rest }, ref) {
+    return <input ref={ref} className={cn('field__input', className)} {...rest} />;
+  },
+);
--- a/apps/frontend/src/components/ui/Label.tsx
+++ b/apps/frontend/src/components/ui/Label.tsx
@@ -0,0 +1,6 @@
+import type { LabelHTMLAttributes } from 'react';
+import { cn } from '@/lib/cn';
+
+export function Label({ className, ...rest }: LabelHTMLAttributes<HTMLLabelElement>) {
+  return <label className={cn('field__label', className)} {...rest} />;
+}
--- a/apps/frontend/src/components/ui/Modal.tsx
+++ b/apps/frontend/src/components/ui/Modal.tsx
@@ -0,0 +1,78 @@
+import { useEffect, type ReactNode } from 'react';
+import { createPortal } from 'react-dom';
+import { X } from 'lucide-react';
+import { cn } from '@/lib/cn';
+import { Button } from './Button';
+
+interface ModalProps {
+  open: boolean;
+  onClose: () => void;
+  title: ReactNode;
+  description?: ReactNode;
+  children: ReactNode;
+  footer?: ReactNode;
+  size?: 'md' | 'lg';
+}
+
+export function Modal({
+  open,
+  onClose,
+  title,
+  description,
+  children,
+  footer,
+  size = 'md',
+}: ModalProps) {
+  useEffect(() => {
+    if (!open) return;
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === 'Escape') onClose();
+    };
+    window.addEventListener('keydown', onKey);
+    const prev = document.body.style.overflow;
+    document.body.style.overflow = 'hidden';
+    return () => {
+      window.removeEventListener('keydown', onKey);
+      document.body.style.overflow = prev;
+    };
+  }, [open, onClose]);
+
+  if (!open) return null;
+
+  return createPortal(
+    <div className="fixed inset-0 z-50 flex items-end justify-center p-0 sm:items-center sm:p-6">
+      <div
+        className="absolute inset-0 bg-ink/40 backdrop-blur-sm animate-fade-in-up"
+        onClick={onClose}
+        aria-hidden
+      />
+      <div
+        role="dialog"
+        aria-modal="true"
+        className={cn(
+          'relative w-full bg-surface shadow-pop animate-fade-in-up',
+          'rounded-t-xl sm:rounded-xl',
+          size === 'md' ? 'sm:max-w-lg' : 'sm:max-w-2xl',
+          'max-h-[90vh] overflow-hidden flex flex-col',
+        )}
+      >
+        <header className="flex items-start justify-between gap-4 border-b border-border px-5 py-4">
+          <div className="min-w-0">
+            <h2 className="text-lg font-semibold text-ink">{title}</h2>
+            {description && <p className="mt-1 text-sm text-muted">{description}</p>}
+          </div>
+          <Button variant="ghost" size="icon" onClick={onClose} aria-label="Close">
+            <X className="h-5 w-5" />
+          </Button>
+        </header>
+        <div className="overflow-y-auto px-5 py-5">{children}</div>
+        {footer && (
+          <footer className="flex items-center justify-end gap-2 border-t border-border px-5 py-4">
+            {footer}
+          </footer>
+        )}
+      </div>
+    </div>,
+    document.body,
+  );
+}
--- a/apps/frontend/src/components/ui/Textarea.tsx
+++ b/apps/frontend/src/components/ui/Textarea.tsx
@@ -0,0 +1,16 @@
+import { forwardRef, type TextareaHTMLAttributes } from 'react';
+import { cn } from '@/lib/cn';
+
+export const Textarea = forwardRef<
+  HTMLTextAreaElement,
+  TextareaHTMLAttributes<HTMLTextAreaElement>
+>(function Textarea({ className, rows = 3, ...rest }, ref) {
+  return (
+    <textarea
+      ref={ref}
+      rows={rows}
+      className={cn('field__textarea', className)}
+      {...rest}
+    />
+  );
+});
--- a/apps/frontend/src/features/auth/authStore.ts
+++ b/apps/frontend/src/features/auth/authStore.ts
@@ -0,0 +1,49 @@
+import { create } from 'zustand';
+import type { AuthUser } from '@family-wishlist/shared';
+import { api, ApiError } from '@/lib/api';
+
+interface AuthState {
+  user: AuthUser | null;
+  status: 'idle' | 'loading' | 'ready';
+  init: () => Promise<void>;
+  login: (username: string, password: string) => Promise<void>;
+  logout: () => Promise<void>;
+  refresh: () => Promise<void>;
+}
+
+export const useAuthStore = create<AuthState>((set) => ({
+  user: null,
+  status: 'idle',
+  init: async () => {
+    set({ status: 'loading' });
+    try {
+      const user = await api.get<AuthUser>('/api/auth/me');
+      set({ user, status: 'ready' });
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 401) {
+        set({ user: null, status: 'ready' });
+        return;
+      }
+      set({ user: null, status: 'ready' });
+    }
+  },
+  login: async (username, password) => {
+    const user = await api.post<AuthUser>('/api/auth/login', { username, password });
+    set({ user });
+  },
+  logout: async () => {
+    try {
+      await api.post('/api/auth/logout');
+    } finally {
+      set({ user: null });
+    }
+  },
+  refresh: async () => {
+    try {
+      const user = await api.get<AuthUser>('/api/auth/me');
+      set({ user });
+    } catch {
+      set({ user: null });
+    }
+  },
+}));
--- a/apps/frontend/src/features/wishes/wishes.api.ts
+++ b/apps/frontend/src/features/wishes/wishes.api.ts
@@ -0,0 +1,41 @@
+import type {
+  CreateWishInput,
+  UpdateWishInput,
+  Wish,
+  WishStatus,
+} from '@family-wishlist/shared';
+import { api } from '@/lib/api';
+
+export type WishWithOwnerBadge = Wish & { isNewForOwner?: boolean };
+
+export type OwnerStatus = 'active' | 'archived' | 'completed' | 'deleted';
+
+export const wishesApi = {
+  list: (status: OwnerStatus) =>
+    api.get<WishWithOwnerBadge[]>(`/api/wishes?status=${status}`),
+
+  get: (id: string) => api.get<Wish>(`/api/wishes/${id}`),
+
+  create: (input: CreateWishInput) => api.post<Wish, CreateWishInput>('/api/wishes', input),
+
+  update: (id: string, input: UpdateWishInput) =>
+    api.patch<Wish, UpdateWishInput>(`/api/wishes/${id}`, input),
+
+  remove: (id: string) => api.delete<Wish>(`/api/wishes/${id}`),
+  archive: (id: string) => api.post<Wish>(`/api/wishes/${id}/archive`),
+  complete: (id: string) => api.post<Wish>(`/api/wishes/${id}/complete`),
+  restore: (id: string) => api.post<Wish>(`/api/wishes/${id}/restore`),
+  duplicate: (id: string) => api.post<Wish>(`/api/wishes/${id}/duplicate`),
+
+  uploadImage: (id: string, file: File) => {
+    const fd = new FormData();
+    fd.append('file', file, file.name);
+    return api.upload<Wish>(`/api/wishes/${id}/image`, fd);
+  },
+  refreshOg: (id: string) => api.post<Wish>(`/api/wishes/${id}/image/refresh-og`),
+  deleteImage: (id: string) => api.delete<Wish>(`/api/wishes/${id}/image`),
+};
+
+export function statusToQuery(s: WishStatus): OwnerStatus {
+  return s.toLowerCase() as OwnerStatus;
+}
--- a/apps/frontend/src/features/wishes/wishes.hooks.ts
+++ b/apps/frontend/src/features/wishes/wishes.hooks.ts
@@ -0,0 +1,156 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import type { CreateWishInput, UpdateWishInput } from '@family-wishlist/shared';
+import { toast } from 'sonner';
+import { wishesApi, type OwnerStatus } from './wishes.api';
+import { ApiError } from '@/lib/api';
+import { useI18n } from '@/i18n/i18n';
+
+const LIST_KEY = (status: OwnerStatus) => ['wishes', status] as const;
+
+function invalidateAll(client: ReturnType<typeof useQueryClient>): void {
+  void client.invalidateQueries({ queryKey: ['wishes'] });
+}
+
+function toastError(err: unknown, fallback: string): void {
+  if (err instanceof ApiError) toast.error(err.message);
+  else toast.error(fallback);
+}
+
+export function useWishes(status: OwnerStatus) {
+  return useQuery({
+    queryKey: LIST_KEY(status),
+    queryFn: () => wishesApi.list(status),
+    staleTime: 10_000,
+  });
+}
+
+export function useCreateWish() {
+  const client = useQueryClient();
+  const { t } = useI18n();
+  return useMutation({
+    mutationFn: (input: CreateWishInput) => wishesApi.create(input),
+    onSuccess: () => {
+      invalidateAll(client);
+      toast.success(t('toast.wishAdded'));
+    },
+    onError: (err) => toastError(err, t('toast.genericError')),
+  });
+}
+
+export function useUpdateWish() {
+  const client = useQueryClient();
+  const { t } = useI18n();
+  return useMutation({
+    mutationFn: (vars: { id: string; input: UpdateWishInput }) =>
+      wishesApi.update(vars.id, vars.input),
+    onSuccess: () => {
+      invalidateAll(client);
+      toast.success(t('toast.saved'));
+    },
+    onError: (err) => toastError(err, t('toast.genericError')),
+  });
+}
+
+export function useArchiveWish() {
+  const client = useQueryClient();
+  const { t } = useI18n();
+  return useMutation({
+    mutationFn: (id: string) => wishesApi.archive(id),
+    onSuccess: () => {
+      invalidateAll(client);
+      toast.success(t('toast.archived'));
+    },
+    onError: (err) => toastError(err, t('toast.genericError')),
+  });
+}
+
+export function useCompleteWish() {
+  const client = useQueryClient();
+  const { t } = useI18n();
+  return useMutation({
+    mutationFn: (id: string) => wishesApi.complete(id),
+    onSuccess: () => {
+      invalidateAll(client);
+      toast.success(t('toast.fulfilled'));
+    },
+    onError: (err) => toastError(err, t('toast.genericError')),
+  });
+}
+
+export function useDeleteWish() {
+  const client = useQueryClient();
+  const { t } = useI18n();
+  return useMutation({
+    mutationFn: (id: string) => wishesApi.remove(id),
+    onSuccess: () => {
+      invalidateAll(client);
+      toast.success(t('toast.deleted'));
+    },
+    onError: (err) => toastError(err, t('toast.genericError')),
+  });
+}
+
+export function useRestoreWish() {
+  const client = useQueryClient();
+  const { t } = useI18n();
+  return useMutation({
+    mutationFn: (id: string) => wishesApi.restore(id),
+    onSuccess: () => {
+      invalidateAll(client);
+      toast.success(t('toast.restored'));
+    },
+    onError: (err) => toastError(err, t('toast.genericError')),
+  });
+}
+
+export function useDuplicateWish() {
+  const client = useQueryClient();
+  const { t } = useI18n();
+  return useMutation({
+    mutationFn: (id: string) => wishesApi.duplicate(id),
+    onSuccess: () => {
+      invalidateAll(client);
+      toast.success(t('toast.duplicated'));
+    },
+    onError: (err) => toastError(err, t('toast.genericError')),
+  });
+}
+
+export function useUploadWishImage() {
+  const client = useQueryClient();
+  const { t } = useI18n();
+  return useMutation({
+    mutationFn: (vars: { id: string; file: File }) => wishesApi.uploadImage(vars.id, vars.file),
+    onSuccess: () => {
+      invalidateAll(client);
+      toast.success(t('toast.imageUpdated'));
+    },
+    onError: (err) => toastError(err, t('toast.genericError')),
+  });
+}
+
+export function useRefreshOg() {
+  const client = useQueryClient();
+  const { t } = useI18n();
+  return useMutation({
+    mutationFn: (id: string) => wishesApi.refreshOg(id),
+    onSuccess: () => {
+      invalidateAll(client);
+      toast.success(t('toast.imageRefreshed'));
+    },
+    onError: (err) => toastError(err, t('toast.imageFetchFailed')),
+  });
+}
+
+export function useResetWishImage() {
+  const client = useQueryClient();
+  const { t } = useI18n();
+  return useMutation({
+    mutationFn: (id: string) => wishesApi.deleteImage(id),
+    onSuccess: () => {
+      invalidateAll(client);
+      toast.success(t('toast.imageReset'));
+    },
+    onError: (err) => toastError(err, t('toast.genericError')),
+  });
+}
--- a/apps/frontend/src/i18n/i18n.tsx
+++ b/apps/frontend/src/i18n/i18n.tsx
@@ -0,0 +1,339 @@
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useState,
+  type ReactNode,
+} from 'react';
+
+export type Language = 'ru' | 'en';
+
+const STORAGE_KEY = 'family-wishlist-language';
+const FALLBACK_LANGUAGE: Language = 'ru';
+
+const translations = {
+  ru: {
+    'app.name': 'Family Wishlist',
+    'language.ru': 'Русский',
+    'language.en': 'English',
+    'language.switch': 'Язык',
+    'common.loading': 'Загрузка...',
+    'common.cancel': 'Отмена',
+    'common.save': 'Сохранить',
+    'common.saveChanges': 'Сохранить изменения',
+    'common.backHome': 'На главную',
+    'common.days.one': '{count} день',
+    'common.days.few': '{count} дня',
+    'common.days.many': '{count} дней',
+    'footer.frontend': 'frontend v{version}',
+    'footer.backend': 'backend v{version}',
+    'header.active': 'Активные',
+    'header.fulfilled': 'Исполненные',
+    'header.archive': 'Архив',
+    'header.trash': 'Корзина',
+    'header.signedInAs': 'вошли как {name}',
+    'header.profileSettings': 'Настройки профиля',
+    'header.profile': 'Профиль',
+    'header.friendWishes': 'Желания {name}',
+    'header.logout': 'Выйти',
+    'login.title': 'С возвращением',
+    'login.description': 'Войдите, чтобы управлять списком желаний. Доступы задаются на сервере.',
+    'login.username': 'Логин',
+    'login.password': 'Пароль',
+    'login.submit': 'Войти',
+    'login.failed': 'Не удалось войти',
+    'dashboard.title': 'Ваш список желаний',
+    'dashboard.description': 'Добавляйте вещи, о которых мечтаете. Публичная страница доступна по адресу ',
+    'dashboard.addWish': 'Добавить желание',
+    'dashboard.emptyTitle': 'Желаний пока нет',
+    'dashboard.emptyText': 'Начните с того, что вам действительно хочется получить.',
+    'dashboard.addFirstWish': 'Добавить первое желание',
+    'archive.title': 'Архив',
+    'archive.description': 'Отложенные желания. Их видите только вы, и их можно вернуть в активный список.',
+    'archive.emptyTitle': 'Архив пуст',
+    'archive.emptyText': 'Архивированные желания появятся здесь.',
+    'completed.title': 'Исполненные',
+    'completed.description': 'Желания, которые уже исполнились. Из любого можно создать новое.',
+    'completed.emptyTitle': 'Исполненных желаний пока нет',
+    'completed.emptyText': 'Когда желание исполнится, отметьте его, и оно появится здесь.',
+    'trash.title': 'Корзина',
+    'trash.description': 'Удалённые желания хранятся {days}, затем удаляются навсегда.',
+    'trash.emptyTitle': 'Корзина пуста',
+    'trash.emptyText': 'Удалённые желания будут появляться здесь на {days}.',
+    'trash.autoRemove': 'Автоудаление через {days}',
+    'profile.title': 'Профиль',
+    'profile.publicPage': 'Публичная страница доступна по адресу ',
+    'profile.slug': 'Slug (публичный URL)',
+    'profile.displayName': 'Отображаемое имя',
+    'profile.bio': 'О себе',
+    'profile.avatarUrl': 'Ссылка на аватар',
+    'profile.avatar': 'Аватар',
+    'profile.avatarHint': 'Можно вставить ссылку или загрузить фото до 2 MB.',
+    'profile.uploadAvatar': 'Загрузить фото',
+    'profile.avatarTooLarge': 'Фото должно быть не больше 2 MB',
+    'profile.avatarUnsupported': 'Поддерживаются JPEG, PNG, WebP и GIF',
+    'profile.saved': 'Профиль сохранён',
+    'profile.avatarUploaded': 'Аватар обновлён',
+    'profile.saveFailed': 'Не удалось сохранить',
+    'public.loadingWishes': 'Загрузка желаний...',
+    'public.notFoundTitle': 'Профиль не найден',
+    'public.notFoundText': 'Проверьте ссылку и попробуйте ещё раз. Slug чувствителен к регистру.',
+    'public.backToMine': 'Вернуться к моим желаниям',
+    'public.wishlistTitle': 'Список желаний {name}',
+    'public.emptyTitle': 'Желаний пока нет',
+    'public.emptyText': 'Загляните позже!',
+    'notFound.text': 'Не удалось найти эту страницу.',
+    'protected.loading': 'Загрузка...',
+    'wish.action.edit': 'Редактировать',
+    'wish.action.complete': 'Отметить исполненным',
+    'wish.action.archive': 'В архив',
+    'wish.action.delete': 'Удалить',
+    'wish.action.restore': 'Восстановить',
+    'wish.action.duplicate': 'Создать копию как новое',
+    'wish.actions': 'Действия',
+    'wish.openLink': 'открыть ссылку',
+    'wish.badge.new': 'новое',
+    'wish.badge.fulfilled': 'исполнено',
+    'wish.badge.archived': 'архив',
+    'wish.badge.trash': 'корзина',
+    'wishForm.addTitle': 'Добавить желание',
+    'wishForm.editTitle': 'Редактировать желание',
+    'wishForm.addDescription': 'Расскажите, чего хочется. По ссылке мы попробуем подтянуть картинку.',
+    'wishForm.editDescription': 'Обновите детали желания.',
+    'wishForm.title': 'Название',
+    'wishForm.titlePlaceholder': 'Гейзерная кофеварка, размер 3',
+    'wishForm.price': 'Цена (необязательно)',
+    'wishForm.pricePlaceholder': 'например, 2490',
+    'wishForm.currency': 'Валюта',
+    'wishForm.link': 'Ссылка (необязательно)',
+    'wishForm.linkHint': 'После сохранения попробуем подтянуть превью-картинку по ссылке.',
+    'wishForm.comment': 'Комментарий (необязательно)',
+    'wishForm.commentPlaceholder': 'Размер / цвет / заметки...',
+    'wishForm.image': 'Картинка',
+    'wishForm.uploadCustom': 'Загрузить свою',
+    'wishForm.refreshFromLink': 'Обновить по ссылке',
+    'wishForm.resetImage': 'Сбросить на стандартную',
+    'wishForm.addSubmit': 'Добавить желание',
+    'toast.genericError': 'Что-то пошло не так',
+    'toast.wishAdded': 'Желание добавлено',
+    'toast.saved': 'Сохранено',
+    'toast.archived': 'Перемещено в архив',
+    'toast.fulfilled': 'Отмечено исполненным',
+    'toast.deleted': 'Перемещено в корзину (30 дней на восстановление)',
+    'toast.restored': 'Восстановлено',
+    'toast.duplicated': 'Новое желание создано из исполненного',
+    'toast.imageUpdated': 'Картинка обновлена',
+    'toast.imageRefreshed': 'Картинка обновлена по ссылке',
+    'toast.imageFetchFailed': 'Не удалось получить картинку по ссылке',
+    'toast.imageReset': 'Картинка сброшена на стандартную',
+    'validation.invalid': 'Проверьте значение поля',
+    'validation.slug': 'Slug: 3-32 символа, строчные латинские буквы, цифры и дефисы',
+  },
+  en: {
+    'app.name': 'Family Wishlist',
+    'language.ru': 'Русский',
+    'language.en': 'English',
+    'language.switch': 'Language',
+    'common.loading': 'Loading...',
+    'common.cancel': 'Cancel',
+    'common.save': 'Save',
+    'common.saveChanges': 'Save changes',
+    'common.backHome': 'Back to home',
+    'common.days.one': '{count} day',
+    'common.days.few': '{count} days',
+    'common.days.many': '{count} days',
+    'footer.frontend': 'frontend v{version}',
+    'footer.backend': 'backend v{version}',
+    'header.active': 'Active',
+    'header.fulfilled': 'Fulfilled',
+    'header.archive': 'Archive',
+    'header.trash': 'Trash',
+    'header.signedInAs': 'signed in as {name}',
+    'header.profileSettings': 'Profile settings',
+    'header.profile': 'Profile',
+    'header.friendWishes': "{name}'s wishes",
+    'header.logout': 'Log out',
+    'login.title': 'Welcome back',
+    'login.description': 'Sign in to manage your wishlist. Credentials are set up via the server environment.',
+    'login.username': 'Username',
+    'login.password': 'Password',
+    'login.submit': 'Sign in',
+    'login.failed': 'Login failed',
+    'dashboard.title': 'Your wishlist',
+    'dashboard.description': 'Add things you dream of. Share your public page at ',
+    'dashboard.addWish': 'Add wish',
+    'dashboard.emptyTitle': 'No wishes yet',
+    'dashboard.emptyText': "Start by adding something you'd love to receive.",
+    'dashboard.addFirstWish': 'Add your first wish',
+    'archive.title': 'Archive',
+    'archive.description': 'Wishes you put aside. Only you see this. Restore them to your active list any time.',
+    'archive.emptyTitle': 'Archive is empty',
+    'archive.emptyText': 'Archived wishes will show up here.',
+    'completed.title': 'Fulfilled',
+    'completed.description': "Wishes you've received. You can create a new wish based on any of them.",
+    'completed.emptyTitle': 'Nothing fulfilled yet',
+    'completed.emptyText': 'When a wish comes true, mark it as fulfilled and it lands here.',
+    'trash.title': 'Trash',
+    'trash.description': 'Deleted wishes are kept for {days}, then permanently removed.',
+    'trash.emptyTitle': 'Trash is empty',
+    'trash.emptyText': 'Deleted wishes will appear here for {days}.',
+    'trash.autoRemove': 'Auto-removes in {days}',
+    'profile.title': 'Profile',
+    'profile.publicPage': 'Your public page lives at ',
+    'profile.slug': 'Slug (public URL)',
+    'profile.displayName': 'Display name',
+    'profile.bio': 'Bio',
+    'profile.avatarUrl': 'Avatar URL',
+    'profile.avatar': 'Avatar',
+    'profile.avatarHint': 'Paste a link or upload a photo up to 2 MB.',
+    'profile.uploadAvatar': 'Upload photo',
+    'profile.avatarTooLarge': 'Avatar must be 2 MB or less',
+    'profile.avatarUnsupported': 'JPEG, PNG, WebP and GIF are supported',
+    'profile.saved': 'Profile saved',
+    'profile.avatarUploaded': 'Avatar updated',
+    'profile.saveFailed': 'Save failed',
+    'public.loadingWishes': 'Loading wishes...',
+    'public.notFoundTitle': 'Profile not found',
+    'public.notFoundText': 'Check the link and try again. Slugs are case-sensitive.',
+    'public.backToMine': 'Back to my wishlist',
+    'public.wishlistTitle': "{name}'s wishlist",
+    'public.emptyTitle': 'No wishes yet',
+    'public.emptyText': 'Check back later!',
+    'notFound.text': "We couldn't find that page.",
+    'protected.loading': 'Loading...',
+    'wish.action.edit': 'Edit',
+    'wish.action.complete': 'Mark fulfilled',
+    'wish.action.archive': 'Archive',
+    'wish.action.delete': 'Delete',
+    'wish.action.restore': 'Restore',
+    'wish.action.duplicate': 'Create copy as new',
+    'wish.actions': 'Actions',
+    'wish.openLink': 'open link',
+    'wish.badge.new': 'new',
+    'wish.badge.fulfilled': 'fulfilled',
+    'wish.badge.archived': 'archived',
+    'wish.badge.trash': 'trash',
+    'wishForm.addTitle': 'Add a wish',
+    'wishForm.editTitle': 'Edit wish',
+    'wishForm.addDescription': 'Tell us what you want. A link helps us grab a preview image automatically.',
+    'wishForm.editDescription': 'Update the details of your wish.',
+    'wishForm.title': 'Title',
+    'wishForm.titlePlaceholder': 'Moka pot, size 3',
+    'wishForm.price': 'Price (optional)',
+    'wishForm.pricePlaceholder': 'e.g. 2490',
+    'wishForm.currency': 'Currency',
+    'wishForm.link': 'Link (optional)',
+    'wishForm.linkHint': 'We will try to pull a preview image from the link after saving.',
+    'wishForm.comment': 'Comment (optional)',
+    'wishForm.commentPlaceholder': 'Size / color / notes...',
+    'wishForm.image': 'Image',
+    'wishForm.uploadCustom': 'Upload custom',
+    'wishForm.refreshFromLink': 'Refresh from link',
+    'wishForm.resetImage': 'Reset to default',
+    'wishForm.addSubmit': 'Add wish',
+    'toast.genericError': 'Something went wrong',
+    'toast.wishAdded': 'Wish added',
+    'toast.saved': 'Saved',
+    'toast.archived': 'Moved to archive',
+    'toast.fulfilled': 'Marked as fulfilled',
+    'toast.deleted': 'Moved to trash (30 days to restore)',
+    'toast.restored': 'Restored',
+    'toast.duplicated': 'New wish created from the fulfilled one',
+    'toast.imageUpdated': 'Image updated',
+    'toast.imageRefreshed': 'Image refreshed from link',
+    'toast.imageFetchFailed': 'Could not fetch image from link',
+    'toast.imageReset': 'Reset to default image',
+    'validation.invalid': 'Check this field',
+    'validation.slug': 'Slug must be 3-32 chars, lowercase letters, digits, hyphens',
+  },
+} as const;
+
+export type TranslationKey = keyof typeof translations.ru;
+
+interface I18nContextValue {
+  language: Language;
+  locale: string;
+  setLanguage: (language: Language) => void;
+  t: (key: TranslationKey, vars?: Record<string, string | number>) => string;
+  dayCount: (count: number) => string;
+}
+
+const I18nContext = createContext<I18nContextValue | null>(null);
+
+function isLanguage(value: string | null): value is Language {
+  return value === 'ru' || value === 'en';
+}
+
+function detectLanguage(): Language {
+  if (typeof window === 'undefined') return FALLBACK_LANGUAGE;
+  const saved = window.localStorage.getItem(STORAGE_KEY);
+  if (isLanguage(saved)) return saved;
+  const languages = navigator.languages.length ? navigator.languages : [navigator.language];
+  for (const lang of languages) {
+    const normalized = lang.toLowerCase();
+    if (normalized.startsWith('ru')) return 'ru';
+    if (normalized.startsWith('en')) return 'en';
+  }
+  return FALLBACK_LANGUAGE;
+}
+
+function interpolate(template: string, vars?: Record<string, string | number>): string {
+  if (!vars) return template;
+  return template.replace(/\{(\w+)\}/g, (_, key: string) => String(vars[key] ?? `{${key}}`));
+}
+
+function dayKey(language: Language, count: number): TranslationKey {
+  if (language === 'en') return count === 1 ? 'common.days.one' : 'common.days.many';
+  const mod10 = count % 10;
+  const mod100 = count % 100;
+  if (mod10 === 1 && mod100 !== 11) return 'common.days.one';
+  if (mod10 >= 2 && mod10 <= 4 && (mod100 < 12 || mod100 > 14)) return 'common.days.few';
+  return 'common.days.many';
+}
+
+export function I18nProvider({ children }: { children: ReactNode }) {
+  const [language, setLanguageState] = useState<Language>(() => detectLanguage());
+
+  useEffect(() => {
+    document.documentElement.lang = language;
+    window.localStorage.setItem(STORAGE_KEY, language);
+  }, [language]);
+
+  const setLanguage = useCallback((next: Language) => setLanguageState(next), []);
+  const t = useCallback(
+    (key: TranslationKey, vars?: Record<string, string | number>) =>
+      interpolate(translations[language][key] ?? translations[FALLBACK_LANGUAGE][key], vars),
+    [language],
+  );
+  const dayCount = useCallback(
+    (count: number) => t(dayKey(language, count), { count }),
+    [language, t],
+  );
+
+  const value = useMemo<I18nContextValue>(
+    () => ({
+      language,
+      locale: language === 'ru' ? 'ru-RU' : 'en-US',
+      setLanguage,
+      t,
+      dayCount,
+    }),
+    [dayCount, language, setLanguage, t],
+  );
+
+  return <I18nContext.Provider value={value}>{children}</I18nContext.Provider>;
+}
+
+export function useI18n(): I18nContextValue {
+  const value = useContext(I18nContext);
+  if (!value) throw new Error('useI18n must be used within I18nProvider');
+  return value;
+}
+
+export function translateValidation(t: I18nContextValue['t'], message: string | undefined): string {
+  if (!message) return t('validation.invalid');
+  if (message.includes('Slug must be')) return t('validation.slug');
+  return t('validation.invalid');
+}
--- a/apps/frontend/src/lib/api.ts
+++ b/apps/frontend/src/lib/api.ts
@@ -0,0 +1,70 @@
+export interface ApiErrorShape {
+  error: string;
+  message: string;
+  details?: unknown;
+}
+
+export class ApiError extends Error {
+  readonly status: number;
+  readonly code: string;
+  readonly details?: unknown;
+  constructor(status: number, body: ApiErrorShape) {
+    super(body.message);
+    this.status = status;
+    this.code = body.error;
+    this.details = body.details;
+  }
+}
+
+interface RequestOptions<TBody = unknown> {
+  method?: 'GET' | 'POST' | 'PATCH' | 'DELETE';
+  body?: TBody;
+  signal?: AbortSignal;
+  formData?: FormData;
+}
+
+async function request<TResponse, TBody = unknown>(
+  path: string,
+  options: RequestOptions<TBody> = {},
+): Promise<TResponse> {
+  const headers: Record<string, string> = {};
+  let body: BodyInit | undefined;
+
+  if (options.formData) {
+    body = options.formData;
+  } else if (options.body !== undefined) {
+    headers['content-type'] = 'application/json';
+    body = JSON.stringify(options.body);
+  }
+
+  const response = await fetch(path, {
+    method: options.method ?? 'GET',
+    headers,
+    body,
+    credentials: 'include',
+    signal: options.signal,
+  });
+
+  const isJson = response.headers.get('content-type')?.includes('application/json');
+  const payload = isJson ? await response.json().catch(() => null) : null;
+
+  if (!response.ok) {
+    const errBody: ApiErrorShape =
+      payload && typeof payload === 'object' && 'error' in payload
+        ? (payload as ApiErrorShape)
+        : { error: 'HTTP', message: response.statusText || 'Request failed' };
+    throw new ApiError(response.status, errBody);
+  }
+
+  return payload as TResponse;
+}
+
+export const api = {
+  get: <T>(path: string, signal?: AbortSignal) => request<T>(path, { signal }),
+  post: <T, B = unknown>(path: string, body?: B) => request<T, B>(path, { method: 'POST', body }),
+  patch: <T, B = unknown>(path: string, body?: B) =>
+    request<T, B>(path, { method: 'PATCH', body }),
+  delete: <T>(path: string) => request<T>(path, { method: 'DELETE' }),
+  upload: <T>(path: string, formData: FormData) =>
+    request<T>(path, { method: 'POST', formData }),
+};
--- a/apps/frontend/src/lib/cn.ts
+++ b/apps/frontend/src/lib/cn.ts
@@ -0,0 +1,6 @@
+import clsx, { type ClassValue } from 'clsx';
+import { twMerge } from 'tailwind-merge';
+
+export function cn(...inputs: ClassValue[]): string {
+  return twMerge(clsx(inputs));
+}
--- a/apps/frontend/src/lib/format.ts
+++ b/apps/frontend/src/lib/format.ts
@@ -0,0 +1,29 @@
+export function formatPrice(
+  price: string | null | undefined,
+  currency: string,
+  locale?: string,
+): string | null {
+  if (!price) return null;
+  const n = Number(price);
+  if (Number.isNaN(n)) return `${price} ${currency}`;
+  try {
+    return new Intl.NumberFormat(locale, {
+      style: 'currency',
+      currency,
+      maximumFractionDigits: 2,
+    }).format(n);
+  } catch {
+    return `${n.toLocaleString(locale)} ${currency}`;
+  }
+}
+
+export function formatDate(iso: string | Date, locale?: string): string {
+  const d = typeof iso === 'string' ? new Date(iso) : iso;
+  return d.toLocaleDateString(locale, { day: 'numeric', month: 'short', year: 'numeric' });
+}
+
+export function daysLeftUntil(iso: string | Date, retentionDays: number): number {
+  const d = typeof iso === 'string' ? new Date(iso) : iso;
+  const expires = d.getTime() + retentionDays * 24 * 60 * 60 * 1000;
+  return Math.max(0, Math.ceil((expires - Date.now()) / (24 * 60 * 60 * 1000)));
+}
--- a/apps/frontend/src/lib/version.ts
+++ b/apps/frontend/src/lib/version.ts
@@ -0,0 +1,4 @@
+declare const __FRONTEND_VERSION__: string;
+
+export const FRONTEND_VERSION: string =
+  typeof __FRONTEND_VERSION__ !== 'undefined' ? __FRONTEND_VERSION__ : '0.0.0';
--- a/apps/frontend/src/main.tsx
+++ b/apps/frontend/src/main.tsx
@@ -0,0 +1,13 @@
+import { StrictMode } from 'react';
+import { createRoot } from 'react-dom/client';
+import { App } from './App';
+import './styles/global.css';
+
+const el = document.getElementById('root');
+if (!el) throw new Error('#root not found');
+
+createRoot(el).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);
--- a/apps/frontend/src/pages/ArchivePage.tsx
+++ b/apps/frontend/src/pages/ArchivePage.tsx
@@ -0,0 +1,50 @@
+import { WishCard } from '@/components/WishCard/WishCard';
+import {
+  useDeleteWish,
+  useRestoreWish,
+  useWishes,
+} from '@/features/wishes/wishes.hooks';
+import { Archive } from 'lucide-react';
+import { useI18n } from '@/i18n/i18n';
+
+export function ArchivePage() {
+  const { t } = useI18n();
+  const { data, isLoading } = useWishes('archived');
+  const restore = useRestoreWish();
+  const remove = useDeleteWish();
+
+  return (
+    <div className="grid gap-6">
+      <section>
+        <h1 className="font-display text-3xl">{t('archive.title')}</h1>
+        <p className="text-sm text-muted">
+          {t('archive.description')}
+        </p>
+      </section>
+
+      {isLoading && <div className="text-muted">{t('common.loading')}</div>}
+
+      {!isLoading && data && data.length === 0 && (
+        <div className="flex flex-col items-center gap-2 rounded-xl border border-border bg-surface/80 p-10 text-center shadow-card">
+          <Archive className="h-10 w-10 text-muted" />
+          <h2 className="text-xl font-semibold">{t('archive.emptyTitle')}</h2>
+          <p className="text-sm text-muted">{t('archive.emptyText')}</p>
+        </div>
+      )}
+
+      {data && data.length > 0 && (
+        <div className="grid gap-5 sm:grid-cols-2 lg:grid-cols-3">
+          {data.map((wish) => (
+            <WishCard
+              key={wish.id}
+              wish={wish}
+              view="owner"
+              onRestore={() => restore.mutate(wish.id)}
+              onDelete={() => remove.mutate(wish.id)}
+            />
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}
--- a/apps/frontend/src/pages/CompletedPage.tsx
+++ b/apps/frontend/src/pages/CompletedPage.tsx
@@ -0,0 +1,52 @@
+import { CheckCircle2 } from 'lucide-react';
+import { WishCard } from '@/components/WishCard/WishCard';
+import {
+  useDeleteWish,
+  useDuplicateWish,
+  useWishes,
+} from '@/features/wishes/wishes.hooks';
+import { useI18n } from '@/i18n/i18n';
+
+export function CompletedPage() {
+  const { t } = useI18n();
+  const { data, isLoading } = useWishes('completed');
+  const duplicate = useDuplicateWish();
+  const remove = useDeleteWish();
+
+  return (
+    <div className="grid gap-6">
+      <section>
+        <h1 className="font-display text-3xl">{t('completed.title')}</h1>
+        <p className="text-sm text-muted">
+          {t('completed.description')}
+        </p>
+      </section>
+
+      {isLoading && <div className="text-muted">{t('common.loading')}</div>}
+
+      {!isLoading && data && data.length === 0 && (
+        <div className="flex flex-col items-center gap-2 rounded-xl border border-border bg-surface/80 p-10 text-center shadow-card">
+          <CheckCircle2 className="h-10 w-10 text-muted" />
+          <h2 className="text-xl font-semibold">{t('completed.emptyTitle')}</h2>
+          <p className="text-sm text-muted">
+            {t('completed.emptyText')}
+          </p>
+        </div>
+      )}
+
+      {data && data.length > 0 && (
+        <div className="grid gap-5 sm:grid-cols-2 lg:grid-cols-3">
+          {data.map((wish) => (
+            <WishCard
+              key={wish.id}
+              wish={wish}
+              view="owner"
+              onDuplicate={() => duplicate.mutate(wish.id)}
+              onDelete={() => remove.mutate(wish.id)}
+            />
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}
--- a/apps/frontend/src/pages/DashboardPage.tsx
+++ b/apps/frontend/src/pages/DashboardPage.tsx
@@ -0,0 +1,104 @@
+import { useState } from 'react';
+import { Plus, Sparkles } from 'lucide-react';
+import type { Wish } from '@family-wishlist/shared';
+import { Button } from '@/components/ui/Button';
+import { WishCard } from '@/components/WishCard/WishCard';
+import { WishForm } from '@/components/WishForm/WishForm';
+import {
+  useArchiveWish,
+  useCompleteWish,
+  useDeleteWish,
+  useWishes,
+} from '@/features/wishes/wishes.hooks';
+import { useAuthStore } from '@/features/auth/authStore';
+import { Link } from 'react-router-dom';
+import { useI18n } from '@/i18n/i18n';
+
+export function DashboardPage() {
+  const { t } = useI18n();
+  const { data, isLoading } = useWishes('active');
+  const [creating, setCreating] = useState(false);
+  const [editing, setEditing] = useState<Wish | null>(null);
+  const archive = useArchiveWish();
+  const complete = useCompleteWish();
+  const remove = useDeleteWish();
+  const user = useAuthStore((s) => s.user);
+
+  return (
+    <div className="grid gap-6">
+      <section className="flex flex-wrap items-end justify-between gap-4">
+        <div>
+          <h1 className="font-display text-3xl">{t('dashboard.title')}</h1>
+          <p className="text-sm text-muted">
+            {t('dashboard.description')}
+            {user && (
+              <Link
+                to={`/u/${user.slug}`}
+                className="font-medium text-primary hover:text-primary-600"
+              >
+                /u/{user.slug}
+              </Link>
+            )}
+            .
+          </p>
+        </div>
+        <Button size="lg" onClick={() => setCreating(true)}>
+          <Plus className="h-4 w-4" />
+          {t('dashboard.addWish')}
+        </Button>
+      </section>
+
+      {isLoading && (
+        <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
+          {[0, 1, 2].map((i) => (
+            <div
+              key={i}
+              className="wish-card animate-pulse"
+              style={{ minHeight: 320, background: 'rgb(var(--color-surface-muted))' }}
+            />
+          ))}
+        </div>
+      )}
+
+      {!isLoading && data && data.length === 0 && (
+        <div className="flex flex-col items-center gap-4 rounded-xl border border-border bg-surface/80 p-10 text-center shadow-card">
+          <img src="/empty-state.svg" alt="" className="h-40 w-40 opacity-90" />
+          <div>
+            <h2 className="text-xl font-semibold">{t('dashboard.emptyTitle')}</h2>
+            <p className="mt-1 text-sm text-muted">
+              {t('dashboard.emptyText')}
+            </p>
+          </div>
+          <Button onClick={() => setCreating(true)}>
+            <Sparkles className="h-4 w-4" />
+            {t('dashboard.addFirstWish')}
+          </Button>
+        </div>
+      )}
+
+      {!isLoading && data && data.length > 0 && (
+        <div className="grid gap-5 sm:grid-cols-2 lg:grid-cols-3">
+          {data.map((wish) => (
+            <WishCard
+              key={wish.id}
+              wish={wish}
+              view="owner"
+              onEdit={() => setEditing(wish)}
+              onArchive={() => archive.mutate(wish.id)}
+              onComplete={() => complete.mutate(wish.id)}
+              onDelete={() => remove.mutate(wish.id)}
+            />
+          ))}
+        </div>
+      )}
+
+      <WishForm open={creating} mode="create" onClose={() => setCreating(false)} />
+      <WishForm
+        open={editing !== null}
+        mode="edit"
+        initial={editing ?? undefined}
+        onClose={() => setEditing(null)}
+      />
+    </div>
+  );
+}
--- a/apps/frontend/src/pages/LoginPage.tsx
+++ b/apps/frontend/src/pages/LoginPage.tsx
@@ -0,0 +1,108 @@
+import { useEffect } from 'react';
+import { Navigate, useLocation, useNavigate } from 'react-router-dom';
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { Gift, Loader2 } from 'lucide-react';
+import { toast } from 'sonner';
+import { loginSchema, type LoginInput } from '@family-wishlist/shared';
+import { Button } from '@/components/ui/Button';
+import { Input } from '@/components/ui/Input';
+import { Label } from '@/components/ui/Label';
+import { useAuthStore } from '@/features/auth/authStore';
+import { ApiError } from '@/lib/api';
+import { Footer } from '@/components/Layout/Footer';
+import { LanguageSwitcher } from '@/components/LanguageSwitcher';
+import { translateValidation, useI18n } from '@/i18n/i18n';
+
+export function LoginPage() {
+  const { t } = useI18n();
+  const { user, login } = useAuthStore();
+  const navigate = useNavigate();
+  const location = useLocation();
+  const from = (location.state as { from?: { pathname: string } } | null)?.from?.pathname ?? '/';
+
+  const {
+    register,
+    handleSubmit,
+    formState: { errors, isSubmitting },
+  } = useForm<LoginInput>({
+    resolver: zodResolver(loginSchema),
+    defaultValues: { username: '', password: '' },
+  });
+
+  useEffect(() => {
+    if (user) navigate(from, { replace: true });
+  }, [user, from, navigate]);
+
+  if (user) return <Navigate to={from} replace />;
+
+  const submit = handleSubmit(async (values) => {
+    try {
+      await login(values.username, values.password);
+      navigate(from, { replace: true });
+    } catch (err) {
+      if (err instanceof ApiError) toast.error(err.message);
+      else toast.error(t('login.failed'));
+    }
+  });
+
+  return (
+    <div className="flex min-h-screen flex-col">
+      <div className="container-page flex justify-end pt-6">
+        <LanguageSwitcher />
+      </div>
+      <div className="container-page flex flex-1 items-center justify-center py-12">
+        <div className="w-full max-w-md animate-fade-in-up">
+          <div className="mb-6 flex items-center justify-center gap-2">
+            <span className="inline-flex h-11 w-11 items-center justify-center rounded-md bg-primary text-primary-foreground shadow-card">
+              <Gift className="h-5 w-5" />
+            </span>
+            <h1 className="font-display text-3xl">{t('app.name')}</h1>
+          </div>
+
+          <div className="rounded-xl border border-border bg-surface p-6 shadow-card sm:p-8">
+            <h2 className="mb-1 text-xl font-semibold">{t('login.title')}</h2>
+            <p className="mb-6 text-sm text-muted">
+              {t('login.description')}
+            </p>
+            <form className="grid gap-4" onSubmit={submit}>
+              <div className="field">
+                <Label htmlFor="username">{t('login.username')}</Label>
+                <Input
+                  id="username"
+                  autoComplete="username"
+                  autoFocus
+                  {...register('username')}
+                />
+                {errors.username && (
+                  <span className="field__error">
+                    {translateValidation(t, errors.username.message)}
+                  </span>
+                )}
+              </div>
+              <div className="field">
+                <Label htmlFor="password">{t('login.password')}</Label>
+                <Input
+                  id="password"
+                  type="password"
+                  autoComplete="current-password"
+                  {...register('password')}
+                />
+                {errors.password && (
+                  <span className="field__error">
+                    {translateValidation(t, errors.password.message)}
+                  </span>
+                )}
+              </div>
+              <Button type="submit" size="lg" disabled={isSubmitting}>
+                {isSubmitting && <Loader2 className="h-4 w-4 animate-spin" />}
+                {t('login.submit')}
+              </Button>
+            </form>
+          </div>
+        </div>
+      </div>
+      <Footer />
+    </div>
+  );
+}
--- a/apps/frontend/src/pages/NotFoundPage.tsx
+++ b/apps/frontend/src/pages/NotFoundPage.tsx
@@ -0,0 +1,18 @@
+import { Link } from 'react-router-dom';
+import { Button } from '@/components/ui/Button';
+import { useI18n } from '@/i18n/i18n';
+
+export function NotFoundPage() {
+  const { t } = useI18n();
+  return (
+    <div className="flex min-h-screen items-center justify-center p-6">
+      <div className="max-w-md rounded-xl border border-border bg-surface p-8 text-center shadow-card">
+        <h1 className="font-display text-4xl">404</h1>
+        <p className="mt-2 text-muted">{t('notFound.text')}</p>
+        <Link to="/" className="mt-4 inline-block">
+          <Button variant="secondary">{t('common.backHome')}</Button>
+        </Link>
+      </div>
+    </div>
+  );
+}
--- a/apps/frontend/src/pages/ProfileSettingsPage.tsx
+++ b/apps/frontend/src/pages/ProfileSettingsPage.tsx
@@ -0,0 +1,212 @@
+import { useEffect, useRef } from 'react';
+import { useForm } from 'react-hook-form';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import {
+  updateProfileSchema,
+  type UpdateProfileInput,
+  type Profile,
+} from '@family-wishlist/shared';
+import { toast } from 'sonner';
+import { Gift, Loader2, Upload } from 'lucide-react';
+import { Button } from '@/components/ui/Button';
+import { Input } from '@/components/ui/Input';
+import { Label } from '@/components/ui/Label';
+import { Textarea } from '@/components/ui/Textarea';
+import { api, ApiError } from '@/lib/api';
+import { useAuthStore } from '@/features/auth/authStore';
+import { translateValidation, useI18n } from '@/i18n/i18n';
+
+const MAX_AVATAR_BYTES = 2 * 1024 * 1024;
+const AVATAR_MIME_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/gif']);
+
+export function ProfileSettingsPage() {
+  const { t } = useI18n();
+  const refresh = useAuthStore((s) => s.refresh);
+  const queryClient = useQueryClient();
+  const fileInputRef = useRef<HTMLInputElement>(null);
+
+  const { data, isLoading } = useQuery({
+    queryKey: ['profile'],
+    queryFn: () => api.get<Profile>('/api/profile'),
+  });
+
+  const {
+    register,
+    handleSubmit,
+    reset,
+    watch,
+    formState: { errors, isSubmitting, isDirty },
+  } = useForm<UpdateProfileInput>({
+    resolver: zodResolver(updateProfileSchema),
+    defaultValues: { slug: '', displayName: '', bio: '', avatarUrl: '' },
+  });
+
+  useEffect(() => {
+    if (data) {
+      reset({
+        slug: data.slug,
+        displayName: data.displayName,
+        bio: data.bio ?? '',
+        avatarUrl: data.avatarUrl ?? '',
+      });
+    }
+  }, [data, reset]);
+
+  const update = useMutation({
+    mutationFn: (values: UpdateProfileInput) =>
+      api.patch<Profile, UpdateProfileInput>('/api/profile', values),
+    onSuccess: (p) => {
+      toast.success(t('profile.saved'));
+      void queryClient.invalidateQueries({ queryKey: ['profile'] });
+      void refresh();
+      reset({
+        slug: p.slug,
+        displayName: p.displayName,
+        bio: p.bio ?? '',
+        avatarUrl: p.avatarUrl ?? '',
+      });
+    },
+    onError: (err) => {
+      if (err instanceof ApiError) toast.error(err.message);
+      else toast.error(t('profile.saveFailed'));
+    },
+  });
+
+  const uploadAvatar = useMutation({
+    mutationFn: (file: File) => {
+      const form = new FormData();
+      form.append('file', file);
+      return api.upload<Profile>('/api/profile/avatar', form);
+    },
+    onSuccess: (p) => {
+      toast.success(t('profile.avatarUploaded'));
+      void queryClient.invalidateQueries({ queryKey: ['profile'] });
+      void refresh();
+      reset({
+        slug: p.slug,
+        displayName: p.displayName,
+        bio: p.bio ?? '',
+        avatarUrl: p.avatarUrl ?? '',
+      });
+    },
+    onError: (err) => {
+      if (err instanceof ApiError) toast.error(err.message);
+      else toast.error(t('profile.saveFailed'));
+    },
+  });
+
+  function handleAvatarFile(file: File | undefined): void {
+    if (!file) return;
+    if (!AVATAR_MIME_TYPES.has(file.type)) {
+      toast.error(t('profile.avatarUnsupported'));
+      return;
+    }
+    if (file.size > MAX_AVATAR_BYTES) {
+      toast.error(t('profile.avatarTooLarge'));
+      return;
+    }
+    uploadAvatar.mutate(file);
+  }
+
+  const submit = handleSubmit((values) => {
+    const payload: UpdateProfileInput = {
+      ...values,
+      bio: values.bio ? values.bio : null,
+      avatarUrl: values.avatarUrl ? values.avatarUrl : null,
+    };
+    update.mutate(payload);
+  });
+
+  const avatarPreview = watch('avatarUrl') || data?.avatarUrl;
+
+  return (
+    <div className="grid max-w-2xl gap-6">
+      <section>
+        <h1 className="font-display text-3xl">{t('profile.title')}</h1>
+        <p className="text-sm text-muted">
+          {t('profile.publicPage')}
+          <code className="rounded bg-ink/5 px-1.5 py-0.5">/u/{data?.slug ?? '...'}</code>.
+        </p>
+      </section>
+
+      {isLoading ? (
+        <div className="text-muted">{t('common.loading')}</div>
+      ) : (
+        <form className="grid gap-4 rounded-xl border border-border bg-surface p-6 shadow-card" onSubmit={submit}>
+          <section className="flex flex-wrap items-center gap-4 rounded-md border border-border bg-surface-muted p-4">
+            <span className="inline-flex h-16 w-16 items-center justify-center overflow-hidden rounded-full bg-primary text-primary-foreground">
+              {avatarPreview ? (
+                <img src={avatarPreview} alt="" className="h-16 w-16 object-cover" />
+              ) : (
+                <Gift className="h-6 w-6" />
+              )}
+            </span>
+            <div className="min-w-0 flex-1">
+              <h2 className="text-sm font-semibold">{t('profile.avatar')}</h2>
+              <p className="text-xs text-muted">{t('profile.avatarHint')}</p>
+            </div>
+            <input
+              ref={fileInputRef}
+              type="file"
+              accept="image/jpeg,image/png,image/webp,image/gif"
+              className="hidden"
+              onChange={(e) => {
+                handleAvatarFile(e.target.files?.[0]);
+                e.currentTarget.value = '';
+              }}
+            />
+            <Button
+              type="button"
+              variant="secondary"
+              onClick={() => fileInputRef.current?.click()}
+              disabled={uploadAvatar.isPending}
+            >
+              {uploadAvatar.isPending ? (
+                <Loader2 className="h-4 w-4 animate-spin" />
+              ) : (
+                <Upload className="h-4 w-4" />
+              )}
+              {t('profile.uploadAvatar')}
+            </Button>
+          </section>
+          <div className="field">
+            <Label htmlFor="slug">{t('profile.slug')}</Label>
+            <Input id="slug" {...register('slug')} />
+            {errors.slug && (
+              <span className="field__error">{translateValidation(t, errors.slug.message)}</span>
+            )}
+          </div>
+          <div className="field">
+            <Label htmlFor="displayName">{t('profile.displayName')}</Label>
+            <Input id="displayName" {...register('displayName')} />
+            {errors.displayName && (
+              <span className="field__error">
+                {translateValidation(t, errors.displayName.message)}
+              </span>
+            )}
+          </div>
+          <div className="field">
+            <Label htmlFor="bio">{t('profile.bio')}</Label>
+            <Textarea id="bio" rows={3} {...register('bio')} />
+          </div>
+          <div className="field">
+            <Label htmlFor="avatarUrl">{t('profile.avatarUrl')}</Label>
+            <Input id="avatarUrl" inputMode="url" {...register('avatarUrl')} />
+            {errors.avatarUrl && (
+              <span className="field__error">
+                {translateValidation(t, errors.avatarUrl.message)}
+              </span>
+            )}
+          </div>
+          <div className="flex items-center justify-end gap-2">
+            <Button type="submit" disabled={!isDirty || isSubmitting}>
+              {isSubmitting && <Loader2 className="h-4 w-4 animate-spin" />}
+              {t('common.saveChanges')}
+            </Button>
+          </div>
+        </form>
+      )}
+    </div>
+  );
+}
--- a/apps/frontend/src/pages/PublicProfilePage.tsx
+++ b/apps/frontend/src/pages/PublicProfilePage.tsx
@@ -0,0 +1,130 @@
+import { useEffect, useRef } from 'react';
+import { Link, useParams } from 'react-router-dom';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import type {
+  PublicProfile,
+  Wish,
+} from '@family-wishlist/shared';
+import { api } from '@/lib/api';
+import { WishCard } from '@/components/WishCard/WishCard';
+import { Footer } from '@/components/Layout/Footer';
+import { Gift } from 'lucide-react';
+import { LanguageSwitcher } from '@/components/LanguageSwitcher';
+import { useI18n } from '@/i18n/i18n';
+import { useAuthStore } from '@/features/auth/authStore';
+import { Button } from '@/components/ui/Button';
+
+export function PublicProfilePage() {
+  const { t } = useI18n();
+  const user = useAuthStore((s) => s.user);
+  const { slug = '' } = useParams<{ slug: string }>();
+  const queryClient = useQueryClient();
+
+  const profile = useQuery({
+    queryKey: ['public-profile', slug],
+    queryFn: () => api.get<PublicProfile>(`/api/public/${encodeURIComponent(slug)}`),
+    retry: false,
+    enabled: slug.length > 0,
+  });
+
+  const wishes = useQuery({
+    queryKey: ['public-wishes', slug],
+    queryFn: () => api.get<Wish[]>(`/api/public/${encodeURIComponent(slug)}/wishes`),
+    enabled: slug.length > 0 && profile.isSuccess,
+  });
+
+  const markSeen = useMutation({
+    mutationFn: (wishIds: string[]) =>
+      api.post(`/api/public/${encodeURIComponent(slug)}/views`, { wishIds }),
+  });
+
+  const marked = useRef(false);
+  useEffect(() => {
+    if (!wishes.data || marked.current) return;
+    const newIds = wishes.data.filter((w) => w.isNewForGuest).map((w) => w.id);
+    if (newIds.length === 0) {
+      marked.current = true;
+      return;
+    }
+    const t = window.setTimeout(() => {
+      markSeen.mutate(newIds, {
+        onSuccess: () => {
+          marked.current = true;
+          void queryClient.invalidateQueries({ queryKey: ['public-wishes', slug] });
+        },
+      });
+    }, 1500);
+    return () => window.clearTimeout(t);
+  }, [wishes.data, markSeen, queryClient, slug]);
+
+  return (
+    <div className="flex min-h-screen flex-col">
+      <div className="container-page flex items-center justify-between gap-3 pt-6">
+        {user ? (
+          <Link to="/">
+            <Button variant="secondary" size="sm">
+              {t('public.backToMine')}
+            </Button>
+          </Link>
+        ) : (
+          <span />
+        )}
+        <LanguageSwitcher />
+      </div>
+      <main className="container-page flex-1 py-10">
+        {profile.isLoading && <div className="text-muted">{t('common.loading')}</div>}
+
+        {profile.isError && (
+          <div className="mx-auto max-w-lg rounded-xl border border-border bg-surface p-8 text-center shadow-card">
+            <h1 className="font-display text-2xl">{t('public.notFoundTitle')}</h1>
+            <p className="mt-2 text-sm text-muted">
+              {t('public.notFoundText')}
+            </p>
+          </div>
+        )}
+
+        {profile.data && (
+          <>
+            <section className="mb-10 flex flex-col items-center gap-3 text-center">
+              <span className="inline-flex h-14 w-14 items-center justify-center rounded-full bg-primary text-primary-foreground shadow-card">
+                {profile.data.avatarUrl ? (
+                  <img
+                    src={profile.data.avatarUrl}
+                    alt=""
+                    className="h-14 w-14 rounded-full object-cover"
+                  />
+                ) : (
+                  <Gift className="h-6 w-6" />
+                )}
+              </span>
+              <h1 className="font-display text-4xl">
+                {t('public.wishlistTitle', { name: profile.data.displayName })}
+              </h1>
+              {profile.data.bio && (
+                <p className="max-w-xl text-muted">{profile.data.bio}</p>
+              )}
+            </section>
+
+            {wishes.isLoading && <div className="text-muted">{t('public.loadingWishes')}</div>}
+
+            {wishes.data && wishes.data.length === 0 && (
+              <div className="mx-auto max-w-lg rounded-xl border border-border bg-surface/80 p-10 text-center shadow-card">
+                <h2 className="text-xl font-semibold">{t('public.emptyTitle')}</h2>
+                <p className="mt-1 text-sm text-muted">{t('public.emptyText')}</p>
+              </div>
+            )}
+
+            {wishes.data && wishes.data.length > 0 && (
+              <div className="grid gap-5 sm:grid-cols-2 lg:grid-cols-3">
+                {wishes.data.map((wish) => (
+                  <WishCard key={wish.id} wish={wish} view="guest" />
+                ))}
+              </div>
+            )}
+          </>
+        )}
+      </main>
+      <Footer />
+    </div>
+  );
+}
--- a/apps/frontend/src/pages/TrashPage.tsx
+++ b/apps/frontend/src/pages/TrashPage.tsx
@@ -0,0 +1,58 @@
+import { Trash2 } from 'lucide-react';
+import { TRASH_RETENTION_DAYS } from '@family-wishlist/shared';
+import { WishCard } from '@/components/WishCard/WishCard';
+import { useRestoreWish, useWishes } from '@/features/wishes/wishes.hooks';
+import { daysLeftUntil } from '@/lib/format';
+import { useI18n } from '@/i18n/i18n';
+
+export function TrashPage() {
+  const { dayCount, t } = useI18n();
+  const { data, isLoading } = useWishes('deleted');
+  const restore = useRestoreWish();
+
+  return (
+    <div className="grid gap-6">
+      <section>
+        <h1 className="font-display text-3xl">{t('trash.title')}</h1>
+        <p className="text-sm text-muted">
+          {t('trash.description', { days: dayCount(TRASH_RETENTION_DAYS) })}
+        </p>
+      </section>
+
+      {isLoading && <div className="text-muted">{t('common.loading')}</div>}
+
+      {!isLoading && data && data.length === 0 && (
+        <div className="flex flex-col items-center gap-2 rounded-xl border border-border bg-surface/80 p-10 text-center shadow-card">
+          <Trash2 className="h-10 w-10 text-muted" />
+          <h2 className="text-xl font-semibold">{t('trash.emptyTitle')}</h2>
+          <p className="text-sm text-muted">
+            {t('trash.emptyText', { days: dayCount(TRASH_RETENTION_DAYS) })}
+          </p>
+        </div>
+      )}
+
+      {data && data.length > 0 && (
+        <div className="grid gap-5 sm:grid-cols-2 lg:grid-cols-3">
+          {data.map((wish) => {
+            const left = wish.deletedAt
+              ? daysLeftUntil(wish.deletedAt, TRASH_RETENTION_DAYS)
+              : TRASH_RETENTION_DAYS;
+            return (
+              <WishCard
+                key={wish.id}
+                wish={wish}
+                view="owner"
+                onRestore={() => restore.mutate(wish.id)}
+                footer={
+                  <p className="mt-2 text-xs font-medium text-warning">
+                    {t('trash.autoRemove', { days: dayCount(left) })}
+                  </p>
+                }
+              />
+            );
+          })}
+        </div>
+      )}
+    </div>
+  );
+}
--- a/apps/frontend/src/routes.tsx
+++ b/apps/frontend/src/routes.tsx
@@ -0,0 +1,31 @@
+import { createBrowserRouter, type RouterProviderProps } from 'react-router-dom';
+import { ProtectedRoute } from './components/Layout/ProtectedRoute';
+import { AppShell } from './components/Layout/AppShell';
+import { LoginPage } from './pages/LoginPage';
+import { DashboardPage } from './pages/DashboardPage';
+import { ArchivePage } from './pages/ArchivePage';
+import { CompletedPage } from './pages/CompletedPage';
+import { TrashPage } from './pages/TrashPage';
+import { ProfileSettingsPage } from './pages/ProfileSettingsPage';
+import { PublicProfilePage } from './pages/PublicProfilePage';
+import { NotFoundPage } from './pages/NotFoundPage';
+
+export const router: RouterProviderProps['router'] = createBrowserRouter([
+  { path: '/login', element: <LoginPage /> },
+  { path: '/u/:slug', element: <PublicProfilePage /> },
+  {
+    element: (
+      <ProtectedRoute>
+        <AppShell />
+      </ProtectedRoute>
+    ),
+    children: [
+      { path: '/', element: <DashboardPage /> },
+      { path: '/archive', element: <ArchivePage /> },
+      { path: '/completed', element: <CompletedPage /> },
+      { path: '/trash', element: <TrashPage /> },
+      { path: '/settings', element: <ProfileSettingsPage /> },
+    ],
+  },
+  { path: '*', element: <NotFoundPage /> },
+]);
--- a/apps/frontend/src/styles/global.css
+++ b/apps/frontend/src/styles/global.css
@@ -0,0 +1,102 @@
+@import './tokens.css';
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+@layer base {
+  html,
+  body,
+  #root {
+    height: 100%;
+  }
+  body {
+    @apply bg-background text-ink font-sans antialiased;
+    background-image:
+      radial-gradient(1200px 600px at 0% -10%, rgba(244, 192, 78, 0.18), transparent 60%),
+      radial-gradient(900px 500px at 100% 110%, rgba(226, 120, 150, 0.18), transparent 55%);
+    background-attachment: fixed;
+  }
+  h1,
+  h2,
+  h3 {
+    @apply font-display text-ink;
+    letter-spacing: -0.01em;
+  }
+  a {
+    @apply transition-colors;
+  }
+}
+
+@layer components {
+  /* BEM-friendly classes: kept parallel to Tailwind utilities where possible. */
+  .wish-card {
+    @apply relative flex flex-col overflow-hidden rounded-lg bg-surface shadow-card transition-transform duration-200;
+  }
+  .wish-card:hover {
+    transform: translateY(-2px);
+  }
+  .wish-card--completed {
+    filter: saturate(0.45) brightness(0.98);
+  }
+  .wish-card--completed .wish-card__title {
+    text-decoration: line-through;
+    text-decoration-thickness: 2px;
+    text-decoration-color: rgb(var(--color-muted) / 0.6);
+  }
+
+  .wish-card__image-wrap {
+    @apply relative aspect-[4/3] bg-surface-muted overflow-hidden;
+  }
+  .wish-card__image {
+    @apply h-full w-full object-cover;
+  }
+  .wish-card__body {
+    @apply flex flex-col gap-2 p-4;
+  }
+  .wish-card__title {
+    @apply text-lg font-semibold leading-snug text-ink;
+  }
+  .wish-card__price {
+    @apply text-sm font-medium text-muted;
+  }
+  .wish-card__comment {
+    @apply text-sm text-muted line-clamp-2;
+  }
+
+  .wish-badge {
+    @apply inline-flex items-center gap-1 rounded-full px-2.5 py-0.5 text-xs font-semibold uppercase tracking-wide;
+  }
+  .wish-badge--new {
+    @apply bg-primary text-primary-foreground;
+  }
+  .wish-badge--completed {
+    @apply bg-ink/5 text-ink;
+  }
+  .wish-badge--archived {
+    @apply bg-warning/20 text-warning;
+  }
+  .wish-badge--deleted {
+    @apply bg-danger/15 text-danger;
+  }
+
+  .field {
+    @apply flex flex-col gap-1.5;
+  }
+  .field__label {
+    @apply text-sm font-medium text-ink;
+  }
+  .field__input,
+  .field__textarea,
+  .field__select {
+    @apply w-full rounded-md border border-border bg-surface px-3 py-2.5 text-ink outline-none transition-all duration-150 placeholder:text-muted focus:border-primary focus:shadow-[var(--shadow-focus)];
+  }
+  .field__error {
+    @apply text-xs text-danger;
+  }
+}
+
+@layer utilities {
+  .container-page {
+    @apply mx-auto w-full max-w-6xl px-4 sm:px-6 lg:px-8;
+  }
+}
--- a/apps/frontend/src/styles/tokens.css
+++ b/apps/frontend/src/styles/tokens.css
@@ -0,0 +1,35 @@
+:root {
+  /* Colors (RGB triplets so Tailwind <alpha-value> works) */
+  --color-background: 255 247 240;
+  --color-surface: 255 255 255;
+  --color-surface-muted: 250 242 235;
+  --color-text: 42 33 53;
+  --color-muted: 142 128 153;
+  --color-border: 235 224 215;
+
+  --color-primary: 226 120 150;
+  --color-primary-50: 255 236 243;
+  --color-primary-600: 200 82 118;
+  --color-primary-foreground: 255 255 255;
+
+  --color-accent: 244 192 78;
+  --color-accent-foreground: 70 48 10;
+
+  --color-success: 97 186 129;
+  --color-warning: 240 168 104;
+  --color-danger: 226 107 107;
+
+  /* Radii */
+  --radius-sm: 8px;
+  --radius-md: 14px;
+  --radius-lg: 20px;
+  --radius-xl: 28px;
+
+  /* Shadows */
+  --shadow-card: 0 1px 2px rgba(42, 33, 53, 0.04), 0 10px 28px rgba(42, 33, 53, 0.07);
+  --shadow-pop: 0 8px 32px rgba(42, 33, 53, 0.18);
+  --shadow-focus: 0 0 0 3px rgba(226, 120, 150, 0.3);
+
+  /* Transitions */
+  --transition-base: 160ms cubic-bezier(0.2, 0.8, 0.2, 1);
+}
--- a/apps/frontend/tailwind.config.ts
+++ b/apps/frontend/tailwind.config.ts
@@ -0,0 +1,58 @@
+import type { Config } from 'tailwindcss';
+
+export default {
+  content: ['./index.html', './src/**/*.{ts,tsx}'],
+  theme: {
+    extend: {
+      colors: {
+        // Mapped to CSS variables defined in src/styles/tokens.css so the design
+        // tokens stay the single source of truth.
+        background: 'rgb(var(--color-background) / <alpha-value>)',
+        surface: 'rgb(var(--color-surface) / <alpha-value>)',
+        'surface-muted': 'rgb(var(--color-surface-muted) / <alpha-value>)',
+        primary: {
+          DEFAULT: 'rgb(var(--color-primary) / <alpha-value>)',
+          foreground: 'rgb(var(--color-primary-foreground) / <alpha-value>)',
+          600: 'rgb(var(--color-primary-600) / <alpha-value>)',
+          50: 'rgb(var(--color-primary-50) / <alpha-value>)',
+        },
+        accent: {
+          DEFAULT: 'rgb(var(--color-accent) / <alpha-value>)',
+          foreground: 'rgb(var(--color-accent-foreground) / <alpha-value>)',
+        },
+        ink: 'rgb(var(--color-text) / <alpha-value>)',
+        muted: 'rgb(var(--color-muted) / <alpha-value>)',
+        border: 'rgb(var(--color-border) / <alpha-value>)',
+        success: 'rgb(var(--color-success) / <alpha-value>)',
+        warning: 'rgb(var(--color-warning) / <alpha-value>)',
+        danger: 'rgb(var(--color-danger) / <alpha-value>)',
+      },
+      fontFamily: {
+        sans: ['Inter', 'ui-sans-serif', 'system-ui', 'sans-serif'],
+        display: ['"Fraunces"', 'Georgia', 'serif'],
+      },
+      borderRadius: {
+        sm: 'var(--radius-sm)',
+        DEFAULT: 'var(--radius-md)',
+        md: 'var(--radius-md)',
+        lg: 'var(--radius-lg)',
+        xl: 'var(--radius-xl)',
+      },
+      boxShadow: {
+        card: 'var(--shadow-card)',
+        pop: 'var(--shadow-pop)',
+        focus: 'var(--shadow-focus)',
+      },
+      keyframes: {
+        fadeInUp: {
+          from: { opacity: '0', transform: 'translateY(8px)' },
+          to: { opacity: '1', transform: 'translateY(0)' },
+        },
+      },
+      animation: {
+        'fade-in-up': 'fadeInUp 320ms ease-out both',
+      },
+    },
+  },
+  plugins: [],
+} satisfies Config;
--- a/apps/frontend/tsconfig.app.json
+++ b/apps/frontend/tsconfig.app.json
@@ -0,0 +1,20 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "jsx": "react-jsx",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "allowImportingTsExtensions": true,
+    "noEmit": true,
+    "types": [],
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["src/*"]
+    }
+  },
+  "include": ["src/**/*"]
+}
--- a/apps/frontend/tsconfig.json
+++ b/apps/frontend/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "files": [],
+  "references": [
+    { "path": "./tsconfig.app.json" },
+    { "path": "./tsconfig.node.json" }
+  ]
+}
--- a/apps/frontend/tsconfig.node.json
+++ b/apps/frontend/tsconfig.node.json
@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "types": ["node"],
+    "allowSyntheticDefaultImports": true,
+    "noEmit": true
+  },
+  "include": ["vite.config.ts", "tailwind.config.ts", "postcss.config.js"]
+}
--- a/apps/frontend/vite.config.ts
+++ b/apps/frontend/vite.config.ts
@@ -0,0 +1,36 @@
+import { defineConfig, loadEnv } from 'vite';
+import react from '@vitejs/plugin-react';
+import path from 'node:path';
+import { readFileSync } from 'node:fs';
+
+const pkg = JSON.parse(readFileSync(path.resolve(__dirname, 'package.json'), 'utf-8')) as {
+  version: string;
+};
+
+export default defineConfig(({ mode }) => {
+  const env = loadEnv(mode, process.cwd(), '');
+  const apiTarget = env.VITE_API_TARGET ?? 'http://localhost:3000';
+
+  return {
+    plugins: [react()],
+    resolve: {
+      alias: {
+        '@': path.resolve(__dirname, './src'),
+      },
+    },
+    define: {
+      __FRONTEND_VERSION__: JSON.stringify(pkg.version),
+    },
+    server: {
+      port: 5173,
+      proxy: {
+        '/api': { target: apiTarget, changeOrigin: true },
+        '/uploads': { target: apiTarget, changeOrigin: true },
+      },
+    },
+    build: {
+      outDir: 'dist',
+      sourcemap: true,
+    },
+  };
+});
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -0,0 +1,16 @@
+services:
+  postgres:
+    image: postgres:16-alpine
+    container_name: family-wishlist-postgres-dev
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_DB: ${DB_NAME}
+    ports:
+      - "5432:5432"
+    volumes:
+      - pgdata_dev:/var/lib/postgresql/data
+
+volumes:
+  pgdata_dev:
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -0,0 +1,50 @@
+services:
+  family-wishlist-backend:
+    build:
+      context: .
+      dockerfile: docker/backend.Dockerfile
+    container_name: family-wishlist-backend
+    restart: unless-stopped
+    env_file: .env
+    environment:
+      NODE_ENV: production
+      UPLOADS_DIR: /app/apps/backend/uploads
+      BACKEND_PORT: 3000
+      DATABASE_URL: postgresql://${DB_USER}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME}
+    volumes:
+      - uploads:/app/apps/backend/uploads
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "wget",
+          "-qO-",
+          "http://127.0.0.1:3000/api/health",
+        ]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+    networks:
+      - postgres_default
+
+  frontend:
+    build:
+      context: .
+      dockerfile: docker/frontend.Dockerfile
+    container_name: family-wishlist-frontend
+    restart: unless-stopped
+    depends_on:
+      family-wishlist-backend:
+        condition: service_healthy
+    ports:
+      - "3055:80"
+    networks:
+      - postgres_default
+
+volumes:
+  uploads:
+
+networks:
+  postgres_default:
+    external: true
--- a/docker/backend.Dockerfile
+++ b/docker/backend.Dockerfile
@@ -0,0 +1,52 @@
+# syntax=docker/dockerfile:1.7
+FROM node:20-alpine AS base
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+RUN corepack enable && corepack prepare pnpm@9.12.0 --activate
+RUN apk add --no-cache openssl
+
+# ---------- deps ----------
+FROM base AS deps
+WORKDIR /app
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* ./
+COPY tsconfig.base.json ./
+COPY packages/shared/package.json packages/shared/
+COPY apps/backend/package.json apps/backend/
+COPY apps/frontend/package.json apps/frontend/
+# Prisma schema is needed before `prisma generate` so we copy it at this stage.
+COPY apps/backend/prisma apps/backend/prisma
+# Install only the backend workspace and its deps.
+RUN pnpm install --filter @family-wishlist/backend... --frozen-lockfile || \
+    pnpm install --filter @family-wishlist/backend...
+# Generate @prisma/client into node_modules so it's present in the runtime stage.
+RUN pnpm --filter @family-wishlist/backend prisma:generate
+
+# ---------- build ----------
+FROM deps AS build
+WORKDIR /app
+COPY packages/shared packages/shared
+COPY apps/backend apps/backend
+RUN pnpm --filter @family-wishlist/shared build
+RUN pnpm --filter @family-wishlist/backend build
+
+# ---------- runtime ----------
+FROM base AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+# Copy everything needed for running: hoisted node_modules (with the generated
+# @prisma/client inside), workspace packages, and the compiled backend.
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/package.json ./package.json
+COPY --from=build /app/pnpm-workspace.yaml ./pnpm-workspace.yaml
+COPY --from=build /app/packages ./packages
+COPY --from=build /app/apps/backend/node_modules ./apps/backend/node_modules
+COPY --from=build /app/apps/backend/dist ./apps/backend/dist
+COPY --from=build /app/apps/backend/prisma ./apps/backend/prisma
+COPY --from=build /app/apps/backend/package.json ./apps/backend/package.json
+COPY --from=build /app/apps/backend/scripts ./apps/backend/scripts
+
+WORKDIR /app/apps/backend
+EXPOSE 3000
+# Apply schema (idempotent; uses `db push` so no prior migrations required) +
+# seed env users + start server.
+CMD ["sh", "-c", "pnpm exec prisma db push --accept-data-loss --skip-generate && node dist/prisma/seed.js && node dist/src/index.js"]
--- a/docker/frontend.Dockerfile
+++ b/docker/frontend.Dockerfile
@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1.7
+FROM node:20-alpine AS base
+ENV PNPM_HOME=/pnpm
+ENV PATH=$PNPM_HOME:$PATH
+RUN corepack enable && corepack prepare pnpm@9.12.0 --activate
+
+# ---------- deps ----------
+FROM base AS deps
+WORKDIR /app
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml* ./
+COPY tsconfig.base.json ./
+COPY packages/shared/package.json packages/shared/
+COPY apps/backend/package.json apps/backend/
+COPY apps/frontend/package.json apps/frontend/
+RUN pnpm install --filter @family-wishlist/frontend... --frozen-lockfile || \
+    pnpm install --filter @family-wishlist/frontend...
+
+# ---------- build ----------
+FROM deps AS build
+WORKDIR /app
+COPY packages/shared packages/shared
+COPY apps/frontend apps/frontend
+RUN pnpm --filter @family-wishlist/shared build
+RUN pnpm --filter @family-wishlist/frontend build
+
+# ---------- runtime (nginx) ----------
+FROM nginx:1.27-alpine AS runtime
+COPY docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/apps/frontend/dist /usr/share/nginx/html
+EXPOSE 80
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -0,0 +1,38 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Static files with long cache
+    location ~* \.(?:js|css|woff2?|svg|png|jpg|jpeg|gif|webp|ico)$ {
+        expires 7d;
+        add_header Cache-Control "public";
+        try_files $uri =404;
+    }
+
+    # API proxy
+    location /api/ {
+        proxy_pass http://family-wishlist-backend:3000/api/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+        client_max_body_size 10m;
+    }
+
+    # Uploaded files (images)
+    location /uploads/ {
+        proxy_pass http://family-wishlist-backend:3000/uploads/;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_cache_valid 200 1h;
+    }
+
+    # SPA fallback
+    location / {
+        try_files $uri /index.html;
+    }
+}
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -3,16 +3,19 @@
  "version": "0.1.0",
  "private": true,
  "type": "module",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
  "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
  },
  "scripts": {
    "typecheck": "tsc --noEmit",
-    "build": "echo 'shared is source-only'",
+    "build": "tsc -p tsconfig.json",
    "lint": "echo 'skip'",
-    "dev": "echo 'shared is source-only'"
+    "dev": "tsc -p tsconfig.json --watch"
  },
  "dependencies": {
    "zod": "^3.23.8"
--- a/packages/shared/src/profile.schema.ts
+++ b/packages/shared/src/profile.schema.ts
@@ -15,6 +15,14 @@ export const profileSchema = z.object({

 export type Profile = z.infer<typeof profileSchema>;

+export const friendProfileSchema = z.object({
+  slug: z.string(),
+  displayName: z.string(),
+  avatarUrl: z.string().nullable(),
+});
+
+export type FriendProfile = z.infer<typeof friendProfileSchema>;
+
 export const updateProfileSchema = z.object({
  slug: z
    .string()
@@ -24,7 +32,20 @@ export const updateProfileSchema = z.object({
    .optional(),
  displayName: z.string().trim().min(1).max(64).optional(),
  bio: z.string().trim().max(500).nullable().optional(),
-  avatarUrl: z.string().url().nullable().optional(),
+  avatarUrl: z
+    .preprocess(
+      (value) => (value === '' ? null : value),
+      z
+        .string()
+        .refine(
+          (value) => value.startsWith('/uploads/avatar/') || z.string().url().safeParse(value).success,
+          {
+            message: 'Avatar must be a URL or an uploaded avatar path',
+          },
+        )
+        .nullable(),
+    )
+    .optional(),
 });

 export type UpdateProfileInput = z.infer<typeof updateProfileSchema>;
--- a/packages/shared/tsconfig.json
+++ b/packages/shared/tsconfig.json
@@ -3,7 +3,7 @@
  "compilerOptions": {
    "rootDir": "./src",
    "outDir": "./dist",
-    "noEmit": true
+    "noEmit": false
  },
  "include": ["src/**/*"]
 }
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
Author	SHA1	Message	Date
Vaka.pro	14a57b19b7	fix: improve friend wishlist navigation layout	2026-04-26 23:44:06 +03:00
admin	17d59c3639	Merge pull request 'feat: add friend wishlist link' (#12 ) from feature/friend-wishlist-link into main Reviewed-on: #12	2026-04-26 20:30:23 +00:00
Vaka.pro	34179b3f30	feat: add friend wishlist link	2026-04-26 23:29:20 +03:00
admin	f8fcda0d13	Merge pull request 'feat: add i18n and avatar upload' (#11 ) from feature/i18n-avatar-upload into main Reviewed-on: #11	2026-04-26 19:18:14 +00:00
Vaka.pro	1b23097b18	feat: add i18n and avatar upload	2026-04-26 22:16:59 +03:00
admin	db41d4a246	Merge pull request 'chore: update frontend port mapping' (#10 ) from chore/update-frontend-port into main Reviewed-on: #10	2026-04-26 18:52:25 +00:00
Vaka.pro	547a452097	chore: update frontend port mapping	2026-04-26 21:50:55 +03:00
admin	3d7501f028	Merge pull request 'fix: build shared package for runtime' (#9 ) from fix/shared-runtime-build into main Reviewed-on: #9	2026-04-26 18:42:52 +00:00
Vaka.pro	7c658706ea	fix: build shared package for runtime	2026-04-26 21:42:08 +03:00
admin	1c9c21d5a7	Merge pull request 'fix: run compiled seed in backend container' (#8 ) from fix/backend-runtime-seed into main Reviewed-on: #8	2026-04-26 17:54:18 +00:00
Vaka.pro	89f75e6d40	fix: run compiled seed in backend container	2026-04-26 20:53:52 +03:00
admin	e69f53114d	Merge pull request 'fix: add portable router type annotation' (#7 ) from fix/frontend-router-type into main Reviewed-on: #7	2026-04-26 17:40:31 +00:00
Vaka.pro	793f0c3422	fix: add portable router type annotation	2026-04-26 20:39:38 +03:00
admin	d99002dc3c	Merge pull request 'fix: resolve backend docker build errors' (#6 ) from fix/backend-docker-build into main Reviewed-on: #6	2026-04-26 16:07:36 +00:00
Vaka.pro	c49abafc61	fix: resolve backend docker build errors	2026-04-26 19:06:50 +03:00
admin	4f4f9ff998	Merge pull request 'chore: use shared postgres for family wishlist' (#5 ) from chore/shared-postgres-db-family into main Reviewed-on: #5	2026-04-25 14:26:12 +00:00
Vaka.pro	2adb03ff33	chore: use shared postgres for family wishlist	2026-04-25 17:25:28 +03:00
admin	a7d5260ce3	Merge pull request 'docs: add setup, security, and api usage guide' (#4 ) from docs/readme into main Reviewed-on: #4	2026-04-23 13:11:42 +00:00
admin	1a978ca98d	Merge pull request 'feat(backend): add fastify api, auth, prisma schema and jobs' (#3 ) from feat/backend into main Reviewed-on: #3	2026-04-23 13:11:35 +00:00
admin	1e228f7be6	Merge pull request 'feat(frontend): add react spa with wishlist flows and public profile' (#2 ) from feat/frontend into main Reviewed-on: #2	2026-04-23 13:11:27 +00:00
admin	1634a3ac27	Merge pull request 'chore(docker): add containerized deployment and nginx proxy' (#1 ) from chore/docker-files into main Reviewed-on: #1	2026-04-23 13:11:16 +00:00
Anton	43f52c3475	docs: add setup, security, and api usage guide	2026-04-23 16:07:09 +03:00
Anton	d84b9b5ee7	chore(docker): add containerized deployment and nginx proxy	2026-04-23 16:06:07 +03:00
Anton	00f01611ed	feat(frontend): add react spa with wishlist flows and public profile	2026-04-23 16:05:27 +03:00