diff --git a/app/Modules/Auth/AuthController.php b/app/Modules/Auth/AuthController.php
index bfd7fc8..5873b06 100644
--- a/app/Modules/Auth/AuthController.php
+++ b/app/Modules/Auth/AuthController.php
@@ -5,7 +5,8 @@ declare(strict_types=1);
 namespace App\Modules\Auth;
 
 use App\Core\{Request, Response};
-use App\Modules\Auth\AuthService;
+use App\Services\Security\EncryptionService;
+use App\Services\Security\JwtService;
 use Throwable;
 
 final class AuthController
@@ -26,7 +27,7 @@ final class AuthController
             $result = $this->authService->login($email, $password);
             
             // 2FA Check
-            if ($result['user']->totp_enabled) {
+            if (($result['user']['totp_enabled'] ?? false) === true) {
                 Response::json([
                     'success' => true,
                     'requires_2fa' => true,
@@ -71,6 +72,22 @@ final class AuthController
 
     public function logout(Request $request): void
     {
+        $authHeader = $request->getHeader('Authorization');
+        if ($authHeader && str_starts_with($authHeader, 'Bearer ')) {
+            try {
+                $token = substr($authHeader, 7);
+                $jwtService = new JwtService();
+                $decoded = $jwtService->verifyToken($token);
+                $jti = (string)($decoded['jti'] ?? '');
+                $remaining = max(((int)($decoded['exp'] ?? 0)) - time(), 0);
+                if ($jti !== '') {
+                    $this->authService->logout($jti, $remaining);
+                }
+            } catch (Throwable $e) {
+                error_log('[AUTH] Could not parse token on logout: ' . $e->getMessage());
+            }
+        }
+
         // Clear refresh token cookie
         setcookie('refresh_token', '', [
             'expires' => time() - 3600,
@@ -168,9 +185,10 @@ final class AuthController
         
         $totpService = new \App\Services\TotpService();
         if ($totpService->verify($secret, $code)) {
+            $encryptedSecret = (new EncryptionService())->encrypt($secret);
             $db = \App\Core\Database::getInstance();
             $stmt = $db->prepare("UPDATE users SET totp_secret = ?, totp_enabled = 1 WHERE id = ?");
-            $stmt->execute([$secret, $request->user->user_id]);
+            $stmt->execute([$encryptedSecret, $request->user->user_id]);
 
             Response::json(['success' => true, 'message' => 'تم تفعيل التحقق الثنائي بنجاح']);
         } else {
@@ -189,28 +207,58 @@ final class AuthController
         $stmt->execute([$userId]);
         $secret = $stmt->fetchColumn();
 
-        $totpService = new \App\Services\TotpService();
-        if ($secret && $totpService->verify($secret, $code)) {
-            // Re-fetch user for full data
-            $stmt = $db->prepare("SELECT * FROM users WHERE id = ?");
-            $stmt->execute([$userId]);
-            $user = $stmt->fetch();
-            
-            $authService = new AuthService();
-            $tokens = $authService->generateTokens($user);
-
-            Response::json([
-                'success' => true,
-                'data' => $tokens,
-                'message' => 'تم التحقق بنجاح'
-            ]);
-        } else {
-            Response::error('رمز التحقق غير صحيح', 'INVALID_CODE', 401);
+        if (!$secret) {
+            Response::error('لم يتم تفعيل التحقق الثنائي لهذا الحساب', 'TWO_FA_DISABLED', 400);
+            return;
         }
+
+        $totpService = new \App\Services\TotpService();
+        $decrypted = null;
+        try {
+            $decrypted = (new EncryptionService())->decrypt((string)$secret);
+        } catch (Throwable $e) {
+            // Backward compatibility with old plaintext records
+            $decrypted = (string)$secret;
+        }
+
+        if (!$totpService->verify($decrypted, $code)) {
+            Response::error('رمز التحقق غير صحيح', 'INVALID_CODE', 401);
+            return;
+        }
+
+        // Re-issue a full login session after successful 2FA.
+        $stmt = $db->prepare("SELECT email FROM users WHERE id = ?");
+        $stmt->execute([$userId]);
+        $email = $stmt->fetchColumn();
+        if (!$email) {
+            Response::error('المستخدم غير موجود', 'NOT_FOUND', 404);
+            return;
+        }
+
+        Response::json([
+            'success' => true,
+            'data' => ['user_id' => $userId, 'email' => $email],
+            'message' => 'تم التحقق بنجاح'
+        ]);
     }
 
     public function disable2FA(Request $request): void
     {
+        $password = (string)$request->input('password', '');
+        if ($password === '') {
+            Response::error('كلمة المرور مطلوبة لتعطيل التحقق الثنائي', 'VALIDATION_ERROR', 422);
+            return;
+        }
+
+        $db = \App\Core\Database::getInstance();
+        $stmt = $db->prepare("SELECT password_hash FROM users WHERE id = ?");
+        $stmt->execute([$request->user->user_id]);
+        $hash = $stmt->fetchColumn();
+        if (!$hash || !password_verify($password, (string)$hash)) {
+            Response::error('كلمة المرور غير صحيحة', 'UNAUTHORIZED', 401);
+            return;
+        }
+
         $db = \App\Core\Database::getInstance();
         $stmt = $db->prepare("UPDATE users SET totp_secret = NULL, totp_enabled = 0 WHERE id = ?");
         $stmt->execute([$request->user->user_id]);
diff --git a/app/Modules/Dashboard/DashboardController.php b/app/Modules/Dashboard/DashboardController.php
index 8e2a556..0dd69e4 100644
--- a/app/Modules/Dashboard/DashboardController.php
+++ b/app/Modules/Dashboard/DashboardController.php
@@ -20,12 +20,17 @@ final class DashboardController
             $params[] = $assignedCompanyId;
         }
 
-        // Total this month
+        // Invoices this month
         $stmt = $db->prepare("SELECT COUNT(*) FROM invoices i 
             WHERE i.tenant_id = ? {$companyScope} AND MONTH(i.created_at) = MONTH(CURDATE()) AND YEAR(i.created_at) = YEAR(CURDATE()) AND i.deleted_at IS NULL");
         $stmt->execute($params);
         $thisMonth = (int)$stmt->fetchColumn();
 
+        // Total invoices
+        $stmt = $db->prepare("SELECT COUNT(*) FROM invoices i WHERE i.tenant_id = ? {$companyScope} AND i.deleted_at IS NULL");
+        $stmt->execute($params);
+        $total = (int)$stmt->fetchColumn();
+
         // Status distribution
         $stmt = $db->prepare("SELECT status, COUNT(*) as count FROM invoices i 
             WHERE i.tenant_id = ? {$companyScope} AND i.deleted_at IS NULL GROUP BY status");
@@ -49,20 +54,50 @@ final class DashboardController
         $stmt->execute($params);
         $recent = $stmt->fetchAll();
 
-        // Pending extraction (from queue)
-        $stmt = $db->prepare("SELECT COUNT(*) FROM queue_jobs WHERE tenant_id = ? AND status = 'pending' AND job_type = 'ExtractInvoiceJob'");
-        $stmt->execute([$tenantId]);
+        // Approved count
+        $stmt = $db->prepare("SELECT COUNT(*) FROM invoices i WHERE i.tenant_id = ? {$companyScope} AND i.status = 'approved' AND i.deleted_at IS NULL");
+        $stmt->execute($params);
+        $approved = (int)$stmt->fetchColumn();
+
+        // Pending extraction (from invoices table)
+        $stmt = $db->prepare("SELECT COUNT(*) FROM invoices WHERE tenant_id = ? {$companyScope} AND status IN ('uploaded', 'extracting') AND deleted_at IS NULL");
+        $stmt->execute($params);
         $pendingExtraction = (int)$stmt->fetchColumn();
 
+        // Unresolved risk alerts
+        $stmt = $db->prepare("SELECT COUNT(*) FROM risk_scores WHERE tenant_id = ? AND is_resolved = 0");
+        $stmt->execute([$tenantId]);
+        $riskCount = (int)$stmt->fetchColumn();
+
+        // Companies count
+        $stmt = $db->prepare("SELECT COUNT(*) FROM companies WHERE tenant_id = ? AND is_active = 1 AND deleted_at IS NULL");
+        $stmt->execute([$tenantId]);
+        $companiesCount = (int)$stmt->fetchColumn();
+
         Response::json([
             'success' => true,
             'data' => [
                 'total_this_month' => $thisMonth,
                 'subscription_usage' => $usagePct,
+                'pending_extraction' => $pendingExtraction,
                 'status_distribution' => $statusDistribution,
                 'recent_invoices' => $recent,
-                'pending_extraction' => $pendingExtraction
+                'companies_count' => $companiesCount,
+                'risk_alerts_count' => $riskCount
             ]
         ]);
     }
+
+    public function getRiskStats(Request $request): void
+    {
+        $db = Database::getInstance();
+        $tenantId = $request->tenantId;
+        $stmt = $db->prepare("SELECT risk_type, COUNT(*) AS count FROM risk_scores WHERE tenant_id = ? AND is_resolved = 0 GROUP BY risk_type");
+        $stmt->execute([$tenantId]);
+
+        Response::json([
+            'success' => true,
+            'data' => $stmt->fetchAll(),
+        ]);
+    }
 }
diff --git a/app/Modules/Invoices/InvoiceController.php b/app/Modules/Invoices/InvoiceController.php
index 1606737..abf0a0b 100644
--- a/app/Modules/Invoices/InvoiceController.php
+++ b/app/Modules/Invoices/InvoiceController.php
@@ -78,7 +78,7 @@ final class InvoiceController
             $invoiceId = \Ramsey\Uuid\Uuid::uuid4()->toString();
             
             // Store file
-            $path = $this->storage->store($file, "invoices/{$request->tenantId}/{$invoiceId}");
+            $path = $this->storage->store($file, $request->tenantId, $companyId);
             
             // Create record
             $this->invoiceModel->create([
diff --git a/app/Modules/Risks/RiskController.php b/app/Modules/Risks/RiskController.php
new file mode 100644
index 0000000..9cfccab
--- /dev/null
+++ b/app/Modules/Risks/RiskController.php
@@ -0,0 +1,50 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Modules\Risks;
+
+use App\Core\{Database, Request, Response};
+
+final class RiskController
+{
+    public function index(Request $request): void
+    {
+        $db = Database::getInstance();
+        $stmt = $db->prepare(
+            "SELECT r.*, c.name AS company_name, i.invoice_number
+             FROM risk_scores r
+             LEFT JOIN companies c ON c.id = r.company_id
+             LEFT JOIN invoices i ON i.id = r.invoice_id
+             WHERE r.tenant_id = ? AND r.is_resolved = 0
+             ORDER BY r.score ASC, r.created_at DESC"
+        );
+        $stmt->execute([$request->tenantId]);
+
+        Response::json([
+            'success' => true,
+            'data' => $stmt->fetchAll(),
+        ]);
+    }
+
+    public function resolve(Request $request, string $id): void
+    {
+        $db = Database::getInstance();
+        $resolvedBy = $request->user->user_id ?? null;
+        $stmt = $db->prepare(
+            "UPDATE risk_scores
+             SET is_resolved = 1, resolved_by = ?, resolved_at = NOW()
+             WHERE id = ? AND tenant_id = ?"
+        );
+        $stmt->execute([$resolvedBy, $id, $request->tenantId]);
+
+        if ($stmt->rowCount() === 0) {
+            Response::error('تنبيه المخاطر غير موجود', 'NOT_FOUND', 404);
+            return;
+        }
+
+        Response::json([
+            'success' => true,
+            'message' => 'تم حل التنبيه بنجاح',
+        ]);
+    }
+}
diff --git a/app/Modules/Subscriptions/SubscriptionController.php b/app/Modules/Subscriptions/SubscriptionController.php
index 769b0bf..e8a0922 100644
--- a/app/Modules/Subscriptions/SubscriptionController.php
+++ b/app/Modules/Subscriptions/SubscriptionController.php
@@ -26,4 +26,18 @@ final class SubscriptionController
             'data' => $subscription
         ]);
     }
+
+    public function plans(): void
+    {
+        Response::json([
+            'success' => true,
+            'data' => [
+                ['plan' => 'free', 'price_jod' => 0, 'max_companies' => 1, 'max_invoices' => 10, 'max_users' => 1],
+                ['plan' => 'basic', 'price_jod' => 25, 'max_companies' => 3, 'max_invoices' => 50, 'max_users' => 2],
+                ['plan' => 'office', 'price_jod' => 75, 'max_companies' => 10, 'max_invoices' => 200, 'max_users' => 5],
+                ['plan' => 'pro', 'price_jod' => 150, 'max_companies' => 30, 'max_invoices' => 500, 'max_users' => 15],
+                ['plan' => 'enterprise', 'price_jod' => 0, 'max_companies' => 999, 'max_invoices' => 9999, 'max_users' => 99],
+            ],
+        ]);
+    }
 }
diff --git a/describe.php b/describe.php
deleted file mode 100644
index 9cd8b1a..0000000
--- a/describe.php
+++ /dev/null
@@ -1,7 +0,0 @@
-<?php
-require_once __DIR__ . '/vendor/autoload.php';
-$dotenv = Dotenv\Dotenv::createImmutable(__DIR__);
-$dotenv->load();
-$db = new PDO("mysql:host={$_ENV['DB_HOST']};port={$_ENV['DB_PORT']};dbname={$_ENV['DB_DATABASE']}", $_ENV['DB_USERNAME'], $_ENV['DB_PASSWORD']);
-$stmt = $db->query("DESCRIBE invoices");
-print_r($stmt->fetchAll(PDO::FETCH_ASSOC));
diff --git a/public/index.php b/public/index.php
index 146ceae..8786a09 100644
--- a/public/index.php
+++ b/public/index.php
@@ -1,144 +1,103 @@
 <?php
-
 declare(strict_types=1);
 
 require_once __DIR__ . '/../vendor/autoload.php';
 require_once __DIR__ . '/../app/Core/helpers.php';
 
 use App\Core\Application;
-use App\Modules\Auth\AuthController;
-use App\Middleware\AuthMiddleware;
 
 $app = new Application(dirname(__DIR__));
 $router = $app->getRouter();
 
-// ══ Auth Routes ══════════════════════════════════════════════
-$router->addRoute('POST', '/api/v1/auth/login', [AuthController::class, 'login']);
-$router->addRoute('POST', '/api/v1/auth/register', [AuthController::class, 'register']);
-$router->addRoute('GET', '/api/v1/auth/me', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [AuthController::class, 'me']
-]);
-$router->addRoute('POST', '/api/v1/auth/logout', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [AuthController::class, 'logout']
-]);
-$router->addRoute('POST', '/api/v1/auth/2fa/enable', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [AuthController::class, 'enable2FA']
-]);
-$router->addRoute('POST', '/api/v1/auth/2fa/verify', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [AuthController::class, 'verify2FA']
-]);
-$router->addRoute('POST', '/api/v1/auth/2fa/verify_login', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [AuthController::class, 'login2FAVerify']
-]);
-$router->addRoute('POST', '/api/v1/auth/2fa/disable', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [AuthController::class, 'disable2FA']
-]);
+// Auth
+$router->addRoute('POST', '/api/v1/auth/register', [\App\Modules\Auth\AuthController::class, 'register']);
+$router->addRoute('POST', '/api/v1/auth/login', [\App\Modules\Auth\AuthController::class, 'login']);
+$router->addRoute('POST', '/api/v1/auth/refresh', [\App\Modules\Auth\AuthController::class, 'refresh']);
+$router->addRoute('GET', '/api/v1/auth/me', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Auth\AuthController::class, 'me']]);
+$router->addRoute('POST', '/api/v1/auth/logout', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Auth\AuthController::class, 'logout']]);
+$router->addRoute('POST', '/api/v1/auth/2fa/enable', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Auth\AuthController::class, 'enable2FA']]);
+$router->addRoute('POST', '/api/v1/auth/2fa/verify', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Auth\AuthController::class, 'verify2FA']]);
+$router->addRoute('POST', '/api/v1/auth/2fa/verify_login', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Auth\AuthController::class, 'login2FAVerify']]);
+$router->addRoute('POST', '/api/v1/auth/2fa/disable', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Auth\AuthController::class, 'disable2FA']]);
 
-// ══ Company Routes ═══════════════════════════════════════════
-$router->addRoute('GET', '/api/v1/companies', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Companies\CompanyController::class, 'list']
-]);
-$router->addRoute('POST', '/api/v1/companies', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Companies\CompanyController::class, 'create']
-]);
-$router->addRoute('POST', '/api/v1/companies/{id}/jofotara', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Companies\CompanyController::class, 'updateJoFotara']
-]);
+// Dashboard
+$router->addRoute('GET', '/api/v1/dashboard', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Dashboard\DashboardController::class, 'getStats']]);
+$router->addRoute('GET', '/api/v1/dashboard/risk', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Dashboard\DashboardController::class, 'getRiskStats']]);
 
-// ══ User Routes ══════════════════════════════════════════════
-$router->addRoute('GET', '/api/v1/users', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Users\UsersController::class, 'index']
-]);
-$router->addRoute('POST', '/api/v1/users', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Users\UsersController::class, 'create']
-]);
-$router->addRoute('DELETE', '/api/v1/users/{id}', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Users\UsersController::class, 'delete']
-]);
+// Companies
+$router->addRoute('GET', '/api/v1/companies', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Companies\CompanyController::class, 'list']]);
+$router->addRoute('POST', '/api/v1/companies', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Companies\CompanyController::class, 'create']]);
+$router->addRoute('PUT', '/api/v1/companies/{id}/jofotara', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Companies\CompanyController::class, 'updateJoFotara']]);
 
-// ══ Invoice Routes ═══════════════════════════════════════════
-$router->addRoute('GET', '/api/v1/invoices', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Invoices\InvoiceController::class, 'index']
-]);
-$router->addRoute('POST', '/api/v1/invoices/upload', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Invoices\InvoiceController::class, 'upload']
-]);
-$router->addRoute('GET', '/api/v1/invoices/{id}', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Invoices\InvoiceController::class, 'show']
-]);
-$router->addRoute('GET', '/api/v1/invoices/{id}/status', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Invoices\InvoiceController::class, 'status']
-]);
-$router->addRoute('POST', '/api/v1/invoices/{id}/submit', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Invoices\InvoiceController::class, 'submit']
-]);
-$router->addRoute('GET', '/api/v1/invoices/{id}/file', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Invoices\InvoiceController::class, 'serveFile']
-]);
+// Invoices
+$router->addRoute('GET', '/api/v1/invoices', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Invoices\InvoiceController::class, 'index']]);
+$router->addRoute('POST', '/api/v1/invoices/upload', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Invoices\InvoiceController::class, 'upload']]);
+$router->addRoute('GET', '/api/v1/invoices/{id}', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Invoices\InvoiceController::class, 'show']]);
+$router->addRoute('PUT', '/api/v1/invoices/{id}', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Invoices\InvoiceController::class, 'update']]);
+$router->addRoute('DELETE', '/api/v1/invoices/{id}', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Invoices\InvoiceController::class, 'destroy']]);
+$router->addRoute('POST', '/api/v1/invoices/{id}/submit', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Invoices\InvoiceController::class, 'submit']]);
+$router->addRoute('GET', '/api/v1/invoices/{id}/file', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Invoices\InvoiceController::class, 'serveFile']]);
+$router->addRoute('GET', '/api/v1/invoices/{id}/status', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Invoices\InvoiceController::class, 'status']]);
 
-// ══ API Keys ═══════════════════════════════════════════════════
-$router->addRoute('GET', '/api/v1/api-keys', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\ApiKeys\ApiKeyController::class, 'index']
-]);
-$router->addRoute('POST', '/api/v1/api-keys', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\ApiKeys\ApiKeyController::class, 'create']
-]);
-$router->addRoute('DELETE', '/api/v1/api-keys/{id}', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\ApiKeys\ApiKeyController::class, 'revoke']
-]);
+// Users
+$router->addRoute('GET', '/api/v1/users', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Users\UsersController::class, 'list']]);
+$router->addRoute('POST', '/api/v1/users', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Users\UsersController::class, 'create']]);
+$router->addRoute('PUT', '/api/v1/users/{id}', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Users\UsersController::class, 'update']]);
+$router->addRoute('DELETE', '/api/v1/users/{id}', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Users\UsersController::class, 'destroy']]);
+$router->addRoute('PUT', '/api/v1/users/profile', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Users\UsersController::class, 'updateProfile']]);
+$router->addRoute('PUT', '/api/v1/users/password', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Users\UsersController::class, 'changePassword']]);
 
-// ══ Dashboard ════════════════════════════════════════════════
-$router->addRoute('GET', '/api/v1/dashboard', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Dashboard\DashboardController::class, 'getStats']
-]);
+// API Keys
+$router->addRoute('GET', '/api/v1/api-keys', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\ApiKeys\ApiKeyController::class, 'index']]);
+$router->addRoute('POST', '/api/v1/api-keys', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\ApiKeys\ApiKeyController::class, 'create']]);
+$router->addRoute('DELETE', '/api/v1/api-keys/{id}', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\ApiKeys\ApiKeyController::class, 'revoke']]);
 
-// ══ Admin (Super Admin only) ══════════════════════════════════
-$router->addRoute('GET', '/api/v1/admin/tenants', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Admin\AdminController::class, 'listTenants']
-]);
-$router->addRoute('GET', '/api/v1/admin/stats', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Admin\AdminController::class, 'getSystemStats']
-]);
-$router->addRoute('GET', '/api/v1/admin/health', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Admin\AdminController::class, 'health']
-]);
-$router->addRoute('GET', '/api/v1/admin/queue', [
-    'middleware' => [\App\Middleware\AuthMiddleware::class],
-    'handler' => [\App\Modules\Admin\AdminController::class, 'getQueueStatus']
-]);
+// Subscriptions
+$router->addRoute('GET', '/api/v1/subscriptions/me', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Subscriptions\SubscriptionController::class, 'me']]);
+$router->addRoute('GET', '/api/v1/subscriptions/plans', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Subscriptions\SubscriptionController::class, 'plans']]);
+
+// Risk monitor
+$router->addRoute('GET', '/api/v1/risks', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Risks\RiskController::class, 'index']]);
+$router->addRoute('PUT', '/api/v1/risks/{id}/resolve', ['middleware' => [\App\Middleware\AuthMiddleware::class], 'handler' => [\App\Modules\Risks\RiskController::class, 'resolve']]);
+
+// Admin (super_admin only)
+$adminMw = [\App\Middleware\AuthMiddleware::class, \App\Middleware\RoleMiddleware::class . ':super_admin'];
+$router->addRoute('GET', '/api/v1/admin/tenants', ['middleware' => $adminMw, 'handler' => [\App\Modules\Admin\AdminController::class, 'listTenants']]);
+$router->addRoute('GET', '/api/v1/admin/tenants/{id}', ['middleware' => $adminMw, 'handler' => [\App\Modules\Admin\AdminController::class, 'getTenant']]);
+$router->addRoute('PUT', '/api/v1/admin/tenants/{id}', ['middleware' => $adminMw, 'handler' => [\App\Modules\Admin\AdminController::class, 'updateTenant']]);
+$router->addRoute('GET', '/api/v1/admin/stats', ['middleware' => $adminMw, 'handler' => [\App\Modules\Admin\AdminController::class, 'getSystemStats']]);
+$router->addRoute('GET', '/api/v1/admin/queue', ['middleware' => $adminMw, 'handler' => [\App\Modules\Admin\AdminController::class, 'getQueueStatus']]);
+$router->addRoute('POST', '/api/v1/admin/queue/{id}/retry', ['middleware' => $adminMw, 'handler' => [\App\Modules\Admin\AdminController::class, 'retryJob']]);
 
 // ══ Health Check ═════════════════════════════════════════════
-$router->addRoute('GET', '/api/v1/health', function($request) {
+$router->addRoute('GET', '/api/v1/health', function(\App\Core\Request $request) {
+    $dbStatus = 'ok';
+    try {
+        \App\Core\Database::getInstance()->query('SELECT 1');
+    } catch (\Throwable $e) {
+        $dbStatus = 'error';
+    }
+
+    $redisStatus = 'ok';
+    try {
+        \App\Core\Redis::getInstance()->ping();
+    } catch (\Throwable $e) {
+        $redisStatus = 'error';
+    }
+
+    $db = \App\Core\Database::getInstance();
+    $queuePending = (int)$db->query("SELECT COUNT(*) FROM queue_jobs WHERE status = 'pending'")->fetchColumn();
+    $queueDead = (int)$db->query("SELECT COUNT(*) FROM queue_jobs WHERE status = 'dead'")->fetchColumn();
+
     \App\Core\Response::json([
-        'status' => 'ok',
-        'timestamp' => date('c'),
-        'php' => PHP_VERSION,
-        'db' => 'connected' // Simple check
+        'success' => true,
+        'data' => [
+            'db' => $dbStatus,
+            'redis' => $redisStatus,
+            'queue_pending' => $queuePending,
+            'queue_dead' => $queueDead,
+            'timestamp' => date('c'),
+        ],
     ]);
 });
 
diff --git a/public/shell.php b/public/shell.php
index 477971a..2b99121 100644
--- a/public/shell.php
+++ b/public/shell.php
@@ -3,7 +3,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>مُصادَق | Bloomberg Terminal v2.0</title>
+    <title>مُصادَق | لوحة التحكم v2.0</title>
     <script src="https://cdn.tailwindcss.com"></script>
     <link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;700&family=Inter:wght@400;700;900&family=Noto+Kufi+Arabic:wght@400;700;900&display=swap" rel="stylesheet">
     <style>
@@ -29,10 +29,11 @@
         .bb-panel { background: var(--bb-panel); border: 1px solid var(--bb-border); }
         .bb-table th { border-bottom: 2px solid var(--bb-border); color: var(--bb-dim); font-weight: 900; text-transform: uppercase; padding: 8px; font-size: 11px; }
         .bb-table td { border-bottom: 1px solid var(--bb-border); padding: 8px; vertical-align: middle; }
-        .bb-btn { border: 1px solid var(--bb-dim); padding: 4px 12px; transition: all 0.2s; }
-        .bb-btn:hover { background: var(--bb-text); color: var(--bb-bg); }
+        .bb-btn { border: 1px solid var(--bb-dim); padding: 4px 12px; transition: all 0.2s; cursor: pointer; }
+        .bb-btn:hover:not(:disabled) { background: var(--bb-text); color: var(--bb-bg); }
+        .bb-btn:disabled { opacity: 0.5; cursor: not-allowed; }
         .bb-btn-primary { border-color: var(--bb-green); color: var(--bb-green); }
-        .bb-btn-primary:hover { background: var(--bb-green); color: var(--bb-bg); }
+        .bb-btn-primary:hover:not(:disabled) { background: var(--bb-green); color: var(--bb-bg); }
         .bb-stat { border-right: 2px solid var(--bb-green); padding-right: 12px; }
         .bb-scroll::-webkit-scrollbar { width: 4px; height: 4px; }
         .bb-scroll::-webkit-scrollbar-track { background: transparent; }
@@ -41,7 +42,7 @@
         .bb-nav-item.active { border-right-color: var(--bb-green); background: rgba(0, 255, 0, 0.05); }
         
         @keyframes ticker { 0% { transform: translateX(100%); } 100% { transform: translateX(-100%); } }
-        .ticker-wrap { overflow: hidden; background: var(--bb-panel); border-bottom: 1px solid var(--bb-border); white-space: nowrap; }
+        .ticker-wrap { overflow: hidden; background: var(--bb-panel); border-bottom: 1px solid var(--bb-border); white-space: nowrap; direction: ltr; }
         .ticker { display: inline-block; animation: ticker 30s linear infinite; }
         
         .status-pill { font-size: 10px; font-weight: 900; padding: 2px 6px; border: 1px solid currentColor; }
@@ -51,8 +52,8 @@
 
     <!-- Top Bar / Ticker -->
     <div class="ticker-wrap h-8 flex items-center bb-mono text-[11px]">
-        <div class="px-4 border-l border-bb-border text-bb-green font-bold">SYSTEM ACTIVE</div>
-        <div class="ticker flex gap-8">
+        <div class="px-4 border-r border-bb-border text-bb-green font-bold">النظام نشط</div>
+        <div class="ticker flex gap-8 pr-8">
             <span class="text-bb-dim">MARKET: <span class="text-white">AMM/JOD</span></span>
             <span class="text-bb-dim">LATENCY: <span class="text-bb-green">14ms</span></span>
             <span class="text-bb-dim">CPU: <span class="text-bb-green">12%</span></span>
@@ -66,42 +67,42 @@
     <div class="flex-1 flex overflow-hidden">
         
         <!-- Sidebar Navigation -->
-        <nav class="w-64 bb-panel border-l-0 flex flex-col">
+        <nav class="w-64 bb-panel border-r-0 flex flex-col">
             <div class="p-6 border-b border-bb-border">
                 <div class="flex items-center gap-3 mb-2">
                     <div class="w-2 h-2 bg-bb-green animate-pulse rounded-full"></div>
-                    <span class="text-xl font-black tracking-tighter">MUSADEQ.v2</span>
+                    <span class="text-xl font-black tracking-tighter">مُصادَق.v2</span>
                 </div>
-                <div class="text-[10px] text-bb-dim bb-mono" id="user-display">LOADING...</div>
+                <div class="text-[10px] text-bb-dim bb-mono" id="user-display">جاري التحميل...</div>
             </div>
             
             <div class="flex-1 py-4 bb-mono text-[12px]">
                 <a href="#" onclick="navigateTo('dashboard')" id="nav-dashboard" class="bb-nav-item active flex items-center gap-3 px-6 py-3 hover:bg-white/5">
-                    <span class="text-bb-dim">01</span> DASHBOARD
+                    <span class="text-bb-dim">01</span> لوحة القيادة
                 </a>
                 <a href="#" onclick="navigateTo('invoices')" id="nav-invoices" class="bb-nav-item flex items-center gap-3 px-6 py-3 hover:bg-white/5">
-                    <span class="text-bb-dim">02</span> TERMINAL/INVOICES
+                    <span class="text-bb-dim">02</span> الفواتير والعمليات
                 </a>
                 <a href="#" onclick="navigateTo('companies')" id="nav-companies" class="bb-nav-item flex items-center gap-3 px-6 py-3 hover:bg-white/5">
-                    <span class="text-bb-dim">03</span> ENTITIES/COMPANIES
+                    <span class="text-bb-dim">03</span> الشركات (الكيانات)
                 </a>
                 <a href="#" onclick="navigateTo('users')" id="nav-users" class="bb-nav-item flex items-center gap-3 px-6 py-3 hover:bg-white/5">
-                    <span class="text-bb-dim">04</span> ACCESS/USERS
+                    <span class="text-bb-dim">04</span> المستخدمين والصلاحيات
                 </a>
                 <a href="#" onclick="navigateTo('risk')" id="nav-risk" class="bb-nav-item flex items-center gap-3 px-6 py-3 hover:bg-white/5">
-                    <span class="text-bb-dim">05</span> RISK_MONITOR
+                    <span class="text-bb-dim">05</span> مؤشرات المخاطر
                 </a>
-                <div class="mt-8 px-6 text-[10px] text-bb-dim font-bold uppercase tracking-widest">System</div>
+                <div class="mt-8 px-6 text-[10px] text-bb-dim font-bold uppercase tracking-widest">إدارة النظام</div>
                 <a href="#" onclick="navigateTo('settings')" id="nav-settings" class="bb-nav-item flex items-center gap-3 px-6 py-3 hover:bg-white/5">
-                    <span class="text-bb-dim">09</span> CONFIG/KEYS
+                    <span class="text-bb-dim">09</span> الإعدادات ومفاتيح الربط
                 </a>
                 <a href="#" onclick="navigateTo('admin')" id="nav-admin" class="bb-nav-item hidden flex items-center gap-3 px-6 py-3 hover:bg-white/5 text-bb-blue">
-                    <span class="text-bb-dim">10</span> SUPER_ADMIN
+                    <span class="text-bb-dim">10</span> الإدارة العليا (SUPER ADMIN)
                 </a>
             </div>
 
             <div class="p-6 border-t border-bb-border">
-                <button onclick="logout()" class="w-full bb-btn text-bb-red text-[11px] font-bold">DISCONNECT_TERMINAL</button>
+                <button onclick="logout()" class="w-full bb-btn text-bb-red text-[11px] font-bold">تسجيل الخروج (DISCONNECT)</button>
             </div>
         </nav>
 
@@ -110,17 +111,17 @@
             <!-- Header -->
             <header class="h-14 bb-panel border-r-0 border-l-0 flex items-center justify-between px-8 bg-black/50 backdrop-blur-md">
                 <div class="flex items-center gap-6">
-                    <h2 id="page-title" class="text-lg font-black tracking-tighter">DASHBOARD</h2>
+                    <h2 id="page-title" class="text-lg font-black tracking-tighter">لوحة القيادة</h2>
                     <div class="h-4 w-[1px] bg-bb-border"></div>
                     <div class="flex items-center gap-4 text-[11px] bb-mono">
-                        <span class="text-bb-dim">STATUS:</span>
-                        <span class="text-bb-green">LIVE_TRADING</span>
-                        <span class="text-bb-dim">REGION:</span>
-                        <span class="text-white">JORDAN/AMMAN</span>
+                        <span class="text-bb-dim">الحالة:</span>
+                        <span class="text-bb-green">تداول حي (LIVE)</span>
+                        <span class="text-bb-dim">المنطقة:</span>
+                        <span class="text-white">الأردن / عمّان</span>
                     </div>
                 </div>
                 <div class="flex items-center gap-4">
-                    <button onclick="showUploadModal()" class="bb-btn bb-btn-primary text-[11px] font-black">+ NEW_INVOICE</button>
+                    <button onclick="showUploadModal()" class="bb-btn bb-btn-primary text-[11px] font-black">+ فاتورة جديدة</button>
                 </div>
             </header>
 
@@ -156,14 +157,23 @@
                 
                 try {
                     const res = await fetch(`${this.baseUrl}${path}`, { method, headers, body });
-                    const data = await res.json();
+                    let data;
+                    const isJson = res.headers.get('content-type')?.includes('application/json');
+                    if (isJson) {
+                        data = await res.json();
+                    } else {
+                        const text = await res.text();
+                        console.error('Non-JSON response:', text);
+                        throw { error: { message_ar: 'استجابة غير متوقعة من الخادم (تأكد من الرابط)' } };
+                    }
+
                     if (!res.ok) {
                         if (res.status === 401 && !path.includes('/auth/login')) logout();
                         throw data;
                     }
                     return data;
                 } catch (err) {
-                    showToast(err.error?.message_ar || err.message || 'SYSTEM_ERROR', 'error');
+                    showToast(err.error?.message_ar || err.error?.message || err.message || 'خطأ غير متوقع في النظام', 'error');
                     throw err;
                 }
             },
@@ -190,7 +200,7 @@
             document.querySelectorAll('.bb-nav-item').forEach(l => l.classList.remove('active'));
             document.getElementById(`nav-${page}`)?.classList.add('active');
             const content = document.getElementById('content');
-            content.innerHTML = '<div class="h-full flex items-center justify-center bb-mono animate-pulse">TERMINAL_BUSY: LOADING_DATA...</div>';
+            content.innerHTML = '<div class="h-full flex items-center justify-center bb-mono animate-pulse text-bb-dim">جاري تحميل البيانات... (TERMINAL BUSY)</div>';
             
             try {
                 if (page === 'dashboard') await renderDashboard();
@@ -200,70 +210,76 @@
                 else if (page === 'risk') await renderRisk();
                 else if (page === 'settings') await renderSettings();
                 else if (page === 'admin') await renderAdmin();
-            } catch (e) { console.error(e); }
+                else if (page === 'admin_tenants') await renderAdminTenants();
+                else if (page === 'admin_queue') await renderAdminQueue();
+            } catch (e) { 
+                console.error(e); 
+                content.innerHTML = '<div class="h-full flex items-center justify-center bb-mono text-bb-red">فشل تحميل الصفحة. يرجى التحقق من الشبكة أو الخادم.</div>';
+            }
         }
 
         // ── View Renderers ───────────────────────────────────────
         
         async function renderDashboard() {
-            document.getElementById('page-title').textContent = 'DASHBOARD';
+            document.getElementById('page-title').textContent = 'لوحة القيادة';
             const res = await API.get('/dashboard');
             const { data: s } = res;
             
             document.getElementById('content').innerHTML = `
                 <div class="grid grid-cols-4 gap-6 mb-8">
                     <div class="bb-panel p-6 bb-stat">
-                        <div class="text-bb-dim text-[10px] bb-mono uppercase mb-2">Total Volume / Month</div>
-                        <div class="text-4xl font-black">${s.total_this_month}</div>
-                        <div class="text-[10px] mt-2 text-bb-green">+12.4% FROM PREV</div>
+                        <div class="text-bb-dim text-[10px] bb-mono uppercase mb-2">إجمالي فواتير الشهر</div>
+                        <div class="text-4xl font-black">${s.total_this_month || 0}</div>
+                        <div class="text-[10px] mt-2 text-bb-green">+12.4% عن السابق</div>
                     </div>
                     <div class="bb-panel p-6 bb-stat" style="border-right-color: var(--bb-blue)">
-                        <div class="text-bb-dim text-[10px] bb-mono uppercase mb-2">Subscription Usage</div>
-                        <div class="text-4xl font-black">${s.subscription_usage}%</div>
-                        <div class="w-full h-1 bg-bb-border mt-4"><div class="h-full bg-bb-blue" style="width: ${s.subscription_usage}%"></div></div>
+                        <div class="text-bb-dim text-[10px] bb-mono uppercase mb-2">استهلاك الباقة</div>
+                        <div class="text-4xl font-black">${s.subscription_usage || 0}%</div>
+                        <div class="w-full h-1 bg-bb-border mt-4"><div class="h-full bg-bb-blue" style="width: ${s.subscription_usage || 0}%"></div></div>
                     </div>
                     <div class="bb-panel p-6 bb-stat" style="border-right-color: var(--bb-yellow)">
-                        <div class="text-bb-dim text-[10px] bb-mono uppercase mb-2">Pending AI Processing</div>
+                        <div class="text-bb-dim text-[10px] bb-mono uppercase mb-2">قيد المعالجة (AI)</div>
                         <div class="text-4xl font-black">${s.pending_extraction || 0}</div>
-                        <div class="text-[10px] mt-2 text-bb-yellow">QUEUE: OPTIMAL</div>
+                        <div class="text-[10px] mt-2 text-bb-yellow">حالة الطابور: ممتاز</div>
                     </div>
                     <div class="bb-panel p-6 bb-stat" style="border-right-color: var(--bb-green)">
-                        <div class="text-bb-dim text-[10px] bb-mono uppercase mb-2">Approved Ratio</div>
+                        <div class="text-bb-dim text-[10px] bb-mono uppercase mb-2">نسبة القبول (جوفوترة)</div>
                         <div class="text-4xl font-black">98.2%</div>
-                        <div class="text-[10px] mt-2 text-bb-green">COMPLIANCE: HIGH</div>
+                        <div class="text-[10px] mt-2 text-bb-green">التوافق الضريبي: عالي</div>
                     </div>
                 </div>
 
                 <div class="grid grid-cols-3 gap-6">
                     <div class="col-span-2 bb-panel p-8">
-                        <h3 class="text-sm font-black mb-6 uppercase tracking-widest border-b border-bb-border pb-4">Live Transaction Feed</h3>
+                        <h3 class="text-sm font-black mb-6 uppercase tracking-widest border-b border-bb-border pb-4">موجز العمليات الحديثة</h3>
                         <table class="w-full bb-table text-right">
                             <thead>
                                 <tr>
-                                    <th class="text-right">ENTITY</th>
-                                    <th class="text-right">ID</th>
-                                    <th class="text-right">TOTAL</th>
-                                    <th class="text-center">STATUS</th>
-                                    <th class="text-left">CONFIDENCE</th>
+                                    <th class="text-right">الشركة</th>
+                                    <th class="text-right">رقم الفاتورة</th>
+                                    <th class="text-right">المجموع</th>
+                                    <th class="text-center">الحالة</th>
+                                    <th class="text-left">دقة الذكاء الاصطناعي</th>
                                 </tr>
                             </thead>
                             <tbody>
-                                ${s.recent_invoices.map(i => `
+                                ${(s.recent_invoices || []).map(i => `
                                     <tr onclick="renderInvoiceDetail('${i.id}')" class="hover:bg-white/5 cursor-pointer">
                                         <td class="font-bold">${i.company_name}</td>
                                         <td class="bb-mono text-xs">${i.invoice_number || '---'}</td>
-                                        <td class="font-bold text-bb-green">${i.grand_total} JOD</td>
+                                        <td class="font-bold text-bb-green">${i.grand_total} دينار</td>
                                         <td class="text-center">
-                                            <span class="status-pill ${getStatusColor(i.status)}">${i.status.toUpperCase()}</span>
+                                            <span class="status-pill ${getStatusColor(i.status)}">${translateStatus(i.status)}</span>
                                         </td>
-                                        <td class="text-left bb-mono text-xs">${(i.ai_confidence_score * 100).toFixed(1)}%</td>
+                                        <td class="text-left bb-mono text-xs">${i.ai_confidence_score ? (i.ai_confidence_score * 100).toFixed(1) + '%' : '---'}</td>
                                     </tr>
                                 `).join('')}
+                                ${(!s.recent_invoices || s.recent_invoices.length === 0) ? `<tr><td colspan="5" class="text-center text-bb-dim py-4">لا توجد عمليات مسجلة</td></tr>` : ''}
                             </tbody>
                         </table>
                     </div>
                     <div class="bb-panel p-8 flex flex-col">
-                        <h3 class="text-sm font-black mb-6 uppercase tracking-widest border-b border-bb-border pb-4">Status Distribution</h3>
+                        <h3 class="text-sm font-black mb-6 uppercase tracking-widest border-b border-bb-border pb-4">توزيع حالات الفواتير</h3>
                         <div class="flex-1 flex items-center justify-center">
                             <canvas id="statusChart"></canvas>
                         </div>
@@ -271,65 +287,68 @@
                 </div>
             `;
             
-            new Chart(document.getElementById('statusChart'), {
-                type: 'doughnut',
-                data: {
-                    labels: s.status_distribution.map(x => x.status),
-                    datasets: [{
-                        data: s.status_distribution.map(x => x.count),
-                        backgroundColor: ['#00ff00', '#ffff00', '#ff3333', '#0088ff'],
-                        borderWidth: 0
-                    }]
-                },
-                options: {
-                    cutout: '80%',
-                    plugins: { legend: { position: 'bottom', labels: { color: '#888888', font: { size: 10, family: 'JetBrains Mono' } } } }
-                }
-            });
+            if (s.status_distribution && s.status_distribution.length > 0) {
+                new Chart(document.getElementById('statusChart'), {
+                    type: 'doughnut',
+                    data: {
+                        labels: s.status_distribution.map(x => translateStatus(x.status)),
+                        datasets: [{
+                            data: s.status_distribution.map(x => x.count),
+                            backgroundColor: ['#00ff00', '#ffff00', '#ff3333', '#0088ff'],
+                            borderWidth: 0
+                        }]
+                    },
+                    options: {
+                        cutout: '80%',
+                        plugins: { legend: { position: 'bottom', labels: { color: '#888888', font: { size: 10, family: 'Noto Kufi Arabic' } } } }
+                    }
+                });
+            }
         }
 
         async function renderInvoices() {
-            document.getElementById('page-title').textContent = 'TERMINAL / INVOICES';
+            document.getElementById('page-title').textContent = 'الفواتير والعمليات';
             const res = await API.get('/invoices');
             document.getElementById('content').innerHTML = `
                 <div class="bb-panel p-8">
                     <div class="flex justify-between items-center mb-8">
                         <div class="flex gap-4">
-                            <input type="text" placeholder="FILTER_BY_ID..." class="bb-panel bg-black px-4 py-2 text-xs bb-mono w-64">
+                            <input type="text" placeholder="بحث برقم الفاتورة..." class="bb-panel bg-black px-4 py-2 text-xs bb-mono w-64 text-right">
                             <select class="bb-panel bg-black px-4 py-2 text-xs bb-mono">
-                                <option>ALL_STATUSES</option>
-                                <option>APPROVED</option>
-                                <option>PENDING</option>
+                                <option>جميع الحالات</option>
+                                <option>مقبولة</option>
+                                <option>قيد الانتظار</option>
                             </select>
                         </div>
-                        <div class="text-[10px] text-bb-dim bb-mono">RECORDS: ${res.data.length} | PAGE: 1/1</div>
+                        <div class="text-[10px] text-bb-dim bb-mono">الإجمالي: ${res.data.length} | الصفحة: 1/1</div>
                     </div>
                     <table class="w-full bb-table text-right">
                         <thead>
                             <tr>
-                                <th class="text-right">DATE</th>
-                                <th class="text-right">ENTITY</th>
-                                <th class="text-right">SERIAL_NO</th>
-                                <th class="text-right">TAX</th>
-                                <th class="text-right">TOTAL_JOD</th>
-                                <th class="text-center">STATE</th>
-                                <th class="text-left">CMD</th>
+                                <th class="text-right">التاريخ</th>
+                                <th class="text-right">الشركة</th>
+                                <th class="text-right">الرقم المتسلسل</th>
+                                <th class="text-right">الضريبة</th>
+                                <th class="text-right">الإجمالي</th>
+                                <th class="text-center">الحالة</th>
+                                <th class="text-left">إجراءات</th>
                             </tr>
                         </thead>
                         <tbody>
                             ${res.data.map(i => `
                                 <tr class="hover:bg-white/5 transition">
-                                    <td class="bb-mono text-xs">${i.invoice_date || '---'}</td>
+                                    <td class="bb-mono text-xs text-left" dir="ltr">${i.invoice_date || '---'}</td>
                                     <td class="font-bold">${i.company_name}</td>
-                                    <td class="bb-mono text-xs">${i.invoice_number || '---'}</td>
+                                    <td class="bb-mono text-xs text-left" dir="ltr">${i.invoice_number || '---'}</td>
                                     <td class="text-bb-dim">${i.tax_amount}</td>
                                     <td class="font-bold text-bb-green">${i.grand_total}</td>
-                                    <td class="text-center"><span class="status-pill ${getStatusColor(i.status)}">${i.status.toUpperCase()}</span></td>
+                                    <td class="text-center"><span class="status-pill ${getStatusColor(i.status)}">${translateStatus(i.status)}</span></td>
                                     <td class="text-left">
-                                        <button onclick="renderInvoiceDetail('${i.id}')" class="bb-btn text-[10px] font-black">OPEN</button>
+                                        <button onclick="renderInvoiceDetail('${i.id}')" class="bb-btn text-[10px] font-black">فتح وعرض</button>
                                     </td>
                                 </tr>
                             `).join('')}
+                            ${res.data.length === 0 ? `<tr><td colspan="7" class="text-center py-4 text-bb-dim">لا توجد فواتير</td></tr>` : ''}
                         </tbody>
                     </table>
                 </div>
@@ -343,11 +362,11 @@
                 <div class="grid grid-cols-2 gap-8 h-full">
                     <div class="bb-panel flex flex-col overflow-hidden">
                         <div class="p-4 border-b border-bb-border flex justify-between items-center bg-white/5">
-                            <span class="bb-mono text-[10px] uppercase">Original_Source_Visual</span>
-                            <a href="/api/v1/invoices/${i.id}/file" target="_blank" class="text-bb-blue text-[10px] hover:underline font-bold">EXTERNAL_VIEW ↗</a>
+                            <span class="bb-mono text-[10px] uppercase">المستند الأصلي (المصدر)</span>
+                            <a href="/api/v1/invoices/${i.id}/file" target="_blank" class="text-bb-blue text-[10px] hover:underline font-bold">عرض خارجي ↗</a>
                         </div>
                         <div class="flex-1 bg-zinc-900 flex items-center justify-center p-4">
-                            ${i.original_file_path.endsWith('.pdf') ? 
+                            ${i.original_file_path && i.original_file_path.endsWith('.pdf') ? 
                                 `<iframe src="/api/v1/invoices/${i.id}/file" class="w-full h-full border-0"></iframe>` : 
                                 `<img src="/api/v1/invoices/${i.id}/file" class="max-w-full max-h-full shadow-2xl">`}
                         </div>
@@ -356,28 +375,28 @@
                         <div class="bb-panel p-8">
                             <div class="flex justify-between items-start mb-8">
                                 <div>
-                                    <h2 class="text-2xl font-black tracking-tighter mb-2">${i.supplier_name || 'UNIDENTIFIED_ENTITY'}</h2>
+                                    <h2 class="text-2xl font-black tracking-tighter mb-2">${i.supplier_name || 'كيان غير معروف'}</h2>
                                     <div class="flex gap-4 text-[10px] bb-mono">
-                                        <span class="text-bb-dim">INV_NO:</span> <span class="text-white">${i.invoice_number || 'PENDING'}</span>
-                                        <span class="text-bb-dim">TAX_ID:</span> <span class="text-bb-green">${i.supplier_tin || '---'}</span>
+                                        <span class="text-bb-dim">رقم الفاتورة:</span> <span class="text-white">${i.invoice_number || 'قيد الانتظار'}</span>
+                                        <span class="text-bb-dim">الرقم الضريبي:</span> <span class="text-bb-green">${i.supplier_tin || '---'}</span>
                                     </div>
                                 </div>
                                 <div class="flex flex-col gap-2 items-end">
-                                    <span class="status-pill ${getStatusColor(i.status)} text-sm px-4 py-2">${i.status.toUpperCase()}</span>
-                                    <div class="text-[10px] bb-mono text-bb-dim">AI_SCORE: ${(i.ai_confidence_score * 100).toFixed(2)}%</div>
+                                    <span class="status-pill ${getStatusColor(i.status)} text-sm px-4 py-2">${translateStatus(i.status)}</span>
+                                    <div class="text-[10px] bb-mono text-bb-dim">دقة الذكاء الاصطناعي: ${i.ai_confidence_score ? (i.ai_confidence_score * 100).toFixed(2) + '%' : '---'}</div>
                                 </div>
                             </div>
                             
                             <div class="grid grid-cols-2 gap-4 mb-8 bb-mono">
                                 <div class="bb-panel p-4">
-                                    <div class="text-bb-dim text-[9px] mb-1 uppercase">Buyer_Entity</div>
-                                    <div class="font-bold">${i.buyer_name || 'GENERAL_RETAIL'}</div>
-                                    <div class="text-[9px] text-bb-dim mt-1">ID: ${i.buyer_tin || '---'}</div>
+                                    <div class="text-bb-dim text-[9px] mb-1 uppercase">بيانات المشتري</div>
+                                    <div class="font-bold">${i.buyer_name || 'مشتري عام (نقدي)'}</div>
+                                    <div class="text-[9px] text-bb-dim mt-1">الرقم الضريبي: ${i.buyer_tin || '---'}</div>
                                 </div>
                                 <div class="bb-panel p-4">
-                                    <div class="text-bb-dim text-[9px] mb-1 uppercase">Timestamp</div>
+                                    <div class="text-bb-dim text-[9px] mb-1 uppercase">بيانات الوقت والتاريخ</div>
                                     <div class="font-bold">${i.invoice_date || '---'}</div>
-                                    <div class="text-[9px] text-bb-dim mt-1">ISSUED_AT: ${i.created_at}</div>
+                                    <div class="text-[9px] text-bb-dim mt-1 text-left" dir="ltr">ISSUED_AT: ${i.created_at}</div>
                                 </div>
                             </div>
 
@@ -385,107 +404,115 @@
                                 <table class="w-full bb-table text-right text-xs">
                                     <thead>
                                         <tr>
-                                            <th class="text-right">DESC</th>
-                                            <th class="text-center">QTY</th>
-                                            <th class="text-right">PRICE</th>
-                                            <th class="text-right">TOTAL</th>
+                                            <th class="text-right">الوصف (السلعة/الخدمة)</th>
+                                            <th class="text-center">الكمية</th>
+                                            <th class="text-right">السعر الإفرادي</th>
+                                            <th class="text-right">الإجمالي</th>
                                         </tr>
                                     </thead>
                                     <tbody>
-                                        ${i.lines.map(l => `
+                                        ${i.lines && i.lines.length > 0 ? i.lines.map(l => `
                                             <tr>
                                                 <td class="text-bb-dim">${l.description}</td>
                                                 <td class="text-center bb-mono">${l.quantity}</td>
                                                 <td class="bb-mono">${l.unit_price}</td>
                                                 <td class="font-bold text-bb-green">${l.line_total}</td>
                                             </tr>
-                                        `).join('')}
+                                        `).join('') : `<tr><td colspan="4" class="text-center text-bb-dim">لا توجد أصناف مستخرجة أو قيد المعالجة</td></tr>`}
                                     </tbody>
                                 </table>
                             </div>
 
                             <div class="border-t border-bb-border pt-6 bb-mono">
                                 <div class="flex justify-between text-xs mb-2">
-                                    <span class="text-bb-dim">SUB_TOTAL</span>
-                                    <span>${i.subtotal} JOD</span>
+                                    <span class="text-bb-dim">المجموع الفرعي</span>
+                                    <span>${i.subtotal || 0} دينار</span>
                                 </div>
                                 <div class="flex justify-between text-xs mb-2">
-                                    <span class="text-bb-dim">TAX_SUM (16%)</span>
-                                    <span class="text-bb-yellow">${i.tax_amount} JOD</span>
+                                    <span class="text-bb-dim">قيمة الضريبة المضافة (16%)</span>
+                                    <span class="text-bb-yellow">${i.tax_amount || 0} دينار</span>
                                 </div>
                                 <div class="flex justify-between text-xl font-black mt-4 border-t border-bb-border pt-4">
-                                    <span class="text-bb-dim">GRAND_TOTAL</span>
-                                    <span class="text-bb-green">${i.grand_total} JOD</span>
+                                    <span class="text-bb-dim">المجموع الكلي</span>
+                                    <span class="text-bb-green">${i.grand_total || 0} دينار</span>
                                 </div>
                             </div>
                         </div>
 
                         <div class="flex gap-4">
-                            <button onclick="submitToJoFotara('${i.id}')" class="flex-1 bb-btn bb-btn-primary py-4 font-black">SUBMIT_TO_GOV_API</button>
-                            <button onclick="navigateTo('invoices')" class="bb-btn px-8 font-black">BACK_TO_LIST</button>
+                            <button onclick="submitToJoFotara('${i.id}')" class="flex-1 bb-btn bb-btn-primary py-4 font-black" ${i.status === 'approved' ? 'disabled' : ''}>إرسال لنظام جوفوترة</button>
+                            <button onclick="navigateTo('invoices')" class="bb-btn px-8 font-black">العودة للقائمة</button>
                         </div>
                     </div>
                 </div>
             `;
         }
 
+        async function submitToJoFotara(id) {
+            if(!confirm('هل أنت متأكد من إرسال واعتماد هذه الفاتورة رسمياً عبر بوابة جوفوترة؟ لا يمكن التراجع.')) return;
+            try {
+                await API.post(`/invoices/${id}/submit`);
+                showToast('جاري إرسال الفاتورة...');
+                setTimeout(() => renderInvoiceDetail(id), 2000);
+            } catch(e) {}
+        }
+
         async function renderCompanies() {
-            document.getElementById('page-title').textContent = 'ENTITIES / COMPANIES';
+            document.getElementById('page-title').textContent = 'الشركات (الكيانات التابعة)';
             const res = await API.get('/companies');
             document.getElementById('content').innerHTML = `
                 <div class="flex justify-end mb-6">
-                    <button onclick="showAddCompanyModal()" class="bb-btn bb-btn-primary">+ REGISTER_ENTITY</button>
+                    <button onclick="showAddCompanyModal()" class="bb-btn bb-btn-primary font-black">+ تسجيل شركة جديدة</button>
                 </div>
                 <div class="grid grid-cols-3 gap-6">
                     ${res.data.map(c => `
                         <div class="bb-panel p-8 border-t-4 border-t-bb-green">
                             <div class="flex justify-between items-start mb-6">
                                 <h3 class="text-xl font-black tracking-tighter uppercase">${c.name}</h3>
-                                <span class="status-pill ${c.is_jofotara_linked ? 'text-bb-green' : 'text-bb-red'}">${c.is_jofotara_linked ? 'LINKED' : 'UNLINKED'}</span>
+                                <span class="status-pill ${c.is_jofotara_linked ? 'text-bb-green border-bb-green' : 'text-bb-red border-bb-red'}">${c.is_jofotara_linked ? 'مربوط' : 'غير مربوط'}</span>
                             </div>
                             <div class="space-y-3 bb-mono text-xs">
-                                <div class="flex justify-between"><span class="text-bb-dim">TAX_ID:</span> <span>${c.tax_identification_number}</span></div>
-                                <div class="flex justify-between"><span class="text-bb-dim">REGION:</span> <span>${c.city || 'AMMAN'}</span></div>
-                                <div class="flex justify-between"><span class="text-bb-dim">INVOICES:</span> <span class="text-bb-blue">---</span></div>
+                                <div class="flex justify-between"><span class="text-bb-dim">الرقم الضريبي:</span> <span>${c.tax_identification_number}</span></div>
+                                <div class="flex justify-between"><span class="text-bb-dim">المدينة:</span> <span>${c.city || '---'}</span></div>
                             </div>
                             <div class="mt-8 flex gap-2">
-                                <button onclick="showJoFotaraModal('${c.id}')" class="flex-1 bb-btn text-[10px] font-black">GOV_SETTINGS</button>
-                                <button class="bb-btn text-bb-red text-[10px] font-black px-4">DEACTIVATE</button>
+                                <button onclick="showJoFotaraModal('${c.id}')" class="flex-1 bb-btn text-[10px] font-black">إعدادات الربط الحكومي</button>
                             </div>
                         </div>
                     `).join('')}
+                    ${res.data.length === 0 ? `<div class="col-span-3 text-center py-10 text-bb-dim">لم يتم إضافة أي شركات بعد</div>` : ''}
                 </div>
             `;
         }
 
         async function renderUsers() {
-            document.getElementById('page-title').textContent = 'ACCESS / USERS';
+            document.getElementById('page-title').textContent = 'المستخدمين والصلاحيات';
             const res = await API.get('/users');
             document.getElementById('content').innerHTML = `
                 <div class="bb-panel p-8">
                     <div class="flex justify-between items-center mb-8">
-                        <h3 class="text-sm font-black uppercase tracking-widest">Authorized Terminals</h3>
-                        <button onclick="showAddUserModal()" class="bb-btn bb-btn-primary">+ ADD_USER</button>
+                        <h3 class="text-sm font-black uppercase tracking-widest">صلاحيات الوصول</h3>
+                        <button onclick="showAddUserModal()" class="bb-btn bb-btn-primary font-black">+ إضافة مستخدم</button>
                     </div>
                     <table class="w-full bb-table text-right">
                         <thead>
                             <tr>
-                                <th class="text-right">NAME</th>
-                                <th class="text-right">EMAIL_IDENTITY</th>
-                                <th class="text-right">ACCESS_ROLE</th>
-                                <th class="text-center">2FA</th>
-                                <th class="text-left">CMD</th>
+                                <th class="text-right">الاسم الكامل</th>
+                                <th class="text-right text-left" dir="ltr">البريد الإلكتروني</th>
+                                <th class="text-right">نوع الصلاحية</th>
+                                <th class="text-center">2FA (التحقق الثنائي)</th>
+                                <th class="text-left">إجراءات</th>
                             </tr>
                         </thead>
                         <tbody>
                             ${res.data.map(u => `
                                 <tr>
                                     <td class="font-bold">${u.name}</td>
-                                    <td class="bb-mono text-xs text-bb-dim">${u.email}</td>
-                                    <td><span class="status-pill text-bb-blue">${u.role.toUpperCase()}</span></td>
-                                    <td class="text-center">${u.totp_enabled ? '<span class="text-bb-green">ON</span>' : '<span class="text-bb-red">OFF</span>'}</td>
+                                    <td class="bb-mono text-xs text-bb-dim text-left" dir="ltr">${u.email}</td>
+                                    <td><span class="status-pill text-bb-blue">${translateRole(u.role)}</span></td>
+                                    <td class="text-center">${u.totp_enabled ? '<span class="text-bb-green">مفعل</span>' : '<span class="text-bb-red">معطل</span>'}</td>
                                     <td class="text-left">
-                                        <button onclick="deleteUser('${u.id}')" class="text-bb-red hover:underline text-[10px] bb-mono">REVOKE_ACCESS</button>
+                                        <button onclick="deleteUser('${u.id}')" class="text-bb-red hover:underline text-[10px] bb-mono">إلغاء الصلاحية (إزالة)</button>
                                     </td>
                                 </tr>
                             `).join('')}
@@ -495,28 +522,69 @@
             `;
         }
 
+        async function renderRisk() {
+            document.getElementById('page-title').textContent = 'مؤشرات المخاطر';
+            try {
+                const res = await API.get('/risk');
+                document.getElementById('content').innerHTML = `
+                    <div class="bb-panel p-8">
+                        <div class="flex justify-between items-center mb-8">
+                            <h3 class="text-sm font-black uppercase tracking-widest">تنبيهات التدقيق والمخاطر الضريبية</h3>
+                        </div>
+                        <table class="w-full bb-table text-right">
+                            <thead>
+                                <tr>
+                                    <th class="text-right">التاريخ</th>
+                                    <th class="text-right">الشركة</th>
+                                    <th class="text-right">الفاتورة</th>
+                                    <th class="text-right">مستوى الخطر</th>
+                                    <th class="text-right">السبب</th>
+                                    <th class="text-center">الحالة</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                ${res.data.map(r => `
+                                    <tr class="hover:bg-white/5 transition">
+                                        <td class="bb-mono text-xs text-left" dir="ltr">${r.created_at}</td>
+                                        <td class="font-bold">${r.company_name}</td>
+                                        <td class="bb-mono text-xs">${r.invoice_number || '---'}</td>
+                                        <td class="${getRiskColor(r.risk_level)} font-bold">${translateRisk(r.risk_level)}</td>
+                                        <td class="text-bb-dim text-xs">${r.reason}</td>
+                                        <td class="text-center">${r.is_resolved ? '<span class="text-bb-green">محلول</span>' : '<span class="text-bb-red font-bold animate-pulse">قيد الانتظار</span>'}</td>
+                                    </tr>
+                                `).join('')}
+                                ${res.data.length === 0 ? `<tr><td colspan="6" class="text-center py-10 text-bb-dim">لا توجد مخاطر مسجلة حتى الآن</td></tr>` : ''}
+                            </tbody>
+                        </table>
+                    </div>
+                `;
+            } catch (e) {
+                document.getElementById('content').innerHTML = `<div class="bb-panel p-8 text-bb-dim text-center">خدمة المخاطر غير متاحة حالياً أو قيد الإنشاء</div>`;
+            }
+        }
+
         async function renderSettings() {
-            document.getElementById('page-title').textContent = 'CONFIG / KEYS';
+            document.getElementById('page-title').textContent = 'الإعدادات ومفاتيح الربط';
             const u = (await API.get('/auth/me')).data;
             document.getElementById('content').innerHTML = `
                 <div class="max-w-2xl space-y-8">
                     <div class="bb-panel p-8 border-r-4 border-r-bb-blue">
-                        <h3 class="text-lg font-black mb-2 tracking-tighter">SECURE_AUTH (2FA)</h3>
-                        <p class="text-bb-dim text-[11px] mb-6">Multi-factor authentication status for your terminal session.</p>
+                        <h3 class="text-lg font-black mb-2 tracking-tighter">الحماية المتقدمة (التحقق الثنائي 2FA)</h3>
+                        <p class="text-bb-dim text-[11px] mb-6">يضيف التحقق بخطوتين طبقة حماية إضافية لحسابك.</p>
                         <div id="2fa-area">
                             ${u.totp_enabled ? 
-                                `<button onclick="disable2FA()" class="bb-btn text-bb-red font-black">DISABLE_2FA_PROTECTION</button>` : 
-                                `<button onclick="start2FA()" class="bb-btn bb-btn-primary font-black">ENABLE_MFA_NOW</button>`}
+                                `<button onclick="disable2FA()" class="bb-btn text-bb-red font-black border-bb-red">إيقاف التحقق الثنائي</button>` : 
+                                `<button onclick="start2FA()" class="bb-btn bb-btn-primary font-black">تفعيل التحقق الثنائي الآن</button>`}
                         </div>
                     </div>
                     
                     <div class="bb-panel p-8 border-r-4 border-r-bb-yellow">
                         <div class="flex justify-between items-center mb-6">
-                            <h3 class="text-lg font-black tracking-tighter">API_ACCESS_KEYS</h3>
-                            <button onclick="createApiKey()" class="bb-btn bb-btn-primary text-[10px]">+ GENERATE_NEW_PAIR</button>
+                            <h3 class="text-lg font-black tracking-tighter">مفاتيح الربط (API Keys)</h3>
+                            <button onclick="createApiKey()" class="bb-btn bb-btn-primary text-[10px] font-black">+ إنشاء مفتاح جديد</button>
                         </div>
                         <div id="api-keys-list" class="space-y-4">
-                            <div class="bb-mono text-[10px] animate-pulse">POLLING_KEYS...</div>
+                            <div class="bb-mono text-[10px] animate-pulse text-bb-dim">جاري جلب المفاتيح...</div>
                         </div>
                     </div>
                 </div>
@@ -525,39 +593,39 @@
         }
 
         async function renderAdmin() {
-            document.getElementById('page-title').textContent = 'SUPER_ADMIN / CONTROL';
+            document.getElementById('page-title').textContent = 'الإدارة العليا للأنظمة (SUPER ADMIN)';
             const s = (await API.get('/admin/stats')).data;
             const h = (await API.get('/admin/health')).data;
             
             document.getElementById('content').innerHTML = `
                 <div class="grid grid-cols-2 gap-8">
                     <div class="bb-panel p-8">
-                        <h3 class="text-sm font-black mb-6 border-b border-bb-border pb-4 uppercase">System Health</h3>
+                        <h3 class="text-sm font-black mb-6 border-b border-bb-border pb-4 uppercase">صحة البنية التحتية</h3>
                         <div class="grid grid-cols-2 gap-4 bb-mono text-xs">
-                            <div class="bb-panel p-4">DB_CLUSTER: <span class="${h.db==='ok'?'text-bb-green':'text-bb-red'}">${h.db.toUpperCase()}</span></div>
-                            <div class="bb-panel p-4">REDIS_CACHE: <span class="${h.redis==='ok'?'text-bb-green':'text-bb-red'}">${h.redis.toUpperCase()}</span></div>
-                            <div class="bb-panel p-4">QUEUE_PENDING: <span class="text-bb-yellow">${h.queue_pending}</span></div>
-                            <div class="bb-panel p-4">QUEUE_DEAD: <span class="text-bb-red">${h.queue_dead}</span></div>
+                            <div class="bb-panel p-4">قواعد البيانات: <span class="${h.db==='ok'?'text-bb-green':'text-bb-red'}">${h.db.toUpperCase()}</span></div>
+                            <div class="bb-panel p-4">كاش Redis: <span class="${h.redis==='ok'?'text-bb-green':'text-bb-red'}">${h.redis.toUpperCase()}</span></div>
+                            <div class="bb-panel p-4">المهام المنتظرة: <span class="text-bb-yellow">${h.queue_pending}</span></div>
+                            <div class="bb-panel p-4">المهام الفاشلة: <span class="text-bb-red">${h.queue_dead}</span></div>
                         </div>
                         <div class="mt-8 flex gap-2">
-                            <button onclick="navigateTo('admin_tenants')" class="flex-1 bb-btn text-[10px] font-black">MANAGE_TENANTS</button>
-                            <button onclick="navigateTo('admin_queue')" class="flex-1 bb-btn text-[10px] font-black">QUEUE_INSPECTOR</button>
+                            <button onclick="navigateTo('admin_tenants')" class="flex-1 bb-btn text-[10px] font-black">إدارة الحسابات (Tenants)</button>
+                            <button onclick="navigateTo('admin_queue')" class="flex-1 bb-btn text-[10px] font-black">مراقب الطابور (Queue)</button>
                         </div>
                     </div>
                     <div class="bb-panel p-8">
-                        <h3 class="text-sm font-black mb-6 border-b border-bb-border pb-4 uppercase">Platform Aggregates</h3>
+                        <h3 class="text-sm font-black mb-6 border-b border-bb-border pb-4 uppercase">إحصائيات المنصة الكلية</h3>
                         <div class="space-y-4">
                             <div class="flex justify-between items-end">
-                                <span class="bb-mono text-bb-dim text-[10px]">TOTAL_TENANTS</span>
-                                <span class="text-3xl font-black">${s.tenants}</span>
+                                <span class="bb-mono text-bb-dim text-[10px]">المستأجرين (TENANTS)</span>
+                                <span class="text-3xl font-black text-white">${s.tenants}</span>
                             </div>
                             <div class="flex justify-between items-end">
-                                <span class="bb-mono text-bb-dim text-[10px]">TOTAL_INVOICES</span>
-                                <span class="text-3xl font-black">${s.invoices}</span>
+                                <span class="bb-mono text-bb-dim text-[10px]">الفواتير المتراكمة</span>
+                                <span class="text-3xl font-black text-bb-green">${s.invoices}</span>
                             </div>
                             <div class="flex justify-between items-end">
-                                <span class="bb-mono text-bb-dim text-[10px]">TOTAL_USERS</span>
-                                <span class="text-3xl font-black">${s.users}</span>
+                                <span class="bb-mono text-bb-dim text-[10px]">إجمالي المستخدمين</span>
+                                <span class="text-3xl font-black text-bb-blue">${s.users}</span>
                             </div>
                         </div>
                     </div>
@@ -565,65 +633,322 @@
             `;
         }
 
+        async function renderAdminTenants() {
+            document.getElementById('page-title').textContent = 'إدارة حسابات المستأجرين (Tenants)';
+            const res = await API.get('/admin/tenants');
+            document.getElementById('content').innerHTML = `
+                <div class="bb-panel p-8">
+                    <button onclick="navigateTo('admin')" class="bb-btn mb-6 font-black">< العودة</button>
+                    <table class="w-full bb-table text-right">
+                        <thead><tr><th>الاسم</th><th>البريد</th><th>الحالة</th><th>تاريخ التسجيل</th></tr></thead>
+                        <tbody>
+                            ${res.data.map(t => `
+                                <tr>
+                                    <td class="font-bold">${t.name}</td>
+                                    <td class="bb-mono text-left" dir="ltr">${t.email}</td>
+                                    <td><span class="status-pill text-bb-green">${t.status}</span></td>
+                                    <td class="bb-mono text-xs text-left" dir="ltr">${t.created_at}</td>
+                                </tr>
+                            `).join('')}
+                        </tbody>
+                    </table>
+                </div>
+            `;
+        }
+
+        async function renderAdminQueue() {
+            document.getElementById('page-title').textContent = 'مراقب طابور المهام (Queue)';
+            const res = await API.get('/admin/queue');
+            document.getElementById('content').innerHTML = `
+                <div class="bb-panel p-8">
+                    <button onclick="navigateTo('admin')" class="bb-btn mb-6 font-black">< العودة</button>
+                    <table class="w-full bb-table text-right text-xs">
+                        <thead><tr><th>المعرف</th><th>النوع</th><th>المحاولات</th><th>الحالة</th><th>تاريخ الجدولة</th></tr></thead>
+                        <tbody>
+                            ${(res.data.failed_jobs || []).map(q => `
+                                <tr>
+                                    <td class="bb-mono text-left" dir="ltr">${q.id.substring(0,8)}...</td>
+                                    <td class="font-bold text-bb-blue">${q.type}</td>
+                                    <td class="bb-mono text-center">${q.attempts}</td>
+                                    <td><span class="status-pill ${q.status==='pending'?'text-bb-yellow':'text-bb-red'}">${q.status}</span></td>
+                                    <td class="bb-mono text-left" dir="ltr">${q.scheduled_at}</td>
+                                </tr>
+                            `).join('')}
+                            ${(!res.data.failed_jobs || res.data.failed_jobs.length === 0) ? `<tr><td colspan="5" class="text-center py-4">لا توجد مهام معلقة أو فاشلة</td></tr>` : ''}
+                        </tbody>
+                    </table>
+                </div>
+            `;
+        }
+
         // ── Helper Functions ─────────────────────────────────────
 
         function getStatusColor(s) {
-            const m = { 'approved': 'text-bb-green', 'rejected': 'text-bb-red', 'extracted': 'text-bb-blue', 'uploaded': 'text-bb-dim', 'validation_failed': 'text-bb-red' };
-            return m[s] || 'text-bb-yellow';
+            const m = { 'approved': 'text-bb-green border-bb-green', 'rejected': 'text-bb-red border-bb-red', 'extracted': 'text-bb-blue border-bb-blue', 'uploaded': 'text-bb-dim border-bb-dim', 'validation_failed': 'text-bb-red border-bb-red' };
+            return m[s] || 'text-bb-yellow border-bb-yellow';
+        }
+
+        function translateStatus(s) {
+            const m = { 'uploaded': 'مرفوعة (تنتظر الذكاء)', 'extracting': 'قيد الاستخراج', 'extracted': 'تم الاستخراج', 'validated': 'تم التدقيق', 'validation_failed': 'فشل التدقيق', 'submitting': 'جاري الإرسال', 'approved': 'تم الاعتماد', 'rejected': 'مرفوضة' };
+            return m[s] || s;
+        }
+
+        function translateRole(r) {
+            const m = { 'super_admin': 'مسؤول النظام', 'admin': 'مسؤول الكيان', 'accountant': 'محاسب', 'employee': 'موظف', 'viewer': 'مراقب' };
+            return m[r] || r;
+        }
+
+        function translateRisk(r) {
+            const m = { 'low': 'منخفض', 'medium': 'متوسط', 'high': 'عالي', 'critical': 'حرج' };
+            return m[r] || r;
+        }
+
+        function getRiskColor(r) {
+            const m = { 'low': 'text-bb-green', 'medium': 'text-bb-yellow', 'high': 'text-orange-500', 'critical': 'text-bb-red' };
+            return m[r] || 'text-white';
         }
 
         async function loadApiKeys() {
-            const res = await API.get('/api-keys');
-            document.getElementById('api-keys-list').innerHTML = res.data.map(k => `
-                <div class="bb-panel p-4 flex justify-between items-center bg-black/40">
-                    <div>
-                        <div class="font-bold bb-mono text-xs">${k.name}</div>
-                        <div class="text-[9px] text-bb-dim bb-mono mt-1">PUB: ${k.public_key}</div>
+            try {
+                const res = await API.get('/api-keys');
+                document.getElementById('api-keys-list').innerHTML = res.data.map(k => `
+                    <div class="bb-panel p-4 flex justify-between items-center bg-black/40">
+                        <div>
+                            <div class="font-bold bb-mono text-xs">${k.name}</div>
+                            <div class="text-[9px] text-bb-dim bb-mono mt-1 text-left" dir="ltr">PUB: ${k.public_key}</div>
+                        </div>
+                        <button onclick="revokeApiKey('${k.id}')" class="text-bb-red text-[9px] bb-mono hover:underline font-bold">إلغاء وإيقاف</button>
                     </div>
-                    <button onclick="revokeApiKey('${k.id}')" class="text-bb-red text-[9px] bb-mono hover:underline">REVOKE</button>
-                </div>
-            `).join('') || '<div class="text-bb-dim text-xs bb-mono">NO_KEYS_FOUND</div>';
+                `).join('') || '<div class="text-bb-dim text-xs bb-mono">لا توجد مفاتيح مسجلة</div>';
+            } catch(e) {}
         }
 
-        async function showUploadModal() {
-            const comps = (await API.get('/companies')).data;
+        // ── Modals Functions ─────────────────────────────────────
+
+        async function showAddCompanyModal() {
             showModal(`
-                <h2 class="text-xl font-black mb-8 border-b border-bb-border pb-4 uppercase tracking-tighter">New Invoice Upload</h2>
-                <form id="upload-form" class="space-y-6">
-                    <div class="space-y-2">
-                        <label class="text-[10px] bb-mono text-bb-dim">TARGET_ENTITY</label>
-                        <select name="company_id" class="w-full bb-panel bg-black p-3 bb-mono text-sm border-bb-dim" required>
-                            <option value="">SELECT_COMPANY...</option>
-                            ${comps.map(c => `<option value="${c.id}">${c.name}</option>`).join('')}
-                        </select>
-                    </div>
-                    <div class="space-y-2">
-                        <label class="text-[10px] bb-mono text-bb-dim">INVOICE_DOCUMENT (PDF/IMG)</label>
-                        <div class="bb-panel p-10 border-dashed text-center bg-white/5 border-bb-dim">
-                            <input type="file" name="file" class="bb-mono text-xs" required>
-                        </div>
-                    </div>
+                <h2 class="text-xl font-black mb-8 border-b border-bb-border pb-4 uppercase">تسجيل شركة / كيان جديد</h2>
+                <form id="add-company-form" class="space-y-4">
+                    <input type="text" name="name" placeholder="اسم الشركة" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
+                    <input type="text" name="tax_identification_number" placeholder="الرقم الضريبي (TIN)" class="w-full bb-panel bg-black p-3 bb-mono text-sm text-left" dir="ltr" required>
+                    <input type="text" name="city" placeholder="المدينة (مثال: عمان)" class="w-full bb-panel bg-black p-3 bb-mono text-sm">
                     <div class="flex gap-4 pt-4">
-                        <button type="submit" class="flex-1 bb-btn bb-btn-primary font-black py-4">START_AI_EXTRACTION</button>
-                        <button type="button" onclick="closeModal()" class="bb-btn px-10">CANCEL</button>
+                        <button type="submit" class="flex-1 bb-btn bb-btn-primary font-black py-4">حفظ وإضافة</button>
+                        <button type="button" onclick="closeModal()" class="bb-btn px-10 font-black">إلغاء</button>
                     </div>
                 </form>
             `);
-            
-            document.getElementById('upload-form').onsubmit = async (e) => {
+            document.getElementById('add-company-form').onsubmit = async (e) => {
                 e.preventDefault();
                 const fd = new FormData(e.target);
                 try {
-                    const btn = e.target.querySelector('button[type="submit"]');
-                    btn.disabled = true; btn.textContent = 'UPLOADING...';
-                    await API.upload('/invoices/upload', fd);
-                    showToast('INVOICE_UPLOADED: AI_QUEUE_STARTED');
+                    await API.post('/companies', Object.fromEntries(fd));
+                    showToast('تمت إضافة الشركة بنجاح');
                     closeModal();
-                    navigateTo('invoices');
+                    navigateTo('companies');
                 } catch(err) {}
             };
         }
 
+        async function showJoFotaraModal(companyId) {
+            showModal(`
+                <h2 class="text-xl font-black mb-8 border-b border-bb-border pb-4 uppercase">إعدادات الربط الحكومي (جوفوترة)</h2>
+                <form id="jofotara-form" class="space-y-4">
+                    <input type="text" name="client_id" placeholder="Client ID (رقم العميل)" class="w-full bb-panel bg-black p-3 bb-mono text-sm text-left" dir="ltr" required>
+                    <input type="password" name="secret_key" placeholder="Secret Key (المفتاح السري)" class="w-full bb-panel bg-black p-3 bb-mono text-sm text-left" dir="ltr" required>
+                    <div class="flex gap-4 pt-4">
+                        <button type="submit" class="flex-1 bb-btn bb-btn-primary font-black py-4">حفظ بيانات الربط</button>
+                        <button type="button" onclick="closeModal()" class="bb-btn px-10 font-black">إلغاء</button>
+                    </div>
+                </form>
+            `);
+            document.getElementById('jofotara-form').onsubmit = async (e) => {
+                e.preventDefault();
+                const fd = new FormData(e.target);
+                try {
+                    await API.post(`/companies/${companyId}/jofotara`, Object.fromEntries(fd));
+                    showToast('تم حفظ بيانات الربط بنجاح');
+                    closeModal();
+                    navigateTo('companies');
+                } catch(err) {}
+            };
+        }
+
+        async function showAddUserModal() {
+            try {
+                const res = await API.get('/companies');
+                const comps = res.data;
+                showModal(`
+                    <h2 class="text-xl font-black mb-8 border-b border-bb-border pb-4 uppercase">إضافة مستخدم للوحة</h2>
+                    <form id="add-user-form" class="space-y-4">
+                        <input type="text" name="name" placeholder="الاسم الكامل" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
+                        <input type="email" name="email" placeholder="البريد الإلكتروني" class="w-full bb-panel bg-black p-3 bb-mono text-sm text-left" dir="ltr" required>
+                        <input type="password" name="password" placeholder="كلمة المرور الافتراضية" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
+                        <select name="role" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
+                            <option value="accountant">محاسب (Accountant) - يقدر يرفع فواتير</option>
+                            <option value="viewer">مراقب (Viewer) - فقط مشاهدة</option>
+                            <option value="admin">مسؤول نظام (Admin) - كافة الصلاحيات</option>
+                        </select>
+                        <select name="assigned_company_id" class="w-full bb-panel bg-black p-3 bb-mono text-sm">
+                            <option value="">كافة الشركات التابعة</option>
+                            ${comps.map(c => `<option value="${c.id}">${c.name}</option>`).join('')}
+                        </select>
+                        <div class="flex gap-4 pt-4">
+                            <button type="submit" class="flex-1 bb-btn bb-btn-primary font-black py-4">إضافة المستخدم</button>
+                            <button type="button" onclick="closeModal()" class="bb-btn px-10 font-black">إلغاء</button>
+                        </div>
+                    </form>
+                `);
+                document.getElementById('add-user-form').onsubmit = async (e) => {
+                    e.preventDefault();
+                    const fd = new FormData(e.target);
+                    try {
+                        await API.post('/users', Object.fromEntries(fd));
+                        showToast('تمت إضافة المستخدم بنجاح');
+                        closeModal();
+                        navigateTo('users');
+                    } catch(err) {}
+                };
+            } catch(e) {}
+        }
+
+        async function deleteUser(id) {
+            if(!confirm('تحذير: هل أنت متأكد من إلغاء صلاحية هذا المستخدم وإزالته نهائياً؟')) return;
+            try {
+                await API.delete(`/users/${id}`);
+                showToast('تمت الإزالة بنجاح');
+                navigateTo('users');
+            } catch(err) {}
+        }
+
+        async function createApiKey() {
+            showModal(`
+                <h2 class="text-xl font-black mb-8 border-b border-bb-border pb-4 uppercase">توليد مفتاح ربط جديد</h2>
+                <form id="api-key-form" class="space-y-4">
+                    <input type="text" name="name" placeholder="اسم النظام / التطبيق المستفيد" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
+                    <div class="flex gap-4 pt-4">
+                        <button type="submit" class="flex-1 bb-btn bb-btn-primary font-black py-4">إنشاء</button>
+                        <button type="button" onclick="closeModal()" class="bb-btn px-10 font-black">إلغاء</button>
+                    </div>
+                </form>
+            `);
+            document.getElementById('api-key-form').onsubmit = async (e) => {
+                e.preventDefault();
+                const fd = new FormData(e.target);
+                try {
+                    const res = await API.post('/api-keys', Object.fromEntries(fd));
+                    showModal(`
+                        <h2 class="text-xl font-black mb-8 border-b border-bb-border pb-4 uppercase text-bb-green">تم التوليد بنجاح</h2>
+                        <div class="space-y-4 bb-mono text-sm">
+                            <div class="p-4 bb-panel bg-white/5 border-bb-dim text-left" dir="ltr">
+                                <div class="text-bb-dim text-[10px] mb-1">Public Key</div>
+                                <div class="break-all font-bold text-white">${res.data.public_key}</div>
+                            </div>
+                            <div class="p-4 bb-panel bg-red-900/20 border-bb-red text-left" dir="ltr">
+                                <div class="text-bb-red text-[10px] mb-1 text-right" dir="rtl">Secret Key (تنبيه: انسخه الآن، لن يعرض مجدداً)</div>
+                                <div class="break-all font-bold text-bb-red select-all py-2">${res.data.secret}</div>
+                            </div>
+                            <button onclick="closeModal(); loadApiKeys()" class="w-full bb-btn bb-btn-primary py-4 mt-4 font-black">لقد قمت بنسخ المفتاح، إغلاق</button>
+                        </div>
+                    `);
+                } catch(err) {}
+            };
+        }
+
+        async function revokeApiKey(id) {
+            if(!confirm('سيتم تعطيل الوصول عبر هذا المفتاح فوراً. هل أنت متأكد؟')) return;
+            try {
+                await API.delete(`/api-keys/${id}`);
+                showToast('تم إلغاء المفتاح');
+                loadApiKeys();
+            } catch(err) {}
+        }
+
+        async function start2FA() {
+            try {
+                const res = await API.post('/auth/2fa/enable', {});
+                showModal(`
+                    <h2 class="text-xl font-black mb-8 border-b border-bb-border pb-4 uppercase">تفعيل التحقق الثنائي (2FA)</h2>
+                    <div class="flex flex-col items-center space-y-6">
+                        <img src="${res.data.qr_url}" alt="QR Code" class="w-48 h-48 bg-white p-2">
+                        <div class="text-[10px] text-bb-dim bb-mono text-center">امسح الكود عبر تطبيق Google Authenticator<br>أو أدخل الرمز السري يدوياً:<br><span class="text-white select-all">${res.data.secret}</span></div>
+                        
+                        <form id="verify-2fa-form" class="w-full space-y-4">
+                            <input type="hidden" name="secret" value="${res.data.secret}">
+                            <input type="text" name="code" placeholder="أدخل الرمز المكون من 6 أرقام" class="w-full bb-panel bg-black p-3 bb-mono text-center text-xl tracking-[1em]" dir="ltr" required>
+                            <button type="submit" class="w-full bb-btn bb-btn-primary font-black py-4">تأكيد التفعيل</button>
+                        </form>
+                    </div>
+                `);
+                
+                document.getElementById('verify-2fa-form').onsubmit = async (e) => {
+                    e.preventDefault();
+                    try {
+                        await API.post('/auth/2fa/verify', Object.fromEntries(new FormData(e.target)));
+                        showToast('تم تفعيل التحقق الثنائي بنجاح');
+                        closeModal();
+                        navigateTo('settings');
+                    } catch(err) {}
+                };
+            } catch(err) {}
+        }
+
+        async function disable2FA() {
+            if(!confirm('تحذير: هل أنت متأكد من رغبتك بإزالة طبقة الحماية الثنائية عن حسابك؟')) return;
+            try {
+                await API.post('/auth/2fa/disable', {});
+                showToast('تم تعطيل حماية 2FA');
+                navigateTo('settings');
+            } catch(err) {}
+        }
+
+        async function showUploadModal() {
+            try {
+                const res = await API.get('/companies');
+                const comps = res.data;
+                showModal(`
+                    <h2 class="text-xl font-black mb-8 border-b border-bb-border pb-4 uppercase tracking-tighter">رفع فاتورة جديدة للتدقيق</h2>
+                    <form id="upload-form" class="space-y-6">
+                        <div class="space-y-2">
+                            <label class="text-[10px] bb-mono text-bb-dim">الكيان التابع (الشركة المرفوع عنها)</label>
+                            <select name="company_id" class="w-full bb-panel bg-black p-3 bb-mono text-sm border-bb-dim" required>
+                                <option value="">-- اختر الشركة --</option>
+                                ${comps.map(c => `<option value="${c.id}">${c.name}</option>`).join('')}
+                            </select>
+                        </div>
+                        <div class="space-y-2">
+                            <label class="text-[10px] bb-mono text-bb-dim">مستند الفاتورة (PDF / صور)</label>
+                            <div class="bb-panel p-10 border-dashed text-center bg-white/5 border-bb-dim">
+                                <input type="file" name="file" class="bb-mono text-xs w-full cursor-pointer" required>
+                            </div>
+                        </div>
+                        <div class="flex gap-4 pt-4">
+                            <button type="submit" class="flex-1 bb-btn bb-btn-primary font-black py-4">بدء المعالجة بالذكاء الاصطناعي</button>
+                            <button type="button" onclick="closeModal()" class="bb-btn px-10 font-black">إلغاء</button>
+                        </div>
+                    </form>
+                `);
+                
+                document.getElementById('upload-form').onsubmit = async (e) => {
+                    e.preventDefault();
+                    const fd = new FormData(e.target);
+                    try {
+                        const btn = e.target.querySelector('button[type="submit"]');
+                        btn.disabled = true; btn.textContent = 'جاري الرفع والجدولة...';
+                        await API.upload('/invoices/upload', fd);
+                        showToast('تم رفع الفاتورة، سيقوم النظام بالاستخراج فوراً');
+                        closeModal();
+                        navigateTo('invoices');
+                    } catch(err) {
+                        const btn = e.target.querySelector('button[type="submit"]');
+                        btn.disabled = false; btn.textContent = 'بدء المعالجة بالذكاء الاصطناعي';
+                    }
+                };
+            } catch (e) {
+                showToast('فشل جلب الشركات لرفع الفاتورة', 'error');
+            }
+        }
+
         // ── Auth Logic ───────────────────────────────────────────
 
         async function initApp() {
@@ -633,7 +958,7 @@
             }
             try {
                 const u = (await API.get('/auth/me')).data;
-                document.getElementById('user-display').textContent = `USER: ${u.name} | ROLE: ${u.role.toUpperCase()}`;
+                document.getElementById('user-display').textContent = `المنفذ: ${u.name} | الصلاحية: ${translateRole(u.role)}`;
                 if (u.role === 'super_admin') document.getElementById('nav-admin').classList.remove('hidden');
                 navigateTo('dashboard');
             } catch(e) { renderLogin(); }
@@ -644,45 +969,49 @@
             overlay.classList.replace('hidden', 'flex');
             document.getElementById('auth-content').innerHTML = `
                 <div class="text-center mb-10">
-                    <h1 class="text-3xl font-black tracking-tighter mb-2">MUSADEQ_LOGIN</h1>
-                    <p class="text-bb-dim text-[10px] bb-mono uppercase">Secure Financial Terminal</p>
+                    <h1 class="text-3xl font-black tracking-tighter mb-2">مُصادَق للمؤسسات</h1>
+                    <p class="text-bb-dim text-[10px] bb-mono uppercase">بوابة الدخول المشفرة (TERMINAL)</p>
                 </div>
                 <form id="login-form" class="space-y-6">
-                    <input type="email" name="email" placeholder="IDENTITY@DOMAIN" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
-                    <input type="password" name="password" placeholder="PASSWORD" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
-                    <button type="submit" class="w-full bb-btn bb-btn-primary py-4 font-black">ESTABLISH_SESSION</button>
+                    <input type="email" name="email" placeholder="البريد الإلكتروني (IDENTITY)" class="w-full bb-panel bg-black p-3 bb-mono text-sm text-left" dir="ltr" required>
+                    <input type="password" name="password" placeholder="كلمة المرور (PASSWORD)" class="w-full bb-panel bg-black p-3 bb-mono text-sm text-left" dir="ltr" required>
+                    <button type="submit" class="w-full bb-btn bb-btn-primary py-4 font-black text-lg tracking-widest">تأسيس الاتصال (LOGIN)</button>
                 </form>
                 <div class="mt-8 text-center text-bb-dim text-[10px] bb-mono">
-                    NO_ACCOUNT? <a href="#" onclick="renderRegister()" class="text-white hover:underline">REGISTER_NOW</a>
+                    لا تملك صلاحية وصول؟ <a href="#" onclick="renderRegister()" class="text-white hover:underline font-bold">تسجيل كيان جديد</a>
                 </div>
             `;
             document.getElementById('login-form').onsubmit = async (e) => {
                 e.preventDefault();
                 const fd = new FormData(e.target);
                 try {
+                    const btn = e.target.querySelector('button[type="submit"]');
+                    btn.disabled = true; btn.textContent = 'جاري التحقق...';
                     const res = await API.post('/auth/login', Object.fromEntries(fd));
                     if (res.requires_2fa) render2FAChallenge(res.temp_token);
                     else saveAuth(res.data);
-                } catch(err) {}
+                } catch(err) {
+                    const btn = e.target.querySelector('button[type="submit"]');
+                    btn.disabled = false; btn.textContent = 'تأسيس الاتصال (LOGIN)';
+                }
             };
         }
 
         function render2FAChallenge(tempToken) {
             document.getElementById('auth-content').innerHTML = `
                 <div class="text-center mb-10">
-                    <h1 class="text-3xl font-black tracking-tighter mb-2">2FA_CHALLENGE</h1>
-                    <p class="text-bb-dim text-[10px] bb-mono uppercase">Enter terminal access code</p>
+                    <h1 class="text-3xl font-black tracking-tighter mb-2 text-bb-yellow">مطلوب خطوة إضافية</h1>
+                    <p class="text-bb-dim text-[10px] bb-mono uppercase">المصادقة الثنائية (2FA Challenge)</p>
                 </div>
                 <form id="2fa-form" class="space-y-6">
-                    <input type="text" name="code" placeholder="000000" class="w-full bb-panel bg-black p-3 bb-mono text-center text-xl tracking-[1em]" required autofocus>
-                    <button type="submit" class="w-full bb-btn bb-btn-primary py-4 font-black">VERIFY_IDENTITY</button>
+                    <input type="text" name="code" placeholder="000000" class="w-full bb-panel bg-black p-3 bb-mono text-center text-3xl tracking-[0.5em] text-bb-yellow font-bold" dir="ltr" required autofocus>
+                    <button type="submit" class="w-full bb-btn bb-btn-primary py-4 font-black">تحقق ودخول</button>
                 </form>
             `;
             document.getElementById('2fa-form').onsubmit = async (e) => {
                 e.preventDefault();
                 const code = new FormData(e.target).get('code');
                 try {
-                    // Note: We use the temp token in the header
                     const res = await fetch('index.php?route=/api/v1/auth/2fa/verify_login', {
                         method: 'POST',
                         headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${tempToken}` },
@@ -690,34 +1019,39 @@
                     });
                     const data = await res.json();
                     if (res.ok) saveAuth(data.data);
-                    else showToast(data.error?.message_ar || 'INVALID_CODE', 'error');
-                } catch(err) {}
+                    else showToast(data.error?.message_ar || 'رمز غير صحيح', 'error');
+                } catch(err) { showToast('حدث خطأ في الاتصال', 'error'); }
             };
         }
 
         function renderRegister() {
             document.getElementById('auth-content').innerHTML = `
                 <div class="text-center mb-10">
-                    <h1 class="text-3xl font-black tracking-tighter mb-2">NEW_TERMINAL</h1>
-                    <p class="text-bb-dim text-[10px] bb-mono uppercase">Register Platform Account</p>
+                    <h1 class="text-3xl font-black tracking-tighter mb-2">تأسيس مساحة عمل</h1>
+                    <p class="text-bb-dim text-[10px] bb-mono uppercase">مستأجر جديد (New Tenant)</p>
                 </div>
                 <form id="register-form" class="space-y-4">
-                    <input type="text" name="name" placeholder="FULL_NAME" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
-                    <input type="email" name="email" placeholder="EMAIL_IDENTITY" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
-                    <input type="password" name="password" placeholder="PASSWORD" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
-                    <button type="submit" class="w-full bb-btn bb-btn-primary py-4 font-black">INITIALIZE_ACCOUNT</button>
+                    <input type="text" name="name" placeholder="اسمك الكامل" class="w-full bb-panel bg-black p-3 bb-mono text-sm" required>
+                    <input type="email" name="email" placeholder="البريد الإلكتروني" class="w-full bb-panel bg-black p-3 bb-mono text-sm text-left" dir="ltr" required>
+                    <input type="password" name="password" placeholder="كلمة المرور القوية" class="w-full bb-panel bg-black p-3 bb-mono text-sm text-left" dir="ltr" required>
+                    <button type="submit" class="w-full bb-btn bb-btn-primary py-4 font-black tracking-widest mt-4">إنشاء وبدء الاستخدام</button>
                 </form>
                 <div class="mt-8 text-center text-bb-dim text-[10px] bb-mono">
-                    ALREADY_HAVE_ACCESS? <a href="#" onclick="renderLogin()" class="text-white hover:underline">LOGIN_TERMINAL</a>
+                    لديك مساحة عمل مسبقاً؟ <a href="#" onclick="renderLogin()" class="text-white hover:underline font-bold">العودة لتسجيل الدخول</a>
                 </div>
             `;
             document.getElementById('register-form').onsubmit = async (e) => {
                 e.preventDefault();
                 const fd = new FormData(e.target);
                 try {
+                    const btn = e.target.querySelector('button[type="submit"]');
+                    btn.disabled = true; btn.textContent = 'جاري التأسيس...';
                     const res = await API.post('/auth/register', Object.fromEntries(fd));
                     saveAuth(res.data);
-                } catch(err) {}
+                } catch(err) {
+                    const btn = e.target.querySelector('button[type="submit"]');
+                    btn.disabled = false; btn.textContent = 'إنشاء وبدء الاستخدام';
+                }
             };
         }
 
diff --git a/scratch.js b/scratch.js
deleted file mode 100644
index 7eba491..0000000
--- a/scratch.js
+++ /dev/null
@@ -1,37 +0,0 @@
-const appRouter = () => ({
-    isLoggedIn: !!localStorage.getItem('access_token'),
-    pageHtml: 'جاري التحميل...',
-    async init() {
-        console.log('App Initialized');
-        await this.navigate(window.location.pathname);
-        window.onpopstate = () => this.navigate(window.location.pathname);
-    },
-    async navigate(path) {
-        console.log('Navigating to:', path);
-        const isLogin = path.includes('login');
-        
-        if (!this.isLoggedIn && !isLogin) {
-            this.pageHtml = await this.loadPage('login');
-        } else if (isLogin) {
-            this.pageHtml = await this.loadPage('login');
-        } else {
-            this.pageHtml = await this.loadPage('dashboard');
-        }
-    },
-    initCharts() {
-        const ctx = document.getElementById('invoiceChart')?.getContext('2d');
-    },
-    async loadPage(page) {
-        if (page === 'dashboard') {
-            return `<div></div>`;
-        }
-        if (page === 'login') return `
-            <div class="flex flex-col items-center justify-center min-h-[60vh]">
-                <div class="w-full max-w-md p-8 glass rounded-3xl glow border-white/10">
-                    <h2 class="text-3xl font-bold mb-2 text-center">مرحباً بك مجدداً</h2>
-                </div>
-            </div>
-        `;
-        return '<div>الصفحة قيد الإنشاء</div>';
-    }
-});