diff --git a/.gitignore b/.gitignore
index 73ce422..357235e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,7 @@ env/
 .env
 .env.*
 !.env.example
+compose.dev.yml
 
 # Logs
 *.log
diff --git a/app/Dockerfile b/app/Dockerfile
index 7bb86f1..8e391ed 100644
--- a/app/Dockerfile
+++ b/app/Dockerfile
@@ -2,7 +2,7 @@ FROM python:3.13-slim
 
 WORKDIR /app
 
-RUN pip install --no-cache-dir fastapi uvicorn "psycopg[binary]" python-multipart jinja2 httpx bcrypt
+RUN pip install --no-cache-dir fastapi uvicorn "psycopg[binary]" python-multipart jinja2 httpx bcrypt Pillow
 
 COPY . .
 
diff --git a/app/main.py b/app/main.py
index bac8473..b25f54f 100644
--- a/app/main.py
+++ b/app/main.py
@@ -3,6 +3,11 @@ import uuid
 import secrets
 import hashlib
 import re
+import time
+import threading
+from collections import defaultdict, deque
+from io import BytesIO
+from urllib.parse import urlparse
 from contextlib import asynccontextmanager
 from datetime import datetime, timedelta
 
@@ -10,6 +15,11 @@ import bcrypt
 import httpx
 import psycopg
 
+try:
+    from PIL import Image, ImageOps, UnidentifiedImageError
+except ImportError:
+    Image = ImageOps = UnidentifiedImageError = None
+
 from fastapi import FastAPI, File, Form, Request, UploadFile
 from fastapi.responses import HTMLResponse, RedirectResponse
 from fastapi.staticfiles import StaticFiles
@@ -56,13 +66,18 @@ os.makedirs(PATCH_DIR, exist_ok=True)
 
 SESSION_COOKIE = "pingu_session"
 SESSION_DAYS = 30
+COOKIE_SECURE = os.environ.get("COOKIE_SECURE", "false").lower() in {"1", "true", "yes"}
 ALLOWED_IMAGE_EXTENSIONS = {".jpg", ".jpeg", ".png", ".webp"}
 MAX_IMAGE_BYTES = 10 * 1024 * 1024
+MAX_IMAGE_PIXELS = 25_000_000
+rate_limit_buckets = defaultdict(deque)
+rate_limit_lock = threading.Lock()
 INITIAL_ADMIN_USERNAME = os.environ.get("INITIAL_ADMIN_USERNAME")
 INITIAL_ADMIN_PASSWORD = os.environ.get("INITIAL_ADMIN_PASSWORD")
 INITIAL_ADMIN_EMAIL = os.environ.get("INITIAL_ADMIN_EMAIL")
 
 BADGE_DEFINITIONS = (
+    ("founder", "Gründer", "⚔️", None, "Von Anfang an dabei und Pingu Concerts mit aufgebaut", "special"),
     ("beta_tester", "Beta Tester", "🧪", None, "In der Beta dabei", "beta"),
     ("first_gig", "Erster Gig", "🎸", 1, "Dein erstes besuchtes Konzert", "attendance"),
     ("regular", "Stammgast", "🤘", 5, "5 Konzerte besucht", "attendance"),
@@ -152,13 +167,30 @@ def ensure_schema():
             concert_id INTEGER NOT NULL REFERENCES concerts(id) ON DELETE CASCADE,
             user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
             status VARCHAR(20) NOT NULL CHECK (
-                status IN ('attending', 'maybe', 'ticket_search')
+                status IN ('attending', 'maybe', 'ticket_search', 'ticket_offer')
             ),
             updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
             PRIMARY KEY (concert_id, user_id)
         )
         """,
         """
+        DO $$
+        BEGIN
+            IF EXISTS (
+                SELECT 1 FROM pg_constraint
+                WHERE conname = 'concert_attendance_status_check'
+                  AND NOT (
+                      pg_get_constraintdef(oid) LIKE '%ticket_search%'
+                      AND pg_get_constraintdef(oid) LIKE '%ticket_offer%'
+                  )
+            ) THEN
+                ALTER TABLE concert_attendance DROP CONSTRAINT concert_attendance_status_check;
+                ALTER TABLE concert_attendance ADD CONSTRAINT concert_attendance_status_check
+                CHECK (status IN ('attending', 'maybe', 'ticket_search', 'ticket_offer'));
+            END IF;
+        END $$
+        """,
+        """
         CREATE TABLE IF NOT EXISTS user_badges (
             user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
             badge_code VARCHAR(50) NOT NULL,
@@ -190,6 +222,118 @@ def ensure_schema():
         CREATE INDEX IF NOT EXISTS idx_venue_aliases_alias
         ON venue_aliases (LOWER(alias))
         """,
+        """
+        ALTER TABLE concerts
+        ADD COLUMN IF NOT EXISTS event_type VARCHAR(20) NOT NULL DEFAULT 'concert'
+        CHECK (event_type IN ('concert', 'festival', 'other'))
+        """,
+        """
+        ALTER TABLE concerts
+        ADD COLUMN IF NOT EXISTS parent_event_id INTEGER
+        REFERENCES concerts(id) ON DELETE SET NULL
+        """,
+        """
+        CREATE INDEX IF NOT EXISTS idx_concerts_parent_event_id
+        ON concerts (parent_event_id)
+        """,
+        """
+        ALTER TABLE users
+        ADD COLUMN IF NOT EXISTS instagram_url VARCHAR(500)
+        """,
+        """
+        ALTER TABLE users DROP COLUMN IF EXISTS email_verified
+        """,
+        """
+        CREATE TABLE IF NOT EXISTS account_tokens (
+            id SERIAL PRIMARY KEY,
+            user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            purpose VARCHAR(30) NOT NULL CHECK (purpose = 'password_reset'),
+            token_hash TEXT NOT NULL UNIQUE,
+            expires_at TIMESTAMP NOT NULL,
+            used_at TIMESTAMP,
+            created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+        )
+        """,
+        """
+        DO $$
+        BEGIN
+            IF EXISTS (
+                SELECT 1 FROM pg_constraint
+                WHERE conname = 'account_tokens_purpose_check'
+                  AND pg_get_constraintdef(oid) LIKE '%verify_email%'
+            ) THEN
+                DELETE FROM account_tokens WHERE purpose = 'verify_email';
+                ALTER TABLE account_tokens DROP CONSTRAINT account_tokens_purpose_check;
+                ALTER TABLE account_tokens ADD CONSTRAINT account_tokens_purpose_check
+                CHECK (purpose = 'password_reset');
+            END IF;
+        END $$
+        """,
+        """
+        CREATE INDEX IF NOT EXISTS idx_account_tokens_lookup
+        ON account_tokens (token_hash, purpose, expires_at)
+        """,
+        """
+        ALTER TABLE users
+        ADD COLUMN IF NOT EXISTS profile_visibility VARCHAR(20) NOT NULL DEFAULT 'friends'
+        CHECK (profile_visibility IN ('public', 'friends', 'nobody'))
+        """,
+        """
+        ALTER TABLE users ALTER COLUMN profile_visibility SET DEFAULT 'friends'
+        """,
+        """
+        DO $$
+        BEGIN
+            IF NOT EXISTS (
+                SELECT 1 FROM pg_constraint
+                WHERE conname = 'users_profile_visibility_check'
+                  AND pg_get_constraintdef(oid) LIKE '%nobody%'
+            ) THEN
+                ALTER TABLE users DROP CONSTRAINT IF EXISTS users_profile_visibility_check;
+                ALTER TABLE users ADD CONSTRAINT users_profile_visibility_check
+                CHECK (profile_visibility IN ('public', 'friends', 'nobody'));
+            END IF;
+        END $$
+        """,
+        """
+        ALTER TABLE concerts ADD COLUMN IF NOT EXISTS flyer_url TEXT
+        """,
+        """
+        CREATE TABLE IF NOT EXISTS friendships (
+            id SERIAL PRIMARY KEY,
+            requester_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            addressee_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            status VARCHAR(20) NOT NULL DEFAULT 'pending'
+                CHECK (status IN ('pending', 'accepted')),
+            created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+            updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+            CHECK (requester_id <> addressee_id),
+            UNIQUE (requester_id, addressee_id)
+        )
+        """,
+        """
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_friendships_pair
+        ON friendships (LEAST(requester_id, addressee_id), GREATEST(requester_id, addressee_id))
+        """,
+        """
+        CREATE TABLE IF NOT EXISTS direct_messages (
+            id SERIAL PRIMARY KEY,
+            sender_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            recipient_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+            body TEXT NOT NULL,
+            read_at TIMESTAMP,
+            created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+            CHECK (sender_id <> recipient_id)
+        )
+        """,
+        """
+        CREATE INDEX IF NOT EXISTS idx_direct_messages_conversation
+        ON direct_messages (sender_id, recipient_id, created_at)
+        """,
+        """
+        CREATE INDEX IF NOT EXISTS idx_direct_messages_unread
+        ON direct_messages (recipient_id, read_at)
+        """,
     ]
 
     with get_db_connection() as connection:
@@ -199,12 +343,11 @@ def ensure_schema():
 
             if INITIAL_ADMIN_USERNAME and INITIAL_ADMIN_PASSWORD:
                 cursor.execute(
-                    "SELECT id FROM users WHERE username = %s",
-                    (INITIAL_ADMIN_USERNAME,),
+                    "SELECT EXISTS (SELECT 1 FROM users)",
                 )
-                existing_user = cursor.fetchone()
+                users_exist = cursor.fetchone()[0]
 
-                if not existing_user:
+                if not users_exist:
                     cursor.execute(
                         """
                         INSERT INTO users (
@@ -239,12 +382,56 @@ async def lifespan(_app: FastAPI):
 app = FastAPI(title="Pingu Concerts", lifespan=lifespan)
 
 
+@app.middleware("http")
+async def security_controls(request: Request, call_next):
+    if request.method in {"POST", "PUT", "PATCH", "DELETE"}:
+        origin = request.headers.get("origin")
+        fetch_site = request.headers.get("sec-fetch-site")
+        origin_host = urlparse(origin).netloc if origin else None
+        expected_host = request.headers.get("host", request.url.netloc)
+        if fetch_site == "cross-site" or (origin_host and origin_host != expected_host):
+            return HTMLResponse("Anfrage aus fremder Quelle abgelehnt.", status_code=403)
+
+        path = request.url.path
+        if path == "/login":
+            bucket_name, limit, window = "login", 10, 15 * 60
+        elif path == "/register" or path.startswith("/password-reset"):
+            bucket_name, limit, window = "account", 10, 60 * 60
+        elif path.startswith("/messages/"):
+            bucket_name, limit, window = "messages", 30, 60
+        elif any(part in path for part in ("/photos", "/patches")) or path in {"/profile", "/concerts"}:
+            bucket_name, limit, window = "uploads", 20, 60 * 60
+        else:
+            bucket_name, limit, window = "writes", 120, 60
+        client_host = request.client.host if request.client else "unknown"
+        key = (client_host, bucket_name)
+        now = time.monotonic()
+        with rate_limit_lock:
+            bucket = rate_limit_buckets[key]
+            while bucket and bucket[0] <= now - window:
+                bucket.popleft()
+            if len(bucket) >= limit:
+                return HTMLResponse("Zu viele Anfragen. Bitte später erneut versuchen.", status_code=429,
+                                    headers={"Retry-After": str(window)})
+            bucket.append(now)
+
+    response = await call_next(request)
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["X-Frame-Options"] = "DENY"
+    response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+    response.headers["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
+    if COOKIE_SECURE:
+        response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+    return response
+
+
 @app.middleware("http")
 async def require_login(request: Request, call_next):
     if (
         request.url.path == "/login"
         or request.url.path == "/register"
         or request.url.path.startswith("/register/")
+        or request.url.path.startswith("/password-reset")
         or request.url.path.startswith("/static/")
     ):
         return await call_next(request)
@@ -294,6 +481,25 @@ def generate_token() -> str:
     return secrets.token_urlsafe(32)
 
 
+def create_account_token(user_id: int, purpose: str, hours: int = 24) -> str:
+    token = generate_token()
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                "DELETE FROM account_tokens WHERE user_id = %s AND purpose = %s AND used_at IS NULL",
+                (user_id, purpose),
+            )
+            cursor.execute(
+                """
+                INSERT INTO account_tokens (user_id, purpose, token_hash, expires_at)
+                VALUES (%s, %s, %s, %s)
+                """,
+                (user_id, purpose, hash_token(token), datetime.now() + timedelta(hours=hours)),
+            )
+        connection.commit()
+    return token
+
+
 def user_from_row(row):
     if not row:
         return None
@@ -303,6 +509,9 @@ def user_from_row(row):
         "username": row[1],
         "display_name": row[2] or row[1],
         "is_admin": bool(row[3]),
+        "pending_friend_count": row[4],
+        "unread_message_count": row[5],
+        "notification_count": row[4] + row[5],
     }
 
 
@@ -320,7 +529,11 @@ def get_current_user(request: Request):
                     users.id,
                     users.username,
                     users.display_name,
-                    users.is_admin
+                    users.is_admin,
+                    (SELECT COUNT(*) FROM friendships
+                     WHERE addressee_id = users.id AND status = 'pending'),
+                    (SELECT COUNT(*) FROM direct_messages
+                     WHERE recipient_id = users.id AND read_at IS NULL)
                 FROM sessions
                 JOIN users
                     ON users.id = sessions.user_id
@@ -363,6 +576,8 @@ def attach_session(response: RedirectResponse, token: str) -> RedirectResponse:
         max_age=SESSION_DAYS * 24 * 60 * 60,
         httponly=True,
         samesite="lax",
+        secure=COOKIE_SECURE,
+        path="/",
     )
     return response
 
@@ -379,6 +594,85 @@ def concert_is_past(start_datetime, end_datetime) -> bool:
     return end < datetime.now()
 
 
+EVENT_TYPES = {
+    "concert": "Konzert",
+    "festival": "Festival",
+    "other": "Sonstiges",
+}
+
+
+def get_linkable_events(exclude_id: int | None = None):
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            exclude_clause = "AND id <> %s" if exclude_id is not None else ""
+            parameters = (exclude_id,) if exclude_id is not None else ()
+            cursor.execute(
+                f"""
+                SELECT id, artist, start_datetime, event_type
+                FROM concerts
+                WHERE event_type IN ('concert', 'festival')
+                  AND DATE(
+                      CASE
+                          WHEN event_type = 'festival'
+                              THEN COALESCE(end_datetime, start_datetime)
+                          ELSE start_datetime
+                      END
+                  ) >= CURRENT_DATE
+                  {exclude_clause}
+                ORDER BY start_datetime DESC
+                """,
+                parameters,
+            )
+            rows = cursor.fetchall()
+    return [
+        {
+            "id": row[0],
+            "title": row[1],
+            "date": row[2].strftime("%d.%m.%Y"),
+            "event_type": row[3],
+            "event_type_label": EVENT_TYPES[row[3]],
+        }
+        for row in rows
+    ]
+
+
+def resolve_event_relationship(cursor, event_type: str, parent_event_id: str, event_id=None):
+    if event_type not in EVENT_TYPES:
+        raise ValueError("Ungültige Veranstaltungskategorie.")
+    if event_type != "other" or not parent_event_id:
+        return None
+
+    try:
+        parent_id = int(parent_event_id)
+    except ValueError as error:
+        raise ValueError("Ungültige Hauptveranstaltung.") from error
+    if event_id is not None and parent_id == event_id:
+        raise ValueError("Eine Veranstaltung kann nicht mit sich selbst verknüpft werden.")
+
+    cursor.execute(
+        """
+        SELECT
+            event_type,
+            DATE(
+                CASE
+                    WHEN event_type = 'festival'
+                        THEN COALESCE(end_datetime, start_datetime)
+                    ELSE start_datetime
+                END
+            ) >= CURRENT_DATE AS is_linkable
+        FROM concerts
+        WHERE id = %s
+        """,
+        (parent_id,),
+    )
+    parent = cursor.fetchone()
+    if not parent or parent[0] not in {"concert", "festival"}:
+        raise ValueError("Die Hauptveranstaltung muss ein Konzert oder Festival sein.")
+    if not parent[1]:
+        raise ValueError("Die Hauptveranstaltung ist bereits beendet und kann nicht mehr verknüpft werden.")
+    return parent_id
+
+
 def load_concert(concert_id: int):
     with get_db_connection() as connection:
         with connection.cursor() as cursor:
@@ -401,10 +695,17 @@ def load_concert(concert_id: int):
                     venues.city,
                     venues.country,
                     venues.latitude,
-                    venues.longitude
+                    venues.longitude,
+                    concerts.event_type,
+                    concerts.parent_event_id,
+                    parent_event.artist,
+                    parent_event.event_type,
+                    concerts.flyer_url
                 FROM concerts
                 LEFT JOIN venues
                     ON concerts.venue_id = venues.id
+                LEFT JOIN concerts AS parent_event
+                    ON concerts.parent_event_id = parent_event.id
                 WHERE concerts.id = %s
                 """,
                 (concert_id,),
@@ -427,6 +728,7 @@ def load_concert(concert_id: int):
         "ticket_url": row[5],
         "ticket_price": row[6],
         "flyer_path": row[7],
+        "flyer_url": row[21],
         "created_by": row[8],
         "is_past": is_past,
         "date": start_datetime.strftime("%d.%m.%Y"),
@@ -435,6 +737,14 @@ def load_concert(concert_id: int):
         "end_date": end_datetime.strftime("%d.%m.%Y") if end_datetime else None,
         "end_time": end_datetime.strftime("%H:%M") if end_datetime else None,
         "end_local": end_datetime.strftime("%Y-%m-%dT%H:%M") if end_datetime else "",
+        "event_type": row[17],
+        "event_type_label": EVENT_TYPES[row[17]],
+        "parent_event": {
+            "id": row[18],
+            "title": row[19],
+            "event_type": row[20],
+            "event_type_label": EVENT_TYPES.get(row[20]),
+        } if row[18] else None,
         "venue": {
             "id": row[9],
             "name": row[10] or "Veranstaltungsort unbekannt",
@@ -477,7 +787,7 @@ def can_delete_concert(user, concert) -> bool:
 
 
 def serialize_concert_card(row):
-    concert_id, artist, start_datetime, venue, city = row
+    concert_id, artist, start_datetime, end_datetime, venue, city, event_type, parent_event_id = row
     venue_text = venue or "Veranstaltungsort unbekannt"
     if city:
         venue_text += f", {city}"
@@ -487,10 +797,118 @@ def serialize_concert_card(row):
         "artist": artist,
         "date": start_datetime.strftime("%d.%m.%Y"),
         "time": start_datetime.strftime("%H:%M"),
+        "end_date": end_datetime.strftime("%d.%m.%Y") if end_datetime else None,
         "venue": venue_text,
+        "event_type": event_type,
+        "event_type_label": EVENT_TYPES[event_type],
+        "parent_event_id": parent_event_id,
+        "children": [],
+        "_start_datetime": start_datetime,
+        "_end_datetime": end_datetime,
     }
 
 
+def build_event_overview(rows):
+    cards = {row[0]: serialize_concert_card(row) for row in rows}
+    roots = []
+    for card in cards.values():
+        parent = cards.get(card["parent_event_id"])
+        if card["event_type"] == "other" and parent:
+            parent["children"].append(card)
+        else:
+            roots.append(card)
+
+    for card in roots:
+        card["children"].sort(key=lambda child: child["_start_datetime"])
+
+    upcoming = [card for card in roots if not concert_is_past(
+        card["_start_datetime"], card["_end_datetime"]
+    )]
+    past = [card for card in roots if card not in upcoming]
+    upcoming.sort(key=lambda card: card["_start_datetime"])
+    past.sort(key=lambda card: card["_start_datetime"], reverse=True)
+    return upcoming, past
+
+
+def load_event_overview(search_query: str = ""):
+    query = """
+        SELECT concerts.id, concerts.artist, concerts.start_datetime,
+               concerts.end_datetime, venues.name, venues.city,
+               concerts.event_type, concerts.parent_event_id
+        FROM concerts
+        LEFT JOIN venues ON concerts.venue_id = venues.id
+        ORDER BY concerts.start_datetime ASC
+    """
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(query)
+            upcoming, past = build_event_overview(cursor.fetchall())
+
+    term = search_query.strip().casefold()
+    if not term:
+        return upcoming, past
+
+    def matches(card):
+        text = f"{card['artist']} {card['venue']} {card['event_type_label']}".casefold()
+        return term in text or any(matches(child) for child in card["children"])
+
+    return (
+        [card for card in upcoming if matches(card)],
+        [card for card in past if matches(card)],
+    )
+
+
+def search_users(search_query: str):
+    term = search_query.strip()
+    if not term:
+        return []
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                """
+                SELECT username, COALESCE(display_name, username), avatar_path
+                FROM users
+                WHERE username ILIKE %s OR COALESCE(display_name, '') ILIKE %s
+                ORDER BY COALESCE(display_name, username), username
+                LIMIT 30
+                """,
+                (f"%{term}%", f"%{term}%"),
+            )
+            return [
+                {"username": row[0], "display_name": row[1], "avatar_path": row[2]}
+                for row in cursor.fetchall()
+            ]
+
+
+def normalize_instagram_url(value: str):
+    value = value.strip()
+    if not value:
+        return None
+    if value.startswith("@"):
+        value = value[1:]
+    if re.fullmatch(r"[A-Za-z0-9._]{1,30}", value):
+        return f"https://www.instagram.com/{value}/"
+
+    candidate = value if "://" in value else f"https://{value}"
+    parsed = urlparse(candidate)
+    if (parsed.hostname or "").lower() not in {"instagram.com", "www.instagram.com"}:
+        raise ValueError("Bitte einen gültigen Instagram-Profillink eingeben.")
+    username = parsed.path.strip("/").split("/", 1)[0]
+    if not re.fullmatch(r"[A-Za-z0-9._]{1,30}", username):
+        raise ValueError("Bitte einen gültigen Instagram-Profillink eingeben.")
+    return f"https://www.instagram.com/{username}/"
+
+
+def normalize_external_url(value: str, field_name: str):
+    value = value.strip()
+    if not value:
+        return None
+    parsed = urlparse(value)
+    if parsed.scheme not in {"http", "https"} or not parsed.hostname or parsed.username or parsed.password:
+        raise ValueError(f"Bitte für {field_name} eine vollständige HTTP- oder HTTPS-Adresse eingeben.")
+    return value
+
+
 def save_image(upload: UploadFile, destination_dir: str, url_prefix: str):
     if not upload or not upload.filename:
         return None, None
@@ -503,8 +921,6 @@ def save_image(upload: UploadFile, destination_dir: str, url_prefix: str):
             status_code=400,
         )
 
-    filename = str(uuid.uuid4()) + extension
-    destination = os.path.join(destination_dir, filename)
     contents = upload.file.read()
 
     if len(contents) > MAX_IMAGE_BYTES:
@@ -513,12 +929,52 @@ def save_image(upload: UploadFile, destination_dir: str, url_prefix: str):
             status_code=400,
         )
 
+    if Image is None:
+        return None, HTMLResponse(
+            "Die sichere Bildprüfung ist noch nicht installiert. Bitte den Web-Container neu bauen.",
+            status_code=503,
+        )
+
+    try:
+        Image.MAX_IMAGE_PIXELS = MAX_IMAGE_PIXELS
+        with Image.open(BytesIO(contents)) as candidate:
+            candidate.verify()
+        with Image.open(BytesIO(contents)) as candidate:
+            image = ImageOps.exif_transpose(candidate)
+            if image.width * image.height > MAX_IMAGE_PIXELS:
+                raise ValueError("Bildauflösung zu groß")
+            image.thumbnail((2400, 2400))
+            if image.mode not in {"RGB", "RGBA"}:
+                image = image.convert("RGBA" if "transparency" in image.info else "RGB")
+            output = BytesIO()
+            image.save(output, format="WEBP", quality=88, method=6)
+            safe_contents = output.getvalue()
+    except (ValueError, OSError, UnidentifiedImageError, Image.DecompressionBombError):
+        return None, HTMLResponse(
+            "Die Datei ist kein gültiges oder unterstütztes Bild.", status_code=400
+        )
+
+    filename = str(uuid.uuid4()) + ".webp"
+    destination = os.path.join(destination_dir, filename)
     with open(destination, "wb") as file:
-        file.write(contents)
+        file.write(safe_contents)
 
     return f"{url_prefix}{filename}", None
 
 
+def remove_uploaded_file(path: str | None, destination_dir: str, url_prefix: str):
+    if not path or not path.startswith(url_prefix):
+        return False
+    relative_name = path.removeprefix(url_prefix)
+    if not relative_name or os.path.basename(relative_name) != relative_name:
+        return False
+    file_path = os.path.join(destination_dir, relative_name)
+    if not os.path.isfile(file_path):
+        return False
+    os.remove(file_path)
+    return True
+
+
 def attended_concert_count(user_id: int) -> int:
     with get_db_connection() as connection:
         with connection.cursor() as cursor:
@@ -586,7 +1042,8 @@ def load_profile(username: str):
         with connection.cursor() as cursor:
             cursor.execute(
                 """
-                SELECT id, username, display_name, avatar_path, created_at
+                SELECT id, username, display_name, avatar_path, created_at, instagram_url,
+                       profile_visibility, is_admin
                 FROM users
                 WHERE LOWER(username) = LOWER(%s)
                 """,
@@ -610,6 +1067,10 @@ def load_profile(username: str):
         "avatar_path": row[3],
         "created_at": row[4].strftime("%d.%m.%Y"),
         "registered_at": row[4],
+        "instagram_url": row[5],
+        "instagram_handle": row[5].rstrip("/").rsplit("/", 1)[-1] if row[5] else None,
+        "profile_visibility": row[6],
+        "is_admin": bool(row[7]),
         "earned_codes": earned_codes,
     }
 
@@ -800,7 +1261,13 @@ def admin_users_page(request: Request):
         with connection.cursor() as cursor:
             cursor.execute(
                 """
-                SELECT id, username, email, display_name, is_admin, created_at
+                SELECT users.id, users.username, users.email, users.display_name,
+                       users.is_admin, users.created_at,
+                       EXISTS (
+                           SELECT 1 FROM user_badges
+                           WHERE user_badges.user_id = users.id
+                             AND user_badges.badge_code = 'founder'
+                       )
                 FROM users
                 ORDER BY is_admin DESC, username ASC
                 """
@@ -815,6 +1282,7 @@ def admin_users_page(request: Request):
             "display_name": row[3] or row[1],
             "is_admin": bool(row[4]),
             "created_at": row[5].strftime("%d.%m.%Y"),
+            "has_founder_badge": bool(row[6]),
         }
         for row in rows
     ]
@@ -889,7 +1357,13 @@ def create_invite(request: Request):
         with connection.cursor() as cursor:
             cursor.execute(
                 """
-                SELECT id, username, email, display_name, is_admin, created_at
+                SELECT users.id, users.username, users.email, users.display_name,
+                       users.is_admin, users.created_at,
+                       EXISTS (
+                           SELECT 1 FROM user_badges
+                           WHERE user_badges.user_id = users.id
+                             AND user_badges.badge_code = 'founder'
+                       )
                 FROM users
                 ORDER BY is_admin DESC, username ASC
                 """
@@ -904,6 +1378,7 @@ def create_invite(request: Request):
             "display_name": row[3] or row[1],
             "is_admin": bool(row[4]),
             "created_at": row[5].strftime("%d.%m.%Y"),
+            "has_founder_badge": bool(row[6]),
         }
         for row in rows
     ]
@@ -1026,12 +1501,7 @@ def delete_venue(request: Request, venue_id: int):
 
 
 def remove_patch_file(path: str | None):
-    if not path:
-        return
-    filename = os.path.basename(path)
-    file_path = os.path.join(PATCH_DIR, filename)
-    if os.path.isfile(file_path):
-        os.remove(file_path)
+    remove_uploaded_file(path, PATCH_DIR, "/static/uploads/patches/")
 
 
 @app.post("/admin/patches/{badge_code}")
@@ -1097,6 +1567,7 @@ def update_user_role(
     request: Request,
     user_id: int,
     role: str = Form(...),
+    founder_badge: str = Form(""),
 ):
     user = require_admin(request)
 
@@ -1116,6 +1587,20 @@ def update_user_role(
                 "UPDATE users SET is_admin = %s WHERE id = %s",
                 (role == "admin", user_id),
             )
+            if founder_badge == "on":
+                cursor.execute(
+                    """
+                    INSERT INTO user_badges (user_id, badge_code)
+                    VALUES (%s, 'founder')
+                    ON CONFLICT (user_id, badge_code) DO NOTHING
+                    """,
+                    (user_id,),
+                )
+            else:
+                cursor.execute(
+                    "DELETE FROM user_badges WHERE user_id = %s AND badge_code = 'founder'",
+                    (user_id,),
+                )
         connection.commit()
 
     return RedirectResponse("/admin/users", status_code=303)
@@ -1135,11 +1620,87 @@ def delete_user(request: Request, user_id: int):
 
     with get_db_connection() as connection:
         with connection.cursor() as cursor:
+            cursor.execute("SELECT avatar_path FROM users WHERE id = %s", (user_id,))
+            target_user = cursor.fetchone()
+            cursor.execute("SELECT path FROM concert_photos WHERE user_id = %s", (user_id,))
+            photo_paths = [row[0] for row in cursor.fetchall()]
             cursor.execute("DELETE FROM users WHERE id = %s", (user_id,))
         connection.commit()
 
+    if target_user:
+        remove_uploaded_file(target_user[0], AVATAR_DIR, "/static/uploads/avatars/")
+    for photo_path in photo_paths:
+        remove_uploaded_file(photo_path, PHOTO_DIR, "/static/uploads/photos/")
+
     return RedirectResponse("/admin/users", status_code=303)
 
+
+@app.post("/admin/users/{user_id}/account-link", response_class=HTMLResponse)
+def create_user_account_link(request: Request, user_id: int, purpose: str = Form(...)):
+    user = require_admin(request)
+    if not user:
+        return HTMLResponse("<h1>Nicht erlaubt</h1>", status_code=403)
+    if purpose != "password_reset":
+        return HTMLResponse("<h1>Ungültiger Linktyp</h1>", status_code=400)
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute("SELECT username, email FROM users WHERE id = %s", (user_id,))
+            target = cursor.fetchone()
+    if not target:
+        return HTMLResponse("<h1>Benutzer nicht gefunden</h1>", status_code=404)
+    token = create_account_token(user_id, purpose, 2)
+    path = f"/password-reset/{token}"
+    template = templates.get_template("account_link.html")
+    return template.render(
+        user=user, target_username=target[0], target_email=target[1],
+        purpose=purpose, account_url=f"{str(request.base_url).rstrip('/')}{path}",
+    )
+
+
+@app.get("/password-reset/{token}", response_class=HTMLResponse)
+def password_reset_page(token: str):
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                """
+                SELECT 1 FROM account_tokens WHERE token_hash = %s
+                AND purpose = 'password_reset' AND used_at IS NULL
+                AND expires_at > CURRENT_TIMESTAMP
+                """,
+                (hash_token(token),),
+            )
+            valid = cursor.fetchone()
+    if not valid:
+        return HTMLResponse("<h1>Reset-Link ungültig oder abgelaufen.</h1>", status_code=410)
+    return templates.get_template("password_reset.html").render(token=token, error=None)
+
+
+@app.post("/password-reset/{token}", response_class=HTMLResponse)
+def password_reset(token: str, password: str = Form(...), password_repeat: str = Form(...)):
+    if len(password) < 10 or password != password_repeat:
+        return templates.get_template("password_reset.html").render(
+            token=token, error="Passwörter müssen übereinstimmen und mindestens 10 Zeichen lang sein."
+        )
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                """
+                SELECT id, user_id FROM account_tokens WHERE token_hash = %s
+                AND purpose = 'password_reset' AND used_at IS NULL
+                AND expires_at > CURRENT_TIMESTAMP FOR UPDATE
+                """,
+                (hash_token(token),),
+            )
+            account_token = cursor.fetchone()
+            if not account_token:
+                return HTMLResponse("<h1>Reset-Link ungültig oder abgelaufen.</h1>", status_code=410)
+            password_hash = bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
+            cursor.execute("UPDATE users SET password_hash = %s WHERE id = %s", (password_hash, account_token[1]))
+            cursor.execute("UPDATE account_tokens SET used_at = CURRENT_TIMESTAMP WHERE id = %s", (account_token[0],))
+            cursor.execute("DELETE FROM sessions WHERE user_id = %s", (account_token[1],))
+        connection.commit()
+    return RedirectResponse("/login?reset=1", status_code=303)
+
 @app.post("/register")
 def register_user(
     token: str = Form(...),
@@ -1159,9 +1720,9 @@ def register_user(
             status_code=400
         )
 
-    if len(password) < 8:
+    if len(password) < 10:
         return HTMLResponse(
-            "<h1>Fehler</h1><p>Das Passwort muss mindestens 8 Zeichen lang sein.</p>",
+            "<h1>Fehler</h1><p>Das Passwort muss mindestens 10 Zeichen lang sein.</p>",
             status_code=400
         )
 
@@ -1410,7 +1971,7 @@ def logout(request: Request):
             connection.commit()
 
     response = RedirectResponse("/", status_code=303)
-    response.delete_cookie(SESSION_COOKIE)
+    response.delete_cookie(SESSION_COOKIE, path="/", secure=COOKIE_SECURE, samesite="lax")
     return response
 
 
@@ -1419,39 +1980,31 @@ def logout(request: Request):
 # ============================================================
 
 @app.get("/", response_class=HTMLResponse)
-def home(request: Request):
-    concert_query = """
-        SELECT
-            concerts.id,
-            concerts.artist,
-            concerts.start_datetime,
-            venues.name,
-            venues.city
-        FROM concerts
-        LEFT JOIN venues
-            ON concerts.venue_id = venues.id
-        WHERE COALESCE(concerts.end_datetime, concerts.start_datetime)
-              {operator} CURRENT_TIMESTAMP
-        ORDER BY concerts.start_datetime {direction}
-    """
-
-    with get_db_connection() as connection:
-        with connection.cursor() as cursor:
-            cursor.execute(
-                concert_query.format(operator=">=", direction="ASC")
-            )
-            upcoming_rows = cursor.fetchall()
-
-            cursor.execute(
-                concert_query.format(operator="<", direction="DESC")
-            )
-            past_rows = cursor.fetchall()
+def home(request: Request, q: str = ""):
+    upcoming_concerts, _past_concerts = load_event_overview(q)
 
     template = templates.get_template("index.html")
     return template.render(
         user=get_current_user(request),
-        upcoming_concerts=[serialize_concert_card(row) for row in upcoming_rows],
-        past_concerts=[serialize_concert_card(row) for row in past_rows],
+        upcoming_concerts=upcoming_concerts,
+        past_concerts=[],
+        archive=False,
+        search_query=q.strip(),
+        user_results=search_users(q),
+    )
+
+
+@app.get("/events/past", response_class=HTMLResponse)
+def past_events(request: Request, q: str = ""):
+    _upcoming_concerts, past_concerts = load_event_overview(q)
+    template = templates.get_template("index.html")
+    return template.render(
+        user=get_current_user(request),
+        upcoming_concerts=[],
+        past_concerts=past_concerts,
+        archive=True,
+        search_query=q.strip(),
+        user_results=search_users(q),
     )
 
 
@@ -1459,13 +2012,78 @@ def home(request: Request):
 # Profiles
 # ============================================================
 
-def render_profile(request: Request, username: str):
+def render_profile(
+    request: Request,
+    username: str,
+    force_own: bool = False,
+    form_error: str | None = None,
+    form_success: str | None = None,
+    instagram_input: str | None = None,
+    status_code: int = 200,
+):
     viewer = get_current_user(request)
     profile = load_profile(username)
 
     if not profile:
         return HTMLResponse("<h1>Benutzer nicht gefunden</h1>", status_code=404)
 
+    is_own_profile = bool(viewer and viewer["id"] == profile["id"])
+    friendship = None
+    if viewer and not is_own_profile:
+        with get_db_connection() as connection:
+            with connection.cursor() as cursor:
+                cursor.execute(
+                    """
+                    SELECT id, requester_id, addressee_id, status
+                    FROM friendships
+                    WHERE (requester_id = %s AND addressee_id = %s)
+                       OR (requester_id = %s AND addressee_id = %s)
+                    """,
+                    (viewer["id"], profile["id"], profile["id"], viewer["id"]),
+                )
+                row = cursor.fetchone()
+                if row:
+                    friendship = {
+                        "id": row[0], "requester_id": row[1],
+                        "addressee_id": row[2], "status": row[3],
+                    }
+    can_view_details = (
+        profile["profile_visibility"] == "public"
+        or is_own_profile
+        or bool(viewer and viewer["is_admin"])
+        or bool(friendship and friendship["status"] == "accepted")
+    )
+    connections = {"incoming": [], "outgoing": [], "friends": []}
+    if is_own_profile:
+        with get_db_connection() as connection:
+            with connection.cursor() as cursor:
+                cursor.execute(
+                    """
+                    SELECT f.id, f.requester_id, f.addressee_id, f.status,
+                           other.username, COALESCE(other.display_name, other.username),
+                           other.avatar_path
+                    FROM friendships f
+                    JOIN users other ON other.id = CASE
+                        WHEN f.requester_id = %s THEN f.addressee_id
+                        ELSE f.requester_id
+                    END
+                    WHERE f.requester_id = %s OR f.addressee_id = %s
+                    ORDER BY f.updated_at DESC
+                    """,
+                    (viewer["id"], viewer["id"], viewer["id"]),
+                )
+                for row in cursor.fetchall():
+                    item = {
+                        "id": row[0], "requester_id": row[1], "addressee_id": row[2],
+                        "status": row[3], "username": row[4],
+                        "display_name": row[5], "avatar_path": row[6],
+                    }
+                    if row[3] == "accepted":
+                        connections["friends"].append(item)
+                    elif row[2] == viewer["id"]:
+                        connections["incoming"].append(item)
+                    else:
+                        connections["outgoing"].append(item)
     attended_count = attended_concert_count(profile["id"])
     grant_earned_badges(
         profile["id"],
@@ -1489,19 +2107,41 @@ def render_profile(request: Request, username: str):
     ]
 
     template = templates.get_template("profile.html")
-    return template.render(
-        user=viewer,
-        profile=profile,
-        attended_count=attended_count,
-        badges=badges,
-        is_own_profile=viewer["id"] == profile["id"],
+    return HTMLResponse(
+        template.render(
+            user=viewer,
+            profile=profile,
+            attended_count=attended_count,
+            badges=badges,
+            is_own_profile=force_own or is_own_profile,
+            can_view_details=can_view_details,
+            friendship=friendship,
+            connections=connections,
+            form_error=form_error,
+            form_success=form_success,
+            instagram_input=instagram_input,
+        ),
+        status_code=status_code,
     )
 
 
 @app.get("/profile", response_class=HTMLResponse)
-def own_profile(request: Request):
+def own_profile(request: Request, saved: str = ""):
     user = get_current_user(request)
-    return render_profile(request, user["username"])
+    saved_items = set(saved.split(","))
+    messages = []
+    if "profile" in saved_items:
+        messages.append("Profil gespeichert")
+    if "avatar" in saved_items:
+        messages.append("Profilbild aktualisiert")
+    if "instagram" in saved_items:
+        messages.append("Instagram verknüpft")
+    return render_profile(
+        request,
+        user["username"],
+        force_own=True,
+        form_success=" · ".join(messages) if messages else None,
+    )
 
 
 @app.get("/users/{username}", response_class=HTMLResponse)
@@ -1513,9 +2153,24 @@ def user_profile(request: Request, username: str):
 async def update_profile(
     request: Request,
     display_name: str = Form(""),
+    instagram_url: str = Form(""),
+    profile_visibility: str = Form("friends"),
     avatar: UploadFile | None = File(None),
 ):
     user = get_current_user(request)
+    try:
+        normalized_instagram_url = normalize_instagram_url(instagram_url)
+    except ValueError as error:
+        return render_profile(
+            request,
+            user["username"],
+            force_own=True,
+            form_error=str(error),
+            instagram_input=instagram_url,
+            status_code=400,
+        )
+    if profile_visibility not in {"public", "friends", "nobody"}:
+        return HTMLResponse("Ungültige Profilsichtbarkeit.", status_code=400)
     avatar_path, error = save_image(
         avatar,
         AVATAR_DIR,
@@ -1527,19 +2182,223 @@ async def update_profile(
 
     with get_db_connection() as connection:
         with connection.cursor() as cursor:
+            cursor.execute("SELECT avatar_path FROM users WHERE id = %s", (user["id"],))
+            previous_profile = cursor.fetchone()
             cursor.execute(
                 """
                 UPDATE users
                 SET
                     display_name = COALESCE(NULLIF(%s, ''), display_name),
-                    avatar_path = COALESCE(%s, avatar_path)
+                    avatar_path = COALESCE(%s, avatar_path),
+                    instagram_url = %s,
+                    profile_visibility = %s
                 WHERE id = %s
+                RETURNING avatar_path, instagram_url
                 """,
-                (display_name.strip(), avatar_path, user["id"]),
+                (display_name.strip(), avatar_path, normalized_instagram_url, profile_visibility, user["id"]),
             )
+            saved_profile = cursor.fetchone()
         connection.commit()
 
-    return RedirectResponse("/profile", status_code=303)
+    if not saved_profile:
+        remove_uploaded_file(avatar_path, AVATAR_DIR, "/static/uploads/avatars/")
+        return HTMLResponse("<h1>Profil konnte nicht gespeichert werden.</h1>", status_code=500)
+    if avatar_path and previous_profile and previous_profile[0] != avatar_path:
+        remove_uploaded_file(previous_profile[0], AVATAR_DIR, "/static/uploads/avatars/")
+    saved_parts = ["profile"]
+    if avatar_path and saved_profile[0] == avatar_path:
+        saved_parts.append("avatar")
+    if normalized_instagram_url and saved_profile[1] == normalized_instagram_url:
+        saved_parts.append("instagram")
+    return RedirectResponse(
+        f"/profile?saved={','.join(saved_parts)}",
+        status_code=303,
+    )
+
+
+@app.post("/users/{username}/friend-request")
+def send_friend_request(request: Request, username: str):
+    user = get_current_user(request)
+    profile = load_profile(username)
+    if not profile:
+        return HTMLResponse("Benutzer nicht gefunden.", status_code=404)
+    if profile["id"] == user["id"]:
+        return HTMLResponse("Du kannst dir nicht selbst eine Anfrage schicken.", status_code=400)
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                """
+                INSERT INTO friendships (requester_id, addressee_id)
+                VALUES (%s, %s)
+                ON CONFLICT DO NOTHING
+                """,
+                (user["id"], profile["id"]),
+            )
+        connection.commit()
+    return RedirectResponse(f"/users/{profile['username']}", status_code=303)
+
+
+@app.post("/friendships/{friendship_id}/{action}")
+def manage_friendship(request: Request, friendship_id: int, action: str):
+    user = get_current_user(request)
+    if action not in {"accept", "decline", "remove"}:
+        return HTMLResponse("Ungültige Aktion.", status_code=400)
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                "SELECT requester_id, addressee_id, status FROM friendships WHERE id = %s",
+                (friendship_id,),
+            )
+            friendship = cursor.fetchone()
+            if not friendship or user["id"] not in friendship[:2]:
+                return HTMLResponse("Freundschaft nicht gefunden.", status_code=404)
+            if action == "accept":
+                if friendship[1] != user["id"] or friendship[2] != "pending":
+                    return HTMLResponse("Diese Anfrage kann nicht angenommen werden.", status_code=403)
+                cursor.execute(
+                    "UPDATE friendships SET status = 'accepted', updated_at = CURRENT_TIMESTAMP WHERE id = %s",
+                    (friendship_id,),
+                )
+            else:
+                if action == "decline" and (friendship[1] != user["id"] or friendship[2] != "pending"):
+                    return HTMLResponse("Diese Anfrage kann nicht abgelehnt werden.", status_code=403)
+                cursor.execute("DELETE FROM friendships WHERE id = %s", (friendship_id,))
+        connection.commit()
+    other_id = friendship[1] if friendship[0] == user["id"] else friendship[0]
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute("SELECT username FROM users WHERE id = %s", (other_id,))
+            other = cursor.fetchone()
+    return RedirectResponse(f"/users/{other[0]}" if other else "/", status_code=303)
+
+
+# ============================================================
+# Direct messages
+# ============================================================
+
+def load_chat_partner(cursor, user, username: str):
+    cursor.execute(
+        """
+        SELECT u.id, u.username, COALESCE(u.display_name, u.username), u.avatar_path,
+               u.is_admin
+        FROM users u
+        WHERE LOWER(u.username) = LOWER(%s)
+          AND u.id <> %s
+          AND (%s OR u.is_admin OR EXISTS (
+              SELECT 1 FROM friendships f
+              WHERE f.status = 'accepted'
+                AND ((f.requester_id = %s AND f.addressee_id = u.id)
+                  OR (f.addressee_id = %s AND f.requester_id = u.id))
+          ))
+        """,
+        (username, user["id"], user["is_admin"], user["id"], user["id"]),
+    )
+    row = cursor.fetchone()
+    if not row:
+        return None
+    return {"id": row[0], "username": row[1], "display_name": row[2],
+            "avatar_path": row[3], "is_admin": bool(row[4])}
+
+
+@app.get("/messages", response_class=HTMLResponse)
+def message_inbox(request: Request):
+    user = get_current_user(request)
+    conversations = []
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                """
+                SELECT u.id, u.username, COALESCE(u.display_name, u.username), u.avatar_path
+                FROM users u
+                WHERE u.id <> %s
+                  AND (%s OR u.is_admin OR EXISTS (
+                      SELECT 1 FROM friendships f
+                      WHERE f.status = 'accepted'
+                        AND ((f.requester_id = %s AND f.addressee_id = u.id)
+                          OR (f.addressee_id = %s AND f.requester_id = u.id))
+                  ))
+                ORDER BY COALESCE(u.display_name, u.username)
+                """,
+                (user["id"], user["is_admin"], user["id"], user["id"]),
+            )
+            for row in cursor.fetchall():
+                cursor.execute(
+                    """
+                    SELECT body, created_at, sender_id,
+                           (SELECT COUNT(*) FROM direct_messages
+                            WHERE sender_id = %s AND recipient_id = %s AND read_at IS NULL)
+                    FROM direct_messages
+                    WHERE (sender_id = %s AND recipient_id = %s)
+                       OR (sender_id = %s AND recipient_id = %s)
+                    ORDER BY created_at DESC LIMIT 1
+                    """,
+                    (row[0], user["id"], user["id"], row[0], row[0], user["id"]),
+                )
+                latest = cursor.fetchone()
+                conversations.append({
+                    "id": row[0], "username": row[1], "display_name": row[2],
+                    "avatar_path": row[3], "last_message": latest[0] if latest else None,
+                    "last_at": latest[1].strftime("%d.%m.%Y %H:%M") if latest else None,
+                    "last_from_me": bool(latest and latest[2] == user["id"]),
+                    "unread_count": latest[3] if latest else 0,
+                })
+    template = templates.get_template("messages.html")
+    return template.render(user=user, conversations=conversations, partner=None, messages=[])
+
+
+@app.get("/messages/{username}", response_class=HTMLResponse)
+def message_conversation(request: Request, username: str):
+    user = get_current_user(request)
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            partner = load_chat_partner(cursor, user, username)
+            if not partner:
+                return HTMLResponse("Chat nicht erlaubt. Er ist für Freunde und Unterhaltungen mit Admins verfügbar.", status_code=403)
+            cursor.execute(
+                """
+                UPDATE direct_messages SET read_at = CURRENT_TIMESTAMP
+                WHERE sender_id = %s AND recipient_id = %s AND read_at IS NULL
+                """,
+                (partner["id"], user["id"]),
+            )
+            cursor.execute(
+                """
+                SELECT sender_id, body, created_at
+                FROM direct_messages
+                WHERE (sender_id = %s AND recipient_id = %s)
+                   OR (sender_id = %s AND recipient_id = %s)
+                ORDER BY created_at ASC, id ASC
+                LIMIT 500
+                """,
+                (user["id"], partner["id"], partner["id"], user["id"]),
+            )
+            messages = [
+                {"from_me": row[0] == user["id"], "body": row[1],
+                 "created_at": row[2].strftime("%d.%m.%Y %H:%M")}
+                for row in cursor.fetchall()
+            ]
+        connection.commit()
+    template = templates.get_template("messages.html")
+    return template.render(user=get_current_user(request), conversations=[], partner=partner, messages=messages)
+
+
+@app.post("/messages/{username}")
+def send_message(request: Request, username: str, body: str = Form(...)):
+    user = get_current_user(request)
+    body = body.strip()
+    if not body or len(body) > 2000:
+        return HTMLResponse("Eine Nachricht muss zwischen 1 und 2000 Zeichen lang sein.", status_code=400)
+    with get_db_connection() as connection:
+        with connection.cursor() as cursor:
+            partner = load_chat_partner(cursor, user, username)
+            if not partner:
+                return HTMLResponse("Chat nicht erlaubt. Er ist für Freunde und Unterhaltungen mit Admins verfügbar.", status_code=403)
+            cursor.execute(
+                "INSERT INTO direct_messages (sender_id, recipient_id, body) VALUES (%s, %s, %s)",
+                (user["id"], partner["id"], body),
+            )
+        connection.commit()
+    return RedirectResponse(f"/messages/{partner['username']}#latest", status_code=303)
 
 
 # ============================================================
@@ -1557,7 +2416,7 @@ def new_concert(request: Request):
         return login_redirect("/concerts/new")
 
     template = templates.get_template("new_concert.html")
-    return template.render(user=user)
+    return template.render(user=user, linkable_events=get_linkable_events())
 
 
 # ============================================================
@@ -1573,7 +2432,7 @@ def concert_detail(request: Request, concert_id: int):
 
     if not concert:
         return HTMLResponse(
-            "<h1>Konzert nicht gefunden</h1>",
+            "<h1>Veranstaltung nicht gefunden</h1>",
             status_code=404
         )
 
@@ -1665,6 +2524,7 @@ def concert_detail(request: Request, concert_id: int):
     ]
     attending_users = [item for item in attendance if item["status"] == "attending"]
     ticket_seekers = [item for item in attendance if item["status"] == "ticket_search"]
+    ticket_offers = [item for item in attendance if item["status"] == "ticket_offer"]
     maybe_users = [item for item in attendance if item["status"] == "maybe"]
     current_attendance = next(
         (item["status"] for item in attendance if item["user_id"] == user["id"]),
@@ -1684,6 +2544,8 @@ def concert_detail(request: Request, concert_id: int):
         attending_count=len(attending_users),
         ticket_seekers=ticket_seekers,
         ticket_seeker_count=len(ticket_seekers),
+        ticket_offers=ticket_offers,
+        ticket_offer_count=len(ticket_offers),
         maybe_users=maybe_users,
         maybe_count=len(maybe_users),
     )
@@ -1697,6 +2559,8 @@ def concert_detail(request: Request, concert_id: int):
 async def create_concert(
     request: Request,
     artist: str = Form(...),
+    event_type: str = Form("concert"),
+    parent_event_id: str = Form(""),
     venue_id: str = Form(""),
     venue_name: str = Form(""),
     city: str = Form(""),
@@ -1710,6 +2574,7 @@ async def create_concert(
     description: str = Form(""),
     ticket_url: str = Form(""),
     ticket_price: str = Form(""),
+    flyer_url: str = Form(""),
     flyer: UploadFile | None = File(None)
 ):
     user = get_current_user(request)
@@ -1717,6 +2582,19 @@ async def create_concert(
     if not user:
         return login_redirect("/concerts/new")
 
+    if event_type not in EVENT_TYPES:
+        return HTMLResponse("<h1>Ungültige Veranstaltungskategorie.</h1>", status_code=400)
+    if event_type == "festival" and not end_datetime:
+        return HTMLResponse("<h1>Bei Festivals ist ein Enddatum erforderlich.</h1>", status_code=400)
+    if event_type != "festival":
+        end_datetime = ""
+    if end_datetime and datetime.fromisoformat(end_datetime) < datetime.fromisoformat(start_datetime):
+        return HTMLResponse("<h1>Das Enddatum darf nicht vor dem Beginn liegen.</h1>", status_code=400)
+    try:
+        normalized_flyer_url = normalize_external_url(flyer_url, "den Flyer")
+    except ValueError as error:
+        return HTMLResponse(f"<h1>{error}</h1>", status_code=400)
+
     flyer_path, error = save_image(
         flyer,
         UPLOAD_DIR,
@@ -1728,6 +2606,13 @@ async def create_concert(
 
     with get_db_connection() as connection:
         with connection.cursor() as cursor:
+            try:
+                selected_parent_event_id = resolve_event_relationship(
+                    cursor, event_type, parent_event_id
+                )
+            except ValueError as error:
+                return HTMLResponse(f"<h1>{error}</h1>", status_code=400)
+
             selected_venue_id = resolve_venue(
                 cursor,
                 venue_id,
@@ -1744,6 +2629,8 @@ async def create_concert(
                 """
                 INSERT INTO concerts (
                     artist,
+                    event_type,
+                    parent_event_id,
                     venue_id,
                     start_datetime,
                     end_datetime,
@@ -1751,15 +2638,18 @@ async def create_concert(
                     ticket_url,
                     ticket_price,
                     flyer_path,
+                    flyer_url,
                     created_by
                 )
                 VALUES (
-                    %s, %s, %s, %s, %s, %s, %s, %s, %s
+                    %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s
                 )
                 RETURNING id
                 """,
                 (
                     artist,
+                    event_type,
+                    selected_parent_event_id,
                     selected_venue_id,
                     start_datetime,
                     end_datetime or None,
@@ -1767,6 +2657,7 @@ async def create_concert(
                     ticket_url or None,
                     ticket_price or None,
                     flyer_path,
+                    normalized_flyer_url,
                     user["id"],
                 ),
             )
@@ -1801,7 +2692,7 @@ def edit_concert_page(request: Request, concert_id: int):
 
     if not concert:
         return HTMLResponse(
-            "<h1>Konzert nicht gefunden</h1>",
+            "<h1>Veranstaltung nicht gefunden</h1>",
             status_code=404
         )
 
@@ -1815,6 +2706,7 @@ def edit_concert_page(request: Request, concert_id: int):
     return template.render(
         user=user,
         concert=concert,
+        linkable_events=get_linkable_events(exclude_id=concert_id),
         can_edit_title=can_edit_title(user, concert),
         can_edit_details=can_edit_details(user, concert),
         can_delete=can_delete_concert(user, concert),
@@ -1826,6 +2718,8 @@ async def edit_concert(
     request: Request,
     concert_id: int,
     artist: str = Form(""),
+    event_type: str = Form("concert"),
+    parent_event_id: str = Form(""),
     venue_id: str = Form(""),
     venue_name: str = Form(""),
     city: str = Form(""),
@@ -1839,6 +2733,7 @@ async def edit_concert(
     description: str = Form(""),
     ticket_url: str = Form(""),
     ticket_price: str = Form(""),
+    flyer_url: str = Form(""),
     flyer: UploadFile | None = File(None)
 ):
     user = get_current_user(request)
@@ -1850,7 +2745,7 @@ async def edit_concert(
 
     if not concert:
         return HTMLResponse(
-            "<h1>Konzert nicht gefunden</h1>",
+            "<h1>Veranstaltung nicht gefunden</h1>",
             status_code=404
         )
 
@@ -1870,9 +2765,26 @@ async def edit_concert(
     next_ticket_url = concert["ticket_url"]
     next_ticket_price = concert["ticket_price"]
     next_flyer = concert["flyer_path"]
+    next_flyer_url = concert["flyer_url"]
     next_venue_id = concert["venue"]["id"]
+    next_event_type = concert["event_type"]
+    next_parent_event_id = concert["parent_event"]["id"] if concert["parent_event"] else None
 
     if can_edit_details(user, concert):
+        if event_type not in EVENT_TYPES:
+            return HTMLResponse("<h1>Ungültige Veranstaltungskategorie.</h1>", status_code=400)
+        if event_type == "festival" and not end_datetime:
+            return HTMLResponse("<h1>Bei Festivals ist ein Enddatum erforderlich.</h1>", status_code=400)
+        if event_type != "festival":
+            end_datetime = ""
+        effective_start = start_datetime or concert["start_local"]
+        if end_datetime and datetime.fromisoformat(end_datetime) < datetime.fromisoformat(effective_start):
+            return HTMLResponse("<h1>Das Enddatum darf nicht vor dem Beginn liegen.</h1>", status_code=400)
+        try:
+            next_flyer_url = normalize_external_url(flyer_url, "den Flyer")
+        except ValueError as error:
+            return HTMLResponse(f"<h1>{error}</h1>", status_code=400)
+
         flyer_path, error = save_image(
             flyer,
             UPLOAD_DIR,
@@ -1883,10 +2795,19 @@ async def edit_concert(
 
         with get_db_connection() as connection:
             with connection.cursor() as cursor:
+                try:
+                    next_parent_event_id = resolve_event_relationship(
+                        cursor, event_type, parent_event_id, concert_id
+                    )
+                except ValueError as error:
+                    return HTMLResponse(f"<h1>{error}</h1>", status_code=400)
                 resolved_venue_id = resolve_venue(
                     cursor,
                     venue_id,
-                    venue_name or concert["venue"]["name"],
+                    venue_name or (
+                        concert["venue"]["name"]
+                        if concert["venue"]["id"] else ""
+                    ),
                     city,
                     street,
                     postal_code,
@@ -1898,6 +2819,7 @@ async def edit_concert(
 
         next_start = start_datetime or concert["start_datetime"]
         next_end = end_datetime or None
+        next_event_type = event_type
         next_description = description or None
         next_ticket_url = ticket_url or None
         next_ticket_price = ticket_price or None
@@ -1911,17 +2833,22 @@ async def edit_concert(
                 UPDATE concerts
                 SET
                     artist = %s,
+                    event_type = %s,
+                    parent_event_id = %s,
                     venue_id = %s,
                     start_datetime = %s,
                     end_datetime = %s,
                     description = %s,
                     ticket_url = %s,
                     ticket_price = %s,
-                    flyer_path = %s
+                    flyer_path = %s,
+                    flyer_url = %s
                 WHERE id = %s
                 """,
                 (
                     next_artist,
+                    next_event_type,
+                    next_parent_event_id,
                     next_venue_id,
                     next_start,
                     next_end or None,
@@ -1929,6 +2856,7 @@ async def edit_concert(
                     next_ticket_url,
                     next_ticket_price,
                     next_flyer,
+                    next_flyer_url,
                     concert_id,
                 ),
             )
@@ -1951,7 +2879,7 @@ def delete_concert(request: Request, concert_id: int):
 
     if not concert:
         return HTMLResponse(
-            "<h1>Konzert nicht gefunden</h1>",
+            "<h1>Veranstaltung nicht gefunden</h1>",
             status_code=404
         )
 
@@ -1963,12 +2891,18 @@ def delete_concert(request: Request, concert_id: int):
 
     with get_db_connection() as connection:
         with connection.cursor() as cursor:
+            cursor.execute("SELECT path FROM concert_photos WHERE concert_id = %s", (concert_id,))
+            photo_paths = [row[0] for row in cursor.fetchall()]
             cursor.execute(
                 "DELETE FROM concerts WHERE id = %s",
                 (concert_id,),
             )
         connection.commit()
 
+    remove_uploaded_file(concert["flyer_path"], UPLOAD_DIR, "/static/uploads/flyers/")
+    for photo_path in photo_paths:
+        remove_uploaded_file(photo_path, PHOTO_DIR, "/static/uploads/photos/")
+
     return RedirectResponse("/", status_code=303)
 
 
@@ -1982,10 +2916,10 @@ def set_attendance(
 
     if not user:
         return login_redirect(f"/concerts/{concert_id}")
-    if status not in {"attending", "maybe", "ticket_search"}:
+    if status not in {"attending", "maybe", "ticket_search", "ticket_offer"}:
         return HTMLResponse("<h1>Ungültige Auswahl</h1>", status_code=400)
     if not load_concert(concert_id):
-        return HTMLResponse("<h1>Konzert nicht gefunden</h1>", status_code=404)
+        return HTMLResponse("<h1>Veranstaltung nicht gefunden</h1>", status_code=404)
 
     with get_db_connection() as connection:
         with connection.cursor() as cursor:
@@ -2020,7 +2954,7 @@ def add_comment(
 
     if not concert:
         return HTMLResponse(
-            "<h1>Konzert nicht gefunden</h1>",
+            "<h1>Veranstaltung nicht gefunden</h1>",
             status_code=404
         )
 
@@ -2074,7 +3008,7 @@ async def add_photo(
 
     if not concert:
         return HTMLResponse(
-            "<h1>Konzert nicht gefunden</h1>",
+            "<h1>Veranstaltung nicht gefunden</h1>",
             status_code=404
         )
 
diff --git a/app/static/css/style.css b/app/static/css/style.css
index 0824b01..73a853e 100644
--- a/app/static/css/style.css
+++ b/app/static/css/style.css
@@ -1,12 +1,12 @@
 :root {
-    --bg: #0b0f19;
-    --surface: #151b29;
-    --surface-hover: #1b2333;
-    --border: #293449;
-    --text: #f3f4f6;
-    --muted: #9ca3af;
-    --accent: #8b5cf6;
-    --accent-hover: #7c3aed;
+    --bg: #050505;
+    --surface: #101010;
+    --surface-hover: #1a1111;
+    --border: #3a3030;
+    --text: #f5f5f4;
+    --muted: #a8a29e;
+    --accent: #b91c1c;
+    --accent-hover: #dc2626;
 }
 
 * {
@@ -23,7 +23,7 @@ body {
         "Segoe UI",
         sans-serif;
 
-    background: var(--bg);
+    background: radial-gradient(circle at 50% -15%, #320909 0, transparent 32rem), var(--bg);
     color: var(--text);
 }
 
@@ -33,7 +33,7 @@ a {
 }
 
 header {
-    background: rgba(21, 27, 41, 0.95);
+    background: rgba(8, 8, 8, 0.96);
     border-bottom: 1px solid var(--border);
     position: sticky;
     top: 0;
@@ -54,12 +54,27 @@ header {
 .logo {
     font-size: 1.4rem;
     font-weight: 800;
+    font-family: Impact, Haettenschweiler, "Arial Narrow Bold", sans-serif;
+    letter-spacing: .06em;
+    text-transform: uppercase;
 }
 
 .logo span {
     color: var(--accent);
 }
 
+.user-menu { position: relative; margin-left: auto; }
+.user-menu summary { padding: 9px 12px; border: 1px solid var(--border); border-radius: 9px; cursor: pointer; list-style: none; font-weight: 700; }
+.user-menu summary::-webkit-details-marker { display: none; }
+.user-menu[open] summary { border-color: var(--accent); background: var(--surface-hover); }
+.user-menu-panel { position: absolute; top: calc(100% + 7px); right: 0; z-index: 100; min-width: 170px; padding: 7px; background: #090909; border: 1px solid var(--border); border-radius: 10px; box-shadow: 0 14px 35px rgba(0,0,0,.6); }
+.user-menu-panel a, .user-menu-panel button { display: block; width: 100%; padding: 10px 11px; color: var(--text); background: transparent; border: 0; border-radius: 7px; text-align: left; font: inherit; cursor: pointer; }
+.user-menu-panel a:hover, .user-menu-panel button:hover { background: var(--surface-hover); color: #f87171; }
+.user-menu-panel form { max-width: none; margin: 0; }
+.metal-notification { position: relative; display: inline-block; margin-left: 5px; color: #ef4444; filter: saturate(1.5); }
+.metal-notification b { position: absolute; top: -7px; right: -9px; min-width: 16px; padding: 1px 4px; color: #fff; background: #b91c1c; border-radius: 999px; font: 700 .65rem/1.3 system-ui, sans-serif; text-align: center; }
+.menu-count { float: right; min-width: 22px; padding: 1px 6px; color: #fff; background: #b91c1c; border-radius: 999px; text-align: center; }
+
 main {
     max-width: 1100px;
     margin: 0 auto;
@@ -73,6 +88,8 @@ main {
 .page-title h1 {
     margin: 0;
     font-size: 2rem;
+    font-family: Impact, Haettenschweiler, "Arial Narrow Bold", sans-serif;
+    letter-spacing: .04em;
 }
 
 .page-title p {
diff --git a/app/static/images/black-denim-texture.webp b/app/static/images/black-denim-texture.webp
new file mode 100644
index 0000000..42f138c
Binary files /dev/null and b/app/static/images/black-denim-texture.webp differ
diff --git a/app/static/style.css b/app/static/style.css
index d22d593..d6a8d3c 100644
--- a/app/static/style.css
+++ b/app/static/style.css
@@ -93,6 +93,8 @@ a {
     width: 100%;
     background: #0a0d12;
     display: flex;
+    flex-direction: column;
+    align-items: center;
     justify-content: center;
     padding: 25px;
 }
@@ -363,3 +365,61 @@ a {
     }
 
 }
+
+/* Dark metal theme */
+body {
+    background: radial-gradient(circle at 50% -15%, #320909 0, transparent 34rem), #050505;
+    color: #f5f5f4;
+}
+
+.concert-detail,
+.comment,
+.attendance-option {
+    background-color: #101010;
+    border-color: #3a3030;
+}
+
+.info-item,
+.attendance-section,
+.comments-section,
+.coming-soon {
+    background-color: #090909;
+    border-color: #3a3030;
+}
+
+.concert-content h1,
+.description h2,
+.attendance-section h2,
+.comments-section h2 {
+    font-family: Impact, Haettenschweiler, "Arial Narrow Bold", sans-serif;
+    letter-spacing: .04em;
+}
+
+.concert-action-edit,
+.ticket-button,
+.attendance-option:hover,
+.attendance-option.is-selected {
+    background: #7f1d1d;
+    border-color: #dc2626;
+}
+
+.concert-action:hover,
+.concert-action-edit:hover,
+.ticket-button:hover {
+    background: #991b1b;
+    border-color: #ef4444;
+}
+
+.attendance-list summary { color: #ef4444; }
+
+.user-menu { position: relative; margin-left: auto; }
+.user-menu summary { padding: 9px 12px; border: 1px solid #3a3030; border-radius: 9px; cursor: pointer; list-style: none; font-weight: 700; }
+.user-menu summary::-webkit-details-marker { display: none; }
+.user-menu[open] summary { border-color: #dc2626; background: #1a1111; }
+.user-menu-panel { position: absolute; top: calc(100% + 7px); right: 0; z-index: 100; min-width: 170px; padding: 7px; background: #090909; border: 1px solid #3a3030; border-radius: 10px; box-shadow: 0 14px 35px rgba(0,0,0,.6); }
+.user-menu-panel a, .user-menu-panel button { display: block; width: 100%; padding: 10px 11px; color: #f5f5f4; background: transparent; border: 0; border-radius: 7px; text-align: left; font: inherit; cursor: pointer; }
+.user-menu-panel a:hover, .user-menu-panel button:hover { background: #1a1111; color: #f87171; }
+.user-menu-panel form { margin: 0; }
+.metal-notification { position: relative; display: inline-block; margin-left: 5px; color: #ef4444; filter: saturate(1.5); }
+.metal-notification b { position: absolute; top: -7px; right: -9px; min-width: 16px; padding: 1px 4px; color: #fff; background: #b91c1c; border-radius: 999px; font: 700 .65rem/1.3 system-ui, sans-serif; text-align: center; }
+.menu-count { float: right; min-width: 22px; padding: 1px 6px; color: #fff; background: #b91c1c; border-radius: 999px; text-align: center; }
diff --git a/app/templates/_user_menu.html b/app/templates/_user_menu.html
new file mode 100644
index 0000000..ddf4b0e
--- /dev/null
+++ b/app/templates/_user_menu.html
@@ -0,0 +1,10 @@
+<details class="user-menu">
+    <summary>☠ {{ user.display_name }}{% if user.notification_count %} <span class="metal-notification" title="{{ user.notification_count }} neue Nachricht(en) oder Anfrage(n)" aria-label="Neue Benachrichtigungen">🤘<b>{{ user.notification_count }}</b></span>{% endif %}</summary>
+    <div class="user-menu-panel">
+        <a href="/profile">Mein Profil</a>
+        <a href="/messages">Nachrichten{% if user.unread_message_count %} <span class="menu-count">{{ user.unread_message_count }}</span>{% endif %}</a>
+        <form method="post" action="/logout">
+            <button type="submit">Abmelden</button>
+        </form>
+    </div>
+</details>
diff --git a/app/templates/account_link.html b/app/templates/account_link.html
new file mode 100644
index 0000000..5d2cb19
--- /dev/null
+++ b/app/templates/account_link.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html><html lang="de"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Account-Link · Pingu Concerts</title><link rel="stylesheet" href="/static/css/style.css"></head><body>
+<header><div class="header-inner"><a href="/" class="logo">🎸 Pingu <span>Concerts</span></a>{% include '_user_menu.html' %}</div></header>
+<main><div class="page-title"><h1>Passwort zurücksetzen</h1><p>Reset-Link für @{{ target_username }} · {{ target_email }}</p></div>
+<section class="admin-section"><p>Diesen persönlichen Link sicher an den User senden. Er ist zwei Stunden gültig und nur einmal verwendbar.</p><label class="invite-link" style="display:block;overflow-wrap:anywhere">{{ account_url }}</label><p><a class="button button-secondary" href="/admin/users">Zurück</a></p></section></main></body></html>
diff --git a/app/templates/admin_patches.html b/app/templates/admin_patches.html
index 8cfe396..97680ed 100644
--- a/app/templates/admin_patches.html
+++ b/app/templates/admin_patches.html
@@ -15,7 +15,7 @@
     </style>
 </head>
 <body>
-<header><div class="header-inner"><a href="/" class="logo">🎸 Pingu <span>Concerts</span></a><span>{{ user.display_name }}</span></div></header>
+<header><div class="header-inner"><a href="/" class="logo">🎸 Pingu <span>Concerts</span></a>{% include '_user_menu.html' %}</div></header>
 <main>
     <div class="page-title"><h1>🧵 Patch-Bilder</h1><p>Grafiken für die Patches auf der virtuellen Kutte verwalten.</p></div>
     {% set admin_section = 'patches' %}{% include '_admin_nav.html' %}
diff --git a/app/templates/admin_users.html b/app/templates/admin_users.html
index 0b71314..35584f5 100644
--- a/app/templates/admin_users.html
+++ b/app/templates/admin_users.html
@@ -7,14 +7,16 @@
     <link rel="stylesheet" href="/static/css/style.css">
     <style>
         .invite-link { display: block; margin-top: 14px; padding: 12px; overflow-wrap: anywhere; background: #0f1420; border: 1px solid var(--border); border-radius: 9px; color: #c4b5fd; }
-        .user-row { display: grid; grid-template-columns: minmax(0, 1fr) auto auto; gap: 12px; align-items: center; }
+        .user-row { display: grid; grid-template-columns: minmax(0, 1fr) auto auto auto; gap: 12px; align-items: center; }
         .user-row form { margin: 0; }
         .role-form { display: flex; gap: 8px; }
+        .role-form label { display: inline-flex; align-items: center; gap: 6px; white-space: nowrap; }
+        .role-form label input { width: auto; margin: 0; }
         @media (max-width: 700px) { .user-row { grid-template-columns: 1fr; } }
     </style>
 </head>
 <body>
-<header><div class="header-inner"><a href="/" class="logo">🎸 Pingu <span>Concerts</span></a><span>{{ user.display_name }}</span></div></header>
+<header><div class="header-inner"><a href="/" class="logo">🎸 Pingu <span>Concerts</span></a>{% include '_user_menu.html' %}</div></header>
 <main>
     <div class="page-title"><h1>⚙️ Verwaltung</h1><p>Benutzerkonten und Einladungen verwalten.</p></div>
     {% set admin_section = 'users' %}{% include '_admin_nav.html' %}
@@ -32,8 +34,12 @@
                     <div><strong>{{ managed_user.display_name }}</strong><div class="admin-meta">@{{ managed_user.username }} · {{ managed_user.email }} · seit {{ managed_user.created_at }}</div></div>
                     <form class="role-form" method="post" action="/admin/users/{{ managed_user.id }}">
                         <select name="role" aria-label="Rolle für {{ managed_user.username }}"><option value="user" {% if not managed_user.is_admin %}selected{% endif %}>Benutzer</option><option value="admin" {% if managed_user.is_admin %}selected{% endif %}>Admin</option></select>
+                        <label><input type="checkbox" name="founder_badge" {% if managed_user.has_founder_badge %}checked{% endif %}> Gründer-Patch</label>
                         <button class="button" type="submit">Speichern</button>
                     </form>
+                    <div class="role-form">
+                        <form method="post" action="/admin/users/{{ managed_user.id }}/account-link"><input type="hidden" name="purpose" value="password_reset"><button class="button button-secondary" type="submit">Passwort-Reset</button></form>
+                    </div>
                     {% if managed_user.id != user.id %}<form method="post" action="/admin/users/{{ managed_user.id }}/delete" onsubmit="return confirm('Diesen Benutzer wirklich löschen?');"><button class="admin-danger" type="submit">Löschen</button></form>{% endif %}
                 </div>
             {% endfor %}
diff --git a/app/templates/admin_venues.html b/app/templates/admin_venues.html
index cb3f5f2..f9af748 100644
--- a/app/templates/admin_venues.html
+++ b/app/templates/admin_venues.html
@@ -13,19 +13,37 @@
         .venue-actions label { display: flex; align-items: center; gap: 6px; }
         .merge-form { display: grid; grid-template-columns: minmax(180px, 1fr) auto; gap: 8px; margin-top: 12px; padding-top: 12px; border-top: 1px solid var(--border); }
         .delete-form { margin-top: 10px; text-align: right; }
+        .venue-card { padding: 0; overflow: hidden; }
+        .venue-summary { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 14px; align-items: center; padding: 14px 16px; cursor: pointer; list-style: none; }
+        .venue-summary::-webkit-details-marker { display: none; }
+        .venue-summary::after { content: "▾"; color: var(--muted); transition: transform .15s ease; }
+        .venue-card[open] .venue-summary::after { transform: rotate(180deg); }
+        .venue-card[open] .venue-summary { border-bottom: 1px solid var(--border); background: var(--surface-hover); }
+        .venue-summary-title { display: block; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+        .venue-summary-meta { display: block; margin-top: 3px; color: var(--muted); font-size: .83rem; }
+        .venue-verified { color: #86efac; }
+        .venue-unverified { color: #fca5a5; }
+        .venue-editor { padding: 16px; }
         @media (max-width: 900px) { .venue-fields { grid-template-columns: 1fr 1fr; } }
         @media (max-width: 560px) { .venue-fields, .merge-form { grid-template-columns: 1fr; } }
     </style>
 </head>
 <body>
-<header><div class="header-inner"><a href="/" class="logo">🎸 Pingu <span>Concerts</span></a><span>{{ user.display_name }}</span></div></header>
+<header><div class="header-inner"><a href="/" class="logo">🎸 Pingu <span>Concerts</span></a>{% include '_user_menu.html' %}</div></header>
 <main>
     <div class="page-title"><h1>📍 Veranstaltungsorte</h1><p>Orte korrigieren, bestätigen, zusammenführen oder entfernen.</p></div>
     {% set admin_section = 'venues' %}{% include '_admin_nav.html' %}
     <section class="admin-section">
         <div class="admin-list">
             {% for venue in venues %}
-                <article class="admin-row">
+                <details class="admin-row venue-card" {% if not venue.is_verified %}open{% endif %}>
+                    <summary class="venue-summary">
+                        <span>
+                            <strong class="venue-summary-title">{{ venue.name }}{% if venue.city %} · {{ venue.city }}{% endif %}{% if venue.country %} · {{ venue.country }}{% endif %}</strong>
+                            <span class="venue-summary-meta"><span class="{% if venue.is_verified %}venue-verified{% else %}venue-unverified{% endif %}">{% if venue.is_verified %}✓ bestätigt{% else %}● unbestätigt{% endif %}</span> · {{ venue.concert_count }} Veranstaltung(en) · ID {{ venue.id }}</span>
+                        </span>
+                    </summary>
+                    <div class="venue-editor">
                     <form method="post" action="/admin/venues/{{ venue.id }}">
                         <div class="venue-fields">
                             <input name="name" value="{{ venue.name }}" aria-label="Name" required>
@@ -50,7 +68,8 @@
                     <form class="delete-form" method="post" action="/admin/venues/{{ venue.id }}/delete" onsubmit="return confirm('{% if venue.concert_count %}Der Ort ist mit {{ venue.concert_count }} Konzert(en) verknüpft. Diese Konzerte haben danach keinen Veranstaltungsort mehr. {% endif %}Ort endgültig löschen?');">
                         <button class="admin-danger" type="submit">Ort löschen{% if venue.concert_count %} ({{ venue.concert_count }} Verknüpfung(en)){% endif %}</button>
                     </form>
-                </article>
+                    </div>
+                </details>
             {% else %}<p>Noch keine Veranstaltungsorte vorhanden.</p>{% endfor %}
         </div>
     </section>
diff --git a/app/templates/concert_detail.html b/app/templates/concert_detail.html
index 1c1d0e5..773fc8a 100644
--- a/app/templates/concert_detail.html
+++ b/app/templates/concert_detail.html
@@ -17,28 +17,44 @@
         href="/static/style.css"
     >
 
+    <style>
+        .detail-topbar { display: flex; justify-content: space-between; align-items: flex-start; gap: 16px; }
+        .event-type-badge { display: inline-block; margin-bottom: 8px; padding: 4px 9px; border: 1px solid #4b5563; border-radius: 999px; color: #c4b5fd; font-size: .8rem; font-weight: 700; text-transform: uppercase; }
+        .parent-event-link { color: #c4b5fd; }
+        .flyer-source { display: block; width: 100%; flex: 0 0 100%; margin: 10px 0 0; color: #a8a29e; font-size: .85rem; text-align: center; }
+        .flyer-source a { color: #f87171; text-decoration: underline; }
+        .flyer-disclaimer { display: block; margin-top: 4px; font-size: .75rem; }
+    </style>
+
 </head>
 
 <body>
 
 <div class="container">
 
-    <a href="/" class="back-link">
-        ← Zurück zum Kalender
-    </a>
+    <div class="detail-topbar">
+        <a href="/" class="back-link">← Zurück zum Kalender</a>
+        {% include '_user_menu.html' %}
+    </div>
 
     <article class="concert-detail">
 
-        {% if concert.flyer_path %}
+        {% if concert.flyer_url or concert.flyer_path %}
 
             <div class="flyer-container">
 
                 <img
-                    src="{{ concert.flyer_path }}"
+                    src="{{ concert.flyer_url or concert.flyer_path }}"
                     alt="Flyer {{ concert.artist }}"
                     class="concert-flyer"
+                    referrerpolicy="no-referrer"
+                    {% if concert.flyer_url and concert.flyer_path %}onerror="this.onerror=null;this.src='{{ concert.flyer_path }}'"{% endif %}
                 >
 
+                {% if concert.flyer_url %}
+                    <p class="flyer-source"><a href="{{ concert.flyer_url }}" target="_blank" rel="noopener noreferrer nofollow external">Quelle</a><span class="flyer-disclaimer">Extern eingebundener Flyer. Rechte liegen beim jeweiligen Veranstalter bzw. Rechteinhaber. Hinweise zur Entfernung bitte an die Administration.</span></p>
+                {% endif %}
+
             </div>
 
         {% endif %}
@@ -46,6 +62,8 @@
 
         <div class="concert-content">
 
+            <span class="event-type-badge">{{ concert.event_type_label }}</span>
+
             <h1>
                 {{ concert.artist }}
             </h1>
@@ -69,6 +87,11 @@
 
                         {{ concert.time }} Uhr
 
+                        {% if concert.event_type == 'festival' and concert.end_date %}
+                            <br>
+                            bis {{ concert.end_date }}{% if concert.end_time %}, {{ concert.end_time }} Uhr{% endif %}
+                        {% endif %}
+
                     </div>
 
                 </div>
@@ -96,12 +119,19 @@
 
 
                         {% if concert.venue.postal_code
-                              or concert.venue.city %}
+                              or concert.venue.city
+                              or (concert.venue.country
+                                  and concert.venue.country not in ('Deutschland', 'Germany')) %}
 
                             <br>
 
                             {{ concert.venue.postal_code }}
                             {{ concert.venue.city }}
+                            {% if concert.venue.country
+                                  and concert.venue.country not in ('Deutschland', 'Germany') %}
+                                {% if concert.venue.postal_code or concert.venue.city %} · {% endif %}
+                                {{ concert.venue.country }}
+                            {% endif %}
 
                         {% endif %}
 
@@ -136,13 +166,22 @@
 
             </div>
 
+            {% if concert.parent_event %}
+                <p>
+                    Gehört zu:
+                    <a class="parent-event-link" href="/concerts/{{ concert.parent_event.id }}">
+                        {{ concert.parent_event.event_type_label }} · {{ concert.parent_event.title }}
+                    </a>
+                </p>
+            {% endif %}
+
 
             {% if concert.description %}
 
                 <section class="description">
 
                     <h2>
-                        Über das Konzert
+                        Über die Veranstaltung
                     </h2>
 
                     <p>
@@ -173,9 +212,9 @@
 
             {% if can_edit %}
 
-                <div class="detail-actions" aria-label="Konzert verwalten">
+                <div class="detail-actions" aria-label="Veranstaltung verwalten">
                     <a href="/concerts/{{ concert.id }}/edit" class="concert-action concert-action-edit">
-                        ✏️ Konzert bearbeiten
+                        ✏️ Veranstaltung bearbeiten
                     </a>
 
                     {% if user.is_admin and can_delete %}
@@ -183,10 +222,10 @@
                         <form
                             method="post"
                             action="/concerts/{{ concert.id }}/delete"
-                            onsubmit="return confirm('Dieses Konzert wirklich löschen?');"
+                            onsubmit="return confirm('Diese Veranstaltung wirklich löschen?');"
                         >
                             <button type="submit" class="concert-action concert-action-delete">
-                                🗑️ Konzert löschen
+                                🗑️ Veranstaltung löschen
                             </button>
                         </form>
 
@@ -234,7 +273,17 @@
                             type="submit"
                             class="attendance-option {% if current_attendance == 'ticket_search' %}is-selected{% endif %}"
                         >
-                            🎟️ Suche Ticket
+                            🔎 Suche Ticket
+                        </button>
+                    </form>
+
+                    <form method="post" action="/concerts/{{ concert.id }}/attendance">
+                        <input type="hidden" name="status" value="ticket_offer">
+                        <button
+                            type="submit"
+                            class="attendance-option {% if current_attendance == 'ticket_offer' %}is-selected{% endif %}"
+                        >
+                            🎟️ Biete Ticket
                         </button>
                     </form>
 
@@ -245,6 +294,7 @@
                         {{ attending_count }} Zusage{% if attending_count != 1 %}n{% endif %}
                         · {{ maybe_count }} Vielleicht
                         · {{ ticket_seeker_count }} sucht Ticket
+                        · {{ ticket_offer_count }} bietet Ticket
                     </summary>
 
                     <div class="attendance-groups">
@@ -278,7 +328,7 @@
                         </div>
 
                         <div>
-                            <h3>🎟️ Sucht ein Ticket</h3>
+                            <h3>🔎 Sucht ein Ticket</h3>
 
                             {% if ticket_seekers %}
                                 <ul>
@@ -291,6 +341,20 @@
                             {% endif %}
                         </div>
 
+                        <div>
+                            <h3>🎟️ Bietet ein Ticket</h3>
+
+                            {% if ticket_offers %}
+                                <ul>
+                                    {% for offer in ticket_offers %}
+                                        <li><a href="/users/{{ offer.username }}">{{ offer.name }}</a></li>
+                                    {% endfor %}
+                                </ul>
+                            {% else %}
+                                <p>Aktuell bietet niemand ein Ticket an.</p>
+                            {% endif %}
+                        </div>
+
                     </div>
                 </details>
 
diff --git a/app/templates/edit_concert.html b/app/templates/edit_concert.html
index 40b463a..19108d8 100644
--- a/app/templates/edit_concert.html
+++ b/app/templates/edit_concert.html
@@ -10,17 +10,39 @@
 <header>
     <div class="header-inner">
         <a href="/" class="logo">🎸 Pingu <span>Concerts</span></a>
+        {% include '_user_menu.html' %}
     </div>
 </header>
 <main>
     <div class="page-title">
-        <h1>✏️ Konzert bearbeiten</h1>
-        <p>Änderungen werden direkt beim Konzert gespeichert.</p>
+        <h1>✏️ Veranstaltung bearbeiten</h1>
+        <p>Änderungen werden direkt bei der Veranstaltung gespeichert.</p>
     </div>
     <section class="empty">
         <form method="post" action="/concerts/{{ concert.id }}/edit" enctype="multipart/form-data">
+            {% if can_edit_details %}
+                <p>
+                    <label>Kategorie<br>
+                        <select name="event_type" id="event-type" required>
+                            <option value="concert" {% if concert.event_type == 'concert' %}selected{% endif %}>Konzert</option>
+                            <option value="festival" {% if concert.event_type == 'festival' %}selected{% endif %}>Festival</option>
+                            <option value="other" {% if concert.event_type == 'other' %}selected{% endif %}>Sonstiges</option>
+                        </select>
+                    </label>
+                </p>
+                <p id="parent-event-field" {% if concert.event_type != 'other' %}hidden{% endif %}>
+                    <label>Gehört zu<br>
+                        <select name="parent_event_id" id="parent-event-id">
+                            <option value="">Keine Verknüpfung – eigenständige Karte</option>
+                            {% for event in linkable_events %}
+                                <option value="{{ event.id }}" {% if concert.parent_event and concert.parent_event.id == event.id %}selected{% endif %}>{{ event.event_type_label }} · {{ event.title }} · {{ event.date }}</option>
+                            {% endfor %}
+                        </select>
+                    </label>
+                </p>
+            {% endif %}
             <p>
-                <label>Künstler / Band<br>
+                <label>Titel / Künstler / Band<br>
                     <input type="text" name="artist" value="{{ concert.artist }}" {% if not can_edit_title %}disabled{% endif %} required>
                 </label>
             </p>
@@ -53,9 +75,9 @@
                         <input type="datetime-local" name="start_datetime" value="{{ concert.start_local }}" required>
                     </label>
                 </p>
-                <p>
+                <p id="festival-end-field" {% if concert.event_type != 'festival' %}hidden{% endif %}>
                     <label>Ende<br>
-                        <input type="datetime-local" name="end_datetime" value="{{ concert.end_local }}">
+                        <input type="datetime-local" name="end_datetime" id="festival-end-datetime" value="{{ concert.end_local }}" {% if concert.event_type == 'festival' %}required{% endif %}>
                     </label>
                 </p>
                 <p>
@@ -73,14 +95,20 @@
                         <input type="number" name="ticket_price" value="{{ concert.ticket_price or '' }}" step="0.01" min="0">
                     </label>
                 </p>
+                <p>
+                    <label>Flyer extern verlinken <small>(bevorzugt)</small><br>
+                        <input type="url" name="flyer_url" value="{{ concert.flyer_url or '' }}" placeholder="https://veranstalter.example/flyer.jpg">
+                    </label>
+                    <small>Bitte möglichst die offizielle Quelle verwenden. Ein externer Link wird gegenüber einem Upload bevorzugt und unter dem Bild genannt. Feld leeren, um wieder den Upload zu verwenden.</small>
+                </p>
                 <p>
                     <label>Neuen Flyer hochladen<br>
                         <input type="file" name="flyer" accept="image/jpeg,image/png,image/webp">
                     </label>
                     <small>Ohne neue Datei bleibt der bisherige Flyer erhalten.</small>
                 </p>
-                {% if concert.flyer_path %}
-                    <p><img src="{{ concert.flyer_path }}" alt="Aktueller Flyer" style="max-width: 300px; max-height: 400px; border-radius: 10px;"></p>
+                {% if concert.flyer_url or concert.flyer_path %}
+                    <p><img src="{{ concert.flyer_url or concert.flyer_path }}" alt="Aktueller Flyer" referrerpolicy="no-referrer" style="max-width: 300px; max-height: 400px; border-radius: 10px;"></p>
                 {% endif %}
             {% endif %}
             <div>
@@ -90,5 +118,26 @@
         </form>
     </section>
 </main>
+{% if can_edit_details %}
+<script>
+const eventType = document.getElementById("event-type");
+const parentEventField = document.getElementById("parent-event-field");
+const parentEventId = document.getElementById("parent-event-id");
+const festivalEndField = document.getElementById("festival-end-field");
+const festivalEndDatetime = document.getElementById("festival-end-datetime");
+
+function updateEventFields() {
+    const isFestival = eventType.value === "festival";
+    const isOther = eventType.value === "other";
+    festivalEndField.hidden = !isFestival;
+    festivalEndDatetime.required = isFestival;
+    parentEventField.hidden = !isOther;
+    if (!isFestival) festivalEndDatetime.value = "";
+    if (!isOther) parentEventId.value = "";
+}
+
+eventType.addEventListener("change", updateEventFields);
+</script>
+{% endif %}
 </body>
 </html>
diff --git a/app/templates/index.html b/app/templates/index.html
index de5e403..b9db149 100644
--- a/app/templates/index.html
+++ b/app/templates/index.html
@@ -78,6 +78,33 @@
             gap: 15px;
         }
 
+        .event-group { display: grid; gap: 8px; }
+
+        .linked-events {
+            display: grid;
+            gap: 7px;
+            margin-left: 30px;
+        }
+
+        .concert-card.linked-event {
+            padding: 14px 18px;
+            border-left: 3px solid #a78bfa;
+            background: #121720;
+        }
+
+        .linked-event .concert-artist { font-size: 1.05rem; margin-bottom: 5px; }
+        .linked-event .concert-meta { font-size: .9rem; }
+
+        .event-category {
+            display: inline-block;
+            margin-bottom: 7px;
+            color: #aab4c3;
+            font-size: .78rem;
+            font-weight: 700;
+            letter-spacing: .04em;
+            text-transform: uppercase;
+        }
+
         .past-concerts-title {
             margin: 28px 0 0;
         }
@@ -127,6 +154,33 @@
             color: #8b949e;
         }
 
+        .search-panel { margin-bottom: 26px; padding: 16px; background: rgba(16,16,16,.92); border: 1px solid #3a3030; border-radius: 14px; }
+        .search-form { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 10px; }
+        .search-form input { margin: 0; }
+        .search-results-title { margin: 24px 0 12px; font-size: 1.15rem; }
+        .user-results { display: grid; grid-template-columns: repeat(auto-fill, minmax(210px, 1fr)); gap: 10px; margin-bottom: 24px; }
+        .user-result { display: flex; align-items: center; gap: 11px; padding: 12px; background: #101010; border: 1px solid #3a3030; border-radius: 11px; }
+        .user-result:hover { border-color: #dc2626; }
+        .user-result-avatar { width: 44px; height: 44px; flex: 0 0 44px; object-fit: cover; border-radius: 50%; background: #292524; display: grid; place-items: center; font-weight: 800; }
+        .user-result-name { min-width: 0; }
+        .user-result-name strong, .user-result-name span { display: block; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+        .user-result-name span { color: #a8a29e; font-size: .86rem; }
+
+        body {
+            background: radial-gradient(circle at 50% -20%, #3a0909 0, transparent 34rem), #050505;
+            min-height: 100vh;
+        }
+
+        .page-header { padding-bottom: 22px; border-bottom: 1px solid #3f2424; }
+        .page-header h1 { font-family: Impact, Haettenschweiler, "Arial Narrow Bold", sans-serif; letter-spacing: .05em; text-transform: uppercase; text-shadow: 0 2px 18px rgba(185, 28, 28, .45); }
+        .new-concert-button { background: #991b1b; border: 1px solid #dc2626; }
+        .new-concert-button:hover { background: #b91c1c; }
+        .admin-button:hover { border-color: #dc2626; }
+        .concert-card { background: linear-gradient(145deg, #101010, #181313); border-color: #3a3030; }
+        .concert-card:hover { border-color: #dc2626; background: #1c1212; }
+        .concert-date { color: #ef4444; }
+        .concert-card.linked-event { border-left-color: #dc2626; background: #0d0d0d; }
+
         @media (max-width: 600px) {
 
             .page-header {
@@ -139,12 +193,31 @@
                 text-align: center;
             }
 
+            .linked-events { margin-left: 16px; }
+            .search-form { grid-template-columns: 1fr; }
+
         }
 
     </style>
 
 </head>
 
+{% macro event_card(concert, linked=false) %}
+    <a href="/concerts/{{ concert.id }}" class="concert-card{% if linked %} linked-event{% endif %}">
+        <span class="event-category">{{ concert.event_type_label }}</span>
+        <div class="concert-artist">
+            {% if concert.event_type == 'festival' %}🎪{% elif concert.event_type == 'other' %}🥂{% else %}🎸{% endif %}
+            {{ concert.artist }}
+        </div>
+        <div class="concert-meta">
+            <div class="concert-date">
+                📅 {{ concert.date }}{% if concert.end_date %} – {{ concert.end_date }}{% else %} um {{ concert.time }} Uhr{% endif %}
+            </div>
+            <div>📍 {{ concert.venue }}</div>
+        </div>
+    </a>
+{% endmacro %}
+
 
 <body>
 
@@ -155,11 +228,11 @@
         <div>
 
             <h1>
-                🐧 Pingu Concerts
+                {% if archive %}☠ Vergangene Veranstaltungen{% else %}🐧 Pingu Concerts{% endif %}
             </h1>
 
             <div class="subtitle">
-                Unser Konzertkalender
+                {% if archive %}Das Archiv vergangener Nächte{% else %}Konzerte, Festivals und alles davor{% endif %}
             </div>
 
         </div>
@@ -167,8 +240,8 @@
 
         <div class="header-actions">
 
-            <a href="/profile" class="admin-button">
-                👤 Mein Profil
+            <a href="{% if archive %}/{% else %}/events/past{% endif %}" class="admin-button">
+                {% if archive %}⚡ Bevorstehend{% else %}☠ Vergangene{% endif %}
             </a>
 
             {% if user.is_admin %}
@@ -183,79 +256,69 @@
                 href="/concerts/new"
                 class="new-concert-button"
             >
-                + Konzert hinzufügen
+                + Veranstaltung hinzufügen
             </a>
 
+            {% include '_user_menu.html' %}
+
         </div>
 
     </header>
 
+    <section class="search-panel" aria-label="Suche">
+        <form class="search-form" method="get" action="{% if archive %}/events/past{% else %}/{% endif %}">
+            <input type="search" name="q" value="{{ search_query }}" placeholder="Veranstaltungen, Orte oder User suchen …" aria-label="Veranstaltungen oder User suchen">
+            <button class="new-concert-button" type="submit">Suchen</button>
+        </form>
+    </section>
+
+    {% if search_query %}
+        <h2 class="search-results-title">User zu „{{ search_query }}“</h2>
+        {% if user_results %}
+            <div class="user-results">
+                {% for result in user_results %}
+                    <a class="user-result" href="/users/{{ result.username }}">
+                        {% if result.avatar_path %}<img class="user-result-avatar" src="{{ result.avatar_path }}" alt="">{% else %}<span class="user-result-avatar">{{ result.display_name[:1] }}</span>{% endif %}
+                        <span class="user-result-name"><strong>{{ result.display_name }}</strong><span>@{{ result.username }}</span></span>
+                    </a>
+                {% endfor %}
+            </div>
+        {% else %}<p class="subtitle">Keine passenden User gefunden.</p>{% endif %}
+        <h2 class="search-results-title">Veranstaltungen zu „{{ search_query }}“</h2>
+    {% endif %}
+
 
     {% if upcoming_concerts or past_concerts %}
 
         <div class="concert-list">
 
             {% for concert in upcoming_concerts %}
-
-                <a
-                    href="/concerts/{{ concert.id }}"
-                    class="concert-card"
-                >
-
-                    <div class="concert-artist">
-                        🎸 {{ concert.artist }}
-                    </div>
-
-
-                    <div class="concert-meta">
-
-                        <div class="concert-date">
-                            📅 {{ concert.date }}
-                            um {{ concert.time }} Uhr
+                <div class="event-group">
+                    {{ event_card(concert) }}
+                    {% if concert.children %}
+                        <div class="linked-events">
+                            {% for child in concert.children %}{{ event_card(child, true) }}{% endfor %}
                         </div>
-
-
-                        <div>
-                            📍 {{ concert.venue }}
-                        </div>
-
-                    </div>
-
-                </a>
+                    {% endif %}
+                </div>
 
             {% endfor %}
 
-            {% if past_concerts %}
+            {% if archive and past_concerts %}
 
                 <h2 class="past-concerts-title">
-                    Vergangene Konzerte
+                    Archiv
                 </h2>
 
                 {% for concert in past_concerts %}
-
-                    <a
-                        href="/concerts/{{ concert.id }}"
-                        class="concert-card"
-                    >
-
-                        <div class="concert-artist">
-                            🎸 {{ concert.artist }}
-                        </div>
-
-                        <div class="concert-meta">
-
-                            <div class="concert-date">
-                                📅 {{ concert.date }}
-                                um {{ concert.time }} Uhr
+                    <div class="event-group">
+                        {{ event_card(concert) }}
+                        {% if concert.children %}
+                            <div class="linked-events">
+                                {% for child in concert.children %}{{ event_card(child, true) }}{% endfor %}
                             </div>
-
-                            <div>
-                                📍 {{ concert.venue }}
-                            </div>
-
-                        </div>
-
-                    </a>
+                        {% endif %}
+                    </div>
 
                 {% endfor %}
 
@@ -268,11 +331,11 @@
         <div class="empty-state">
 
             <h2>
-                Noch keine Konzerte 🎸
+                {% if archive %}Noch keine vergangenen Veranstaltungen ☠{% else %}Noch keine Veranstaltungen 🎸{% endif %}
             </h2>
 
             <p>
-                Leg das erste Konzert an!
+                {% if archive %}Hier erscheinen abgeschlossene Veranstaltungen.{% else %}Leg die erste Veranstaltung an!{% endif %}
             </p>
 
         </div>
diff --git a/app/templates/login.html b/app/templates/login.html
index 0b8e3f7..560a1d1 100644
--- a/app/templates/login.html
+++ b/app/templates/login.html
@@ -32,6 +32,7 @@
                 </label>
             </p>
             <button type="submit" class="button">Anmelden</button>
+            <p><small>Passwort vergessen? Bitte einen Admin um einen zeitlich begrenzten Reset-Link.</small></p>
             <a href="/" class="button button-secondary">Abbrechen</a>
         </form>
     </section>
diff --git a/app/templates/messages.html b/app/templates/messages.html
new file mode 100644
index 0000000..48cdb05
--- /dev/null
+++ b/app/templates/messages.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Nachrichten · Pingu Concerts</title>
+    <link rel="stylesheet" href="/static/css/style.css">
+    <style>
+        .conversation-list { display: grid; gap: 10px; }
+        .conversation-card { display: flex; align-items: center; gap: 12px; padding: 14px; background: var(--surface); border: 1px solid var(--border); border-radius: 13px; }
+        .conversation-card:hover { border-color: var(--accent); }
+        .chat-avatar { width: 48px; height: 48px; flex: 0 0 48px; border-radius: 50%; object-fit: cover; background: #292524; display: grid; place-items: center; font-weight: 800; }
+        .conversation-copy { min-width: 0; flex: 1; }
+        .conversation-copy strong, .conversation-copy span { display: block; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+        .conversation-copy span { margin-top: 3px; color: var(--muted); font-size: .9rem; }
+        .unread-badge { min-width: 26px; padding: 3px 7px; color: #fff; background: #b91c1c; border-radius: 999px; text-align: center; font-weight: 800; }
+        .chat-header { display: flex; align-items: center; gap: 12px; margin-bottom: 18px; }
+        .chat-header h1 { margin: 0; }
+        .chat-log { display: flex; flex-direction: column; gap: 9px; min-height: 260px; padding: 18px; background: #090909; border: 1px solid var(--border); border-radius: 15px; }
+        .chat-bubble { align-self: flex-start; max-width: min(76%, 650px); padding: 10px 13px; background: #262020; border-radius: 4px 13px 13px 13px; white-space: pre-wrap; overflow-wrap: anywhere; }
+        .chat-bubble.mine { align-self: flex-end; background: #5f1515; border-radius: 13px 4px 13px 13px; }
+        .chat-time { display: block; margin-top: 5px; color: #a8a29e; font-size: .72rem; }
+        .chat-form { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 10px; margin-top: 12px; max-width: none; }
+        .chat-form textarea { min-height: 76px; margin: 0; resize: vertical; }
+        .empty-chat { color: var(--muted); text-align: center; margin: auto; }
+        @media (max-width: 600px) { .chat-form { grid-template-columns: 1fr; } .chat-bubble { max-width: 90%; } }
+    </style>
+</head>
+<body>
+<header><div class="header-inner"><a href="/" class="logo">🎸 Pingu <span>Concerts</span></a>{% include '_user_menu.html' %}</div></header>
+<main>
+    {% if partner %}
+        <div class="chat-header">
+            {% if partner.avatar_path %}<img class="chat-avatar" src="{{ partner.avatar_path }}" alt="">{% else %}<span class="chat-avatar">{{ partner.display_name[:1] }}</span>{% endif %}
+            <div><h1>{{ partner.display_name }}</h1><a href="/users/{{ partner.username }}">@{{ partner.username }}</a></div>
+        </div>
+        <div class="chat-log">
+            {% for message in messages %}<div class="chat-bubble{% if message.from_me %} mine{% endif %}"{% if loop.last %} id="latest"{% endif %}>{{ message.body }}<span class="chat-time">{{ message.created_at }}</span></div>
+            {% else %}<p class="empty-chat">Noch keine Nachrichten. Schreib die erste!</p>{% endfor %}
+        </div>
+        <form class="chat-form" method="post" action="/messages/{{ partner.username }}">
+            <textarea name="body" maxlength="2000" required placeholder="Nachricht schreiben …" aria-label="Nachricht"></textarea>
+            <button class="button" type="submit">Senden</button>
+        </form>
+        <p><a class="button button-secondary" href="/messages">← Alle Nachrichten</a></p>
+    {% else %}
+        <div class="page-title"><h1>🤘 Nachrichten</h1><p>Private Chats mit deinen Freunden.</p></div>
+        <div class="conversation-list">
+            {% for conversation in conversations %}
+                <a class="conversation-card" href="/messages/{{ conversation.username }}">
+                    {% if conversation.avatar_path %}<img class="chat-avatar" src="{{ conversation.avatar_path }}" alt="">{% else %}<span class="chat-avatar">{{ conversation.display_name[:1] }}</span>{% endif %}
+                    <span class="conversation-copy"><strong>{{ conversation.display_name }}</strong><span>{% if conversation.last_message %}{% if conversation.last_from_me %}Du: {% endif %}{{ conversation.last_message }} · {{ conversation.last_at }}{% else %}Chat beginnen{% endif %}</span></span>
+                    {% if conversation.unread_count %}<span class="unread-badge">{{ conversation.unread_count }}</span>{% endif %}
+                </a>
+            {% else %}<div class="empty"><h2>Noch keine Chats</h2><p>Chats sind mit bestätigten Freunden und mit Admins verfügbar.</p></div>{% endfor %}
+        </div>
+    {% endif %}
+</main>
+</body>
+</html>
diff --git a/app/templates/new_concert.html b/app/templates/new_concert.html
index dcb20e4..42dcc83 100644
--- a/app/templates/new_concert.html
+++ b/app/templates/new_concert.html
@@ -10,7 +10,7 @@
         content="width=device-width, initial-scale=1.0"
     >
 
-    <title>Konzert hinzufügen · Pingu Concerts</title>
+    <title>Veranstaltung hinzufügen · Pingu Concerts</title>
 
     <link
         rel="stylesheet"
@@ -78,6 +78,8 @@
             🎸 Pingu <span>Concerts</span>
         </a>
 
+        {% include '_user_menu.html' %}
+
     </div>
 
 </header>
@@ -87,7 +89,7 @@
 
     <div class="page-title">
 
-        <h1>🎤 Konzert hinzufügen</h1>
+        <h1>🎤 Veranstaltung hinzufügen</h1>
 
         <p>
             Trag ein, worauf wir uns freuen.
@@ -104,6 +106,26 @@
             enctype="multipart/form-data"
         >
 
+            <p>
+                <label for="event-type">Kategorie</label><br>
+                <select name="event_type" id="event-type" required>
+                    <option value="concert">Konzert</option>
+                    <option value="festival">Festival</option>
+                    <option value="other">Sonstiges</option>
+                </select>
+            </p>
+
+            <p id="parent-event-field" hidden>
+                <label for="parent-event-id">Gehört zu</label><br>
+                <select name="parent_event_id" id="parent-event-id">
+                    <option value="">Keine Verknüpfung – eigenständige Karte</option>
+                    {% for event in linkable_events %}
+                        <option value="{{ event.id }}">{{ event.event_type_label }} · {{ event.title }} · {{ event.date }}</option>
+                    {% endfor %}
+                </select>
+                <small>Zum Beispiel ein gemeinsames Vortrinken vor einem Konzert.</small>
+            </p>
+
             <!-- ================================================= -->
             <!-- Künstler -->
             <!-- ================================================= -->
@@ -111,7 +133,7 @@
             <p>
 
                 <label>
-                    Künstler / Band<br>
+                    Titel / Künstler / Band<br>
 
                     <input
                         type="text"
@@ -124,7 +146,6 @@
 
             </p>
 
-
             <!-- ================================================= -->
             <!-- Veranstaltungsort -->
             <!-- ================================================= -->
@@ -208,6 +229,13 @@
 
             </p>
 
+            <p id="festival-end-field" hidden>
+                <label>
+                    Enddatum und Uhrzeit<br>
+                    <input type="datetime-local" name="end_datetime" id="festival-end-datetime">
+                </label>
+            </p>
+
 
             <!-- ================================================= -->
             <!-- Beschreibung -->
@@ -221,7 +249,7 @@
                     <textarea
                         name="description"
                         rows="5"
-                        placeholder="Optional: Infos zum Konzert, Tour, Supportbands usw."
+                        placeholder="Optional: Infos zur Veranstaltung, Tour, Supportbands usw."
                     ></textarea>
 
                 </label>
@@ -277,9 +305,13 @@
 
             <div class="flyer-upload">
 
+                <label for="flyer-url">🔗 Flyer extern verlinken <small>(bevorzugt)</small></label>
+                <input type="url" id="flyer-url" name="flyer_url" placeholder="https://veranstalter.example/flyer.jpg">
+                <div class="flyer-help">Bitte möglichst den offiziellen Flyer des Veranstalters oder der Band verlinken. Das Bild wird nicht auf Pingu Concerts kopiert; der Link wird als Quelle ausgewiesen.</div>
+
                 <label for="flyer">
 
-                    🎨 Konzert-Flyer
+                    🎨 Veranstaltungs-Flyer
 
                 </label>
 
@@ -294,7 +326,7 @@
 
                 <div class="flyer-help">
 
-                    JPG, PNG oder WEBP · maximal 10 MB
+                    Alternative, falls kein offizieller externer Link verfügbar ist: JPG, PNG oder WEBP · maximal 10 MB. Ist ein Link angegeben, wird er bevorzugt dargestellt.
 
                 </div>
 
@@ -330,7 +362,7 @@
                     type="submit"
                     class="button"
                 >
-                    💾 Konzert speichern
+                    💾 Veranstaltung speichern
                 </button>
 
 
@@ -352,6 +384,25 @@
 
 <script>
 
+const eventType = document.getElementById("event-type");
+const parentEventField = document.getElementById("parent-event-field");
+const parentEventId = document.getElementById("parent-event-id");
+const festivalEndField = document.getElementById("festival-end-field");
+const festivalEndDatetime = document.getElementById("festival-end-datetime");
+
+function updateEventFields() {
+    const isFestival = eventType.value === "festival";
+    const isOther = eventType.value === "other";
+    festivalEndField.hidden = !isFestival;
+    festivalEndDatetime.required = isFestival;
+    parentEventField.hidden = !isOther;
+    if (!isFestival) festivalEndDatetime.value = "";
+    if (!isOther) parentEventId.value = "";
+}
+
+eventType.addEventListener("change", updateEventFields);
+updateEventFields();
+
 /* ============================================================
    VENUE SEARCH
    ============================================================ */
diff --git a/app/templates/password_reset.html b/app/templates/password_reset.html
new file mode 100644
index 0000000..a94c8b7
--- /dev/null
+++ b/app/templates/password_reset.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html><html lang="de"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Passwort zurücksetzen · Pingu Concerts</title><link rel="stylesheet" href="/static/css/style.css"></head><body>
+<header><div class="header-inner"><a href="/" class="logo">🎸 Pingu <span>Concerts</span></a></div></header><main><div class="page-title"><h1>Passwort zurücksetzen</h1></div><section class="empty">
+{% if error %}<p role="alert">{{ error }}</p>{% endif %}<form method="post" action="/password-reset/{{ token }}"><label>Neues Passwort<br><input type="password" name="password" minlength="10" required autocomplete="new-password"></label><br><label>Passwort wiederholen<br><input type="password" name="password_repeat" minlength="10" required autocomplete="new-password"></label><br><button class="button" type="submit">Passwort speichern</button></form>
+</section></main></body></html>
diff --git a/app/templates/profile.html b/app/templates/profile.html
index 2113084..f30cb77 100644
--- a/app/templates/profile.html
+++ b/app/templates/profile.html
@@ -13,9 +13,15 @@
         .avatar-fallback { display: grid; place-items: center; background: #283048; font-size: 3rem; font-weight: 800; }
         .profile-name { margin: 0; font-size: 1.7rem; }
         .profile-handle, .profile-since { color: var(--muted); margin: 6px 0 0; }
+        .instagram-link { display: inline-flex; margin-top: 12px; padding: 8px 12px; color: #fff; background: #7f1d1d; border: 1px solid #dc2626; border-radius: 9px; font-weight: 700; }
+        .instagram-link:hover { color: #f87171; }
+        .profile-error { margin-bottom: 18px; padding: 12px 14px; color: #fecaca; background: #450a0a; border: 1px solid #b91c1c; border-radius: 9px; }
+        .profile-success { margin-bottom: 18px; padding: 12px 14px; color: #bbf7d0; background: #052e16; border: 1px solid #15803d; border-radius: 9px; }
+        .instagram-current { display: block; margin: -8px 0 14px; color: #f87171; }
+        .avatar-upload-status { display: block; min-height: 1.2em; margin: -8px 0 12px; color: var(--muted); font-size: .85rem; }
         .stat { margin-top: 22px; padding: 16px; background: #0f1420; border-radius: 12px; }
         .stat strong { display: block; color: #c4b5fd; font-size: 2.2rem; }
-        .kutte { position: relative; min-height: 320px; padding: 58px 36px 28px; background: linear-gradient(90deg, #151515 0 46%, #222 46% 54%, #151515 54%); border: 4px solid #353535; border-radius: 28px 28px 14px 14px; box-shadow: inset 0 0 0 2px #090909; }
+        .kutte { position: relative; min-height: 320px; padding: 58px 36px 28px; background-image: linear-gradient(90deg, rgba(0,0,0,.2) 0 46%, rgba(255,255,255,.035) 46% 54%, rgba(0,0,0,.2) 54%), url('/static/images/black-denim-texture.webp'); background-size: 100% 100%, 520px auto; background-repeat: no-repeat, repeat; border: 4px solid #292524; border-radius: 28px 28px 14px 14px; box-shadow: inset 0 0 28px 8px rgba(0,0,0,.8), 0 10px 30px rgba(0,0,0,.45); }
         .kutte::before, .kutte::after { content: ""; position: absolute; top: 0; width: 30%; height: 62px; background: #111; border-bottom: 3px solid #404040; }
         .kutte::before { left: 0; border-radius: 24px 0 45% 0; }
         .kutte::after { right: 0; border-radius: 0 24px 0 45%; }
@@ -26,10 +32,25 @@
         .patch-icon { font-size: 2.5rem; }
         .patch-image { width: auto; height: auto; max-width: 140px; max-height: 140px; object-fit: contain; display: block; }
         .patch.locked { opacity: .38; filter: grayscale(1); }
-        .patch.earned { border-style: solid; border-color: #a78bfa; box-shadow: 0 0 12px rgba(167, 139, 250, .35); }
+        .patch.earned { border: 0; background: transparent; box-shadow: 2px 3px 7px rgba(0,0,0,.7); }
         .profile-edit { margin-top: 24px; }
         .profile-edit form { margin: 0; max-width: none; }
         .profile-edit input { margin-bottom: 14px; }
+        .friend-actions { display: flex; flex-wrap: wrap; justify-content: center; gap: 8px; margin-top: 16px; }
+        .friend-actions form { margin: 0; }
+        .friend-note { margin: 14px 0 0; color: var(--muted); font-size: .9rem; }
+        .private-note { margin: 12px 0 0; padding: 10px; color: var(--muted); background: #0a0a0a; border-radius: 9px; }
+        .visibility-options { display: grid; gap: 8px; margin: 6px 0 18px; }
+        .visibility-options label { display: flex; align-items: flex-start; gap: 9px; margin: 0; }
+        .visibility-options input { width: auto; margin: 4px 0 0; }
+        .connections { margin-top: 24px; padding: 24px; background: var(--surface); border: 1px solid var(--border); border-radius: 16px; }
+        .connection-list { display: grid; gap: 9px; }
+        .connection-row { display: flex; align-items: center; gap: 11px; padding: 11px; background: #090909; border: 1px solid var(--border); border-radius: 10px; }
+        .connection-row > a { display: flex; min-width: 0; flex: 1; align-items: center; gap: 10px; }
+        .connection-avatar { width: 40px; height: 40px; flex: 0 0 40px; border-radius: 50%; object-fit: cover; background: #292524; display: grid; place-items: center; }
+        .connection-actions { display: flex; flex-wrap: wrap; gap: 6px; }
+        .connection-actions form { margin: 0; }
+        .connection-actions .button { padding: 7px 10px; font-size: .85rem; }
         @media (max-width: 720px) { .profile-layout { grid-template-columns: 1fr; } .kutte { padding-left: 20px; padding-right: 20px; } }
     </style>
 </head>
@@ -37,7 +58,7 @@
 <header>
     <div class="header-inner">
         <a href="/" class="logo">🎸 Pingu <span>Concerts</span></a>
-        <a href="/profile">Mein Profil</a>
+        {% include '_user_menu.html' %}
     </div>
 </header>
 <main>
@@ -54,8 +75,30 @@
             {% endif %}
             <h2 class="profile-name">{{ profile.display_name }}</h2>
             <p class="profile-handle">@{{ profile.username }}</p>
-            <p class="profile-since">Dabei seit {{ profile.created_at }}</p>
+            {% if can_view_details %}<p class="profile-since">Dabei seit {{ profile.created_at }}</p>{% endif %}
+            {% if can_view_details and profile.instagram_url %}
+                <a class="instagram-link" href="{{ profile.instagram_url }}" target="_blank" rel="noopener noreferrer">◎ Instagram · @{{ profile.instagram_handle }}</a>
+            {% endif %}
             <div class="stat"><strong>{{ attended_count }}</strong>besuchte Konzerte</div>
+            {% if not is_own_profile %}
+                <div class="friend-actions">
+                    {% if (user.is_admin or profile.is_admin) and (not friendship or friendship.status != 'accepted') %}
+                        <a class="button" href="/messages/{{ profile.username }}">Nachricht senden</a>
+                    {% endif %}
+                    {% if not friendship %}
+                        <form method="post" action="/users/{{ profile.username }}/friend-request"><button class="button" type="submit">Freundschaft anfragen</button></form>
+                    {% elif friendship.status == 'accepted' %}
+                        <a class="button" href="/messages/{{ profile.username }}">Nachricht senden</a>
+                        <form method="post" action="/friendships/{{ friendship.id }}/remove"><button class="button button-secondary" type="submit">Freundschaft beenden</button></form>
+                    {% elif friendship.addressee_id == user.id %}
+                        <form method="post" action="/friendships/{{ friendship.id }}/accept"><button class="button" type="submit">Annehmen</button></form>
+                        <form method="post" action="/friendships/{{ friendship.id }}/decline"><button class="button button-secondary" type="submit">Ablehnen</button></form>
+                    {% else %}
+                        <form method="post" action="/friendships/{{ friendship.id }}/remove"><button class="button button-secondary" type="submit">Anfrage zurückziehen</button></form>
+                    {% endif %}
+                </div>
+                {% if not can_view_details %}<p class="private-note">Weitere Profildetails sind nur für Freunde sichtbar.</p>{% endif %}
+            {% endif %}
         </section>
         <section class="badges-card">
             <h2>🥋 Virtuelle Kutte</h2>
@@ -81,18 +124,110 @@
             </div>
         </section>
     </div>
+    {% if is_own_profile %}
+        <section class="connections">
+            <h2>🤝 Freunde</h2>
+            {% if connections.incoming %}
+                <h3>Offene Anfragen</h3>
+                <div class="connection-list">
+                    {% for connection in connections.incoming %}
+                        <div class="connection-row">
+                            <a href="/users/{{ connection.username }}">
+                                {% if connection.avatar_path %}<img class="connection-avatar" src="{{ connection.avatar_path }}" alt="">{% else %}<span class="connection-avatar">{{ connection.display_name[:1] }}</span>{% endif %}
+                                <strong>{{ connection.display_name }} <small>@{{ connection.username }}</small></strong>
+                            </a>
+                            <div class="connection-actions">
+                                <form method="post" action="/friendships/{{ connection.id }}/accept"><button class="button" type="submit">Annehmen</button></form>
+                                <form method="post" action="/friendships/{{ connection.id }}/decline"><button class="button button-secondary" type="submit">Ablehnen</button></form>
+                            </div>
+                        </div>
+                    {% endfor %}
+                </div>
+            {% endif %}
+            {% if connections.friends %}
+                <h3>Deine Freunde</h3>
+                <div class="connection-list">
+                    {% for connection in connections.friends %}
+                        <div class="connection-row">
+                            <a href="/users/{{ connection.username }}">
+                                {% if connection.avatar_path %}<img class="connection-avatar" src="{{ connection.avatar_path }}" alt="">{% else %}<span class="connection-avatar">{{ connection.display_name[:1] }}</span>{% endif %}
+                                <strong>{{ connection.display_name }} <small>@{{ connection.username }}</small></strong>
+                            </a>
+                            <div class="connection-actions"><form method="post" action="/friendships/{{ connection.id }}/remove"><button class="button button-secondary" type="submit">Entfernen</button></form></div>
+                        </div>
+                    {% endfor %}
+                </div>
+            {% endif %}
+            {% if connections.outgoing %}<p class="friend-note">{{ connections.outgoing|length }} gesendete Anfrage(n) warten noch auf Antwort.</p>{% endif %}
+            {% if not connections.incoming and not connections.friends and not connections.outgoing %}<p class="friend-note">Noch keine Verbindungen. Finde andere User über die Suche auf der Startseite.</p>{% endif %}
+        </section>
+    {% endif %}
     {% if is_own_profile %}
         <section class="profile-edit">
             <h2>Profil bearbeiten</h2>
-            <form method="post" action="/profile" enctype="multipart/form-data">
+            {% if form_error %}<p class="profile-error" role="alert">{{ form_error }}</p>{% endif %}
+            {% if form_success %}<p class="profile-success" role="status">{{ form_success }}</p>{% endif %}
+            <form method="post" action="/profile" enctype="multipart/form-data" id="profile-form">
                 <label for="display-name">Anzeigename</label>
                 <input id="display-name" name="display_name" type="text" value="{{ profile.display_name }}" maxlength="100">
+                <label for="instagram-url">Instagram-Profil <small>(optional)</small></label>
+                <input id="instagram-url" name="instagram_url" type="text" value="{{ instagram_input if instagram_input is not none else (profile.instagram_url or '') }}" placeholder="@name oder https://instagram.com/name" autocomplete="url">
+                {% if profile.instagram_url %}<a class="instagram-current" href="{{ profile.instagram_url }}" target="_blank" rel="noopener noreferrer">Aktuell verknüpft: @{{ profile.instagram_handle }}</a>{% endif %}
+                <fieldset>
+                    <legend>Wer darf alle Profildetails sehen?</legend>
+                    <div class="visibility-options">
+                        <label><input type="radio" name="profile_visibility" value="public" {% if profile.profile_visibility == 'public' %}checked{% endif %}> <span><strong>Alle User</strong><br><small>Jeder angemeldete User sieht auch Instagram und Beitrittsdatum.</small></span></label>
+                        <label><input type="radio" name="profile_visibility" value="friends" {% if profile.profile_visibility == 'friends' %}checked{% endif %}> <span><strong>Nur Freunde</strong><br><small>Username, Profilbild, Konzertanzahl und Kutte bleiben immer sichtbar.</small></span></label>
+                        <label><input type="radio" name="profile_visibility" value="nobody" {% if profile.profile_visibility == 'nobody' %}checked{% endif %}> <span><strong>Niemand</strong><br><small>Zusätzliche Details siehst nur du; Admins behalten administrativen Zugriff.</small></span></label>
+                    </div>
+                </fieldset>
                 <label for="avatar">Profilbild</label>
                 <input id="avatar" name="avatar" type="file" accept="image/jpeg,image/png,image/webp">
+                <span class="avatar-upload-status" id="avatar-upload-status">Große Bilder werden vor dem Upload automatisch optimiert.</span>
                 <button class="button" type="submit">Profil speichern</button>
             </form>
         </section>
     {% endif %}
 </main>
+<script>
+const profileForm = document.getElementById("profile-form");
+if (profileForm) {
+    profileForm.addEventListener("submit", async event => {
+        if (profileForm.dataset.optimized === "true") return;
+        const input = document.getElementById("avatar");
+        const file = input.files[0];
+        if (!file) return;
+        event.preventDefault();
+        const status = document.getElementById("avatar-upload-status");
+        const button = profileForm.querySelector('button[type="submit"]');
+        button.disabled = true;
+        status.textContent = "Profilbild wird optimiert …";
+        try {
+            const bitmap = await createImageBitmap(file);
+            const scale = Math.min(1, 1000 / Math.max(bitmap.width, bitmap.height));
+            const canvas = document.createElement("canvas");
+            canvas.width = Math.max(1, Math.round(bitmap.width * scale));
+            canvas.height = Math.max(1, Math.round(bitmap.height * scale));
+            const context = canvas.getContext("2d");
+            context.imageSmoothingEnabled = true;
+            context.imageSmoothingQuality = "high";
+            context.drawImage(bitmap, 0, 0, canvas.width, canvas.height);
+            bitmap.close();
+            const blob = await new Promise(resolve => canvas.toBlob(resolve, "image/webp", .86));
+            if (!blob) throw new Error("Bild konnte nicht verarbeitet werden");
+            const transfer = new DataTransfer();
+            transfer.items.add(new File([blob], "profilbild.webp", {type: "image/webp"}));
+            input.files = transfer.files;
+            profileForm.dataset.optimized = "true";
+            status.textContent = `Optimiert: ${Math.ceil(blob.size / 1024)} KB – wird hochgeladen …`;
+            profileForm.requestSubmit();
+        } catch (error) {
+            console.error("Avatar optimization failed:", error);
+            status.textContent = "Das Bild konnte nicht verarbeitet werden. Bitte ein kleineres JPG, PNG oder WebP wählen.";
+            button.disabled = false;
+        }
+    });
+}
+</script>
 </body>
 </html>
diff --git a/app/templates/register.html b/app/templates/register.html
index 47274cf..0f025fc 100644
--- a/app/templates/register.html
+++ b/app/templates/register.html
@@ -75,6 +75,8 @@
             type="password"
             name="password"
             required
+            minlength="10"
+            autocomplete="new-password"
         >
 
         <button type="submit">
diff --git a/compose.yml b/compose.yml
index 3332d8e..843934a 100644
--- a/compose.yml
+++ b/compose.yml
@@ -28,6 +28,7 @@ services:
       INITIAL_ADMIN_USERNAME: ${INITIAL_ADMIN_USERNAME}
       INITIAL_ADMIN_PASSWORD: ${INITIAL_ADMIN_PASSWORD}
       INITIAL_ADMIN_EMAIL: ${INITIAL_ADMIN_EMAIL}
+      COOKIE_SECURE: ${COOKIE_SECURE:-false}
 
     volumes:
       - concert_uploads:/app/static/uploads
diff --git a/db/init/01_initial.sql b/db/init/01_initial.sql
index 72402b1..f120475 100644
--- a/db/init/01_initial.sql
+++ b/db/init/01_initial.sql
@@ -5,10 +5,57 @@ CREATE TABLE users (
     password_hash TEXT NOT NULL,
     display_name VARCHAR(100),
     avatar_path TEXT,
+    instagram_url VARCHAR(500),
+    profile_visibility VARCHAR(20) NOT NULL DEFAULT 'friends'
+        CHECK (profile_visibility IN ('public', 'friends', 'nobody')),
     is_admin BOOLEAN NOT NULL DEFAULT FALSE,
     created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
 
+CREATE TABLE account_tokens (
+    id SERIAL PRIMARY KEY,
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    purpose VARCHAR(30) NOT NULL CHECK (purpose = 'password_reset'),
+    token_hash TEXT NOT NULL UNIQUE,
+    expires_at TIMESTAMP NOT NULL,
+    used_at TIMESTAMP,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE INDEX idx_account_tokens_lookup
+    ON account_tokens (token_hash, purpose, expires_at);
+
+CREATE TABLE friendships (
+    id SERIAL PRIMARY KEY,
+    requester_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    addressee_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    status VARCHAR(20) NOT NULL DEFAULT 'pending'
+        CHECK (status IN ('pending', 'accepted')),
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CHECK (requester_id <> addressee_id),
+    UNIQUE (requester_id, addressee_id)
+);
+
+CREATE UNIQUE INDEX idx_friendships_pair
+    ON friendships (LEAST(requester_id, addressee_id), GREATEST(requester_id, addressee_id));
+
+CREATE TABLE direct_messages (
+    id SERIAL PRIMARY KEY,
+    sender_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    recipient_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    body TEXT NOT NULL,
+    read_at TIMESTAMP,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CHECK (sender_id <> recipient_id)
+);
+
+CREATE INDEX idx_direct_messages_conversation
+    ON direct_messages (sender_id, recipient_id, created_at);
+
+CREATE INDEX idx_direct_messages_unread
+    ON direct_messages (recipient_id, read_at);
+
 CREATE TABLE registration_invites (
     id SERIAL PRIMARY KEY,
     token_hash TEXT NOT NULL UNIQUE,
@@ -51,6 +98,9 @@ CREATE TABLE venue_aliases (
 CREATE TABLE concerts (
     id SERIAL PRIMARY KEY,
     artist VARCHAR(255) NOT NULL,
+    event_type VARCHAR(20) NOT NULL DEFAULT 'concert'
+        CHECK (event_type IN ('concert', 'festival', 'other')),
+    parent_event_id INTEGER REFERENCES concerts(id) ON DELETE SET NULL,
     venue_id INTEGER REFERENCES venues(id) ON DELETE SET NULL,
     start_datetime TIMESTAMP NOT NULL,
     end_datetime TIMESTAMP,
@@ -58,6 +108,7 @@ CREATE TABLE concerts (
     ticket_url TEXT,
     ticket_price NUMERIC(10,2),
     flyer_path TEXT,
+    flyer_url TEXT,
     created_by INTEGER REFERENCES users(id) ON DELETE SET NULL,
     created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
@@ -82,7 +133,7 @@ CREATE TABLE concert_attendance (
     concert_id INTEGER NOT NULL REFERENCES concerts(id) ON DELETE CASCADE,
     user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     status VARCHAR(20) NOT NULL CHECK (
-        status IN ('attending', 'maybe', 'ticket_search')
+        status IN ('attending', 'maybe', 'ticket_search', 'ticket_offer')
     ),
     updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
     PRIMARY KEY (concert_id, user_id)
@@ -107,6 +158,9 @@ CREATE INDEX idx_venues_external_id
 CREATE INDEX idx_venue_aliases_alias
     ON venue_aliases (LOWER(alias));
 
+CREATE INDEX idx_concerts_parent_event_id
+    ON concerts(parent_event_id);
+
 CREATE INDEX idx_concert_comments_concert
     ON concert_comments(concert_id, created_at);
 
diff --git a/db/migrations/05_event_categories.sql b/db/migrations/05_event_categories.sql
new file mode 100644
index 0000000..f248557
--- /dev/null
+++ b/db/migrations/05_event_categories.sql
@@ -0,0 +1,10 @@
+ALTER TABLE concerts
+ADD COLUMN IF NOT EXISTS event_type VARCHAR(20) NOT NULL DEFAULT 'concert'
+CHECK (event_type IN ('concert', 'festival', 'other'));
+
+ALTER TABLE concerts
+ADD COLUMN IF NOT EXISTS parent_event_id INTEGER
+REFERENCES concerts(id) ON DELETE SET NULL;
+
+CREATE INDEX IF NOT EXISTS idx_concerts_parent_event_id
+ON concerts(parent_event_id);
diff --git a/db/migrations/06_user_instagram.sql b/db/migrations/06_user_instagram.sql
new file mode 100644
index 0000000..963abb9
--- /dev/null
+++ b/db/migrations/06_user_instagram.sql
@@ -0,0 +1,2 @@
+ALTER TABLE users
+ADD COLUMN IF NOT EXISTS instagram_url VARCHAR(500);
diff --git a/db/migrations/07_friendships_and_privacy.sql b/db/migrations/07_friendships_and_privacy.sql
new file mode 100644
index 0000000..a9ae915
--- /dev/null
+++ b/db/migrations/07_friendships_and_privacy.sql
@@ -0,0 +1,18 @@
+ALTER TABLE users
+ADD COLUMN IF NOT EXISTS profile_visibility VARCHAR(20) NOT NULL DEFAULT 'public'
+CHECK (profile_visibility IN ('public', 'friends'));
+
+CREATE TABLE IF NOT EXISTS friendships (
+    id SERIAL PRIMARY KEY,
+    requester_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    addressee_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    status VARCHAR(20) NOT NULL DEFAULT 'pending'
+        CHECK (status IN ('pending', 'accepted')),
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CHECK (requester_id <> addressee_id),
+    UNIQUE (requester_id, addressee_id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_friendships_pair
+ON friendships (LEAST(requester_id, addressee_id), GREATEST(requester_id, addressee_id));
diff --git a/db/migrations/08_direct_messages.sql b/db/migrations/08_direct_messages.sql
new file mode 100644
index 0000000..4c104d7
--- /dev/null
+++ b/db/migrations/08_direct_messages.sql
@@ -0,0 +1,15 @@
+CREATE TABLE IF NOT EXISTS direct_messages (
+    id SERIAL PRIMARY KEY,
+    sender_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    recipient_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    body TEXT NOT NULL,
+    read_at TIMESTAMP,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CHECK (sender_id <> recipient_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_direct_messages_conversation
+ON direct_messages (sender_id, recipient_id, created_at);
+
+CREATE INDEX IF NOT EXISTS idx_direct_messages_unread
+ON direct_messages (recipient_id, read_at);
diff --git a/db/migrations/09_profile_privacy_and_flyer_links.sql b/db/migrations/09_profile_privacy_and_flyer_links.sql
new file mode 100644
index 0000000..86ce104
--- /dev/null
+++ b/db/migrations/09_profile_privacy_and_flyer_links.sql
@@ -0,0 +1,12 @@
+ALTER TABLE users
+ALTER COLUMN profile_visibility SET DEFAULT 'friends';
+
+ALTER TABLE users
+DROP CONSTRAINT IF EXISTS users_profile_visibility_check;
+
+ALTER TABLE users
+ADD CONSTRAINT users_profile_visibility_check
+CHECK (profile_visibility IN ('public', 'friends', 'nobody'));
+
+ALTER TABLE concerts
+ADD COLUMN IF NOT EXISTS flyer_url TEXT;
diff --git a/db/migrations/10_release_safety.sql b/db/migrations/10_release_safety.sql
new file mode 100644
index 0000000..b44452a
--- /dev/null
+++ b/db/migrations/10_release_safety.sql
@@ -0,0 +1,28 @@
+ALTER TABLE users
+DROP COLUMN IF EXISTS email_verified;
+
+CREATE TABLE IF NOT EXISTS account_tokens (
+    id SERIAL PRIMARY KEY,
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    purpose VARCHAR(30) NOT NULL CHECK (purpose = 'password_reset'),
+    token_hash TEXT NOT NULL UNIQUE,
+    expires_at TIMESTAMP NOT NULL,
+    used_at TIMESTAMP,
+    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+DELETE FROM account_tokens WHERE purpose = 'verify_email';
+
+ALTER TABLE account_tokens DROP CONSTRAINT IF EXISTS account_tokens_purpose_check;
+ALTER TABLE account_tokens ADD CONSTRAINT account_tokens_purpose_check
+CHECK (purpose = 'password_reset');
+
+CREATE INDEX IF NOT EXISTS idx_account_tokens_lookup
+ON account_tokens (token_hash, purpose, expires_at);
+
+ALTER TABLE concert_attendance
+DROP CONSTRAINT IF EXISTS concert_attendance_status_check;
+
+ALTER TABLE concert_attendance
+ADD CONSTRAINT concert_attendance_status_check
+CHECK (status IN ('attending', 'maybe', 'ticket_search', 'ticket_offer'));