tweak

Implement tiers end to end

.gitea/workflows/check.yml

@@ -1,9 +0,0 @@
-name: check
-on: [push]
-jobs:
-    check:
-        runs-on: ubuntu-latest
-        steps:
-            # actions/checkout v4.2.2, 2026-02-22
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: docker build .

.gitignore

@@ -21,7 +21,9 @@ node_modules/
 *.key
 
 # Go build artifacts
-backend-go/bin/
+backend/bin/
+backend/api
+backend/poller
 *.exe
 *.exe~
 *.dll

.prettierignore

@@ -1,7 +1,7 @@
 node_modules/
 frontend/dist/
 frontend/build/
-backend-go/bin/
+backend/bin/
 *.lock
 Prompts/
 .claude/

LICENSE

@@ -2,8 +2,7 @@ MIT License
 
 Copyright (c) 2026 Steven Jannette
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is

Makefile

@@ -2,7 +2,7 @@
         test-go test-js lint-go lint-js fmt-go fmt-js fmt-check-go fmt-check-js \
         build-go build-js
 
-GODIR    := backend-go
+GODIR    := backend
 JSDIR    := frontend
 PRETTIER := $(JSDIR)/node_modules/.bin/prettier
 

README.md

@@ -28,8 +28,8 @@ make hooks
 cd frontend && npm install && cd ..
 
 # Copy and fill in environment variables
-cp backend-go/.env.example backend-go/.env
-# edit backend-go/.env with your DATABASE_URL, FIREBASE_PROJECT_ID, ETH_RPC_URL
+cp backend/.env.example backend/.env
+# edit backend/.env with your DATABASE_URL, FIREBASE_PROJECT_ID, ETH_RPC_URL
 
 # Run checks (requires golangci-lint)
 make check
@@ -38,7 +38,7 @@ make check
 make run
 
 # Start the poller (separate terminal)
-cd backend-go && go run ./cmd/poller
+cd backend && go run ./cmd/poller
 
 # Start the frontend dev server (separate terminal)
 cd frontend && npm run dev
@@ -63,7 +63,7 @@ frontend:
 
 ```
 koin_ping_0.2.0/
-├── backend-go/                # Go monorepo root
+├── backend/                # Go monorepo root
 │   ├── cmd/api/               # HTTP REST API server
 │   ├── cmd/poller/            # Blockchain polling daemon
 │   └── internal/

REPO_POLICIES.md

@@ -1,188 +0,0 @@
----
-title: Repository Policies
-last_modified: 2026-02-22
----
-
-This document covers repository structure, tooling, and workflow standards. Code
-style conventions are in separate documents:
-
-- [Code Styleguide](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE.md)
-  (general, bash, Docker)
-- [Go](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_GO.md)
-- [JavaScript](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_JS.md)
-- [Python](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_PYTHON.md)
-- [Go HTTP Server Conventions](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/GO_HTTP_SERVER_CONVENTIONS.md)
-
----
-
-- Cross-project documentation (such as this file) must include
-  `last_modified: YYYY-MM-DD` in the YAML front matter so it can be kept in sync
-  with the authoritative source as policies evolve.
-
-- **ALL external references must be pinned by cryptographic hash.** This
-  includes Docker base images, Go modules, npm packages, GitHub Actions, and
-  anything else fetched from a remote source. Version tags (`@v4`, `@latest`,
-  `:3.21`, etc.) are server-mutable and therefore remote code execution
-  vulnerabilities. The ONLY acceptable way to reference an external dependency
-  is by its content hash (Docker `@sha256:...`, Go module hash in `go.sum`, npm
-  integrity hash in lockfile, GitHub Actions `@<commit-sha>`). No exceptions.
-  This also means never `curl | bash` to install tools like pyenv, nvm, rustup,
-  etc. Instead, download a specific release archive from GitHub, verify its hash
-  (hardcoded in the Dockerfile or script), and only then install. Unverified
-  install scripts are arbitrary remote code execution. This is the single most
-  important rule in this document. Double-check every external reference in
-  every file before committing. There are zero exceptions to this rule.
-
-- Every repo with software must have a root `Makefile` with these targets:
-  `make test`, `make lint`, `make fmt` (writes), `make fmt-check` (read-only),
-  `make check` (prereqs: `test`, `lint`, `fmt-check`), `make docker`, and
-  `make hooks` (installs pre-commit hook). A model Makefile is at
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
-
-- Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
-  instead of invoking the underlying tools directly. The Makefile is the single
-  source of truth for how these operations are run.
-
-- The Makefile is authoritative documentation for how the repo is used. Beyond
-  the required targets above, it should have targets for every common operation:
-  running a local development server (`make run`, `make dev`), re-initializing
-  or migrating the database (`make db-reset`, `make migrate`), building
-  artifacts (`make build`), generating code, seeding data, or anything else a
-  developer would do regularly. If someone checks out the repo and types
-  `make<tab>`, they should see every meaningful operation available. A new
-  contributor should be able to understand the entire development workflow by
-  reading the Makefile.
-
-- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  as a build step so the build fails if the branch is not green. For non-server
-  repos, the Dockerfile should bring up a development environment and run
-  `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled.
-
-- Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `docker build .` on push. Since the Dockerfile already runs `make check`,
-  a successful build implies all checks pass.
-
-- Use platform-standard formatters: `black` for Python, `prettier` for
-  JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
-  two exceptions: four-space indents (except Go), and `proseWrap: always` for
-  Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
-  HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
-
-- Pre-commit hook: `make check` if local testing is possible, otherwise
-  `make lint && make fmt-check`. The Makefile should provide a `make hooks`
-  target to install the pre-commit hook.
-
-- All repos with software must have tests that run via the platform-standard
-  test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
-  tests exist yet, add the most minimal test possible — e.g. importing the
-  module under test to verify it compiles/parses. There is no excuse for
-  `make test` to be a no-op.
-
-- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
-  Makefile.
-
-- Docker builds must complete in under 5 minutes.
-
-- `make check` must not modify any files in the repo. Tests may use temporary
-  directories.
-
-- `main` must always pass `make check`, no exceptions.
-
-- Never commit secrets. `.env` files, credentials, API keys, and private keys
-  must be in `.gitignore`. No exceptions.
-
-- `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  Fetch the standard `.gitignore` from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  a new repo.
-
-- Never use `git add -A` or `git add .`. Always stage files explicitly by name.
-
-- Never force-push to `main`.
-
-- Make all changes on a feature branch. You can do whatever you want on a
-  feature branch.
-
-- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
-
-- When pinning images or packages by hash, add a comment above the reference
-  with the version and date (YYYY-MM-DD).
-
-- Use `yarn`, not `npm`.
-
-- Write all dates as YYYY-MM-DD (ISO 8601).
-
-- Simple projects should be configured with environment variables.
-
-- Dockerized web services listen on port 8080 by default, overridable with
-  `PORT`.
-
-- `README.md` is the primary documentation. Required sections:
-    - **Description**: First line must include the project name, purpose,
-      category (web server, SPA, CLI tool, etc.), license, and author. Example:
-      "µPaaS is an MIT-licensed Go web application by @sneak that receives
-      git-frontend webhooks and deploys applications via Docker in realtime."
-    - **Getting Started**: Copy-pasteable install/usage code block.
-    - **Rationale**: Why does this exist?
-    - **Design**: How is the program structured?
-    - **TODO**: Update meticulously, even between commits. When planning, put
-      the todo list in the README so a new agent can pick up where the last one
-      left off.
-    - **License**: MIT, GPL, or WTFPL. Ask the user for new projects. Include a
-      `LICENSE` file in the repo root and a License section in the README.
-    - **Author**: [@sneak](https://sneak.berlin).
-
-- First commit of a new repo should contain only `README.md`.
-
-- Go module root: `sneak.berlin/go/<name>`. Always run `go mod tidy` before
-  committing.
-
-- Use SemVer.
-
-- Database migrations live in `internal/db/migrations/` and must be embedded in
-  the binary.
-    - `000_migration.sql` — contains ONLY the creation of the migrations
-      tracking table itself. Nothing else.
-    - `001_schema.sql` — the full application schema.
-    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
-      There is no installed base to migrate. Edit `001_schema.sql` directly.
-    - **Post-1.0.0:** add new numbered migration files for each schema change.
-      Never edit existing migrations after release.
-
-- All repos should have an `.editorconfig` enforcing the project's indentation
-  settings.
-
-- Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
-  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
-  language-specific config). Everything else goes in a subdirectory. Canonical
-  subdirectory names:
-    - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints
-    - `configs/` — configuration templates and examples
-    - `deploy/` — deployment manifests (k8s, compose, terraform)
-    - `docs/` — documentation and markdown (README.md stays in root)
-    - `internal/` — Go internal packages
-    - `internal/db/migrations/` — database migrations
-    - `pkg/` — Go library packages
-    - `share/` — systemd units, data files
-    - `static/` — static assets (images, fonts, etc.)
-    - `web/` — web frontend source
-
-- When setting up a new repo, files from the `prompts` repo may be used as
-  templates. Fetch them from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/<path>`.
-
-- New repos must contain at minimum:
-    - `README.md`, `.git`, `.gitignore`, `.editorconfig`
-    - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
-    - `Makefile`
-    - `Dockerfile`, `.dockerignore`
-    - `.gitea/workflows/check.yml`
-    - Go: `go.mod`, `go.sum`, `.golangci.yml`
-    - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
-    - Python: `pyproject.toml`

backend-go/.env.example

@@ -1,20 +0,0 @@
-# Server
-PORT=3001
-API_BASE_PATH=/v1
-NODE_ENV=development
-
-# Database
-DATABASE_URL=postgresql://user:password@localhost:5432/koin_ping
-
-# Ethereum JSON-RPC
-ETH_RPC_URL=https://mainnet.infura.io/v3/YOUR-PROJECT-ID
-
-# Polling interval (ms, minimum 1000)
-POLL_INTERVAL_MS=60000
-
-# Firebase
-FIREBASE_PROJECT_ID=koin-ping
-
-# Email notifications (Resend — https://resend.com)
-# RESEND_API_KEY=re_xxxxxxxxxxxx
-# EMAIL_FROM=Koin Ping <alerts@yourdomain.com>

backend-go/README.md

@@ -1,15 +0,0 @@
-Start DB:
-
-brew services start postgresql@15
-
-
-From the backend-go directory, you have a few options:
-
-Option 1: Single command (both API + poller)
-cd /Users/kjannette/workspace/koin_ping_0.2.0/backend-gomake dev-all
-
-Option 2: Two separate terminals
-Terminal 1 (API server):
-cd /Users/kjannette/workspace/koin_ping_0.2.0/backend-gogo run ./cmd/api
-Terminal 2 (Poller):
-cd /Users/kjannette/workspace/koin_ping_0.2.0/backend-gogo run ./cmd/poller

backend-go/cmd/api/main.go

@@ -1,143 +0,0 @@
-// Package main is the entry point for the API server.
-package main
-
-import (
-	"fmt"
-	"log"
-	"net/http"
-	"time"
-
-	"github.com/joho/godotenv"
-	"github.com/kjannette/koin-ping/backend-go/internal/config"
-	"github.com/kjannette/koin-ping/backend-go/internal/database"
-	"github.com/kjannette/koin-ping/backend-go/internal/firebase"
-	"github.com/kjannette/koin-ping/backend-go/internal/handlers"
-	"github.com/kjannette/koin-ping/backend-go/internal/middleware"
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
-	"github.com/kjannette/koin-ping/backend-go/internal/services"
-)
-
-const (
-	// max duration to read a request.
-	serverReadTimeoutSeconds = 5
-	// maxiduration to write a response.
-	serverWriteTimeoutSeconds = 10
-)
-
-//nolint:funlen
-func main() {
-	_ = godotenv.Load() // .env is optional; env vars can also be set externally
-
-	cfg, err := config.Load()
-	if err != nil {
-		log.Fatalf("Failed to load config: %v", err)
-	}
-
-	pool, err := database.Connect(cfg.DSN())
-	if err != nil {
-		log.Fatalf("Failed to connect to database: %v", err)
-	}
-
-	if err := firebase.Init(cfg.FirebaseProjectID); err != nil {
-		log.Fatalf("Failed to initialize Firebase: %v", err)
-	}
-
-	defer database.Close()
-
-	addressModel := models.NewAddressModel(pool)
-	alertRuleModel := models.NewAlertRuleModel(pool)
-	alertEventModel := models.NewAlertEventModel(pool)
-	checkpointModel := models.NewCheckpointModel(pool)
-	notifConfigModel := models.NewNotificationConfigModel(pool)
-
-	emailDigestSvc := services.NewEmailDigestService(
-		cfg.ResendAPIKey, cfg.EmailFrom, alertEventModel, notifConfigModel,
-	)
-
-	addressHandler := handlers.NewAddressHandler(addressModel)
-	alertRuleHandler := handlers.NewAlertRuleHandler(alertRuleModel, addressModel)
-	alertEventHandler := handlers.NewAlertEventHandler(alertEventModel)
-	notifConfigHandler := handlers.NewNotificationConfigHandler(notifConfigModel, cfg)
-	emailDigestHandler := handlers.NewEmailDigestHandler(emailDigestSvc, notifConfigModel)
-	statusHandler := handlers.NewStatusHandler(checkpointModel)
-
-	mux := http.NewServeMux()
-	b := cfg.APIBasePath // e.g. "/v1"
-
-	// Public routes
-	mux.HandleFunc("GET "+b+"/health", handlers.HealthCheck)
-	mux.HandleFunc("GET "+b+"/status", statusHandler.GetStatus)
-
-	// Authenticated routes — addresses
-	mux.Handle("POST "+b+"/addresses",
-		middleware.Authenticate(http.HandlerFunc(addressHandler.Create)))
-	mux.Handle("GET "+b+"/addresses",
-		middleware.Authenticate(http.HandlerFunc(addressHandler.List)))
-	mux.Handle("DELETE "+b+"/addresses/{addressId}",
-		middleware.Authenticate(http.HandlerFunc(addressHandler.Remove)))
-	mux.Handle("PATCH "+b+"/addresses/{addressId}",
-		middleware.Authenticate(http.HandlerFunc(addressHandler.UpdateLabel)))
-
-	// Authenticated routes for alert rules
-	mux.Handle("POST "+b+"/addresses/{addressId}/alerts",
-		middleware.Authenticate(http.HandlerFunc(alertRuleHandler.Create)))
-	mux.Handle("GET "+b+"/addresses/{addressId}/alerts",
-		middleware.Authenticate(http.HandlerFunc(alertRuleHandler.ListByAddress)))
-	mux.Handle("PATCH "+b+"/alerts/{alertId}",
-		middleware.Authenticate(http.HandlerFunc(alertRuleHandler.UpdateStatus)))
-	mux.Handle("DELETE "+b+"/alerts/{alertId}",
-		middleware.Authenticate(http.HandlerFunc(alertRuleHandler.Remove)))
-
-	// Authenticated routes — alert events
-	mux.Handle("GET "+b+"/alert-events",
-		middleware.Authenticate(http.HandlerFunc(alertEventHandler.List)))
-
-	// Authenticated routes — notification config
-	mux.Handle("GET "+b+"/notification-config",
-		middleware.Authenticate(http.HandlerFunc(notifConfigHandler.GetConfig)))
-	mux.Handle("PUT "+b+"/notification-config",
-		middleware.Authenticate(http.HandlerFunc(notifConfigHandler.UpdateConfig)))
-	mux.Handle("DELETE "+b+"/notification-config",
-		middleware.Authenticate(http.HandlerFunc(notifConfigHandler.DeleteConfig)))
-	mux.Handle("POST "+b+"/notification-config/test",
-		middleware.Authenticate(http.HandlerFunc(notifConfigHandler.TestChannels)))
-
-	// Authenticated routes — email digest
-	mux.Handle("POST "+b+"/email/setup",
-		middleware.Authenticate(http.HandlerFunc(emailDigestHandler.SetupEmail)))
-	mux.Handle("POST "+b+"/email/digest",
-		middleware.Authenticate(http.HandlerFunc(emailDigestHandler.SendDigest)))
-
-	handler := corsMiddleware(mux)
-
-	addr := fmt.Sprintf(":%d", cfg.Port)
-	log.Printf("Server running on port %d", cfg.Port)
-	log.Printf("API base path: %s", cfg.APIBasePath)
-	log.Printf("Environment: %s", cfg.NodeEnv)
-
-	server := &http.Server{
-		Addr:         addr,
-		Handler:      handler,
-		ReadTimeout:  serverReadTimeoutSeconds * time.Second,
-		WriteTimeout: serverWriteTimeoutSeconds * time.Second,
-	}
-	if err := server.ListenAndServe(); err != nil {
-		log.Fatalf("Server failed: %v", err)
-	}
-}
-
-func corsMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Access-Control-Allow-Origin", "*")
-		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
-		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
-
-		if r.Method == http.MethodOptions {
-			w.WriteHeader(http.StatusNoContent)
-
-			return
-		}
-
-		next.ServeHTTP(w, r)
-	})
-}

backend-go/internal/middleware/auth.go

@@ -1,99 +0,0 @@
-// Package middleware provides HTTP middleware for authentication and context injection.
-package middleware
-
-import (
-	"context"
-	"encoding/json"
-	"log"
-	"net/http"
-	"strings"
-
-	fbauth "github.com/kjannette/koin-ping/backend-go/internal/firebase"
-)
-
-type contextKey string
-
-const (
-	UserIDKey    contextKey = "user_id"
-	UserEmailKey contextKey = "user_email"
-)
-
-type errorResponse struct {
-	Error   string `json:"error"`
-	Message string `json:"message"`
-}
-
-func writeJSON(w http.ResponseWriter, status int, v interface{}) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(status)
-	json.NewEncoder(w).Encode(v)
-}
-
-func Authenticate(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		authHeader := r.Header.Get("Authorization")
-		if authHeader == "" || !strings.HasPrefix(authHeader, "Bearer ") {
-			log.Println("No Authorization header or invalid format")
-			writeJSON(w, http.StatusUnauthorized, errorResponse{
-				Error:   "UNAUTHORIZED",
-				Message: "No authentication token provided",
-			})
-			return
-		}
-
-		token := strings.TrimPrefix(authHeader, "Bearer ")
-		if token == "" {
-			log.Println("Empty token")
-			writeJSON(w, http.StatusUnauthorized, errorResponse{
-				Error:   "UNAUTHORIZED",
-				Message: "Invalid token format",
-			})
-			return
-		}
-
-		log.Println("Verifying Firebase token...")
-		decoded, err := fbauth.Auth().VerifyIDToken(r.Context(), token)
-		if err != nil {
-			log.Printf("Token verification failed: %v", err)
-
-			errMsg := err.Error()
-			if strings.Contains(errMsg, "expired") {
-				writeJSON(w, http.StatusUnauthorized, errorResponse{
-					Error:   "TOKEN_EXPIRED",
-					Message: "Authentication token has expired",
-				})
-				return
-			}
-
-			writeJSON(w, http.StatusUnauthorized, errorResponse{
-				Error:   "UNAUTHORIZED",
-				Message: "Failed to verify authentication token",
-			})
-			return
-		}
-
-		userID := decoded.UID
-		email, _ := decoded.Claims["email"].(string)
-
-		log.Printf("Token verified! User ID: %s, Email: %s", userID, email)
-
-		ctx := context.WithValue(r.Context(), UserIDKey, userID)
-		ctx = context.WithValue(ctx, UserEmailKey, email)
-
-		next.ServeHTTP(w, r.WithContext(ctx))
-	})
-}
-
-func GetUserID(ctx context.Context) string {
-	if v, ok := ctx.Value(UserIDKey).(string); ok {
-		return v
-	}
-	return ""
-}
-
-func GetUserEmail(ctx context.Context) string {
-	if v, ok := ctx.Value(UserEmailKey).(string); ok {
-		return v
-	}
-	return ""
-}

backend-go/internal/models/alert_rule.go

@@ -1,115 +0,0 @@
-package models
-
-import (
-	"context"
-	"errors"
-
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
-)
-
-type AlertRuleModel struct {
-	pool *pgxpool.Pool
-}
-
-func NewAlertRuleModel(pool *pgxpool.Pool) *AlertRuleModel {
-	return &AlertRuleModel{pool: pool}
-}
-
-func (m *AlertRuleModel) Create(ctx context.Context, addressID int, alertType domain.AlertType, threshold *float64) (*domain.AlertRule, error) {
-	var r domain.AlertRule
-	err := m.pool.QueryRow(ctx,
-		`INSERT INTO alert_rules (address_id, type, threshold, enabled)
-		 VALUES ($1, $2, $3, TRUE)
-		 RETURNING id, address_id, type, threshold, enabled, created_at`,
-		addressID, alertType.String(), threshold,
-	).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Enabled, &r.CreatedAt)
-	if err != nil {
-		return nil, err
-	}
-	return &r, nil
-}
-
-func (m *AlertRuleModel) ListByAddress(ctx context.Context, addressID int) ([]domain.AlertRule, error) {
-	rows, err := m.pool.Query(ctx,
-		`SELECT id, address_id, type, threshold, enabled, created_at
-		 FROM alert_rules
-		 WHERE address_id = $1
-		 ORDER BY created_at DESC`,
-		addressID,
-	)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-
-	var rules []domain.AlertRule
-	for rows.Next() {
-		var r domain.AlertRule
-		if err := rows.Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Enabled, &r.CreatedAt); err != nil {
-			return nil, err
-		}
-		rules = append(rules, r)
-	}
-	return rules, rows.Err()
-}
-
-func (m *AlertRuleModel) FindByID(ctx context.Context, id int, userID *string) (*domain.AlertRule, error) {
-	var r domain.AlertRule
-	var err error
-
-	if userID != nil {
-		err = m.pool.QueryRow(ctx,
-			`SELECT ar.id, ar.address_id, ar.type, ar.threshold, ar.enabled, ar.created_at
-			 FROM alert_rules ar
-			 JOIN addresses a ON a.id = ar.address_id
-			 WHERE ar.id = $1 AND a.user_id = $2`,
-			id, *userID,
-		).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Enabled, &r.CreatedAt)
-	} else {
-		err = m.pool.QueryRow(ctx,
-			`SELECT id, address_id, type, threshold, enabled, created_at
-			 FROM alert_rules
-			 WHERE id = $1`,
-			id,
-		).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Enabled, &r.CreatedAt)
-	}
-
-	if err != nil {
-		if errors.Is(err, pgx.ErrNoRows) {
-			return nil, nil
-		}
-		return nil, err
-	}
-	return &r, nil
-}
-
-func (m *AlertRuleModel) UpdateEnabled(ctx context.Context, id int, enabled bool) (*domain.AlertRule, error) {
-	var r domain.AlertRule
-	err := m.pool.QueryRow(ctx,
-		`UPDATE alert_rules
-		 SET enabled = $2
-		 WHERE id = $1
-		 RETURNING id, address_id, type, threshold, enabled, created_at`,
-		id, enabled,
-	).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Enabled, &r.CreatedAt)
-	if err != nil {
-		if errors.Is(err, pgx.ErrNoRows) {
-			return nil, nil
-		}
-		return nil, err
-	}
-	return &r, nil
-}
-
-func (m *AlertRuleModel) Remove(ctx context.Context, id int) (bool, error) {
-	tag, err := m.pool.Exec(ctx,
-		`DELETE FROM alert_rules WHERE id = $1`,
-		id,
-	)
-	if err != nil {
-		return false, err
-	}
-	return tag.RowsAffected() > 0, nil
-}

backend-go/internal/notifications/notifier.go

@@ -1,16 +0,0 @@
-package notifications
-
-import "context"
-
-// AlertMetadata holds context about the alert being sent.
-type AlertMetadata struct {
-	TxHash       string
-	AddressLabel string
-	AlertType    string
-	Address      string
-}
-
-// Notifier is the interface implemented by all notification channels.
-type Notifier interface {
-	Send(ctx context.Context, message string, meta AlertMetadata) error
-}

backend/Makefile

@@ -37,7 +37,7 @@ tidy:
 
 # Database setup
 db-setup:
-	psql -d koin_ping_dev -f infra/schema.sql
+	psql -d koin_ping -f infra/schema.sql
 
 vet:
 	go vet ./...

backend/README.md

@@ -0,0 +1,33 @@
+Backend startup quickstart:
+
+----------------------------->  BEST
+## 1. brew services start postgresql@15
+
+          OR 
+
+      /opt/homebrew/opt/postgresql@15/bin/pg_ctl -D /opt/homebrew/var/postgresql@15 start
+
+## 2.   ALLIN ONE: 
+        Make dev-all — Runs both the API and poller concurrently.
+----------------------------->  BEST
+
+          - OR - 
+          
+           
+## 3.  Option 1: Single command (both API + poller)
+       cd /Users/kjannette/workspace/koin_ping_0.2.0/backendmake dev-all
+
+## 4.   Option 2: Two separate terminals
+        Terminal 1 (API server):
+        cd /Users/kjannette/workspace/koin_ping_0.2.0/backend go run ./cmd/api
+        
+        make run — Builds and runs the API server.
+        make dev — Runs the API server with auto-reload via air (falls back to go run if air isn't installed).
+
+## 5.   Terminal 2 (Poller):
+        cd /Users/kjannette/workspace/koin_ping_0.2.0/backend 
+        go run ./cmd/poller
+
+        make poller — Builds and runs the poller.
+        make poller-dev — Runs the poller with auto-reload.
+

backend/cmd/api/main.go

@@ -0,0 +1,176 @@
+// Package main is the entry point for the API server.
+package main
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/joho/godotenv"
+	"github.com/kjannette/koin-ping/backend/internal/config"
+	"github.com/kjannette/koin-ping/backend/internal/database"
+	"github.com/kjannette/koin-ping/backend/internal/handlers"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/services"
+)
+
+const (
+	// max duration to read a request.
+	serverReadTimeoutSeconds = 5
+	// maxiduration to write a response.
+	serverWriteTimeoutSeconds = 10
+)
+
+//nolint:funlen
+func main() {
+	_ = godotenv.Load() // .env is optional; env vars can also be set externally
+
+	cfg, err := config.Load()
+	if err != nil {
+		log.Fatalf("Failed to load config: %v", err)
+	}
+
+	pool, err := database.Connect(cfg.DSN())
+	if err != nil {
+		log.Fatalf("Failed to connect to database: %v", err)
+	}
+
+	defer database.Close()
+
+	userModel := models.NewUserModel(pool)
+	addressModel := models.NewAddressModel(pool)
+	alertRuleModel := models.NewAlertRuleModel(pool)
+	alertEventModel := models.NewAlertEventModel(pool)
+	checkpointModel := models.NewCheckpointModel(pool)
+	notifConfigModel := models.NewNotificationConfigModel(pool)
+
+	emailDigestSvc := services.NewEmailDigestService(
+		cfg.ResendAPIKey, cfg.EmailFrom, alertEventModel, notifConfigModel,
+	)
+
+	addressHandler := handlers.NewAddressHandler(addressModel, userModel)
+	alertRuleHandler := handlers.NewAlertRuleHandler(alertRuleModel, addressModel, userModel)
+	alertEventHandler := handlers.NewAlertEventHandler(alertEventModel)
+	notifConfigHandler := handlers.NewNotificationConfigHandler(notifConfigModel, userModel, cfg)
+	emailDigestHandler := handlers.NewEmailDigestHandler(emailDigestSvc, notifConfigModel)
+	statusHandler := handlers.NewStatusHandler(checkpointModel)
+	stripeHandler := handlers.NewStripeHandler(userModel, cfg)
+	accountHandler := handlers.NewAccountHandler(userModel, addressModel, cfg)
+	authHandler := handlers.NewAuthHandler(userModel, cfg)
+
+	authenticate := middleware.Authenticate(userModel, cfg.JWTSecret)
+	requireSub := middleware.RequireSubscription(userModel)
+
+	// authAndSub chains authentication + subscription check for protected routes.
+	authAndSub := func(h http.Handler) http.Handler {
+		return authenticate(requireSub(h))
+	}
+
+	mux := http.NewServeMux()
+	b := cfg.APIBasePath // e.g. "/v1"
+
+	// Public routes
+	mux.HandleFunc("GET "+b+"/health", handlers.HealthCheck)
+	mux.HandleFunc("GET "+b+"/status", statusHandler.GetStatus)
+
+	// Auth routes (public — no token required)
+	mux.HandleFunc("POST "+b+"/auth/login", authHandler.Login)
+	mux.HandleFunc("POST "+b+"/auth/register", authHandler.RegisterAfterCheckout)
+
+	// Stripe webhook (public — called by Stripe, not authenticated)
+	mux.HandleFunc("POST "+b+"/stripe/webhook", stripeHandler.HandleWebhook)
+
+	// Onboarding checkout (public — account doesn't exist yet)
+	mux.HandleFunc("POST "+b+"/stripe/create-onboarding-checkout", stripeHandler.CreateOnboardingCheckout)
+
+	// Stripe routes (auth required, NO subscription required)
+	mux.Handle("POST "+b+"/stripe/create-checkout-session",
+		authenticate(http.HandlerFunc(stripeHandler.CreateCheckoutSession)))
+	mux.Handle("GET "+b+"/stripe/subscription-status",
+		authenticate(http.HandlerFunc(stripeHandler.GetSubscriptionStatus)))
+	mux.Handle("POST "+b+"/stripe/verify-checkout",
+		authenticate(http.HandlerFunc(stripeHandler.VerifyCheckoutSession)))
+	mux.Handle("POST "+b+"/stripe/create-portal-session",
+		authenticate(http.HandlerFunc(stripeHandler.CreatePortalSession)))
+	mux.Handle("POST "+b+"/stripe/activate-free",
+		authenticate(http.HandlerFunc(stripeHandler.ActivateFreeTier)))
+
+	// Account route (auth required, NO subscription required)
+	mux.Handle("GET "+b+"/user/account",
+		authenticate(http.HandlerFunc(accountHandler.GetAccount)))
+
+	// Authenticated + subscribed routes — addresses
+	mux.Handle("POST "+b+"/addresses",
+		authAndSub(http.HandlerFunc(addressHandler.Create)))
+	mux.Handle("GET "+b+"/addresses",
+		authAndSub(http.HandlerFunc(addressHandler.List)))
+	mux.Handle("DELETE "+b+"/addresses/{addressId}",
+		authAndSub(http.HandlerFunc(addressHandler.Remove)))
+	mux.Handle("PATCH "+b+"/addresses/{addressId}",
+		authAndSub(http.HandlerFunc(addressHandler.UpdateLabel)))
+
+	// Authenticated + subscribed routes — alert rules
+	mux.Handle("POST "+b+"/addresses/{addressId}/alerts",
+		authAndSub(http.HandlerFunc(alertRuleHandler.Create)))
+	mux.Handle("GET "+b+"/addresses/{addressId}/alerts",
+		authAndSub(http.HandlerFunc(alertRuleHandler.ListByAddress)))
+	mux.Handle("PATCH "+b+"/alerts/{alertId}",
+		authAndSub(http.HandlerFunc(alertRuleHandler.UpdateStatus)))
+	mux.Handle("DELETE "+b+"/alerts/{alertId}",
+		authAndSub(http.HandlerFunc(alertRuleHandler.Remove)))
+
+	// Authenticated + subscribed routes — alert events
+	mux.Handle("GET "+b+"/alert-events",
+		authAndSub(http.HandlerFunc(alertEventHandler.List)))
+
+	// Authenticated + subscribed routes — notification config
+	mux.Handle("GET "+b+"/notification-config",
+		authAndSub(http.HandlerFunc(notifConfigHandler.GetConfig)))
+	mux.Handle("PUT "+b+"/notification-config",
+		authAndSub(http.HandlerFunc(notifConfigHandler.UpdateConfig)))
+	mux.Handle("DELETE "+b+"/notification-config",
+		authAndSub(http.HandlerFunc(notifConfigHandler.DeleteConfig)))
+	mux.Handle("POST "+b+"/notification-config/test",
+		authAndSub(http.HandlerFunc(notifConfigHandler.TestChannels)))
+
+	// Authenticated + subscribed routes — email digest
+	mux.Handle("POST "+b+"/email/setup",
+		authAndSub(http.HandlerFunc(emailDigestHandler.SetupEmail)))
+	mux.Handle("POST "+b+"/email/digest",
+		authAndSub(http.HandlerFunc(emailDigestHandler.SendDigest)))
+
+	handler := corsMiddleware(mux)
+
+	addr := fmt.Sprintf(":%d", cfg.Port)
+	log.Printf("Server running on port %d", cfg.Port)
+	log.Printf("API base path: %s", cfg.APIBasePath)
+	log.Printf("Environment: %s", cfg.NodeEnv)
+
+	server := &http.Server{
+		Addr:         addr,
+		Handler:      handler,
+		ReadTimeout:  serverReadTimeoutSeconds * time.Second,
+		WriteTimeout: serverWriteTimeoutSeconds * time.Second,
+	}
+	if err := server.ListenAndServe(); err != nil {
+		log.Fatalf("Server failed: %v", err)
+	}
+}
+
+func corsMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
+
+		if r.Method == http.MethodOptions {
+			w.WriteHeader(http.StatusNoContent)
+
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}

backend/cmd/poller/main.go

@@ -12,11 +12,11 @@ import (
 	"time"
 
 	"github.com/joho/godotenv"
-	"github.com/kjannette/koin-ping/backend-go/internal/config"
-	"github.com/kjannette/koin-ping/backend-go/internal/database"
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
-	"github.com/kjannette/koin-ping/backend-go/internal/protocols/ethereum"
-	"github.com/kjannette/koin-ping/backend-go/internal/services"
+	"github.com/kjannette/koin-ping/backend/internal/config"
+	"github.com/kjannette/koin-ping/backend/internal/database"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/protocols/ethereum"
+	"github.com/kjannette/koin-ping/backend/internal/services"
 )
 
 const (
@@ -51,6 +51,7 @@ func main() {
 
 	defer database.Close()
 
+	userModel := models.NewUserModel(pool)
 	addressModel := models.NewAddressModel(pool)
 	alertRuleModel := models.NewAlertRuleModel(pool)
 	alertEventModel := models.NewAlertEventModel(pool)
@@ -59,8 +60,7 @@ func main() {
 
 	observer := services.NewObserverService(eth, addressModel, checkpointModel)
 	evaluator := services.NewEvaluatorService(
-		eth, alertRuleModel, alertEventModel, addressModel, notifConfigModel,
-		cfg.ResendAPIKey, cfg.EmailFrom,
+		eth, alertRuleModel, alertEventModel, addressModel, userModel, notifConfigModel,
 	)
 	digestSvc := services.NewEmailDigestService(cfg.ResendAPIKey, cfg.EmailFrom, alertEventModel, notifConfigModel)
 
@@ -138,6 +138,8 @@ func runCycle(
 		return
 	}
 
+	evaluator.WaitForNotifications()
+
 	duration := time.Since(startTime)
 	log.Printf("[%s] Cycle complete: %d observations, %d alerts fired in %s",
 		time.Now().UTC().Format(time.RFC3339),

backend/go.mod

@@ -1,4 +1,4 @@
-module github.com/kjannette/koin-ping/backend-go
+module github.com/kjannette/koin-ping/backend
 
 go 1.25.0
 
@@ -32,6 +32,7 @@ require (
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
@@ -44,6 +45,7 @@ require (
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/resend/resend-go/v3 v3.1.1 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
+	github.com/stripe/stripe-go/v82 v82.5.1 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
@@ -53,12 +55,12 @@ require (
 	go.opentelemetry.io/otel/sdk v1.39.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
 	go.opentelemetry.io/otel/trace v1.39.0 // indirect
-	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/net v0.50.0 // indirect
+	golang.org/x/crypto v0.49.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
 	golang.org/x/oauth2 v0.35.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/appengine/v2 v2.0.6 // indirect
 	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect

backend/go.sum

@@ -61,6 +61,8 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre
 github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
@@ -101,6 +103,8 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stripe/stripe-go/v82 v82.5.1 h1:05q6ZDKoe8PLMpQV072obF74HCgP4XJeJYoNuRSX2+8=
+github.com/stripe/stripe-go/v82 v82.5.1/go.mod h1:majCQX6AfObAvJiHraPi/5udwHi4ojRvJnnxckvHrX8=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
@@ -126,18 +130,24 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
 golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
 golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
 golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
 golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -145,6 +155,8 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
 golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -153,6 +165,8 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
 golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

backend/infra/migrations/005_create_users_table.sql

@@ -0,0 +1,13 @@
+-- Migration 005: Create users table with UUID primary key
+-- This establishes a local user record for each Firebase-authenticated user.
+
+CREATE TABLE IF NOT EXISTS users (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  firebase_uid VARCHAR(128) NOT NULL UNIQUE,
+  email VARCHAR(255) NOT NULL,
+  display_name VARCHAR(255),
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_users_firebase_uid ON users(firebase_uid);

backend/infra/migrations/006_migrate_user_ids_to_uuid.sql

@@ -0,0 +1,73 @@
+-- Migration 006: Migrate user_id columns from Firebase UID strings to user UUIDs
+--
+-- Prerequisites: migration 005 (users table) must be applied first.
+-- This migration backfills the users table from existing data, then swaps the
+-- VARCHAR user_id columns for UUID foreign keys referencing users(id).
+
+BEGIN;
+
+-- 1. Backfill users table from existing Firebase UIDs in addresses
+INSERT INTO users (firebase_uid, email)
+  SELECT DISTINCT user_id, ''
+  FROM addresses
+  WHERE user_id IS NOT NULL
+ON CONFLICT (firebase_uid) DO NOTHING;
+
+-- 2. Backfill from notification configs (catches users with configs but no addresses)
+INSERT INTO users (firebase_uid, email)
+  SELECT DISTINCT user_id, ''
+  FROM user_notification_configs
+  WHERE user_id IS NOT NULL
+ON CONFLICT (firebase_uid) DO NOTHING;
+
+-- ============================================================
+-- 3. Migrate addresses.user_id from VARCHAR to UUID
+-- ============================================================
+
+ALTER TABLE addresses ADD COLUMN user_uuid UUID;
+
+UPDATE addresses a
+SET user_uuid = u.id
+FROM users u
+WHERE u.firebase_uid = a.user_id;
+
+-- Drop old constraints and column
+ALTER TABLE addresses DROP CONSTRAINT IF EXISTS addresses_user_id_address_key;
+DROP INDEX IF EXISTS idx_addresses_user_id;
+ALTER TABLE addresses DROP COLUMN user_id;
+
+-- Rename and constrain
+ALTER TABLE addresses RENAME COLUMN user_uuid TO user_id;
+ALTER TABLE addresses ALTER COLUMN user_id SET NOT NULL;
+ALTER TABLE addresses ADD CONSTRAINT fk_addresses_user
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
+ALTER TABLE addresses ADD CONSTRAINT addresses_user_id_address_key
+  UNIQUE (user_id, address);
+CREATE INDEX idx_addresses_user_id ON addresses(user_id);
+
+-- ============================================================
+-- 4. Migrate user_notification_configs.user_id from VARCHAR to UUID
+-- ============================================================
+
+-- Drop the PK first (it's on user_id)
+ALTER TABLE user_notification_configs DROP CONSTRAINT IF EXISTS user_notification_configs_pkey;
+DROP INDEX IF EXISTS idx_notification_configs_enabled;
+
+ALTER TABLE user_notification_configs ADD COLUMN user_uuid UUID;
+
+UPDATE user_notification_configs nc
+SET user_uuid = u.id
+FROM users u
+WHERE u.firebase_uid = nc.user_id;
+
+ALTER TABLE user_notification_configs DROP COLUMN user_id;
+ALTER TABLE user_notification_configs RENAME COLUMN user_uuid TO user_id;
+ALTER TABLE user_notification_configs ALTER COLUMN user_id SET NOT NULL;
+ALTER TABLE user_notification_configs ADD CONSTRAINT user_notification_configs_pkey
+  PRIMARY KEY (user_id);
+ALTER TABLE user_notification_configs ADD CONSTRAINT fk_notification_configs_user
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
+CREATE INDEX idx_notification_configs_enabled
+  ON user_notification_configs(notification_enabled);
+
+COMMIT;

backend/infra/migrations/007_add_stripe_to_users.sql

@@ -0,0 +1,8 @@
+-- Migration 007: Add Stripe subscription fields to users table
+
+ALTER TABLE users ADD COLUMN IF NOT EXISTS stripe_customer_id VARCHAR(255);
+ALTER TABLE users ADD COLUMN IF NOT EXISTS stripe_subscription_id VARCHAR(255);
+ALTER TABLE users ADD COLUMN IF NOT EXISTS subscription_status VARCHAR(50) DEFAULT 'none';
+ALTER TABLE users ADD COLUMN IF NOT EXISTS subscription_created_at TIMESTAMP;
+
+CREATE INDEX IF NOT EXISTS idx_users_stripe_customer_id ON users(stripe_customer_id);

backend/infra/migrations/008_add_min_max_to_alert_rules.sql

@@ -0,0 +1,6 @@
+ALTER TABLE alert_rules ADD COLUMN minimum DECIMAL(20, 6);
+ALTER TABLE alert_rules ADD COLUMN maximum DECIMAL(20, 6);
+
+ALTER TABLE alert_rules ADD CONSTRAINT non_negative_minimum CHECK (minimum IS NULL OR minimum >= 0);
+ALTER TABLE alert_rules ADD CONSTRAINT non_negative_maximum CHECK (maximum IS NULL OR maximum >= 0);
+ALTER TABLE alert_rules ADD CONSTRAINT min_lte_max CHECK (minimum IS NULL OR maximum IS NULL OR minimum <= maximum);

backend/infra/migrations/009_add_subscription_tier.sql

@@ -0,0 +1,8 @@
+ALTER TABLE users ADD COLUMN IF NOT EXISTS subscription_tier VARCHAR(20) DEFAULT 'free';
+
+-- Existing active/trialing subscribers were on the single paid plan,
+-- which is now the "premium" tier. Backfill them so they aren't downgraded.
+UPDATE users
+SET subscription_tier = 'premium'
+WHERE subscription_status IN ('active', 'trialing')
+  AND stripe_subscription_id IS NOT NULL;

backend/infra/migrations/010_add_password_auth.sql

@@ -0,0 +1,11 @@
+-- Migration 010: Add password-based authentication
+-- Adds password_hash column, makes firebase_uid optional, ensures email uniqueness.
+
+ALTER TABLE users ADD COLUMN IF NOT EXISTS password_hash VARCHAR(255);
+
+ALTER TABLE users ALTER COLUMN firebase_uid DROP NOT NULL;
+
+-- Ensure email is unique so it can serve as the login identifier.
+-- Drop the old index first if it exists, then create a unique one.
+DROP INDEX IF EXISTS idx_users_email_unique;
+CREATE UNIQUE INDEX idx_users_email_unique ON users (email);

backend/infra/schema.sql

@@ -4,15 +4,29 @@ DROP TABLE IF EXISTS alert_rules CASCADE;
 DROP TABLE IF EXISTS address_checkpoints CASCADE;
 DROP TABLE IF EXISTS user_notification_configs CASCADE;
 DROP TABLE IF EXISTS addresses CASCADE;
+DROP TABLE IF EXISTS users CASCADE;
+
+CREATE TABLE users (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  firebase_uid VARCHAR(128) NOT NULL UNIQUE,
+  email VARCHAR(255) NOT NULL,
+  display_name VARCHAR(255),
+  stripe_customer_id VARCHAR(255),
+  stripe_subscription_id VARCHAR(255),
+  subscription_status VARCHAR(50) DEFAULT 'none',
+  subscription_tier VARCHAR(20) DEFAULT 'free',
+  subscription_created_at TIMESTAMP,
+  created_at TIMESTAMP DEFAULT NOW(),
+  updated_at TIMESTAMP DEFAULT NOW()
+);
 
 CREATE TABLE addresses (
   id SERIAL PRIMARY KEY,
-  user_id VARCHAR(128) NOT NULL,       -- Firebase user ID (multi-user support)
+  user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
   address VARCHAR(42) NOT NULL,        -- Ethereum address format (0x + 40 hex chars)
   label VARCHAR(255),                  -- Optional human-readable label
   created_at TIMESTAMP DEFAULT NOW(),
 
-  -- Unique users can track the same address independently
   UNIQUE(user_id, address)
 );
 
@@ -22,6 +36,8 @@ CREATE TABLE alert_rules (
   address_id INTEGER NOT NULL REFERENCES addresses(id) ON DELETE CASCADE,
   type VARCHAR(50) NOT NULL,           -- 'incoming_tx', 'outgoing_tx', 'large_transfer', 'balance_below'
   threshold DECIMAL(20, 6),            -- ETH amount threshold (nullable for tx types that don't need it)
+  minimum DECIMAL(20, 6),              -- Optional min amount filter for incoming/outgoing alerts
+  maximum DECIMAL(20, 6),              -- Optional max amount filter for incoming/outgoing alerts
   enabled BOOLEAN DEFAULT TRUE,
   created_at TIMESTAMP DEFAULT NOW(),
 
@@ -31,7 +47,11 @@ CREATE TABLE alert_rules (
 
   CONSTRAINT positive_threshold CHECK (
     threshold IS NULL OR threshold > 0
-  )
+  ),
+
+  CONSTRAINT non_negative_minimum CHECK (minimum IS NULL OR minimum >= 0),
+  CONSTRAINT non_negative_maximum CHECK (maximum IS NULL OR maximum >= 0),
+  CONSTRAINT min_lte_max CHECK (minimum IS NULL OR maximum IS NULL OR minimum <= maximum)
 );
 
 
@@ -51,7 +71,7 @@ CREATE TABLE address_checkpoints (
 );
 
 CREATE TABLE user_notification_configs (
-  user_id VARCHAR(128) PRIMARY KEY,
+  user_id UUID PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
   discord_webhook_url TEXT,            -- Discord webhook URL (nullable)
   telegram_chat_id VARCHAR(128),       -- Telegram chat ID (nullable)
   telegram_bot_token VARCHAR(255),     -- Telegram bot token (nullable)
@@ -63,6 +83,8 @@ CREATE TABLE user_notification_configs (
 );
 
 -- Create indexes for common queries
+CREATE INDEX idx_users_firebase_uid ON users(firebase_uid);
+CREATE INDEX idx_users_stripe_customer_id ON users(stripe_customer_id);
 CREATE INDEX idx_addresses_user_id ON addresses(user_id);
 CREATE INDEX idx_alert_rules_address_id ON alert_rules(address_id);
 CREATE INDEX idx_alert_rules_enabled ON alert_rules(enabled);

backend/internal/config/config.go

@@ -32,6 +32,13 @@ type Config struct {
 	ResendAPIKey         string
 	EmailFrom            string
 	DigestIntervalHours  int
+	StripeSecretKey        string
+	StripeWebhookSecret    string
+	StripePriceIDPremium   string
+	StripePriceIDPro       string
+	StripePublishableKey   string
+	FrontendURL            string
+	JWTSecret              string
 }
 
 // Load reads configuration from environment variables and returns a Config.
@@ -52,6 +59,13 @@ func Load() (*Config, error) {
 		ResendAPIKey:        os.Getenv("RESEND_API_KEY"),
 		EmailFrom:           getEnv("EMAIL_FROM", "Koin Ping <alerts@koinping.com>"),
 		DigestIntervalHours:  getEnvInt("DIGEST_INTERVAL_HOURS", defaultDigestIntervalHours),
+		StripeSecretKey:        os.Getenv("STRIPE_SECRET_KEY"),
+		StripeWebhookSecret:    os.Getenv("STRIPE_WEBHOOK_SECRET"),
+		StripePriceIDPremium:   os.Getenv("STRIPE_PRICE_ID_PREMIUM"),
+		StripePriceIDPro:       os.Getenv("STRIPE_PRICE_ID_PRO"),
+		StripePublishableKey:   os.Getenv("STRIPE_PUBLISHABLE_KEY"),
+		FrontendURL:          getEnv("FRONTEND_URL", "http://localhost:3000"),
+		JWTSecret:            getEnv("JWT_SECRET", "change-me-in-production"),
 	}
 
 	if cfg.PollIntervalMS < minPollIntervalMS {
@@ -82,6 +96,19 @@ func (c *Config) DSN() string {
 	)
 }
 
+// TierForPriceID maps a Stripe price ID back to the corresponding
+// subscription tier. Returns empty string if the price is unrecognised.
+func (c *Config) TierForPriceID(priceID string) string {
+	switch priceID {
+	case c.StripePriceIDPremium:
+		return "premium"
+	case c.StripePriceIDPro:
+		return "pro"
+	default:
+		return ""
+	}
+}
+
 func getEnv(key, fallback string) string {
 	if v := os.Getenv(key); v != "" {
 		return v

backend/internal/config/config_test.go

@@ -0,0 +1,28 @@
+package config
+
+import "testing"
+
+func TestTierForPriceID(t *testing.T) {
+	t.Parallel()
+
+	cfg := &Config{
+		StripePriceIDPremium: "price_premium_123",
+		StripePriceIDPro:     "price_pro_456",
+	}
+
+	tests := []struct {
+		priceID string
+		want    string
+	}{
+		{"price_premium_123", "premium"},
+		{"price_pro_456", "pro"},
+		{"price_unknown", ""},
+		{"", ""},
+	}
+
+	for _, tt := range tests {
+		if got := cfg.TierForPriceID(tt.priceID); got != tt.want {
+			t.Errorf("TierForPriceID(%q) = %q, want %q", tt.priceID, got, tt.want)
+		}
+	}
+}

backend/internal/domain/types.go

@@ -2,6 +2,80 @@ package domain
 
 import "time"
 
+type SubscriptionTier string
+
+const (
+	TierFree    SubscriptionTier = "free"
+	TierPremium SubscriptionTier = "premium"
+	TierPro     SubscriptionTier = "pro"
+)
+
+func IsValidTier(t string) bool {
+	switch SubscriptionTier(t) {
+	case TierFree, TierPremium, TierPro:
+		return true
+	}
+	return false
+}
+
+const unlimitedLimit = -1
+
+type TierLimits struct {
+	MaxAddresses    int      `json:"max_addresses"`
+	MaxAlertTypes   int      `json:"max_alert_types"`
+	AllowedChannels []string `json:"allowed_channels"`
+}
+
+func GetTierLimits(tier SubscriptionTier) TierLimits {
+	switch tier {
+	case TierPremium:
+		return TierLimits{
+			MaxAddresses:    3,
+			MaxAlertTypes:   2,
+			AllowedChannels: []string{"email", "discord", "telegram"},
+		}
+	case TierPro:
+		return TierLimits{
+			MaxAddresses:    unlimitedLimit,
+			MaxAlertTypes:   unlimitedLimit,
+			AllowedChannels: []string{"email", "discord", "telegram", "slack"},
+		}
+	default:
+		return TierLimits{
+			MaxAddresses:    1,
+			MaxAlertTypes:   1,
+			AllowedChannels: []string{"email"},
+		}
+	}
+}
+
+func (l TierLimits) IsUnlimitedAddresses() bool  { return l.MaxAddresses == unlimitedLimit }
+func (l TierLimits) IsUnlimitedAlertTypes() bool  { return l.MaxAlertTypes == unlimitedLimit }
+
+func (l TierLimits) ChannelAllowed(channel string) bool {
+	for _, c := range l.AllowedChannels {
+		if c == channel {
+			return true
+		}
+	}
+	return false
+}
+
+type User struct {
+	ID                    string           `json:"id"`
+	FirebaseUID           *string          `json:"-"`
+	Email                 string           `json:"email"`
+	DisplayName           *string          `json:"display_name"`           //nolint:tagliatelle
+	PasswordHash          *string          `json:"-"`
+	StripeCustomerID      *string          `json:"-"`
+	StripeSubscriptionID  *string          `json:"-"`
+	SubscriptionStatus    string           `json:"subscription_status"`    //nolint:tagliatelle
+	SubscriptionTier      SubscriptionTier `json:"subscription_tier"`      //nolint:tagliatelle
+	SubscriptionCreatedAt *time.Time       `json:"subscription_created_at,omitempty"` //nolint:tagliatelle
+	CreatedAt             time.Time        `json:"created_at"`             //nolint:tagliatelle
+	UpdatedAt             time.Time        `json:"updated_at"`             //nolint:tagliatelle
+}
+
 type Address struct {
 	ID        int       `json:"id"`
 	UserID    string    `json:"user_id"`    //nolint:tagliatelle
@@ -34,7 +108,7 @@ var ThresholdRequiredTypes = []AlertType{ //nolint:gochecknoglobals
 	AlertBalanceBelow,
 }
 
-// IsValidAlertType returns true if the given string matches a known AlertType.
+// returns true if the given string matches a known AlertType.
 func IsValidAlertType(t string) bool {
 	for _, v := range ValidAlertTypes {
 		if string(v) == t {
@@ -45,7 +119,6 @@ func IsValidAlertType(t string) bool {
 	return false
 }
 
-// IsThresholdRequired returns true if the given AlertType requires a threshold.
 func IsThresholdRequired(t AlertType) bool {
 	for _, v := range ThresholdRequiredTypes {
 		if v == t {
@@ -61,6 +134,8 @@ type AlertRule struct {
 	AddressID int       `json:"address_id"` //nolint:tagliatelle
 	Type      AlertType `json:"type"`
 	Threshold *float64  `json:"threshold"`
+	Minimum   *float64  `json:"minimum"`
+	Maximum   *float64  `json:"maximum"`
 	Enabled   bool      `json:"enabled"`
 	CreatedAt time.Time `json:"created_at"` //nolint:tagliatelle
 }
@@ -80,7 +155,6 @@ type AddressCheckpoint struct {
 	LastCheckedAt    time.Time `json:"last_checked_at"`    //nolint:tagliatelle
 }
 
-// CheckpointDetail combines checkpoint and address info for reporting.
 type CheckpointDetail struct {
 	AddressID        int       `json:"address_id"`         //nolint:tagliatelle
 	Address          string    `json:"address"`
@@ -89,7 +163,7 @@ type CheckpointDetail struct {
 	LastCheckedAt    time.Time `json:"last_checked_at"`    //nolint:tagliatelle
 }
 
-// NotificationConfig holds a user's notification preferences.
+//  holds a user's notification preferences.
 type NotificationConfig struct {
 	UserID              string     `json:"user_id"`              //nolint:tagliatelle
 	DiscordWebhookURL   *string    `json:"discord_webhook_url"`  //nolint:tagliatelle
@@ -118,14 +192,12 @@ type NormalizedTx struct {
 	TokenValue    *string `json:"token_value,omitempty"`    //nolint:tagliatelle
 }
 
-// IsTokenTransfer returns true if this transaction represents an ERC-20 token transfer.
 func (tx NormalizedTx) IsTokenTransfer() bool {
 	return tx.TokenContract != nil
 }
 
 type Direction string
 
-// String implements fmt.Stringer.
 func (d Direction) String() string { return string(d) }
 
 const (

backend/internal/domain/types_test.go

@@ -0,0 +1,104 @@
+package domain
+
+import "testing"
+
+func TestIsValidTier(t *testing.T) {
+	t.Parallel()
+
+	valid := []string{"free", "premium", "pro"}
+	for _, tier := range valid {
+		if !IsValidTier(tier) {
+			t.Errorf("expected %q to be valid", tier)
+		}
+	}
+
+	invalid := []string{"", "basic", "enterprise", "FREE", "Pro"}
+	for _, tier := range invalid {
+		if IsValidTier(tier) {
+			t.Errorf("expected %q to be invalid", tier)
+		}
+	}
+}
+
+func TestGetTierLimits_Free(t *testing.T) {
+	t.Parallel()
+
+	limits := GetTierLimits(TierFree)
+	if limits.MaxAddresses != 1 {
+		t.Errorf("free MaxAddresses = %d, want 1", limits.MaxAddresses)
+	}
+	if limits.MaxAlertTypes != 1 {
+		t.Errorf("free MaxAlertTypes = %d, want 1", limits.MaxAlertTypes)
+	}
+	if len(limits.AllowedChannels) != 1 || limits.AllowedChannels[0] != "email" {
+		t.Errorf("free AllowedChannels = %v, want [email]", limits.AllowedChannels)
+	}
+	if limits.IsUnlimitedAddresses() {
+		t.Error("free should not have unlimited addresses")
+	}
+	if limits.IsUnlimitedAlertTypes() {
+		t.Error("free should not have unlimited alert types")
+	}
+}
+
+func TestGetTierLimits_Premium(t *testing.T) {
+	t.Parallel()
+
+	limits := GetTierLimits(TierPremium)
+	if limits.MaxAddresses != 3 {
+		t.Errorf("premium MaxAddresses = %d, want 3", limits.MaxAddresses)
+	}
+	if limits.MaxAlertTypes != 2 {
+		t.Errorf("premium MaxAlertTypes = %d, want 2", limits.MaxAlertTypes)
+	}
+	if !limits.ChannelAllowed("email") {
+		t.Error("premium should allow email")
+	}
+	if !limits.ChannelAllowed("discord") {
+		t.Error("premium should allow discord")
+	}
+	if !limits.ChannelAllowed("telegram") {
+		t.Error("premium should allow telegram")
+	}
+	if limits.ChannelAllowed("slack") {
+		t.Error("premium should NOT allow slack")
+	}
+}
+
+func TestGetTierLimits_Pro(t *testing.T) {
+	t.Parallel()
+
+	limits := GetTierLimits(TierPro)
+	if !limits.IsUnlimitedAddresses() {
+		t.Error("pro should have unlimited addresses")
+	}
+	if !limits.IsUnlimitedAlertTypes() {
+		t.Error("pro should have unlimited alert types")
+	}
+	for _, ch := range []string{"email", "discord", "telegram", "slack"} {
+		if !limits.ChannelAllowed(ch) {
+			t.Errorf("pro should allow %s", ch)
+		}
+	}
+}
+
+func TestGetTierLimits_Unknown(t *testing.T) {
+	t.Parallel()
+
+	limits := GetTierLimits(SubscriptionTier("unknown"))
+	if limits.MaxAddresses != 1 {
+		t.Errorf("unknown tier should default to free limits, got MaxAddresses=%d", limits.MaxAddresses)
+	}
+}
+
+func TestChannelAllowed_NotInList(t *testing.T) {
+	t.Parallel()
+
+	limits := GetTierLimits(TierFree)
+	if limits.ChannelAllowed("discord") {
+		t.Error("free should not allow discord")
+	}
+	if limits.ChannelAllowed("nonexistent") {
+		t.Error("nonexistent channel should not be allowed")
+	}
+}

backend/internal/handlers/account.go

@@ -0,0 +1,88 @@
+package handlers
+
+import (
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/kjannette/koin-ping/backend/internal/config"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+type AccountHandler struct {
+	users     *models.UserModel
+	addresses *models.AddressModel
+	cfg       *config.Config
+}
+
+func NewAccountHandler(users *models.UserModel, addresses *models.AddressModel, cfg *config.Config) *AccountHandler {
+	return &AccountHandler{users: users, addresses: addresses, cfg: cfg}
+}
+
+type accountResponse struct {
+	UserID             string            `json:"user_id"`
+	Email              string            `json:"email"`
+	UserName           string            `json:"user_name"`
+	SubscriptionStatus string            `json:"subscription_status"`
+	SubscriptionTier   string            `json:"subscription_tier"`
+	SubscriptionPlan   string            `json:"subscription_plan"`
+	TierLimits         domain.TierLimits `json:"tier_limits"`
+	AddressCount       int               `json:"address_count"`
+	MemberSince        *string           `json:"member_since,omitempty"`
+	NextBillingDate    *string           `json:"next_billing_date,omitempty"`
+	CancelAtPeriodEnd  bool              `json:"cancel_at_period_end"`
+	PeriodEndDate      *string           `json:"period_end_date,omitempty"`
+}
+
+var tierPlanLabels = map[domain.SubscriptionTier]string{ //nolint:gochecknoglobals
+	domain.TierFree:    "Free Trial",
+	domain.TierPremium: "Premium / $1.99 mo",
+	domain.TierPro:     "Pro / $11.99 mo",
+}
+
+func (h *AccountHandler) GetAccount(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+	email := middleware.GetUserEmail(r.Context())
+
+	user, err := h.users.GetByID(r.Context(), userID)
+	if err != nil || user == nil {
+		log.Printf("Account: failed to get user %s: %v", userID, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to load user")
+		return
+	}
+
+	addrCount, err := h.addresses.CountByUser(r.Context(), userID)
+	if err != nil {
+		log.Printf("Account: failed to count addresses for %s: %v", userID, err)
+		addrCount = 0
+	}
+
+	planLabel := tierPlanLabels[user.SubscriptionTier]
+	if planLabel == "" {
+		planLabel = "Free Trial"
+	}
+
+	resp := accountResponse{
+		UserID:             user.ID,
+		Email:              email,
+		UserName:           email,
+		SubscriptionStatus: user.SubscriptionStatus,
+		SubscriptionTier:   string(user.SubscriptionTier),
+		SubscriptionPlan:   planLabel,
+		TierLimits:         domain.GetTierLimits(user.SubscriptionTier),
+		AddressCount:       addrCount,
+	}
+
+	if user.SubscriptionCreatedAt != nil {
+		t := user.SubscriptionCreatedAt.Format(time.DateOnly)
+		resp.MemberSince = &t
+	}
+
+	resp.NextBillingDate = nil
+	resp.CancelAtPeriodEnd = false
+	resp.PeriodEndDate = nil
+
+	writeJSON(w, http.StatusOK, resp)
+}

backend/internal/handlers/address.go

@@ -3,24 +3,26 @@ package handlers
 
 import (
 	"encoding/json"
+	"fmt"
 	"log"
 	"net/http"
 	"regexp"
 	"strings"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
-	"github.com/kjannette/koin-ping/backend-go/internal/middleware"
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
 )
 
 var ethAddressRe = regexp.MustCompile(`^0x[a-fA-F0-9]{40}$`)
 
 type AddressHandler struct {
 	addresses *models.AddressModel
+	users     *models.UserModel
 }
 
-func NewAddressHandler(addresses *models.AddressModel) *AddressHandler {
-	return &AddressHandler{addresses: addresses}
+func NewAddressHandler(addresses *models.AddressModel, users *models.UserModel) *AddressHandler {
+	return &AddressHandler{addresses: addresses, users: users}
 }
 
 func (h *AddressHandler) Create(w http.ResponseWriter, r *http.Request) {
@@ -49,6 +51,28 @@ func (h *AddressHandler) Create(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	user, err := h.users.GetByID(r.Context(), userID)
+	if err != nil || user == nil {
+		log.Printf("Failed to get user %s for tier check: %v", userID, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to verify account")
+		return
+	}
+
+	limits := domain.GetTierLimits(user.SubscriptionTier)
+	if !limits.IsUnlimitedAddresses() {
+		count, err := h.addresses.CountByUser(r.Context(), userID)
+		if err != nil {
+			log.Printf("Failed to count addresses for user %s: %v", userID, err)
+			writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to create address")
+			return
+		}
+		if count >= limits.MaxAddresses {
+			writeError(w, http.StatusForbidden, "TIER_LIMIT_REACHED",
+				fmt.Sprintf("Your %s plan allows %d address(es). Upgrade to track more.", user.SubscriptionTier, limits.MaxAddresses))
+			return
+		}
+	}
+
 	log.Printf("User %s creating address: %s", userID, body.Address)
 
 	addr, err := h.addresses.Create(r.Context(), userID, body.Address, body.Label)

backend/internal/handlers/alert_event.go

@@ -5,9 +5,9 @@ import (
 	"net/http"
 	"strconv"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
-	"github.com/kjannette/koin-ping/backend-go/internal/middleware"
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
 )
 
 // AlertEventHandler handles HTTP requests for alert event history.

backend/internal/handlers/alert_rule.go

@@ -9,9 +9,9 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
-	"github.com/kjannette/koin-ping/backend-go/internal/middleware"
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
 )
 
 var errThresholdFormat = errors.New("unsupported threshold format")
@@ -19,10 +19,11 @@ var errThresholdFormat = errors.New("unsupported threshold format")
 type AlertRuleHandler struct {
 	alertRules *models.AlertRuleModel
 	addresses  *models.AddressModel
+	users      *models.UserModel
 }
 
-func NewAlertRuleHandler(alertRules *models.AlertRuleModel, addresses *models.AddressModel) *AlertRuleHandler {
-	return &AlertRuleHandler{alertRules: alertRules, addresses: addresses}
+func NewAlertRuleHandler(alertRules *models.AlertRuleModel, addresses *models.AddressModel, users *models.UserModel) *AlertRuleHandler {
+	return &AlertRuleHandler{alertRules: alertRules, addresses: addresses, users: users}
 }
 
 func (h *AlertRuleHandler) Create(w http.ResponseWriter, r *http.Request) {
@@ -37,6 +38,8 @@ func (h *AlertRuleHandler) Create(w http.ResponseWriter, r *http.Request) {
 	var body struct {
 		Type      string          `json:"type"`
 		Threshold json.RawMessage `json:"threshold"`
+		Minimum   json.RawMessage `json:"minimum"`
+		Maximum   json.RawMessage `json:"maximum"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
 		log.Printf("Failed to decode alert request body: %v", err)
@@ -53,6 +56,40 @@ func (h *AlertRuleHandler) Create(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	minimum, err := parseThreshold(body.Minimum)
+	if err != nil {
+		log.Printf("Failed to parse minimum: %v", err)
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "minimum must be a valid number")
+
+		return
+	}
+
+	maximum, err := parseThreshold(body.Maximum)
+	if err != nil {
+		log.Printf("Failed to parse maximum: %v", err)
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "maximum must be a valid number")
+
+		return
+	}
+
+	if minimum != nil && *minimum < 0 {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "minimum must be non-negative")
+
+		return
+	}
+
+	if maximum != nil && *maximum < 0 {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "maximum must be non-negative")
+
+		return
+	}
+
+	if minimum != nil && maximum != nil && *minimum > *maximum {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "minimum must not exceed maximum")
+
+		return
+	}
+
 	log.Printf("User %s creating alert: type=%s, addressID=%d", userID, body.Type, addressID)
 
 	if body.Type == "" {
@@ -96,7 +133,29 @@ func (h *AlertRuleHandler) Create(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	newAlert, err := h.alertRules.Create(r.Context(), addressID, alertType, threshold)
+	user, userErr := h.users.GetByID(r.Context(), userID)
+	if userErr != nil || user == nil {
+		log.Printf("Failed to get user %s for tier check: %v", userID, userErr)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to verify account")
+		return
+	}
+
+	limits := domain.GetTierLimits(user.SubscriptionTier)
+	if !limits.IsUnlimitedAlertTypes() {
+		typeCount, countErr := h.alertRules.CountDistinctTypesByAddress(r.Context(), addressID)
+		if countErr != nil {
+			log.Printf("Failed to count alert types for address %d: %v", addressID, countErr)
+			writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to create alert rule")
+			return
+		}
+		if typeCount >= limits.MaxAlertTypes {
+			writeError(w, http.StatusForbidden, "TIER_LIMIT_REACHED",
+				fmt.Sprintf("Your %s plan allows %d alert type(s) per address. Upgrade for more.", user.SubscriptionTier, limits.MaxAlertTypes))
+			return
+		}
+	}
+
+	newAlert, err := h.alertRules.Create(r.Context(), addressID, alertType, threshold, minimum, maximum)
 	if err != nil {
 		log.Printf("Error creating alert rule: %v", err)
 		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to create alert rule")
@@ -182,7 +241,7 @@ func (h *AlertRuleHandler) ListByAddress(w http.ResponseWriter, r *http.Request)
 	writeJSON(w, http.StatusOK, alerts)
 }
 
-// UpdateStatus handles PATCH requests to enable or disable an alert rule.
+// UpdateStatus handles PATCH requests to enable/disable an alert rule and/or update min/max thresholds.
 func (h *AlertRuleHandler) UpdateStatus(w http.ResponseWriter, r *http.Request) {
 	userID := middleware.GetUserID(r.Context())
 	alertID, ok := parseIntParam(r.PathValue("alertId"))
@@ -194,6 +253,9 @@ func (h *AlertRuleHandler) UpdateStatus(w http.ResponseWriter, r *http.Request)
 
 	var body struct {
 		Enabled        *bool           `json:"enabled"`
+		Minimum        json.RawMessage `json:"minimum"`
+		Maximum        json.RawMessage `json:"maximum"`
+		UpdateMinMax   bool            `json:"update_min_max"`   //nolint:tagliatelle
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
 		log.Printf("Failed to decode update request body: %v", err)
@@ -204,8 +266,8 @@ func (h *AlertRuleHandler) UpdateStatus(w http.ResponseWriter, r *http.Request)
 
 	log.Printf("User %s updating alert ID: %d", userID, alertID)
 
-	if body.Enabled == nil {
-		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "enabled must be a boolean value")
+	if body.Enabled == nil && !body.UpdateMinMax {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "must provide enabled (boolean) or update_min_max with minimum/maximum values")
 
 		return
 	}
@@ -224,7 +286,54 @@ func (h *AlertRuleHandler) UpdateStatus(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	updated, err := h.alertRules.UpdateEnabled(r.Context(), alertID, *body.Enabled)
+	var updated *domain.AlertRule
+
+	if body.UpdateMinMax {
+		minimum, parseErr := parseThreshold(body.Minimum)
+		if parseErr != nil {
+			writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "minimum must be a valid number")
+
+			return
+		}
+
+		maximum, parseErr := parseThreshold(body.Maximum)
+		if parseErr != nil {
+			writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "maximum must be a valid number")
+
+			return
+		}
+
+		if minimum != nil && *minimum < 0 {
+			writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "minimum must be non-negative")
+
+			return
+		}
+
+		if maximum != nil && *maximum < 0 {
+			writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "maximum must be non-negative")
+
+			return
+		}
+
+		if minimum != nil && maximum != nil && *minimum > *maximum {
+			writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "minimum must not exceed maximum")
+
+			return
+		}
+
+		updated, err = h.alertRules.UpdateThresholds(r.Context(), alertID, minimum, maximum)
+		if err != nil {
+			log.Printf("Error updating alert thresholds: %v", err)
+			writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to update alert")
+
+			return
+		}
+
+		log.Printf("Alert %d thresholds updated: min=%v, max=%v", alertID, minimum, maximum)
+	}
+
+	if body.Enabled != nil {
+		updated, err = h.alertRules.UpdateEnabled(r.Context(), alertID, *body.Enabled)
 		if err != nil {
 			log.Printf("Error updating alert: %v", err)
 			writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to update alert")
@@ -233,6 +342,8 @@ func (h *AlertRuleHandler) UpdateStatus(w http.ResponseWriter, r *http.Request)
 		}
 
 		log.Printf("Alert %d updated: enabled=%v", alertID, *body.Enabled)
+	}
+
 	writeJSON(w, http.StatusOK, updated)
 }
 

backend/internal/handlers/auth.go

@@ -0,0 +1,230 @@
+package handlers
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	checkoutsession "github.com/stripe/stripe-go/v82/checkout/session"
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/kjannette/koin-ping/backend/internal/config"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+const (
+	bcryptCost     = 12
+	jwtTTLHours    = 72
+	minPasswordLen = 6
+)
+
+type AuthHandler struct {
+	users *models.UserModel
+	cfg   *config.Config
+}
+
+func NewAuthHandler(users *models.UserModel, cfg *config.Config) *AuthHandler {
+	return &AuthHandler{users: users, cfg: cfg}
+}
+
+type authResponse struct {
+	Token              string `json:"token"`
+	UserID             string `json:"user_id"`    //nolint:tagliatelle
+	Email              string `json:"email"`
+	SubscriptionStatus string `json:"subscription_status"` //nolint:tagliatelle
+	SubscriptionTier   string `json:"subscription_tier"`   //nolint:tagliatelle
+}
+
+func (h *AuthHandler) issueJWT(userID, email string) (string, error) {
+	claims := jwt.MapClaims{
+		"sub":   userID,
+		"email": email,
+		"iat":   time.Now().Unix(),
+		"exp":   time.Now().Add(jwtTTLHours * time.Hour).Unix(),
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString([]byte(h.cfg.JWTSecret))
+}
+
+// Login authenticates an existing user by email + password.
+func (h *AuthHandler) Login(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Email    string `json:"email"`
+		Password string `json:"password"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeError(w, http.StatusBadRequest, "BAD_REQUEST", "Invalid request body")
+		return
+	}
+
+	if body.Email == "" || body.Password == "" {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Email and password are required")
+		return
+	}
+
+	user, err := h.users.FindByEmail(r.Context(), body.Email)
+	if err != nil {
+		log.Printf("Login: DB error looking up %s: %v", body.Email, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Login failed")
+		return
+	}
+	if user == nil {
+		writeError(w, http.StatusUnauthorized, "INVALID_CREDENTIALS", "Invalid email or password")
+		return
+	}
+
+	if user.PasswordHash == nil || *user.PasswordHash == "" {
+		writeError(w, http.StatusUnauthorized, "INVALID_CREDENTIALS", "Invalid email or password")
+		return
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(*user.PasswordHash), []byte(body.Password)); err != nil {
+		writeError(w, http.StatusUnauthorized, "INVALID_CREDENTIALS", "Invalid email or password")
+		return
+	}
+
+	token, err := h.issueJWT(user.ID, user.Email)
+	if err != nil {
+		log.Printf("Login: failed to issue JWT for %s: %v", user.ID, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Login failed")
+		return
+	}
+
+	log.Printf("Login successful for user %s (%s)", user.ID, user.Email)
+	writeJSON(w, http.StatusOK, authResponse{
+		Token:              token,
+		UserID:             user.ID,
+		Email:              user.Email,
+		SubscriptionStatus: user.SubscriptionStatus,
+		SubscriptionTier:   string(user.SubscriptionTier),
+	})
+}
+
+// RegisterAfterCheckout creates a new user account after a successful Stripe
+// checkout. It verifies the Stripe session was paid, hashes the password,
+// inserts the user into Postgres, links the Stripe customer/subscription,
+// and returns a JWT so the frontend is immediately authenticated.
+func (h *AuthHandler) RegisterAfterCheckout(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Email     string `json:"email"`
+		Password  string `json:"password"`
+		SessionID string `json:"session_id"` //nolint:tagliatelle
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeError(w, http.StatusBadRequest, "BAD_REQUEST", "Invalid request body")
+		return
+	}
+
+	if body.Email == "" || body.Password == "" {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Email and password are required")
+		return
+	}
+	if len(body.Password) < minPasswordLen {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Password must be at least 6 characters")
+		return
+	}
+
+	existing, err := h.users.FindByEmail(r.Context(), body.Email)
+	if err != nil {
+		log.Printf("Register: DB error looking up %s: %v", body.Email, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Registration failed")
+		return
+	}
+	if existing != nil {
+		writeError(w, http.StatusConflict, "EMAIL_IN_USE", "An account with this email already exists")
+		return
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(body.Password), bcryptCost)
+	if err != nil {
+		log.Printf("Register: bcrypt error: %v", err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Registration failed")
+		return
+	}
+
+	user, err := h.users.CreateWithPassword(r.Context(), body.Email, string(hash))
+	if err != nil {
+		log.Printf("Register: failed to create user %s: %v", body.Email, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Registration failed")
+		return
+	}
+
+	// If a Stripe session_id was provided (paid tier checkout), link the
+	// Stripe customer and activate the subscription immediately.
+	if body.SessionID != "" {
+		h.linkStripeSession(r, user.ID, body.SessionID)
+	}
+
+	// Re-fetch to pick up updated subscription fields after Stripe link.
+	user, err = h.users.GetByID(r.Context(), user.ID)
+	if err != nil || user == nil {
+		log.Printf("Register: failed to re-fetch user %s: %v", body.Email, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Registration failed")
+		return
+	}
+
+	token, err := h.issueJWT(user.ID, user.Email)
+	if err != nil {
+		log.Printf("Register: failed to issue JWT for %s: %v", user.ID, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Registration failed")
+		return
+	}
+
+	log.Printf("Registration successful for user %s (%s)", user.ID, user.Email)
+	writeJSON(w, http.StatusOK, authResponse{
+		Token:              token,
+		UserID:             user.ID,
+		Email:              user.Email,
+		SubscriptionStatus: user.SubscriptionStatus,
+		SubscriptionTier:   string(user.SubscriptionTier),
+	})
+}
+
+// linkStripeSession retrieves the Stripe checkout session by ID, verifies
+// payment, and writes the Stripe customer + subscription to the user record.
+func (h *AuthHandler) linkStripeSession(r *http.Request, userID, sessionID string) {
+	s, err := checkoutsession.Get(sessionID, nil)
+	if err != nil {
+		log.Printf("linkStripeSession: failed to retrieve session %s: %v", sessionID, err)
+		return
+	}
+
+	fullJSON, _ := json.MarshalIndent(s, "", "  ")
+	log.Printf("STRIPE REGISTER LINK — FULL SESSION:\n%s", string(fullJSON))
+
+	if s.PaymentStatus != "paid" {
+		log.Printf("linkStripeSession: session %s not paid (status=%s)", sessionID, s.PaymentStatus)
+		return
+	}
+
+	tier := domain.TierPremium
+	if t, ok := s.Metadata["tier"]; ok && domain.IsValidTier(t) {
+		tier = domain.SubscriptionTier(t)
+	}
+
+	customerID := ""
+	if s.Customer != nil {
+		customerID = s.Customer.ID
+	}
+	subscriptionID := ""
+	if s.Subscription != nil {
+		subscriptionID = s.Subscription.ID
+	}
+
+	if customerID != "" {
+		if err := h.users.UpdateStripeCustomer(r.Context(), userID, customerID); err != nil {
+			log.Printf("linkStripeSession: failed to save customer ID: %v", err)
+		}
+	}
+	if subscriptionID != "" && customerID != "" {
+		if err := h.users.ActivateSubscription(r.Context(), customerID, subscriptionID, "active", tier); err != nil {
+			log.Printf("linkStripeSession: failed to activate subscription: %v", err)
+		}
+	}
+
+	log.Printf("linkStripeSession: linked user %s → customer %s, subscription %s, tier %s",
+		userID, customerID, subscriptionID, tier)
+}

backend/internal/handlers/email_digest.go

@@ -4,9 +4,9 @@ import (
 	"log"
 	"net/http"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/middleware"
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
-	"github.com/kjannette/koin-ping/backend-go/internal/services"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/services"
 )
 
 type EmailDigestHandler struct {

backend/internal/handlers/notification_config.go

@@ -7,22 +7,23 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/config"
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
-	"github.com/kjannette/koin-ping/backend-go/internal/middleware"
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
-	"github.com/kjannette/koin-ping/backend-go/internal/notifications"
+	"github.com/kjannette/koin-ping/backend/internal/config"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/notifications"
 )
 
 var emailRe = regexp.MustCompile(`^[^\s@]+@[^\s@]+\.[^\s@]+$`)
 
 type NotificationConfigHandler struct {
 	configs *models.NotificationConfigModel
+	users   *models.UserModel
 	cfg     *config.Config
 }
 
-func NewNotificationConfigHandler(configs *models.NotificationConfigModel, cfg *config.Config) *NotificationConfigHandler {
-	return &NotificationConfigHandler{configs: configs, cfg: cfg}
+func NewNotificationConfigHandler(configs *models.NotificationConfigModel, users *models.UserModel, cfg *config.Config) *NotificationConfigHandler {
+	return &NotificationConfigHandler{configs: configs, users: users, cfg: cfg}
 }
 
 func (h *NotificationConfigHandler) GetConfig(w http.ResponseWriter, r *http.Request) {
@@ -95,6 +96,26 @@ func (h *NotificationConfigHandler) UpdateConfig(w http.ResponseWriter, r *http.
 		return
 	}
 
+	user, userErr := h.users.GetByID(r.Context(), userID)
+	if userErr != nil || user == nil {
+		log.Printf("Failed to get user %s for tier check: %v", userID, userErr)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to verify account")
+		return
+	}
+
+	limits := domain.GetTierLimits(user.SubscriptionTier)
+
+	if !limits.ChannelAllowed("discord") {
+		body.DiscordWebhookURL = nil
+	}
+	if !limits.ChannelAllowed("telegram") {
+		body.TelegramBotToken = nil
+		body.TelegramChatID = nil
+	}
+	if !limits.ChannelAllowed("slack") {
+		body.SlackWebhookURL = nil
+	}
+
 	enabled := true
 	if body.NotificationEnabled != nil {
 		enabled = *body.NotificationEnabled

backend/internal/handlers/status.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/models"
 )
 
 // StatusHandler handles the system status endpoint.

backend/internal/handlers/stripe.go

@@ -0,0 +1,439 @@
+package handlers
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+
+	"github.com/stripe/stripe-go/v82"
+	portalsession "github.com/stripe/stripe-go/v82/billingportal/session"
+	checkoutsession "github.com/stripe/stripe-go/v82/checkout/session"
+	"github.com/stripe/stripe-go/v82/webhook"
+
+	"github.com/kjannette/koin-ping/backend/internal/config"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/middleware"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+const webhookMaxBodyBytes = 65536
+
+type StripeHandler struct {
+	users *models.UserModel
+	cfg   *config.Config
+}
+
+func NewStripeHandler(users *models.UserModel, cfg *config.Config) *StripeHandler {
+	stripe.Key = cfg.StripeSecretKey
+	return &StripeHandler{users: users, cfg: cfg}
+}
+
+func (h *StripeHandler) priceIDForTier(tier domain.SubscriptionTier) (string, error) {
+	switch tier {
+	case domain.TierPremium:
+		return h.cfg.StripePriceIDPremium, nil
+	case domain.TierPro:
+		return h.cfg.StripePriceIDPro, nil
+	default:
+		return "", fmt.Errorf("no Stripe price for tier %q", tier) //nolint:err113
+	}
+}
+
+// CreateCheckoutSession creates a Stripe Checkout session for the selected tier.
+func (h *StripeHandler) CreateCheckoutSession(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	var body struct {
+		Tier string `json:"tier"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeError(w, http.StatusBadRequest, "BAD_REQUEST", "Invalid request body")
+		return
+	}
+
+	if body.Tier == "" {
+		body.Tier = "premium"
+	}
+
+	tier := domain.SubscriptionTier(body.Tier)
+	if tier != domain.TierPremium && tier != domain.TierPro {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Tier must be 'premium' or 'pro'")
+		return
+	}
+
+	priceID, err := h.priceIDForTier(tier)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", err.Error())
+		return
+	}
+
+	user, err := h.users.GetByID(r.Context(), userID)
+	if err != nil || user == nil {
+		log.Printf("Failed to get user %s: %v", userID, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to load user")
+		return
+	}
+
+	params := &stripe.CheckoutSessionParams{
+		Mode: stripe.String(string(stripe.CheckoutSessionModeSubscription)),
+		LineItems: []*stripe.CheckoutSessionLineItemParams{
+			{
+				Price:    stripe.String(priceID),
+				Quantity: stripe.Int64(1),
+			},
+		},
+		SuccessURL:        stripe.String(h.cfg.FrontendURL + "/subscribe?payment=success&session_id={CHECKOUT_SESSION_ID}"),
+		CancelURL:         stripe.String(h.cfg.FrontendURL + "/subscribe?payment=cancelled"),
+		ClientReferenceID: stripe.String(userID),
+		CustomerEmail:     stripe.String(user.Email),
+	}
+
+	params.AddMetadata("tier", string(tier))
+
+	if user.StripeCustomerID != nil && *user.StripeCustomerID != "" {
+		params.Customer = user.StripeCustomerID
+		params.CustomerEmail = nil
+	}
+
+	s, err := checkoutsession.New(params)
+	if err != nil {
+		log.Printf("Failed to create Stripe checkout session: %v", err)
+		writeError(w, http.StatusInternalServerError, "STRIPE_ERROR", "Failed to create checkout session")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]string{"url": s.URL})
+}
+
+// GetSubscriptionStatus returns the current user's subscription state.
+func (h *StripeHandler) GetSubscriptionStatus(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	user, err := h.users.GetByID(r.Context(), userID)
+	if err != nil || user == nil {
+		log.Printf("Failed to get user %s: %v", userID, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to load user")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"subscription_status": user.SubscriptionStatus,
+		"subscription_tier":   user.SubscriptionTier,
+		"subscription_created_at": user.SubscriptionCreatedAt,
+	})
+}
+
+// VerifyCheckoutSession retrieves a completed checkout session from Stripe,
+// confirms payment, and activates the user's subscription in the database.
+func (h *StripeHandler) VerifyCheckoutSession(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	var body struct {
+		SessionID string `json:"session_id"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body.SessionID == "" {
+		writeError(w, http.StatusBadRequest, "BAD_REQUEST", "Missing session_id")
+		return
+	}
+
+	s, err := checkoutsession.Get(body.SessionID, nil)
+	if err != nil {
+		log.Printf("Failed to retrieve checkout session %s: %v", body.SessionID, err)
+		writeError(w, http.StatusBadRequest, "STRIPE_ERROR", "Invalid checkout session")
+		return
+	}
+
+	if fullJSON, marshalErr := json.MarshalIndent(s, "", "  "); marshalErr == nil {
+		log.Printf("STRIPE VERIFY CHECKOUT — FULL SESSION:\n%s", string(fullJSON))
+	}
+
+	if s.ClientReferenceID != "" && s.ClientReferenceID != userID {
+		writeError(w, http.StatusForbidden, "FORBIDDEN", "Session does not belong to this user")
+		return
+	}
+
+	if s.PaymentStatus != stripe.CheckoutSessionPaymentStatusPaid {
+		writeError(w, http.StatusBadRequest, "PAYMENT_INCOMPLETE", "Payment has not been completed")
+		return
+	}
+
+	tier := domain.TierPremium
+	if t, ok := s.Metadata["tier"]; ok && domain.IsValidTier(t) {
+		tier = domain.SubscriptionTier(t)
+	}
+
+	customerID := ""
+	if s.Customer != nil {
+		customerID = s.Customer.ID
+	}
+	subscriptionID := ""
+	if s.Subscription != nil {
+		subscriptionID = s.Subscription.ID
+	}
+
+	if customerID != "" {
+		if err := h.users.UpdateStripeCustomer(r.Context(), userID, customerID); err != nil {
+			log.Printf("VerifyCheckout: failed to save customer ID: %v", err)
+		}
+	}
+	if subscriptionID != "" && customerID != "" {
+		if err := h.users.ActivateSubscription(r.Context(), customerID, subscriptionID, "active", tier); err != nil {
+			log.Printf("VerifyCheckout: failed to activate subscription: %v", err)
+		}
+	}
+
+	log.Printf("Checkout verified for user %s, customer %s, subscription %s, tier %s", userID, customerID, subscriptionID, tier)
+	writeJSON(w, http.StatusOK, map[string]string{
+		"subscription_status": "active",
+		"subscription_tier":   string(tier),
+	})
+}
+
+// ActivateFreeTier sets the user to the free tier without Stripe involvement.
+func (h *StripeHandler) ActivateFreeTier(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	if err := h.users.ActivateFreeTier(r.Context(), userID); err != nil {
+		log.Printf("ActivateFreeTier: failed for user %s: %v", userID, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to activate free tier")
+		return
+	}
+
+	log.Printf("Free tier activated for user %s", userID)
+	writeJSON(w, http.StatusOK, map[string]string{
+		"subscription_status": "active",
+		"subscription_tier":   "free",
+	})
+}
+
+// CreateOnboardingCheckout creates a Stripe Checkout session for a user who
+// has not yet created an account. This is a public endpoint (no auth required).
+// The Firebase account is created on the frontend only after payment succeeds.
+func (h *StripeHandler) CreateOnboardingCheckout(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Email string `json:"email"`
+		Tier  string `json:"tier"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeError(w, http.StatusBadRequest, "BAD_REQUEST", "Invalid request body")
+		return
+	}
+
+	if body.Email == "" {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Email is required")
+		return
+	}
+
+	if body.Tier == "" {
+		body.Tier = "premium"
+	}
+
+	tier := domain.SubscriptionTier(body.Tier)
+	if tier != domain.TierPremium && tier != domain.TierPro {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", "Tier must be 'premium' or 'pro'")
+		return
+	}
+
+	priceID, err := h.priceIDForTier(tier)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "VALIDATION_ERROR", err.Error())
+		return
+	}
+
+	params := &stripe.CheckoutSessionParams{
+		Mode: stripe.String(string(stripe.CheckoutSessionModeSubscription)),
+		LineItems: []*stripe.CheckoutSessionLineItemParams{
+			{
+				Price:    stripe.String(priceID),
+				Quantity: stripe.Int64(1),
+			},
+		},
+		SuccessURL:    stripe.String(h.cfg.FrontendURL + "/subscribe?payment=success&session_id={CHECKOUT_SESSION_ID}"),
+		CancelURL:     stripe.String(h.cfg.FrontendURL + "/subscribe?payment=cancelled"),
+		CustomerEmail: stripe.String(body.Email),
+	}
+	params.AddMetadata("tier", string(tier))
+	params.AddMetadata("onboarding", "true")
+
+	s, err := checkoutsession.New(params)
+	if err != nil {
+		log.Printf("Failed to create onboarding checkout session: %v", err)
+		writeError(w, http.StatusInternalServerError, "STRIPE_ERROR", "Failed to create checkout session")
+		return
+	}
+
+	if fullJSON, marshalErr := json.MarshalIndent(s, "", "  "); marshalErr == nil {
+		log.Printf("STRIPE ONBOARDING CHECKOUT CREATED — FULL SESSION:\n%s", string(fullJSON))
+	}
+
+	writeJSON(w, http.StatusOK, map[string]string{"url": s.URL})
+}
+
+// CreatePortalSession creates a Stripe Billing Portal session so the user can
+// manage their subscription (cancel, update payment method, view invoices).
+func (h *StripeHandler) CreatePortalSession(w http.ResponseWriter, r *http.Request) {
+	userID := middleware.GetUserID(r.Context())
+
+	user, err := h.users.GetByID(r.Context(), userID)
+	if err != nil || user == nil {
+		log.Printf("Portal: failed to get user %s: %v", userID, err)
+		writeError(w, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to load user")
+		return
+	}
+
+	if user.StripeCustomerID == nil || *user.StripeCustomerID == "" {
+		writeError(w, http.StatusBadRequest, "NO_CUSTOMER", "No Stripe customer on file")
+		return
+	}
+
+	params := &stripe.BillingPortalSessionParams{
+		Customer:  user.StripeCustomerID,
+		ReturnURL: stripe.String(h.cfg.FrontendURL + "/account"),
+	}
+
+	s, err := portalsession.New(params)
+	if err != nil {
+		log.Printf("Portal: failed to create portal session: %v", err)
+		writeError(w, http.StatusInternalServerError, "STRIPE_ERROR", "Failed to create portal session")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]string{"url": s.URL})
+}
+
+// HandleWebhook processes incoming Stripe webhook events.
+func (h *StripeHandler) HandleWebhook(w http.ResponseWriter, r *http.Request) {
+	payload, err := io.ReadAll(io.LimitReader(r.Body, webhookMaxBodyBytes))
+	if err != nil {
+		log.Printf("Error reading webhook body: %v", err)
+		w.WriteHeader(http.StatusServiceUnavailable)
+		return
+	}
+
+	sig := r.Header.Get("Stripe-Signature")
+	event, err := webhook.ConstructEvent(payload, sig, h.cfg.StripeWebhookSecret)
+	if err != nil {
+		log.Printf("Webhook signature verification failed: %v", err)
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
+	switch event.Type {
+	case "checkout.session.completed":
+		h.handleCheckoutCompleted(r, event)
+	case "customer.subscription.updated":
+		h.handleSubscriptionUpdated(r, event)
+	case "customer.subscription.deleted":
+		h.handleSubscriptionDeleted(r, event)
+	default:
+		log.Printf("Unhandled Stripe event type: %s", event.Type)
+	}
+
+	w.WriteHeader(http.StatusOK)
+}
+
+func (h *StripeHandler) handleCheckoutCompleted(r *http.Request, event stripe.Event) {
+	log.Printf("STRIPE CHECKOUT COMPLETED — FULL RAW PAYLOAD:\n%s", string(event.Data.Raw))
+
+	var session stripe.CheckoutSession
+	if err := json.Unmarshal(event.Data.Raw, &session); err != nil {
+		log.Printf("Error parsing checkout session: %v", err)
+		return
+	}
+
+	userID := session.ClientReferenceID
+	if userID == "" {
+		log.Println("Checkout session missing client_reference_id")
+		return
+	}
+
+	tier := domain.TierPremium
+	if t, ok := session.Metadata["tier"]; ok && domain.IsValidTier(t) {
+		tier = domain.SubscriptionTier(t)
+	}
+
+	customerID := ""
+	if session.Customer != nil {
+		customerID = session.Customer.ID
+	}
+	subscriptionID := ""
+	if session.Subscription != nil {
+		subscriptionID = session.Subscription.ID
+	}
+
+	if customerID != "" {
+		if err := h.users.UpdateStripeCustomer(r.Context(), userID, customerID); err != nil {
+			log.Printf("Failed to save Stripe customer ID: %v", err)
+		}
+	}
+
+	if subscriptionID != "" && customerID != "" {
+		if err := h.users.ActivateSubscription(r.Context(), customerID, subscriptionID, "active", tier); err != nil {
+			log.Printf("Failed to activate subscription: %v", err)
+		}
+	}
+
+	log.Printf("Checkout completed for user %s, customer %s, subscription %s, tier %s", userID, customerID, subscriptionID, tier)
+}
+
+func (h *StripeHandler) handleSubscriptionUpdated(r *http.Request, event stripe.Event) {
+	var sub stripe.Subscription
+	if err := json.Unmarshal(event.Data.Raw, &sub); err != nil {
+		log.Printf("Error parsing subscription update: %v", err)
+		return
+	}
+
+	customerID := ""
+	if sub.Customer != nil {
+		customerID = sub.Customer.ID
+	}
+	if customerID == "" {
+		return
+	}
+
+	status := string(sub.Status)
+
+	// Detect tier from the subscription's current price so that
+	// upgrades/downgrades via the Stripe portal are reflected.
+	tier := domain.TierPremium
+	if sub.Items != nil {
+		for _, item := range sub.Items.Data {
+			if item.Price != nil {
+				if t := h.cfg.TierForPriceID(item.Price.ID); t != "" {
+					tier = domain.SubscriptionTier(t)
+					break
+				}
+			}
+		}
+	}
+
+	if err := h.users.ActivateSubscription(r.Context(), customerID, sub.ID, status, tier); err != nil {
+		log.Printf("Failed to update subscription: %v", err)
+	}
+
+	log.Printf("Subscription %s updated to %s (tier %s) for customer %s", sub.ID, status, tier, customerID)
+}
+
+func (h *StripeHandler) handleSubscriptionDeleted(r *http.Request, event stripe.Event) {
+	var sub stripe.Subscription
+	if err := json.Unmarshal(event.Data.Raw, &sub); err != nil {
+		log.Printf("Error parsing subscription deletion: %v", err)
+		return
+	}
+
+	customerID := ""
+	if sub.Customer != nil {
+		customerID = sub.Customer.ID
+	}
+	if customerID == "" {
+		return
+	}
+
+	if err := h.users.UpdateSubscriptionStatus(r.Context(), customerID, "canceled"); err != nil {
+		log.Printf("Failed to mark subscription canceled: %v", err)
+	}
+
+	log.Printf("Subscription canceled for customer %s", customerID)
+}

backend/internal/middleware/auth.go

@@ -0,0 +1,184 @@
+// Package middleware provides HTTP middleware for authentication and context injection.
+package middleware
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+
+	"github.com/golang-jwt/jwt/v5"
+
+	"github.com/kjannette/koin-ping/backend/internal/models"
+)
+
+type contextKey string
+
+const (
+	UserIDKey    contextKey = "user_id"
+	UserEmailKey contextKey = "user_email"
+	UserTierKey  contextKey = "user_tier"
+)
+
+type errorResponse struct {
+	Error   string `json:"error"`
+	Message string `json:"message"`
+}
+
+func writeJSON(w http.ResponseWriter, status int, v interface{}) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	json.NewEncoder(w).Encode(v) //nolint:errcheck
+}
+
+// Authenticate verifies the JWT from the Authorization header, loads the local
+// user from Postgres, and injects the user UUID + email + tier into context.
+func Authenticate(userModel *models.UserModel, jwtSecret string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			authHeader := r.Header.Get("Authorization")
+			if authHeader == "" || !strings.HasPrefix(authHeader, "Bearer ") {
+				log.Println("No Authorization header or invalid format")
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "No authentication token provided",
+				})
+				return
+			}
+
+			rawToken := strings.TrimPrefix(authHeader, "Bearer ")
+			if rawToken == "" {
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "Invalid token format",
+				})
+				return
+			}
+
+			parsed, err := jwt.Parse(rawToken, func(t *jwt.Token) (interface{}, error) {
+				if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+					return nil, jwt.ErrSignatureInvalid
+				}
+				return []byte(jwtSecret), nil
+			})
+			if err != nil || !parsed.Valid {
+				log.Printf("JWT verification failed: %v", err)
+
+				errMsg := ""
+				if err != nil {
+					errMsg = err.Error()
+				}
+				if strings.Contains(errMsg, "expired") {
+					writeJSON(w, http.StatusUnauthorized, errorResponse{
+						Error:   "TOKEN_EXPIRED",
+						Message: "Authentication token has expired",
+					})
+					return
+				}
+
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "Failed to verify authentication token",
+				})
+				return
+			}
+
+			claims, ok := parsed.Claims.(jwt.MapClaims)
+			if !ok {
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "Invalid token claims",
+				})
+				return
+			}
+
+			userID, _ := claims["sub"].(string)
+			email, _ := claims["email"].(string)
+
+			if userID == "" {
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "Invalid token: missing user ID",
+				})
+				return
+			}
+
+			user, err := userModel.GetByID(r.Context(), userID)
+			if err != nil || user == nil {
+				log.Printf("JWT auth: user %s not found in DB: %v", userID, err)
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "User account not found",
+				})
+				return
+			}
+
+			log.Printf("JWT verified — User UUID: %s, Email: %s", user.ID, email)
+
+			ctx := context.WithValue(r.Context(), UserIDKey, user.ID)
+			ctx = context.WithValue(ctx, UserEmailKey, email)
+			ctx = context.WithValue(ctx, UserTierKey, string(user.SubscriptionTier))
+
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
+
+// RequireSubscription blocks requests from users without an active subscription.
+// Must be applied after Authenticate.
+func RequireSubscription(userModel *models.UserModel) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			userID := GetUserID(r.Context())
+			if userID == "" {
+				writeJSON(w, http.StatusUnauthorized, errorResponse{
+					Error:   "UNAUTHORIZED",
+					Message: "Authentication required",
+				})
+				return
+			}
+
+			user, err := userModel.GetByID(r.Context(), userID)
+			if err != nil || user == nil {
+				log.Printf("RequireSubscription: failed to load user %s: %v", userID, err)
+				writeJSON(w, http.StatusInternalServerError, errorResponse{
+					Error:   "INTERNAL_ERROR",
+					Message: "Failed to verify subscription",
+				})
+				return
+			}
+
+			if user.SubscriptionStatus != "active" && user.SubscriptionStatus != "trialing" {
+				writeJSON(w, http.StatusForbidden, errorResponse{
+					Error:   "SUBSCRIPTION_REQUIRED",
+					Message: "An active subscription is required to use this feature",
+				})
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+func GetUserID(ctx context.Context) string {
+	if v, ok := ctx.Value(UserIDKey).(string); ok {
+		return v
+	}
+	return ""
+}
+
+func GetUserEmail(ctx context.Context) string {
+	if v, ok := ctx.Value(UserEmailKey).(string); ok {
+		return v
+	}
+	return ""
+}
+
+func GetUserTier(ctx context.Context) string {
+	if v, ok := ctx.Value(UserTierKey).(string); ok {
+		return v
+	}
+	return "free"
+}

backend/internal/middleware/auth_test.go

@@ -0,0 +1,60 @@
+package middleware
+
+import (
+	"context"
+	"testing"
+)
+
+func TestGetUserID_Empty(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	if id := GetUserID(ctx); id != "" {
+		t.Errorf("expected empty user ID, got %q", id)
+	}
+}
+
+func TestGetUserID_Set(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.WithValue(context.Background(), UserIDKey, "abc-123")
+	if id := GetUserID(ctx); id != "abc-123" {
+		t.Errorf("expected abc-123, got %q", id)
+	}
+}
+
+func TestGetUserEmail_Empty(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	if email := GetUserEmail(ctx); email != "" {
+		t.Errorf("expected empty email, got %q", email)
+	}
+}
+
+func TestGetUserEmail_Set(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.WithValue(context.Background(), UserEmailKey, "test@example.com")
+	if email := GetUserEmail(ctx); email != "test@example.com" {
+		t.Errorf("expected test@example.com, got %q", email)
+	}
+}
+
+func TestGetUserTier_Default(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	if tier := GetUserTier(ctx); tier != "free" {
+		t.Errorf("expected default tier 'free', got %q", tier)
+	}
+}
+
+func TestGetUserTier_Set(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.WithValue(context.Background(), UserTierKey, "pro")
+	if tier := GetUserTier(ctx); tier != "pro" {
+		t.Errorf("expected 'pro', got %q", tier)
+	}
+}

backend/internal/models/address.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
 )
 
 type AddressModel struct {
@@ -55,12 +55,14 @@ func (m *AddressModel) ListByUser(ctx context.Context, userID string) ([]domain.
 	return addresses, rows.Err()
 }
 
-// ListAll returns all addresses system-wide (used by the poller).
+// ListAll returns addresses for users with an active subscription (used by the poller).
 func (m *AddressModel) ListAll(ctx context.Context) ([]domain.Address, error) {
 	rows, err := m.pool.Query(ctx,
-		`SELECT id, user_id, address, label, created_at
-		 FROM addresses
-		 ORDER BY created_at DESC`,
+		`SELECT a.id, a.user_id, a.address, a.label, a.created_at
+		 FROM addresses a
+		 JOIN users u ON u.id = a.user_id
+		 WHERE u.subscription_status IN ('active', 'trialing')
+		 ORDER BY a.created_at DESC`,
 	)
 	if err != nil {
 		return nil, err
@@ -125,6 +127,15 @@ func (m *AddressModel) UpdateLabel(ctx context.Context, id int, userID string, l
 	return &a, nil
 }
 
+func (m *AddressModel) CountByUser(ctx context.Context, userID string) (int, error) {
+	var count int
+	err := m.pool.QueryRow(ctx,
+		`SELECT COUNT(*) FROM addresses WHERE user_id = $1`,
+		userID,
+	).Scan(&count)
+	return count, err
+}
+
 func (m *AddressModel) Remove(ctx context.Context, id int, userID string) (bool, error) {
 	tag, err := m.pool.Exec(ctx,
 		`DELETE FROM addresses WHERE id = $1 AND user_id = $2`,

backend/internal/models/alert_event.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
 )
 
 type AlertEventModel struct {

backend/internal/models/alert_rule.go

@@ -0,0 +1,142 @@
+package models
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+)
+
+type AlertRuleModel struct {
+	pool *pgxpool.Pool
+}
+
+func NewAlertRuleModel(pool *pgxpool.Pool) *AlertRuleModel {
+	return &AlertRuleModel{pool: pool}
+}
+
+func (m *AlertRuleModel) Create(ctx context.Context, addressID int, alertType domain.AlertType, threshold, minimum, maximum *float64) (*domain.AlertRule, error) {
+	var r domain.AlertRule
+	err := m.pool.QueryRow(ctx,
+		`INSERT INTO alert_rules (address_id, type, threshold, minimum, maximum, enabled)
+		 VALUES ($1, $2, $3, $4, $5, TRUE)
+		 RETURNING id, address_id, type, threshold, minimum, maximum, enabled, created_at`,
+		addressID, alertType.String(), threshold, minimum, maximum,
+	).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Minimum, &r.Maximum, &r.Enabled, &r.CreatedAt)
+	if err != nil {
+		return nil, err
+	}
+	return &r, nil
+}
+
+func (m *AlertRuleModel) ListByAddress(ctx context.Context, addressID int) ([]domain.AlertRule, error) {
+	rows, err := m.pool.Query(ctx,
+		`SELECT id, address_id, type, threshold, minimum, maximum, enabled, created_at
+		 FROM alert_rules
+		 WHERE address_id = $1
+		 ORDER BY created_at DESC`,
+		addressID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var rules []domain.AlertRule
+	for rows.Next() {
+		var r domain.AlertRule
+		if err := rows.Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Minimum, &r.Maximum, &r.Enabled, &r.CreatedAt); err != nil {
+			return nil, err
+		}
+		rules = append(rules, r)
+	}
+	return rules, rows.Err()
+}
+
+func (m *AlertRuleModel) FindByID(ctx context.Context, id int, userID *string) (*domain.AlertRule, error) {
+	var r domain.AlertRule
+	var err error
+
+	if userID != nil {
+		err = m.pool.QueryRow(ctx,
+			`SELECT ar.id, ar.address_id, ar.type, ar.threshold, ar.minimum, ar.maximum, ar.enabled, ar.created_at
+			 FROM alert_rules ar
+			 JOIN addresses a ON a.id = ar.address_id
+			 WHERE ar.id = $1 AND a.user_id = $2`,
+			id, *userID,
+		).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Minimum, &r.Maximum, &r.Enabled, &r.CreatedAt)
+	} else {
+		err = m.pool.QueryRow(ctx,
+			`SELECT id, address_id, type, threshold, minimum, maximum, enabled, created_at
+			 FROM alert_rules
+			 WHERE id = $1`,
+			id,
+		).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Minimum, &r.Maximum, &r.Enabled, &r.CreatedAt)
+	}
+
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &r, nil
+}
+
+func (m *AlertRuleModel) UpdateEnabled(ctx context.Context, id int, enabled bool) (*domain.AlertRule, error) {
+	var r domain.AlertRule
+	err := m.pool.QueryRow(ctx,
+		`UPDATE alert_rules
+		 SET enabled = $2
+		 WHERE id = $1
+		 RETURNING id, address_id, type, threshold, minimum, maximum, enabled, created_at`,
+		id, enabled,
+	).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Minimum, &r.Maximum, &r.Enabled, &r.CreatedAt)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &r, nil
+}
+
+func (m *AlertRuleModel) UpdateThresholds(ctx context.Context, id int, minimum, maximum *float64) (*domain.AlertRule, error) {
+	var r domain.AlertRule
+	err := m.pool.QueryRow(ctx,
+		`UPDATE alert_rules
+		 SET minimum = $2, maximum = $3
+		 WHERE id = $1
+		 RETURNING id, address_id, type, threshold, minimum, maximum, enabled, created_at`,
+		id, minimum, maximum,
+	).Scan(&r.ID, &r.AddressID, &r.Type, &r.Threshold, &r.Minimum, &r.Maximum, &r.Enabled, &r.CreatedAt)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &r, nil
+}
+
+func (m *AlertRuleModel) CountDistinctTypesByAddress(ctx context.Context, addressID int) (int, error) {
+	var count int
+	err := m.pool.QueryRow(ctx,
+		`SELECT COUNT(DISTINCT type) FROM alert_rules WHERE address_id = $1`,
+		addressID,
+	).Scan(&count)
+	return count, err
+}
+
+func (m *AlertRuleModel) Remove(ctx context.Context, id int) (bool, error) {
+	tag, err := m.pool.Exec(ctx,
+		`DELETE FROM alert_rules WHERE id = $1`,
+		id,
+	)
+	if err != nil {
+		return false, err
+	}
+	return tag.RowsAffected() > 0, nil
+}

backend/internal/models/checkpoint.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
 )
 
 type CheckpointModel struct {

backend/internal/models/notification_config.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
 )
 
 type NotificationConfigModel struct {
@@ -77,10 +77,12 @@ func (m *NotificationConfigModel) Remove(ctx context.Context, userID string) (bo
 
 func (m *NotificationConfigModel) ListEnabled(ctx context.Context) ([]domain.NotificationConfig, error) {
 	rows, err := m.pool.Query(ctx,
-		`SELECT user_id, discord_webhook_url, telegram_chat_id, telegram_bot_token,
-		        email, slack_webhook_url
-		 FROM user_notification_configs
-		 WHERE notification_enabled = TRUE`,
+		`SELECT nc.user_id, nc.discord_webhook_url, nc.telegram_chat_id, nc.telegram_bot_token,
+		        nc.email, nc.slack_webhook_url
+		 FROM user_notification_configs nc
+		 JOIN users u ON u.id = nc.user_id
+		 WHERE nc.notification_enabled = TRUE
+		   AND u.subscription_status IN ('active', 'trialing')`,
 	)
 	if err != nil {
 		return nil, err

backend/internal/models/user.go

@@ -0,0 +1,128 @@
+package models
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+)
+
+type UserModel struct {
+	pool *pgxpool.Pool
+}
+
+func NewUserModel(pool *pgxpool.Pool) *UserModel {
+	return &UserModel{pool: pool}
+}
+
+const userColumns = `id, firebase_uid, email, display_name, password_hash,
+	stripe_customer_id, stripe_subscription_id, subscription_status,
+	subscription_tier, subscription_created_at, created_at, updated_at`
+
+func scanUser(row pgx.Row) (*domain.User, error) {
+	var u domain.User
+	err := row.Scan(
+		&u.ID, &u.FirebaseUID, &u.Email, &u.DisplayName, &u.PasswordHash,
+		&u.StripeCustomerID, &u.StripeSubscriptionID, &u.SubscriptionStatus,
+		&u.SubscriptionTier, &u.SubscriptionCreatedAt, &u.CreatedAt, &u.UpdatedAt,
+	)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, nil //nolint:nilnil
+		}
+		return nil, err
+	}
+	return &u, nil
+}
+
+// FindOrCreateByFirebaseUID returns the local user for a Firebase UID,
+// creating one if it doesn't exist yet. On conflict (returning user) the
+// updated_at timestamp is refreshed.
+func (m *UserModel) FindOrCreateByFirebaseUID(ctx context.Context, firebaseUID, email string) (*domain.User, error) {
+	row := m.pool.QueryRow(ctx,
+		`INSERT INTO users (firebase_uid, email)
+		 VALUES ($1, $2)
+		 ON CONFLICT (firebase_uid) DO UPDATE SET updated_at = NOW()
+		 RETURNING `+userColumns,
+		firebaseUID, email,
+	)
+	return scanUser(row)
+}
+
+func (m *UserModel) FindByEmail(ctx context.Context, email string) (*domain.User, error) {
+	row := m.pool.QueryRow(ctx,
+		`SELECT `+userColumns+` FROM users WHERE email = $1`, email,
+	)
+	return scanUser(row)
+}
+
+func (m *UserModel) CreateWithPassword(ctx context.Context, email, passwordHash string) (*domain.User, error) {
+	row := m.pool.QueryRow(ctx,
+		`INSERT INTO users (email, password_hash)
+		 VALUES ($1, $2)
+		 RETURNING `+userColumns,
+		email, passwordHash,
+	)
+	return scanUser(row)
+}
+
+func (m *UserModel) GetByID(ctx context.Context, id string) (*domain.User, error) {
+	row := m.pool.QueryRow(ctx,
+		`SELECT `+userColumns+` FROM users WHERE id = $1`, id,
+	)
+	return scanUser(row)
+}
+
+func (m *UserModel) UpdateStripeCustomer(ctx context.Context, userID, stripeCustomerID string) error {
+	_, err := m.pool.Exec(ctx,
+		`UPDATE users SET stripe_customer_id = $2, updated_at = NOW() WHERE id = $1`,
+		userID, stripeCustomerID,
+	)
+	return err
+}
+
+func (m *UserModel) ActivateSubscription(ctx context.Context, stripeCustomerID, subscriptionID, status string, tier domain.SubscriptionTier) error {
+	_, err := m.pool.Exec(ctx,
+		`UPDATE users
+		 SET stripe_subscription_id = $2,
+		     subscription_status = $3,
+		     subscription_tier = $4,
+		     subscription_created_at = COALESCE(subscription_created_at, NOW()),
+		     updated_at = NOW()
+		 WHERE stripe_customer_id = $1`,
+		stripeCustomerID, subscriptionID, status, string(tier),
+	)
+	return err
+}
+
+func (m *UserModel) UpdateSubscriptionTier(ctx context.Context, userID string, tier domain.SubscriptionTier) error {
+	_, err := m.pool.Exec(ctx,
+		`UPDATE users SET subscription_tier = $2, updated_at = NOW() WHERE id = $1`,
+		userID, string(tier),
+	)
+	return err
+}
+
+func (m *UserModel) ActivateFreeTier(ctx context.Context, userID string) error {
+	_, err := m.pool.Exec(ctx,
+		`UPDATE users
+		 SET subscription_status = 'active',
+		     subscription_tier = 'free',
+		     subscription_created_at = COALESCE(subscription_created_at, NOW()),
+		     updated_at = NOW()
+		 WHERE id = $1`,
+		userID,
+	)
+	return err
+}
+
+func (m *UserModel) UpdateSubscriptionStatus(ctx context.Context, stripeCustomerID, status string) error {
+	_, err := m.pool.Exec(ctx,
+		`UPDATE users SET subscription_status = $2, updated_at = NOW()
+		 WHERE stripe_customer_id = $1`,
+		stripeCustomerID, status,
+	)
+	return err
+}

backend/internal/notifications/discord.go

@@ -21,17 +21,14 @@ const (
 	colorBlue   = 0x0099ff
 )
 
-// discordHTTPClient is a shared HTTP client with a timeout for Discord requests.
 var discordHTTPClient = &http.Client{ //nolint:gochecknoglobals
 	Timeout: discordHTTPTimeoutSeconds * time.Second,
 }
 
-// DiscordNotifier sends alert notifications via a Discord webhook.
+//  sends alert notifications via a Discord webhook.
 type DiscordNotifier struct {
 	WebhookURL string
 }
-
-// Send implements Notifier for Discord.
 func (d *DiscordNotifier) Send(_ context.Context, message string, meta AlertMetadata) error {
 	_, err := SendDiscordNotification(d.WebhookURL, message, meta)
 	return err
@@ -104,8 +101,12 @@ func SendDiscordNotification(webhookURL, message string, meta AlertMetadata) (bo
 	defer resp.Body.Close()
 
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		err := fmt.Errorf("discord webhook failed: HTTP %d", resp.StatusCode)
 		log.Printf("Discord webhook failed: HTTP %d", resp.StatusCode)
-		return false, fmt.Errorf("discord webhook failed: HTTP %d", resp.StatusCode)
+		if isPermanentStatusCode(resp.StatusCode) {
+			return false, &PermanentError{Err: err}
+		}
+		return false, err
 	}
 
 	return true, nil

backend/internal/notifications/email.go

@@ -10,14 +10,12 @@ import (
 	"time"
 )
 
-// EmailNotifier sends alert notifications via email (Resend).
 type EmailNotifier struct {
 	APIKey string
 	From   string
 	To     string
 }
 
-// Send implements Notifier for email.
 func (e *EmailNotifier) Send(_ context.Context, message string, meta AlertMetadata) error {
 	_, err := SendEmailNotification(e.APIKey, e.From, e.To, message, meta)
 	return err
@@ -99,8 +97,12 @@ func SendEmailNotification(apiKey, fromAddress, toAddress, message string, meta
 	defer resp.Body.Close()
 
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		err := fmt.Errorf("resend API failed: HTTP %d", resp.StatusCode)
 		log.Printf("Resend API failed: HTTP %d", resp.StatusCode)
-		return false, fmt.Errorf("resend API failed: HTTP %d", resp.StatusCode)
+		if isPermanentStatusCode(resp.StatusCode) {
+			return false, &PermanentError{Err: err}
+		}
+		return false, err
 	}
 
 	return true, nil

backend/internal/notifications/notifier.go

@@ -0,0 +1,38 @@
+package notifications
+
+import (
+	"context"
+	"errors"
+	"net/http"
+)
+
+// AlertMetadata holds context about the alert being sent.
+type AlertMetadata struct {
+	TxHash       string
+	AddressLabel string
+	AlertType    string
+	Address      string
+}
+
+type Notifier interface {
+	Send(ctx context.Context, message string, meta AlertMetadata) error
+}
+
+// PermanentError wraps errors that should not be retried (e.g. 401, 403, 404).
+type PermanentError struct{ Err error }
+
+func (e *PermanentError) Error() string { return e.Err.Error() }
+func (e *PermanentError) Unwrap() error { return e.Err }
+
+func IsPermanent(err error) bool {
+	var p *PermanentError
+	return errors.As(err, &p)
+}
+
+func isPermanentStatusCode(code int) bool {
+	return code == http.StatusUnauthorized ||
+		code == http.StatusForbidden ||
+		code == http.StatusNotFound ||
+		code == http.StatusMethodNotAllowed ||
+		code == http.StatusGone
+}

backend/internal/notifications/slack.go

@@ -87,8 +87,12 @@ func SendSlackNotification(webhookURL, message string, meta AlertMetadata) (bool
 	defer resp.Body.Close()
 
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		err := fmt.Errorf("slack webhook failed: HTTP %d", resp.StatusCode)
 		log.Printf("Slack webhook failed: HTTP %d", resp.StatusCode)
-		return false, fmt.Errorf("slack webhook failed: HTTP %d", resp.StatusCode)
+		if isPermanentStatusCode(resp.StatusCode) {
+			return false, &PermanentError{Err: err}
+		}
+		return false, err
 	}
 
 	return true, nil

backend/internal/notifications/telegram.go

@@ -63,8 +63,12 @@ func SendTelegramNotification(botToken, chatID, message string, meta AlertMetada
 	defer resp.Body.Close()
 
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		err := fmt.Errorf("telegram API failed: HTTP %d", resp.StatusCode)
 		log.Printf("Telegram API failed: HTTP %d", resp.StatusCode)
-		return false, fmt.Errorf("telegram API failed: HTTP %d", resp.StatusCode)
+		if isPermanentStatusCode(resp.StatusCode) {
+			return false, &PermanentError{Err: err}
+		}
+		return false, err
 	}
 
 	return true, nil

backend/internal/protocols/ethereum/jsonrpc.go

@@ -12,18 +12,20 @@ import (
 	"strings"
 	"time"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
 )
 
 const (
 	rpcTimeoutMS      = 30000
 	rpcMaxRetries     = 3
-	rpcRetryBaseMS  = 1000
+	rpcRetryBaseMS    = 2000
+	rpcMinIntervalMS  = 1000
 )
 
 type JsonRpcEthereum struct {
 	rpcURL     string
 	client     *http.Client
+	lastCallAt time.Time
 }
 
 func NewJsonRpcEthereum(rpcURL string) (*JsonRpcEthereum, error) {
@@ -58,6 +60,8 @@ type rpcError struct {
 }
 
 func (j *JsonRpcEthereum) callRPC(ctx context.Context, method string, params ...interface{}) (json.RawMessage, error) {
+	j.throttle(ctx)
+
 	if params == nil {
 		params = []interface{}{}
 	}
@@ -72,7 +76,25 @@ func (j *JsonRpcEthereum) callRPC(ctx context.Context, method string, params ...
 		return nil, fmt.Errorf("marshal RPC request: %w", err)
 	}
 
-	return j.callWithRetry(ctx, method, body)
+	result, callErr := j.callWithRetry(ctx, method, body)
+	j.lastCallAt = time.Now()
+
+	return result, callErr
+}
+
+func (j *JsonRpcEthereum) throttle(ctx context.Context) {
+	if j.lastCallAt.IsZero() {
+		return
+	}
+	minInterval := time.Duration(rpcMinIntervalMS) * time.Millisecond
+	elapsed := time.Since(j.lastCallAt)
+	if elapsed >= minInterval {
+		return
+	}
+	select {
+	case <-ctx.Done():
+	case <-time.After(minInterval - elapsed):
+	}
 }
 
 // callWithRetry executes a JSON-RPC POST with exponential backoff on transient errors.

backend/internal/protocols/ethereum/observer.go

@@ -3,7 +3,7 @@ package ethereum
 import (
 	"context"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
 )
 
 // EthereumObserver defines the interface for blockchain interaction.

backend/internal/services/email_digest.go

@@ -9,7 +9,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/models"
 )
 
 const (
@@ -20,7 +20,7 @@ const (
 
 var digestHTTPClient = &http.Client{Timeout: emailHTTPTimeout} //nolint:gochecknoglobals
 
-// EmailDigestService handles email setup and digest sending via Resend.
+// handles email setup and digest sending via Resend.
 type EmailDigestService struct {
 	apiKey      string
 	fromAddress string
@@ -66,7 +66,6 @@ func (s *EmailDigestService) SetupEmail(toAddress string) error {
 	return s.send(toAddress, "Koin Ping — Email Alerts Configured", html)
 }
 
-// SendDigest compiles recent alert events for a user and sends a digest email.
 func (s *EmailDigestService) SendDigest(ctx context.Context, userID, toAddress string) error {
 	if !s.Configured() {
 		return fmt.Errorf("email service not configured: RESEND_API_KEY not set") //nolint:err113
@@ -131,8 +130,6 @@ func (s *EmailDigestService) SendDigest(ctx context.Context, userID, toAddress s
 	return s.send(toAddress, subject, html)
 }
 
-// SendDigestsForAllUsers sends a digest email to every user that has
-// notifications enabled and an email configured.
 func (s *EmailDigestService) SendDigestsForAllUsers(ctx context.Context) (int, error) {
 	if !s.Configured() {
 		return 0, nil

backend/internal/services/evaluator.go

@@ -4,19 +4,23 @@ import (
 	"context"
 	"fmt"
 	"log"
+	"sync"
 	"time"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
-	"github.com/kjannette/koin-ping/backend-go/internal/notifications"
-	"github.com/kjannette/koin-ping/backend-go/internal/protocols/ethereum"
-	"github.com/kjannette/koin-ping/backend-go/internal/wei"
+	"golang.org/x/sync/semaphore"
+
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/notifications"
+	"github.com/kjannette/koin-ping/backend/internal/protocols/ethereum"
+	"github.com/kjannette/koin-ping/backend/internal/wei"
 )
 
 const (
 	notificationTimeout    = 30 * time.Second
 	notificationMaxRetries = 3
 	notificationRetryBase  = time.Second
+	maxConcurrentNotifications = 5
 )
 
 type EvaluatorService struct {
@@ -24,9 +28,10 @@ type EvaluatorService struct {
 	alertRules   *models.AlertRuleModel
 	alertEvents  *models.AlertEventModel
 	addresses    *models.AddressModel
+	users        *models.UserModel
 	notifConfigs *models.NotificationConfigModel
-	resendAPIKey string
-	emailFrom    string
+	notifSem     *semaphore.Weighted
+	notifWg      sync.WaitGroup
 }
 
 func NewEvaluatorService(
@@ -34,18 +39,17 @@ func NewEvaluatorService(
 	alertRules *models.AlertRuleModel,
 	alertEvents *models.AlertEventModel,
 	addresses *models.AddressModel,
+	users *models.UserModel,
 	notifConfigs *models.NotificationConfigModel,
-	resendAPIKey string,
-	emailFrom string,
 ) *EvaluatorService {
 	return &EvaluatorService{
 		eth:          eth,
 		alertRules:   alertRules,
 		alertEvents:  alertEvents,
 		addresses:    addresses,
+		users:        users,
 		notifConfigs: notifConfigs,
-		resendAPIKey: resendAPIKey,
-		emailFrom:    emailFrom,
+		notifSem:     semaphore.NewWeighted(maxConcurrentNotifications),
 	}
 }
 
@@ -97,9 +101,9 @@ func (s *EvaluatorService) evaluateObservation(ctx context.Context, obs domain.O
 func (s *EvaluatorService) ruleMatches(ctx context.Context, rule domain.AlertRule, obs domain.ObservedTx) (bool, error) {
 	switch rule.Type {
 	case domain.AlertIncomingTx:
-		return obs.Direction == domain.DirectionIncoming, nil
+		return s.matchesDirectionalTx(rule, obs, domain.DirectionIncoming)
 	case domain.AlertOutgoingTx:
-		return obs.Direction == domain.DirectionOutgoing, nil
+		return s.matchesDirectionalTx(rule, obs, domain.DirectionOutgoing)
 	case domain.AlertLargeTransfer:
 		return s.matchesLargeTransfer(rule, obs)
 	case domain.AlertBalanceBelow:
@@ -110,6 +114,42 @@ func (s *EvaluatorService) ruleMatches(ctx context.Context, rule domain.AlertRul
 	}
 }
 
+func (s *EvaluatorService) matchesDirectionalTx(rule domain.AlertRule, obs domain.ObservedTx, expected domain.Direction) (bool, error) {
+	if obs.Direction != expected {
+		return false, nil
+	}
+
+	if rule.Minimum != nil {
+		minWei, err := wei.FromEth(*rule.Minimum)
+		if err != nil {
+			return false, err
+		}
+		aboveMin, err := wei.GreaterThanOrEqual(obs.Value, minWei)
+		if err != nil {
+			return false, err
+		}
+		if !aboveMin {
+			return false, nil
+		}
+	}
+
+	if rule.Maximum != nil {
+		maxWei, err := wei.FromEth(*rule.Maximum)
+		if err != nil {
+			return false, err
+		}
+		belowMax, err := wei.LessThanOrEqual(obs.Value, maxWei)
+		if err != nil {
+			return false, err
+		}
+		if !belowMax {
+			return false, nil
+		}
+	}
+
+	return true, nil
+}
+
 func (s *EvaluatorService) matchesLargeTransfer(rule domain.AlertRule, obs domain.ObservedTx) (bool, error) {
 	if rule.Threshold == nil {
 		return false, nil
@@ -189,7 +229,14 @@ func (s *EvaluatorService) fireAlert(ctx context.Context, rule domain.AlertRule,
 	if addr != nil {
 		userID := addr.UserID
 		address := addr.Address
+		if err := s.notifSem.Acquire(ctx, 1); err != nil {
+			log.Printf("Failed to acquire notification semaphore for rule %d: %v", rule.ID, err)
+			return nil
+		}
+		s.notifWg.Add(1)
 		go func() {
+			defer s.notifSem.Release(1)
+			defer s.notifWg.Done()
 			notifCtx, cancel := context.WithTimeout(context.Background(), notificationTimeout)
 			defer cancel()
 			s.sendNotification(notifCtx, userID, message, obs, addressLabel, rule, address)
@@ -199,14 +246,21 @@ func (s *EvaluatorService) fireAlert(ctx context.Context, rule domain.AlertRule,
 	return nil
 }
 
-func (s *EvaluatorService) buildNotifiers(cfg *domain.NotificationConfig) []notifications.Notifier {
+// WaitForNotifications blocks until all in-flight notification goroutines finish.
+func (s *EvaluatorService) WaitForNotifications() {
+	s.notifWg.Wait()
+}
+
+func (s *EvaluatorService) buildNotifiers(cfg *domain.NotificationConfig, limits domain.TierLimits) []notifications.Notifier {
 	var notifiers []notifications.Notifier
 
-	if cfg.DiscordWebhookURL != nil && *cfg.DiscordWebhookURL != "" {
+	if limits.ChannelAllowed("discord") &&
+		cfg.DiscordWebhookURL != nil && *cfg.DiscordWebhookURL != "" {
 		notifiers = append(notifiers, &notifications.DiscordNotifier{WebhookURL: *cfg.DiscordWebhookURL})
 	}
 
-	if cfg.TelegramBotToken != nil && *cfg.TelegramBotToken != "" &&
+	if limits.ChannelAllowed("telegram") &&
+		cfg.TelegramBotToken != nil && *cfg.TelegramBotToken != "" &&
 		cfg.TelegramChatID != nil && *cfg.TelegramChatID != "" {
 		notifiers = append(notifiers, &notifications.TelegramNotifier{
 			BotToken: *cfg.TelegramBotToken,
@@ -214,17 +268,12 @@ func (s *EvaluatorService) buildNotifiers(cfg *domain.NotificationConfig) []noti
 		})
 	}
 
-	if cfg.SlackWebhookURL != nil && *cfg.SlackWebhookURL != "" {
+	if limits.ChannelAllowed("slack") &&
+		cfg.SlackWebhookURL != nil && *cfg.SlackWebhookURL != "" {
 		notifiers = append(notifiers, &notifications.SlackNotifier{WebhookURL: *cfg.SlackWebhookURL})
 	}
 
-	if cfg.Email != nil && *cfg.Email != "" {
-		notifiers = append(notifiers, &notifications.EmailNotifier{
-			APIKey: s.resendAPIKey,
-			From:   s.emailFrom,
-			To:     *cfg.Email,
-		})
-	}
+	// Email is delivered exclusively via the daily digest service, never real-time.
 
 	return notifiers
 }
@@ -242,8 +291,14 @@ func sendWithRetry(ctx context.Context, n notifications.Notifier, message string
 		}
 
 		if err := n.Send(ctx, message, meta); err != nil {
-			log.Printf("Notification attempt %d/%d failed: %v", attempt+1, notificationMaxRetries, err)
 			lastErr = err
+
+			if notifications.IsPermanent(err) {
+				log.Printf("Permanent notification failure, skipping retries: %v", err)
+				return err
+			}
+
+			log.Printf("Notification attempt %d/%d failed: %v", attempt+1, notificationMaxRetries, err)
 			continue
 		}
 
@@ -264,6 +319,13 @@ func (s *EvaluatorService) sendNotification(ctx context.Context, userID, message
 		return
 	}
 
+	user, err := s.users.GetByID(ctx, userID)
+	if err != nil || user == nil {
+		log.Printf("Failed to load user %s for tier check in notification: %v", userID, err)
+		return
+	}
+	limits := domain.GetTierLimits(user.SubscriptionTier)
+
 	meta := notifications.AlertMetadata{
 		TxHash:       obs.Hash,
 		AddressLabel: addressLabel,
@@ -271,7 +333,7 @@ func (s *EvaluatorService) sendNotification(ctx context.Context, userID, message
 		Address:      address,
 	}
 
-	for _, n := range s.buildNotifiers(notifConfig) {
+	for _, n := range s.buildNotifiers(notifConfig, limits) {
 		if err := sendWithRetry(ctx, n, message, meta); err != nil {
 			log.Printf("Notification channel failed for user %s after retries: %v", userID, err)
 		} else {

backend/internal/services/observer.go

@@ -5,9 +5,9 @@ import (
 	"log"
 	"strings"
 
-	"github.com/kjannette/koin-ping/backend-go/internal/domain"
-	"github.com/kjannette/koin-ping/backend-go/internal/models"
-	"github.com/kjannette/koin-ping/backend-go/internal/protocols/ethereum"
+	"github.com/kjannette/koin-ping/backend/internal/domain"
+	"github.com/kjannette/koin-ping/backend/internal/models"
+	"github.com/kjannette/koin-ping/backend/internal/protocols/ethereum"
 )
 
 const maxBlocksPerRun = 100

backend/internal/wei/converter.go

@@ -90,6 +90,14 @@ func LessThan(weiA, weiB string) (bool, error) {
 	return cmp < 0, nil
 }
 
+func LessThanOrEqual(weiA, weiB string) (bool, error) {
+	cmp, err := Compare(weiA, weiB)
+	if err != nil {
+		return false, err
+	}
+	return cmp <= 0, nil
+}
+
 // FormatAsEth formats a Wei string as "X.XXXX ETH".
 func FormatAsEth(weiString string, decimals int) (string, error) {
 	eth, err := ToEth(weiString)

frontend/src/App.jsx

@@ -1,27 +1,39 @@
 import { Routes, Route, Navigate } from "react-router-dom";
 import { useAuth } from "./contexts/AuthContext";
 import Navbar from "./components/Navbar";
-import Login from "./pages/Login";
-import Signup from "./pages/Signup";
-import Onboarding from "./pages/Onboarding";
-import Addresses from "./pages/Addresses";
-import Alerts from "./pages/Alerts";
-import AlertHistory from "./pages/AlertHistory";
+import Login from "./pages/login/Login";
+import Subscribe from "./pages/subscribe/Subscribe";
+import Addresses from "./pages/addresses/Addresses";
+import Alerts from "./pages/alerts/Alerts";
+import AlertHistory from "./pages/alertHistory/AlertHistory";
+import Account from "./pages/user_account/Account";
 
 export default function App() {
-    const { currentUser } = useAuth();
+  const { isAuthenticated, isSubscribed, user } = useAuth();
 
-    if (!currentUser) {
+  // Unauthenticated: show login + onboarding routes only
+  if (!isAuthenticated) {
     return (
       <Routes>
         <Route path="/login" element={<Login />} />
-                <Route path="/signup" element={<Signup />} />
-                <Route path="/onboarding" element={<Onboarding />} />
+        <Route path="/subscribe" element={<Subscribe />} />
         <Route path="*" element={<Navigate to="/login" />} />
       </Routes>
     );
   }
 
+  // Authenticated but no active subscription: force through subscribe flow
+  if (!isSubscribed) {
+    return (
+      <Routes>
+        <Route path="/subscribe" element={<Subscribe />} />
+        <Route path="/account" element={<><Navbar /><Account /></>} />
+        <Route path="*" element={<Navigate to="/subscribe" />} />
+      </Routes>
+    );
+  }
+
+  // Fully authenticated + subscribed: main app
   return (
     <div>
       <Navbar />
@@ -30,7 +42,8 @@ export default function App() {
         <Route path="/addresses" element={<Addresses />} />
         <Route path="/alerts" element={<Alerts />} />
         <Route path="/alertevents" element={<AlertHistory />} />
-                <Route path="/onboarding" element={<Onboarding />} />
+        <Route path="/account" element={<Account />} />
+        <Route path="/subscribe" element={<Subscribe />} />
         <Route path="*" element={<Navigate to="/addresses" />} />
       </Routes>
     </div>

frontend/src/api/account.js

@@ -0,0 +1,25 @@
+import { getAuthHeaders } from "./authHeaders";
+import { API_BASE } from "./config";
+
+export async function getAccount() {
+    const headers = await getAuthHeaders();
+    const res = await fetch(`${API_BASE}/user/account`, { headers });
+    if (!res.ok) {
+        const data = await res.json();
+        throw new Error(data.message || "Failed to load account");
+    }
+    return res.json();
+}
+
+export async function createPortalSession() {
+    const headers = await getAuthHeaders();
+    const res = await fetch(`${API_BASE}/stripe/create-portal-session`, {
+        method: "POST",
+        headers,
+    });
+    if (!res.ok) {
+        const data = await res.json();
+        throw new Error(data.message || "Failed to create portal session");
+    }
+    return res.json();
+}

frontend/src/api/alerts.jsx

@@ -129,6 +129,48 @@ export async function updateAlertStatus(alertId, enabled) {
     }
 }
 
+/**
+ * Update the min/max thresholds on an alert rule
+ * @param {number} alertId - Alert rule ID
+ * @param {number|null} minimum - Minimum amount (null to clear)
+ * @param {number|null} maximum - Maximum amount (null to clear)
+ * @returns {Promise<Object>} Updated alert rule
+ */
+export async function updateAlertThresholds(alertId, minimum, maximum) {
+    try {
+        const headers = await getAuthHeaders();
+        const response = await fetch(`${API_BASE}/alerts/${alertId}`, {
+            method: "PATCH",
+            headers: headers,
+            body: JSON.stringify({
+                update_min_max: true,
+                minimum: minimum ?? null,
+                maximum: maximum ?? null,
+            }),
+        });
+
+        if (!response.ok) {
+            let errorMessage = "Failed to update alert thresholds";
+            try {
+                const error = await response.json();
+                errorMessage = error.message || errorMessage;
+            } catch {
+                errorMessage = `Server error: ${response.status} ${response.statusText}`;
+            }
+            throw new Error(errorMessage);
+        }
+
+        return response.json();
+    } catch (error) {
+        if (error.message.includes("fetch")) {
+            throw new Error(
+                "Cannot connect to server. Is the backend running?",
+            );
+        }
+        throw error;
+    }
+}
+
 /**
  * Delete an alert rule
  * @param {number} alertId - Alert rule ID

frontend/src/api/auth.js

@@ -0,0 +1,27 @@
+import { API_BASE } from "./config";
+
+export async function loginUser(email, password) {
+  const res = await fetch(`${API_BASE}/auth/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email, password }),
+  });
+  const data = await res.json();
+  if (!res.ok) {
+    throw new Error(data.message || "Login failed");
+  }
+  return data;
+}
+
+export async function registerAfterCheckout(email, password, sessionId) {
+  const res = await fetch(`${API_BASE}/auth/register`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email, password, session_id: sessionId || "" }),
+  });
+  const data = await res.json();
+  if (!res.ok) {
+    throw new Error(data.message || "Registration failed");
+  }
+  return data;
+}

frontend/src/api/authHeaders.js

@@ -1,45 +1,30 @@
 /**
  * Auth Headers Helper
  *
- * Provides authentication headers for API calls
- * Includes Firebase ID token in Authorization header
+ * Provides authentication headers for API calls.
+ * Reads the JWT from localStorage (set by AuthContext on login).
  */
 
-import { auth } from "../firebase/config";
+export function getAuthHeaders() {
+  const token = localStorage.getItem("kp_token");
 
-/**
- * Get headers with authentication token
- * @returns {Promise<Object>} Headers object with Authorization
- */
-export async function getAuthHeaders() {
-    const currentUser = auth.currentUser;
-
-    if (!currentUser) {
+  if (!token) {
     throw new Error("No authenticated user");
   }
 
-    // Get Firebase ID token
-    const token = await currentUser.getIdToken();
-
   return {
     "Content-Type": "application/json",
     Authorization: `Bearer ${token}`,
   };
 }
 
-/**
- * Get headers for non-JSON requests (e.g., DELETE with no body)
- * @returns {Promise<Object>} Headers object with Authorization
- */
-export async function getAuthHeadersSimple() {
-    const currentUser = auth.currentUser;
+export function getAuthHeadersSimple() {
+  const token = localStorage.getItem("kp_token");
 
-    if (!currentUser) {
+  if (!token) {
     throw new Error("No authenticated user");
   }
 
-    const token = await currentUser.getIdToken();
-
   return {
     Authorization: `Bearer ${token}`,
   };

frontend/src/api/stripe.jsx

@@ -0,0 +1,68 @@
+import { getAuthHeaders } from "./authHeaders";
+import { API_BASE } from "./config";
+
+export async function createCheckoutSession(tier = "premium") {
+    const headers = await getAuthHeaders();
+    const res = await fetch(`${API_BASE}/stripe/create-checkout-session`, {
+        method: "POST",
+        headers: { ...headers, "Content-Type": "application/json" },
+        body: JSON.stringify({ tier }),
+    });
+    if (!res.ok) {
+        const data = await res.json();
+        throw new Error(data.message || "Failed to create checkout session");
+    }
+    return res.json();
+}
+
+export async function createOnboardingCheckout(email, tier = "premium") {
+    const res = await fetch(`${API_BASE}/stripe/create-onboarding-checkout`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email, tier }),
+    });
+    if (!res.ok) {
+        const data = await res.json();
+        throw new Error(data.message || "Failed to create checkout session");
+    }
+    return res.json();
+}
+
+export async function activateFreeTier() {
+    const headers = await getAuthHeaders();
+    const res = await fetch(`${API_BASE}/stripe/activate-free`, {
+        method: "POST",
+        headers,
+    });
+    if (!res.ok) {
+        const data = await res.json();
+        throw new Error(data.message || "Failed to activate free tier");
+    }
+    return res.json();
+}
+
+export async function verifyCheckoutSession(sessionId) {
+    const headers = await getAuthHeaders();
+    const res = await fetch(`${API_BASE}/stripe/verify-checkout`, {
+        method: "POST",
+        headers: { ...headers, "Content-Type": "application/json" },
+        body: JSON.stringify({ session_id: sessionId }),
+    });
+    if (!res.ok) {
+        const data = await res.json();
+        throw new Error(data.message || "Failed to verify checkout session");
+    }
+    return res.json();
+}
+
+export async function getSubscriptionStatus() {
+    const headers = await getAuthHeaders();
+    const res = await fetch(`${API_BASE}/stripe/subscription-status`, {
+        headers,
+    });
+    if (!res.ok) {
+        const data = await res.json();
+        throw new Error(data.message || "Failed to get subscription status");
+    }
+    return res.json();
+}

frontend/src/components/AddressForm.jsx

@@ -37,7 +37,7 @@ export default function AddressForm({ onSubmit }) {
                 placeholder="Treasury, Cold Wallet, etc."
             />
 
-            <Button type="submit" disabled={!canSubmit}>
+            <Button type="submit" disabled={!canSubmit} className="mt-md">
                 Add Address
             </Button>
         </form>

frontend/src/components/AlertForm.css

@@ -0,0 +1,7 @@
+.alert-form__options {
+  margin-bottom: 1rem;
+}
+
+.alert-form__radio {
+  display: block;
+}

frontend/src/components/AlertForm.jsx

@@ -1,6 +1,7 @@
 import { useState } from "react";
 import Input from "./Input";
 import Button from "./Button";
+import "./AlertForm.css";
 
 const ALERT_TYPES = [
     { value: "incoming_tx", label: "Incoming transaction" },
@@ -36,9 +37,9 @@ export default function AlertForm({ onSubmit }) {
 
     return (
         <form onSubmit={handleSubmit}>
-            <div style={{ marginBottom: "1rem" }}>
+            <div className="alert-form__options">
                 {ALERT_TYPES.map((opt) => (
-                    <label key={opt.value} style={{ display: "block" }}>
+                    <label key={opt.value} className="alert-form__radio">
                         <input
                             type="radio"
                             name="alertType"

frontend/src/components/Button.css

@@ -0,0 +1,14 @@
+.btn {
+  padding: 0.5rem 1rem;
+  font-size: 1rem;
+  border: none;
+  border-radius: var(--radius-md);
+  cursor: pointer;
+  color: var(--color-text);
+  transition: opacity 0.15s ease;
+}
+
+.btn:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+}

frontend/src/components/Button.jsx

@@ -1,20 +1,19 @@
+import "./Button.css";
+
 export default function Button({
     children,
     onClick,
     disabled = false,
     type = "button",
+    variant = "primary",
+    className = "",
 }) {
     return (
         <button
             type={type}
             onClick={onClick}
             disabled={disabled}
-            style={{
-                padding: "0.5rem 1rem",
-                fontSize: "1rem",
-                cursor: disabled ? "not-allowed" : "pointer",
-                opacity: disabled ? 0.6 : 1,
-            }}
+            className={`btn btn--${variant} ${className}`}
         >
             {children}
         </button>

frontend/src/components/Input.css

@@ -0,0 +1,21 @@
+.input__label {
+  display: block;
+  margin: 0.8rem 0rem 0.4rem 0rem;
+  font-size: 0.9rem;
+}
+
+.input__control {
+  width: 100%;
+  padding: 0.5rem;
+  font-size: 1rem;
+  background-color: var(--color-bg-elevated);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+  color: var(--color-text);
+}
+
+.input__control:focus {
+  outline: none;
+  border-color: var(--color-primary);
+  box-shadow: 0 0 0 2px rgba(0, 102, 204, 0.25);
+}

frontend/src/components/Input.jsx

@@ -1,3 +1,5 @@
+import "./Input.css";
+
 export default function Input({
     label,
     type = "text",
@@ -7,12 +9,12 @@ export default function Input({
     step,
     min,
     disabled = false,
+    required = false,
+    className = "",
 }) {
     return (
-        <label style={{ display: "block", marginBottom: "1rem" }}>
-            <div style={{ marginBottom: "0.25rem", fontSize: "0.9rem" }}>
-                {label}
-            </div>
+        <label className={`form-field ${className}`}>
+            <div className="input__label">{label}</div>
             <input
                 type={type}
                 value={value}
@@ -20,12 +22,9 @@ export default function Input({
                 step={step}
                 min={min}
                 disabled={disabled}
+                required={required}
                 onChange={(e) => onChange(e.target.value)}
-                style={{
-                    width: "100%",
-                    padding: "0.5rem",
-                    fontSize: "1rem",
-                }}
+                className="input__control"
             />
         </label>
     );

frontend/src/components/Navbar.css

@@ -0,0 +1,167 @@
+.navbar {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  padding: 1rem 2rem;
+  margin-bottom: 1.5rem;
+  background-color: var(--color-bg);
+  border-bottom: 1px solid var(--color-border-light);
+}
+
+/* ── Left Group: Brand + Links ───────────────────────────── */
+
+.navbar__left {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+.navbar__brand-group {
+  display: flex;
+  align-items: center;
+}
+
+.navbar__brand {
+  font-weight: 700;
+  font-size: 1.4rem;
+  color: var(--color-brand);
+  margin-right: 2rem;
+  letter-spacing: 0.5px;
+}
+
+.navbar__links {
+  display: flex;
+  gap: 0.25rem;
+}
+
+.navbar__link {
+  padding: 0.5rem 1.25rem;
+  border-radius: var(--radius-lg);
+  text-decoration: none;
+  font-size: 1.425rem;
+  font-weight: 200;
+  color: var(--color-text-subtle);
+  background-color: transparent;
+  transition: all 0.15s ease;
+}
+
+.navbar__link--active {
+  font-weight: 600;
+  color: var(--color-text);
+  background-color: var(--color-bg-card);
+}
+
+/* ── Right Group: Email + Logout + Hamburger ─────────────── */
+
+.navbar__right {
+  display: flex;
+  align-items: center;
+  gap: 1rem;
+}
+
+.navbar__user {
+  font-size: 1.275rem;
+  color: #777;
+}
+
+.navbar__user-link {
+  color: var(--color-primary);
+  text-decoration: none;
+  transition: color 0.15s ease;
+}
+
+.navbar__user-link:hover {
+  color: var(--color-primary-hover);
+}
+
+.navbar__user-link--mobile {
+  display: none;
+}
+
+.navbar__logout {
+  padding: 0.4rem 1rem;
+  font-size: 1.275rem;
+  font-weight: 400;
+  background-color: transparent;
+  color: var(--color-text-subtle);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-lg);
+  cursor: pointer;
+  transition: all 0.15s ease;
+}
+
+/* ── Hamburger Icon (hidden on desktop) ──────────────────── */
+
+.navbar__hamburger {
+  display: none;
+  flex-direction: column;
+  justify-content: center;
+  gap: 5px;
+  background: none;
+  border: none;
+  cursor: pointer;
+  padding: 4px;
+}
+
+.navbar__hamburger-bar {
+  display: block;
+  width: 28px;
+  height: 3px;
+  background-color: var(--color-brand);
+  border-radius: 2px;
+}
+
+/* ── Responsive: Tablet & below (≤ 768px) ────────────────── */
+
+@media (max-width: 768px) {
+  .navbar {
+    padding: 0.75rem 1rem;
+  }
+
+  .navbar__brand-group {
+    flex-direction: column;
+    align-items: flex-start;
+  }
+
+  .navbar__brand {
+    margin-right: 0;
+    font-size: 1.25rem;
+  }
+
+  .navbar__links {
+    display: none;
+  }
+
+  .navbar__user-link--mobile {
+    display: block;
+    font-size: 0.95rem;
+  }
+
+  .navbar__user-link--desktop {
+    display: none;
+  }
+
+  .navbar__logout {
+    display: none;
+  }
+
+  .navbar__hamburger {
+    display: flex;
+  }
+}
+
+/* ── Responsive: Mobile (≤ 480px) ────────────────────────── */
+
+@media (max-width: 480px) {
+  .navbar {
+    padding: 0.75rem;
+  }
+
+  .navbar__brand {
+    font-size: 1.15rem;
+  }
+
+  .navbar__user-link--mobile {
+    font-size: 0.85rem;
+  }
+}

frontend/src/components/Navbar.jsx

@@ -1,56 +1,40 @@
+import { useState } from "react";
 import { Link, useLocation } from "react-router-dom";
 import { useAuth } from "../contexts/AuthContext";
+import NavPanel from "./navPanel/NavPanel";
+import "./Navbar.css";
 
 const navLinks = [
   { to: "/addresses", label: "Addresses" },
   { to: "/alerts", label: "Configure Alerts" },
-  { to: "/alertevents", label: "Alert Events" },
+  { to: "/alertevents", label: "Alert Event History" },
 ];
 
 export default function Navbar() {
-  const { currentUser, logout } = useAuth();
+  const { user, logout } = useAuth();
   const location = useLocation();
+  const [isNavPanelOpen, setIsNavPanelOpen] = useState(false);
 
-  if (!currentUser) return null;
+  if (!user) return null;
 
   return (
-    <nav style={{
-      display: "flex",
-      justifyContent: "space-between",
-      alignItems: "center",
-      padding: "1rem 2rem",
-      marginBottom: "1.5rem",
-      backgroundColor: "#1a1a1a",
-      borderBottom: "1px solid #333",
-    }}>
-      <div style={{ display: "flex", alignItems: "center", gap: "0.5rem" }}>
-        <span style={{
-          fontWeight: 700,
-          fontSize: "1.4rem",
-          color: "#e62525",
-          marginRight: "2rem",
-          letterSpacing: "0.5px",
-        }}>
-          Koin Ping
-        </span>
-
-        <div style={{ display: "flex", gap: "0.25rem" }}>
+    <>
+      <nav className="navbar">
+        <div className="navbar__left">
+          <div className="navbar__brand-group">
+            <span className="navbar__brand">Koin Ping</span>
+            <Link to="/account" className="navbar__user-link navbar__user-link--mobile">
+              {user.email}
+            </Link>
+          </div>
+          <div className="navbar__links">
             {navLinks.map(({ to, label }) => {
               const isActive = location.pathname === to;
               return (
                 <Link
                   key={to}
                   to={to}
-                style={{
-                  padding: "0.5rem 1.25rem",
-                  borderRadius: "6px",
-                  textDecoration: "none",
-                  fontSize: "1.425rem",
-                  fontWeight: isActive ? 600 : 200,
-                  color: isActive ? "#fff" : "#999",
-                  backgroundColor: isActive ? "#333" : "transparent",
-                  transition: "all 0.15s ease",
-                }}
+                  className={`navbar__link ${isActive ? "navbar__link--active" : ""}`}
                 >
                   {label}
                 </Link>
@@ -59,27 +43,29 @@ export default function Navbar() {
           </div>
         </div>
 
-      <div style={{ display: "flex", alignItems: "center", gap: "1.25rem" }}>
-        <span style={{ fontSize: "1.275rem", color: "#777" }}>
-          {currentUser.email}
-        </span>
-        <button
-          onClick={logout}
-          style={{
-            padding: "0.4rem 1rem",
-            fontSize: "1.275rem",
-            fontWeight: 400,
-            backgroundColor: "transparent",
-            color: "#999",
-            border: "1px solid #444",
-            borderRadius: "6px",
-            cursor: "pointer",
-            transition: "all 0.15s ease",
-          }}
-        >
+        <div className="navbar__right">
+          <Link to="/account" className="navbar__user navbar__user-link navbar__user-link--desktop">
+            {user.email}
+          </Link>
+          <button onClick={logout} className="navbar__logout">
             Logout
           </button>
+          <button
+            className="navbar__hamburger"
+            onClick={() => setIsNavPanelOpen(true)}
+            aria-label="Open navigation menu"
+          >
+            <span className="navbar__hamburger-bar" />
+            <span className="navbar__hamburger-bar" />
+            <span className="navbar__hamburger-bar" />
+          </button>
         </div>
       </nav>
+
+      <NavPanel
+        isOpen={isNavPanelOpen}
+        onClose={() => setIsNavPanelOpen(false)}
+      />
+    </>
   );
 }

frontend/src/components/TierPicker.css

@@ -0,0 +1,120 @@
+.tier-picker {
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+  gap: 1rem;
+}
+
+.tier-picker__card {
+  position: relative;
+  display: flex;
+  flex-direction: column;
+  padding: 1.5rem 1.25rem;
+  background-color: var(--color-bg-elevated);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-xl);
+  text-align: center;
+}
+
+.tier-picker__card--highlighted {
+  border-color: var(--color-primary);
+  box-shadow: 0 0 0 1px var(--color-primary);
+}
+
+.tier-picker__card--selected {
+  border-color: var(--color-success);
+  box-shadow: 0 0 0 1px var(--color-success);
+}
+
+.tier-picker__badge {
+  position: absolute;
+  top: -10px;
+  left: 50%;
+  transform: translateX(-50%);
+  background-color: var(--color-primary);
+  color: white;
+  font-size: 0.7rem;
+  font-weight: 700;
+  padding: 2px 12px;
+  border-radius: 10px;
+  white-space: nowrap;
+}
+
+.tier-picker__name {
+  margin-bottom: 0.5rem;
+  font-size: 1.05rem;
+  color: var(--color-text);
+}
+
+.tier-picker__price {
+  margin-bottom: 1.25rem;
+}
+
+.tier-picker__amount {
+  font-size: 2rem;
+  font-weight: 700;
+  color: white;
+}
+
+.tier-picker__period {
+  font-size: 0.85rem;
+  color: var(--color-text-dimmed);
+}
+
+.tier-picker__features {
+  list-style: none;
+  padding: 0;
+  margin: 0 0 1.25rem;
+  text-align: left;
+  flex-grow: 1;
+}
+
+.tier-picker__feature {
+  padding: 0.3rem 0;
+  font-size: 0.82rem;
+  color: var(--color-text-label);
+}
+
+.tier-picker__feature--disabled {
+  color: var(--color-text-dimmed);
+  opacity: 0.55;
+}
+
+.tier-picker__check {
+  color: var(--color-primary);
+  font-weight: bold;
+  margin-right: 0.4rem;
+}
+
+.tier-picker__dash {
+  margin-right: 0.4rem;
+}
+
+.tier-picker__btn {
+  width: 100%;
+  padding: 0.6rem;
+  background-color: var(--color-bg-card);
+  border: 1px solid var(--color-border);
+  color: var(--color-text);
+  cursor: pointer;
+  border-radius: var(--radius-md);
+  font-weight: 600;
+}
+
+.tier-picker__btn:hover {
+  background-color: var(--color-primary);
+  border-color: var(--color-primary);
+}
+
+.tier-picker__btn--selected {
+  background-color: var(--color-success);
+  border-color: var(--color-success);
+  color: white;
+}
+
+@media (max-width: 768px) {
+  .tier-picker {
+    grid-template-columns: 1fr;
+    max-width: 400px;
+    margin: 0 auto;
+  }
+}

frontend/src/components/TierPicker.jsx

@@ -0,0 +1,89 @@
+import "./TierPicker.css";
+
+const TIERS = [
+  {
+    id: "free",
+    name: "Trial Monitoring",
+    price: "$0",
+    period: "",
+    features: [
+      "Monitor 1 blockchain address 24/7",
+      "Configure alerts to fire on trigger events",
+      "1 transaction alert type per trigger (email digest)",
+    ],
+    disabledFeatures: [],
+  },
+  {
+    id: "premium",
+    name: "Premium Monitoring",
+    price: "$1.99",
+    period: "/month",
+    features: [
+      "Monitor 3 blockchain addresses",
+      "Configure two types of rule-based alerts to fire on trigger events for each of the three addresses",
+      "Daily email digest alert",
+      "Real-time Discord alerts",
+      "Real-time Telegram alerts",
+    ],
+    disabledFeatures: [],
+    highlighted: true,
+  },
+  {
+    id: "pro",
+    name: "Professional Monitoring",
+    price: "$11.99",
+    period: "/month",
+    features: [
+      "Monitor unlimited blockchain addresses",
+      "Configure unlimited alert rules to fire on unlimited events on any address",
+      "Daily email digest alert",
+      "Real-time Discord alerts",
+      "Real-time Telegram alerts",
+      "Real-time Slack alerts configurable for multiple Slack groups or channels",
+      "Unlimited transaction alert types per monitored address",
+    ],
+    disabledFeatures: [],
+  },
+];
+
+export default function TierPicker({ onSelect, selectedTier }) {
+  return (
+    <div className="tier-picker">
+      {TIERS.map((tier) => (
+        <div
+          key={tier.id}
+          className={`tier-picker__card${tier.highlighted ? " tier-picker__card--highlighted" : ""}${selectedTier === tier.id ? " tier-picker__card--selected" : ""}`}
+        >
+          {tier.highlighted && (
+            <div className="tier-picker__badge">Most Popular</div>
+          )}
+          <h3 className="tier-picker__name">{tier.name}</h3>
+          <div className="tier-picker__price">
+            <span className="tier-picker__amount">{tier.price}</span>
+            {tier.period && (
+              <span className="tier-picker__period">{tier.period}</span>
+            )}
+          </div>
+          <ul className="tier-picker__features">
+            {tier.features.map((f) => (
+              <li key={f} className="tier-picker__feature">
+                <span className="tier-picker__check">&#10003;</span> {f}
+              </li>
+            ))}
+            {tier.disabledFeatures.map((f) => (
+              <li key={f} className="tier-picker__feature tier-picker__feature--disabled">
+                <span className="tier-picker__dash">&mdash;</span> {f}
+              </li>
+            ))}
+          </ul>
+          <button
+            className={`btn tier-picker__btn${selectedTier === tier.id ? " tier-picker__btn--selected" : ""}`}
+            onClick={() => onSelect(tier.id)}
+          >
+            {selectedTier === tier.id ? "Selected" : "Select"}
+          </button>
+        </div>
+      ))}
+    </div>
+  );
+}

frontend/src/components/UpgradeBanner.css

@@ -0,0 +1,32 @@
+.upgrade-banner {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  padding: 0.75rem 1rem;
+  margin-bottom: 1rem;
+  border-radius: var(--radius-md);
+  background-color: #3a2e00;
+  border: 1px solid #aa7700;
+  color: #ffcc44;
+}
+
+.upgrade-banner__message {
+  font-size: 0.88rem;
+}
+
+.upgrade-banner__link {
+  background: none;
+  border: 1px solid #aa7700;
+  color: #ffcc44;
+  padding: 0.25rem 0.75rem;
+  border-radius: var(--radius-md);
+  cursor: pointer;
+  font-size: 0.82rem;
+  font-weight: 600;
+  white-space: nowrap;
+}
+
+.upgrade-banner__link:hover {
+  background-color: #4a3800;
+}

frontend/src/components/UpgradeBanner.jsx

@@ -0,0 +1,18 @@
+import { useNavigate } from "react-router-dom";
+import "./UpgradeBanner.css";
+
+export default function UpgradeBanner({ message, linkTo = "/subscribe?upgrade=true" }) {
+  const navigate = useNavigate();
+
+  return (
+    <div className="upgrade-banner">
+      <span className="upgrade-banner__message">{message}</span>
+      <button
+        className="upgrade-banner__link"
+        onClick={() => navigate(linkTo)}
+      >
+        Upgrade
+      </button>
+    </div>
+  );
+}

frontend/src/components/navPanel/NavPanel.css

@@ -0,0 +1,78 @@
+/* ── Overlay Backdrop ─────────────────────────────────────── */
+
+.nav-panel__overlay {
+  position: fixed;
+  inset: 0;
+  background-color: rgba(0, 0, 0, 0.45);
+  opacity: 0;
+  pointer-events: none;
+  transition: opacity 0.3s ease;
+  z-index: 900;
+}
+
+.nav-panel__overlay--visible {
+  opacity: 1;
+  pointer-events: auto;
+}
+
+/* ── Slide-out Panel ─────────────────────────────────────── */
+
+.nav-panel {
+  position: fixed;
+  top: 0;
+  left: 0;
+  width: 260px;
+  height: 100%;
+  background-color: var(--color-bg-elevated);
+  border-right: 1px solid var(--color-border);
+  transform: translateX(-100%);
+  transition: transform 0.3s ease;
+  z-index: 950;
+  display: flex;
+  flex-direction: column;
+  padding: 1.5rem 0;
+}
+
+.nav-panel--open {
+  transform: translateX(0);
+}
+
+/* ── Nav Links ───────────────────────────────────────────── */
+
+.nav-panel__nav {
+  display: flex;
+  flex-direction: column;
+  flex: 1;
+}
+
+.nav-panel__link {
+  padding: 0.9rem 1.5rem;
+  text-decoration: none;
+  font-size: 1.3rem;
+  font-weight: 200;
+  color: var(--color-text-subtle);
+  border-left: 3px solid transparent;
+  transition: background-color 0.15s ease, color 0.15s ease;
+}
+
+.nav-panel__link--active {
+  font-weight: 600;
+  color: var(--color-text);
+  background-color: var(--color-bg-card);
+  border-left-color: var(--color-brand);
+}
+
+/* ── Logout Button ───────────────────────────────────────── */
+
+.nav-panel__logout {
+  margin: 1rem 1.5rem;
+  padding: 0.5rem 1rem;
+  font-size: 1.15rem;
+  font-weight: 400;
+  background-color: transparent;
+  color: var(--color-text-subtle);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-lg);
+  cursor: pointer;
+  transition: all 0.15s ease;
+}

frontend/src/components/navPanel/NavPanel.jsx

@@ -0,0 +1,52 @@
+import { Link, useLocation } from "react-router-dom";
+import { useAuth } from "../../contexts/AuthContext";
+import "./NavPanel.css";
+
+const navLinks = [
+  { to: "/addresses", label: "Addresses" },
+  { to: "/alerts", label: "Configure Alerts" },
+  { to: "/alertevents", label: "Alert Event History" },
+];
+
+export default function NavPanel({ isOpen, onClose }) {
+  const { logout } = useAuth();
+  const location = useLocation();
+
+  const handleNavClick = () => {
+    onClose();
+  };
+
+  const handleLogout = () => {
+    onClose();
+    logout();
+  };
+
+  return (
+    <>
+      <div
+        className={`nav-panel__overlay${isOpen ? " nav-panel__overlay--visible" : ""}`}
+        onClick={onClose}
+      />
+      <aside className={`nav-panel${isOpen ? " nav-panel--open" : ""}`}>
+        <nav className="nav-panel__nav">
+          {navLinks.map(({ to, label }) => {
+            const isActive = location.pathname === to;
+            return (
+              <Link
+                key={to}
+                to={to}
+                className={`nav-panel__link${isActive ? " nav-panel__link--active" : ""}`}
+                onClick={handleNavClick}
+              >
+                {label}
+              </Link>
+            );
+          })}
+        </nav>
+        <button onClick={handleLogout} className="nav-panel__logout">
+          Logout
+        </button>
+      </aside>
+    </>
+  );
+}

frontend/src/contexts/AuthContext.jsx

@@ -1,114 +1,98 @@
-/**
- * AuthContext - Firebase Authentication State Management
- *
- * Provides authentication state and methods throughout the app
- */
+import { createContext, useReducer, useContext, useEffect, useCallback, useRef } from "react";
+import authReducer, { initialState, ACTION_TYPES } from "../reducers/authReducer";
+import { loginUser, registerAfterCheckout } from "../api/auth";
+import { getAccount } from "../api/account";
 
-import { createContext, useContext, useEffect, useState } from "react";
-import {
-    createUserWithEmailAndPassword,
-    signInWithEmailAndPassword,
-    signOut,
-    onAuthStateChanged,
-} from "firebase/auth";
-import { auth } from "../firebase/config";
+const AuthContext = createContext(null);
 
-const AuthContext = createContext();
+export function AuthProvider({ children }) {
+  const [state, dispatch] = useReducer(authReducer, initialState);
+  const fetchedRef = useRef(false);
+
+  const fetchAccount = useCallback(async () => {
+    try {
+      const account = await getAccount();
+      dispatch({
+        type: ACTION_TYPES.SET_USER,
+        payload: {
+          id: account.user_id,
+          email: account.email,
+          subscriptionStatus: account.subscription_status,
+          subscriptionTier: account.subscription_tier,
+          tierLimits: account.tier_limits,
+          addressCount: account.address_count,
+        },
+      });
+    } catch {
+      dispatch({ type: ACTION_TYPES.LOGOUT });
+    }
+  }, []);
+
+  // On mount, if we have a token in localStorage, hydrate user from backend.
+  useEffect(() => {
+    if (!state.token || fetchedRef.current) return;
+    fetchedRef.current = true;
+    fetchAccount();
+  }, [state.token, fetchAccount]);
+
+  async function login(email, password) {
+    const data = await loginUser(email, password);
+    dispatch({ type: ACTION_TYPES.LOGIN_SUCCESS, payload: data });
+    fetchedRef.current = false;
+    return data;
+  }
+
+  async function register(email, password, sessionId) {
+    const data = await registerAfterCheckout(email, password, sessionId);
+    dispatch({ type: ACTION_TYPES.LOGIN_SUCCESS, payload: data });
+    fetchedRef.current = false;
+    return data;
+  }
+
+  function logout() {
+    fetchedRef.current = false;
+    dispatch({ type: ACTION_TYPES.LOGOUT });
+  }
+
+  function refreshAccount() {
+    fetchAccount();
+  }
+
+  const isAuthenticated = state.isAuthenticated && !!state.token;
+  const isSubscribed =
+    state.user?.subscriptionStatus === "active" ||
+    state.user?.subscriptionStatus === "trialing";
+
+  const tierLimits = state.user?.tierLimits || {
+    max_addresses: 1,
+    max_alert_types: 1,
+    allowed_channels: ["email"],
+  };
+
+  const value = {
+    user: state.user,
+    token: state.token,
+    isAuthenticated,
+    isSubscribed,
+    tierLimits,
+    userTier: state.user?.subscriptionTier || "free",
+    login,
+    register,
+    logout,
+    refreshAccount,
+    dispatch,
+    ACTION_TYPES,
+  };
+
+  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
+}
 
-/**
- * Hook to access auth context
- * @returns {Object} Auth context value
- */
 export function useAuth() {
   const context = useContext(AuthContext);
   if (!context) {
-        throw new Error("useAuth must be used within AuthProvider");
+    throw new Error("useAuth must be used within an AuthProvider");
   }
   return context;
 }
 
-/**
- * AuthProvider - Wraps app and provides auth state
- */
-export function AuthProvider({ children }) {
-    const [currentUser, setCurrentUser] = useState(null);
-    const [loading, setLoading] = useState(true);
-    const [error, setError] = useState(null);
-
-    /**
-     * Sign up with email and password
-     */
-    async function signup(email, password) {
-        try {
-            setError(null);
-            const result = await createUserWithEmailAndPassword(
-                auth,
-                email,
-                password,
-            );
-            return result.user;
-        } catch (err) {
-            setError(err.message);
-            throw err;
-        }
-    }
-
-    /**
-     * Log in with email and password
-     */
-    async function login(email, password) {
-        try {
-            setError(null);
-            const result = await signInWithEmailAndPassword(
-                auth,
-                email,
-                password,
-            );
-            return result.user;
-        } catch (err) {
-            setError(err.message);
-            throw err;
-        }
-    }
-
-    /**
-     * Log out current user
-     */
-    async function logout() {
-        try {
-            setError(null);
-            await signOut(auth);
-        } catch (err) {
-            setError(err.message);
-            throw err;
-        }
-    }
-
-    /**
-     * Listen for auth state changes
-     */
-    useEffect(() => {
-        const unsubscribe = onAuthStateChanged(auth, (user) => {
-            setCurrentUser(user);
-            setLoading(false);
-        });
-
-        // Cleanup subscription
-        return unsubscribe;
-    }, []);
-
-    const value = {
-        currentUser,
-        signup,
-        login,
-        logout,
-        error,
-        loading,
-    };
-
-    return (
-        <AuthContext.Provider value={value}>
-            {!loading && children}
-        </AuthContext.Provider>
-    );
-}
+export default useAuth;

frontend/src/index.css

@@ -1,5 +1,43 @@
 @import url('https://fonts.googleapis.com/css2?family=Nunito:ital,wght@0,200..1000;1,200..1000&display=swap');
 
+:root {
+  --color-primary: #0066cc;
+  --color-primary-hover: #0077ee;
+  --color-brand: #e62525;
+  --color-success: #28a745;
+  --color-success-text: #00ff00;
+  --color-success-bg: #00ff0020;
+  --color-success-border: #00ff00;
+  --color-error: #ff6666;
+  --color-error-bg: #ff000020;
+  --color-error-border: #ff0000;
+  --color-warning: #ffcc44;
+  --color-warning-bg: #3a2e00;
+  --color-warning-border: #aa7700;
+  --color-danger: #cc6666;
+  --color-danger-border: #884444;
+
+  --color-bg: #1a1a1a;
+  --color-bg-elevated: #242424;
+  --color-bg-card: #333;
+  --color-bg-section: #2a2a2a;
+
+  --color-border: #444;
+  --color-border-light: #333;
+  --color-border-section: #3a3a3a;
+
+  --color-text: white;
+  --color-text-muted: #b3b3b3;
+  --color-text-dimmed: #808080;
+  --color-text-subtle: #999;
+  --color-text-label: #ccc;
+
+  --radius-sm: 3px;
+  --radius-md: 4px;
+  --radius-lg: 6px;
+  --radius-xl: 8px;
+}
+
 *,
 *::before,
 *::after {
@@ -21,13 +59,378 @@ body {
   -moz-osx-font-smoothing: grayscale;
 }
 
-h1, h2, h3, h4, h5, h6 {
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
   font-family: 'Nunito', sans-serif;
   font-weight: 200;
 }
 
-input, select, textarea, button {
+input,
+select,
+textarea,
+button {
   font-family: 'Nunito', sans-serif;
   font-size: 1rem;
   font-weight: 200;
 }
+
+/* ── Page Layouts ─────────────────────────────────────────── */
+
+.page {
+  max-width: 800px;
+  margin: 0 auto;
+  padding: 2rem;
+}
+
+.page--wide {
+  max-width: 1400px;
+}
+
+/* ── Cards & Sections ─────────────────────────────────────── */
+
+.card {
+  padding: 1rem;
+  background-color: var(--color-bg-card);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+}
+
+.section {
+  margin-bottom: 1.5rem;
+  padding: 1rem;
+  background-color: var(--color-bg-section);
+  border-radius: var(--radius-lg);
+  border: 1px solid var(--color-border-section);
+}
+
+/* ── Form Controls ────────────────────────────────────────── */
+
+.form-field {
+  margin-bottom: 1.25rem;
+}
+
+.form-field--last {
+  margin-bottom: 1.75rem;
+}
+
+.form-label {
+  display: block;
+  margin-bottom: 0.25rem;
+  font-size: 0.9rem;
+  color: var(--color-text-label);
+}
+
+.form-control {
+  width: 100%;
+  padding: 0.5rem;
+  font-size: 1rem;
+  background-color: var(--color-bg-elevated);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+  color: var(--color-text);
+}
+
+.form-control:focus {
+  outline: none;
+  border-color: var(--color-primary);
+  box-shadow: 0 0 0 2px rgba(0, 102, 204, 0.25);
+}
+
+.form-control--mono {
+  font-family: monospace;
+}
+
+.form-select {
+  width: 100%;
+  padding: 0.5rem;
+  font-size: 1rem;
+  background-color: var(--color-bg);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+  color: var(--color-text);
+}
+
+/* ── Buttons ──────────────────────────────────────────────── */
+
+.btn {
+  padding: 0.5rem 1rem;
+  font-size: 1rem;
+  border: none;
+  border-radius: var(--radius-md);
+  cursor: pointer;
+  color: var(--color-text);
+  transition: opacity 0.15s ease;
+}
+
+.btn:disabled {
+  opacity: 0.6;
+  cursor: not-allowed;
+}
+
+.btn--primary {
+  background-color: var(--color-primary);
+}
+
+.btn--success {
+  background-color: var(--color-success);
+}
+
+.btn--secondary {
+  background-color: #6c757d;
+}
+
+.btn--danger {
+  background-color: transparent;
+  border: 1px solid var(--color-danger-border);
+  color: var(--color-danger);
+}
+
+.btn--ghost {
+  background-color: transparent;
+  border: 1px solid var(--color-border);
+  color: var(--color-text-subtle);
+}
+
+.btn--sm {
+  padding: 0.25rem 0.6rem;
+  font-size: 0.85rem;
+}
+
+.btn--lg {
+  padding: 0.75rem 1.5rem;
+}
+
+/* ── Feedback Alerts ──────────────────────────────────────── */
+
+.alert {
+  padding: 0.75rem;
+  margin-bottom: 1rem;
+  border-radius: var(--radius-md);
+}
+
+.alert--error {
+  background-color: var(--color-error-bg);
+  border: 1px solid var(--color-error-border);
+  color: var(--color-error);
+}
+
+.alert--success {
+  background-color: var(--color-success-bg);
+  border: 1px solid var(--color-success-border);
+  color: var(--color-success-text);
+}
+
+.alert--warning {
+  background-color: var(--color-warning-bg);
+  border: 1px solid var(--color-warning-border);
+  color: var(--color-warning);
+}
+
+/* ── Lists ────────────────────────────────────────────────── */
+
+.list-unstyled {
+  list-style: none;
+  padding: 0;
+}
+
+.list-item--card {
+  padding: 1rem;
+  margin-bottom: 0.5rem;
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+  background-color: var(--color-bg-card);
+}
+
+/* ── Typography Helpers ───────────────────────────────────── */
+
+.text-muted {
+  color: var(--color-text-muted);
+}
+
+.text-dimmed {
+  color: var(--color-text-dimmed);
+}
+
+.text-mono {
+  font-family: monospace;
+}
+
+.text-bold {
+  font-weight: bold;
+}
+
+.text-error {
+  color: red;
+}
+
+.text-sm {
+  font-size: 1.035rem;
+}
+
+.text-xs {
+  font-size: 0.978rem;
+}
+
+.help-link {
+  color: var(--color-primary);
+  font-size: 0.85rem;
+}
+
+/* ── Flex Utilities ───────────────────────────────────────── */
+
+.flex {
+  display: flex;
+}
+
+.flex--between {
+  justify-content: space-between;
+}
+
+.flex--center {
+  align-items: center;
+}
+
+.flex--column {
+  flex-direction: column;
+}
+
+.flex--wrap {
+  flex-wrap: wrap;
+}
+
+.gap-xs {
+  gap: 0.25rem;
+}
+
+.gap-sm {
+  gap: 0.5rem;
+}
+
+.gap-md {
+  gap: 0.75rem;
+}
+
+.gap-lg {
+  gap: 1rem;
+}
+
+/* ── Spacing Helpers ──────────────────────────────────────── */
+
+.mb-0 {
+  margin-bottom: 0;
+}
+
+.mb-sm {
+  margin-bottom: 0.5rem;
+}
+
+.mb-md {
+  margin-bottom: 1rem;
+}
+
+.mb-lg {
+  margin-bottom: 1.5rem;
+}
+
+.mb-xl {
+  margin-bottom: 2rem;
+}
+
+.mt-0 {
+  margin-top: 0;
+}
+
+.mt-md {
+  margin-top: 1rem;
+}
+
+.text-white {
+  color: white;
+}
+
+.text-white-sm {
+  color: white;
+  font-size: 0.85rem;
+}
+
+/* ── Responsive Breakpoints ──────────────────────────────── */
+/* Mobile:  <= 480px                                          */
+/* Tablet:  481px – 768px                                     */
+/* Laptop:  769px – 1024px                                    */
+/* Desktop: >= 1025px (default styles above)                  */
+
+/* Laptop & below */
+@media (max-width: 1024px) {
+  .page--wide {
+    max-width: 100%;
+  }
+}
+
+/* Tablet & below */
+@media (max-width: 768px) {
+  html {
+    font-size: 13px;
+  }
+
+  .page {
+    padding: 1.25rem;
+  }
+
+  .btn--lg {
+    padding: 0.6rem 1.2rem;
+  }
+
+  h1 {
+    font-size: 1.75rem;
+  }
+
+  h2 {
+    font-size: 1.4rem;
+  }
+
+  h3 {
+    font-size: 1.15rem;
+  }
+}
+
+/* Tier-locked: greyed out, non-interactive overlay for features above the user's plan */
+.tier-locked {
+  opacity: 0.45;
+  pointer-events: none;
+  filter: grayscale(40%);
+  user-select: none;
+}
+
+/* Mobile */
+@media (max-width: 480px) {
+  html {
+    font-size: 12px;
+  }
+
+  .page {
+    padding: 1rem 0.75rem;
+  }
+
+  .form-control,
+  .form-select {
+    font-size: 0.95rem;
+  }
+
+  .btn {
+    padding: 0.45rem 0.85rem;
+    font-size: 0.95rem;
+  }
+
+  .btn--lg {
+    padding: 0.55rem 1rem;
+    font-size: 1rem;
+  }
+
+  .section {
+    padding: 0.75rem;
+  }
+}

frontend/src/pages/Addresses.jsx

@@ -1,200 +0,0 @@
-import { useState, useEffect } from "react";
-import AddressForm from "../components/AddressForm";
-import { getAddresses, createAddress, deleteAddress, updateAddress } from "../api/addresses";
-
-export default function Addresses() {
-    const [addresses, setAddresses] = useState([]);
-    const [loading, setLoading] = useState(true);
-    const [error, setError] = useState(null);
-    const [editingId, setEditingId] = useState(null);
-    const [editLabel, setEditLabel] = useState("");
-
-    // Load addresses on mount
-    useEffect(() => {
-        async function fetchAddresses() {
-            try {
-                setLoading(true);
-                const data = await getAddresses();
-                setAddresses(data);
-            } catch (err) {
-                setError(err.message);
-                console.error("Failed to fetch addresses:", err);
-            } finally {
-                setLoading(false);
-            }
-        }
-
-        fetchAddresses();
-    }, []);
-
-    // Handle new address submission
-    async function handleAddressSubmit(data) {
-        try {
-            const newAddress = await createAddress(data);
-            setAddresses((prev) => [...prev, newAddress]);
-            setError(null);
-        } catch (err) {
-            setError(err.message);
-            console.error("Failed to create address:", err);
-        }
-    }
-
-    async function handleDelete(id, label) {
-        const displayName = label || "this address";
-        if (!window.confirm(`Remove "${displayName}"? This will also delete all associated alert rules.`)) {
-            return;
-        }
-        try {
-            await deleteAddress(id);
-            setAddresses((prev) => prev.filter((a) => a.id !== id));
-            setError(null);
-        } catch (err) {
-            setError(err.message);
-            console.error("Failed to delete address:", err);
-        }
-    }
-
-    function handleEditStart(addr) {
-        setEditingId(addr.id);
-        setEditLabel(addr.label ?? "");
-    }
-
-    async function handleEditSave(id) {
-        try {
-            const updated = await updateAddress(id, { label: editLabel || null });
-            setAddresses((prev) => prev.map((a) => (a.id === id ? updated : a)));
-            setEditingId(null);
-            setEditLabel("");
-            setError(null);
-        } catch (err) {
-            setError(err.message);
-            console.error("Failed to update address:", err);
-        }
-    }
-
-    function handleEditCancel() {
-        setEditingId(null);
-        setEditLabel("");
-    }
-
-    return (
-        <div style={{ maxWidth: "800px", margin: "0 auto", padding: "2rem" }}>
-            <h1>Tracked Addresses</h1>
-
-            <div style={{ marginBottom: "2rem" }}>
-                <AddressForm onSubmit={handleAddressSubmit} />
-            </div>
-
-            <div>
-                <h2>Existing Addresses</h2>
-                {loading && <p>Loading addresses...</p>}
-                {error && <p style={{ color: "red" }}>Error: {error}</p>}
-                {!loading && !error && addresses.length === 0 && (
-                    <p style={{ color: "#808080" }}>
-                        No addresses tracked yet. Add one above to get started.
-                    </p>
-                )}
-                {addresses.length > 0 && (
-                    <ul style={{ listStyle: "none", padding: 0 }}>
-                        {addresses.map((addr, index) => (
-                            <li
-                                key={addr.id || index}
-                                style={{
-                                    padding: "1rem",
-                                    marginBottom: "0.5rem",
-                                    border: "1px solid #444",
-                                    borderRadius: "4px",
-                                    backgroundColor: "#333",
-                                }}
-                            >
-                                <div style={{ display: "flex", justifyContent: "space-between", alignItems: "center" }}>
-                                    <div style={{ flex: 1 }}>
-                                        {editingId === addr.id ? (
-                                            <div style={{ display: "flex", gap: "0.5rem", alignItems: "center", marginBottom: "0.25rem" }}>
-                                                <input
-                                                    value={editLabel}
-                                                    onChange={(e) => setEditLabel(e.target.value)}
-                                                    placeholder="Label (optional)"
-                                                    style={{
-                                                        background: "#444",
-                                                        border: "1px solid #666",
-                                                        borderRadius: "3px",
-                                                        color: "#fff",
-                                                        padding: "0.25rem 0.5rem",
-                                                        fontSize: "0.9rem",
-                                                    }}
-                                                    onKeyDown={(e) => {
-                                                        if (e.key === "Enter") handleEditSave(addr.id);
-                                                        if (e.key === "Escape") handleEditCancel();
-                                                    }}
-                                                    autoFocus
-                                                />
-                                                <button
-                                                    onClick={() => handleEditSave(addr.id)}
-                                                    style={{ cursor: "pointer", padding: "0.25rem 0.6rem", fontSize: "0.85rem" }}
-                                                >
-                                                    Save
-                                                </button>
-                                                <button
-                                                    onClick={handleEditCancel}
-                                                    style={{ cursor: "pointer", padding: "0.25rem 0.6rem", fontSize: "0.85rem", background: "transparent", color: "#aaa", border: "1px solid #555" }}
-                                                >
-                                                    Cancel
-                                                </button>
-                                            </div>
-                                        ) : (
-                                            <div style={{ display: "flex", alignItems: "center", gap: "0.5rem", marginBottom: "0.25rem" }}>
-                                                <span style={{ fontWeight: "bold" }}>
-                                                    {addr.label || "Unlabeled"}
-                                                </span>
-                                                <button
-                                                    onClick={() => handleEditStart(addr)}
-                                                    style={{
-                                                        cursor: "pointer",
-                                                        background: "transparent",
-                                                        border: "none",
-                                                        color: "#6699cc",
-                                                        fontSize: "0.8rem",
-                                                        padding: "0",
-                                                        textDecoration: "underline",
-                                                    }}
-                                                >
-                                                    Edit
-                                                </button>
-                                            </div>
-                                        )}
-                                        <div
-                                            style={{
-                                                fontFamily: "monospace",
-                                                fontSize: "1.035rem",
-                                                color: "#b3b3b3",
-                                            }}
-                                        >
-                                            {addr.address}
-                                        </div>
-                                    </div>
-                                    <button
-                                        onClick={() => handleDelete(addr.id, addr.label)}
-                                        style={{
-                                            cursor: "pointer",
-                                            background: "transparent",
-                                            border: "1px solid #884444",
-                                            color: "#cc6666",
-                                            borderRadius: "3px",
-                                            padding: "0.3rem 0.7rem",
-                                            fontSize: "0.85rem",
-                                            marginLeft: "1rem",
-                                            flexShrink: 0,
-                                        }}
-                                    >
-                                        Remove
-                                    </button>
-                                </div>
-                            </li>
-                        ))}
-                    </ul>
-                )}
-            </div>
-        </div>
-    );
-}

frontend/src/pages/AlertHistory.jsx

@@ -1,85 +0,0 @@
-import { useState, useEffect } from "react";
-import { getAlertEvents } from "../api/alertEvents";
-
-export default function AlertHistory() {
-    const [alertEvents, setAlertEvents] = useState([]);
-    const [loading, setLoading] = useState(true);
-    const [error, setError] = useState(null);
-
-    // Fetch alert events on mount
-    useEffect(() => {
-        async function fetchAlertEvents() {
-            try {
-                setLoading(true);
-                const data = await getAlertEvents();
-                setAlertEvents(data);
-            } catch (err) {
-                setError(err.message);
-                console.error("Failed to fetch alert events:", err);
-            } finally {
-                setLoading(false);
-            }
-        }
-
-        fetchAlertEvents();
-    }, []);
-
-    if (loading) {
-        return <div style={{ padding: "2rem" }}>Loading...</div>;
-    }
-
-    if (error) {
-        return (
-            <div style={{ padding: "2rem", color: "red" }}>Error: {error}</div>
-        );
-    }
-
-    return (
-        <div style={{ maxWidth: "800px", margin: "0 auto", padding: "2rem" }}>
-            <h1>Recent Alert Events</h1>
-
-            {alertEvents.length === 0 ? (
-                <p style={{ color: "#808080" }}>No alerts yet</p>
-            ) : (
-                <ul style={{ listStyle: "none", padding: 0 }}>
-                    {alertEvents.map((event) => (
-                        <li
-                            key={event.id}
-                            style={{
-                                padding: "1rem",
-                                marginBottom: "0.75rem",
-                                border: "1px solid #444",
-                                borderRadius: "4px",
-                                backgroundColor: "#333",
-                            }}
-                        >
-                            <div style={{ marginBottom: "0.5rem" }}>
-                                {event.message}
-                            </div>
-                            {event.address_label && (
-                                <div
-                                    style={{
-                                    fontSize: "1.035rem",
-                                    color: "#808080",
-                                        marginBottom: "0.25rem",
-                                    }}
-                                >
-                                    Address: {event.address_label}
-                                </div>
-                            )}
-                            <small style={{ color: "#b3b3b3" }}>
-                                {formatTimestamp(event.timestamp)}
-                            </small>
-                        </li>
-                    ))}
-                </ul>
-            )}
-        </div>
-    );
-}
-
-// Helper to format timestamp for display
-function formatTimestamp(timestamp) {
-    const date = new Date(timestamp);
-    return date.toLocaleString();
-}

frontend/src/pages/Alerts.jsx

@@ -1,842 +0,0 @@
-import { useState, useEffect } from "react";
-import AlertForm from "../components/AlertForm";
-import Button from "../components/Button";
-import { getAddresses } from "../api/addresses";
-import {
-    getAlerts,
-    createAlert,
-    updateAlertStatus,
-    deleteAlert,
-} from "../api/alerts";
-import {
-    getNotificationConfig,
-    updateNotificationConfig,
-    testNotificationChannels,
-    setupEmail,
-    sendEmailDigest,
-} from "../api/notificationConfig";
-
-const inputStyle = {
-    width: "100%",
-    padding: "0.5rem",
-    fontSize: "0.9rem",
-    backgroundColor: "#1a1a1a",
-    border: "1px solid #444",
-    borderRadius: "4px",
-    color: "white",
-    fontFamily: "monospace",
-    boxSizing: "border-box",
-};
-
-const labelStyle = {
-    display: "block",
-    marginBottom: "0.25rem",
-    fontSize: "0.9rem",
-    color: "#ccc",
-};
-
-const helpLinkStyle = { color: "#0066cc", fontSize: "0.85rem" };
-
-const sectionStyle = {
-    marginBottom: "1.5rem",
-    padding: "1rem",
-    backgroundColor: "#2a2a2a",
-    borderRadius: "6px",
-    border: "1px solid #3a3a3a",
-};
-
-export default function Alerts() {
-    const [addresses, setAddresses] = useState([]);
-    const [selectedAddressId, setSelectedAddressId] = useState(null);
-    const [alerts, setAlerts] = useState([]);
-    const [loading, setLoading] = useState(true);
-    const [error, setError] = useState(null);
-
-    // Notification config state
-    const [notificationEnabled, setNotificationEnabled] = useState(false);
-    const [discordWebhookUrl, setDiscordWebhookUrl] = useState("");
-    const [telegramBotToken, setTelegramBotToken] = useState("");
-    const [telegramChatId, setTelegramChatId] = useState("");
-    const [email, setEmail] = useState("");
-    const [slackWebhookUrl, setSlackWebhookUrl] = useState("");
-    const [notificationLoading, setNotificationLoading] = useState(false);
-    const [notificationError, setNotificationError] = useState(null);
-    const [notificationSuccess, setNotificationSuccess] = useState(null);
-    const [testingChannels, setTestingChannels] = useState(false);
-    const [settingUpEmail, setSettingUpEmail] = useState(false);
-    const [sendingDigest, setSendingDigest] = useState(false);
-    const [hasExistingConfig, setHasExistingConfig] = useState(false);
-
-    useEffect(() => {
-        async function fetchData() {
-            try {
-                setLoading(true);
-
-                const addressData = await getAddresses();
-                setAddresses(addressData);
-                if (addressData.length > 0) {
-                    setSelectedAddressId(addressData[0].id);
-                }
-
-                const configData = await getNotificationConfig();
-                setNotificationEnabled(
-                    configData.notification_enabled !== false,
-                );
-                setDiscordWebhookUrl(configData.discord_webhook_url || "");
-                setTelegramBotToken(configData.telegram_bot_token || "");
-                setTelegramChatId(configData.telegram_chat_id || "");
-                setEmail(configData.email || "");
-                setSlackWebhookUrl(configData.slack_webhook_url || "");
-
-                const hasSaved =
-                    !!configData.discord_webhook_url ||
-                    !!configData.telegram_bot_token ||
-                    !!configData.telegram_chat_id ||
-                    !!configData.email ||
-                    !!configData.slack_webhook_url;
-                setHasExistingConfig(hasSaved);
-            } catch (err) {
-                setError(err.message);
-                console.error("Failed to fetch data:", err);
-            } finally {
-                setLoading(false);
-            }
-        }
-
-        fetchData();
-    }, []);
-
-    useEffect(() => {
-        if (!selectedAddressId) {
-            setAlerts([]);
-            return;
-        }
-
-        async function fetchAlerts() {
-            try {
-                const data = await getAlerts(selectedAddressId);
-                setAlerts(data);
-                setError(null);
-            } catch (err) {
-                setError(err.message);
-                console.error("Failed to fetch alerts:", err);
-            }
-        }
-
-        fetchAlerts();
-    }, [selectedAddressId]);
-
-    async function handleAlertSubmit(data) {
-        if (!selectedAddressId) return;
-
-        try {
-            const newAlert = await createAlert(selectedAddressId, data);
-            setAlerts((prev) => [...prev, newAlert]);
-            setError(null);
-        } catch (err) {
-            setError(err.message);
-            console.error("Failed to create alert:", err);
-        }
-    }
-
-    async function handleToggleAlert(alertId, currentStatus) {
-        try {
-            const updated = await updateAlertStatus(alertId, !currentStatus);
-            setAlerts((prev) =>
-                prev.map((alert) => (alert.id === alertId ? updated : alert)),
-            );
-            setError(null);
-        } catch (err) {
-            setError(err.message);
-            console.error("Failed to update alert:", err);
-        }
-    }
-
-    async function handleDeleteAlert(alertId) {
-        try {
-            await deleteAlert(alertId);
-            setAlerts((prev) => prev.filter((alert) => alert.id !== alertId));
-            setError(null);
-        } catch (err) {
-            setError(err.message);
-            console.error("Failed to delete alert:", err);
-        }
-    }
-
-    async function handleSaveNotificationConfig() {
-        if (hasExistingConfig) {
-            const confirmed = window.confirm(
-                "This will overwrite your previously saved notification settings. Continue?",
-            );
-            if (!confirmed) return;
-        }
-
-        try {
-            setNotificationLoading(true);
-            setNotificationError(null);
-            setNotificationSuccess(null);
-
-            const config = {
-                notification_enabled: notificationEnabled,
-                discord_webhook_url: discordWebhookUrl || null,
-                telegram_bot_token: telegramBotToken || null,
-                telegram_chat_id: telegramChatId || null,
-                email: email || null,
-                slack_webhook_url: slackWebhookUrl || null,
-            };
-
-            await updateNotificationConfig(config);
-            setHasExistingConfig(true);
-            setNotificationSuccess("Notification settings saved!");
-            setTimeout(() => setNotificationSuccess(null), 3000);
-        } catch (err) {
-            setNotificationError(err.message);
-            console.error("Failed to save notification config:", err);
-        } finally {
-            setNotificationLoading(false);
-        }
-    }
-
-    async function handleTestChannels() {
-        try {
-            setTestingChannels(true);
-            setNotificationError(null);
-            setNotificationSuccess(null);
-
-            const data = await testNotificationChannels();
-            const results = data.results || [];
-
-            const failed = results.filter((r) => !r.success);
-            const succeeded = results.filter((r) => r.success);
-
-            if (failed.length === 0 && succeeded.length > 0) {
-                setNotificationSuccess(
-                    `Test sent to: ${succeeded.map((r) => r.channel).join(", ")}`,
-                );
-            } else if (failed.length > 0 && succeeded.length > 0) {
-                setNotificationSuccess(
-                    `Sent: ${succeeded.map((r) => r.channel).join(", ")}. Failed: ${failed.map((r) => `${r.channel} (${r.error})`).join(", ")}`,
-                );
-            } else if (failed.length > 0) {
-                setNotificationError(
-                    `Test failed: ${failed.map((r) => `${r.channel} (${r.error})`).join(", ")}`,
-                );
-            }
-
-            setTimeout(() => {
-                setNotificationSuccess(null);
-                setNotificationError(null);
-            }, 6000);
-        } catch (err) {
-            setNotificationError(err.message);
-        } finally {
-            setTestingChannels(false);
-        }
-    }
-
-    async function handleSetupEmail() {
-        try {
-            setSettingUpEmail(true);
-            setNotificationError(null);
-            setNotificationSuccess(null);
-
-            await handleSaveNotificationConfig();
-
-            const result = await setupEmail();
-            setNotificationSuccess(
-                result.message || "Confirmation email sent!",
-            );
-            setTimeout(() => setNotificationSuccess(null), 5000);
-        } catch (err) {
-            setNotificationError(err.message);
-        } finally {
-            setSettingUpEmail(false);
-        }
-    }
-
-    async function handleSendDigest() {
-        try {
-            setSendingDigest(true);
-            setNotificationError(null);
-            setNotificationSuccess(null);
-
-            const result = await sendEmailDigest();
-            setNotificationSuccess(result.message || "Digest email sent!");
-            setTimeout(() => setNotificationSuccess(null), 5000);
-        } catch (err) {
-            setNotificationError(err.message);
-        } finally {
-            setSendingDigest(false);
-        }
-    }
-
-    const selectedAddress = addresses.find((a) => a.id === selectedAddressId);
-
-    if (loading) {
-        return <div style={{ padding: "2rem" }}>Loading addresses...</div>;
-    }
-
-    if (addresses.length === 0) {
-        return (
-            <div style={{ padding: "2rem" }}>
-                <p>
-                    No addresses tracked yet. Add an address first to create
-                    alerts.
-                </p>
-            </div>
-        );
-    }
-
-    return (
-        <div style={{ maxWidth: "1400px", margin: "0 auto", padding: "2rem" }}>
-            <h1 style={{ marginBottom: "2rem" }}>
-                Alert Rules & Notifications
-            </h1>
-
-            <div
-                style={{
-                    display: "grid",
-                    gridTemplateColumns: "1fr 1fr",
-                    gap: "2rem",
-                    alignItems: "start",
-                }}
-            >
-                {/* LEFT COLUMN: Alert Rules */}
-                <div>
-                    <h2 style={{ marginTop: 0 }}>Alert Rules</h2>
-
-                    <div style={{ marginBottom: "2rem" }}>
-                        <label
-                            style={{ display: "block", marginBottom: "0.5rem" }}
-                        >
-                            <strong>Select Address:</strong>
-                        </label>
-                        <select
-                            value={selectedAddressId || ""}
-                            onChange={(e) =>
-                                setSelectedAddressId(Number(e.target.value))
-                            }
-                            style={{
-                                width: "100%",
-                                padding: "0.5rem",
-                                fontSize: "1rem",
-                                backgroundColor: "#1a1a1a",
-                                border: "1px solid #444",
-                                borderRadius: "4px",
-                                color: "white",
-                            }}
-                        >
-                            {addresses.map((addr) => (
-                                <option key={addr.id} value={addr.id}>
-                                    {addr.label || "Unlabeled"} - {addr.address}
-                                </option>
-                            ))}
-                        </select>
-                    </div>
-
-                    {selectedAddress && (
-                        <>
-                            <div
-                                style={{
-                                    padding: "1rem",
-                                    marginBottom: "2rem",
-                                    backgroundColor: "#333",
-                                    borderRadius: "4px",
-                                    border: "1px solid #444",
-                                }}
-                            >
-                                <div
-                                    style={{
-                                        fontSize: "1.035rem",
-                                        color: "#b3b3b3",
-                                    }}
-                                >
-                                    Managing alerts for:
-                                </div>
-                                <div
-                                    style={{
-                                        fontWeight: "bold",
-                                        marginTop: "0.25rem",
-                                    }}
-                                >
-                                    {selectedAddress.label || "Unlabeled"}
-                                </div>
-                                <div
-                                    style={{
-                                        fontFamily: "monospace",
-                                        fontSize: "1.035rem",
-                                        color: "#b3b3b3",
-                                    }}
-                                >
-                                    {selectedAddress.address}
-                                </div>
-                            </div>
-
-                            <div style={{ marginBottom: "2rem" }}>
-                                <h3>Create New Alert</h3>
-                                <AlertForm onSubmit={handleAlertSubmit} />
-                            </div>
-
-                            <div>
-                                <h3>Active Alert Rules</h3>
-                                {error && (
-                                    <p style={{ color: "red" }}>
-                                        Error: {error}
-                                    </p>
-                                )}
-                                {alerts.length === 0 ? (
-                                    <p style={{ color: "#666" }}>
-                                        No alert rules defined yet. Create one
-                                        above.
-                                    </p>
-                                ) : (
-                                    <ul
-                                        style={{
-                                            listStyle: "none",
-                                            padding: 0,
-                                        }}
-                                    >
-                                        {alerts.map((alert) => (
-                                            <li
-                                                key={alert.id}
-                                                style={{
-                                                    padding: "1rem",
-                                                    marginBottom: "0.5rem",
-                                                    border: "1px solid #444",
-                                                    borderRadius: "4px",
-                                                    backgroundColor: "#333",
-                                                    opacity: alert.enabled
-                                                        ? 1
-                                                        : 0.6,
-                                                }}
-                                            >
-                                                <div
-                                                    style={{
-                                                        display: "flex",
-                                                        justifyContent:
-                                                            "space-between",
-                                                        alignItems:
-                                                            "flex-start",
-                                                    }}
-                                                >
-                                                    <div style={{ flex: 1 }}>
-                                                        <div
-                                                            style={{
-                                                                fontWeight:
-                                                                    "bold",
-                                                                marginBottom:
-                                                                    "0.25rem",
-                                                            }}
-                                                        >
-                                                            {formatAlertType(
-                                                                alert.type,
-                                                            )}
-                                                        </div>
-                                                        {alert.threshold && (
-                                                            <div
-                                                                style={{
-                                                                    fontSize:
-                                                                        "1.035rem",
-                                                                    color: "#b3b3b3",
-                                                                }}
-                                                            >
-                                                                Threshold:{" "}
-                                                                {
-                                                                    alert.threshold
-                                                                }{" "}
-                                                                ETH
-                                                            </div>
-                                                        )}
-                                                        <div
-                                                            style={{
-                                                                fontSize:
-                                                                    "0.978rem",
-                                                                color: "#808080",
-                                                                marginTop:
-                                                                    "0.25rem",
-                                                            }}
-                                                        >
-                                                            Status:{" "}
-                                                            {alert.enabled
-                                                                ? "Enabled"
-                                                                : "Disabled"}
-                                                        </div>
-                                                    </div>
-                                                    <div
-                                                        style={{
-                                                            display: "flex",
-                                                            gap: "0.5rem",
-                                                        }}
-                                                    >
-                                                        <Button
-                                                            onClick={() =>
-                                                                handleToggleAlert(
-                                                                    alert.id,
-                                                                    alert.enabled,
-                                                                )
-                                                            }
-                                                        >
-                                                            {alert.enabled
-                                                                ? "Disable"
-                                                                : "Enable"}
-                                                        </Button>
-                                                        <Button
-                                                            onClick={() =>
-                                                                handleDeleteAlert(
-                                                                    alert.id,
-                                                                )
-                                                            }
-                                                        >
-                                                            Delete
-                                                        </Button>
-                                                    </div>
-                                                </div>
-                                            </li>
-                                        ))}
-                                    </ul>
-                                )}
-                            </div>
-                        </>
-                    )}
-                </div>
-
-                {/* RIGHT COLUMN: Notification Settings */}
-                <div>
-                    <h2 style={{ marginTop: 0 }}>Notification Settings</h2>
-
-                    {notificationSuccess && (
-                        <div
-                            style={{
-                                padding: "0.75rem",
-                                marginBottom: "1rem",
-                                backgroundColor: "#00ff0020",
-                                border: "1px solid #00ff00",
-                                borderRadius: "4px",
-                                color: "#00ff00",
-                            }}
-                        >
-                            {notificationSuccess}
-                        </div>
-                    )}
-
-                    {notificationError && (
-                        <div
-                            style={{
-                                padding: "0.75rem",
-                                marginBottom: "1rem",
-                                backgroundColor: "#ff000020",
-                                border: "1px solid #ff0000",
-                                borderRadius: "4px",
-                                color: "#ff6666",
-                            }}
-                        >
-                            {notificationError}
-                        </div>
-                    )}
-
-                    {/* Master toggle */}
-                    <div
-                        style={{
-                            marginBottom: "1.5rem",
-                            padding: "1rem",
-                            backgroundColor: "#333",
-                            borderRadius: "4px",
-                        }}
-                    >
-                        <label
-                            style={{
-                                display: "flex",
-                                alignItems: "center",
-                                cursor: "pointer",
-                            }}
-                        >
-                            <input
-                                type="checkbox"
-                                checked={notificationEnabled}
-                                onChange={(e) =>
-                                    setNotificationEnabled(e.target.checked)
-                                }
-                                style={{
-                                    marginRight: "0.5rem",
-                                    width: "18px",
-                                    height: "18px",
-                                }}
-                            />
-                            <span style={{ fontWeight: "bold" }}>
-                                Enable Notifications
-                            </span>
-                        </label>
-                        <div
-                            style={{
-                                fontSize: "0.978rem",
-                                color: "#808080",
-                                marginTop: "0.5rem",
-                                marginLeft: "26px",
-                            }}
-                        >
-                            Master switch for all notification channels
-                        </div>
-                    </div>
-
-                    {/* All channel settings — hidden when master toggle is off */}
-                    <div
-                        style={{
-                            display: notificationEnabled ? "block" : "none",
-                        }}
-                    >
-                        {/* Telegram */}
-                        <div style={sectionStyle}>
-                            <h3 style={{ marginTop: 0, marginBottom: "1rem" }}>
-                                Telegram
-                            </h3>
-
-                            <div style={{ marginBottom: "0.75rem" }}>
-                                <label style={labelStyle}>Bot Token</label>
-                                <input
-                                    type="text"
-                                    value={telegramBotToken}
-                                    onChange={(e) =>
-                                        setTelegramBotToken(e.target.value)
-                                    }
-                                    placeholder="123456789:ABCdefGHIjklMNOpqrSTUvwxYZ"
-                                    style={inputStyle}
-                                />
-                            </div>
-
-                            <div style={{ marginBottom: "0.5rem" }}>
-                                <label style={labelStyle}>Chat ID</label>
-                                <input
-                                    type="text"
-                                    value={telegramChatId}
-                                    onChange={(e) =>
-                                        setTelegramChatId(e.target.value)
-                                    }
-                                    placeholder="-1001234567890"
-                                    style={inputStyle}
-                                />
-                            </div>
-
-                            <a
-                                href="https://core.telegram.org/bots#how-do-i-create-a-bot"
-                                target="_blank"
-                                rel="noopener noreferrer"
-                                style={helpLinkStyle}
-                            >
-                                How to create a Telegram bot & get your Chat ID
-                            </a>
-                        </div>
-
-                        {/* Email */}
-                        <div style={sectionStyle}>
-                            <h3 style={{ marginTop: 0, marginBottom: "1rem" }}>
-                                Email
-                            </h3>
-
-                            <div style={{ marginBottom: "0.75rem" }}>
-                                <label style={labelStyle}>Email Address</label>
-                                <input
-                                    type="email"
-                                    value={email}
-                                    onChange={(e) => setEmail(e.target.value)}
-                                    placeholder="you@example.com"
-                                    style={inputStyle}
-                                />
-                            </div>
-
-                            <div
-                                style={{
-                                    fontSize: "0.85rem",
-                                    color: "#808080",
-                                    marginBottom: "0.75rem",
-                                }}
-                            >
-                                Alert notifications and digests will be sent to
-                                this address
-                            </div>
-
-                            <div
-                                style={{
-                                    display: "flex",
-                                    gap: "0.5rem",
-                                }}
-                            >
-                                <button
-                                    onClick={handleSetupEmail}
-                                    disabled={settingUpEmail || !email}
-                                    style={{
-                                        padding: "0.5rem 1rem",
-                                        fontSize: "0.85rem",
-                                        backgroundColor:
-                                            settingUpEmail || !email
-                                                ? "#333"
-                                                : "#0066cc",
-                                        color: "white",
-                                        border: "none",
-                                        borderRadius: "4px",
-                                        cursor:
-                                            settingUpEmail || !email
-                                                ? "not-allowed"
-                                                : "pointer",
-                                    }}
-                                >
-                                    {settingUpEmail
-                                        ? "Setting up..."
-                                        : "Verify Email"}
-                                </button>
-
-                                <button
-                                    onClick={handleSendDigest}
-                                    disabled={sendingDigest || !email}
-                                    style={{
-                                        padding: "0.5rem 1rem",
-                                        fontSize: "0.85rem",
-                                        backgroundColor:
-                                            sendingDigest || !email
-                                                ? "#333"
-                                                : "#6c757d",
-                                        color: "white",
-                                        border: "none",
-                                        borderRadius: "4px",
-                                        cursor:
-                                            sendingDigest || !email
-                                                ? "not-allowed"
-                                                : "pointer",
-                                    }}
-                                >
-                                    {sendingDigest
-                                        ? "Sending..."
-                                        : "Send Digest Now"}
-                                </button>
-                            </div>
-                        </div>
-
-                        {/* Discord */}
-                        <div style={sectionStyle}>
-                            <h3 style={{ marginTop: 0, marginBottom: "1rem" }}>
-                                Discord
-                            </h3>
-
-                            <div style={{ marginBottom: "0.5rem" }}>
-                                <label style={labelStyle}>
-                                    Discord Webhook URL
-                                </label>
-                                <input
-                                    type="text"
-                                    value={discordWebhookUrl}
-                                    onChange={(e) =>
-                                        setDiscordWebhookUrl(e.target.value)
-                                    }
-                                    placeholder="https://discord.com/api/webhooks/..."
-                                    style={inputStyle}
-                                />
-                            </div>
-
-                            <a
-                                href="https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks"
-                                target="_blank"
-                                rel="noopener noreferrer"
-                                style={helpLinkStyle}
-                            >
-                                How to get a Discord webhook URL
-                            </a>
-                        </div>
-
-                        {/* Slack */}
-                        <div style={sectionStyle}>
-                            <h3 style={{ marginTop: 0, marginBottom: "1rem" }}>
-                                Slack
-                            </h3>
-
-                            <div style={{ marginBottom: "0.5rem" }}>
-                                <label style={labelStyle}>
-                                    Slack Webhook URL
-                                </label>
-                                <input
-                                    type="text"
-                                    value={slackWebhookUrl}
-                                    onChange={(e) =>
-                                        setSlackWebhookUrl(e.target.value)
-                                    }
-                                    placeholder="https://hooks.slack.com/services/..."
-                                    style={inputStyle}
-                                />
-                            </div>
-
-                            <a
-                                href="https://api.slack.com/messaging/webhooks"
-                                target="_blank"
-                                rel="noopener noreferrer"
-                                style={helpLinkStyle}
-                            >
-                                How to set up Slack Incoming Webhooks
-                            </a>
-                        </div>
-
-                        {/* Save & Test buttons at the bottom */}
-                        <div
-                            style={{
-                                display: "flex",
-                                gap: "0.75rem",
-                                marginTop: "1rem",
-                            }}
-                        >
-                            <button
-                                onClick={handleSaveNotificationConfig}
-                                disabled={notificationLoading}
-                                style={{
-                                    padding: "0.75rem 1.5rem",
-                                    fontSize: "1rem",
-                                    backgroundColor: notificationLoading
-                                        ? "#333"
-                                        : "#0066cc",
-                                    color: "white",
-                                    border: "none",
-                                    borderRadius: "4px",
-                                    cursor: notificationLoading
-                                        ? "not-allowed"
-                                        : "pointer",
-                                }}
-                            >
-                                {notificationLoading
-                                    ? "Saving..."
-                                    : "Save Settings"}
-                            </button>
-
-                            <button
-                                onClick={handleTestChannels}
-                                disabled={testingChannels}
-                                style={{
-                                    padding: "0.75rem 1.5rem",
-                                    fontSize: "1rem",
-                                    backgroundColor: testingChannels
-                                        ? "#333"
-                                        : "#28a745",
-                                    color: "white",
-                                    border: "none",
-                                    borderRadius: "4px",
-                                    cursor: testingChannels
-                                        ? "not-allowed"
-                                        : "pointer",
-                                }}
-                            >
-                                {testingChannels
-                                    ? "Testing..."
-                                    : "Test All Channels"}
-                            </button>
-                        </div>
-                    </div>
-                </div>
-            </div>
-        </div>
-    );
-}
-
-function formatAlertType(type) {
-    const labels = {
-        incoming_tx: "Incoming transaction",
-        outgoing_tx: "Outgoing transaction",
-        large_transfer: "Large transfer",
-        balance_below: "Balance below threshold",
-    };
-    return labels[type] || type;
-}

frontend/src/pages/Login.css

@@ -1,88 +0,0 @@
-.login-page {
-  min-height: 100vh;
-  background-image: url(/ping.png);
-  background-size: 67%;
-  background-position: center;
-  background-repeat: no-repeat;
-}
-
-.login-card {
-  max-width: 400px;
-  margin: 20px auto;
-  padding: 2rem;
-  padding-top: 8rem;
-  border: 1px solid #333;
-  border-radius: 8px;
-  background-color: rgba(0, 0, 0, 0.75);
-}
-
-.login-heading {
-  margin-bottom: 2rem;
-  text-align: center;
-}
-
-.login-brand {
-  color: #e62525;
-}
-
-.login-error {
-  padding: 0.75rem;
-  margin-bottom: 1rem;
-  background-color: #ff000020;
-  border: 1px solid #ff0000;
-  border-radius: 4px;
-  color: #ff6666;
-}
-
-.login-field {
-  margin-bottom: 1rem;
-}
-
-.login-field-last {
-  margin-bottom: 1.5rem;
-}
-
-.login-label {
-  display: block;
-  margin-bottom: 0.5rem;
-}
-
-.login-input {
-  width: 100%;
-  padding: 0.5rem;
-  font-size: 1.2rem;
-  background-color: #242424;
-  border: 1px solid #444;
-  border-radius: 4px;
-  color: white;
-}
-
-.login-button {
-  width: 100%;
-  padding: 0.75rem;
-  font-size: 1.2rem;
-  background-color: #0066cc;
-  color: white;
-  border: none;
-  border-radius: 4px;
-  cursor: pointer;
-}
-
-.login-button:disabled {
-  background-color: #333;
-  cursor: not-allowed;
-}
-
-.login-footer {
-  margin-top: 1.5rem;
-  text-align: center;
-}
-
-.login-footer-text {
-  color: #b3b3b3;
-}
-
-.login-signup-link {
-  color: #0066cc;
-  text-decoration: none;
-}