From fd0a076bc31e3ae90286f7b2827b4d9852aa8be3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cau=C3=AA=20Faleiros?= <cauefaleiros@gmail.com>
Date: Tue, 9 Jun 2026 16:00:48 -0300
Subject: [PATCH] Rollback to stable frontend services commit

---
 .dockerignore                        |    9 -
 CONTEXT.md                           |    8 +-
 Dockerfile                           |    8 +-
 backend/index.js                     | 1661 +++++++++++++++++++++++++-
 backend/middleware/auth.js           |   56 -
 backend/policies/accessPolicy.js     |    2 -
 backend/routes/activityRoutes.js     |   30 -
 backend/routes/apiKeysRoutes.js      |   61 -
 backend/routes/attendancesRoutes.js  |   88 --
 backend/routes/authRoutes.js         |  269 -----
 backend/routes/funnelsRoutes.js      |  141 ---
 backend/routes/integrationsRoutes.js |  155 ---
 backend/routes/originsRoutes.js      |  138 ---
 backend/routes/searchRoutes.js       |   80 --
 backend/routes/teamsRoutes.js        |   93 --
 backend/routes/tenantsRoutes.js      |  103 --
 backend/routes/usersRoutes.js        |  235 ----
 backend/services/activityService.js  |   14 -
 backend/services/provisioning.js     |  273 -----
 backend/test/accessPolicy.test.js    |    8 -
 docker-compose.local.yml             |    4 +
 package-lock.json                    |   82 +-
 src/assets/audio/notification.mp3    |  Bin 0 -> 16128 bytes
 src/components/Layout.tsx            |  158 ++-
 src/pages/TeamManagement.tsx         |   73 +-
 src/pages/UserProfile.tsx            |   28 +-
 src/services/activityService.ts      |   23 -
 src/services/dataService.ts          |    2 +-
 src/services/notificationsService.ts |   66 +
 src/types.ts                         |    1 +
 30 files changed, 1912 insertions(+), 1957 deletions(-)
 delete mode 100644 .dockerignore
 delete mode 100644 backend/middleware/auth.js
 delete mode 100644 backend/routes/activityRoutes.js
 delete mode 100644 backend/routes/apiKeysRoutes.js
 delete mode 100644 backend/routes/attendancesRoutes.js
 delete mode 100644 backend/routes/authRoutes.js
 delete mode 100644 backend/routes/funnelsRoutes.js
 delete mode 100644 backend/routes/integrationsRoutes.js
 delete mode 100644 backend/routes/originsRoutes.js
 delete mode 100644 backend/routes/searchRoutes.js
 delete mode 100644 backend/routes/teamsRoutes.js
 delete mode 100644 backend/routes/tenantsRoutes.js
 delete mode 100644 backend/routes/usersRoutes.js
 delete mode 100644 backend/services/activityService.js
 delete mode 100644 backend/services/provisioning.js
 create mode 100644 src/assets/audio/notification.mp3
 delete mode 100644 src/services/activityService.ts
 create mode 100644 src/services/notificationsService.ts

diff --git a/.dockerignore b/.dockerignore
deleted file mode 100644
index f2cdda6..0000000
--- a/.dockerignore
+++ /dev/null
@@ -1,9 +0,0 @@
-.git
-.env
-node_modules
-backend/node_modules
-dist
-backend/uploads
-npm-debug.log*
-Dockerfile
-docker-compose*.yml
diff --git a/CONTEXT.md b/CONTEXT.md
index 468ccb5..af37a0c 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -28,16 +28,16 @@ We have transitioned from a mock-based prototype to a **secure, multi-tenant pro
   - Super Admins can generate persistent `api_keys` for specific tenants.
   - `GET /api/integration/users`, `/funnels`, and `/origins` allow the n8n AI to dynamically map the tenant's actual agents and workflow stages before processing a chat.
   - `POST /api/integration/attendances` accepts the AI's final JSON payload (including the `full_summary` text) and injects it directly into the dashboard.
-- **Activity Feed:**
-  - Replaced the noisy real-time notification tray with an on-demand activity feed (`/api/activity`) that records important operational events without polling, unread state, delete actions, or sound playback.
-  - Automated activity events: Super Admins see new organizations; Admins/Super Admins see new user setups; Agents see team assignment changes; Managers see "Venda Fechada" events when n8n posts a converted lead.
+- **Real-Time Notification System:** 
+  - Built a persistent notification tray (`/api/notifications`) with real-time polling (10s intervals) and a hidden HTML5 `<audio>` player for cross-browser sound playback (custom `.mp3` loaded via Vite).
+  - Automated Triggers: Super Admins are notified of new organizations; Admins/Super Admins are notified of new user setups; Agents are notified of team assignment changes; Managers get "Venda Fechada" alerts when n8n posts a converted lead.
 - **Enhanced UI/UX:** 
   - Premium "Onyx & Gold" True Black dark mode (Zinc scale).
   - Fully collapsible interactive sidebar with memory (`localStorage`).
   - All Date/Time displays localized to strict Brazilian formatting (`pt-BR`, 24h, `DD/MM/YY`).
 
 ## 📌 Roadmap / To-Do
-- [ ] **Critical Activity Alerts:** Add backend rules for high-signal events such as critically low attendance scores (`score < 50`) or response-time SLA breaches (`first_response_time_min > 60`).
+- [ ] **Advanced AI Notification Triggers:** Implement backend logic to automatically notify Managers when an attendance payload from n8n receives a critically low quality score (`score < 50`), or breaches a specific Response Time SLA (e.g., `first_response_time_min > 60`).
 - [ ] **Data Export/Reporting:** Allow Admins to export attendance and KPI data to CSV/Excel.
 - [ ] **Billing/Subscription Management:** Integrate a payment gateway (e.g., Stripe/Asaas) to manage tenant trial periods and active statuses dynamically.
 
diff --git a/Dockerfile b/Dockerfile
index 178eb9b..5ecf721 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,8 +3,8 @@ FROM node:22-alpine AS builder
 
 WORKDIR /app
 
-COPY package.json package-lock.json ./
-RUN npm ci --no-audit
+COPY package.json ./
+RUN npm install
 
 COPY . .
 
@@ -21,15 +21,13 @@ ENV NODE_ENV=production
 COPY backend/package.json backend/package-lock.json ./
 
 # Install dependencies
-RUN npm ci --omit=dev --no-audit
+RUN npm ci --omit=dev
 
 # Copy backend source directly into root
 COPY backend/index.js ./index.js
 COPY backend/db.js ./db.js
 COPY backend/config ./config
-COPY backend/middleware ./middleware
 COPY backend/policies ./policies
-COPY backend/routes ./routes
 COPY backend/services ./services
 COPY backend/utils ./utils
 
diff --git a/backend/index.js b/backend/index.js
index ff1d370..65aaf30 100644
--- a/backend/index.js
+++ b/backend/index.js
@@ -1,28 +1,28 @@
 require('dotenv').config();
 const express = require('express');
 const path = require('path');
+const bcrypt = require('bcryptjs');
+const jwt = require('jsonwebtoken');
+const crypto = require('crypto');
 const multer = require('multer');
 const { v4: uuidv4 } = require('uuid');
 const fs = require('fs');
 const pool = require('./db');
+const { hashSecret, maskSecret } = require('./utils/security');
 const transporter = require('./services/mailer');
-const { provisionSuperAdmin } = require('./services/provisioning');
 const { createCorsMiddleware } = require('./config/cors');
 const { allowedOrigins, getBaseUrl, getStartupBaseUrl, isProduction, jwtSecret: JWT_SECRET, port: PORT } = require('./config/runtime');
-const { authenticateToken } = require('./middleware/auth');
-const { createAuthRouter } = require('./routes/authRoutes');
-const { createUsersRouter } = require('./routes/usersRoutes');
-const { createTeamsRouter } = require('./routes/teamsRoutes');
-const { createTenantsRouter } = require('./routes/tenantsRoutes');
-const { createActivityRouter } = require('./routes/activityRoutes');
-const { createOriginsRouter } = require('./routes/originsRoutes');
-const { createFunnelsRouter } = require('./routes/funnelsRoutes');
-const { createSearchRouter } = require('./routes/searchRoutes');
-const { createAttendancesRouter } = require('./routes/attendancesRoutes');
-const { createApiKeysRouter } = require('./routes/apiKeysRoutes');
-const { createIntegrationsRouter } = require('./routes/integrationsRoutes');
+const {
+  canReadUser,
+  canUpdateUser,
+  canManageUserStatus,
+  canChangeUserEmail,
+  canManageUserRoleOrTeam,
+  canReadAttendance,
+} = require('./policies/accessPolicy');
 
 const app = express();
+const USER_PUBLIC_FIELDS = 'id, tenant_id, team_id, name, email, slug, role, status, bio, avatar_url, sound_enabled, created_at';
 
 app.use(createCorsMiddleware({ allowedOrigins, isProduction }));
 app.use(express.json());
@@ -71,31 +71,1349 @@ app.use('/uploads', express.static(uploadDir, {
 // --- API Router ---
 const apiRouter = express.Router();
 
+// Middleware de autenticação
+const authenticateToken = async (req, res, next) => {
+  // Ignorar rotas de auth
+  if (req.path.startsWith('/auth/')) return next();
+
+  const authHeader = req.headers['authorization'];
+  
+  // API Key Authentication for n8n/External Integrations
+  if (authHeader && authHeader.startsWith('Bearer fasto_sk_')) {
+    const apiKey = authHeader.split(' ')[1];
+    try {
+      const [keys] = await pool.query(
+        'SELECT * FROM api_keys WHERE secret_hash = ? OR secret_key = ?',
+        [hashSecret(apiKey), apiKey]
+      );
+      if (keys.length === 0) return res.status(401).json({ error: 'Chave de API inválida.' });
+      
+      // Update last used timestamp
+      await pool.query('UPDATE api_keys SET last_used_at = CURRENT_TIMESTAMP WHERE id = ?', [keys[0].id]);
+      
+      // Attach a "system/bot" user identity to the request based on the tenant
+      req.user = {
+        id: 'bot_integration',
+        tenant_id: keys[0].tenant_id,
+        role: 'admin', // Give integration admin privileges within its tenant
+        is_api_key: true
+      };
+      return next();
+    } catch (error) {
+      console.error('API Key validation error:', error);
+      return res.status(500).json({ error: 'Erro ao validar chave de API.' });
+    }
+  }
+
+  // Standard JWT Authentication
+  const token = authHeader && authHeader.split(' ')[1];
+
+  if (!token) return res.status(401).json({ error: 'Token não fornecido.' });
+
+  try {
+    const user = jwt.verify(token, JWT_SECRET);
+    req.user = user;
+    next();
+  } catch (err) {
+    return res.status(401).json({ error: 'Token inválido ou expirado.' });
+  }
+};
+
+const requireRole = (roles) => (req, res, next) => {
+  if (!req.user || !req.user.role) return res.status(401).json({ error: 'Não autenticado.' });
+  if (!roles.includes(req.user.role)) return res.status(403).json({ error: 'Acesso negado. Você não tem permissão para realizar esta ação.' });
+  next();
+};
+
 apiRouter.use(authenticateToken);
 
 // --- Auth Routes ---
 
-apiRouter.use(createAuthRouter({ pool, transporter, getBaseUrl, jwtSecret: JWT_SECRET }));
+// Register
+apiRouter.post('/auth/register', async (req, res) => {
+  const { name, email, password, organizationName } = req.body;
+  try {
+    const [existing] = await pool.query('SELECT id FROM users WHERE email = ?', [email]);
+    if (existing.length > 0) return res.status(400).json({ error: 'E-mail já cadastrado.' });
 
-apiRouter.use(createUsersRouter({ pool, upload, transporter, getBaseUrl }));
+    const passwordHash = await bcrypt.hash(password, 10);
+    const verificationCode = Math.floor(100000 + Math.random() * 900000).toString();
+    const expiresAt = new Date(Date.now() + 15 * 60 * 1000);
 
-apiRouter.use(createTeamsRouter({ pool }));
+    await pool.query(
+      'INSERT INTO pending_registrations (email, password_hash, full_name, organization_name, verification_code, expires_at) VALUES (?, ?, ?, ?, ?, ?)',
+      [email, passwordHash, name, organizationName, verificationCode, expiresAt]
+    );
 
-apiRouter.use(createTenantsRouter({ pool, transporter, getBaseUrl }));
+    const mailOptions = {
+      from: `"Fasto" <${process.env.MAIL_FROM || 'nao-responda@blyzer.com.br'}>`,
+      to: email,
+      subject: 'Seu código de verificação Fasto',
+      text: `Olá ${name}, seu código de verificação é: ${verificationCode}`,
+      html: `
+        <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e2e8f0; border-radius: 12px;">
+          <h2 style="color: #0f172a;">Bem-vindo ao Fasto!</h2>
+          <p style="color: #475569;">Seu código: <strong>${verificationCode}</strong></p>
+        </div>`
+    };
+    await transporter.sendMail(mailOptions);
+    res.json({ message: 'Código enviado.' });
+  } catch (error) {
+    console.error('Register error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
 
-apiRouter.use(createActivityRouter({ pool }));
+// Verify
+apiRouter.post('/auth/verify', async (req, res) => {
+  const { email, code } = req.body;
+  const connection = await pool.getConnection();
+  try {
+    await connection.beginTransaction();
+    const [pending] = await connection.query(
+      'SELECT * FROM pending_registrations WHERE email = ? AND verification_code = ? AND expires_at > NOW() ORDER BY created_at DESC LIMIT 1',
+      [email, code]
+    );
+    if (pending.length === 0) return res.status(400).json({ error: 'Código inválido.' });
 
-apiRouter.use(createOriginsRouter({ pool }));
+    const data = pending[0];
+    const tenantId = `tenant_${crypto.randomUUID().split('-')[0]}`;
+    const userId = `u_${crypto.randomUUID().split('-')[0]}`;
 
-apiRouter.use(createFunnelsRouter({ pool }));
+    await connection.query('INSERT INTO tenants (id, name, slug, admin_email) VALUES (?, ?, ?, ?)',
+      [tenantId, data.organization_name, data.organization_name.toLowerCase().replace(/ /g, '-'), email]);
+    await connection.query('INSERT INTO users (id, tenant_id, name, email, password_hash, role) VALUES (?, ?, ?, ?, ?, ?)',
+      [userId, tenantId, data.full_name, email, data.password_hash, 'admin']);    await connection.query('DELETE FROM pending_registrations WHERE email = ?', [email]);
 
-apiRouter.use(createSearchRouter({ pool }));
+    await connection.commit();
+    res.json({ message: 'Sucesso.' });
+  } catch (error) {
+    await connection.rollback();
+    res.status(500).json({ error: error.message });
+  } finally {
+    connection.release();
+  }
+});
 
-apiRouter.use(createAttendancesRouter({ pool }));
+// Login
+apiRouter.post('/auth/login', async (req, res) => {
+  const { email, password } = req.body;
+  try {
+    const [users] = await pool.query('SELECT * FROM users WHERE email = ?', [email]);
+    if (users.length === 0) return res.status(401).json({ error: 'Credenciais inválidas.' });
+    
+    const user = users[0];
 
-apiRouter.use(createApiKeysRouter({ pool }));
+    // Verificar se o usuário está ativo
+    if (user.status !== 'active') {
+      return res.status(403).json({ error: 'Sua conta está inativa. Contate o administrador.' });
+    }
 
-apiRouter.use(createIntegrationsRouter({ pool }));
+    const valid = await bcrypt.compare(password, user.password_hash);
+    if (!valid) return res.status(401).json({ error: 'Credenciais inválidas.' });
+
+    // Generate Access Token (short-lived)
+    const token = jwt.sign({ id: user.id, tenant_id: user.tenant_id, role: user.role, team_id: user.team_id, slug: user.slug }, JWT_SECRET, { expiresIn: '15m' });
+    
+    // Generate Refresh Token (long-lived)
+    const refreshToken = crypto.randomBytes(40).toString('hex');
+    const refreshId = `rt_${crypto.randomUUID().split('-')[0]}`;
+    
+    // Store Refresh Token in database (expires in 30 days)
+    await pool.query(
+      'INSERT INTO refresh_tokens (id, user_id, token, token_hash, expires_at) VALUES (?, ?, ?, ?, DATE_ADD(NOW(), INTERVAL 30 DAY))',
+      [refreshId, user.id, maskSecret(refreshId, refreshToken), hashSecret(refreshToken)]
+    );
+
+    res.json({ 
+      token, 
+      refreshToken,
+      user: { id: user.id, name: user.name, email: user.email, role: user.role, tenant_id: user.tenant_id, team_id: user.team_id, slug: user.slug } 
+    });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// Refresh Token
+apiRouter.post('/auth/refresh', async (req, res) => {
+  const { refreshToken } = req.body;
+  if (!refreshToken) return res.status(400).json({ error: 'Refresh token não fornecido.' });
+
+  try {
+    // Verifies if the token exists and hasn't expired
+    const [tokens] = await pool.query(
+      'SELECT r.user_id, u.tenant_id, u.role, u.team_id, u.slug, u.status FROM refresh_tokens r JOIN users u ON r.user_id = u.id WHERE (r.token_hash = ? OR r.token = ?) AND r.expires_at > NOW()',
+      [hashSecret(refreshToken), refreshToken]
+    );
+
+    if (tokens.length === 0) {
+      // If invalid, optionally delete the bad token if it's just expired
+      await pool.query('DELETE FROM refresh_tokens WHERE token_hash = ? OR token = ?', [hashSecret(refreshToken), refreshToken]);
+      return res.status(401).json({ error: 'Sessão expirada. Faça login novamente.' });
+    }
+
+    const user = tokens[0];
+
+    if (user.status !== 'active') {
+      await pool.query('DELETE FROM refresh_tokens WHERE token_hash = ? OR token = ?', [hashSecret(refreshToken), refreshToken]);
+      return res.status(403).json({ error: 'Sua conta está inativa.' });
+    }
+
+    // Sliding Expiration: Extend the refresh token's life by another 30 days
+    await pool.query('UPDATE refresh_tokens SET expires_at = DATE_ADD(NOW(), INTERVAL 30 DAY) WHERE token_hash = ? OR token = ?', [hashSecret(refreshToken), refreshToken]);
+
+    // Issue a new short-lived access token
+    const newAccessToken = jwt.sign(
+      { id: user.user_id, tenant_id: user.tenant_id, role: user.role, team_id: user.team_id, slug: user.slug }, 
+      JWT_SECRET, 
+      { expiresIn: '15m' }
+    );
+
+    res.json({ token: newAccessToken });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// Logout (Revoke Refresh Token)
+apiRouter.post('/auth/logout', async (req, res) => {
+  const { refreshToken } = req.body;
+  try {
+    if (refreshToken) {
+      await pool.query('DELETE FROM refresh_tokens WHERE token_hash = ? OR token = ?', [hashSecret(refreshToken), refreshToken]);
+    }
+    res.json({ message: 'Logout bem-sucedido.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// God Mode (Impersonate Tenant)
+apiRouter.post('/impersonate/:tenantId', requireRole(['super_admin']), async (req, res) => {
+  try {
+    // Buscar o primeiro admin (ou qualquer usuário) do tenant para assumir a identidade
+    const [users] = await pool.query("SELECT * FROM users WHERE tenant_id = ? AND role = 'admin' LIMIT 1", [req.params.tenantId]);
+    
+    if (users.length === 0) {
+      return res.status(404).json({ error: 'Nenhum administrador encontrado nesta organização para assumir a identidade.' });
+    }
+
+    const user = users[0];
+
+    if (user.status !== 'active') {
+      return res.status(403).json({ error: 'A conta do admin desta organização está inativa.' });
+    }
+
+    // Gerar um token JWT como se fôssemos o admin do tenant
+    const token = jwt.sign({ id: user.id, tenant_id: user.tenant_id, role: user.role, team_id: user.team_id, slug: user.slug }, JWT_SECRET, { expiresIn: '2h' });
+    res.json({ token, user: { id: user.id, name: user.name, email: user.email, role: user.role, tenant_id: user.tenant_id, team_id: user.team_id, slug: user.slug } });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// Forgot Password
+apiRouter.post('/auth/forgot-password', async (req, res) => {
+  const { email } = req.body;
+  try {
+    const [users] = await pool.query('SELECT name FROM users WHERE email = ?', [email]);
+    if (users.length > 0) {
+      const token = crypto.randomBytes(32).toString('hex');
+      await pool.query('INSERT INTO password_resets (email, token, expires_at) VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 15 MINUTE))', [email, token]);
+      const link = `${getBaseUrl(req)}/#/reset-password?token=${token}`;
+
+      const mailOptions = {        from: `"Fasto" <${process.env.MAIL_FROM || 'nao-responda@blyzer.com.br'}>`,
+        to: email,
+        subject: 'Recuperação de Senha - Fasto',
+        html: `
+          <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e2e8f0; border-radius: 12px;">
+            <h2 style="color: #0f172a;">Olá, ${users[0].name}!</h2>
+            <p style="color: #475569;">Você solicitou a recuperação de senha da sua conta no Fasto.</p>
+            <p style="color: #475569;">Clique no botão abaixo para criar uma nova senha:</p>
+            <div style="text-align: center; margin: 30px 0;">
+              <a href="${link}" style="background-color: #0f172a; color: white; padding: 12px 24px; text-decoration: none; border-radius: 8px; font-weight: bold; display: inline-block;">Redefinir Minha Senha</a>
+            </div>
+            <p style="font-size: 12px; color: #94a3b8;">Este link expira em 15 minutos. Se você não solicitou isso, pode ignorar este e-mail.</p>
+            <div style="border-top: 1px solid #f1f5f9; margin-top: 20px; padding-top: 20px; text-align: center;">
+              <p style="font-size: 12px; color: #94a3b8;">Desenvolvido por <a href="https://blyzer.com.br" style="color: #3b82f6; text-decoration: none;">Blyzer</a></p>
+            </div>
+          </div>
+        `
+      };
+      await transporter.sendMail(mailOptions);
+    }
+    res.json({ message: 'Se o e-mail existir, enviamos as instruções.' });
+  } catch (error) {
+    console.error('Forgot password error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// Reset Password
+apiRouter.post('/auth/reset-password', async (req, res) => {
+  const { token, password, name } = req.body;
+  try {
+    const [resets] = await pool.query('SELECT email FROM password_resets WHERE token = ? AND expires_at > NOW()', [token]);
+    if (resets.length === 0) return res.status(400).json({ error: 'Token inválido ou expirado.' });
+    
+    const hash = await bcrypt.hash(password, 10);
+    
+    if (name) {
+      // If a name is provided (like in the initial admin setup flow), update it along with the password
+      await pool.query('UPDATE users SET password_hash = ?, name = ? WHERE email = ?', [hash, name, resets[0].email]);
+      
+      // Notify managers/admins of the same tenant
+      const [u] = await pool.query('SELECT id, name, tenant_id, role, team_id FROM users WHERE email = ?', [resets[0].email]);
+      if (u.length > 0) {
+        const user = u[0];
+        const [notifiable] = await pool.query(
+          "SELECT id FROM users WHERE tenant_id = ? AND role IN ('admin', 'manager', 'super_admin') AND id != ?",
+          [user.tenant_id, user.id]
+        );
+        for (const n of notifiable) {
+          await pool.query(
+            'INSERT INTO notifications (id, user_id, type, title, message, link) VALUES (?, ?, ?, ?, ?, ?)',
+            [crypto.randomUUID(), n.id, 'info', 'Novo Membro Ativo', `${name} concluiu o cadastro e já pode acessar o sistema.`, `/users/${user.id}`]
+          );
+        }
+        
+        // If the new user is an admin, notify super_admins too
+        if (user.role === 'admin') {
+          const [superAdmins] = await pool.query("SELECT id FROM users WHERE role = 'super_admin'");
+          for (const sa of superAdmins) {
+            await pool.query(
+              'INSERT INTO notifications (id, user_id, type, title, message, link) VALUES (?, ?, ?, ?, ?, ?)',
+              [crypto.randomUUID(), sa.id, 'success', 'Admin Ativo', `O admin ${name} da organização configurou sua conta.`, `/super-admin`]
+            );
+          }
+        }
+      }
+    } else {
+      // Standard password reset, just update the hash
+      await pool.query('UPDATE users SET password_hash = ? WHERE email = ?', [hash, resets[0].email]);
+    }
+    
+    await pool.query('DELETE FROM password_resets WHERE email = ?', [resets[0].email]);
+    res.json({ message: 'Senha e perfil atualizados com sucesso.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// --- User Routes ---
+apiRouter.get('/users', async (req, res) => {
+  try {
+    const { tenantId } = req.query;
+    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
+
+    let q = `SELECT ${USER_PUBLIC_FIELDS} FROM users`;
+    const params = [];
+    if (effectiveTenantId && effectiveTenantId !== 'all') { 
+      q += ' WHERE tenant_id = ?'; 
+      params.push(effectiveTenantId); 
+    }
+    
+    // Strict RBAC: Managers can only see users in their own team, or themselves if they don't have a team yet
+    if (req.user.role === 'manager') {
+      if (req.user.team_id) {
+        q += (params.length > 0 ? ' AND' : ' WHERE') + ' (team_id = ? OR id = ?)';
+        params.push(req.user.team_id, req.user.id);
+      } else {
+        q += (params.length > 0 ? ' AND' : ' WHERE') + ' id = ?';
+        params.push(req.user.id);
+      }
+    }
+    
+    const [rows] = await pool.query(q, params);
+    res.json(rows);
+  } catch (error) { res.status(500).json({ error: error.message }); }
+});
+
+apiRouter.get('/users/:idOrSlug', async (req, res) => {
+  try {
+    const [rows] = await pool.query(`SELECT ${USER_PUBLIC_FIELDS} FROM users WHERE id = ? OR slug = ?`, [req.params.idOrSlug, req.params.idOrSlug]);
+    if (!rows || rows.length === 0) return res.status(404).json({ error: 'Not found' });
+    if (!req.user || !req.user.role) return res.status(401).json({ error: 'Não autenticado' });
+    
+    if (!canReadUser(req.user, rows[0])) return res.status(403).json({ error: 'Acesso negado.' });
+
+    res.json(rows[0]);
+  } catch (error) { 
+    console.error('Error in GET /users/:idOrSlug:', error);
+    res.status(500).json({ error: error.message }); 
+  }
+});
+
+// Convidar Novo Membro (Admin criando usuário)
+apiRouter.post('/users', requireRole(['admin', 'manager', 'super_admin']), async (req, res) => {
+  const { name, email, role, team_id, tenant_id } = req.body;
+  const effectiveTenantId = req.user.role === 'super_admin' ? tenant_id : req.user.tenant_id;
+  
+  // Strict RBAC: Managers can only create agents and assign them to their own team
+  let finalRole = role || 'agent';
+  let finalTeamId = team_id || null;
+  
+  if (req.user.role === 'manager') {
+    if (!req.user.team_id) return res.status(403).json({ error: 'Gerente sem time não pode criar membros.' });
+    finalRole = 'agent'; // Force manager creations to be agents
+    finalTeamId = req.user.team_id; // Force assignment to manager's team
+  }
+  try {
+    // 1. Verificar se e-mail já existe
+    const [existing] = await pool.query('SELECT id FROM users WHERE email = ?', [email]);
+    if (existing.length > 0) return res.status(400).json({ error: 'E-mail já cadastrado.' });
+
+    const uid = `u_${crypto.randomUUID().split('-')[0]}`;
+    const slug = `${name.toLowerCase().replace(/[^a-z0-9]+/g, '-')}-${crypto.randomBytes(4).toString('hex')}`;
+    const placeholderHash = 'pending_setup'; // Usuário não pode logar com isso
+
+    // 2. Criar Usuário
+    await pool.query(
+      'INSERT INTO users (id, tenant_id, team_id, name, email, password_hash, slug, role, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
+      [uid, effectiveTenantId, finalTeamId, name, email, placeholderHash, slug, finalRole, 'active']
+    );
+
+    // 3. Gerar Token de Setup de Senha (reusando lógica de reset)
+    const token = crypto.randomBytes(32).toString('hex');
+    await pool.query(
+      'INSERT INTO password_resets (email, token, expires_at) VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 15 MINUTE))',
+      [email, token]
+    );
+
+    // 4. Enviar E-mail de Boas-vindas
+    const setupLink = `${getBaseUrl(req)}/#/reset-password?token=${token}`;
+
+    await transporter.sendMail({
+      from: `"Fasto" <${process.env.MAIL_FROM || 'nao-responda@blyzer.com.br'}>`,
+      to: email,
+      subject: 'Bem-vindo ao Fasto - Finalize seu cadastro',
+      html: `
+        <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e2e8f0; border-radius: 12px; background: #ffffff; color: #0f172a;">
+          <h2 style="color: #0f172a;">Olá, ${name}!</h2>
+          <p style="color: #475569;">Você foi convidado para participar da equipe no Fasto.</p>
+          <p style="color: #475569;">Clique no botão abaixo para definir sua senha e acessar sua conta:</p>
+          <div style="text-align: center; margin: 30px 0;">
+            <a href="${setupLink}" style="background-color: #0f172a; color: white; padding: 12px 24px; text-decoration: none; border-radius: 8px; font-weight: bold; display: inline-block;">Finalizar Cadastro</a>
+          </div>
+          <p style="font-size: 12px; color: #94a3b8;">Este link expira em 15 minutos. Se você não esperava este convite, ignore este e-mail.</p>
+          <div style="border-top: 1px solid #f1f5f9; margin-top: 20px; padding-top: 20px; text-align: center;">
+            <p style="font-size: 12px; color: #94a3b8;">Desenvolvido por <a href="https://blyzer.com.br" style="color: #3b82f6; text-decoration: none;">Blyzer</a></p>
+          </div>
+        </div>
+      `
+    });
+    res.status(201).json({ id: uid, message: 'Convite enviado com sucesso.' });
+  } catch (error) {
+    console.error('Invite error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.put('/users/:id', async (req, res) => {
+  const { name, bio, role, team_id, status, email, sound_enabled } = req.body;
+  try {
+    const [existing] = await pool.query('SELECT * FROM users WHERE id = ?', [req.params.id]);
+    if (existing.length === 0) return res.status(404).json({ error: 'Not found' });
+
+    if (!canUpdateUser(req.user, existing[0])) return res.status(403).json({ error: 'Acesso negado.' });
+
+    // Only Admins can change roles and teams. Managers can only edit basic info of their team members.
+    const finalRole = canManageUserRoleOrTeam(req.user) && role !== undefined ? role : existing[0].role;
+    const finalTeamId = canManageUserRoleOrTeam(req.user) && team_id !== undefined ? team_id : existing[0].team_id;
+    const finalStatus = canManageUserStatus(req.user) && status !== undefined ? status : existing[0].status;
+    const finalEmail = canChangeUserEmail(req.user, existing[0]) && email !== undefined ? email : existing[0].email;
+    const finalSoundEnabled = req.user.id === req.params.id && sound_enabled !== undefined ? sound_enabled : (existing[0].sound_enabled ?? true);
+
+    if (finalEmail !== existing[0].email) {
+      const [emailCheck] = await pool.query('SELECT id FROM users WHERE email = ? AND id != ?', [finalEmail, req.params.id]);
+      if (emailCheck.length > 0) return res.status(400).json({ error: 'E-mail já está em uso.' });
+    }
+
+    await pool.query(
+      'UPDATE users SET name = ?, bio = ?, email = ?, role = ?, team_id = ?, status = ?, sound_enabled = ? WHERE id = ?',
+      [name || existing[0].name, bio !== undefined ? bio : existing[0].bio, finalEmail, finalRole, finalTeamId || null, finalStatus, finalSoundEnabled, req.params.id]
+    );
+
+    // Trigger Notification for Team Change
+    if (finalTeamId && finalTeamId !== existing[0].team_id && existing[0].status === 'active') {
+      const [team] = await pool.query('SELECT name FROM teams WHERE id = ?', [finalTeamId]);
+      if (team.length > 0) {
+        await pool.query(
+          'INSERT INTO notifications (id, user_id, type, title, message, link) VALUES (?, ?, ?, ?, ?, ?)',
+          [crypto.randomUUID(), req.params.id, 'info', 'Novo Time', `Você foi adicionado ao time ${team[0].name}.`, '/']
+        );
+      }
+    }
+
+    res.json({ message: 'User updated successfully.' });
+  } catch (error) {    console.error('Update user error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.delete('/users/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  try {
+    const [existing] = await pool.query('SELECT tenant_id FROM users WHERE id = ?', [req.params.id]);
+    if (existing.length === 0) return res.status(404).json({ error: 'Not found' });
+    if (req.user.role !== 'super_admin' && existing[0].tenant_id !== req.user.tenant_id) {
+      return res.status(403).json({ error: 'Acesso negado.' });
+    }
+
+    await pool.query('DELETE FROM users WHERE id = ?', [req.params.id]);
+    res.json({ message: 'User deleted successfully.' });
+  } catch (error) {
+    console.error('Delete user error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// Upload de Avatar
+apiRouter.post('/users/:id/avatar', upload.single('avatar'), async (req, res) => {
+  try {
+    if (!req.file) return res.status(400).json({ error: 'Nenhum arquivo enviado.' });
+    
+    // Validar se o usuário está alterando o próprio avatar (ou super_admin)
+    if (req.user.id !== req.params.id && req.user.role !== 'super_admin') {
+      return res.status(403).json({ error: 'Acesso negado.' });
+    }
+
+    const avatarUrl = `/uploads/${req.file.filename}`;
+    await pool.query('UPDATE users SET avatar_url = ? WHERE id = ?', [avatarUrl, req.params.id]);
+    
+    res.json({ avatarUrl });
+  } catch (error) {
+    console.error('Avatar upload error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+
+// --- Notifications Routes ---
+apiRouter.get('/notifications', async (req, res) => {
+  try {
+    const [rows] = await pool.query(
+      'SELECT * FROM notifications WHERE user_id = ? ORDER BY created_at DESC LIMIT 50',
+      [req.user.id]
+    );
+    res.json(rows);
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.put('/notifications/read-all', async (req, res) => {
+  try {
+    await pool.query(
+      'UPDATE notifications SET is_read = true WHERE user_id = ?',
+      [req.user.id]
+    );
+    res.json({ message: 'All notifications marked as read' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.put('/notifications/:id', async (req, res) => {
+  try {
+    await pool.query(
+      'UPDATE notifications SET is_read = true WHERE id = ? AND user_id = ?',
+      [req.params.id, req.user.id]
+    );
+    res.json({ message: 'Notification marked as read' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.delete('/notifications/clear-all', async (req, res) => {
+  try {
+    await pool.query(
+      'DELETE FROM notifications WHERE user_id = ?',
+      [req.user.id]
+    );
+    res.json({ message: 'All notifications deleted' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.delete('/notifications/:id', async (req, res) => {
+  try {
+    await pool.query(
+      'DELETE FROM notifications WHERE id = ? AND user_id = ?',
+      [req.params.id, req.user.id]
+    );
+    res.json({ message: 'Notification deleted' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// --- Origin Routes (Groups & Items) ---
+apiRouter.get('/origins', async (req, res) => {
+  try {
+    const { tenantId } = req.query;
+    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
+    if (!effectiveTenantId || effectiveTenantId === 'all') return res.json([]);
+
+    const [groups] = await pool.query('SELECT * FROM origin_groups WHERE tenant_id = ? ORDER BY created_at ASC', [effectiveTenantId]);
+    
+    // Seed default origin group if none exists
+    if (groups.length === 0) {
+      const gid = `origrp_${crypto.randomUUID().split('-')[0]}`;
+      await pool.query('INSERT INTO origin_groups (id, tenant_id, name) VALUES (?, ?, ?)', [gid, effectiveTenantId, 'Origens Padrão']);
+      
+      const defaultOrigins = [
+        { name: 'WhatsApp', color: 'bg-green-100 text-green-700 border-green-200 dark:bg-green-900/30 dark:text-green-400 dark:border-green-800' },
+        { name: 'Instagram', color: 'bg-pink-100 text-pink-700 border-pink-200 dark:bg-pink-900/30 dark:text-pink-400 dark:border-pink-800' },
+        { name: 'Website', color: 'bg-red-100 text-red-700 border-red-200 dark:bg-red-900/30 dark:text-red-400 dark:border-red-800' },
+        { name: 'LinkedIn', color: 'bg-blue-100 text-blue-700 border-blue-200 dark:bg-blue-900/30 dark:text-blue-400 dark:border-blue-800' },
+        { name: 'Indicação', color: 'bg-orange-100 text-orange-700 border-orange-200 dark:bg-orange-900/30 dark:text-orange-400 dark:border-orange-800' }
+      ];
+      for (const origin of defaultOrigins) {
+        const oid = `oriitm_${crypto.randomUUID().split('-')[0]}`;
+        await pool.query(
+          'INSERT INTO origin_items (id, origin_group_id, name, color_class) VALUES (?, ?, ?, ?)',
+          [oid, gid, origin.name, origin.color]
+        );
+      }
+      
+      // Update all teams of this tenant to use this origin group if they have none
+      await pool.query('UPDATE teams SET origin_group_id = ? WHERE tenant_id = ? AND origin_group_id IS NULL', [gid, effectiveTenantId]);
+      
+      groups.push({ id: gid, tenant_id: effectiveTenantId, name: 'Origens Padrão' });
+    }
+
+    const [items] = await pool.query('SELECT * FROM origin_items WHERE origin_group_id IN (?) ORDER BY created_at ASC', [groups.map(g => g.id)]);
+    const [teams] = await pool.query('SELECT id, origin_group_id FROM teams WHERE tenant_id = ? AND origin_group_id IS NOT NULL', [effectiveTenantId]);
+
+    const result = groups.map(g => ({
+      ...g,
+      items: items.filter(i => i.origin_group_id === g.id),
+      teamIds: teams.filter(t => t.origin_group_id === g.id).map(t => t.id)
+    }));
+
+    res.json(result);
+  } catch (error) {
+    console.error("GET /origins error:", error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.post('/origins', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, tenantId } = req.body;
+  const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
+  try {
+    const gid = `origrp_${crypto.randomUUID().split('-')[0]}`;
+    await pool.query('INSERT INTO origin_groups (id, tenant_id, name) VALUES (?, ?, ?)', [gid, effectiveTenantId, name]);
+    res.status(201).json({ id: gid });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.put('/origins/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, teamIds } = req.body;
+  try {
+    if (name) {
+      await pool.query('UPDATE origin_groups SET name = ? WHERE id = ?', [name, req.params.id]);
+    }
+    if (teamIds && Array.isArray(teamIds)) {
+      await pool.query('UPDATE teams SET origin_group_id = NULL WHERE origin_group_id = ?', [req.params.id]);
+      if (teamIds.length > 0) {
+        await pool.query('UPDATE teams SET origin_group_id = ? WHERE id IN (?)', [req.params.id, teamIds]);
+      }
+    }
+    res.json({ message: 'Origin group updated.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.delete('/origins/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  try {
+    await pool.query('DELETE FROM origin_items WHERE origin_group_id = ?', [req.params.id]);
+    await pool.query('UPDATE teams SET origin_group_id = NULL WHERE origin_group_id = ?', [req.params.id]);
+    await pool.query('DELETE FROM origin_groups WHERE id = ?', [req.params.id]);
+    res.json({ message: 'Origin group deleted.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.post('/origins/:id/items', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, color_class } = req.body;
+  try {
+    const oid = `oriitm_${crypto.randomUUID().split('-')[0]}`;
+    await pool.query(
+      'INSERT INTO origin_items (id, origin_group_id, name, color_class) VALUES (?, ?, ?, ?)',
+      [oid, req.params.id, name, color_class || 'bg-zinc-100 text-zinc-800 border-zinc-200']
+    );
+    res.status(201).json({ id: oid });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.put('/origin_items/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, color_class } = req.body;
+  try {
+    const [existing] = await pool.query('SELECT * FROM origin_items WHERE id = ?', [req.params.id]);
+    if (existing.length === 0) return res.status(404).json({ error: 'Origin item not found' });
+    
+    await pool.query('UPDATE origin_items SET name = ?, color_class = ? WHERE id = ?', [name || existing[0].name, color_class || existing[0].color_class, req.params.id]);
+    res.json({ message: 'Origin item updated.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.delete('/origin_items/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  try {
+    await pool.query('DELETE FROM origin_items WHERE id = ?', [req.params.id]);
+    res.json({ message: 'Origin item deleted.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// --- Funnel Routes ---
+apiRouter.get('/funnels', async (req, res) => {
+  try {
+    const { tenantId } = req.query;
+    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
+    if (!effectiveTenantId || effectiveTenantId === 'all') return res.json([]);
+
+    const [funnels] = await pool.query('SELECT * FROM funnels WHERE tenant_id = ? ORDER BY created_at ASC', [effectiveTenantId]);
+    
+    // Seed default funnel if none exists
+    if (funnels.length === 0) {
+      const fid = `funnel_${crypto.randomUUID().split('-')[0]}`;
+      await pool.query('INSERT INTO funnels (id, tenant_id, name) VALUES (?, ?, ?)', [fid, effectiveTenantId, 'Funil Padrão']);
+      
+      const defaultStages = [
+        { name: 'Sem atendimento', color: 'bg-zinc-100 text-zinc-700 border-zinc-200 dark:bg-dark-input dark:text-dark-muted dark:border-dark-border', order: 0 },
+        { name: 'Identificação', color: 'bg-blue-100 text-blue-700 border-blue-200 dark:bg-blue-900/30 dark:text-blue-400 dark:border-blue-800', order: 1 },
+        { name: 'Negociação', color: 'bg-purple-100 text-purple-700 border-purple-200 dark:bg-purple-900/30 dark:text-purple-400 dark:border-purple-800', order: 2 },
+        { name: 'Ganhos', color: 'bg-green-100 text-green-700 border-green-200 dark:bg-green-900/30 dark:text-green-400 dark:border-green-800', order: 3 },
+        { name: 'Perdidos', color: 'bg-red-100 text-red-700 border-red-200 dark:bg-red-900/30 dark:text-red-400 dark:border-red-800', order: 4 }
+      ];
+      
+      for (const s of defaultStages) {
+        const sid = `stage_${crypto.randomUUID().split('-')[0]}`;
+        await pool.query(
+          'INSERT INTO funnel_stages (id, funnel_id, name, color_class, order_index) VALUES (?, ?, ?, ?, ?)',
+          [sid, fid, s.name, s.color, s.order]
+        );
+      }
+      
+      // Update all teams of this tenant to use this funnel if they have none
+      await pool.query('UPDATE teams SET funnel_id = ? WHERE tenant_id = ? AND funnel_id IS NULL', [fid, effectiveTenantId]);
+      
+      funnels.push({ id: fid, tenant_id: effectiveTenantId, name: 'Funil Padrão' });
+    }
+
+    const [stages] = await pool.query('SELECT * FROM funnel_stages WHERE funnel_id IN (?) ORDER BY order_index ASC', [funnels.map(f => f.id)]);
+    const [teams] = await pool.query('SELECT id, funnel_id FROM teams WHERE tenant_id = ? AND funnel_id IS NOT NULL', [effectiveTenantId]);
+
+    const result = funnels.map(f => ({
+      ...f,
+      stages: stages.filter(s => s.funnel_id === f.id),
+      teamIds: teams.filter(t => t.funnel_id === f.id).map(t => t.id)
+    }));
+
+    res.json(result);
+  } catch (error) {
+    console.error("GET /funnels error:", error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.post('/funnels', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, tenantId } = req.body;
+  const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
+  try {
+    const fid = `funnel_${crypto.randomUUID().split('-')[0]}`;
+    await pool.query('INSERT INTO funnels (id, tenant_id, name) VALUES (?, ?, ?)', [fid, effectiveTenantId, name]);
+    res.status(201).json({ id: fid });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.put('/funnels/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, teamIds } = req.body;
+  try {
+    if (name) {
+      await pool.query('UPDATE funnels SET name = ? WHERE id = ?', [name, req.params.id]);
+    }
+    if (teamIds && Array.isArray(teamIds)) {
+      await pool.query('UPDATE teams SET funnel_id = NULL WHERE funnel_id = ?', [req.params.id]);
+      if (teamIds.length > 0) {
+        await pool.query('UPDATE teams SET funnel_id = ? WHERE id IN (?)', [req.params.id, teamIds]);
+      }
+    }
+    res.json({ message: 'Funnel updated.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.delete('/funnels/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  try {
+    await pool.query('DELETE FROM funnel_stages WHERE funnel_id = ?', [req.params.id]);
+    await pool.query('UPDATE teams SET funnel_id = NULL WHERE funnel_id = ?', [req.params.id]);
+    await pool.query('DELETE FROM funnels WHERE id = ?', [req.params.id]);
+    res.json({ message: 'Funnel deleted.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.post('/funnels/:id/stages', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, color_class, order_index } = req.body;
+  try {
+    const sid = `stage_${crypto.randomUUID().split('-')[0]}`;
+    await pool.query(
+      'INSERT INTO funnel_stages (id, funnel_id, name, color_class, order_index) VALUES (?, ?, ?, ?, ?)',
+      [sid, req.params.id, name, color_class, order_index || 0]
+    );
+    res.status(201).json({ id: sid });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.put('/funnel_stages/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, color_class, order_index } = req.body;
+  try {
+    const [existing] = await pool.query('SELECT * FROM funnel_stages WHERE id = ?', [req.params.id]);
+    if (existing.length === 0) return res.status(404).json({ error: 'Stage not found' });
+    
+    await pool.query(
+      'UPDATE funnel_stages SET name = ?, color_class = ?, order_index = ? WHERE id = ?',
+      [name || existing[0].name, color_class || existing[0].color_class, order_index !== undefined ? order_index : existing[0].order_index, req.params.id]
+    );
+    res.json({ message: 'Stage updated.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.delete('/funnel_stages/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  try {
+    await pool.query('DELETE FROM funnel_stages WHERE id = ?', [req.params.id]);
+    res.json({ message: 'Stage deleted.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// --- Global Search ---
+apiRouter.get('/search', async (req, res) => {
+  const { q } = req.query;
+  if (!q || q.length < 2) return res.json({ members: [], teams: [], attendances: [], organizations: [] });
+
+  const queryStr = `%${q}%`;
+  const results = { members: [], teams: [], attendances: [], organizations: [] };
+
+  try {
+    // 1. Search Members (only for roles above agent)
+    if (req.user.role !== 'agent') {
+      let membersQ = 'SELECT id, name, email, slug, role, team_id, avatar_url FROM users WHERE (name LIKE ? OR email LIKE ?)';
+      const membersParams = [queryStr, queryStr];
+
+      if (req.user.role === 'super_admin') {
+        // No extra filters
+      } else if (req.user.role === 'admin') {
+        membersQ += ' AND tenant_id = ?';
+        membersParams.push(req.user.tenant_id);
+      } else if (req.user.role === 'manager') {
+        membersQ += ' AND tenant_id = ? AND (team_id = ? OR id = ?)';
+        membersParams.push(req.user.tenant_id, req.user.team_id, req.user.id);
+      }
+      const [members] = await pool.query(membersQ, membersParams);
+      results.members = members;
+    }
+
+    // 2. Search Teams (only for roles above agent)
+    if (req.user.role !== 'agent') {
+      let teamsQ = 'SELECT id, name, description FROM teams WHERE name LIKE ?';
+      const teamsParams = [queryStr];
+
+      if (req.user.role === 'super_admin') {
+        // No extra filters
+      } else if (req.user.role === 'admin') {
+        teamsQ += ' AND tenant_id = ?';
+        teamsParams.push(req.user.tenant_id);
+      } else if (req.user.role === 'manager') {
+        teamsQ += ' AND tenant_id = ? AND id = ?';
+        teamsParams.push(req.user.tenant_id, req.user.team_id);
+      }
+      const [teams] = await pool.query(teamsQ, teamsParams);
+      results.teams = teams;
+    }
+
+    // 3. Search Organizations (only for super_admin)
+    if (req.user.role === 'super_admin') {
+      const [orgs] = await pool.query('SELECT id, name, slug, status FROM tenants WHERE name LIKE ? OR slug LIKE ? LIMIT 5', [queryStr, queryStr]);
+      results.organizations = orgs;
+    }
+
+    // 4. Search Attendances
+    let attendancesQ = 'SELECT a.id, a.title, a.created_at, u.name as user_name FROM attendances a JOIN users u ON a.user_id = u.id WHERE a.title LIKE ?';
+    const attendancesParams = [queryStr];
+
+    if (req.user.role === 'super_admin') {
+      // No extra filters
+    } else if (req.user.role === 'admin') {
+      attendancesQ += ' AND a.tenant_id = ?';
+      attendancesParams.push(req.user.tenant_id);
+    } else if (req.user.role === 'manager') {
+      attendancesQ += ' AND a.tenant_id = ? AND u.team_id = ?';
+      attendancesParams.push(req.user.tenant_id, req.user.team_id);
+    } else {
+      attendancesQ += ' AND a.user_id = ?';
+      attendancesParams.push(req.user.id);
+    }
+    attendancesQ += ' LIMIT 10';
+    const [attendances] = await pool.query(attendancesQ, attendancesParams);
+    results.attendances = attendances;
+
+    res.json(results);
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+
+// --- Attendance Routes ---
+apiRouter.get('/attendances', async (req, res) => {
+  try {
+    const { tenantId, userId, teamId, startDate, endDate, funnelStage, origin } = req.query;
+    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
+
+    let q = 'SELECT a.*, u.team_id FROM attendances a JOIN users u ON a.user_id = u.id WHERE a.tenant_id = ?';
+    const params = [effectiveTenantId];
+    
+    if (startDate && endDate) { q += ' AND a.created_at BETWEEN ? AND ?'; params.push(new Date(startDate), new Date(endDate)); }
+    
+    // Strict RBAC: Agents can ONLY see their own data, regardless of what they request
+    if (req.user.role === 'agent') {
+      q += ' AND a.user_id = ?';
+      params.push(req.user.id);
+    } else {
+      if (req.user.role === 'manager') {
+        q += ' AND u.team_id = ?';
+        params.push(req.user.team_id);
+      } else if (teamId && teamId !== 'all') { 
+        q += ' AND u.team_id = ?'; 
+        params.push(teamId); 
+      }
+
+      if (userId && userId !== 'all') {
+        // check if it's a slug or id
+        if (userId.startsWith('u_') || userId.length === 36) {
+          q += ' AND a.user_id = ?';
+          params.push(userId);
+        } else {
+          q += ' AND u.slug = ?';
+          params.push(userId);
+        }
+      }    }
+    
+    if (funnelStage && funnelStage !== 'all') { q += ' AND a.funnel_stage = ?'; params.push(funnelStage); }
+    if (origin && origin !== 'all') { q += ' AND a.origin = ?'; params.push(origin); }
+    
+    q += ' ORDER BY a.created_at DESC';
+    const [rows] = await pool.query(q, params);
+    const processed = rows.map(r => ({
+      ...r,
+      attention_points: typeof r.attention_points === 'string' ? JSON.parse(r.attention_points) : r.attention_points,
+      improvement_points: typeof r.improvement_points === 'string' ? JSON.parse(r.improvement_points) : r.improvement_points,
+      converted: Boolean(r.converted)
+    }));
+    res.json(processed);
+  } catch (error) { res.status(500).json({ error: error.message }); }
+});
+
+apiRouter.get('/attendances/:id', async (req, res) => {
+  try {
+    const [rows] = await pool.query(
+      'SELECT a.*, u.team_id FROM attendances a JOIN users u ON a.user_id = u.id WHERE a.id = ?',
+      [req.params.id]
+    );
+    if (rows.length === 0) return res.status(404).json({ error: 'Not found' });
+    
+    if (!canReadAttendance(req.user, rows[0])) return res.status(403).json({ error: 'Acesso negado.' });
+
+    const r = rows[0];
+    res.json({
+      ...r,
+      attention_points: typeof r.attention_points === 'string' ? JSON.parse(r.attention_points) : r.attention_points,
+      improvement_points: typeof r.improvement_points === 'string' ? JSON.parse(r.improvement_points) : r.improvement_points,
+      converted: Boolean(r.converted)
+    });
+  } catch (error) { res.status(500).json({ error: error.message }); }
+});
+
+// --- API Key Management Routes ---
+apiRouter.get('/api-keys', requireRole(['admin', 'super_admin']), async (req, res) => {
+  try {
+    const { tenantId } = req.query;
+    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
+    if (!effectiveTenantId || effectiveTenantId === 'all') return res.json([]);
+
+    const [rows] = await pool.query(
+      'SELECT id, name, created_at, last_used_at, CASE WHEN secret_key LIKE "masked:%" THEN CONCAT("fasto_sk_", RIGHT(secret_key, 6), "...") ELSE CONCAT(SUBSTRING(secret_key, 1, 14), "...") END as masked_key FROM api_keys WHERE tenant_id = ?',
+      [effectiveTenantId]
+    );
+    res.json(rows);
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.post('/api-keys', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, tenantId } = req.body;
+  const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
+  try {
+    const id = `apk_${crypto.randomUUID().split('-')[0]}`;
+    // Generate a strong, random 32-byte hex string for the secret key
+    const secretKey = `fasto_sk_${crypto.randomBytes(32).toString('hex')}`;
+    
+    await pool.query(
+      'INSERT INTO api_keys (id, tenant_id, name, secret_key, secret_hash) VALUES (?, ?, ?, ?, ?)',
+      [id, effectiveTenantId, name || 'Nova Integração API', maskSecret(id, secretKey), hashSecret(secretKey)]
+    );
+    
+    // We only return the actual secret key ONCE during creation.
+    res.status(201).json({ id, secret_key: secretKey, message: 'Chave criada. Salve-a agora, ela não será exibida novamente.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.delete('/api-keys/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  try {
+    const [existing] = await pool.query('SELECT tenant_id FROM api_keys WHERE id = ?', [req.params.id]);
+    if (existing.length === 0) return res.status(404).json({ error: 'Chave não encontrada' });
+    if (req.user.role !== 'super_admin' && existing[0].tenant_id !== req.user.tenant_id) return res.status(403).json({ error: 'Acesso negado' });
+
+    await pool.query('DELETE FROM api_keys WHERE id = ?', [req.params.id]);
+    res.json({ message: 'Chave de API revogada com sucesso.' });
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// --- External Integration API (n8n) ---
+apiRouter.get('/integration/users', requireRole(['admin']), async (req, res) => {
+  if (!req.user.is_api_key) return res.status(403).json({ error: 'Endpoint restrito a chaves de API.' });
+  try {
+    const [rows] = await pool.query(
+      'SELECT u.id, u.name, u.email, t.name as team_name FROM users u LEFT JOIN teams t ON u.team_id = t.id WHERE u.tenant_id = ? AND u.status = "active"',
+      [req.user.tenant_id]
+    );
+    res.json(rows);
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.get('/integration/origins', requireRole(['admin']), async (req, res) => {
+  if (!req.user.is_api_key) return res.status(403).json({ error: 'Endpoint restrito a chaves de API.' });
+  try {
+    const [groups] = await pool.query('SELECT id, name FROM origin_groups WHERE tenant_id = ?', [req.user.tenant_id]);
+    if (groups.length === 0) return res.json([]);
+
+    const [items] = await pool.query('SELECT origin_group_id, name FROM origin_items WHERE origin_group_id IN (?) ORDER BY created_at ASC', [groups.map(g => g.id)]);
+    const [teams] = await pool.query('SELECT id as team_id, name as team_name, origin_group_id FROM teams WHERE tenant_id = ? AND origin_group_id IS NOT NULL', [req.user.tenant_id]);
+
+    const result = groups.map(g => ({
+      group_name: g.name,
+      origins: items.filter(i => i.origin_group_id === g.id).map(i => i.name),
+      assigned_teams: teams.filter(t => t.origin_group_id === g.id).map(t => ({ id: t.team_id, name: t.team_name }))
+    }));
+
+    res.json(result);
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.get('/integration/funnels', requireRole(['admin']), async (req, res) => {
+  if (!req.user.is_api_key) return res.status(403).json({ error: 'Endpoint restrito a chaves de API.' });
+  try {
+    const [funnels] = await pool.query('SELECT id, name FROM funnels WHERE tenant_id = ?', [req.user.tenant_id]);
+    if (funnels.length === 0) return res.json([]);
+
+    const [stages] = await pool.query('SELECT funnel_id, name, order_index FROM funnel_stages WHERE funnel_id IN (?) ORDER BY order_index ASC', [funnels.map(f => f.id)]);
+    const [teams] = await pool.query('SELECT id as team_id, name as team_name, funnel_id FROM teams WHERE tenant_id = ? AND funnel_id IS NOT NULL', [req.user.tenant_id]);
+
+    const result = funnels.map(f => ({
+      funnel_name: f.name,
+      stages: stages.filter(s => s.funnel_id === f.id).map(s => s.name),
+      assigned_teams: teams.filter(t => t.funnel_id === f.id).map(t => ({ id: t.team_id, name: t.team_name }))
+    }));
+
+    res.json(result);
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.post('/integration/attendances', requireRole(['admin']), async (req, res) => {
+  if (!req.user.is_api_key) return res.status(403).json({ error: 'Endpoint restrito a chaves de API.' });
+  
+  const {
+    user_id,
+    origin,
+    funnel_stage,
+    title,
+    full_summary,
+    score,
+    first_response_time_min,
+    handling_time_min,
+    product_requested,
+    product_sold,
+    converted,
+    attention_points,
+    improvement_points
+  } = req.body;
+
+  if (!user_id || !origin || !funnel_stage || !title) {
+    return res.status(400).json({ error: 'Campos obrigatórios ausentes: user_id, origin, funnel_stage, title' });
+  }
+
+  try {
+    // Validate user belongs to the API Key's tenant
+    const [users] = await pool.query('SELECT id FROM users WHERE id = ? AND tenant_id = ? AND status = "active"', [user_id, req.user.tenant_id]);
+    if (users.length === 0) return res.status(400).json({ error: 'user_id inválido, inativo ou não pertence a esta organização.' });
+
+    const attId = `att_${crypto.randomUUID().split('-')[0]}`;
+    await pool.query(
+      `INSERT INTO attendances (
+        id, tenant_id, user_id, title, full_summary, score, 
+        first_response_time_min, handling_time_min, 
+        funnel_stage, origin, product_requested, product_sold, 
+        converted, attention_points, improvement_points
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        attId,
+        req.user.tenant_id,
+        user_id,
+        title,
+        full_summary || null,
+        score || 0,
+        first_response_time_min || 0,
+        handling_time_min || 0,
+        funnel_stage,
+        origin,
+        product_requested || null,
+        product_sold || null,
+        converted ? 1 : 0,
+        attention_points ? JSON.stringify(attention_points) : null,
+        improvement_points ? JSON.stringify(improvement_points) : null
+      ]
+    );
+
+    // Automation Trigger: "Venda Fechada!" (Ganhos)
+    if (converted) {
+      // Find the user's manager/admin
+      const [managers] = await pool.query(
+        "SELECT id FROM users WHERE tenant_id = ? AND role IN ('admin', 'manager') AND id != ?",
+        [req.user.tenant_id, user_id]
+      );
+      const [agentInfo] = await pool.query("SELECT name FROM users WHERE id = ?", [user_id]);
+      const agentName = agentInfo[0]?.name || 'Um agente';
+
+      for (const m of managers) {
+        await pool.query(
+          'INSERT INTO notifications (id, user_id, type, title, message, link) VALUES (?, ?, ?, ?, ?, ?)',
+          [crypto.randomUUID(), m.id, 'success', 'Venda Fechada!', `${agentName} converteu um lead em ${funnel_stage}.`, `/attendances/${attId}`]
+        );
+      }
+    }
+
+    res.status(201).json({ id: attId, message: 'Atendimento registrado com sucesso.' });
+  } catch (error) {
+    console.error('Integration Error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+// --- Tenant Routes ---
+apiRouter.get('/tenants', requireRole(['super_admin']), async (req, res) => {
+  try {
+    const q = 'SELECT t.*, (SELECT COUNT(*) FROM users u WHERE u.tenant_id = t.id) as user_count, (SELECT COUNT(*) FROM attendances a WHERE a.tenant_id = t.id) as attendance_count FROM tenants t';
+    const [rows] = await pool.query(q);
+    res.json(rows);
+  } catch (error) { res.status(500).json({ error: error.message }); }
+});
+
+// --- Team Routes ---
+apiRouter.get('/teams', async (req, res) => {
+  try {
+    const { tenantId } = req.query;
+    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
+    
+    let q = 'SELECT * FROM teams';
+    const params = [];
+    if (effectiveTenantId && effectiveTenantId !== 'all') { 
+      q += ' WHERE tenant_id = ?'; 
+      params.push(effectiveTenantId); 
+    }
+    
+    // Strict RBAC: Managers can only see their own team
+    if (req.user.role === 'manager') {
+      if (req.user.team_id) {
+        q += (params.length > 0 ? ' AND' : ' WHERE') + ' id = ?';
+        params.push(req.user.team_id);
+      } else {
+        // If a manager doesn't have a team, return nothing to prevent showing all teams
+        q += (params.length > 0 ? ' AND' : ' WHERE') + ' 1=0'; 
+      }
+    }
+    
+    const [rows] = await pool.query(q, params);
+    res.json(rows);
+  } catch (error) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.post('/teams', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, description, tenantId } = req.body;
+  const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
+  try {
+    const tid = `team_${crypto.randomUUID().split('-')[0]}`;
+    await pool.query(
+      'INSERT INTO teams (id, tenant_id, name, description) VALUES (?, ?, ?, ?)',
+      [tid, effectiveTenantId, name, description || null]
+    );
+    res.status(201).json({ id: tid, message: 'Time criado com sucesso.' });
+  } catch (error) {
+    console.error('Create team error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.put('/teams/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  const { name, description } = req.body;
+  try {
+    const [existing] = await pool.query('SELECT tenant_id FROM teams WHERE id = ?', [req.params.id]);
+    if (existing.length === 0) return res.status(404).json({ error: 'Not found' });
+    if (req.user.role !== 'super_admin' && existing[0].tenant_id !== req.user.tenant_id) {
+      return res.status(403).json({ error: 'Acesso negado.' });
+    }
+
+    await pool.query(
+      'UPDATE teams SET name = ?, description = ? WHERE id = ?',
+      [name, description || null, req.params.id]
+    );
+    res.json({ message: 'Team updated successfully.' });
+  } catch (error) {
+    console.error('Update team error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+apiRouter.delete('/teams/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
+  try {
+    const [existing] = await pool.query('SELECT tenant_id FROM teams WHERE id = ?', [req.params.id]);
+    if (existing.length === 0) return res.status(404).json({ error: 'Not found' });
+    if (req.user.role !== 'super_admin' && existing[0].tenant_id !== req.user.tenant_id) {
+      return res.status(403).json({ error: 'Acesso negado.' });
+    }
+
+    // Set users team_id to NULL to prevent orphan foreign key issues if constrained
+    await pool.query('UPDATE users SET team_id = NULL WHERE team_id = ?', [req.params.id]);
+    await pool.query('DELETE FROM teams WHERE id = ?', [req.params.id]);
+    
+    res.json({ message: 'Team deleted successfully.' });
+  } catch (error) {
+    console.error('Delete team error:', error);
+    res.status(500).json({ error: error.message });
+  }
+});
+
+
+
+apiRouter.post('/tenants', requireRole(['super_admin']), async (req, res) => {
+  const { name, slug, admin_email, status } = req.body;
+  const connection = await pool.getConnection();
+  try {
+    await connection.beginTransaction();
+    const tid = `tenant_${crypto.randomUUID().split('-')[0]}`;
+    await connection.query('INSERT INTO tenants (id, name, slug, admin_email, status) VALUES (?, ?, ?, ?, ?)', [tid, name, slug, admin_email, status || 'active']);
+    
+    // Check if user already exists
+    const [existingUser] = await connection.query('SELECT id FROM users WHERE email = ?', [admin_email]);
+    if (existingUser.length === 0) {
+      const uid = `u_${crypto.randomUUID().split('-')[0]}`;
+      const userSlug = `admin-${crypto.randomBytes(4).toString('hex')}`;
+      const placeholderHash = 'pending_setup';
+      await connection.query('INSERT INTO users (id, tenant_id, name, email, password_hash, slug, role) VALUES (?, ?, ?, ?, ?, ?, ?)', [uid, tid, 'Admin', admin_email, placeholderHash, userSlug, 'admin']);
+      
+      const token = crypto.randomBytes(32).toString('hex');
+      // Adicionar aos pending_registrations em vez de criar um usuário direto se quisermos que eles completem o cadastro.
+      // Ou, se quisermos apenas definir a senha, mantemos o password_resets.
+      // O usuário quer "like a register", então vamos enviar para uma página onde eles definem a senha.
+      await connection.query('INSERT INTO password_resets (email, token, expires_at) VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 15 MINUTE))', [admin_email, token]);
+      
+      const setupLink = `${getBaseUrl(req)}/#/setup-account?token=${token}`;
+
+      // Add Notification for Super Admins
+      const [superAdmins] = await connection.query("SELECT id FROM users WHERE role = 'super_admin'");
+      for (const sa of superAdmins) {
+        await connection.query(
+          'INSERT INTO notifications (id, user_id, type, title, message, link) VALUES (?, ?, ?, ?, ?, ?)',
+          [crypto.randomUUID(), sa.id, 'success', 'Nova Organização', `A organização ${name} foi criada.`, '/super-admin']
+        );
+      }
+
+      await transporter.sendMail({
+        from: `"Fasto" <${process.env.MAIL_FROM || 'nao-responda@blyzer.com.br'}>`,
+        to: admin_email,
+        subject: 'Bem-vindo ao Fasto - Conclua seu cadastro de Admin',
+        html: `
+          <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e2e8f0; border-radius: 12px; background: #ffffff; color: #0f172a;">
+            <h2 style="color: #0f172a;">Sua organização foi criada</h2>
+            <p style="color: #475569;">Você foi definido como administrador da organização <strong>${name}</strong>.</p>
+            <p style="color: #475569;">Por favor, clique no botão abaixo para definir sua senha e concluir seu cadastro.</p>
+            <div style="text-align: center; margin: 30px 0;">
+              <a href="${setupLink}" style="background-color: #0f172a; color: white; padding: 12px 24px; text-decoration: none; border-radius: 8px; font-weight: bold; display: inline-block;">Finalizar Cadastro</a>
+            </div>
+            <p style="font-size: 12px; color: #94a3b8;">Este link expira em 15 minutos.</p>
+          </div>
+        `
+      }).catch(err => console.error("Email failed:", err));
+    }
+    
+    await connection.commit();
+    res.status(201).json({ id: tid, message: 'Organização criada e convite enviado por e-mail.' });
+  } catch (error) { await connection.rollback(); res.status(500).json({ error: error.message }); } finally { connection.release(); }
+});
+
+apiRouter.put('/tenants/:id', requireRole(['super_admin']), async (req, res) => {
+  const { name, slug, admin_email, status } = req.body;
+  try {
+    await pool.query(
+      'UPDATE tenants SET name = ?, slug = ?, admin_email = ?, status = ? WHERE id = ?',
+      [name, slug || null, admin_email, status, req.params.id]
+    );
+    res.json({ message: 'Tenant updated successfully.' });
+  } catch (error) { res.status(500).json({ error: error.message }); }
+});
+
+apiRouter.delete('/tenants/:id', requireRole(['super_admin']), async (req, res) => {
+  try {
+    await pool.query('DELETE FROM tenants WHERE id = ?', [req.params.id]);
+    res.json({ message: 'Tenant deleted successfully.' });
+  } catch (error) { res.status(500).json({ error: error.message }); }
+});
 
 // Mount the API Router
 app.use('/api', apiRouter);
@@ -110,7 +1428,300 @@ if (process.env.NODE_ENV === 'production') {
   });
 }
 
+// Auto-provision Super Admin
+const provisionSuperAdmin = async (retries = 10, delay = 10000) => {
+  const email = 'suporte@blyzer.com.br';
+  
+  for (let i = 0; i < retries; i++) {
+    try {
+      // Test connection first
+      const connection = await pool.getConnection();
+      
+      // Auto-create missing tables to prevent issues with outdated Docker configs/volumes
+      await connection.query(`
+        CREATE TABLE IF NOT EXISTS password_resets (
+          email varchar(255) NOT NULL,
+          token varchar(255) NOT NULL,
+          expires_at timestamp NOT NULL,
+          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+          PRIMARY KEY (token),
+          KEY email (email)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+      `);
+      
+      await connection.query(`
+        CREATE TABLE IF NOT EXISTS pending_registrations (
+          email varchar(255) NOT NULL,
+          password_hash varchar(255) NOT NULL,
+          full_name varchar(255) NOT NULL,
+          organization_name varchar(255) NOT NULL,
+          verification_code varchar(10) NOT NULL,
+          expires_at timestamp NOT NULL,
+          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+          PRIMARY KEY (email)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+      `);
+
+      await connection.query(`
+        CREATE TABLE IF NOT EXISTS notifications (
+          id varchar(36) NOT NULL,
+          user_id varchar(36) NOT NULL,
+          type enum('success', 'info', 'warning', 'error') DEFAULT 'info',
+          title varchar(255) NOT NULL,
+          message text NOT NULL,
+          link varchar(255) DEFAULT NULL,
+          is_read boolean DEFAULT false,
+          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+          PRIMARY KEY (id),
+          KEY user_id (user_id),
+          KEY created_at (created_at)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+      `);
+
+      // Add slug column if it doesn't exist
+      try {
+        await connection.query('ALTER TABLE users ADD COLUMN slug VARCHAR(255) UNIQUE DEFAULT NULL');
+      } catch (err) {
+        // Ignore error if column already exists (ER_DUP_FIELDNAME)
+        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (slug):', err.message);
+      }
+
+      // Populate empty slugs
+      try {
+        await connection.query(`UPDATE users SET slug = CONCAT(LOWER(REPLACE(name, ' ', '-')), '-', SUBSTRING(MD5(RAND()), 1, 8)) WHERE slug IS NULL`);
+      } catch (err) {
+        console.log('Schema update note (populate slugs):', err.message);
+      }
+
+      // Add sound_enabled column if it doesn't exist
+      try {
+        await connection.query('ALTER TABLE users ADD COLUMN sound_enabled BOOLEAN DEFAULT true');
+      } catch (err) {
+        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (sound_enabled):', err.message);
+      }
+
+      // Update origin to VARCHAR for custom origins
+      try {
+        await connection.query("ALTER TABLE attendances MODIFY COLUMN origin VARCHAR(255) NOT NULL");
+      } catch (err) {
+        console.log('Schema update note (origin):', err.message);
+      }
+
+      // Convert funnel_stage to VARCHAR for custom funnels
+      try {
+        await connection.query("ALTER TABLE attendances MODIFY COLUMN funnel_stage VARCHAR(255) NOT NULL");
+      } catch (err) {
+        console.log('Schema update note (funnel_stage):', err.message);
+      }
+
+      // Add full_summary column for detailed AI analysis
+      try {
+        await connection.query("ALTER TABLE attendances ADD COLUMN full_summary TEXT DEFAULT NULL");
+      } catch (err) {
+        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (full_summary):', err.message);
+      }
+
+      // Create origin_groups table
+      await connection.query(`
+        CREATE TABLE IF NOT EXISTS origin_groups (
+          id varchar(36) NOT NULL,
+          tenant_id varchar(36) NOT NULL,
+          name varchar(255) NOT NULL,
+          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+          PRIMARY KEY (id),
+          KEY tenant_id (tenant_id)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+      `);
+
+      // Create origin_items table
+      await connection.query(`
+        CREATE TABLE IF NOT EXISTS origin_items (
+          id varchar(36) NOT NULL,
+          origin_group_id varchar(36) NOT NULL,
+          name varchar(255) NOT NULL,
+          color_class varchar(255) DEFAULT 'bg-zinc-100 text-zinc-800 border-zinc-200',
+          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+          PRIMARY KEY (id),
+          KEY origin_group_id (origin_group_id)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+      `);
+
+      // Attempt to add color_class if table already existed without it
+      try {
+        await connection.query("ALTER TABLE origin_items ADD COLUMN color_class VARCHAR(255) DEFAULT 'bg-zinc-100 text-zinc-800 border-zinc-200'");
+      } catch (err) {
+        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (origin_items.color_class):', err.message);
+      }
+
+      // Add origin_group_id to teams
+      try {
+        await connection.query("ALTER TABLE teams ADD COLUMN origin_group_id VARCHAR(36) DEFAULT NULL");
+      } catch (err) {
+        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (teams.origin_group_id):', err.message);
+      }
+
+      // Rename summary to title
+      try {
+        await connection.query("ALTER TABLE attendances RENAME COLUMN summary TO title");
+      } catch (err) {
+        if (err.code !== 'ER_BAD_FIELD_ERROR' && err.code !== 'ER_DUP_FIELDNAME') {
+           // If RENAME COLUMN fails (older mysql), try CHANGE
+           try {
+             await connection.query("ALTER TABLE attendances CHANGE COLUMN summary title TEXT");
+           } catch (e) {
+             console.log('Schema update note (summary to title):', e.message);
+           }
+        }
+      }
+
+      // Create funnels table
+      await connection.query(`
+        CREATE TABLE IF NOT EXISTS funnels (
+          id varchar(36) NOT NULL,
+          tenant_id varchar(36) NOT NULL,
+          name varchar(255) NOT NULL,
+          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+          PRIMARY KEY (id),
+          KEY tenant_id (tenant_id)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+      `);
+
+      // Create funnel_stages table
+      await connection.query(`
+        CREATE TABLE IF NOT EXISTS funnel_stages (
+          id varchar(36) NOT NULL,
+          funnel_id varchar(36) NOT NULL,
+          name varchar(255) NOT NULL,
+          color_class varchar(255) DEFAULT 'bg-zinc-100 text-zinc-800 border-zinc-200',
+          order_index int DEFAULT 0,
+          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+          PRIMARY KEY (id),
+          KEY funnel_id (funnel_id)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+      `);
+
+      // Create api_keys table for external integrations (n8n)
+      await connection.query(`
+        CREATE TABLE IF NOT EXISTS api_keys (
+          id varchar(36) NOT NULL,
+          tenant_id varchar(36) NOT NULL,
+          name varchar(255) NOT NULL,
+          secret_key varchar(255) NOT NULL,
+          secret_hash varchar(64) DEFAULT NULL,
+          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+          last_used_at timestamp NULL DEFAULT NULL,
+          PRIMARY KEY (id),
+          UNIQUE KEY secret_key (secret_key),
+          UNIQUE KEY secret_hash (secret_hash),
+          KEY tenant_id (tenant_id)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+      `);
+
+      try {
+        await connection.query("ALTER TABLE api_keys ADD COLUMN secret_hash VARCHAR(64) DEFAULT NULL");
+      } catch (err) {
+        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (api_keys.secret_hash):', err.message);
+      }
+
+      try {
+        await connection.query("ALTER TABLE api_keys ADD UNIQUE KEY secret_hash (secret_hash)");
+      } catch (err) {
+        if (err.code !== 'ER_DUP_KEYNAME') console.log('Schema update note (api_keys.secret_hash index):', err.message);
+      }
+
+      // Create refresh_tokens table for persistent sessions
+      await connection.query(`
+        CREATE TABLE IF NOT EXISTS refresh_tokens (
+          id varchar(36) NOT NULL,
+          user_id varchar(36) NOT NULL,
+          token varchar(255) NOT NULL,
+          token_hash varchar(64) DEFAULT NULL,
+          expires_at timestamp NOT NULL,
+          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+          PRIMARY KEY (id),
+          UNIQUE KEY token (token),
+          UNIQUE KEY token_hash (token_hash),
+          KEY user_id (user_id)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+      `);
+
+      try {
+        await connection.query("ALTER TABLE refresh_tokens ADD COLUMN token_hash VARCHAR(64) DEFAULT NULL");
+      } catch (err) {
+        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (refresh_tokens.token_hash):', err.message);
+      }
+
+      try {
+        await connection.query("ALTER TABLE refresh_tokens ADD UNIQUE KEY token_hash (token_hash)");
+      } catch (err) {
+        if (err.code !== 'ER_DUP_KEYNAME') console.log('Schema update note (refresh_tokens.token_hash index):', err.message);
+      }
+
+      // Add funnel_id to teams
+      try {
+        await connection.query("ALTER TABLE teams ADD COLUMN funnel_id VARCHAR(36) DEFAULT NULL");
+      } catch (err) {
+        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (teams.funnel_id):', err.message);
+      }
+
+      connection.release();
+      // Ensure system tenant exists
+      await pool.query('INSERT IGNORE INTO tenants (id, name, slug, admin_email, status) VALUES (?, ?, ?, ?, ?)', ['system', 'System Admin', 'system', email, 'active']);
+      
+      const [existing] = await pool.query('SELECT id, password_hash FROM users WHERE email = ?', [email]);
+      if (existing.length === 0 || existing[0].password_hash === 'pending_setup') {
+        console.log('Provisioning default super_admin or resending email...');
+        
+        if (existing.length === 0) {
+          const uid = `u_${crypto.randomUUID().split('-')[0]}`;
+          const placeholderHash = 'pending_setup';
+          const superAdminSlug = 'suporte-blyzer';
+          
+          await pool.query(
+            'INSERT INTO users (id, tenant_id, name, email, password_hash, slug, role, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
+            [uid, 'system', 'Blyzer Suporte', email, placeholderHash, superAdminSlug, 'super_admin', 'active']
+          );
+        }
+
+        const token = crypto.randomBytes(32).toString('hex');
+        // Delete any old unused tokens for this email to prevent buildup
+        await pool.query('DELETE FROM password_resets WHERE email = ?', [email]);
+        
+        await pool.query(
+          'INSERT INTO password_resets (email, token, expires_at) VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 15 MINUTE))',
+          [email, token]
+        );
+
+        const setupLink = `${getStartupBaseUrl()}/#/setup-account?token=${token}`;
+        console.log(`\n\n=== SUPER ADMIN SETUP LINK ===\n${setupLink}\n==============================\n\n`);
+
+        await transporter.sendMail({
+          from: `"Fasto" <${process.env.MAIL_FROM || 'nao-responda@blyzer.com.br'}>`,
+          to: email,
+          subject: 'Conta Super Admin Criada - Fasto',
+          html: `
+            <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e2e8f0; border-radius: 12px; background: #ffffff; color: #0f172a;">
+              <h2 style="color: #0f172a;">Conta Super Admin Gerada</h2>
+              <p style="color: #475569;">Sua conta de suporte (super_admin) foi criada no Fasto.</p>
+              <div style="text-align: center; margin: 30px 0;">
+                <a href="${setupLink}" style="background-color: #0f172a; color: white; padding: 12px 24px; text-decoration: none; border-radius: 8px; font-weight: bold; display: inline-block;">Finalizar Cadastro</a>
+              </div>
+              <p style="font-size: 12px; color: #94a3b8;">Este link expira em 15 minutos.</p>
+            </div>
+          `
+        }).catch(err => console.error("Failed to send super_admin email:", err));
+      }
+      return; // Success, exit the retry loop
+    } catch (error) {
+      console.error(`Failed to provision super_admin (Attempt ${i + 1}/${retries}):`, error.message);
+      if (i < retries - 1) {
+        await new Promise(res => setTimeout(res, delay));
+      }
+    }
+  }
+};
+
 app.listen(PORT, async () => {
-  await provisionSuperAdmin({ pool, transporter, getStartupBaseUrl });
+  await provisionSuperAdmin();
   console.log(`🚀 Servidor Backend rodando em http://localhost:${PORT}`);
 });
diff --git a/backend/middleware/auth.js b/backend/middleware/auth.js
deleted file mode 100644
index a9c1db8..0000000
--- a/backend/middleware/auth.js
+++ /dev/null
@@ -1,56 +0,0 @@
-const jwt = require('jsonwebtoken');
-const pool = require('../db');
-const { jwtSecret } = require('../config/runtime');
-const { hashSecret } = require('../utils/security');
-
-const authenticateToken = async (req, res, next) => {
-  if (req.path.startsWith('/auth/')) return next();
-
-  const authHeader = req.headers['authorization'];
-
-  if (authHeader && authHeader.startsWith('Bearer fasto_sk_')) {
-    const apiKey = authHeader.split(' ')[1];
-    try {
-      const [keys] = await pool.query(
-        'SELECT * FROM api_keys WHERE secret_hash = ? OR secret_key = ?',
-        [hashSecret(apiKey), apiKey]
-      );
-      if (keys.length === 0) return res.status(401).json({ error: 'Chave de API inválida.' });
-
-      await pool.query('UPDATE api_keys SET last_used_at = CURRENT_TIMESTAMP WHERE id = ?', [keys[0].id]);
-
-      req.user = {
-        id: 'bot_integration',
-        tenant_id: keys[0].tenant_id,
-        role: 'admin',
-        is_api_key: true
-      };
-      return next();
-    } catch (error) {
-      console.error('API Key validation error:', error);
-      return res.status(500).json({ error: 'Erro ao validar chave de API.' });
-    }
-  }
-
-  const token = authHeader && authHeader.split(' ')[1];
-
-  if (!token) return res.status(401).json({ error: 'Token não fornecido.' });
-
-  try {
-    req.user = jwt.verify(token, jwtSecret);
-    next();
-  } catch (err) {
-    return res.status(401).json({ error: 'Token inválido ou expirado.' });
-  }
-};
-
-const requireRole = (roles) => (req, res, next) => {
-  if (!req.user || !req.user.role) return res.status(401).json({ error: 'Não autenticado.' });
-  if (!roles.includes(req.user.role)) return res.status(403).json({ error: 'Acesso negado. Você não tem permissão para realizar esta ação.' });
-  next();
-};
-
-module.exports = {
-  authenticateToken,
-  requireRole,
-};
diff --git a/backend/policies/accessPolicy.js b/backend/policies/accessPolicy.js
index 494f00a..2f2e948 100644
--- a/backend/policies/accessPolicy.js
+++ b/backend/policies/accessPolicy.js
@@ -23,7 +23,6 @@ const canUpdateUser = (actor, targetUser) => {
 const canManageUserStatus = (actor) => actor.role === 'super_admin' || actor.role === 'admin';
 const canChangeUserEmail = (actor, targetUser) => actor.id === targetUser.id || actor.role === 'super_admin' || actor.role === 'admin';
 const canManageUserRoleOrTeam = (actor) => actor.role === 'super_admin' || actor.role === 'admin';
-const canManageUserPassword = (actor) => actor.role === 'super_admin' || actor.role === 'admin';
 
 const canReadAttendance = (actor, attendance) => {
   if (!actor || !attendance || !sameTenant(actor, attendance)) return false;
@@ -39,6 +38,5 @@ module.exports = {
   canManageUserStatus,
   canChangeUserEmail,
   canManageUserRoleOrTeam,
-  canManageUserPassword,
   canReadAttendance,
 };
diff --git a/backend/routes/activityRoutes.js b/backend/routes/activityRoutes.js
deleted file mode 100644
index 4898041..0000000
--- a/backend/routes/activityRoutes.js
+++ /dev/null
@@ -1,30 +0,0 @@
-const express = require('express');
-
-const createActivityRouter = ({ pool }) => {
-  const router = express.Router();
-
-  const listActivity = async (req, res) => {
-    try {
-      const [rows] = await pool.query(
-        `SELECT id, type, title, message, link, created_at
-         FROM notifications
-         WHERE user_id = ?
-         ORDER BY created_at DESC
-         LIMIT 50`,
-        [req.user.id]
-      );
-      res.json(rows);
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  };
-
-  router.get('/activity', listActivity);
-  router.get('/notifications', listActivity);
-
-  return router;
-};
-
-module.exports = {
-  createActivityRouter,
-};
diff --git a/backend/routes/apiKeysRoutes.js b/backend/routes/apiKeysRoutes.js
deleted file mode 100644
index c430a18..0000000
--- a/backend/routes/apiKeysRoutes.js
+++ /dev/null
@@ -1,61 +0,0 @@
-const express = require('express');
-const crypto = require('crypto');
-const { requireRole } = require('../middleware/auth');
-const { hashSecret, maskSecret } = require('../utils/security');
-
-const createApiKeysRouter = ({ pool }) => {
-  const router = express.Router();
-
-  router.get('/api-keys', requireRole(['admin', 'super_admin']), async (req, res) => {
-    try {
-      const { tenantId } = req.query;
-      const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
-      if (!effectiveTenantId || effectiveTenantId === 'all') return res.json([]);
-
-      const [rows] = await pool.query(
-        'SELECT id, name, created_at, last_used_at, CASE WHEN secret_key LIKE "masked:%" THEN CONCAT("fasto_sk_", RIGHT(secret_key, 6), "...") ELSE CONCAT(SUBSTRING(secret_key, 1, 14), "...") END as masked_key FROM api_keys WHERE tenant_id = ?',
-        [effectiveTenantId]
-      );
-      res.json(rows);
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/api-keys', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, tenantId } = req.body;
-    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
-    try {
-      const id = `apk_${crypto.randomUUID().split('-')[0]}`;
-      const secretKey = `fasto_sk_${crypto.randomBytes(32).toString('hex')}`;
-
-      await pool.query(
-        'INSERT INTO api_keys (id, tenant_id, name, secret_key, secret_hash) VALUES (?, ?, ?, ?, ?)',
-        [id, effectiveTenantId, name || 'Nova Integração API', maskSecret(id, secretKey), hashSecret(secretKey)]
-      );
-
-      res.status(201).json({ id, secret_key: secretKey, message: 'Chave criada. Salve-a agora, ela não será exibida novamente.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.delete('/api-keys/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    try {
-      const [existing] = await pool.query('SELECT tenant_id FROM api_keys WHERE id = ?', [req.params.id]);
-      if (existing.length === 0) return res.status(404).json({ error: 'Chave não encontrada' });
-      if (req.user.role !== 'super_admin' && existing[0].tenant_id !== req.user.tenant_id) return res.status(403).json({ error: 'Acesso negado' });
-
-      await pool.query('DELETE FROM api_keys WHERE id = ?', [req.params.id]);
-      res.json({ message: 'Chave de API revogada com sucesso.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  return router;
-};
-
-module.exports = {
-  createApiKeysRouter,
-};
diff --git a/backend/routes/attendancesRoutes.js b/backend/routes/attendancesRoutes.js
deleted file mode 100644
index 38f5b73..0000000
--- a/backend/routes/attendancesRoutes.js
+++ /dev/null
@@ -1,88 +0,0 @@
-const express = require('express');
-const { canReadAttendance } = require('../policies/accessPolicy');
-
-const parseAttendance = (attendance) => ({
-  ...attendance,
-  attention_points: typeof attendance.attention_points === 'string' ? JSON.parse(attendance.attention_points) : attendance.attention_points,
-  improvement_points: typeof attendance.improvement_points === 'string' ? JSON.parse(attendance.improvement_points) : attendance.improvement_points,
-  converted: Boolean(attendance.converted),
-});
-
-const createAttendancesRouter = ({ pool }) => {
-  const router = express.Router();
-
-  router.get('/attendances', async (req, res) => {
-    try {
-      const { tenantId, userId, teamId, startDate, endDate, funnelStage, origin } = req.query;
-      const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
-
-      let q = 'SELECT a.*, u.team_id FROM attendances a JOIN users u ON a.user_id = u.id WHERE a.tenant_id = ?';
-      const params = [effectiveTenantId];
-
-      if (startDate && endDate) {
-        q += ' AND a.created_at BETWEEN ? AND ?';
-        params.push(new Date(startDate), new Date(endDate));
-      }
-
-      if (req.user.role === 'agent') {
-        q += ' AND a.user_id = ?';
-        params.push(req.user.id);
-      } else {
-        if (req.user.role === 'manager') {
-          q += ' AND u.team_id = ?';
-          params.push(req.user.team_id);
-        } else if (teamId && teamId !== 'all') {
-          q += ' AND u.team_id = ?';
-          params.push(teamId);
-        }
-
-        if (userId && userId !== 'all') {
-          if (userId.startsWith('u_') || userId.length === 36) {
-            q += ' AND a.user_id = ?';
-            params.push(userId);
-          } else {
-            q += ' AND u.slug = ?';
-            params.push(userId);
-          }
-        }
-      }
-
-      if (funnelStage && funnelStage !== 'all') {
-        q += ' AND a.funnel_stage = ?';
-        params.push(funnelStage);
-      }
-      if (origin && origin !== 'all') {
-        q += ' AND a.origin = ?';
-        params.push(origin);
-      }
-
-      q += ' ORDER BY a.created_at DESC';
-      const [rows] = await pool.query(q, params);
-      res.json(rows.map(parseAttendance));
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.get('/attendances/:id', async (req, res) => {
-    try {
-      const [rows] = await pool.query(
-        'SELECT a.*, u.team_id FROM attendances a JOIN users u ON a.user_id = u.id WHERE a.id = ?',
-        [req.params.id]
-      );
-      if (rows.length === 0) return res.status(404).json({ error: 'Not found' });
-
-      if (!canReadAttendance(req.user, rows[0])) return res.status(403).json({ error: 'Acesso negado.' });
-
-      res.json(parseAttendance(rows[0]));
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  return router;
-};
-
-module.exports = {
-  createAttendancesRouter,
-};
diff --git a/backend/routes/authRoutes.js b/backend/routes/authRoutes.js
deleted file mode 100644
index 3469958..0000000
--- a/backend/routes/authRoutes.js
+++ /dev/null
@@ -1,269 +0,0 @@
-const express = require('express');
-const bcrypt = require('bcryptjs');
-const jwt = require('jsonwebtoken');
-const crypto = require('crypto');
-const { hashSecret, maskSecret } = require('../utils/security');
-const { requireRole } = require('../middleware/auth');
-const { recordActivity } = require('../services/activityService');
-
-const createAuthRouter = ({ pool, transporter, getBaseUrl, jwtSecret }) => {
-  const router = express.Router();
-
-  router.post('/auth/register', async (req, res) => {
-    const { name, email, password, organizationName } = req.body;
-    try {
-      const [existing] = await pool.query('SELECT id FROM users WHERE email = ?', [email]);
-      if (existing.length > 0) return res.status(400).json({ error: 'E-mail já cadastrado.' });
-
-      const passwordHash = await bcrypt.hash(password, 10);
-      const verificationCode = Math.floor(100000 + Math.random() * 900000).toString();
-      const expiresAt = new Date(Date.now() + 15 * 60 * 1000);
-
-      await pool.query(
-        'INSERT INTO pending_registrations (email, password_hash, full_name, organization_name, verification_code, expires_at) VALUES (?, ?, ?, ?, ?, ?)',
-        [email, passwordHash, name, organizationName, verificationCode, expiresAt]
-      );
-
-      await transporter.sendMail({
-        from: `"Fasto" <${process.env.MAIL_FROM || 'nao-responda@blyzer.com.br'}>`,
-        to: email,
-        subject: 'Seu código de verificação Fasto',
-        text: `Olá ${name}, seu código de verificação é: ${verificationCode}`,
-        html: `
-          <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e2e8f0; border-radius: 12px;">
-            <h2 style="color: #0f172a;">Bem-vindo ao Fasto!</h2>
-            <p style="color: #475569;">Seu código: <strong>${verificationCode}</strong></p>
-          </div>`
-      });
-      res.json({ message: 'Código enviado.' });
-    } catch (error) {
-      console.error('Register error:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/auth/verify', async (req, res) => {
-    const { email, code } = req.body;
-    const connection = await pool.getConnection();
-    try {
-      await connection.beginTransaction();
-      const [pending] = await connection.query(
-        'SELECT * FROM pending_registrations WHERE email = ? AND verification_code = ? AND expires_at > NOW() ORDER BY created_at DESC LIMIT 1',
-        [email, code]
-      );
-      if (pending.length === 0) return res.status(400).json({ error: 'Código inválido.' });
-
-      const data = pending[0];
-      const tenantId = `tenant_${crypto.randomUUID().split('-')[0]}`;
-      const userId = `u_${crypto.randomUUID().split('-')[0]}`;
-
-      await connection.query('INSERT INTO tenants (id, name, slug, admin_email) VALUES (?, ?, ?, ?)',
-        [tenantId, data.organization_name, data.organization_name.toLowerCase().replace(/ /g, '-'), email]);
-      await connection.query('INSERT INTO users (id, tenant_id, name, email, password_hash, role) VALUES (?, ?, ?, ?, ?, ?)',
-        [userId, tenantId, data.full_name, email, data.password_hash, 'admin']);
-      await connection.query('DELETE FROM pending_registrations WHERE email = ?', [email]);
-
-      await connection.commit();
-      res.json({ message: 'Sucesso.' });
-    } catch (error) {
-      await connection.rollback();
-      res.status(500).json({ error: error.message });
-    } finally {
-      connection.release();
-    }
-  });
-
-  router.post('/auth/login', async (req, res) => {
-    const { email, password } = req.body;
-    try {
-      const [users] = await pool.query('SELECT * FROM users WHERE email = ?', [email]);
-      if (users.length === 0) return res.status(401).json({ error: 'Credenciais inválidas.' });
-
-      const user = users[0];
-      if (user.status !== 'active') {
-        return res.status(403).json({ error: 'Sua conta está inativa. Contate o administrador.' });
-      }
-
-      const valid = await bcrypt.compare(password, user.password_hash);
-      if (!valid) return res.status(401).json({ error: 'Credenciais inválidas.' });
-
-      const token = jwt.sign({ id: user.id, tenant_id: user.tenant_id, role: user.role, team_id: user.team_id, slug: user.slug }, jwtSecret, { expiresIn: '15m' });
-      const refreshToken = crypto.randomBytes(40).toString('hex');
-      const refreshId = `rt_${crypto.randomUUID().split('-')[0]}`;
-
-      await pool.query(
-        'INSERT INTO refresh_tokens (id, user_id, token, token_hash, expires_at) VALUES (?, ?, ?, ?, DATE_ADD(NOW(), INTERVAL 30 DAY))',
-        [refreshId, user.id, maskSecret(refreshId, refreshToken), hashSecret(refreshToken)]
-      );
-
-      res.json({
-        token,
-        refreshToken,
-        user: { id: user.id, name: user.name, email: user.email, role: user.role, tenant_id: user.tenant_id, team_id: user.team_id, slug: user.slug }
-      });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/auth/refresh', async (req, res) => {
-    const { refreshToken } = req.body;
-    if (!refreshToken) return res.status(400).json({ error: 'Refresh token não fornecido.' });
-
-    try {
-      const [tokens] = await pool.query(
-        'SELECT r.user_id, u.tenant_id, u.role, u.team_id, u.slug, u.status FROM refresh_tokens r JOIN users u ON r.user_id = u.id WHERE (r.token_hash = ? OR r.token = ?) AND r.expires_at > NOW()',
-        [hashSecret(refreshToken), refreshToken]
-      );
-
-      if (tokens.length === 0) {
-        await pool.query('DELETE FROM refresh_tokens WHERE token_hash = ? OR token = ?', [hashSecret(refreshToken), refreshToken]);
-        return res.status(401).json({ error: 'Sessão expirada. Faça login novamente.' });
-      }
-
-      const user = tokens[0];
-
-      if (user.status !== 'active') {
-        await pool.query('DELETE FROM refresh_tokens WHERE token_hash = ? OR token = ?', [hashSecret(refreshToken), refreshToken]);
-        return res.status(403).json({ error: 'Sua conta está inativa.' });
-      }
-
-      await pool.query('UPDATE refresh_tokens SET expires_at = DATE_ADD(NOW(), INTERVAL 30 DAY) WHERE token_hash = ? OR token = ?', [hashSecret(refreshToken), refreshToken]);
-
-      const newAccessToken = jwt.sign(
-        { id: user.user_id, tenant_id: user.tenant_id, role: user.role, team_id: user.team_id, slug: user.slug },
-        jwtSecret,
-        { expiresIn: '15m' }
-      );
-
-      res.json({ token: newAccessToken });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/auth/logout', async (req, res) => {
-    const { refreshToken } = req.body;
-    try {
-      if (refreshToken) {
-        await pool.query('DELETE FROM refresh_tokens WHERE token_hash = ? OR token = ?', [hashSecret(refreshToken), refreshToken]);
-      }
-      res.json({ message: 'Logout bem-sucedido.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/impersonate/:tenantId', requireRole(['super_admin']), async (req, res) => {
-    try {
-      const [users] = await pool.query("SELECT * FROM users WHERE tenant_id = ? AND role = 'admin' LIMIT 1", [req.params.tenantId]);
-
-      if (users.length === 0) {
-        return res.status(404).json({ error: 'Nenhum administrador encontrado nesta organização para assumir a identidade.' });
-      }
-
-      const user = users[0];
-
-      if (user.status !== 'active') {
-        return res.status(403).json({ error: 'A conta do admin desta organização está inativa.' });
-      }
-
-      const token = jwt.sign({ id: user.id, tenant_id: user.tenant_id, role: user.role, team_id: user.team_id, slug: user.slug }, jwtSecret, { expiresIn: '2h' });
-      res.json({ token, user: { id: user.id, name: user.name, email: user.email, role: user.role, tenant_id: user.tenant_id, team_id: user.team_id, slug: user.slug } });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/auth/forgot-password', async (req, res) => {
-    const { email } = req.body;
-    try {
-      const [users] = await pool.query('SELECT name FROM users WHERE email = ?', [email]);
-      if (users.length > 0) {
-        const token = crypto.randomBytes(32).toString('hex');
-        await pool.query('INSERT INTO password_resets (email, token, expires_at) VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 15 MINUTE))', [email, token]);
-        const link = `${getBaseUrl(req)}/#/reset-password?token=${token}`;
-
-        await transporter.sendMail({
-          from: `"Fasto" <${process.env.MAIL_FROM || 'nao-responda@blyzer.com.br'}>`,
-          to: email,
-          subject: 'Recuperação de Senha - Fasto',
-          html: `
-            <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e2e8f0; border-radius: 12px;">
-              <h2 style="color: #0f172a;">Olá, ${users[0].name}!</h2>
-              <p style="color: #475569;">Você solicitou a recuperação de senha da sua conta no Fasto.</p>
-              <p style="color: #475569;">Clique no botão abaixo para criar uma nova senha:</p>
-              <div style="text-align: center; margin: 30px 0;">
-                <a href="${link}" style="background-color: #0f172a; color: white; padding: 12px 24px; text-decoration: none; border-radius: 8px; font-weight: bold; display: inline-block;">Redefinir Minha Senha</a>
-              </div>
-              <p style="font-size: 12px; color: #94a3b8;">Este link expira em 15 minutos. Se você não solicitou isso, pode ignorar este e-mail.</p>
-              <div style="border-top: 1px solid #f1f5f9; margin-top: 20px; padding-top: 20px; text-align: center;">
-                <p style="font-size: 12px; color: #94a3b8;">Desenvolvido por <a href="https://blyzer.com.br" style="color: #3b82f6; text-decoration: none;">Blyzer</a></p>
-              </div>
-            </div>
-          `
-        });
-      }
-      res.json({ message: 'Se o e-mail existir, enviamos as instruções.' });
-    } catch (error) {
-      console.error('Forgot password error:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/auth/reset-password', async (req, res) => {
-    const { token, password, name } = req.body;
-    try {
-      const [resets] = await pool.query('SELECT email FROM password_resets WHERE token = ? AND expires_at > NOW()', [token]);
-      if (resets.length === 0) return res.status(400).json({ error: 'Token inválido ou expirado.' });
-
-      const hash = await bcrypt.hash(password, 10);
-
-      if (name) {
-        await pool.query('UPDATE users SET password_hash = ?, name = ? WHERE email = ?', [hash, name, resets[0].email]);
-
-        const [u] = await pool.query('SELECT id, name, tenant_id, role, team_id FROM users WHERE email = ?', [resets[0].email]);
-        if (u.length > 0) {
-          const user = u[0];
-          const [notifiable] = await pool.query(
-            "SELECT id FROM users WHERE tenant_id = ? AND role IN ('admin', 'manager', 'super_admin') AND id != ?",
-            [user.tenant_id, user.id]
-          );
-          for (const n of notifiable) {
-            await recordActivity(pool, {
-              userId: n.id,
-              type: 'info',
-              title: 'Novo Membro Ativo',
-              message: `${name} concluiu o cadastro e já pode acessar o sistema.`,
-              link: `/users/${user.id}`,
-            });
-          }
-
-          if (user.role === 'admin') {
-            const [superAdmins] = await pool.query("SELECT id FROM users WHERE role = 'super_admin'");
-            for (const sa of superAdmins) {
-              await recordActivity(pool, {
-                userId: sa.id,
-                type: 'success',
-                title: 'Admin Ativo',
-                message: `O admin ${name} da organização configurou sua conta.`,
-                link: '/super-admin',
-              });
-            }
-          }
-        }
-      } else {
-        await pool.query('UPDATE users SET password_hash = ? WHERE email = ?', [hash, resets[0].email]);
-      }
-
-      await pool.query('DELETE FROM password_resets WHERE email = ?', [resets[0].email]);
-      res.json({ message: 'Senha e perfil atualizados com sucesso.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  return router;
-};
-
-module.exports = { createAuthRouter };
diff --git a/backend/routes/funnelsRoutes.js b/backend/routes/funnelsRoutes.js
deleted file mode 100644
index 8bc1587..0000000
--- a/backend/routes/funnelsRoutes.js
+++ /dev/null
@@ -1,141 +0,0 @@
-const express = require('express');
-const crypto = require('crypto');
-const { requireRole } = require('../middleware/auth');
-
-const createFunnelsRouter = ({ pool }) => {
-  const router = express.Router();
-
-  router.get('/funnels', async (req, res) => {
-    try {
-      const { tenantId } = req.query;
-      const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
-      if (!effectiveTenantId || effectiveTenantId === 'all') return res.json([]);
-
-      const [funnels] = await pool.query('SELECT * FROM funnels WHERE tenant_id = ? ORDER BY created_at ASC', [effectiveTenantId]);
-
-      if (funnels.length === 0) {
-        const fid = `funnel_${crypto.randomUUID().split('-')[0]}`;
-        await pool.query('INSERT INTO funnels (id, tenant_id, name) VALUES (?, ?, ?)', [fid, effectiveTenantId, 'Funil Padrão']);
-
-        const defaultStages = [
-          { name: 'Sem atendimento', color: 'bg-zinc-100 text-zinc-700 border-zinc-200 dark:bg-dark-input dark:text-dark-muted dark:border-dark-border', order: 0 },
-          { name: 'Identificação', color: 'bg-blue-100 text-blue-700 border-blue-200 dark:bg-blue-900/30 dark:text-blue-400 dark:border-blue-800', order: 1 },
-          { name: 'Negociação', color: 'bg-purple-100 text-purple-700 border-purple-200 dark:bg-purple-900/30 dark:text-purple-400 dark:border-purple-800', order: 2 },
-          { name: 'Ganhos', color: 'bg-green-100 text-green-700 border-green-200 dark:bg-green-900/30 dark:text-green-400 dark:border-green-800', order: 3 },
-          { name: 'Perdidos', color: 'bg-red-100 text-red-700 border-red-200 dark:bg-red-900/30 dark:text-red-400 dark:border-red-800', order: 4 }
-        ];
-
-        for (const s of defaultStages) {
-          const sid = `stage_${crypto.randomUUID().split('-')[0]}`;
-          await pool.query(
-            'INSERT INTO funnel_stages (id, funnel_id, name, color_class, order_index) VALUES (?, ?, ?, ?, ?)',
-            [sid, fid, s.name, s.color, s.order]
-          );
-        }
-
-        await pool.query('UPDATE teams SET funnel_id = ? WHERE tenant_id = ? AND funnel_id IS NULL', [fid, effectiveTenantId]);
-        funnels.push({ id: fid, tenant_id: effectiveTenantId, name: 'Funil Padrão' });
-      }
-
-      const [stages] = await pool.query('SELECT * FROM funnel_stages WHERE funnel_id IN (?) ORDER BY order_index ASC', [funnels.map(f => f.id)]);
-      const [teams] = await pool.query('SELECT id, funnel_id FROM teams WHERE tenant_id = ? AND funnel_id IS NOT NULL', [effectiveTenantId]);
-
-      const result = funnels.map(f => ({
-        ...f,
-        stages: stages.filter(s => s.funnel_id === f.id),
-        teamIds: teams.filter(t => t.funnel_id === f.id).map(t => t.id)
-      }));
-
-      res.json(result);
-    } catch (error) {
-      console.error("GET /funnels error:", error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/funnels', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, tenantId } = req.body;
-    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
-    try {
-      const fid = `funnel_${crypto.randomUUID().split('-')[0]}`;
-      await pool.query('INSERT INTO funnels (id, tenant_id, name) VALUES (?, ?, ?)', [fid, effectiveTenantId, name]);
-      res.status(201).json({ id: fid });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.put('/funnels/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, teamIds } = req.body;
-    try {
-      if (name) {
-        await pool.query('UPDATE funnels SET name = ? WHERE id = ?', [name, req.params.id]);
-      }
-      if (teamIds && Array.isArray(teamIds)) {
-        await pool.query('UPDATE teams SET funnel_id = NULL WHERE funnel_id = ?', [req.params.id]);
-        if (teamIds.length > 0) {
-          await pool.query('UPDATE teams SET funnel_id = ? WHERE id IN (?)', [req.params.id, teamIds]);
-        }
-      }
-      res.json({ message: 'Funnel updated.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.delete('/funnels/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    try {
-      await pool.query('DELETE FROM funnel_stages WHERE funnel_id = ?', [req.params.id]);
-      await pool.query('UPDATE teams SET funnel_id = NULL WHERE funnel_id = ?', [req.params.id]);
-      await pool.query('DELETE FROM funnels WHERE id = ?', [req.params.id]);
-      res.json({ message: 'Funnel deleted.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/funnels/:id/stages', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, color_class, order_index } = req.body;
-    try {
-      const sid = `stage_${crypto.randomUUID().split('-')[0]}`;
-      await pool.query(
-        'INSERT INTO funnel_stages (id, funnel_id, name, color_class, order_index) VALUES (?, ?, ?, ?, ?)',
-        [sid, req.params.id, name, color_class, order_index || 0]
-      );
-      res.status(201).json({ id: sid });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.put('/funnel_stages/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, color_class, order_index } = req.body;
-    try {
-      const [existing] = await pool.query('SELECT * FROM funnel_stages WHERE id = ?', [req.params.id]);
-      if (existing.length === 0) return res.status(404).json({ error: 'Stage not found' });
-
-      await pool.query(
-        'UPDATE funnel_stages SET name = ?, color_class = ?, order_index = ? WHERE id = ?',
-        [name || existing[0].name, color_class || existing[0].color_class, order_index !== undefined ? order_index : existing[0].order_index, req.params.id]
-      );
-      res.json({ message: 'Stage updated.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.delete('/funnel_stages/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    try {
-      await pool.query('DELETE FROM funnel_stages WHERE id = ?', [req.params.id]);
-      res.json({ message: 'Stage deleted.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  return router;
-};
-
-module.exports = {
-  createFunnelsRouter,
-};
diff --git a/backend/routes/integrationsRoutes.js b/backend/routes/integrationsRoutes.js
deleted file mode 100644
index 7269f89..0000000
--- a/backend/routes/integrationsRoutes.js
+++ /dev/null
@@ -1,155 +0,0 @@
-const express = require('express');
-const crypto = require('crypto');
-const { requireRole } = require('../middleware/auth');
-const { recordActivity } = require('../services/activityService');
-
-const requireApiKey = (req, res) => {
-  if (req.user.is_api_key) return true;
-  res.status(403).json({ error: 'Endpoint restrito a chaves de API.' });
-  return false;
-};
-
-const createIntegrationsRouter = ({ pool }) => {
-  const router = express.Router();
-
-  router.get('/integration/users', requireRole(['admin']), async (req, res) => {
-    if (!requireApiKey(req, res)) return;
-    try {
-      const [rows] = await pool.query(
-        'SELECT u.id, u.name, u.email, t.name as team_name FROM users u LEFT JOIN teams t ON u.team_id = t.id WHERE u.tenant_id = ? AND u.status = "active"',
-        [req.user.tenant_id]
-      );
-      res.json(rows);
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.get('/integration/origins', requireRole(['admin']), async (req, res) => {
-    if (!requireApiKey(req, res)) return;
-    try {
-      const [groups] = await pool.query('SELECT id, name FROM origin_groups WHERE tenant_id = ?', [req.user.tenant_id]);
-      if (groups.length === 0) return res.json([]);
-
-      const [items] = await pool.query('SELECT origin_group_id, name FROM origin_items WHERE origin_group_id IN (?) ORDER BY created_at ASC', [groups.map(g => g.id)]);
-      const [teams] = await pool.query('SELECT id as team_id, name as team_name, origin_group_id FROM teams WHERE tenant_id = ? AND origin_group_id IS NOT NULL', [req.user.tenant_id]);
-
-      const result = groups.map(g => ({
-        group_name: g.name,
-        origins: items.filter(i => i.origin_group_id === g.id).map(i => i.name),
-        assigned_teams: teams.filter(t => t.origin_group_id === g.id).map(t => ({ id: t.team_id, name: t.team_name }))
-      }));
-
-      res.json(result);
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.get('/integration/funnels', requireRole(['admin']), async (req, res) => {
-    if (!requireApiKey(req, res)) return;
-    try {
-      const [funnels] = await pool.query('SELECT id, name FROM funnels WHERE tenant_id = ?', [req.user.tenant_id]);
-      if (funnels.length === 0) return res.json([]);
-
-      const [stages] = await pool.query('SELECT funnel_id, name, order_index FROM funnel_stages WHERE funnel_id IN (?) ORDER BY order_index ASC', [funnels.map(f => f.id)]);
-      const [teams] = await pool.query('SELECT id as team_id, name as team_name, funnel_id FROM teams WHERE tenant_id = ? AND funnel_id IS NOT NULL', [req.user.tenant_id]);
-
-      const result = funnels.map(f => ({
-        funnel_name: f.name,
-        stages: stages.filter(s => s.funnel_id === f.id).map(s => s.name),
-        assigned_teams: teams.filter(t => t.funnel_id === f.id).map(t => ({ id: t.team_id, name: t.team_name }))
-      }));
-
-      res.json(result);
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/integration/attendances', requireRole(['admin']), async (req, res) => {
-    if (!requireApiKey(req, res)) return;
-
-    const {
-      user_id,
-      origin,
-      funnel_stage,
-      title,
-      full_summary,
-      score,
-      first_response_time_min,
-      handling_time_min,
-      product_requested,
-      product_sold,
-      converted,
-      attention_points,
-      improvement_points
-    } = req.body;
-
-    if (!user_id || !origin || !funnel_stage || !title) {
-      return res.status(400).json({ error: 'Campos obrigatórios ausentes: user_id, origin, funnel_stage, title' });
-    }
-
-    try {
-      const [users] = await pool.query('SELECT id FROM users WHERE id = ? AND tenant_id = ? AND status = "active"', [user_id, req.user.tenant_id]);
-      if (users.length === 0) return res.status(400).json({ error: 'user_id inválido, inativo ou não pertence a esta organização.' });
-
-      const attId = `att_${crypto.randomUUID().split('-')[0]}`;
-      await pool.query(
-        `INSERT INTO attendances (
-          id, tenant_id, user_id, title, full_summary, score,
-          first_response_time_min, handling_time_min,
-          funnel_stage, origin, product_requested, product_sold,
-          converted, attention_points, improvement_points
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [
-          attId,
-          req.user.tenant_id,
-          user_id,
-          title,
-          full_summary || null,
-          score || 0,
-          first_response_time_min || 0,
-          handling_time_min || 0,
-          funnel_stage,
-          origin,
-          product_requested || null,
-          product_sold || null,
-          converted ? 1 : 0,
-          attention_points ? JSON.stringify(attention_points) : null,
-          improvement_points ? JSON.stringify(improvement_points) : null
-        ]
-      );
-
-      if (converted) {
-        const [managers] = await pool.query(
-          "SELECT id FROM users WHERE tenant_id = ? AND role IN ('admin', 'manager') AND id != ?",
-          [req.user.tenant_id, user_id]
-        );
-        const [agentInfo] = await pool.query("SELECT name FROM users WHERE id = ?", [user_id]);
-        const agentName = agentInfo[0]?.name || 'Um agente';
-
-        for (const m of managers) {
-          await recordActivity(pool, {
-            userId: m.id,
-            type: 'success',
-            title: 'Venda Fechada!',
-            message: `${agentName} converteu um lead em ${funnel_stage}.`,
-            link: `/attendances/${attId}`,
-          });
-        }
-      }
-
-      res.status(201).json({ id: attId, message: 'Atendimento registrado com sucesso.' });
-    } catch (error) {
-      console.error('Integration Error:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  return router;
-};
-
-module.exports = {
-  createIntegrationsRouter,
-};
diff --git a/backend/routes/originsRoutes.js b/backend/routes/originsRoutes.js
deleted file mode 100644
index c20e1f1..0000000
--- a/backend/routes/originsRoutes.js
+++ /dev/null
@@ -1,138 +0,0 @@
-const express = require('express');
-const crypto = require('crypto');
-const { requireRole } = require('../middleware/auth');
-
-const createOriginsRouter = ({ pool }) => {
-  const router = express.Router();
-
-  router.get('/origins', async (req, res) => {
-    try {
-      const { tenantId } = req.query;
-      const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
-      if (!effectiveTenantId || effectiveTenantId === 'all') return res.json([]);
-
-      const [groups] = await pool.query('SELECT * FROM origin_groups WHERE tenant_id = ? ORDER BY created_at ASC', [effectiveTenantId]);
-
-      if (groups.length === 0) {
-        const gid = `origrp_${crypto.randomUUID().split('-')[0]}`;
-        await pool.query('INSERT INTO origin_groups (id, tenant_id, name) VALUES (?, ?, ?)', [gid, effectiveTenantId, 'Origens Padrão']);
-
-        const defaultOrigins = [
-          { name: 'WhatsApp', color: 'bg-green-100 text-green-700 border-green-200 dark:bg-green-900/30 dark:text-green-400 dark:border-green-800' },
-          { name: 'Instagram', color: 'bg-pink-100 text-pink-700 border-pink-200 dark:bg-pink-900/30 dark:text-pink-400 dark:border-pink-800' },
-          { name: 'Website', color: 'bg-red-100 text-red-700 border-red-200 dark:bg-red-900/30 dark:text-red-400 dark:border-red-800' },
-          { name: 'LinkedIn', color: 'bg-blue-100 text-blue-700 border-blue-200 dark:bg-blue-900/30 dark:text-blue-400 dark:border-blue-800' },
-          { name: 'Indicação', color: 'bg-orange-100 text-orange-700 border-orange-200 dark:bg-orange-900/30 dark:text-orange-400 dark:border-orange-800' }
-        ];
-
-        for (const origin of defaultOrigins) {
-          const oid = `oriitm_${crypto.randomUUID().split('-')[0]}`;
-          await pool.query(
-            'INSERT INTO origin_items (id, origin_group_id, name, color_class) VALUES (?, ?, ?, ?)',
-            [oid, gid, origin.name, origin.color]
-          );
-        }
-
-        await pool.query('UPDATE teams SET origin_group_id = ? WHERE tenant_id = ? AND origin_group_id IS NULL', [gid, effectiveTenantId]);
-        groups.push({ id: gid, tenant_id: effectiveTenantId, name: 'Origens Padrão' });
-      }
-
-      const [items] = await pool.query('SELECT * FROM origin_items WHERE origin_group_id IN (?) ORDER BY created_at ASC', [groups.map(g => g.id)]);
-      const [teams] = await pool.query('SELECT id, origin_group_id FROM teams WHERE tenant_id = ? AND origin_group_id IS NOT NULL', [effectiveTenantId]);
-
-      const result = groups.map(g => ({
-        ...g,
-        items: items.filter(i => i.origin_group_id === g.id),
-        teamIds: teams.filter(t => t.origin_group_id === g.id).map(t => t.id)
-      }));
-
-      res.json(result);
-    } catch (error) {
-      console.error("GET /origins error:", error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/origins', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, tenantId } = req.body;
-    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
-    try {
-      const gid = `origrp_${crypto.randomUUID().split('-')[0]}`;
-      await pool.query('INSERT INTO origin_groups (id, tenant_id, name) VALUES (?, ?, ?)', [gid, effectiveTenantId, name]);
-      res.status(201).json({ id: gid });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.put('/origins/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, teamIds } = req.body;
-    try {
-      if (name) {
-        await pool.query('UPDATE origin_groups SET name = ? WHERE id = ?', [name, req.params.id]);
-      }
-      if (teamIds && Array.isArray(teamIds)) {
-        await pool.query('UPDATE teams SET origin_group_id = NULL WHERE origin_group_id = ?', [req.params.id]);
-        if (teamIds.length > 0) {
-          await pool.query('UPDATE teams SET origin_group_id = ? WHERE id IN (?)', [req.params.id, teamIds]);
-        }
-      }
-      res.json({ message: 'Origin group updated.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.delete('/origins/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    try {
-      await pool.query('DELETE FROM origin_items WHERE origin_group_id = ?', [req.params.id]);
-      await pool.query('UPDATE teams SET origin_group_id = NULL WHERE origin_group_id = ?', [req.params.id]);
-      await pool.query('DELETE FROM origin_groups WHERE id = ?', [req.params.id]);
-      res.json({ message: 'Origin group deleted.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/origins/:id/items', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, color_class } = req.body;
-    try {
-      const oid = `oriitm_${crypto.randomUUID().split('-')[0]}`;
-      await pool.query(
-        'INSERT INTO origin_items (id, origin_group_id, name, color_class) VALUES (?, ?, ?, ?)',
-        [oid, req.params.id, name, color_class || 'bg-zinc-100 text-zinc-800 border-zinc-200']
-      );
-      res.status(201).json({ id: oid });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.put('/origin_items/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, color_class } = req.body;
-    try {
-      const [existing] = await pool.query('SELECT * FROM origin_items WHERE id = ?', [req.params.id]);
-      if (existing.length === 0) return res.status(404).json({ error: 'Origin item not found' });
-
-      await pool.query('UPDATE origin_items SET name = ?, color_class = ? WHERE id = ?', [name || existing[0].name, color_class || existing[0].color_class, req.params.id]);
-      res.json({ message: 'Origin item updated.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.delete('/origin_items/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    try {
-      await pool.query('DELETE FROM origin_items WHERE id = ?', [req.params.id]);
-      res.json({ message: 'Origin item deleted.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  return router;
-};
-
-module.exports = {
-  createOriginsRouter,
-};
diff --git a/backend/routes/searchRoutes.js b/backend/routes/searchRoutes.js
deleted file mode 100644
index 39601fb..0000000
--- a/backend/routes/searchRoutes.js
+++ /dev/null
@@ -1,80 +0,0 @@
-const express = require('express');
-
-const createSearchRouter = ({ pool }) => {
-  const router = express.Router();
-
-  router.get('/search', async (req, res) => {
-    const { q } = req.query;
-    if (!q || q.length < 2) return res.json({ members: [], teams: [], attendances: [], organizations: [] });
-
-    const queryStr = `%${q}%`;
-    const results = { members: [], teams: [], attendances: [], organizations: [] };
-
-    try {
-      if (req.user.role !== 'agent') {
-        let membersQ = 'SELECT id, name, email, slug, role, team_id, avatar_url FROM users WHERE (name LIKE ? OR email LIKE ?)';
-        const membersParams = [queryStr, queryStr];
-
-        if (req.user.role === 'admin') {
-          membersQ += ' AND tenant_id = ?';
-          membersParams.push(req.user.tenant_id);
-        } else if (req.user.role === 'manager') {
-          membersQ += ' AND tenant_id = ? AND (team_id = ? OR id = ?)';
-          membersParams.push(req.user.tenant_id, req.user.team_id, req.user.id);
-        }
-
-        const [members] = await pool.query(membersQ, membersParams);
-        results.members = members;
-      }
-
-      if (req.user.role !== 'agent') {
-        let teamsQ = 'SELECT id, name, description FROM teams WHERE name LIKE ?';
-        const teamsParams = [queryStr];
-
-        if (req.user.role === 'admin') {
-          teamsQ += ' AND tenant_id = ?';
-          teamsParams.push(req.user.tenant_id);
-        } else if (req.user.role === 'manager') {
-          teamsQ += ' AND tenant_id = ? AND id = ?';
-          teamsParams.push(req.user.tenant_id, req.user.team_id);
-        }
-
-        const [teams] = await pool.query(teamsQ, teamsParams);
-        results.teams = teams;
-      }
-
-      if (req.user.role === 'super_admin') {
-        const [orgs] = await pool.query('SELECT id, name, slug, status FROM tenants WHERE name LIKE ? OR slug LIKE ? LIMIT 5', [queryStr, queryStr]);
-        results.organizations = orgs;
-      }
-
-      let attendancesQ = 'SELECT a.id, a.title, a.created_at, u.name as user_name FROM attendances a JOIN users u ON a.user_id = u.id WHERE a.title LIKE ?';
-      const attendancesParams = [queryStr];
-
-      if (req.user.role === 'admin') {
-        attendancesQ += ' AND a.tenant_id = ?';
-        attendancesParams.push(req.user.tenant_id);
-      } else if (req.user.role === 'manager') {
-        attendancesQ += ' AND a.tenant_id = ? AND u.team_id = ?';
-        attendancesParams.push(req.user.tenant_id, req.user.team_id);
-      } else if (req.user.role !== 'super_admin') {
-        attendancesQ += ' AND a.user_id = ?';
-        attendancesParams.push(req.user.id);
-      }
-
-      attendancesQ += ' LIMIT 10';
-      const [attendances] = await pool.query(attendancesQ, attendancesParams);
-      results.attendances = attendances;
-
-      res.json(results);
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  return router;
-};
-
-module.exports = {
-  createSearchRouter,
-};
diff --git a/backend/routes/teamsRoutes.js b/backend/routes/teamsRoutes.js
deleted file mode 100644
index bb76c0a..0000000
--- a/backend/routes/teamsRoutes.js
+++ /dev/null
@@ -1,93 +0,0 @@
-const express = require('express');
-const crypto = require('crypto');
-const { requireRole } = require('../middleware/auth');
-
-const createTeamsRouter = ({ pool }) => {
-  const router = express.Router();
-
-  router.get('/teams', async (req, res) => {
-    try {
-      const { tenantId } = req.query;
-      const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
-
-      let q = 'SELECT * FROM teams';
-      const params = [];
-      if (effectiveTenantId && effectiveTenantId !== 'all') {
-        q += ' WHERE tenant_id = ?';
-        params.push(effectiveTenantId);
-      }
-
-      if (req.user.role === 'manager') {
-        if (req.user.team_id) {
-          q += (params.length > 0 ? ' AND' : ' WHERE') + ' id = ?';
-          params.push(req.user.team_id);
-        } else {
-          q += (params.length > 0 ? ' AND' : ' WHERE') + ' 1=0';
-        }
-      }
-
-      const [rows] = await pool.query(q, params);
-      res.json(rows);
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/teams', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, description, tenantId } = req.body;
-    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
-    try {
-      const tid = `team_${crypto.randomUUID().split('-')[0]}`;
-      await pool.query(
-        'INSERT INTO teams (id, tenant_id, name, description) VALUES (?, ?, ?, ?)',
-        [tid, effectiveTenantId, name, description || null]
-      );
-      res.status(201).json({ id: tid, message: 'Time criado com sucesso.' });
-    } catch (error) {
-      console.error('Create team error:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.put('/teams/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    const { name, description } = req.body;
-    try {
-      const [existing] = await pool.query('SELECT tenant_id FROM teams WHERE id = ?', [req.params.id]);
-      if (existing.length === 0) return res.status(404).json({ error: 'Not found' });
-      if (req.user.role !== 'super_admin' && existing[0].tenant_id !== req.user.tenant_id) {
-        return res.status(403).json({ error: 'Acesso negado.' });
-      }
-
-      await pool.query(
-        'UPDATE teams SET name = ?, description = ? WHERE id = ?',
-        [name, description || null, req.params.id]
-      );
-      res.json({ message: 'Team updated successfully.' });
-    } catch (error) {
-      console.error('Update team error:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.delete('/teams/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    try {
-      const [existing] = await pool.query('SELECT tenant_id FROM teams WHERE id = ?', [req.params.id]);
-      if (existing.length === 0) return res.status(404).json({ error: 'Not found' });
-      if (req.user.role !== 'super_admin' && existing[0].tenant_id !== req.user.tenant_id) {
-        return res.status(403).json({ error: 'Acesso negado.' });
-      }
-
-      await pool.query('UPDATE users SET team_id = NULL WHERE team_id = ?', [req.params.id]);
-      await pool.query('DELETE FROM teams WHERE id = ?', [req.params.id]);
-
-      res.json({ message: 'Team deleted successfully.' });
-    } catch (error) {
-      console.error('Delete team error:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  return router;
-};
-
-module.exports = { createTeamsRouter };
diff --git a/backend/routes/tenantsRoutes.js b/backend/routes/tenantsRoutes.js
deleted file mode 100644
index 8bd8067..0000000
--- a/backend/routes/tenantsRoutes.js
+++ /dev/null
@@ -1,103 +0,0 @@
-const express = require('express');
-const crypto = require('crypto');
-const { requireRole } = require('../middleware/auth');
-const { recordActivity } = require('../services/activityService');
-
-const createTenantsRouter = ({ pool, transporter, getBaseUrl }) => {
-  const router = express.Router();
-
-  router.get('/tenants', requireRole(['super_admin']), async (req, res) => {
-    try {
-      const q = 'SELECT t.*, (SELECT COUNT(*) FROM users u WHERE u.tenant_id = t.id) as user_count, (SELECT COUNT(*) FROM attendances a WHERE a.tenant_id = t.id) as attendance_count FROM tenants t';
-      const [rows] = await pool.query(q);
-      res.json(rows);
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/tenants', requireRole(['super_admin']), async (req, res) => {
-    const { name, slug, admin_email, status } = req.body;
-    const connection = await pool.getConnection();
-    try {
-      await connection.beginTransaction();
-      const tid = `tenant_${crypto.randomUUID().split('-')[0]}`;
-      await connection.query('INSERT INTO tenants (id, name, slug, admin_email, status) VALUES (?, ?, ?, ?, ?)', [tid, name, slug, admin_email, status || 'active']);
-
-      const [existingUser] = await connection.query('SELECT id FROM users WHERE email = ?', [admin_email]);
-      if (existingUser.length === 0) {
-        const uid = `u_${crypto.randomUUID().split('-')[0]}`;
-        const userSlug = `admin-${crypto.randomBytes(4).toString('hex')}`;
-        const placeholderHash = 'pending_setup';
-        await connection.query('INSERT INTO users (id, tenant_id, name, email, password_hash, slug, role) VALUES (?, ?, ?, ?, ?, ?, ?)', [uid, tid, 'Admin', admin_email, placeholderHash, userSlug, 'admin']);
-
-        const token = crypto.randomBytes(32).toString('hex');
-        await connection.query('INSERT INTO password_resets (email, token, expires_at) VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 15 MINUTE))', [admin_email, token]);
-
-        const setupLink = `${getBaseUrl(req)}/#/setup-account?token=${token}`;
-
-        const [superAdmins] = await connection.query("SELECT id FROM users WHERE role = 'super_admin'");
-        for (const sa of superAdmins) {
-          await recordActivity(connection, {
-            userId: sa.id,
-            type: 'success',
-            title: 'Nova Organização',
-            message: `A organização ${name} foi criada.`,
-            link: '/super-admin',
-          });
-        }
-
-        await transporter.sendMail({
-          from: `"Fasto" <${process.env.MAIL_FROM || 'nao-responda@blyzer.com.br'}>`,
-          to: admin_email,
-          subject: 'Bem-vindo ao Fasto - Conclua seu cadastro de Admin',
-          html: `
-            <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e2e8f0; border-radius: 12px; background: #ffffff; color: #0f172a;">
-              <h2 style="color: #0f172a;">Sua organização foi criada</h2>
-              <p style="color: #475569;">Você foi definido como administrador da organização <strong>${name}</strong>.</p>
-              <p style="color: #475569;">Por favor, clique no botão abaixo para definir sua senha e concluir seu cadastro.</p>
-              <div style="text-align: center; margin: 30px 0;">
-                <a href="${setupLink}" style="background-color: #0f172a; color: white; padding: 12px 24px; text-decoration: none; border-radius: 8px; font-weight: bold; display: inline-block;">Finalizar Cadastro</a>
-              </div>
-              <p style="font-size: 12px; color: #94a3b8;">Este link expira em 15 minutos.</p>
-            </div>
-          `
-        }).catch(err => console.error("Email failed:", err));
-      }
-
-      await connection.commit();
-      res.status(201).json({ id: tid, message: 'Organização criada e convite enviado por e-mail.' });
-    } catch (error) {
-      await connection.rollback();
-      res.status(500).json({ error: error.message });
-    } finally {
-      connection.release();
-    }
-  });
-
-  router.put('/tenants/:id', requireRole(['super_admin']), async (req, res) => {
-    const { name, slug, admin_email, status } = req.body;
-    try {
-      await pool.query(
-        'UPDATE tenants SET name = ?, slug = ?, admin_email = ?, status = ? WHERE id = ?',
-        [name, slug || null, admin_email, status, req.params.id]
-      );
-      res.json({ message: 'Tenant updated successfully.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.delete('/tenants/:id', requireRole(['super_admin']), async (req, res) => {
-    try {
-      await pool.query('DELETE FROM tenants WHERE id = ?', [req.params.id]);
-      res.json({ message: 'Tenant deleted successfully.' });
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  return router;
-};
-
-module.exports = { createTenantsRouter };
diff --git a/backend/routes/usersRoutes.js b/backend/routes/usersRoutes.js
deleted file mode 100644
index 800b9b1..0000000
--- a/backend/routes/usersRoutes.js
+++ /dev/null
@@ -1,235 +0,0 @@
-const express = require('express');
-const bcrypt = require('bcryptjs');
-const crypto = require('crypto');
-const { requireRole } = require('../middleware/auth');
-const {
-  canReadUser,
-  canUpdateUser,
-  canManageUserStatus,
-  canChangeUserEmail,
-  canManageUserRoleOrTeam,
-  canManageUserPassword,
-} = require('../policies/accessPolicy');
-const { recordActivity } = require('../services/activityService');
-
-const USER_PUBLIC_FIELDS = 'id, tenant_id, team_id, name, email, slug, role, status, bio, avatar_url, created_at';
-const MIN_PASSWORD_LENGTH = 8;
-
-const createUsersRouter = ({ pool, upload, transporter, getBaseUrl }) => {
-  const router = express.Router();
-
-  router.get('/users', async (req, res) => {
-    try {
-      const { tenantId } = req.query;
-      const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
-
-      let q = `SELECT ${USER_PUBLIC_FIELDS} FROM users`;
-      const params = [];
-      if (effectiveTenantId && effectiveTenantId !== 'all') {
-        q += ' WHERE tenant_id = ?';
-        params.push(effectiveTenantId);
-      }
-
-      if (req.user.role === 'manager') {
-        if (req.user.team_id) {
-          q += (params.length > 0 ? ' AND' : ' WHERE') + ' (team_id = ? OR id = ?)';
-          params.push(req.user.team_id, req.user.id);
-        } else {
-          q += (params.length > 0 ? ' AND' : ' WHERE') + ' id = ?';
-          params.push(req.user.id);
-        }
-      }
-
-      const [rows] = await pool.query(q, params);
-      res.json(rows);
-    } catch (error) {
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.get('/users/:idOrSlug', async (req, res) => {
-    try {
-      const [rows] = await pool.query(`SELECT ${USER_PUBLIC_FIELDS} FROM users WHERE id = ? OR slug = ?`, [req.params.idOrSlug, req.params.idOrSlug]);
-      if (!rows || rows.length === 0) return res.status(404).json({ error: 'Not found' });
-      if (!req.user || !req.user.role) return res.status(401).json({ error: 'Não autenticado' });
-
-      if (!canReadUser(req.user, rows[0])) return res.status(403).json({ error: 'Acesso negado.' });
-
-      res.json(rows[0]);
-    } catch (error) {
-      console.error('Error in GET /users/:idOrSlug:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/users', requireRole(['admin', 'manager', 'super_admin']), async (req, res) => {
-    const { name, email, role, team_id, tenant_id, password } = req.body;
-    const effectiveTenantId = req.user.role === 'super_admin' ? tenant_id : req.user.tenant_id;
-    const shouldSetPassword = typeof password === 'string' && password.length > 0;
-
-    let finalRole = role || 'agent';
-    let finalTeamId = team_id || null;
-
-    if (req.user.role === 'manager') {
-      if (!req.user.team_id) return res.status(403).json({ error: 'Gerente sem time não pode criar membros.' });
-      finalRole = 'agent';
-      finalTeamId = req.user.team_id;
-    }
-    try {
-      if (shouldSetPassword && !canManageUserPassword(req.user)) {
-        return res.status(403).json({ error: 'Apenas admins podem definir senha de usuários.' });
-      }
-      if (shouldSetPassword && password.length < MIN_PASSWORD_LENGTH) {
-        return res.status(400).json({ error: `A senha deve ter pelo menos ${MIN_PASSWORD_LENGTH} caracteres.` });
-      }
-      if (finalRole === 'super_admin' && req.user.role !== 'super_admin') {
-        return res.status(403).json({ error: 'Apenas super admins podem criar super admins.' });
-      }
-
-      const [existing] = await pool.query('SELECT id FROM users WHERE email = ?', [email]);
-      if (existing.length > 0) return res.status(400).json({ error: 'E-mail já cadastrado.' });
-
-      const uid = `u_${crypto.randomUUID().split('-')[0]}`;
-      const slug = `${name.toLowerCase().replace(/[^a-z0-9]+/g, '-')}-${crypto.randomBytes(4).toString('hex')}`;
-      const passwordHash = shouldSetPassword ? await bcrypt.hash(password, 10) : 'pending_setup';
-
-      await pool.query(
-        'INSERT INTO users (id, tenant_id, team_id, name, email, password_hash, slug, role, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
-        [uid, effectiveTenantId, finalTeamId, name, email, passwordHash, slug, finalRole, 'active']
-      );
-
-      if (shouldSetPassword) {
-        return res.status(201).json({ id: uid, message: 'Membro criado com senha definida.' });
-      }
-
-      const token = crypto.randomBytes(32).toString('hex');
-      await pool.query(
-        'INSERT INTO password_resets (email, token, expires_at) VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 15 MINUTE))',
-        [email, token]
-      );
-
-      const setupLink = `${getBaseUrl(req)}/#/reset-password?token=${token}`;
-
-      await transporter.sendMail({
-        from: `"Fasto" <${process.env.MAIL_FROM || 'nao-responda@blyzer.com.br'}>`,
-        to: email,
-        subject: 'Bem-vindo ao Fasto - Finalize seu cadastro',
-        html: `
-          <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e2e8f0; border-radius: 12px; background: #ffffff; color: #0f172a;">
-            <h2 style="color: #0f172a;">Olá, ${name}!</h2>
-            <p style="color: #475569;">Você foi convidado para participar da equipe no Fasto.</p>
-            <p style="color: #475569;">Clique no botão abaixo para definir sua senha e acessar sua conta:</p>
-            <div style="text-align: center; margin: 30px 0;">
-              <a href="${setupLink}" style="background-color: #0f172a; color: white; padding: 12px 24px; text-decoration: none; border-radius: 8px; font-weight: bold; display: inline-block;">Finalizar Cadastro</a>
-            </div>
-            <p style="font-size: 12px; color: #94a3b8;">Este link expira em 15 minutos. Se você não esperava este convite, ignore este e-mail.</p>
-            <div style="border-top: 1px solid #f1f5f9; margin-top: 20px; padding-top: 20px; text-align: center;">
-              <p style="font-size: 12px; color: #94a3b8;">Desenvolvido por <a href="https://blyzer.com.br" style="color: #3b82f6; text-decoration: none;">Blyzer</a></p>
-            </div>
-          </div>
-        `
-      });
-      res.status(201).json({ id: uid, message: 'Convite enviado com sucesso.' });
-    } catch (error) {
-      console.error('Invite error:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.put('/users/:id', async (req, res) => {
-    const { name, bio, role, team_id, status, email, password } = req.body;
-    const shouldUpdatePassword = typeof password === 'string' && password.length > 0;
-    try {
-      const [existing] = await pool.query('SELECT * FROM users WHERE id = ?', [req.params.id]);
-      if (existing.length === 0) return res.status(404).json({ error: 'Not found' });
-
-      if (!canUpdateUser(req.user, existing[0])) return res.status(403).json({ error: 'Acesso negado.' });
-      if (shouldUpdatePassword && !canManageUserPassword(req.user)) {
-        return res.status(403).json({ error: 'Apenas admins podem alterar senha de usuários.' });
-      }
-      if (shouldUpdatePassword && password.length < MIN_PASSWORD_LENGTH) {
-        return res.status(400).json({ error: `A senha deve ter pelo menos ${MIN_PASSWORD_LENGTH} caracteres.` });
-      }
-      if (role === 'super_admin' && req.user.role !== 'super_admin') {
-        return res.status(403).json({ error: 'Apenas super admins podem definir super admins.' });
-      }
-
-      const finalRole = canManageUserRoleOrTeam(req.user) && role !== undefined ? role : existing[0].role;
-      const finalTeamId = canManageUserRoleOrTeam(req.user) && team_id !== undefined ? team_id : existing[0].team_id;
-      const finalStatus = canManageUserStatus(req.user) && status !== undefined ? status : existing[0].status;
-      const finalEmail = canChangeUserEmail(req.user, existing[0]) && email !== undefined ? email : existing[0].email;
-
-      if (finalEmail !== existing[0].email) {
-        const [emailCheck] = await pool.query('SELECT id FROM users WHERE email = ? AND id != ?', [finalEmail, req.params.id]);
-        if (emailCheck.length > 0) return res.status(400).json({ error: 'E-mail já está em uso.' });
-      }
-
-      await pool.query(
-        'UPDATE users SET name = ?, bio = ?, email = ?, role = ?, team_id = ?, status = ? WHERE id = ?',
-        [name || existing[0].name, bio !== undefined ? bio : existing[0].bio, finalEmail, finalRole, finalTeamId || null, finalStatus, req.params.id]
-      );
-
-      if (shouldUpdatePassword) {
-        const passwordHash = await bcrypt.hash(password, 10);
-        await pool.query('UPDATE users SET password_hash = ? WHERE id = ?', [passwordHash, req.params.id]);
-        await pool.query('DELETE FROM password_resets WHERE email = ?', [finalEmail]);
-      }
-
-      if (finalTeamId && finalTeamId !== existing[0].team_id && existing[0].status === 'active') {
-        const [team] = await pool.query('SELECT name FROM teams WHERE id = ?', [finalTeamId]);
-        if (team.length > 0) {
-          await recordActivity(pool, {
-            userId: req.params.id,
-            type: 'info',
-            title: 'Novo Time',
-            message: `Você foi adicionado ao time ${team[0].name}.`,
-            link: '/',
-          });
-        }
-      }
-
-      res.json({ message: 'User updated successfully.' });
-    } catch (error) {
-      console.error('Update user error:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.delete('/users/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
-    try {
-      const [existing] = await pool.query('SELECT tenant_id FROM users WHERE id = ?', [req.params.id]);
-      if (existing.length === 0) return res.status(404).json({ error: 'Not found' });
-      if (req.user.role !== 'super_admin' && existing[0].tenant_id !== req.user.tenant_id) {
-        return res.status(403).json({ error: 'Acesso negado.' });
-      }
-
-      await pool.query('DELETE FROM users WHERE id = ?', [req.params.id]);
-      res.json({ message: 'User deleted successfully.' });
-    } catch (error) {
-      console.error('Delete user error:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  router.post('/users/:id/avatar', upload.single('avatar'), async (req, res) => {
-    try {
-      if (!req.file) return res.status(400).json({ error: 'Nenhum arquivo enviado.' });
-
-      if (req.user.id !== req.params.id && req.user.role !== 'super_admin') {
-        return res.status(403).json({ error: 'Acesso negado.' });
-      }
-
-      const avatarUrl = `/uploads/${req.file.filename}`;
-      await pool.query('UPDATE users SET avatar_url = ? WHERE id = ?', [avatarUrl, req.params.id]);
-
-      res.json({ avatarUrl });
-    } catch (error) {
-      console.error('Avatar upload error:', error);
-      res.status(500).json({ error: error.message });
-    }
-  });
-
-  return router;
-};
-
-module.exports = { createUsersRouter };
diff --git a/backend/services/activityService.js b/backend/services/activityService.js
deleted file mode 100644
index af4a4ef..0000000
--- a/backend/services/activityService.js
+++ /dev/null
@@ -1,14 +0,0 @@
-const crypto = require('crypto');
-
-const recordActivity = async (db, { userId, type = 'info', title, message, link = null }) => {
-  if (!userId || !title || !message) return;
-
-  await db.query(
-    'INSERT INTO notifications (id, user_id, type, title, message, link) VALUES (?, ?, ?, ?, ?, ?)',
-    [crypto.randomUUID(), userId, type, title, message, link]
-  );
-};
-
-module.exports = {
-  recordActivity,
-};
diff --git a/backend/services/provisioning.js b/backend/services/provisioning.js
deleted file mode 100644
index c77ddd7..0000000
--- a/backend/services/provisioning.js
+++ /dev/null
@@ -1,273 +0,0 @@
-const crypto = require('crypto');
-
-const provisionSuperAdmin = async ({ pool, transporter, getStartupBaseUrl, retries = 10, delay = 10000 }) => {
-  const email = 'suporte@blyzer.com.br';
-
-  for (let i = 0; i < retries; i++) {
-    let connection;
-    try {
-      connection = await pool.getConnection();
-
-      await connection.query(`
-        CREATE TABLE IF NOT EXISTS password_resets (
-          email varchar(255) NOT NULL,
-          token varchar(255) NOT NULL,
-          expires_at timestamp NOT NULL,
-          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
-          PRIMARY KEY (token),
-          KEY email (email)
-        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-      `);
-
-      await connection.query(`
-        CREATE TABLE IF NOT EXISTS pending_registrations (
-          email varchar(255) NOT NULL,
-          password_hash varchar(255) NOT NULL,
-          full_name varchar(255) NOT NULL,
-          organization_name varchar(255) NOT NULL,
-          verification_code varchar(10) NOT NULL,
-          expires_at timestamp NOT NULL,
-          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
-          PRIMARY KEY (email)
-        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-      `);
-
-      await connection.query(`
-        CREATE TABLE IF NOT EXISTS notifications (
-          id varchar(36) NOT NULL,
-          user_id varchar(36) NOT NULL,
-          type enum('success', 'info', 'warning', 'error') DEFAULT 'info',
-          title varchar(255) NOT NULL,
-          message text NOT NULL,
-          link varchar(255) DEFAULT NULL,
-          is_read boolean DEFAULT false,
-          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
-          PRIMARY KEY (id),
-          KEY user_id (user_id),
-          KEY created_at (created_at)
-        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-      `);
-
-      try {
-        await connection.query('ALTER TABLE users ADD COLUMN slug VARCHAR(255) UNIQUE DEFAULT NULL');
-      } catch (err) {
-        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (slug):', err.message);
-      }
-
-      try {
-        await connection.query(`UPDATE users SET slug = CONCAT(LOWER(REPLACE(name, ' ', '-')), '-', SUBSTRING(MD5(RAND()), 1, 8)) WHERE slug IS NULL`);
-      } catch (err) {
-        console.log('Schema update note (populate slugs):', err.message);
-      }
-
-      try {
-        await connection.query("ALTER TABLE attendances MODIFY COLUMN origin VARCHAR(255) NOT NULL");
-      } catch (err) {
-        console.log('Schema update note (origin):', err.message);
-      }
-
-      try {
-        await connection.query("ALTER TABLE attendances MODIFY COLUMN funnel_stage VARCHAR(255) NOT NULL");
-      } catch (err) {
-        console.log('Schema update note (funnel_stage):', err.message);
-      }
-
-      try {
-        await connection.query("ALTER TABLE attendances ADD COLUMN full_summary TEXT DEFAULT NULL");
-      } catch (err) {
-        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (full_summary):', err.message);
-      }
-
-      await connection.query(`
-        CREATE TABLE IF NOT EXISTS origin_groups (
-          id varchar(36) NOT NULL,
-          tenant_id varchar(36) NOT NULL,
-          name varchar(255) NOT NULL,
-          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
-          PRIMARY KEY (id),
-          KEY tenant_id (tenant_id)
-        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-      `);
-
-      await connection.query(`
-        CREATE TABLE IF NOT EXISTS origin_items (
-          id varchar(36) NOT NULL,
-          origin_group_id varchar(36) NOT NULL,
-          name varchar(255) NOT NULL,
-          color_class varchar(255) DEFAULT 'bg-zinc-100 text-zinc-800 border-zinc-200',
-          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
-          PRIMARY KEY (id),
-          KEY origin_group_id (origin_group_id)
-        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-      `);
-
-      try {
-        await connection.query("ALTER TABLE origin_items ADD COLUMN color_class VARCHAR(255) DEFAULT 'bg-zinc-100 text-zinc-800 border-zinc-200'");
-      } catch (err) {
-        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (origin_items.color_class):', err.message);
-      }
-
-      try {
-        await connection.query("ALTER TABLE teams ADD COLUMN origin_group_id VARCHAR(36) DEFAULT NULL");
-      } catch (err) {
-        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (teams.origin_group_id):', err.message);
-      }
-
-      try {
-        await connection.query("ALTER TABLE attendances RENAME COLUMN summary TO title");
-      } catch (err) {
-        if (err.code !== 'ER_BAD_FIELD_ERROR' && err.code !== 'ER_DUP_FIELDNAME') {
-          try {
-            await connection.query("ALTER TABLE attendances CHANGE COLUMN summary title TEXT");
-          } catch (e) {
-            console.log('Schema update note (summary to title):', e.message);
-          }
-        }
-      }
-
-      await connection.query(`
-        CREATE TABLE IF NOT EXISTS funnels (
-          id varchar(36) NOT NULL,
-          tenant_id varchar(36) NOT NULL,
-          name varchar(255) NOT NULL,
-          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
-          PRIMARY KEY (id),
-          KEY tenant_id (tenant_id)
-        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-      `);
-
-      await connection.query(`
-        CREATE TABLE IF NOT EXISTS funnel_stages (
-          id varchar(36) NOT NULL,
-          funnel_id varchar(36) NOT NULL,
-          name varchar(255) NOT NULL,
-          color_class varchar(255) DEFAULT 'bg-zinc-100 text-zinc-800 border-zinc-200',
-          order_index int DEFAULT 0,
-          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
-          PRIMARY KEY (id),
-          KEY funnel_id (funnel_id)
-        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-      `);
-
-      await connection.query(`
-        CREATE TABLE IF NOT EXISTS api_keys (
-          id varchar(36) NOT NULL,
-          tenant_id varchar(36) NOT NULL,
-          name varchar(255) NOT NULL,
-          secret_key varchar(255) NOT NULL,
-          secret_hash varchar(64) DEFAULT NULL,
-          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
-          last_used_at timestamp NULL DEFAULT NULL,
-          PRIMARY KEY (id),
-          UNIQUE KEY secret_key (secret_key),
-          UNIQUE KEY secret_hash (secret_hash),
-          KEY tenant_id (tenant_id)
-        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-      `);
-
-      try {
-        await connection.query("ALTER TABLE api_keys ADD COLUMN secret_hash VARCHAR(64) DEFAULT NULL");
-      } catch (err) {
-        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (api_keys.secret_hash):', err.message);
-      }
-
-      try {
-        await connection.query("ALTER TABLE api_keys ADD UNIQUE KEY secret_hash (secret_hash)");
-      } catch (err) {
-        if (err.code !== 'ER_DUP_KEYNAME') console.log('Schema update note (api_keys.secret_hash index):', err.message);
-      }
-
-      await connection.query(`
-        CREATE TABLE IF NOT EXISTS refresh_tokens (
-          id varchar(36) NOT NULL,
-          user_id varchar(36) NOT NULL,
-          token varchar(255) NOT NULL,
-          token_hash varchar(64) DEFAULT NULL,
-          expires_at timestamp NOT NULL,
-          created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
-          PRIMARY KEY (id),
-          UNIQUE KEY token (token),
-          UNIQUE KEY token_hash (token_hash),
-          KEY user_id (user_id)
-        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-      `);
-
-      try {
-        await connection.query("ALTER TABLE refresh_tokens ADD COLUMN token_hash VARCHAR(64) DEFAULT NULL");
-      } catch (err) {
-        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (refresh_tokens.token_hash):', err.message);
-      }
-
-      try {
-        await connection.query("ALTER TABLE refresh_tokens ADD UNIQUE KEY token_hash (token_hash)");
-      } catch (err) {
-        if (err.code !== 'ER_DUP_KEYNAME') console.log('Schema update note (refresh_tokens.token_hash index):', err.message);
-      }
-
-      try {
-        await connection.query("ALTER TABLE teams ADD COLUMN funnel_id VARCHAR(36) DEFAULT NULL");
-      } catch (err) {
-        if (err.code !== 'ER_DUP_FIELDNAME') console.log('Schema update note (teams.funnel_id):', err.message);
-      }
-
-      connection.release();
-      connection = null;
-
-      await pool.query('INSERT IGNORE INTO tenants (id, name, slug, admin_email, status) VALUES (?, ?, ?, ?, ?)', ['system', 'System Admin', 'system', email, 'active']);
-
-      const [existing] = await pool.query('SELECT id, password_hash FROM users WHERE email = ?', [email]);
-      if (existing.length === 0 || existing[0].password_hash === 'pending_setup') {
-        console.log('Provisioning default super_admin or resending email...');
-
-        if (existing.length === 0) {
-          const uid = `u_${crypto.randomUUID().split('-')[0]}`;
-          const placeholderHash = 'pending_setup';
-          const superAdminSlug = 'suporte-blyzer';
-
-          await pool.query(
-            'INSERT INTO users (id, tenant_id, name, email, password_hash, slug, role, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
-            [uid, 'system', 'Blyzer Suporte', email, placeholderHash, superAdminSlug, 'super_admin', 'active']
-          );
-        }
-
-        const token = crypto.randomBytes(32).toString('hex');
-        await pool.query('DELETE FROM password_resets WHERE email = ?', [email]);
-
-        await pool.query(
-          'INSERT INTO password_resets (email, token, expires_at) VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 15 MINUTE))',
-          [email, token]
-        );
-
-        const setupLink = `${getStartupBaseUrl()}/#/setup-account?token=${token}`;
-        console.log(`\n\n=== SUPER ADMIN SETUP LINK ===\n${setupLink}\n==============================\n\n`);
-
-        await transporter.sendMail({
-          from: `"Fasto" <${process.env.MAIL_FROM || 'nao-responda@blyzer.com.br'}>`,
-          to: email,
-          subject: 'Conta Super Admin Criada - Fasto',
-          html: `
-            <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e2e8f0; border-radius: 12px; background: #ffffff; color: #0f172a;">
-              <h2 style="color: #0f172a;">Conta Super Admin Gerada</h2>
-              <p style="color: #475569;">Sua conta de suporte (super_admin) foi criada no Fasto.</p>
-              <div style="text-align: center; margin: 30px 0;">
-                <a href="${setupLink}" style="background-color: #0f172a; color: white; padding: 12px 24px; text-decoration: none; border-radius: 8px; font-weight: bold; display: inline-block;">Finalizar Cadastro</a>
-              </div>
-              <p style="font-size: 12px; color: #94a3b8;">Este link expira em 15 minutos.</p>
-            </div>
-          `
-        }).catch(err => console.error("Failed to send super_admin email:", err));
-      }
-      return;
-    } catch (error) {
-      if (connection) connection.release();
-      console.error(`Failed to provision super_admin (Attempt ${i + 1}/${retries}):`, error.message);
-      if (i < retries - 1) {
-        await new Promise(res => setTimeout(res, delay));
-      }
-    }
-  }
-};
-
-module.exports = {
-  provisionSuperAdmin,
-};
diff --git a/backend/test/accessPolicy.test.js b/backend/test/accessPolicy.test.js
index 681f4c9..a3eca4e 100644
--- a/backend/test/accessPolicy.test.js
+++ b/backend/test/accessPolicy.test.js
@@ -6,7 +6,6 @@ const {
   canManageUserStatus,
   canChangeUserEmail,
   canManageUserRoleOrTeam,
-  canManageUserPassword,
   canReadAttendance,
 } = require('../policies/accessPolicy');
 
@@ -49,13 +48,6 @@ test('only admins can manage role, team, and status fields', () => {
   assert.equal(canChangeUserEmail(manager, agent), false);
 });
 
-test('only admins can manage user passwords', () => {
-  assert.equal(canManageUserPassword(superAdmin), true);
-  assert.equal(canManageUserPassword(admin), true);
-  assert.equal(canManageUserPassword(manager), false);
-  assert.equal(canManageUserPassword(agent), false);
-});
-
 test('attendance detail policy matches role boundaries', () => {
   const ownAttendance = { id: 'att_1', tenant_id: 'tenant_a', user_id: 'u_agent', team_id: 'team_a' };
   const teamAttendance = { id: 'att_2', tenant_id: 'tenant_a', user_id: 'u_another', team_id: 'team_a' };
diff --git a/docker-compose.local.yml b/docker-compose.local.yml
index ade810e..62ce19d 100644
--- a/docker-compose.local.yml
+++ b/docker-compose.local.yml
@@ -20,6 +20,10 @@ services:
       - SMTP_PASS=${SMTP_PASS}
       - MAIL_FROM=${MAIL_FROM}
       - SMTP_DEBUG=${SMTP_DEBUG:-false}
+    volumes:
+      - ./dist:/app/dist # Map local build to container
+      - ./backend/index.js:/app/index.js
+      - ./backend/db.js:/app/db.js
     command: ["node", "index.js"]
     depends_on:
       - db
diff --git a/package-lock.json b/package-lock.json
index 3797848..15599da 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1444,9 +1444,9 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.5",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
-      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "version": "1.20.4",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.4.tgz",
+      "integrity": "sha512-ZTgYYLMOXY9qKU/57FAo8F+HA2dGX7bqGc71txDRC1rS4frdFI5R7NhluHxH6M0YItAP0sHB4uqAOcYKxO6uGA==",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",
@@ -1457,7 +1457,7 @@
         "http-errors": "~2.0.1",
         "iconv-lite": "~0.4.24",
         "on-finished": "~2.4.1",
-        "qs": "~6.15.1",
+        "qs": "~6.14.0",
         "raw-body": "~2.5.3",
         "type-is": "~1.6.18",
         "unpipe": "~1.0.0"
@@ -1932,9 +1932,9 @@
       }
     },
     "node_modules/es-object-atoms": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
-      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -2027,14 +2027,14 @@
       "license": "MIT"
     },
     "node_modules/express": {
-      "version": "4.22.2",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
-      "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
+      "version": "4.22.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
+      "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
         "array-flatten": "1.1.1",
-        "body-parser": "~1.20.5",
+        "body-parser": "~1.20.3",
         "content-disposition": "~0.5.4",
         "content-type": "~1.0.4",
         "cookie": "~0.7.1",
@@ -2053,7 +2053,7 @@
         "parseurl": "~1.3.3",
         "path-to-regexp": "~0.1.12",
         "proxy-addr": "~2.0.7",
-        "qs": "~6.15.1",
+        "qs": "~6.14.0",
         "range-parser": "~1.2.1",
         "safe-buffer": "5.2.1",
         "send": "~0.19.0",
@@ -2261,9 +2261,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
-      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -2590,9 +2590,9 @@
       "license": "MIT"
     },
     "node_modules/multer": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/multer/-/multer-2.1.1.tgz",
-      "integrity": "sha512-mo+QTzKlx8R7E5ylSXxWzGoXoZbOsRMpyitcht8By2KHvMbf3tjwosZ/Mu/XYU6UuJ3VZnODIrak5ZrPiPyB6A==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/multer/-/multer-2.1.0.tgz",
+      "integrity": "sha512-TBm6j41rxNohqawsxlsWsNNh/VdV4QFXcBvRcPhXaA05EZ79z0qJ2bQFpync6JBoHTeNY5Q1JpG7AlTjdlfAEA==",
       "license": "MIT",
       "dependencies": {
         "append-field": "^1.0.0",
@@ -2694,9 +2694,9 @@
       "license": "MIT"
     },
     "node_modules/nodemailer": {
-      "version": "8.0.10",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.10.tgz",
-      "integrity": "sha512-BLFuSth7QtHOkBzyqTehWWyub0NTRDuK2Q2SQfnGLsrJnzyU+Yeh4WpV1eZGuARFj1xQJHIdnTuJZLP+b9R1GQ==",
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.1.tgz",
+      "integrity": "sha512-5kcldIXmaEjZcHR6F28IKGSgpmZHaF1IXLWFTG+Xh3S+Cce4MiakLtWY+PlBU69fLbRa8HlaGIrC/QolUpHkhg==",
       "license": "MIT-0",
       "engines": {
         "node": ">=6.0.0"
@@ -2745,9 +2745,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "0.1.13",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
-      "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
+      "version": "0.1.12",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
+      "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==",
       "license": "MIT"
     },
     "node_modules/picocolors": {
@@ -2813,9 +2813,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.14.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
+      "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "side-channel": "^1.1.0"
@@ -2913,9 +2913,9 @@
       }
     },
     "node_modules/react-router": {
-      "version": "7.17.0",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.17.0.tgz",
-      "integrity": "sha512-FDELK7rTMlCHO5+reyXsPlmfr7N1F91lPHsWYfMEGQm/KQ+F4JFM8jGoeQDmDvdTs93Fw9aSilH+uKRb4/jXvQ==",
+      "version": "7.13.1",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.13.1.tgz",
+      "integrity": "sha512-td+xP4X2/6BJvZoX6xw++A2DdEi++YypA69bJUV5oVvqf6/9/9nNlD70YO1e9d3MyamJEBQFEzk6mbfDYbqrSA==",
       "license": "MIT",
       "dependencies": {
         "cookie": "^1.0.1",
@@ -2935,12 +2935,12 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "7.17.0",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.17.0.tgz",
-      "integrity": "sha512-fyU2yjGups/hE6Xz0I5ZYbVL8Gx29eCjgpHaRaTaVU+OOAdfRX05KsvyRm0GO8YQwOkhpU3MurW1jyMUJn+zSw==",
+      "version": "7.13.1",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.13.1.tgz",
+      "integrity": "sha512-UJnV3Rxc5TgUPJt2KJpo1Jpy0OKQr0AjgbZzBFjaPJcFOb2Y8jA5H3LT8HUJAiRLlWrEXWHbF1Z4SCZaQjWDHw==",
       "license": "MIT",
       "dependencies": {
-        "react-router": "7.17.0"
+        "react-router": "7.13.1"
       },
       "engines": {
         "node": ">=20.0.0"
@@ -3201,13 +3201,13 @@
       }
     },
     "node_modules/side-channel-list": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
-      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
+      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.4"
+        "object-inspect": "^1.13.3"
       },
       "engines": {
         "node": ">= 0.4"
@@ -3440,9 +3440,9 @@
       }
     },
     "node_modules/uuid": {
-      "version": "13.0.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.2.tgz",
-      "integrity": "sha512-vzi9uRZ926x4XV73S/4qQaTwPXM2JBj6/6lI/byHH1jOpCzb0zDbfytgA9LcN/hzb2l7WQSQnxITOVx5un/wGw==",
+      "version": "13.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.0.tgz",
+      "integrity": "sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
diff --git a/src/assets/audio/notification.mp3 b/src/assets/audio/notification.mp3
new file mode 100644
index 0000000000000000000000000000000000000000..e6e2336014f5cecfb3dc9ae1112883cdf8ff46a1
GIT binary patch
literal 16128
zcmd_RWmHse^!R%w=%EpY9=c)ZhM_~cL~`g9kdzRIkdTn>E|HK{5Rjo;8c9JZK~NAu
zK!MBm_h0vS-`qF%_1$Yd&)WO!bIy9!b3SXI{nYK>c~t;_eifK{j>dv>qL)+Zk$~A?
zuC(+r0PcVFicjtskf@tA`qVXoFN~P)Hv&ckLik>H{>dnNIOYTVufT92oI1HkpGH6l
z48<oyp!jn|97oeRbt3+c8S#ItJjXj<w5oE@ow)w@FkWnIY|Q^x1)r3ZRPh)9f>ipa
zvK&g<d+{Vh^=?{L>rPgsPbRNU{o5D$#kGk=AYul?_z<WXE&{K&of7bY0Gm3bQ9e?{
zpb|0MNJI)doN{8IiT}Q+sHjbo{a^w$zj;&0+4oNkHr*lrV>M@V|5*L<W%IuV+I{(d
zQMRym9tkEUrceMNxrvRv#RlEJyuFhNfGiqN!sqA%hJqNb0~z}0w?8kz`v}&4v9%5&
z3wo8w`jLsz(ZUEO4wghWf(a_{7*VamKnpvOAS6wYmb4j0@AEOnS|R=kwm^c0`+(Z8
zGMQ%F{v)R*&ppm$*0)L&m%rf&_Yy~5Z}HCO@m55fbp(IRX->>I%ntvaTQ~4^R#?kj
z{ljB+@%L4l6Gpjgw?DNG%7u;8*bTXJ*>&OBTE(}w|3<oW;W_D?YG3*7tvPk#%b)-N
z!)K?m<A5q7;Bw^4=?2|!v4q@M^iHOZ)ii@pJcf!64*;kDOhi;Qc^Y5<x6;7_!k(CD
zU>IDDjhAGjm$oC7YiNeQ{hqRw5mnjoFYA(d`0wjlp^E+@x9yelc~yqSFEwS~cOJ8s
z3-cZZOdl^_5G~Rxd_J+gzE=FWRMc%3effg)_V$`b|K}fzmFZe@iFbG1dG)d9(_$C@
zVtXrZWEtDWO{0nGJsedf15*GX(Bqtc%$fFR`B7>V&Z6kEaX+GhbWWovvh<b`T(W8^
z1a+z$oB>J@6=8_!jX)ydL^KaM6Rv^{7+l#^tZwi4M*z6Yh6X=^5J2CE+t9~tfI4Sg
zyyFl6FVVe{l*a)346ZX&Zj><c()<jXXTPVD4CnCS^l$s^>9hFaf-jz}Zu~XdZ&;{Z
zW9a<xPnn18Vq)S*qV4L&GOF}K)obnFpm@z<Q$yEn$j@NTvizc?;j*-vm9ctD@uu5d
z#n1mDZ4vQPV|%Yex_#R|&i-Wn+;jJ7Zm)Nr6~XP2-oG6b;Lo+41zcK8O^rYpYqz}_
zrROJZjahEb&n|!07^Y+FOn8x+7zED5Ba$Idixduu>=;)Xq|~UC2Pa_A!2`<(XE{8_
z%d>k)hmI^Zp!~%1>dmW(6JvZpR#-Ft`~V6xWcJJ2)=N0A+2jqZKQ-40_I>&e*Sw12
zoSr<w-n7R2^@P*WR@QRi)syh@HhGF9>y7V>pZXRK_Z@-_hgn8V^9wI^^E^XqTmN*P
zZBzYnE%<O~dpZTH^_L*o??41~v2c>N*#>C>00v+^THNSvYb6KZ;MCxxWttpSI_U&^
zS-3ulTWjjSRDu}{(f}7~7lG7)OM&sLMc^zLyGV0L4l$-03W)@G=%5AJ1FCM^b>Fg;
zHeRGk#F$hzNeVm_d)ok2toJGlkkIS`UxrfJH-!rR27y04Ypy9F9uxc7JZs1IoyvDq
z+eI)pr}N*D=C{o{!TAUU=~1FgzWDVNC;H;5om#lfwbiagOYHhI6xB+1(ZMdfjsO5q
zYhLHkQS&ODD}b&uuZn_*p*fj%AF3|eF$vg34uQ$0HQ92AK_JXGT1?CYR*GnX7Q>K3
zN)VZn0cb?1#^GYu@f_u`^NM^}O@EP@BkSI=DNY{HLIbUvbRD}Q!mYOO((y?AYjnSE
zpZZz1;T{S1i8RuZ{852xMxNg0Q2j>3^NBaZ<qd7`c10;l<ECxr-%oTB>N&hR=dd8{
z)>RZu;%<i%4kjtO_j$3G5177st$i1i{4HYQo;%+j9Ze$f0j#45F*9Bc8V|PAzugNM
zBz=!8(d3!{uowUFe-FSJmYxg`MFH)x1XELvfZ2i;>-8Q6yi&!^)pZQ?0#rI=*b)>_
zg@@p_(<Z{CK-5b&@8dvU&=mElMuFK`=AShBjwL>h;iof>AtB*hw2q#QbxNcSmU-#x
z-E5*0TH!t09+Ss=_#jbNOZ0+Z+lk_Us|@u6dnzzgB$~L|$&9gWSNSWdNN~6yFaPJy
z(>Al(=Ry?;Mq0(z^FM;aPc}}UUGLT{Xazl69G?cj00Mcc{p0A*)lt4%BPbHFn~O*P
zI07L-7tH)H0{<y3Dz7veOAQ8oI}*Vlm}nTx83ai16Y-FVL0=&FLDT~*7&V)17KXt%
zLfpI<lA7}%mTl_rsv>92MdM~V!;S6Wm+u0;P`K6jE?1#>37^nbs5I1RGd!&j4*WdP
zEUgCquuywG@o#llgQ}u&r{8Ne%HIAN&m%Eu`v>-srrvoQ!GAw@6o<DZyf?tx9KLXU
zg|i{HGF3tbjW>c28Egt$GDRVCprRyt5CPgOiEV}x14SeP7edhZ0yzyvBgo)%5lR>=
zVGa}^G)M&ao%T3~@{q4(yjt@MXZ{Uf?Z3R_dxg6rn*W`Lp4py=E*>?Ft#z|fUd_in
zUnW<)*Z)J1{?jAkn&HI5M@PqwKK{$>x^lVKTT{e(tGKDGi!ED{^I<>Xi))tl{c9ob
z9Q;(@6sctqtvR=dxKO<ne(UYN_<pLYh3;~aL-95f0CEYQ5rEA5Oo(BWrg3{Usk*h{
z&@riw3CpO8{%W=fJk)V-EB<&HE5ronIR=V=JYw}rRJWn|`Y%+N`J?MzGNFVkzutl#
zrHFl)I3F#iL)_5(KxOjK<FYKzlZZ%Da9{DH+@H#oxd-M?)~y={Gt=^X99v9qJG`!B
zLU^6|*gj>~anr>rY#IJp|5egC96Dg`v$4|bc794|p^$HOL-Hr*!`v7#B~x&WZ3l_z
z_lU0S@Pcaqlu0q_1tFY{M0%0<;Ys`uf5)6opR6KkKx6zTP9$=AfQ>BzkN!XYDdV0S
z8jTpQ+8Mmzm8J{z<fY-bPu*}7+c(Uy<#gRxf={3d5Q=5Hy}yzpIxFSPVe$3B4Xd+n
zZ<L1TOC6{5dg_=Gm|TpEoVguTz3~;lS1QvX)*K>NLh7+5Ap68NUDQfe`M%MpX*S!l
z>u)6KYHQ=|O%dCpJEI1OtJXKINp;ruV1drnH8GPt8_N!&l?jp_ULJzF%NL&;_E3k5
zPDVef0G#kKr~4obN(fE~>4-4qrnRrT%x-d`Gs9eNgQGN5A-G{axOkfAEhhoNzQ-zt
zW@#TYt>9t|nYtEI_?Qwg{{k<5PL^WIhON<Ndqby1W19Gc=&#N6)gJ84#=^2iNux2%
z;Z??sne*UWQ-a^mT+mkjyE7LtRn%_0V+S9;ukKk_1V(OeA-2x~9xmxqZ<|~zyAPUI
z5q;W6jth;O)#ukO$~COm(bqqF@OOj_4oARq2vHhv4f`QFna#jFgJ_dny3M2<W>h?!
zx<n*zv#H}RJU$rh*cV|kg|i_T^sxC~?xT&+^x61)&(9>YJ=tc>OEfYvyhdjlTjOHB
zK~W=X46J$TzI8prc)U#Jx{6P}?u}{|almJ++q2q>RdwtB%viqV^I8tbHsTWS%C24w
zwN%V-Sa3MK*xMp@**fgDYOVin%M-YNtf5Fc;pep^UPshTMhP5Im#r=_^S1`b=62gb
zQ>+L;P!jNVZwC!}e4Qk5yiKpMuaVGv*If^^xjH%#!#@;}sKZ^SYYK*#Ox{NuNymX+
z;_VNlH{DB#`~6ne%9{RFbTFesr%K6>#sf%O54jbTQWqLH%g`Vr_-og`uv}kYJom8~
z6~E|vF)o7zjZ>$@7G?4)a*1y%3446=hP9hV$Os+01O8pXB;xg#9JnK9@4`PxbY3^A
z8L=CcwTUb|7izVVRO=+DbiMWy=LNuIv`zrV41+2_K2qZo)m0@C_RLmA2KVEOP_>S6
zsz~MQ{L3d%&dJ~<0hh}2E)n{_89vkOscfE33yXdHAOFm8&ueuC$N$+Gyc+p78mc2f
zQ^-X&<rEKI;;_Htznb4qB#zh0`S{EZ@y<Cm(?o1ZP~R#ekv%hquk>|gk&L#j&wi$a
zUQU|stlPFXLpF&~Ye?zX^q%1RZH^3io3`>Dsb-0j)9;KL4`YRIBCMD4!xd+mG(&T}
zB{w2nxPGh$@+P#FPZNxo<Wq1nS*!+p40!SV6a^4y39z8Ja^xT#FWXCs7;+x|v@OaX
zA*7AR*M>g?N?!p!XhM8Ed}^z2Q`q=iUIO=M*?MiV_+K3LoDBS;t`h~GMrLIdOiza%
zD0&Fp<Ht>+(p%FAP#-HZ@OD{M(agBj(c{%Kat!@s)M;{`%JG-glMt^hKBJrMpabL8
z5C!jg4@DZG`~a&3h2@RcrP>?ej_m^xjv0R{TDU72NnCq080D`yB}$;|Fk%$4A0SI4
zuTLD-Inv|t2|F+lOpH@PWAQm*^hzdBHT9l88dNnbE@HDx38lbW54`ixeO!c9W+~+-
zryTZ?vVd0Wuw>{bypzV!a$<{C=24EEW{{4HpUJu~;0l(8Ho9lZ#+iH<)OEe?>x(?d
zjQy6$+w^00;?--5AN;EKo!Q1Z_P>-mwO+fA285=zSh9S|Jo5}VJSv>JuCn=jOohKm
z?_{KkMHv`o#s&ukN=bVw$ZIJ{df=m|F<1y7hNXcR^x|>Ijnor->mO0E8tx{@IC@1a
z0G&)umg*YrM@7bPLLMuvQ_Vjym*w?RlV!vxm(=%DctH0S-j^tFW$Fa9IR5)OM?U{s
z%j`a@T=i#Y_Tacd^zeiIx%b-4*=qD=s$sGG%(ZW?sS0J<o<Hw*>fKIZ-sTgQIhtzd
z4m<y1R5>81Y_VUjy;jJ;zLO|x^)L6Ru1}0RM%(1Xht-rs=3B8dQu?@gK3CEeCk|DD
zCILv$ypb^UIhmm2Q_?aQc_ChV*=W6>F+A-w5AET`IzlcH5N107n?-=lN~S_S*TE+;
zDC!vwdLIAW;nMU*)c?alWbS|bb6{{XwN*v`+8MMFNJT#LW~U~$Bo}Hl?yD*L>huHI
z7?x*Fl-B15f`a_5WQ(Y&6^!H*&;D(ZvX)*kk`~1n3#MsjA~mL)iW&Iq%0!wk63*6i
z!xTCN+ZdY9!#IXpnCic0=XX114YBy07YA>A@`+>Te!Eofg{c2JQTVyZ_f@ht_aEAq
z2JmVCRg9$VwLu!az!ScRqZ4`Xuu&M@_f`CRx}86}zLYV5+=N#P6E*UeCC!w`sJs13
zei174tJiL<`J%_24gAHV(9n2TyT+I>2WkC!FhDNKnA<^2xFA03+i+g|Z~lp8uo;f&
zLSW(~vCP@`m<@Z0&l79cF=C7>KffxV!*>L|e_Uqq-?wmcu(`Ud2%=f&gf-ed8s-<4
ztpB<4yRdYNn95u9zPF6o5^nV1X0uHCJQEtAz}Lp0d4VCcegrqV9!JJW5%$4}gB9Q5
zRn!_f1H_7ch`CEgqp>a^7#0_>A_Gv3AfMTRS4tUnPK0)1KR>p>se&m>NJ!%B&}pKK
zFUzR7oN;GzXh@iS<XJKo$RJg#(Z@w!R?>zPUsE-1oh#M4Xn4u2+)j9bJ@lW-r}JhM
zMIRK0naXQ-G#%2M@(d~b>UcOZB)7fvM%P<s-R94)zr7tB9m_OiD(L}#Tmd#Ri*^_(
zib@cFh(*IDpdtrv%7xp@5%lVT3N6Cb{`hqo6k%5)#u~{vw2XF=OF0g8h@>->HOSpM
z0|G)xnK%^?r2W$eoeXAJ>G8#8u7sCU1R5VDg3Ge)ob1@oeCf3x%2*F4KA!&7Rkgm@
zQ2SA1TJTYJzFn&xN8No|ErwjjM}>x!+<sJ|nWg?G2^t+FGseThe|Y%6ptv*rhMS9P
zeyGE7*`He7WnOj&0ucbsj061cJ)t80#k{uj%#1iL#(Yptae@nsT7D%$1|A^Vb{=4n
zf^rnHh|g;6S`vCY9R%Kdm|Z#ztawpBrZuwmWUQ^kpQA*Goxe;N(62t%fti!m?OVO6
z-^%%){6_@;d9il?){5Qn&}6&mQ?@0VK~j>oe*pLm1FOwl{;zC(ZWS;hSU9h*Zlzhz
z({W%!>#kqPn{ga{s=8=A9@ysm#xHL%i2sG<e#Pwu=k1?!PG`?^ogEjnvVpTu$Rj@Z
z2`fkP(&dYp?#3%}TW(x32)Kek1(ZlShnr&6&+lUc!N1p&4)K(rgg8<{z+D7>AWd*t
zHO>$?4!l`{144l0!2pOBFaVq#Z_CnK(=Rj%f*7AF5&PPr8jkktRPz{`_ArimvRQkI
zSs{z-RSEh=3>4A?u59$X3`#7O%wjz59QZS_6{YOj9_32O$;fq5LnhaH`RG`Yo44PL
z{t%Tx>w8*FJK7$85IHY5>2=l(&krtG*^hE1+2Ioo%(9o<)8&HSn(i-IY-H=M5T{X;
zK_BBq0n>O60GzZ1dZ^4snNfU7>BK=vfrOvp%;SiHFvOH#D3}u9h8!b7y%@42fVx;6
zfCDT5UinH?P08Zww?R3l5&t9G;*<e~e3M)yGO@tC7xDsm`LSGr3S?}lv?UFK3zt^A
z`}@0_UM8hQ?<6TRRVz<A8DFz*On%AcSgm+1K2<PZ_Q&ln>k-Glx@SAd5`GO2g1yf&
ztrQja_9mBq{5?~`qa!_ueZwj!Psn8?nS1_t-)i!g*Nt3nbs7MdjbwQ~T}vx3kecD3
zK^GuJ-mXQTqZ9cA%9Kb0xMHz1iA0#YkqS{KF~@tJ=JS|RAuc*Gi^Y^j8sNHZG#a6D
zJo=z44eu)Wq{_95ZXscM-g5{gr8a4%HEaKG!!^0s_}!}o3ZtXs)~gpe!p##W2T??w
zDn$WdfnDd`O!YrnC}*MgA(Q7jp_(aDNmEq#6)o$7{AorOdj?e@PZcUY+yDObY}*td
zW0WDnb(ld2+(i-y*q~Z0j!(IyhA!+S0xAGwGK2LYpgLfT&d@OtF2Fxl;XmO50jMBg
z6c2F@4$y(AR?LB6G@Gc%7~*j7q+<K?+8+=u#qXpm+uQ#a{{=9(FEzBhLeby>Tmr=@
zSAhE8t!&2{hHx#<`MYchh_S4xCoAh?S*M5FvCZyuAF8jSD$tfEIALI-L{g1X9aGLp
z0p^#mS5*(gxPV4y<ZHD52CU=qNQ?Z|jZ#ulc~tR6unzv`+4Y};$*U!8?tC_W<Ku1V
z)vmppp3v*l+uNYysfRamw|n1vZf`I5)}P&Og+ss+02smUxmit7TGA>Bx|@fH{MJB+
zO`eH@d(b8`USfC%;LU|IQPWHWz&9Vp96Z47rRGFVWQ<lAbD06?9^in74CI7}*y|fM
z&^abD%X5WWLh>jGQwckyCr8PU?Veb|AZ&@j{0H(V5~`0-8!-x#Ll`lAO1l$A35y8$
zi0*$rMYl;}`meEGgSZKLfj%q1CztPoyf5sX>oD8lY%a+5$gy3>2-hA=`K&ZvXnsAy
zWWY#9O`Wq<j|D^Upv<>^RsbM|g3|ID-M{_&5Wx8;JP9*OC&3d1VT}pvq6+EQi26^@
z2v4C=qB*gtDLMnFI&AN@4<8s3sYWMG-kJx>P~52xc`35wAT1K-_+zu|2sfiog7t05
z!-Kjl0*`u-F<aXB0{x$GEgOlY>hG^6Xmkr^ydA`X1G{_)lPtzS@#Iu9%o<v^*3Cn2
zJMF&B*B%*tm{v=C_2u#<Mrenp@Kr<6p~J>eN0QT;Y?0i*n-2gX#dz^Y9{>purkQP=
zr8WYL#KgTnCP;}AKV}c2L<N4NZ|XUajcuutZUMdNH+bcDH3M`Dq{(W3+>4Zp#&NG|
zoaSzNPJxY1kk_~;TF|RoLQRPlvAAf25z26nL{>emFyrDa!AEl=2vE2`rE$tV4sMM%
zUIiUgV4x84Ag3=8ZtR5xaWz$MEGHWqSt?Go`Cy`sy>nS54Q;Lk@{E~ISyUMpIy1e+
zNx6?2gz$~Vz(2o<8RQ9EGXbpIXe>9G4mFV2>qDU<+)p+UrT`0A9$CW~(+PsK_8AbW
zA{x;)1h~|j+Gr7~A?Sbn)8gaUYm64(&HvQz=jQ!HgG@42IE36{YZ_Q9bdS1@(Qq>G
z=wSgFeq>_{d!Nl@2;I|{QdlI1_Q7%ou~KT?H{tG!(=(=eU2kds*H=aLestP0J!2Qf
z2k&I3ZVvJm8(ho`1!~1@^ZVZkoj%-guD|-*2{P91;eQtP?&F^$v(FZvKLkDK+_?Ru
zC@X#$N_y2}QoXxVobqX>1i;8RuVH*3Fc8KS>k8{Df!Xu3SHT=m9x2jQ%&5=kc~}(z
z!Urt~iN>1YKn71BTpk${xJ=&_o*bQ#^E)Q)Ul+E7<azK{>fy-Mhzbm82>SiBNS?FL
zc_}XY8n5SNkjppDo84NI2Ir3li{TY-dD;ryp4~L=T4q>ug#K8*c0WI`xqbJybFJs*
zR<x(E;L%UmoA9R#wzrG)`7IYaF=m~eirwLV!@)&2IQV8djnU<hMhYYh+5%wbkU7FF
zh}oaA9fsxb<9<c6WUzxu;uW(<qoMVE>-hm|lsV3#&8bmWJSr1MJ#QtWJL*K>*O<~~
zv$4gKu0&f&p~m>tOyVa}kTT8pvHAl|Z4#>QI$hS7<@@(6rCi_s&QXm?t65J5fAHJi
zcanT3EvrG(`R7lF^~xY`z3}#jw;d1u3aN|l(Y20$a_*k}>@xA|I*M2%zYT+eMPOR7
z1}r)VP5c4wOIYZGk?-r#I(EtzbHqxZA<r0yi#R-;1QeStpz)wInj!(O{f$`aJAgD7
zd*2`maZ#&iJTz;k86`*GT2VTTt5rOtYDcU`K4aF!JF^`uMD04`5qny0D|IxO3_a-L
zT1Z9rJzD(vVn6s-cRIi5TiyE_2^t)_$CK<=@wny&8GpTw-8vM!u3)Jrz>?2M>u()(
zgx|}R_AyM9w1#C81k{K_2i7p?B_n}R#2#Zk`z9NSr1}jQb(cpdks~~<S1eQBU}g%O
zPr9s8JnPHVjA(7*p3IK&i-F9&eUkZT9U=D3iLc+Eo{}X#MImV#GiCad(AVytd#qbo
z{^MUb0(zpNZM<xEP#Cvt9jYTwDL~Hf^HFSMIBWUqBjoXbya+B&LR6D~ePzIyg`NJw
zu;)&$j_KgHFVYpVBvSusoZfF7Ne9kvlRjFBe7tbNtydn)WOAEl?LLkGz}(wOT4Y2(
z92G7YK$_4*C^Mj+C{?|8F}G7DaG`ySVQ`u#h^WeGPRrwj?rek;g1V9f&5zzbzpRR7
zu>d=(7#4W(s+a}Z+u=`y$h!T>1$$?z*w;O<CCVH8VoCbwHZ2GHFoLyg^z{4Z$F<eo
zDL*<032+Df^_O<f{=N%jIo(OPa-Ji)O5dC)HkGBE)=GeR_oW`_26dCch}c!}L52t!
zDo6`4@L80eww!aIPiD=hh5QSr)V*|BTX85`H<KiJBNCTjb|81!1cq3sQ7d_p7f&-3
zbNKfkYYtf^zngLGCjph{X0y)tz?hNoom2}Dd~^S$mH(dDwVSvl*rj~D4aeS~v!?or
z?M-FP-|Wtp^^cD}h<`q9Ups2B>}>j@_tSIx^V1n#@Ge0k|CsCK_agwpA(Ed2LbD>l
zkW-+925AEkWpWr4HqxHkFZ(V08{hbxySHCFm;_zU`)Kh2Cq7bYMK=Yeo3lOF4Jqjj
zKj<}SoNYQTa16m_*cvJHIUjJH@Gcn@5~w|PBVI5Wsi&KC$N5t!SS8YQ(xP4ISFfil
zl;*Qtda5yaBPZCq5k6sTX6?@WeZ#W;%jC}^FPGw_pTaC$TGiI^TwE<THE4jJa8#hF
zf)GgAq=I5fzTv^)#LH2xpXj<{d7|U+Ko`Z>;aCO>PDEXXq1(s4!1r%C-&jY|{B5%@
z{K>m{Q*zNg@&3pOHc%7av`bY&mE}eLGU{h@aPrti__a#(Z)s)q+&$)<ck>1P=BZg5
zP9)=2BR|F#I|G*)gbt~5Z(lw5O39;^^8}Y#HPe_gKzLOW;G#=GLU76OmEoiqt>`5c
zT0L5pm`+RjYhA6F&5!if9a#nW29Ixw;2pt{Ac5awR*%-`kSTZn<#|;nAUaiE+hfV@
zTggby+fYwA3eP|E`j2A4I;CtpN61aJW6!C-a@63zDTj&ZeZi<%iZ6IX-&NDexD^Kd
zPvQ|y6fF|OPB~eVY#)Tf=326?dKxml`vnTrAmdq+wXRnBj<RoKeob}l&GdZZ5i1x9
zMXxUA&#yI1@~_5N+kX4GA^*4T*8`z{Vi-WnNsAVYu|lUos{m}6ojNQ=q95)+_}n?=
z5NYQN-_0>_j2w!=^^Yh4gYCG;U$y_E!i!zj@}~h;5xvwX%Wz%r^q`~}hW^ov36nuM
z(p!)(Ycd<Y+x--jW7%YyxtG^9TODNdrQZA3^;h}27U$O_OiJ{meXBjl-k#7l*WF1;
zj}=)u1OYY4fPZ<_1C6Umv#8V(C}4!v0Z<5Tq!N)Id9x<ckF|VVm{+(3V%+s@lpk0Z
zf#@83F%ZCZ&IUrur*U}r*CI)nDfOOLFPs23tTfrV5=@0p3~@u&tt=G<K~<{n`<zTn
z++PJ0DIh(!bHZX`CQaVkH`TEC>&)caf3I)xF10yw);U+PX%jhnH(~p%Zr0g_#Z?M-
zJ#g}A;XMGvsj&?Mq0lDOiTGGlFI+Y;Qr}=W=Y@V{EY%1;kPI8Zj*n6&!VE@XOOOC_
zj(4P0iSE#Re<qs!iB6_u)yRH?FxgeilAmjw7OPL<>;e7rIJy*Fs{P=v2ZN97(BEb~
z8&%c&J>-oNdJvxTnru*Aqj<6UpC`|I?Ai`KIFOxf72mepp2a*cH92{`asQ^_wjt;<
zn<f}lhki>uL{zekHd5e(6PVc*9Paw1nWL%Lc8Tx9mpu8Wq!6By%Aybq#hD1bs9t=7
zdd33=FG_A9tIdm6bpbc?iZG88&uqc)!pDgpSj7mLWrXD0DE{f(=(T`czqoyUFn;>`
z+(;mIFE5k)YfDtN)zhL2dtb|5fAA|Es1@-vWj*REUajX<YTLh4s;19Fq1SwC9scCn
z(}Wl)bPWz$i8@*VqR#b=#6heJ7cCfr{*V7E{ET-hgZEdpHuKcmBSRCVC{>ThrtbKc
z&HL(h)VO)TI20Iyn@tieN4}*c=rJ->pFaB*wW|6uae!Qog@@gIWQ8&Ss$EzU)@W<t
zqaj#;{HLj6MdSv0(ma^m{gUQmEi{)zvfEH5$k|zRDS4sGSKDT%y7KAx>_Bm#vE-@O
zu=nR>sv%W%xllS<xd6%Vco&B4jih&Tm4q&Vg?X<{h!XhG#7YP-dXZ{Z9-CzcWzlHH
z`{)o2#-pBfa&lH}b#qijX(xU08W-O3s#mK|!`n*nH0Ur%ah&z7%Qluf7tn6Auc(Zn
zs$_W1O-?;fX{;I-R1v0a{(eoWimxcFOP104wU_Aa8(DK6>)6`V71-KxWQ&(dto{o+
zrGtCi?^~}I>_=|Yu2);nfAfOz`2jRHc&Z};g>yH8<jG2z$+e6nxU$fM|BWV?V54I#
zO=`{u@pZ`&u1M>bAId<h^V=&7#FCt2U)xi-6BJbm*t~4~E0mkRcKx!|UJU249S4Xm
zT=sT{yt6@&>7HP*g>POhlQWl=$MJ$E{~Oyt>$S4HDdRnFQr#+NZ;OxP`R>1e?^(8e
z=j@N+lTdaR#=}WN7@V=bx2))&ALgou<)D&KfB{Q2m^bHsL@K}+r<5|#bpYeHKz}=%
znXnpYAA_j?ldg4M`1jata5J*K`=2mJoE(}xq|{Q&*p`-Nv>|7bsr9N;e0}9RV}4!P
z@%7%YC}<n^aoA?)1HVY;Pt0jmsG)w1?}<CYPjmgK&$iqj261+{Tgb;Y=)RrW{y1@+
zo6WMv@JDr)$iqevoRnp=(;EGd&nrU7jzH3er^tUgNjwf9GeauF=I%C8AQd26q>JoG
zGVjy=k#J!-ic_!wiW4#iJx1dZqo%`%0m^ouy3&vUAe>jEo}l>g(V<7hH15}LG~b+_
zJI8Dl&rG`~q058t*{{0j{4Jn)AkLCJeNKmFU`MH?wU)gv>*GCz8j1ezBM(HXd{*ZZ
z=eN(qAEb@)2MYej|8CrKK2;UbRXc3y@Q7Qerv%MoC0rqSffuVab~x9KUz{X^>EEBM
zd0+Be1)eu07MWacOnBLRpZB<&^$@}*cuf8I$*RNIzxc}@<F?&QXWyP=<7Y2FV{w2S
ztTJc<%LYoJz#)jDqvF9Rvk{c=DmF!f3AH|1(MB0o*B3qRC?h~5^A1@p4qT*zL|GdX
zNop7&d)k#|hA%Z8-;#{0m*Wg+*rRURsvgMU+ER>;QpxOJuKZ;j^21q@V_N-Tt2(m2
z^K%>T*^6%*|GZFJjUJaa-zPcg99LX2okSnOLZ$z9-`D&2dnM#FeIu)9VoKLV@mELi
z`Mc!nO(nht+0&r68_V-Y%NL@qm&4vNI!d}~qJqLmWDSxA%!Z5bMBWEQ5ulAlROnj-
zqq7v~0{oajB*<)hKWL*J(jKQAhGaqt15F6Br}Mwibr#3{HbIpy86=pAc=zXsh&a-D
zNp%(6bKaDoeYNis?V=|iP8PLr>15i>K@P6hG#}Hi2arm-J`GtHY-pYu6Y#b4TN#oT
z{G1hQeHcDJwr4sRrxa1Jh{qP;Y9-O_TDX+Z`}BvwhpZhYhU>Ur#yF}fTQNz?;Z3S8
zc3JVR23efENN5BCgsJAh1^bjRlf@CdI8n?g<yrpyD-}Kjd0i2cBm6q0k^!ZZ1+6k}
zX2mgSK3Cz+94^e-;-dmXTgaICm8<1OXLMN}2J~?ldN20*SG&F+jY}jh7m-=78^@2%
z;&t>tp)yjweA2*a;6RqlC*Q_2tapA-T8Lym@J;vbk<{;YoqvvwE%Ih#C$GMA?3?Mm
zC)ee@ecOu+`fG}5syLDRBz+o@(C;gY!jNiWnve(-9Qhc^jLaG&6Ju7pk4(V&AUQC&
zxR@L?446f0V<bp`*Ah!<Ms>q>e^>#Wp!b57d=ZnA$rI5tbJ0d$N=II=Fyt0>PQ*%@
z=`m`Nq%*3zsL!T2#PvXFvaPsGiOd)apR$V8IQ;(b^^>{#UX#kpBcsI!;*@XR$NtCv
zub0n1SocOvF#LM$(ykurCSy)K4kc~$8^h$=?ce1;4_`3m7!35q1}H?{i^^ep1Q$+m
z2uZwL2(){p<t22Vw}6BEE5`2I<J{3*S`opFR|c8s$j=%t(>y-Nk+mERvmwZ*2_X;=
z20<ACmcp95B|=EJ7f-}>xFVKjJ4Br)4bjY-MnU&}7`+qNkE`<F;CVwg_&E6pI>>5w
ziOtDS0za>a(VUA$B)zDJc#_eGsYqFw;qM9@2~4K2Icxp>Te<8=N~p+4!7zkP_UT}k
zjro(El%?Cr&$&gfL<ge#HaRV_YPd7YeyfNRek6Pgm)rjG$!Ni{l)>Fo{9iXCm<-^7
z3*Rj*d*m!K^`_OD6_ib|#Ehins6$F4k#M+pWN_>>UPR=V{QAC~>U0?l9tOAU*E2@h
z<A1&j3{JtG7}9djw$F~zrRk9^rDdM4HP1H-r1+Au5Q5zm6=F%K_mxWw&iw45L{tmB
zv$|ndQ>I4`aX*Z!HQ0qKju)%!$F8pa<cuKwyO*=%+|U_bTkIY{S6cYp^i)rSUL8e6
z=(tQMiC3(2;;PK)J2K$Z<owKlIw6zg{NPZee^VQAx2p&MMW7tuP=FRrS;C&fU7`VJ
zV|h&{yZIyM{-!vb6w670aWw^PV`YJ`yTvY+?Vt+$irFk<aTns1fbU_})P~ZKVSOEb
zHuN|CHBjF-Ly%`8F{#{05?YE(@XRAlSJm~Ac2(Uym(M(Uh7m6Q<7>J)Une<mDj$q?
zj2b`SGc787)*PWND2%mvXy{tAn%5)1aO@b6+4{&P?;y(Elwxf0ph+h#O4@OI+xXRP
z2&-VO2<^^5^=h?Ls)ZX02e86clbgLJGlzG@rzW9>i<lsWiH-P0vzv=0d63A&$JEw5
zX4D)wbM+y3`UaN&*r?)B#|DHL9eW7pxw91w3+`v!V<Vk7emQCiMh;HZX+qaH0<N@t
z0&uD^y_1uX!O8~}p`13|ftc;CH-}TzADgVqBrWAv&kJ1M{Kx-o+*@3KY}5p!Z}-P)
zj;CyO_jt$&gxt8aS2_?8yClK4x3rG(l1W<vnkFPOm*IsUEeGdrZ1w*+_HyPN_INO}
z2X^vp<n%Y1P(X2E7<)7fM;*$NjGhp2rsNN_?}Vu1ftk?!c<T6A9e(N|I)D{UQG<tX
zl0a;R?|D4_<FCZS_bm171zAbsuLz8*6ih<iN)GK+wp2KqS^1v`6O*6SnZEzR<+-=g
z7cgsa!nc^k=aj4xZgN2X_QBumh&hX<klmI*drJ>9n+!(WcAGN6)E{zUo_Q|A?>s7?
zA$KvRP`uL64(f>GFlRj7ylW)P@@J_dJs<a#VBRkMBXA9H#}MgVe&5~;#nYkfh4%u^
zI_jh)`?Li*x=~MhTWNG)s6*^AF^muO1d99Zc&3Dt6i++#^;x)6eGG1r_<kJ6Yktj3
zxE{mI%i1!8$w2gRYfM+r$^7*F#VoqYnJPu%pFs~F_mXDWs2jE~=w^K=2_8!EidENd
zJt00{5}5n?jCZ(S+QQiGM)}~MzVUZHMAxrN-^uU13|@~-S>o$zyL|6ituUtROZwFW
z9H)#JuIuRi@%3omFLYBDfjYu|eG#c(!VrQ906sV#hyW8u50|8+ja>yX!>TWnHO)vN
zy_hE?a3=5wzS0B?>)PI)ZJIC1LoxeHqrbf3K3Y`GsH5x_s-AW{*yo|Fcf~gUQ?M<^
zm(adHM9jvT&o_0pV1Z?)ABSAMO8AFoj(MiRmly$dtNNC#hfSWBQ)+9K&G*>!@|>&u
zsWZ(@%d00dMP_&(j-)1Wk!;${={R+6E!>`IRaqva-a4eM`D%JF#+LkQL*j!Uqjiu9
zAU}wKEHW7nLS=L%>%n^ppB4n+pb$hbPy|1=3o-$qSftm)Wy~Iwmc7I8&FJLStDFU4
zE}G`ZtKZg=EUb*blGvpYNhJ_V<;{}GYAJ5$+&8b3x3I~j^KNlmL@6438AsM=ytFk<
z9hD7hR7;?}dAn0FD@GZyz_P1)$G_tZ!J?3NFW(*ijfqR3;JA>brhcf9+|1aT%tr4~
zu2k*woT-m{2kw^qB(#67#<~u}i}%iSreqXuTW~fWBwV=U)+gQs^@Odsj}9-V3(r6F
z4&Ls}Z4Gr^y=qIH&TL1+LFz=C$%G&k93NZZaKM4ilt;QFtQ<~Gj|_vBLs7~Se#T48
zFdt5eT;0G|kRG9{$?}YGL3NLrPw@){$=c{zAJ4#$mx@&%M&T0oS!=Y%7o?{HnQyk`
zDq6DA;2Jgfd5)CLpQ@Sj#|Yu}>Q})7SD~73GxpC^ggvjz3tg-3dkj5^+97dSHy%Fx
z^(ywjVZWKr#bsYc){g!A-r=FCSy9&9+FO^Q?)vnzpO!o7suQ0(mI40}Km;f$F{1#=
zfnyS+CE*s-FF=$<Uj;WM6{!kl10$%BETD8eGyx1U*tL`cso84DMD4T`zLT;RlZVNg
zypgMtB)*@$Mu|K2W$Eu0F47cx$hSZ<pyG=?Y=1@>@5`Cb6zi7fezzrXoJ5Fx<)3d2
zv$avfcZJRyuF~?LmVlVw@#p-p_g;tlIw#?O=8xLCctguC*RnWPEHeq>;b@;&@p9~;
zD&F^cI`}@9)=<Z>SieS7-iTGPOe>#G2p|D8fj&SRc@LPw!6+h=nAymcgXO|#K&(gj
z_{Z(EX%RCK03itD%<!g6=YyiYJwpd~x>*2Q<DfZ(hP*}V`g<ws%R^7=Wm*<7AK{(#
zk9w=cZ+@FuMaj4aD}BYbW^8+39fcdQn5HG>2DIhoB%ipH7?&;h58U#-e%q#<0Frcz
z4DxY~@@sS6<Nh2SGs%-$T4a;xLcFi?+Nolg_RY6;Ugn-QHh{yiYnPkTjuo&!eORgZ
z#yA%JSC|(>2{GV8;s8x#_Yk!A9)@_TFL1z_$Tdz%ALICh$S@VglaY$^r3^Z@*q44g
z52VKXhBEN6ki9fT_?QVSg^EccQa?pn<Vk$qG$r6PuUH8Z*6a5@;_Ymyx6!3opF6Bv
zOP*TzkN;osS%f}HEfY-2uZb^kp7f8HJ!ZiZxO`5Cm9`x$M!3D>q~CDaUAF#U@#sN!
zyAacFY02ExzCxx;1<|H#GvSOc6&Xew&s`EEBRc$K`BKbFIA28WIkAc4bAnLyA0<8x
z=y2VoAst$<mvBeyHZP1w35p#6DWOK}ltIzhiDO$mZ7G0;Ol%&BuEB@*q6(NPRA1nK
zK@m!SiZF^LlEs^H<}`gdW}oYXQ+gjyS3=EEA^pwT%Gb@+-4eT-Z*1+SMsztQ6^fkO
z>L*(@+D)RpkIkn0eO(<iXvRmQru>yy&IUD`w9_U@`5&7li>Uvu{o}bdKPko^=&$dS
z)`2`zBURt-19DSQ<T}`S0EP=>n9wEycQN080aiS{)+@&W1Ec)wAcGM=oER2mRe^_L
zY7P{}w+o$9@zbZ@1NVxhSm$~po4CSk;IwasZkS`2n{uBK)aFp+axgi>j2{|HT2YlU
zNE32KPDzP0Ij5bfURA_3WUKb`(3v{4eSZY1pXFcmYR!Hp)KkoJ>%xb$3_e_}f6x=o
zx$UTA8Yh)yN5aYUI9*<eoB|cu$N052K7!#oX&{#FdF#xIxl-4mkE}`uw+d@64w4Xz
zZN~=yRjen$giw^#5Ci8+&?ssMiaSA%A;W6I;z2rCA3V!ae|sI;!)zD@*^g9j{5Y*-
zeUq%L$Kxgfh9r+(NF1vCOxH&$bEz_Aj_)6OI#8TFuZlwK#JL|O8?6yLUp$AWK1mus
z@P85f#L(zCVvbCoSjsSdRI}sap|t%u|EH86g^ovAAAUujt5M6VIdk3olyqQJh+4Nf
zY@5()PD~ei;PZEtvzQ`jDOYGL3WHY<$^&6?dL0R1L?BFmnBruOCcGa?qC<qy#BxJn
z0E!)(0=7t)wZ(Pt;{GN7(Qk*(>um<$LaLLmUifu1s2rAzkmXJ1R=C`6!nPh}`JA>I
z`-^!zUtlt`S|AG|bhsGT*uy_a{#i)#%QmBhe&J!zv&<&JM~eUPe;I#{@Ioa_Fd4N8
zN^S<ngqVGqf;J%i#yTaKdyf!bWaykcTf+PZv}@T@^rSxeC`YAz@>^`HJQ05m&!nD7
zy37^sx_kr6eop55&^j^j!pL{RiC2vwlrRJNn&<`4gdt<eTEmh-bzmxJtmBN%CHY7n
z0-+QW7o9g7<&U58iju=)a+^k!R7EX86w^_zNup65eFUb=5|Yeii)Pv3N#i#N_o-s(
zO+V{!;?momIe{^X#E&Zk3#^&@lx37THTP@&a(Yp8V5CH0njG-N<eRz+!sast{yY9A
z*<zE7ENc^j=R%<oek{rN9(YLb>a!luu}4IyuUUT7G5r*D&D#7)!qkU=n5$wX5zLJR
zOhI6@AQAxBfD~q2a8pz-TOI|4Qlt+_G$4fmDPdt~N1z<#nmkrDHACW5JV?K6rkiE*
zsc3X1gVNwMRFcWxw}q;&Vlwb#DW)X<ZRPP(y26>cwKw}}4vp;r_J;RdcfZ;BPM))i
z<2cr)(H0x38|pDEFuqRFJX}xhAnTYM^(e;)l6-&%zQ^j|MBco$Z9>87yrR675`=F?
zM{|$z;{ETW_wPSJ<IM@*xf<fc{LnXC%28k<8jXnn=YRp+yS8J<AUUMKOjJ8zPCPNF
zvo|~^9AY=f>O7cJF$_gW$?BZ9fX4|^UrZDBYt^;R8RU}1Bp>^{uO{*hgd<h%i=~MP
zxqpdSQcF9o=J>s9uOULF$oZY;SIAkSGWXv!)C<S+m$N-INuv(hCQH)d;x|5te{N}b
z__D^|j&BhtNyz;TP3}oBY2#14ZA~`&p?+iHSJx#sd-EgU;lGw=o#U5&m$^OO{llXi
zJa9}!?NT=wfMHV_eI5u0Qz^KM3Xh<WV#G*Q2sH%fx&Kyrwb<!*qO^C7-=h-dh;#AX
z$+Bgtx1(d^Dw-6ioNR<8Ni^~8$-_|WWdai2cDUq+D`gBG_mtJAFNJ&89{i=IH8d-}
z|3;wJShIDHY&C@b)cR@cLqDt0`27C=_`e`nB=l1f9c5;1)(bib)sisd=!bs18~=`X
zFh?BbO25U!Q(-9`okyyNzvNAP66-sq?BPE$|C&7cAS}BuRt%{DO6@^DW_acPWZC9Y
zPU#a7n%h1$8bEK-VNgrhB{Chpaj8ZA(g^`n4mJfkUf@he|D?sB-OX*BfybHb(WR<a
z`G&4+?5qok9Zc0eZ8VVTY3=h8Es1#lky1Ces*J~!N#BZG0?Sla$M)d@-;Yv6E~)ah
z{mBD4J+Mqp9XjGnnN0D{eXe!ukte&MjJ-m1yZ6P4q&ZnfMQbbUw^!1&C(78FY}*80
zz3DHDRSpcCPp7Yans`LYd*3U_y!nqvwA=bX!+U@mObG#qZ4*EjK7u)Vk)RsQ=a3i}
z6){kPPmWo>L#lb%l4DQ<E?RxjPa5r(yA#0{r>5Z@u-znA7h=Q^$1$&Rtphg?zkCKB
z$n;C5=CCfGHKK&QnXOII*dTvaU|j8X|JKyvtnw43{pv6?|38h~#^!|&bZ3F?R5-aM
zjaV_aBtGXCSSByMdra-iNjrub8hnFP>RuyJN4N(%sHZa!Ds$0ML!I3RabBwKZ~+^h
zb{7-~fCA(ZB^^jXIRTug781*HcROREel(gSw-<|_@@8T`r`%j~n2>{Xls0PfRp3^=
z{dO6CSp)OVQsQ;>c8IJbQ^M?h&K}v8Q1=&}rZ{39mpJK=rq(i&UcQ1<;z^ao0FfgL
z{!Hx-cfx$n{H*Lp4B`RQA*ZJQ);TK4sYdAX%pNKKvF;8s{j#5}aFDRG)nqu=9pZrR
z#Cl606W01yNBvB8?H8<-cAcnxmLxUQ-$vw$2L-Q)=#SwiKPH>k)I=Yfa|@znb2poY
zSP8OA7^rm0LBRMWY1hwYKV@sSOr=wU);e9@Hz9*n(HCa9#grel>+AKr(5+otd;}WU
zhb|v3i#eL@IBT;)xQP-OG%PG=?SEJ1zf!ATv^~3g_=3Csc(!|bt|a;0_<C;sRJd)+
zdxdAWKU)+v?)X=|BFJnDK=Dm59Csz<-~@0knid9uO@{!&>-U@L?~j3!E7@mJ)T_<;
z*7hMy9acTg;fFz^u_7*~`7Oi-s&vJ1<zs|9_<vsf`t?1{{x!#DiaA<}LIjc%gI|RE
z9zan{M_}+>u?R*UgogZ>t)ZIM_J@QJlV$G8w_oh8y@{9qm0OQ}uFO@Vqle-KI{6s|
zKctX5xI#8bG76IBii{FGX8rP!qyaA|o1C?Os@~=R=S%-xitRKh&>{MrU;D4p=e;$$
zgJae(50h@moSUq5@$P@mo)xT$dZo%sTDa$>hrT_s*iBJPx;e9Sx%eCLknhM-|Nc+O
z*qoe21-_?dIg@;U@}DIdhkh2v3wW>ftZ3@b>Ar(uG!{*Uc@n4R<Xak-%oRe3r=N%x
z2S-m-vEwmLeAX8&!wlJzkrj-5MUlZrz){?oj7M5@l%?n)?bO^CQ5ZINo3yR52&E}r
zQ5MZ<#jtVIFWOXA(AUaIBZSG^><9j))qK8Z$`PQU7tt^b8v=ibj*tSPEportTvk{p
zb8eQOjSRWD=#QM6ty|2Oiiw6n)1ZX?r=M<_pQ7Btdp6p0Ow3an_XzaF;HpqW(0@nf
zg8%x;k8$MYvZ}JeW)P1d5+=E1Qkc`JJKyb9*x!bq*H5)LMj(0|P<>=O8D<L;3widR
z@Aj5QabNhIQ97ZvmOU=_XgETmpo*UX(az4}KaWY2ad`GWH~l}=-<KXR$pY!*z}w^g
z|GoNY>|KS0g2+$=xtmviH%yW2_XAuNXVl80K0h7|3IG6P8AMP>)QQbeQz9Z=OI(mP
z@<qI4Bsi(NVlN4UaEl?+vn$1_ZgPV>$KN*3Lm8G9d&AS;5Qc*WCZvqKozo0o#FD6#
z7;r1NMT^aGGGL{tC2*ZpLGsgC^DL2jfKplGW3>Z#MUHe1zN77Wd9AH%gdyutFBS$M
z4545M=8Z8F;OEYOM?ZbJ7j&KYIcc0D;6MH^07Cy*EiXS5NN@Vv`s6o&(&>TpzjJ^v
zq28&b5d*So0SLB;0Ohduxc64!Pr`3cv$1D<V_aOD{=bPx%wNZ0ww(+eGd|tkD&GEF
zf5tdIK~eXio8HRDgz?_28lF0;YGisS;P(3VpW^M!VCU})L&>9tIW?A%zi$rtqDRnz
zE5xr1GvF3tvBIDiB)Le-yOXJkm;c+Zx3>qR)LD97g=;Nd#a(^FivPD~$%0_~ZfdwP
zL3r8XkzJHRlJMtXH^$te^+JzBOH}FvAO%8#P>kSemFOjg0d_&<d8Ozj-T0Y`SROvG
zvO$Jpd)w8KfQMLzKd!pI+i3j3Vz$MGwA;8?hwsjK_Jih0L8}hmmBqGt56e5vZ?SdK
z!{YbKLcO!Ib6{P)#oKOa4~skRf5pS{e`>R~|D4V)0v>mo``ALM{zXZz{s0xX_w9|6
zlAf0TW4uZeFU<l6@<bF14eh;jT3|w*LC-11WGuH(w5kgrvmjPeQ%P~><>lw+Cyr=r
z(Jpk?tgfy(o_x((R`%|$l+{{^65R=d;r|%6u!&DK2Q^)yW)l+=V>LB3wXpwDc>hQ4
zUc%2mF?o1*sqJR++3jB<B0S~3I~nuj8YCp7zr~i6lo;HJ_k|MbPAyyb-{lX}|9{B;
E1)K9LD*ylh

literal 0
HcmV?d00001

diff --git a/src/components/Layout.tsx b/src/components/Layout.tsx
index 01aea8f..31a9c7e 100644
--- a/src/components/Layout.tsx
+++ b/src/components/Layout.tsx
@@ -7,10 +7,11 @@ import {
 } from 'lucide-react';
 import { 
   getAttendances, getUsers, getUserById, logout, searchGlobal, 
-  getActivityEvents, returnToSuperAdmin
+  getNotifications, markNotificationAsRead, markAllNotificationsAsRead,
+  deleteNotification, clearAllNotifications, returnToSuperAdmin
 } from '../services/dataService';
 import { User } from '../types';
-import type { ActivityEvent } from '../services/activityService';
+import notificationSound from '../assets/audio/notification.mp3';
 
 const SidebarItem = ({ to, icon: Icon, label, collapsed }: { to: string, icon: any, label: string, collapsed: boolean }) => (
   <NavLink
@@ -51,19 +52,53 @@ export const Layout: React.FC<{ children: React.ReactNode }> = ({ children }) =>
   const [isSearching, setIsSearching] = useState(false);
   const [showSearchResults, setShowSearchResults] = useState(false);
 
-  // Activity Feed State
-  const [activityEvents, setActivityEvents] = useState<ActivityEvent[]>([]);
-  const [showActivity, setShowActivity] = useState(false);
+  // Notifications State
+  const [notifications, setNotifications] = useState<any[]>([]);
+  const [showNotifications, setShowNotifications] = useState(false);
+  const unreadCount = notifications.filter(n => !n.is_read).length;
+  const previousUnreadCountRef = React.useRef(0);
+  const isInitialLoadRef = React.useRef(true);
+  
+  // Pre-initialize audio to ensure it's loaded and ready
+  const audioRef = React.useRef<HTMLAudioElement | null>(null);
 
-  const loadActivityEvents = async () => {
-    const data = await getActivityEvents();
-    setActivityEvents(data);
+  const playNotificationSound = () => {
+    if (currentUser?.sound_enabled !== false && audioRef.current) {
+      // Reset time to 0 to allow rapid replays
+      audioRef.current.currentTime = 0;
+      const playPromise = audioRef.current.play();
+      if (playPromise !== undefined) {
+        playPromise.catch(e => console.log('Audio play blocked by browser policy:', e));
+      }
+    }
   };
 
-  const handleActivityClick = async () => {
-    const willOpen = !showActivity;
-    setShowActivity(willOpen);
-    if (willOpen) await loadActivityEvents();
+  const loadNotifications = async () => {
+    const data = await getNotifications();
+    
+    const newUnreadCount = data.filter((n: any) => !n.is_read).length;
+    
+    // Only play sound if it's NOT the first load AND the count actually increased
+    if (!isInitialLoadRef.current && newUnreadCount > previousUnreadCountRef.current) {
+      playNotificationSound();
+    }
+    
+    setNotifications(data);
+    previousUnreadCountRef.current = newUnreadCount;
+    isInitialLoadRef.current = false;
+  };
+
+  const handleBellClick = async () => {
+    const willOpen = !showNotifications;
+    setShowNotifications(willOpen);
+    
+    if (willOpen && unreadCount > 0) {
+      // Optimistic update
+      setNotifications(prev => prev.map(n => ({ ...n, is_read: true })));
+      previousUnreadCountRef.current = 0;
+      await markAllNotificationsAsRead();
+      loadNotifications();
+    }
   };
 
   useEffect(() => {
@@ -109,7 +144,9 @@ export const Layout: React.FC<{ children: React.ReactNode }> = ({ children }) =>
       }
     };
     fetchCurrentUser();
-    loadActivityEvents();
+    loadNotifications();
+    const interval = setInterval(loadNotifications, 10000);
+    return () => clearInterval(interval);
   }, [navigate]);
 
   const handleLogout = () => {
@@ -462,52 +499,94 @@ export const Layout: React.FC<{ children: React.ReactNode }> = ({ children }) =>
             {/* Notifications */}
             <div className="relative">
               <button
-                onClick={handleActivityClick}
+                onClick={handleBellClick}
                 className="p-2 text-zinc-500 dark:text-dark-muted hover:bg-zinc-100 dark:hover:bg-dark-border rounded-full relative transition-colors"
-                title="Atividades"
-              >
-                <Bell size={20} />
+              >                <Bell size={20} />
+                {unreadCount > 0 && (
+                  <span className="absolute top-1.5 right-2 w-2.5 h-2.5 bg-brand-yellow rounded-full border-2 border-white dark:border-dark-header"></span>
+                )}
               </button>
 
-              {showActivity && (
+              {showNotifications && (
                 <div className="absolute top-full mt-2 right-0 w-80 bg-white dark:bg-dark-card border border-zinc-200 dark:border-dark-border rounded-2xl shadow-2xl overflow-hidden z-50 animate-in fade-in slide-in-from-top-2 duration-200">
                   <div className="p-4 border-b border-zinc-100 dark:border-dark-border flex justify-between items-center bg-zinc-50/50 dark:bg-dark-bg/50">
-                    <h3 className="font-bold text-zinc-900 dark:text-dark-text">Atividades</h3>
+                    <h3 className="font-bold text-zinc-900 dark:text-dark-text">Notificações</h3>
+                    <div className="flex gap-3">
+                      {unreadCount > 0 && (
+                        <button 
+                          onClick={async (e) => {
+                            e.stopPropagation();
+                            await markAllNotificationsAsRead();
+                            loadNotifications();
+                          }}
+                          className="text-xs text-brand-yellow hover:underline"
+                        >
+                          Marcar lidas
+                        </button>
+                      )}
+                      {notifications.length > 0 && (
+                        <button 
+                          onClick={async (e) => {
+                            e.stopPropagation();
+                            await clearAllNotifications();
+                            loadNotifications();
+                          }}
+                          className="text-xs text-zinc-400 hover:text-red-500 hover:underline transition-colors"
+                        >
+                          Limpar tudo
+                        </button>
+                      )}
+                    </div>
                   </div>
                   <div className="max-h-96 overflow-y-auto">
-                    {activityEvents.length > 0 ? (
-                      activityEvents.map(event => (
+                    {notifications.length > 0 ? (
+                      notifications.map(n => (
                         <div
-                          key={event.id}
-                          className="w-full relative group p-4 text-left hover:bg-zinc-50 dark:hover:bg-dark-border transition-colors border-b border-zinc-50 dark:border-dark-border/50 last:border-0"
+                          key={n.id}
+                          className={`w-full relative group p-4 text-left hover:bg-zinc-50 dark:hover:bg-dark-border transition-colors border-b border-zinc-50 dark:border-dark-border/50 last:border-0 ${!n.is_read ? 'bg-brand-yellow/5 dark:bg-brand-yellow/5' : ''}`}
                         >
                           <div 
-                            className={event.link ? 'cursor-pointer' : ''}
-                            onClick={() => {
-                              if (event.link) navigate(event.link);
-                              setShowActivity(false);
+                            className="cursor-pointer pr-6" 
+                            onClick={async () => {
+                              if (!n.is_read) await markNotificationAsRead(n.id);
+                              if (n.link) navigate(n.link);
+                              setShowNotifications(false);
+                              loadNotifications();
                             }}
                           >
                             <div className="flex justify-between items-start mb-1">
                               <span className={`text-xs font-bold uppercase tracking-wider ${
-                                event.type === 'success' ? 'text-green-500' :
-                                event.type === 'warning' ? 'text-orange-500' :
-                                event.type === 'error' ? 'text-red-500' : 'text-blue-500'
+                                n.type === 'success' ? 'text-green-500' : 
+                                n.type === 'warning' ? 'text-orange-500' : 
+                                n.type === 'error' ? 'text-red-500' : 'text-blue-500'
                               }`}>
-                                {event.type === 'success' ? 'SUCESSO' : event.type === 'warning' ? 'AVISO' : event.type === 'error' ? 'ERRO' : 'INFO'}
+                                {n.type === 'success' ? 'SUCESSO' : n.type === 'warning' ? 'AVISO' : n.type === 'error' ? 'ERRO' : 'INFO'}
                               </span>
                               <span className="text-[10px] text-zinc-400 dark:text-dark-muted">
-                                {new Date(event.created_at).toLocaleDateString('pt-BR')}
+                                {new Date(n.created_at).toLocaleDateString('pt-BR')}
                               </span>
                             </div>
-                            <div className="text-sm font-bold text-zinc-900 dark:text-dark-text mb-0.5">{event.title}</div>
-                            <p className="text-xs text-zinc-500 dark:text-dark-muted line-clamp-2">{event.message}</p>
+                            <div className="text-sm font-bold text-zinc-900 dark:text-dark-text mb-0.5">{n.title}</div>
+                            <p className="text-xs text-zinc-500 dark:text-dark-muted line-clamp-2">{n.message}</p>
                           </div>
+                          
+                          {/* Delete Button */}
+                          <button
+                            onClick={async (e) => {
+                              e.stopPropagation();
+                              await deleteNotification(n.id);
+                              loadNotifications();
+                            }}
+                            className="absolute top-4 right-4 p-1 text-zinc-300 hover:text-red-500 transition-all rounded-md hover:bg-red-50 dark:hover:bg-red-900/30"
+                            title="Remover notificação"
+                          >
+                            <X size={14} />
+                          </button>
                         </div>
                       ))
                     ) : (
                       <div className="p-8 text-center text-zinc-500 dark:text-dark-muted text-sm">
-                        Nenhuma atividade por enquanto.
+                        Nenhuma notificação por enquanto.
                       </div>
                     )}
                   </div>
@@ -515,7 +594,8 @@ export const Layout: React.FC<{ children: React.ReactNode }> = ({ children }) =>
               )}
             </div>
 
-            {showActivity && <div className="fixed inset-0 z-40" onClick={() => setShowActivity(false)} />}
+            {/* Close notifications when clicking outside */}
+            {showNotifications && <div className="fixed inset-0 z-40" onClick={() => setShowNotifications(false)} />}
           </div>
         </header>
 
@@ -533,6 +613,12 @@ export const Layout: React.FC<{ children: React.ReactNode }> = ({ children }) =>
         />
       )}
 
+      {/* Hidden Audio Player for Notifications */}
+      <audio 
+        ref={audioRef} 
+        src={notificationSound} 
+        preload="auto" 
+      />
     </div>
   );
 };
diff --git a/src/pages/TeamManagement.tsx b/src/pages/TeamManagement.tsx
index 46fd97e..7e54df3 100644
--- a/src/pages/TeamManagement.tsx
+++ b/src/pages/TeamManagement.tsx
@@ -1,6 +1,6 @@
 import React, { useState, useEffect } from 'react';
 import { Link } from 'react-router-dom';
-import { Users, Plus, Search, X, Edit, Trash2, Loader2, AlertTriangle, KeyRound } from 'lucide-react';
+import { Users, Plus, Mail, Search, X, Edit, Trash2, Loader2, AlertTriangle } from 'lucide-react';
 import { getUsers, getTeams, createMember, deleteUser, updateUser, getUserById, getTenants } from '../services/dataService';
 import { User, Tenant } from '../types';
 
@@ -24,9 +24,7 @@ export const TeamManagement: React.FC = () => {
     role: 'agent' as any, 
     team_id: '', 
     status: 'active' as any,
-    tenant_id: '',
-    password: '',
-    confirmPassword: ''
+    tenant_id: ''
   });
 
   const loadData = async () => {
@@ -69,36 +67,12 @@ export const TeamManagement: React.FC = () => {
     try {
       const tid = localStorage.getItem('ctms_tenant_id') || '';
       const finalTenantId = currentUser?.role === 'super_admin' ? formData.tenant_id : tid;
-      const password = formData.password.trim();
-      const confirmPassword = formData.confirmPassword.trim();
-
-      if (password || confirmPassword) {
-        if (password.length < 8) {
-          alert('A senha deve ter pelo menos 8 caracteres.');
-          return;
-        }
-        if (password !== confirmPassword) {
-          alert('As senhas não conferem.');
-          return;
-        }
-      }
-
-      const payload: any = {
-        name: formData.name,
-        email: formData.email,
-        role: formData.role,
-        team_id: formData.team_id,
-        status: formData.status,
-        tenant_id: finalTenantId
-      };
-
-      if (password) payload.password = password;
       
       if (editingUser) {
-        const success = await updateUser(editingUser.id, payload);
+        const success = await updateUser(editingUser.id, { ...formData, tenant_id: finalTenantId });
         if (success) { setIsModalOpen(false); loadData(); }
       } else {
-        await createMember(payload);
+        await createMember({ ...formData, tenant_id: finalTenantId });
         setIsModalOpen(false); 
         loadData();
       }
@@ -120,7 +94,6 @@ export const TeamManagement: React.FC = () => {
   if (loading && users.length === 0) return <div className="flex h-screen items-center justify-center text-zinc-400 dark:text-dark-muted transition-colors">Carregando...</div>;
 
   const canManage = currentUser?.role === 'admin' || currentUser?.role === 'super_admin' || currentUser?.role === 'manager';
-  const canManagePasswords = currentUser?.role === 'admin' || currentUser?.role === 'super_admin';
   const filtered = users.filter(u => 
     (u.name.toLowerCase().includes(searchTerm.toLowerCase()) || u.email.toLowerCase().includes(searchTerm.toLowerCase())) &&
     (tenantFilter === 'all' || u.tenant_id === tenantFilter)
@@ -149,7 +122,7 @@ export const TeamManagement: React.FC = () => {
           <p className="text-zinc-500 dark:text-dark-muted text-sm">Visualize e gerencie as funções dos membros da sua organização.</p>
         </div>
         {canManage && (
-          <button onClick={() => { setEditingUser(null); setFormData({name:'', email:'', role:'agent', team_id:'', status:'active', tenant_id:'', password:'', confirmPassword:''}); setIsModalOpen(true); }} className="bg-zinc-900 dark:bg-brand-yellow text-white dark:text-zinc-950 px-4 py-2 rounded-lg flex items-center gap-2 text-sm font-bold shadow-sm hover:opacity-90 transition-all">
+          <button onClick={() => { setEditingUser(null); setFormData({name:'', email:'', role:'agent', team_id:'', status:'active'}); setIsModalOpen(true); }} className="bg-zinc-900 dark:bg-brand-yellow text-white dark:text-zinc-950 px-4 py-2 rounded-lg flex items-center gap-2 text-sm font-bold shadow-sm hover:opacity-90 transition-all">
             <Plus size={16} /> Adicionar Membro
           </button>
         )}
@@ -222,7 +195,7 @@ export const TeamManagement: React.FC = () => {
                   {canManage && (
                     <td className="px-6 py-4 text-right">
                       <div className="flex justify-end gap-2 transition-opacity">
-                        <button onClick={() => { setEditingUser(user); setFormData({name:user.name, email:user.email, role:user.role as any, team_id:user.team_id||'', status:user.status as any, tenant_id: user.tenant_id||'', password:'', confirmPassword:''}); setIsModalOpen(true); }} className="p-2 hover:bg-zinc-100 dark:hover:bg-dark-border text-zinc-400 hover:text-zinc-900 dark:hover:text-dark-text rounded-lg transition-colors"><Edit size={16} /></button>
+                        <button onClick={() => { setEditingUser(user); setFormData({name:user.name, email:user.email, role:user.role as any, team_id:user.team_id||'', status:user.status as any, tenant_id: user.tenant_id||''}); setIsModalOpen(true); }} className="p-2 hover:bg-zinc-100 dark:hover:bg-dark-border text-zinc-400 hover:text-zinc-900 dark:hover:text-dark-text rounded-lg transition-colors"><Edit size={16} /></button>
                         <button onClick={() => { setUserToDelete(user); setDeleteConfirmName(''); setIsDeleteModalOpen(true); }} className="p-2 hover:bg-red-50 dark:hover:bg-red-900/30 text-zinc-400 hover:text-red-600 dark:hover:text-red-400 rounded-lg transition-colors"><Trash2 size={16} /></button>
                       </div>
                     </td>
@@ -236,7 +209,7 @@ export const TeamManagement: React.FC = () => {
 
       {isModalOpen && (
         <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-zinc-950/80 backdrop-blur-sm">
-          <div className="bg-white dark:bg-dark-card rounded-2xl p-8 w-full max-w-lg max-h-[90vh] overflow-y-auto shadow-2xl animate-in zoom-in duration-200 transition-colors border border-transparent dark:border-dark-border">
+          <div className="bg-white dark:bg-dark-card rounded-2xl p-8 w-full max-w-lg shadow-2xl animate-in zoom-in duration-200 transition-colors border border-transparent dark:border-dark-border">
             <h3 className="text-xl font-bold text-zinc-900 dark:text-dark-text mb-6">{editingUser ? 'Editar Usuário' : 'Novo Membro'}</h3>
             <form onSubmit={handleSave} className="space-y-5">
               <div>
@@ -302,38 +275,6 @@ export const TeamManagement: React.FC = () => {
                   <option value="inactive">Inativo</option>
                 </select>
               </div>
-              {canManagePasswords && (
-                <div className="space-y-4 rounded-xl border border-zinc-200 dark:border-dark-border bg-zinc-50 dark:bg-dark-bg/50 p-4">
-                  <div className="flex items-center gap-2 text-xs font-bold text-zinc-500 dark:text-dark-muted uppercase">
-                    <KeyRound size={14} className="text-brand-yellow" />
-                    {editingUser ? 'Alterar senha' : 'Senha inicial'}
-                  </div>
-                  <div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
-                    <div>
-                      <label className="text-xs font-bold text-zinc-500 dark:text-dark-muted uppercase mb-1 block">Senha</label>
-                      <input
-                        type="password"
-                        value={formData.password}
-                        onChange={e => setFormData({...formData, password:e.target.value})}
-                        className="w-full bg-white dark:bg-dark-input border border-zinc-200 dark:border-dark-border p-3 rounded-lg text-sm text-zinc-900 dark:text-dark-text outline-none focus:ring-2 focus:ring-brand-yellow/20"
-                        placeholder={editingUser ? 'Deixe em branco para manter' : 'Opcional'}
-                        autoComplete="new-password"
-                      />
-                    </div>
-                    <div>
-                      <label className="text-xs font-bold text-zinc-500 dark:text-dark-muted uppercase mb-1 block">Confirmar</label>
-                      <input
-                        type="password"
-                        value={formData.confirmPassword}
-                        onChange={e => setFormData({...formData, confirmPassword:e.target.value})}
-                        className="w-full bg-white dark:bg-dark-input border border-zinc-200 dark:border-dark-border p-3 rounded-lg text-sm text-zinc-900 dark:text-dark-text outline-none focus:ring-2 focus:ring-brand-yellow/20"
-                        placeholder="Repita a senha"
-                        autoComplete="new-password"
-                      />
-                    </div>
-                  </div>
-                </div>
-              )}
               <div className="flex justify-end gap-3 pt-6 border-t dark:border-dark-border mt-6">
                 <button type="button" onClick={() => setIsModalOpen(false)} className="px-6 py-2.5 text-sm font-medium text-zinc-500 dark:text-dark-muted hover:bg-zinc-100 dark:hover:bg-dark-border rounded-lg transition-colors">Cancelar</button>
                 <button type="submit" disabled={isSaving} className="bg-zinc-900 dark:bg-brand-yellow text-white dark:text-zinc-950 px-8 py-2.5 rounded-lg text-sm font-bold flex items-center gap-2 hover:opacity-90 transition-all">{isSaving ? <Loader2 className="animate-spin" size={16} /> : 'Salvar Alterações'}</button>
diff --git a/src/pages/UserProfile.tsx b/src/pages/UserProfile.tsx
index 639a784..8597ce3 100644
--- a/src/pages/UserProfile.tsx
+++ b/src/pages/UserProfile.tsx
@@ -1,5 +1,5 @@
 import React, { useState, useEffect, useRef } from 'react';
-import { Camera, Save, Mail, User as UserIcon, Building, Shield, Loader2, CheckCircle2 } from 'lucide-react';
+import { Camera, Save, Mail, User as UserIcon, Building, Shield, Loader2, CheckCircle2, Bell } from 'lucide-react';
 import { getUserById, getTenants, getTeams, updateUser, uploadAvatar } from '../services/dataService';
 import { User, Tenant } from '../types';
 
@@ -273,6 +273,32 @@ export const UserProfile: React.FC = () => {
                 <p className="text-xs text-zinc-400 dark:text-zinc-500 text-right">{bio.length}/500 caracteres</p>
               </div>
 
+              <div className="space-y-2 pt-2">
+                <div className="flex items-center justify-between p-4 bg-zinc-50 dark:bg-zinc-900/50 rounded-xl border border-zinc-200 dark:border-zinc-800">
+                  <div>
+                    <h4 className="text-sm font-semibold text-zinc-900 dark:text-zinc-100 flex items-center gap-2">
+                      <Bell size={16} className="text-brand-yellow" /> Notificações Sonoras
+                    </h4>
+                    <p className="text-xs text-zinc-500 dark:text-zinc-400 mt-1">
+                      Reproduzir um som quando você receber uma nova notificação.
+                    </p>
+                  </div>
+                  <label className="relative inline-flex items-center cursor-pointer">
+                    <input 
+                      type="checkbox" 
+                      className="sr-only peer" 
+                      checked={user.sound_enabled ?? true}
+                      onChange={async (e) => {
+                        const newStatus = e.target.checked;
+                        setUser({...user, sound_enabled: newStatus});
+                        await updateUser(user.id, { sound_enabled: newStatus });
+                      }}
+                    />
+                    <div className="w-11 h-6 bg-zinc-200 peer-focus:outline-none rounded-full peer dark:bg-zinc-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-zinc-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all dark:border-zinc-600 peer-checked:bg-brand-yellow"></div>
+                  </label>
+                </div>
+              </div>
+
               <div className="pt-4 flex items-center justify-end border-t border-zinc-100 dark:border-zinc-800 mt-6 transition-colors">
                 <button
                   type="button"
diff --git a/src/services/activityService.ts b/src/services/activityService.ts
deleted file mode 100644
index 1baf2da..0000000
--- a/src/services/activityService.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import { API_URL, apiFetch, getHeaders } from './apiClient';
-
-export interface ActivityEvent {
-  id: string;
-  type: 'success' | 'info' | 'warning' | 'error';
-  title: string;
-  message: string;
-  link?: string | null;
-  created_at: string;
-}
-
-export const getActivityEvents = async (): Promise<ActivityEvent[]> => {
-  try {
-    const response = await apiFetch(`${API_URL}/activity`, {
-      headers: getHeaders()
-    });
-    if (!response.ok) throw new Error('Failed to fetch activity');
-    return await response.json();
-  } catch (error) {
-    console.error("API Error (getActivityEvents):", error);
-    return [];
-  }
-};
diff --git a/src/services/dataService.ts b/src/services/dataService.ts
index 011c15e..bd56e27 100644
--- a/src/services/dataService.ts
+++ b/src/services/dataService.ts
@@ -1,9 +1,9 @@
 export * from './apiClient';
-export * from './activityService';
 export * from './attendancesService';
 export * from './authService';
 export * from './funnelsService';
 export * from './integrationsService';
+export * from './notificationsService';
 export * from './originsService';
 export * from './teamsService';
 export * from './tenantsService';
diff --git a/src/services/notificationsService.ts b/src/services/notificationsService.ts
new file mode 100644
index 0000000..63bcec3
--- /dev/null
+++ b/src/services/notificationsService.ts
@@ -0,0 +1,66 @@
+import { API_URL, apiFetch, getHeaders } from './apiClient';
+
+export const getNotifications = async (): Promise<any[]> => {
+  try {
+    const response = await apiFetch(`${API_URL}/notifications`, {
+      headers: getHeaders()
+    });
+    if (!response.ok) throw new Error('Failed to fetch notifications');
+    return await response.json();
+  } catch (error) {
+    console.error("API Error (getNotifications):", error);
+    return [];
+  }
+};
+
+export const markNotificationAsRead = async (id: string): Promise<boolean> => {
+  try {
+    const response = await apiFetch(`${API_URL}/notifications/${id}`, {
+      method: 'PUT',
+      headers: getHeaders()
+    });
+    return response.ok;
+  } catch (error) {
+    console.error("API Error (markNotificationAsRead):", error);
+    return false;
+  }
+};
+
+export const markAllNotificationsAsRead = async (): Promise<boolean> => {
+  try {
+    const response = await apiFetch(`${API_URL}/notifications/read-all`, {
+      method: 'PUT',
+      headers: getHeaders()
+    });
+    return response.ok;
+  } catch (error) {
+    console.error("API Error (markAllNotificationsAsRead):", error);
+    return false;
+  }
+};
+
+export const deleteNotification = async (id: string): Promise<boolean> => {
+  try {
+    const response = await apiFetch(`${API_URL}/notifications/${id}`, {
+      method: 'DELETE',
+      headers: getHeaders()
+    });
+    return response.ok;
+  } catch (error) {
+    console.error("API Error (deleteNotification):", error);
+    return false;
+  }
+};
+
+export const clearAllNotifications = async (): Promise<boolean> => {
+  try {
+    const response = await apiFetch(`${API_URL}/notifications/clear-all`, {
+      method: 'DELETE',
+      headers: getHeaders()
+    });
+    return response.ok;
+  } catch (error) {
+    console.error("API Error (clearAllNotifications):", error);
+    return false;
+  }
+};
diff --git a/src/types.ts b/src/types.ts
index a2faf6e..ddd785f 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -49,6 +49,7 @@ export interface User {
   team_id: string;
   bio?: string;
   status: 'active' | 'inactive';
+  sound_enabled?: boolean;
 }
 
 export interface Attendance {