Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Filament/Concerns/WarnsOfConcurrentEditing.php

@@ -0,0 +1,154 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Concerns;
+
+use App\Support\Presence;
+use Filament\Notifications\Notification;
+use Filament\Support\Exceptions\Halt;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Livewire\Attributes\Locked;
+
+/**
+ * Two people can open the same record's edit screen at once, and nothing in
+ * Filament's own EditRecord page says so. This is the two things that fact
+ * calls for.
+ *
+ * The soft warning: whoever opens the screen second is told, right away, who
+ * else already has it open. Only ever shown to the person arriving later —
+ * the first person has no reason to expect company, and there is nothing this
+ * screen could tell them that would help.
+ *
+ * The hard guard: whoever *saves* second is refused, if the record changed
+ * underneath them since their screen was opened. This is the one that
+ * actually prevents losing work, and it does not depend on the warning above
+ * having been seen or even shown — a closed tab, a second monitor, a
+ * teammate ten minutes ago all end up caught the same way, because it checks
+ * the database at the moment of saving rather than trusting what the warning
+ * said earlier.
+ *
+ * Applied to every Edit page rather than picked per resource: a collision is
+ * a property of two people and one record, not of what the record happens to
+ * be.
+ */
+trait WarnsOfConcurrentEditing
+{
+    /**
+     * `updated_at` as read straight from the database when this screen was
+     * opened — not through the model, so a cast or a mutator cannot make two
+     * identical instants compare unequal.
+     *
+     * Public and Locked, both on purpose and for different reasons. Public
+     * because Livewire only carries public properties across requests — a
+     * protected one resets to null on every hydration, which silently
+     * disables the whole guard. Locked because a plain public property can be
+     * overwritten by whatever a request claims it should be; the one thing
+     * this value must never be is something the browser gets to supply.
+     */
+    #[Locked]
+    public ?string $loadedUpdatedAt = null;
+
+    public function mount(int|string $record): void
+    {
+        parent::mount($record);
+
+        $this->loadedUpdatedAt = $this->currentUpdatedAt();
+
+        $this->warnOfOtherEditors();
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     */
+    protected function handleRecordUpdate(Model $record, array $data): Model
+    {
+        $current = $this->currentUpdatedAt();
+
+        if ($this->loadedUpdatedAt !== null && $current !== null && $current !== $this->loadedUpdatedAt) {
+            $this->warnOfConflict();
+
+            throw (new Halt)->rollBackDatabaseTransaction();
+        }
+
+        $record = parent::handleRecordUpdate($record, $data);
+
+        // What was just written is the new baseline: saving again without
+        // reloading is judged against what this screen itself just wrote,
+        // not against the moment it was first opened.
+        $this->loadedUpdatedAt = $this->currentUpdatedAt();
+
+        return $record;
+    }
+
+    protected function warnOfOtherEditors(): void
+    {
+        $user = Auth::user();
+
+        if ($user === null) {
+            return;
+        }
+
+        $others = Presence::touch($this->getRecord(), $user);
+
+        if ($others->isEmpty()) {
+            return;
+        }
+
+        Notification::make()
+            ->warning()
+            ->title(__('panel.presence.title'))
+            ->body(__('panel.presence.body', ['names' => $others->pluck('name')->implode(', ')]))
+            ->persistent()
+            ->send();
+    }
+
+    protected function warnOfConflict(): void
+    {
+        Notification::make()
+            ->danger()
+            ->title(__('panel.concurrency.title'))
+            ->body($this->conflictMessage())
+            ->persistent()
+            ->send();
+    }
+
+    /**
+     * Named when the history knows who — which is most of the time, since
+     * every content model records who changed what. Without a name the
+     * message still says everything that matters: it changed, and saving now
+     * would have erased that.
+     */
+    protected function conflictMessage(): string
+    {
+        $record = $this->getRecord();
+
+        $author = method_exists($record, 'revisions')
+            ? $record->revisions()->value('user_name')
+            : null;
+
+        return $author !== null
+            ? __('panel.concurrency.body_with_author', ['name' => $author])
+            : __('panel.concurrency.body');
+    }
+
+    /**
+     * Read straight from the table: one column, no relations, no casts to
+     * disagree about, and no risk of a stale in-memory copy answering for the
+     * database.
+     *
+     * Precision is whole seconds, which is what `timestamps()` stores here —
+     * two saves inside the same second are a genuine race even in
+     * production, and this guard is honest about not catching that one.
+     */
+    protected function currentUpdatedAt(): ?string
+    {
+        $record = $this->getRecord();
+
+        return DB::table($record->getTable())
+            ->where($record->getKeyName(), $record->getKey())
+            ->value('updated_at');
+    }
+}

app/Filament/Pages/Auth/PireonLogin.php

@@ -0,0 +1,178 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Pages\Auth;
+
+use App\Actions\Auth\SyncPireonUser;
+use App\Services\Pireon\AccessToken;
+use App\Services\Pireon\PireonClient;
+use App\Services\Pireon\PireonException;
+use App\Services\Pireon\TokenStore;
+use DanHarrin\LivewireRateLimiting\Exceptions\TooManyRequestsException;
+use Filament\Auth\Http\Responses\Contracts\LoginResponse;
+use Filament\Auth\Pages\Login;
+use Filament\Facades\Filament;
+use Illuminate\Contracts\Support\Htmlable;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Validation\ValidationException;
+use SensitiveParameter;
+
+/**
+ * The panel's login screen: an ordinary e-mail and password form.
+ *
+ * The identity server is still the only thing that decides whether those
+ * credentials are correct — there are no local passwords, and `users` has no
+ * usable password column — but the person signing in never sees that. They
+ * type their credentials here and land in the panel.
+ *
+ * The cost of that convenience is stated plainly because it is real: this
+ * application now handles the password rather than never seeing it. It is sent
+ * straight to the identity server over the password grant and is never stored,
+ * logged, or written anywhere; but a compromise here would expose credentials
+ * to the identity server, which the redirect flow made impossible. The
+ * Authorization Code + PKCE routes are still in place
+ * ([`PireonAuthController`](app/Http/Controllers/Auth/PireonAuthController.php))
+ * for anyone who wants that trade back.
+ */
+class PireonLogin extends Login
+{
+    public function getTitle(): string|Htmlable
+    {
+        return __('pireon.sign_in');
+    }
+
+    public function getHeading(): string|Htmlable
+    {
+        return __('pireon.sign_in');
+    }
+
+    public function getSubheading(): string|Htmlable|null
+    {
+        return __('pireon.sign_in_intro');
+    }
+
+    /**
+     * Filament's own flow checks the credentials against the local user table.
+     * There are no local passwords here, so the whole of it is replaced: the
+     * identity server is asked instead, and only what it says is trusted.
+     */
+    public function authenticate(): ?LoginResponse
+    {
+        try {
+            // Filament's own limiter, keyed by IP: five attempts, then a wait.
+            // The identity server has its own; this stops us spending it.
+            $this->rateLimit(5);
+        } catch (TooManyRequestsException $exception) {
+            $this->getRateLimitedNotification($exception)?->send();
+
+            return null;
+        }
+
+        $data = $this->form->getState();
+
+        $this->assertUsable();
+
+        $token = $this->exchange((string) $data['email'], (string) $data['password']);
+
+        $client = app(PireonClient::class);
+
+        try {
+            $identity = $client->identity($token->accessToken);
+        } catch (PireonException $e) {
+            $this->fail($e);
+        }
+
+        // Said only once the credentials were right, so this cannot be used to
+        // find out which addresses have an account.
+        if (! $identity->isUsable()) {
+            throw ValidationException::withMessages([
+                'data.email' => $identity->isApproved()
+                    ? __('pireon.inactive')
+                    : __('pireon.pending_approval'),
+            ]);
+        }
+
+        $user = app(SyncPireonUser::class)->handle($identity);
+
+        // Being a valid account upstream is not the same as being allowed in
+        // here: roles are this application's business.
+        if (! $user->canAccessPanel(Filament::getCurrentOrDefaultPanel())) {
+            throw ValidationException::withMessages([
+                'data.email' => __('pireon.no_permission'),
+            ]);
+        }
+
+        // Rotate the session id so a fixated pre-login session cannot be
+        // reused now that it carries an authenticated identity.
+        session()->regenerate();
+
+        Auth::login($user, (bool) ($data['remember'] ?? false));
+
+        app(TokenStore::class)->put($token);
+
+        if ($user->locale) {
+            session()->put(config('locales.session_key'), $user->locale);
+        }
+
+        return app(LoginResponse::class);
+    }
+
+    /**
+     * Trade the credentials for a token upstream.
+     *
+     * Any refusal answers with the same message. The identity server
+     * distinguishes an unknown address from a wrong password; repeating that
+     * here would turn the form into a way of finding out who has an account.
+     */
+    protected function exchange(string $email, #[SensitiveParameter] string $password): AccessToken
+    {
+        try {
+            return app(PireonClient::class)->requestPasswordToken($email, $password);
+        } catch (PireonException $e) {
+            $this->fail($e);
+        }
+    }
+
+    /**
+     * A misconfiguration is an operator's problem, not a visitor's, so it says
+     * what is actually wrong instead of "those credentials are incorrect".
+     */
+    protected function assertUsable(): void
+    {
+        if (! app(PireonClient::class)->isConfigured()) {
+            throw ValidationException::withMessages([
+                'data.email' => __('pireon.not_configured_body', ['server' => (string) config('pireon.server')]),
+            ]);
+        }
+
+        if (! config('pireon.password_grant_enabled')) {
+            throw ValidationException::withMessages([
+                'data.email' => __('pireon.password_grant_disabled'),
+            ]);
+        }
+    }
+
+    protected function fail(PireonException $e): never
+    {
+        // The address is logged, the password never is — it does not leave the
+        // request it arrived in.
+        Log::warning('Pireon sign-in failed', [
+            'message' => $e->getMessage(),
+            'status' => $e->status,
+        ]);
+
+        // Only say "those credentials are wrong" when that is what happened.
+        // A server that answered 500, or did not answer at all, has said
+        // nothing about the password, and reporting otherwise sends whoever is
+        // signing in to look for a problem that is not theirs.
+        if (! $e->isRejection()) {
+            throw ValidationException::withMessages([
+                'data.email' => __('pireon.server_unavailable'),
+            ]);
+        }
+
+        $this->throwFailureValidationException();
+    }
+}

app/Filament/Pages/SiteHealth.php

@@ -0,0 +1,147 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Pages;
+
+use App\Support\Health\Finding;
+use App\Support\Health\HealthReport;
+use App\Support\Health\Severity;
+use BackedEnum;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification;
+use Filament\Pages\Page;
+use Filament\Support\Icons\Heroicon;
+use Illuminate\Contracts\Support\Htmlable;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Auth;
+use UnitEnum;
+
+/**
+ * Everything wrong with the public site, in one place.
+ *
+ * This page exists because the site is somewhere else. A missing translation,
+ * two records answering at the same URL, an image whose file is gone: none of
+ * it is visible where the content is edited. It shows up on the frontend,
+ * usually late, and usually to a visitor rather than to us.
+ */
+class SiteHealth extends Page
+{
+    protected string $view = 'filament.pages.site-health';
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedShieldCheck;
+
+    protected static ?int $navigationSort = 88;
+
+    /**
+     * Not a public Livewire property: a Finding is a plain object, and
+     * Livewire can only carry types it knows how to serialise. It is
+     * recomputed per render instead, which is what opening this page is for.
+     *
+     * @var Collection<int, Finding>|null
+     */
+    protected ?Collection $findings = null;
+
+    public static function canAccess(): bool
+    {
+        // Anyone who edits content benefits from seeing what is wrong with it.
+        // Individual checks hide themselves behind their own permission.
+        return Auth::user()?->can('panel.access') ?? false;
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('health.title');
+    }
+
+    public function getTitle(): string|Htmlable
+    {
+        return __('health.title');
+    }
+
+    public function getSubheading(): string|Htmlable|null
+    {
+        return __('health.subheading');
+    }
+
+    /**
+     * @return Collection<int, Finding>
+     */
+    public function findings(): Collection
+    {
+        return $this->findings ??= app(HealthReport::class)->runFor(Auth::user());
+    }
+
+    /**
+     * @return array<int, Action>
+     */
+    protected function getHeaderActions(): array
+    {
+        return [
+            Action::make('refresh')
+                ->label(__('health.actions.refresh'))
+                ->icon('heroicon-o-arrow-path')
+                ->color('gray')
+                ->action(function (): void {
+                    $this->refreshFindings();
+
+                    Notification::make()
+                        ->title(__('health.refreshed'))
+                        ->success()
+                        ->send();
+                }),
+        ];
+    }
+
+    public function refreshFindings(): void
+    {
+        // The badge is cached so that drawing it does not run ten checks on
+        // every page of the panel; opening this page is the one moment we
+        // definitely want fresh answers.
+        app(HealthReport::class)->forget(Auth::user());
+
+        $this->findings = null;
+    }
+
+    /**
+     * @return Collection<int, Finding>
+     */
+    public function problems(): Collection
+    {
+        return $this->findings()->filter(fn (Finding $f) => $f->severity->isProblem());
+    }
+
+    /**
+     * @return Collection<int, Finding>
+     */
+    public function passing(): Collection
+    {
+        return $this->findings()->reject(fn (Finding $f) => $f->severity->isProblem());
+    }
+
+    public function hasErrors(): bool
+    {
+        return $this->problems()->contains(fn (Finding $f) => $f->severity === Severity::Error);
+    }
+
+    /**
+     * A count in the sidebar, because a diagnostics page nobody opens
+     * diagnoses nothing.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $problems = app(HealthReport::class)->problemCount(Auth::user());
+
+        return $problems > 0 ? (string) $problems : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'warning';
+    }
+}

app/Filament/Pages/SiteMaintenance.php

@@ -0,0 +1,216 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Pages;
+
+use App\Models\Setting;
+use App\Support\Maintenance;
+use BackedEnum;
+use Carbon\CarbonImmutable;
+use Filament\Actions\Action;
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\Textarea;
+use Filament\Notifications\Notification;
+use Filament\Pages\Page;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Components\Tabs;
+use Filament\Schemas\Components\Tabs\Tab;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Illuminate\Contracts\Support\Htmlable;
+use Illuminate\Support\Facades\Auth;
+use UnitEnum;
+
+/**
+ * Puts the **public site** into maintenance, without touching the panel.
+ *
+ * The distinction is the whole feature: `artisan down` would lock out the
+ * collective as well, exactly when they need to be fixing whatever went wrong.
+ * Here the team keeps editing, repositories keep syncing, and only visitors of
+ * the public site see the notice.
+ */
+class SiteMaintenance extends Page
+{
+    protected string $view = 'filament.pages.site-maintenance';
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedWrenchScrewdriver;
+
+    protected static ?int $navigationSort = 90;
+
+    /**
+     * @var array<string, mixed>|null
+     */
+    public ?array $data = [];
+
+    public static function canAccess(): bool
+    {
+        return Auth::user()?->can('settings.view') ?? false;
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('maintenance.title');
+    }
+
+    public function getTitle(): string|Htmlable
+    {
+        return __('maintenance.title');
+    }
+
+    public function getSubheading(): string|Htmlable|null
+    {
+        return __('maintenance.subheading');
+    }
+
+    /**
+     * A red badge in the sidebar while the site is down — this is not
+     * something anyone should be able to forget about.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        return Maintenance::isEnabled() ? __('maintenance.badge') : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'danger';
+    }
+
+    public function mount(): void
+    {
+        $this->form->fill([
+            'message' => Maintenance::messages(),
+            'until' => Maintenance::until()?->toDateTimeString(),
+        ]);
+    }
+
+    public function form(Schema $schema): Schema
+    {
+        return $schema
+            ->statePath('data')
+            ->components([
+                Section::make(__('maintenance.notice'))
+                    ->description(__('maintenance.notice_hint'))
+                    ->schema([
+                        Tabs::make('message')
+                            ->tabs(collect(config('locales.supported'))
+                                ->map(fn (array $meta, string $locale) => Tab::make($locale)
+                                    ->label(trim(($meta['flag'] ?? '').' '.($meta['native'] ?? $locale)))
+                                    ->schema([
+                                        Textarea::make("message.{$locale}")
+                                            ->hiddenLabel()
+                                            ->rows(3)
+                                            ->placeholder(__('maintenance.default_message', [], $locale))
+                                            ->maxLength(500),
+                                    ]))
+                                ->values()
+                                ->all())
+                            ->columnSpanFull(),
+
+                        DateTimePicker::make('until')
+                            ->label(__('maintenance.until'))
+                            ->helperText(__('maintenance.until_hint'))
+                            ->seconds(false)
+                            ->minDate(now()),
+                    ]),
+            ]);
+    }
+
+    /**
+     * @return array<int, Action>
+     */
+    protected function getHeaderActions(): array
+    {
+        return [
+            Action::make('enable')
+                ->label(__('maintenance.enable'))
+                ->icon('heroicon-o-exclamation-triangle')
+                ->color('danger')
+                ->requiresConfirmation()
+                ->modalDescription(__('maintenance.enable_confirm'))
+                ->visible(fn () => ! Maintenance::isEnabled() && $this->canToggle())
+                ->action(function (): void {
+                    $data = $this->form->getState();
+
+                    Maintenance::enable(
+                        message: array_filter($data['message'] ?? [], fn ($v) => filled($v)),
+                        until: filled($data['until'] ?? null) ? CarbonImmutable::parse($data['until']) : null,
+                    );
+
+                    Notification::make()
+                        ->warning()
+                        ->title(__('maintenance.enabled_notice'))
+                        ->send();
+                }),
+
+            Action::make('disable')
+                ->label(__('maintenance.disable'))
+                ->icon('heroicon-o-check-circle')
+                ->color('success')
+                ->requiresConfirmation()
+                ->visible(fn () => Maintenance::isEnabled() && $this->canToggle())
+                ->action(function (): void {
+                    Maintenance::disable();
+
+                    Notification::make()
+                        ->success()
+                        ->title(__('maintenance.disabled_notice'))
+                        ->send();
+                }),
+
+            Action::make('save')
+                ->label(__('maintenance.save_message'))
+                ->color('gray')
+                ->visible(fn () => $this->canToggle())
+                ->action(function (): void {
+                    $data = $this->form->getState();
+                    $messages = array_filter($data['message'] ?? [], fn ($v) => filled($v));
+
+                    // Saving the wording must not itself take the site down.
+                    if (Maintenance::isEnabled()) {
+                        Maintenance::enable(
+                            message: $messages,
+                            until: filled($data['until'] ?? null) ? CarbonImmutable::parse($data['until']) : null,
+                        );
+                    } else {
+                        Setting::set(Maintenance::KEY, [
+                            ...Maintenance::state(),
+                            'enabled' => false,
+                            'message' => $messages,
+                        ]);
+                    }
+
+                    Notification::make()
+                        ->success()
+                        ->title(__('maintenance.message_saved'))
+                        ->send();
+                }),
+        ];
+    }
+
+    public function isEnabled(): bool
+    {
+        return Maintenance::isEnabled();
+    }
+
+    public function startedAt(): ?string
+    {
+        return Maintenance::startedAt()?->diffForHumans();
+    }
+
+    public function endsAt(): ?string
+    {
+        return Maintenance::until()?->isoFormat('LLL');
+    }
+
+    public function canToggle(): bool
+    {
+        return Auth::user()?->can('settings.maintenance') ?? false;
+    }
+}

app/Filament/Pages/Trash.php

@@ -0,0 +1,183 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Pages;
+
+use App\Models\Application;
+use App\Models\Category;
+use App\Models\Client;
+use App\Models\Member;
+use App\Models\Page;
+use App\Models\Project;
+use App\Models\Service;
+use App\Models\Testimonial;
+use BackedEnum;
+use Filament\Notifications\Notification;
+use Filament\Pages\Page as FilamentPage;
+use Filament\Support\Icons\Heroicon;
+use Illuminate\Contracts\Support\Htmlable;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Auth;
+use UnitEnum;
+
+/**
+ * Everything deleted, in one place.
+ *
+ * Soft deletes are everywhere, but recovering something meant remembering
+ * which resource it had been in and then turning on a filter — which is a lot
+ * to ask of somebody who has just deleted the wrong thing and is looking for
+ * the undo button.
+ */
+class Trash extends FilamentPage
+{
+    protected string $view = 'filament.pages.trash';
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedTrash;
+
+    protected static ?int $navigationSort = 87;
+
+    /**
+     * Every model that can be recovered, and the permission that governs it.
+     *
+     * @var array<class-string<Model>, string>
+     */
+    public const RECOVERABLE = [
+        Page::class => 'pages',
+        Project::class => 'projects',
+        Service::class => 'services',
+        Member::class => 'members',
+        Client::class => 'clients',
+        Testimonial::class => 'testimonials',
+        Category::class => 'categories',
+
+        // The inbox soft-deletes too, and it is gated by its own permission
+        // below — a viewer never sees a stranger's message here either.
+        Application::class => 'applications',
+    ];
+
+    public static function canAccess(): bool
+    {
+        return Auth::user()?->can('panel.access') ?? false;
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getNavigationLabel(): string
+    {
+        return __('panel.trash.title');
+    }
+
+    public function getTitle(): string|Htmlable
+    {
+        return __('panel.trash.title');
+    }
+
+    public function getSubheading(): string|Htmlable|null
+    {
+        return __('panel.trash.subheading');
+    }
+
+    /**
+     * What is in the bin, grouped by what it is — and only the kinds this user
+     * is allowed to see in the first place.
+     *
+     * @return Collection<string, array{label: string, records: Collection<int, Model>}>
+     */
+    public function groups(): Collection
+    {
+        $user = Auth::user();
+
+        return collect(self::RECOVERABLE)
+            ->filter(fn (string $resource) => $user?->can("{$resource}.view_any") ?? false)
+            ->map(fn (string $resource, string $model) => [
+                'model' => $model,
+                'label' => __("panel.{$resource}.plural"),
+                'records' => $model::onlyTrashed()->latest('deleted_at')->limit(25)->get(),
+            ])
+            ->filter(fn (array $group) => $group['records']->isNotEmpty());
+    }
+
+    public function total(): int
+    {
+        return $this->groups()->sum(fn (array $group) => $group['records']->count());
+    }
+
+    /**
+     * Put one thing back.
+     */
+    public function restoreRecord(string $model, int|string $id): void
+    {
+        $record = $this->find($model, $id);
+
+        if (! $record || ! Auth::user()?->can('restore', $record)) {
+            return;
+        }
+
+        $record->restore();
+
+        Notification::make()
+            ->title(__('panel.trash.restored'))
+            ->success()
+            ->send();
+    }
+
+    /**
+     * Erase one thing for good.
+     */
+    public function eraseRecord(string $model, int|string $id): void
+    {
+        $record = $this->find($model, $id);
+
+        if (! $record || ! Auth::user()?->can('forceDelete', $record)) {
+            return;
+        }
+
+        $record->forceDelete();
+
+        Notification::make()
+            ->title(__('panel.trash.erased'))
+            ->warning()
+            ->send();
+    }
+
+    /**
+     * How a record is described here, whatever kind it is.
+     */
+    public function labelFor(Model $record): string
+    {
+        foreach (['name', 'title', 'author_name', 'full_name'] as $attribute) {
+            $value = $record->getAttribute($attribute);
+
+            if (blank($value)) {
+                continue;
+            }
+
+            return is_array($value)
+                ? (string) ($value[config('locales.default')] ?? reset($value))
+                : (string) $value;
+        }
+
+        return '#'.$record->getKey();
+    }
+
+    protected function find(string $model, int|string $id): ?Model
+    {
+        // Only the models this page declares: an id and a class name arriving
+        // from the browser must not be able to reach anything else.
+        if (! array_key_exists($model, self::RECOVERABLE)) {
+            return null;
+        }
+
+        return $model::onlyTrashed()->find($id);
+    }
+
+    public static function getNavigationBadge(): ?string
+    {
+        return null;
+    }
+}

app/Filament/RelationManagers/ReviewsRelationManager.php

@@ -0,0 +1,98 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\RelationManagers;
+
+use App\Filament\Support\ReviewActions;
+use App\Models\ReviewComment;
+use Filament\Actions\Action;
+use Filament\Forms\Components\Textarea;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * The conversation about one record, on the record.
+ *
+ * Sits beside the change history and answers a different question. A revision
+ * knows the title used to say something else; it cannot know that this went
+ * back because the photo is missing, because that sentence was never a field
+ * on the form. Kept together with the two review buttons so the reason and the
+ * decision are written in the same place, rather than the decision here and
+ * the reason in somebody's chat window.
+ */
+class ReviewsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'reviewComments';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.reviews.title');
+    }
+
+    /**
+     * The badge says "waiting", not "how many": a count of comments is
+     * trivia, and whether somebody is waiting for an answer is not.
+     */
+    public static function getBadge(Model $ownerRecord, string $pageClass): ?string
+    {
+        return $ownerRecord->isAwaitingReview() ? '!' : null;
+    }
+
+    public static function getBadgeColor(Model $ownerRecord, string $pageClass): ?string
+    {
+        return 'warning';
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('id', 'desc')
+            ->modifyQueryUsing(fn ($query) => $query->with('user'))
+            ->columns([
+                TextColumn::make('event')
+                    ->label(__('panel.reviews.fields.event'))
+                    ->badge(),
+
+                TextColumn::make('user_name')
+                    ->label(__('panel.reviews.fields.who'))
+                    ->state(fn (ReviewComment $record) => $record->author()),
+
+                TextColumn::make('body')
+                    ->label(__('panel.reviews.fields.note'))
+                    ->wrap()
+                    ->placeholder('—'),
+
+                TextColumn::make('created_at')
+                    ->label(__('panel.reviews.fields.when'))
+                    ->since()
+                    ->dateTimeTooltip()
+                    ->sortable(),
+            ])
+            ->headerActions([
+                ReviewActions::request(),
+                ReviewActions::returnForChanges(),
+
+                // Plain comments, for the half of a review that is neither a
+                // rejection nor an approval: a question, or an answer to one.
+                Action::make('comment')
+                    ->label(__('panel.reviews.actions.comment'))
+                    ->icon('heroicon-o-chat-bubble-left-ellipsis')
+                    ->color('gray')
+                    ->visible(fn () => $this->getOwnerRecord()->exists)
+                    ->schema([
+                        Textarea::make('body')
+                            ->label(__('panel.reviews.fields.note'))
+                            ->rows(3)
+                            ->required()
+                            ->maxLength(2000),
+                    ])
+                    ->action(fn (array $data) => $this->getOwnerRecord()->comment($data['body'])),
+            ])
+            ->emptyStateHeading(__('panel.reviews.empty.heading'))
+            ->emptyStateDescription(__('panel.reviews.empty.description'))
+            ->emptyStateIcon('heroicon-o-chat-bubble-left-right');
+    }
+}

app/Filament/RelationManagers/RevisionsRelationManager.php

@@ -0,0 +1,127 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\RelationManagers;
+
+use App\Models\Revision;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * Who changed what, on the record it happened to.
+ *
+ * One class for every resource: the history of a page and the history of a
+ * testimonial differ only in what is in them.
+ */
+class RevisionsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'revisions';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.revisions.title');
+    }
+
+    public static function getBadge(Model $ownerRecord, string $pageClass): ?string
+    {
+        $count = $ownerRecord->revisions()->count();
+
+        return $count > 0 ? (string) $count : null;
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('id', 'desc')
+            ->modifyQueryUsing(fn ($query) => $query->with('user'))
+            ->columns([
+                TextColumn::make('event')
+                    ->label(__('panel.revisions.fields.event'))
+                    ->badge()
+                    ->formatStateUsing(fn (string $state) => __("panel.revisions.events.{$state}"))
+                    // Publishing is a separate permission because it is a
+                    // bigger act than editing; it reads differently here too.
+                    ->color(fn (string $state) => match ($state) {
+                        'published' => 'success',
+                        'unpublished' => 'warning',
+                        'created' => 'info',
+                        'deleted', 'erased' => 'danger',
+                        default => 'gray',
+                    }),
+
+                TextColumn::make('user_name')
+                    ->label(__('panel.revisions.fields.author'))
+                    ->state(fn (Revision $record) => $record->author()),
+
+                TextColumn::make('changeset')
+                    ->label(__('panel.revisions.fields.fields'))
+                    ->state(fn (Revision $record) => $record->fields())
+                    ->badge()
+                    ->color('gray')
+                    ->limitList(4)
+                    ->placeholder('—'),
+
+                TextColumn::make('created_at')
+                    ->label(__('panel.revisions.fields.when'))
+                    ->since()
+                    ->dateTimeTooltip()
+                    ->sortable(),
+            ])
+            ->filters([
+                SelectFilter::make('event')
+                    ->label(__('panel.revisions.fields.event'))
+                    ->options(fn () => collect(['created', 'updated', 'published', 'unpublished', 'deleted', 'restored', 'erased'])
+                        ->mapWithKeys(fn (string $e) => [$e => __("panel.revisions.events.{$e}")])
+                        ->all()),
+            ])
+            ->recordActions([
+                Action::make('diff')
+                    ->label(__('panel.revisions.actions.diff'))
+                    ->icon('heroicon-o-eye')
+                    ->modalHeading(fn (Revision $record) => __('panel.revisions.diff_heading', [
+                        'author' => $record->author(),
+                        'when' => $record->created_at?->isoFormat('LLL'),
+                    ]))
+                    ->modalSubmitAction(false)
+                    ->modalContent(fn (Revision $record) => view('filament.revisions.diff', [
+                        'revision' => $record,
+                    ])),
+
+                Action::make('restore')
+                    ->label(__('panel.revisions.actions.restore'))
+                    ->icon('heroicon-o-arrow-uturn-left')
+                    ->color('warning')
+                    ->requiresConfirmation()
+                    ->modalDescription(__('panel.revisions.restore_confirm'))
+                    ->authorize(fn () => (bool) Auth::user()?->can('update', $this->getOwnerRecord()))
+                    // Nothing to put back for a creation or a deletion, and
+                    // the newest revision already is the current state.
+                    ->visible(fn (Revision $record) => filled($record->changeset)
+                        && $record->isNot($this->getOwnerRecord()->revisions()->first()))
+                    ->action(function (Revision $record): void {
+                        $owner = $this->getOwnerRecord();
+
+                        // Restoring is itself a change, so it lands in the
+                        // history like any other — the way back is never lost.
+                        $owner->forceFill($record->previousValues())->save();
+
+                        Notification::make()
+                            ->title(__('panel.revisions.restored'))
+                            ->success()
+                            ->send();
+                    }),
+            ]);
+    }
+
+    public function isReadOnly(): bool
+    {
+        return true;
+    }
+}

app/Filament/Resources/Applications/ApplicationResource.php

@@ -0,0 +1,113 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Applications;
+
+use App\Filament\Resources\Applications\Pages\ListApplications;
+use App\Filament\Resources\Applications\Pages\ViewApplication;
+use App\Filament\Resources\Applications\Schemas\ApplicationInfolist;
+use App\Filament\Resources\Applications\Tables\ApplicationsTable;
+use App\Models\Application;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use UnitEnum;
+
+/**
+ * The inbox.
+ *
+ * Everything else in this panel is written by the collective; this is the one
+ * resource written by the public. That difference shapes the whole thing:
+ * nothing here is created by hand, the submitted half is read-only, and the
+ * badge in the sidebar counts the people still waiting for a reply.
+ */
+class ApplicationResource extends Resource
+{
+    protected static ?string $model = Application::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedInboxArrowDown;
+
+    protected static ?int $navigationSort = 4;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.applications.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.applications.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->name;
+    }
+
+    public static function infolist(Schema $schema): Schema
+    {
+        return ApplicationInfolist::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return ApplicationsTable::configure($table);
+    }
+
+    /**
+     * @return Builder<Application>
+     */
+    public static function getEloquentQuery(): Builder
+    {
+        // `subject()` reads the call on every row, and the handler shows in an
+        // optional column: both are loaded up front rather than per row.
+        return parent::getEloquentQuery()->with(['call', 'handler']);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListApplications::route('/'),
+            'view' => ViewApplication::route('/{record}'),
+        ];
+    }
+
+    /**
+     * Submissions arrive from the public site. Nobody types one in.
+     */
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+
+    /**
+     * The number of people waiting for an answer — the only figure in this
+     * panel that represents somebody else's time rather than ours.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $pending = static::getModel()::query()->pending()->count();
+
+        return $pending > 0 ? (string) $pending : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'warning';
+    }
+
+    public static function getNavigationBadgeTooltip(): ?string
+    {
+        return __('panel.applications.badge_tooltip');
+    }
+}

app/Filament/Resources/Applications/Pages/ListApplications.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Applications\Pages;
+
+use App\Enums\ApplicationKind;
+use App\Enums\ApplicationStatus;
+use App\Filament\Resources\Applications\ApplicationResource;
+use Filament\Resources\Pages\ListRecords;
+use Filament\Schemas\Components\Tabs\Tab;
+use Illuminate\Database\Eloquent\Builder;
+
+class ListApplications extends ListRecords
+{
+    protected static string $resource = ApplicationResource::class;
+
+    /**
+     * Tabs rather than filters for the two questions asked most often: who is
+     * still waiting, and who is offering time versus asking for it.
+     *
+     * @return array<string, Tab>
+     */
+    public function getTabs(): array
+    {
+        return [
+            'pending' => Tab::make(__('panel.applications.tabs.pending'))
+                ->modifyQueryUsing(fn (Builder $query) => $query->pending())
+                ->badge(ApplicationResource::getModel()::query()->pending()->count())
+                ->badgeColor('warning'),
+
+            'contribute' => Tab::make(__('panel.applications.tabs.contribute'))
+                ->modifyQueryUsing(fn (Builder $query) => $query
+                    ->where('kind', ApplicationKind::Contribute)
+                    ->notSpam()),
+
+            'request' => Tab::make(__('panel.applications.tabs.request'))
+                ->modifyQueryUsing(fn (Builder $query) => $query
+                    ->where('kind', ApplicationKind::Request)
+                    ->notSpam()),
+
+            'all' => Tab::make(__('panel.applications.tabs.all')),
+
+            'spam' => Tab::make(__('panel.applications.tabs.spam'))
+                ->modifyQueryUsing(fn (Builder $query) => $query
+                    ->where('status', ApplicationStatus::Spam)),
+        ];
+    }
+
+    public function getDefaultActiveTab(): string|int|null
+    {
+        return 'pending';
+    }
+}

app/Filament/Resources/Applications/Pages/ViewApplication.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Applications\Pages;
+
+use App\Filament\Resources\Applications\ApplicationResource;
+use App\Filament\Resources\Applications\Tables\ApplicationsTable;
+use App\Models\Application;
+use Filament\Actions\Action;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\ForceDeleteAction;
+use Filament\Actions\RestoreAction;
+use Filament\Forms\Components\Textarea;
+use Filament\Notifications\Notification;
+use Filament\Resources\Pages\ViewRecord;
+
+class ViewApplication extends ViewRecord
+{
+    protected static string $resource = ApplicationResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            // Answering is the point of the record, so the reply is the first
+            // button rather than something to copy out of the page.
+            Action::make('reply')
+                ->label(__('panel.applications.actions.reply'))
+                ->icon('heroicon-o-envelope')
+                ->color('primary')
+                ->url(fn (Application $record) => 'mailto:'.$record->email.'?subject='
+                    .rawurlencode(__('panel.applications.reply_subject', [
+                        'subject' => $record->subject(),
+                    ])))
+                ->openUrlInNewTab(),
+
+            Action::make('notes')
+                ->label(__('panel.applications.actions.notes'))
+                ->icon('heroicon-o-pencil-square')
+                ->color('gray')
+                ->authorize('update')
+                ->schema([
+                    Textarea::make('notes')
+                        ->label(__('panel.applications.fields.notes'))
+                        ->helperText(__('panel.applications.fields.notes_hint'))
+                        ->rows(6),
+                ])
+                ->fillForm(fn (Application $record) => ['notes' => $record->notes])
+                ->action(function (Application $record, array $data): void {
+                    // Notes are outside the model's fillable list on purpose —
+                    // nothing arriving from the public form may ever land in
+                    // them — so they are written explicitly here.
+                    $record->forceFill(['notes' => $data['notes']])->save();
+
+                    Notification::make()
+                        ->title(__('panel.applications.saved'))
+                        ->success()
+                        ->send();
+                }),
+
+            ...ApplicationsTable::statusActions(),
+
+            DeleteAction::make(),
+            RestoreAction::make(),
+            ForceDeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Applications/Schemas/ApplicationInfolist.php

@@ -0,0 +1,108 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Applications\Schemas;
+
+use App\Models\Application;
+use Filament\Infolists\Components\KeyValueEntry;
+use Filament\Infolists\Components\TextEntry;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+
+/**
+ * A submission is read, not edited: everything above the divider was written
+ * by somebody else and must stay exactly as they sent it. Only the notes and
+ * the status below belong to the collective.
+ */
+class ApplicationInfolist
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.applications.sections.message'))
+                ->columns(3)
+                ->schema([
+                    TextEntry::make('name')
+                        ->label(__('panel.applications.fields.name'))
+                        ->weight('bold'),
+
+                    TextEntry::make('email')
+                        ->label(__('panel.applications.fields.email'))
+                        ->copyable()
+                        // The reply is the whole point of the record, so it is
+                        // one click away rather than a copy-paste.
+                        ->url(fn (Application $record) => 'mailto:'.$record->email),
+
+                    TextEntry::make('organisation')
+                        ->label(__('panel.applications.fields.organisation'))
+                        ->placeholder('—'),
+
+                    TextEntry::make('kind')
+                        ->label(__('panel.applications.fields.kind'))
+                        ->badge(),
+
+                    TextEntry::make('call_title')
+                        ->label(__('panel.applications.fields.subject'))
+                        ->state(fn (Application $record) => $record->subject()),
+
+                    TextEntry::make('hours_per_week')
+                        ->label(__('panel.applications.fields.hours_per_week'))
+                        ->formatStateUsing(fn (?int $state) => $state ? "{$state} h" : '—')
+                        // The number to compare against the call's own ask.
+                        ->helperText(fn (Application $record) => $record->call?->hours_per_week
+                            ? __('panel.applications.fields.hours_asked', [
+                                'hours' => $record->call->hours_per_week,
+                            ])
+                            : null),
+
+                    TextEntry::make('message')
+                        ->label(__('panel.applications.fields.message'))
+                        ->prose()
+                        ->columnSpanFull(),
+
+                    KeyValueEntry::make('links')
+                        ->label(__('panel.applications.fields.links'))
+                        ->keyLabel(__('panel.applications.fields.link_name'))
+                        ->valueLabel(__('panel.applications.fields.link_url'))
+                        ->columnSpanFull()
+                        ->visible(fn (Application $record) => filled($record->links)),
+                ]),
+
+            Section::make(__('panel.applications.sections.internal'))
+                ->description(__('panel.applications.sections.internal_hint'))
+                ->columns(4)
+                ->schema([
+                    TextEntry::make('status')
+                        ->label(__('panel.applications.fields.status'))
+                        ->badge(),
+
+                    TextEntry::make('created_at')
+                        ->label(__('panel.applications.fields.received_at'))
+                        ->dateTime(),
+
+                    TextEntry::make('handler.name')
+                        ->label(__('panel.applications.fields.handled_by'))
+                        ->placeholder('—'),
+
+                    TextEntry::make('handled_at')
+                        ->label(__('panel.applications.fields.handled_at'))
+                        ->dateTime()
+                        ->placeholder('—'),
+
+                    TextEntry::make('locale')
+                        ->label(__('panel.applications.fields.locale'))
+                        ->badge()
+                        ->color('gray')
+                        // Reply in the language they wrote in.
+                        ->formatStateUsing(fn (string $state) => config("locales.supported.{$state}.native", $state)),
+
+                    TextEntry::make('notes')
+                        ->label(__('panel.applications.fields.notes'))
+                        ->prose()
+                        ->placeholder(__('panel.applications.fields.notes_empty'))
+                        ->columnSpanFull(),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Applications/Tables/ApplicationsTable.php

@@ -0,0 +1,163 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Applications\Tables;
+
+use App\Enums\ApplicationKind;
+use App\Enums\ApplicationStatus;
+use App\Models\Application;
+use Filament\Actions\Action;
+use Filament\Actions\ActionGroup;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Actions\ViewAction;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * An inbox rather than a catalogue.
+ *
+ * What it optimises for is the one question worth asking every morning: is
+ * anybody waiting for an answer? Hence the pending filter on by default, the
+ * relative timestamps, and the status transitions one click from the list.
+ */
+class ApplicationsTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('name')
+                    ->label(__('panel.applications.fields.name'))
+                    ->weight('medium')
+                    ->description(fn (Application $record) => $record->email)
+                    ->searchable(['name', 'email']),
+
+                TextColumn::make('kind')
+                    ->label(__('panel.applications.fields.kind'))
+                    ->badge()
+                    ->sortable(),
+
+                TextColumn::make('call_title')
+                    ->label(__('panel.applications.fields.subject'))
+                    ->state(fn (Application $record) => $record->subject())
+                    ->color(fn (Application $record) => $record->call_id ? null : 'gray')
+                    ->wrap()
+                    ->toggleable(),
+
+                TextColumn::make('hours_per_week')
+                    ->label(__('panel.applications.fields.hours_per_week'))
+                    ->badge()
+                    ->color('info')
+                    ->formatStateUsing(fn (?int $state) => $state ? "{$state} h" : '—')
+                    ->toggleable(),
+
+                TextColumn::make('status')
+                    ->label(__('panel.applications.fields.status'))
+                    ->badge()
+                    ->sortable(),
+
+                TextColumn::make('created_at')
+                    ->label(__('panel.applications.fields.received_at'))
+                    ->since()
+                    ->dateTimeTooltip()
+                    ->sortable(),
+
+                TextColumn::make('handler.name')
+                    ->label(__('panel.applications.fields.handled_by'))
+                    ->placeholder('—')
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->filters([
+                // No default here: the tabs above already decide what is in
+                // view, and a filter with a default would silently empty the
+                // spam tab.
+                SelectFilter::make('status')
+                    ->label(__('panel.applications.fields.status'))
+                    ->options(ApplicationStatus::options())
+                    ->multiple(),
+
+                SelectFilter::make('kind')
+                    ->label(__('panel.applications.fields.kind'))
+                    ->options(ApplicationKind::options()),
+
+                SelectFilter::make('call')
+                    ->label(__('panel.applications.fields.call'))
+                    ->relationship('call', 'title->'.config('locales.default'))
+                    ->searchable()
+                    ->preload(),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                ViewAction::make(),
+
+                ActionGroup::make(static::statusActions())
+                    ->label(__('panel.applications.actions.group'))
+                    ->icon('heroicon-m-ellipsis-horizontal'),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    BulkAction::make('mark_spam')
+                        ->label(__('panel.applications.actions.spam'))
+                        ->icon('heroicon-o-no-symbol')
+                        ->color('danger')
+                        ->requiresConfirmation()
+                        ->authorize(fn () => (bool) Auth::user()?->can('applications.update'))
+                        ->action(fn (Collection $records) => $records->each(
+                            fn (Application $record) => $record->markAs(ApplicationStatus::Spam, Auth::user()),
+                        ))
+                        ->deselectRecordsAfterCompletion(),
+
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ])
+            ->emptyStateHeading(__('panel.applications.empty.heading'))
+            ->emptyStateDescription(__('panel.applications.empty.description'))
+            ->emptyStateIcon('heroicon-o-inbox');
+    }
+
+    /**
+     * The status transitions, shared by the list and the record page so the
+     * two cannot drift apart.
+     *
+     * @return array<int, Action>
+     */
+    public static function statusActions(): array
+    {
+        $styles = [
+            ApplicationStatus::Contacted->value => ['heroicon-o-chat-bubble-left-right', 'info'],
+            ApplicationStatus::Accepted->value => ['heroicon-o-check-circle', 'success'],
+            ApplicationStatus::Declined->value => ['heroicon-o-x-circle', 'gray'],
+            ApplicationStatus::Spam->value => ['heroicon-o-no-symbol', 'danger'],
+        ];
+
+        $actions = [];
+
+        foreach ($styles as $status => [$icon, $color]) {
+            $target = ApplicationStatus::from($status);
+
+            $actions[] = Action::make("mark_{$status}")
+                ->label(__("panel.applications.actions.{$status}"))
+                ->icon($icon)
+                ->color($color)
+                ->requiresConfirmation($target === ApplicationStatus::Spam)
+                ->authorize('update')
+                ->visible(fn (Application $record) => $record->status !== $target)
+                ->action(fn (Application $record) => $record->markAs($target, Auth::user()));
+        }
+
+        return $actions;
+    }
+}

app/Filament/Resources/Calls/CallResource.php

@@ -0,0 +1,291 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Calls;
+
+use App\Enums\CallStatus;
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Calls\Pages\CreateCall;
+use App\Filament\Resources\Calls\Pages\EditCall;
+use App\Filament\Resources\Calls\Pages\ListCalls;
+use App\Filament\Resources\Calls\RelationManagers\ApplicationsRelationManager;
+use App\Filament\Support\PreviewAction;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Call;
+use App\Rules\UniqueTranslatedSlug;
+use BackedEnum;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ReplicateAction;
+use Filament\Forms\Components\DatePicker;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Str;
+use UnitEnum;
+
+/**
+ * Calls for contributors — the conversion point of the whole site.
+ *
+ * The hours-per-week and duration fields are what make this worth having as a
+ * model of its own: a volunteer weighs time, and "~4h/week for 8 weeks" is a
+ * decision someone can make in seconds.
+ */
+class CallResource extends Resource
+{
+    protected static ?string $model = Call::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedHandRaised;
+
+    protected static ?int $navigationSort = 3;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.calls.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.calls.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->getTranslation('title', app()->getLocale());
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()->schema([
+                TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                    TextInput::make("title.{$locale}")
+                        ->label(__('panel.calls.fields.title'))
+                        ->required($isDefault)
+                        ->maxLength(255)
+                        ->columnSpanFull()
+                        ->live(onBlur: true)
+                        ->afterStateUpdated(function (?string $state, callable $get, callable $set) use ($locale) {
+                            if (blank($get("slug.{$locale}"))) {
+                                $set("slug.{$locale}", Str::slug((string) $state));
+                            }
+                        }),
+
+                    TextInput::make("slug.{$locale}")
+                        ->label(__('panel.calls.fields.slug'))
+                        ->required($isDefault)
+                        ->maxLength(255)
+                        ->columnSpanFull()
+                        ->rules(fn ($record) => [new UniqueTranslatedSlug(Call::class, $record?->id)]),
+
+                    Textarea::make("description.{$locale}")
+                        ->label(__('panel.calls.fields.description'))
+                        ->rows(4)
+                        ->columnSpanFull(),
+
+                    // Unpaid work needs an explicit exchange. Saying it out
+                    // loud attracts more people than leaving it implied.
+                    Textarea::make("what_you_get.{$locale}")
+                        ->label(__('panel.calls.fields.what_you_get'))
+                        ->helperText(__('panel.calls.fields.what_you_get_hint'))
+                        ->rows(3)
+                        ->columnSpanFull(),
+                ]),
+            ]),
+
+            Section::make(__('panel.calls.sections.commitment'))
+                ->description(__('panel.calls.sections.commitment_hint'))
+                ->columns(3)
+                ->schema([
+                    TextInput::make('hours_per_week')
+                        ->label(__('panel.calls.fields.hours_per_week'))
+                        ->numeric()
+                        ->minValue(1)
+                        ->maxValue(40)
+                        ->suffix('h'),
+
+                    TextInput::make('duration_weeks')
+                        ->label(__('panel.calls.fields.duration_weeks'))
+                        ->numeric()
+                        ->minValue(1),
+
+                    Select::make('seniority')
+                        ->label(__('panel.calls.fields.seniority'))
+                        ->options([
+                            'any' => __('panel.calls.seniority.any'),
+                            'junior' => __('panel.calls.seniority.junior'),
+                            'mid' => __('panel.calls.seniority.mid'),
+                            'senior' => __('panel.calls.seniority.senior'),
+                        ]),
+                ]),
+
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    Select::make('project_id')
+                        ->label(__('panel.calls.fields.project'))
+                        ->relationship('project', 'title->'.config('locales.default'))
+                        ->searchable()
+                        ->preload()
+                        ->helperText(__('panel.calls.fields.project_hint')),
+
+                    Select::make('status')
+                        ->label(__('panel.calls.fields.status'))
+                        ->options(CallStatus::class)
+                        ->default(CallStatus::Open)
+                        ->required(),
+
+                    Select::make('technologies')
+                        ->label(__('panel.calls.fields.technologies'))
+                        ->relationship('technologies', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable()
+                        ->columnSpanFull(),
+
+                    DatePicker::make('opens_at')->label(__('panel.calls.fields.opens_at')),
+                    DatePicker::make('closes_at')->label(__('panel.calls.fields.closes_at')),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('title')
+                    ->label(__('panel.calls.fields.title'))
+                    ->weight('medium')
+                    ->wrap()
+                    ->searchable(query: fn ($q, string $search) => $q
+                        ->where("title->{$locale}", 'like', "%{$search}%")),
+
+                TextColumn::make('status')
+                    ->label(__('panel.calls.fields.status'))
+                    ->badge()
+                    ->sortable(),
+
+                TextColumn::make('project.title')
+                    ->label(__('panel.calls.fields.project'))
+                    ->badge()
+                    ->color('gray')
+                    ->placeholder(__('panel.calls.no_project')),
+
+                // The number that does the work on the public site.
+                TextColumn::make('hours_per_week')
+                    ->label(__('panel.calls.fields.commitment'))
+                    ->formatStateUsing(fn ($state, Call $record) => $state
+                        ? trans_choice('panel.calls.commitment_summary', $record->duration_weeks ?? 0, [
+                            'hours' => $state,
+                            'weeks' => $record->duration_weeks,
+                        ])
+                        : '—')
+                    ->badge()
+                    ->color('info'),
+
+                TextColumn::make('technologies.name')
+                    ->label(__('panel.calls.fields.technologies'))
+                    ->badge()
+                    ->color('gray')
+                    ->limitList(3)
+                    ->toggleable(),
+
+                TextColumn::make('closes_at')
+                    ->label(__('panel.calls.fields.closes_at'))
+                    ->date()
+                    ->placeholder('—')
+                    ->sortable(),
+            ])
+            ->filters([
+                SelectFilter::make('status')
+                    ->label(__('panel.calls.fields.status'))
+                    ->options(CallStatus::options())
+                    ->multiple(),
+
+                SelectFilter::make('technologies')
+                    ->label(__('panel.calls.fields.technologies'))
+                    ->relationship('technologies', 'name')
+                    ->multiple()
+                    ->preload(),
+            ])
+            ->recordActions([
+                // A near-copy is a real workflow: the third similar service,
+                // next year's call. The slug is cleared because two records
+                // cannot answer at the same URL.
+                ReplicateAction::make()
+                    ->label(__('panel.actions.duplicate'))
+                    ->icon('heroicon-o-document-duplicate')
+                    ->excludeAttributes(['slug', 'published_at', 'unpublish_at'])
+                    ->modalHeading(__('panel.actions.duplicate_heading'))
+                    ->successNotificationTitle(__('panel.actions.duplicated')),
+
+                PreviewAction::for('call'),
+
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([DeleteBulkAction::make()]),
+            ]);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+            ApplicationsRelationManager::class,
+        ];
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['title->'.app()->getLocale()];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListCalls::route('/'),
+            'create' => CreateCall::route('/create'),
+            'edit' => EditCall::route('/{record}/edit'),
+        ];
+    }
+
+    /**
+     * How many contributor slots are currently open — the number that tells
+     * the collective whether the site is doing its job.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $open = static::getModel()::query()->open()->count();
+
+        return $open > 0 ? (string) $open : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'success';
+    }
+}

app/Filament/Resources/Calls/Pages/CreateCall.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Calls\Pages;
+
+use App\Filament\Resources\Calls\CallResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateCall extends CreateRecord
+{
+    protected static string $resource = CallResource::class;
+}

app/Filament/Resources/Calls/Pages/EditCall.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Calls\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Calls\CallResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditCall extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = CallResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Calls/Pages/ListCalls.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Calls\Pages;
+
+use App\Filament\Resources\Calls\CallResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListCalls extends ListRecords
+{
+    protected static string $resource = CallResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Calls/RelationManagers/ApplicationsRelationManager.php

@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Calls\RelationManagers;
+
+use App\Enums\ApplicationStatus;
+use App\Filament\Resources\Applications\ApplicationResource;
+use App\Models\Application;
+use Filament\Actions\Action;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * Who answered this call, shown on the call itself.
+ *
+ * The inbox is the place to work through everything at once; this is the place
+ * to answer the question you actually have while looking at an opening — is
+ * anybody interested? A call with no replies after a month is telling you
+ * something about the call, not about the people.
+ */
+class ApplicationsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'applications';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.applications.plural');
+    }
+
+    public static function getBadge(Model $ownerRecord, string $pageClass): ?string
+    {
+        $pending = $ownerRecord->applications()->pending()->count();
+
+        return $pending > 0 ? (string) $pending : null;
+    }
+
+    public static function canViewForRecord(Model $ownerRecord, string $pageClass): bool
+    {
+        // The inbox holds personal data, so it stays behind its own permission
+        // even for someone already allowed to edit the call.
+        return (bool) Auth::user()?->can('applications.view_any');
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('name')
+                    ->label(__('panel.applications.fields.name'))
+                    ->weight('medium')
+                    ->description(fn (Application $record) => $record->email),
+
+                TextColumn::make('hours_per_week')
+                    ->label(__('panel.applications.fields.hours_per_week'))
+                    ->badge()
+                    ->color('info')
+                    ->formatStateUsing(fn (?int $state) => $state ? "{$state} h" : '—'),
+
+                TextColumn::make('status')
+                    ->label(__('panel.applications.fields.status'))
+                    ->badge(),
+
+                TextColumn::make('created_at')
+                    ->label(__('panel.applications.fields.received_at'))
+                    ->since()
+                    ->dateTimeTooltip(),
+            ])
+            ->recordActions([
+                Action::make('open')
+                    ->label(__('panel.applications.actions.open'))
+                    ->icon('heroicon-o-arrow-top-right-on-square')
+                    ->url(fn (Application $record) => ApplicationResource::getUrl('view', ['record' => $record])),
+
+                Action::make('mark_contacted')
+                    ->label(__('panel.applications.actions.contacted'))
+                    ->icon('heroicon-o-chat-bubble-left-right')
+                    ->color('info')
+                    ->authorize('update')
+                    ->visible(fn (Application $record) => $record->status === ApplicationStatus::New)
+                    ->action(fn (Application $record) => $record->markAs(
+                        ApplicationStatus::Contacted,
+                        Auth::user(),
+                    )),
+            ])
+            ->emptyStateHeading(__('panel.applications.empty.call_heading'))
+            ->emptyStateIcon('heroicon-o-inbox');
+    }
+}

app/Filament/Resources/Categories/CategoryResource.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Categories;
+
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Categories\Pages\CreateCategory;
+use App\Filament\Resources\Categories\Pages\EditCategory;
+use App\Filament\Resources\Categories\Pages\ListCategories;
+use App\Filament\Resources\Categories\Schemas\CategoryForm;
+use App\Filament\Resources\Categories\Tables\CategoriesTable;
+use App\Models\Category;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\SoftDeletingScope;
+use UnitEnum;
+
+class CategoryResource extends Resource
+{
+    protected static ?string $model = Category::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedTag;
+
+    protected static ?int $navigationSort = 20;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.categories.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.categories.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.content');
+    }
+
+    /**
+     * Records are labelled by their name in the admin's current language.
+     */
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->getTranslation('name', app()->getLocale());
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return CategoryForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return CategoriesTable::configure($table);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['name->'.app()->getLocale()];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListCategories::route('/'),
+            'create' => CreateCategory::route('/create'),
+            'edit' => EditCategory::route('/{record}/edit'),
+        ];
+    }
+
+    public static function getRecordRouteBindingEloquentQuery(): Builder
+    {
+        return parent::getRecordRouteBindingEloquentQuery()
+            ->withoutGlobalScopes([SoftDeletingScope::class]);
+    }
+}

app/Filament/Resources/Categories/Pages/CreateCategory.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Filament\Resources\Categories\Pages;
+
+use App\Filament\Resources\Categories\CategoryResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateCategory extends CreateRecord
+{
+    protected static string $resource = CategoryResource::class;
+}

app/Filament/Resources/Categories/Pages/EditCategory.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Filament\Resources\Categories\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Categories\CategoryResource;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\ForceDeleteAction;
+use Filament\Actions\RestoreAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditCategory extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = CategoryResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+            ForceDeleteAction::make(),
+            RestoreAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Categories/Pages/ListCategories.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Filament\Resources\Categories\Pages;
+
+use App\Filament\Resources\Categories\CategoryResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListCategories extends ListRecords
+{
+    protected static string $resource = CategoryResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Categories/Schemas/CategoryForm.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Categories\Schemas;
+
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Category;
+use App\Rules\UniqueTranslatedSlug;
+use Filament\Forms\Components\ColorPicker;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Support\Str;
+
+class CategoryForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                TextInput::make("name.{$locale}")
+                    ->label(__('panel.categories.fields.name'))
+                    ->required($isDefault)
+                    ->maxLength(255)
+                    ->live(onBlur: true)
+                    // Fill the slug from the name while it is still untouched,
+                    // per locale, so each language gets its own readable URL.
+                    ->afterStateUpdated(function (?string $state, callable $get, callable $set) use ($locale) {
+                        if (blank($get("slug.{$locale}"))) {
+                            $set("slug.{$locale}", Str::slug((string) $state));
+                        }
+                    }),
+
+                TextInput::make("slug.{$locale}")
+                    ->label(__('panel.categories.fields.slug'))
+                    ->required($isDefault)
+                    ->maxLength(255)
+                    ->rules(fn ($record) => [new UniqueTranslatedSlug(Category::class, $record?->id)]),
+
+                Textarea::make("description.{$locale}")
+                    ->label(__('panel.categories.fields.description'))
+                    ->rows(3)
+                    ->maxLength(1000)
+                    ->columnSpanFull(),
+            ]),
+
+            Section::make()
+                ->columns(3)
+                ->schema([
+                    ColorPicker::make('color')
+                        ->label(__('panel.categories.fields.color')),
+
+                    TextInput::make('position')
+                        ->label(__('panel.categories.fields.position'))
+                        ->numeric()
+                        ->default(0)
+                        ->minValue(0),
+
+                    Toggle::make('is_visible')
+                        ->label(__('panel.categories.fields.is_visible'))
+                        ->default(true),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Categories/Tables/CategoriesTable.php

@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Categories\Tables;
+
+use App\Filament\Support\TranslationStatusColumn;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Tables\Columns\ColorColumn;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+
+class CategoriesTable
+{
+    public static function configure(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            ->defaultSort('position')
+            ->reorderable('position')
+            ->columns([
+                ColorColumn::make('color')
+                    ->label(__('panel.categories.fields.color')),
+
+                TextColumn::make('name')
+                    ->label(__('panel.categories.fields.name'))
+                    // The model resolves `name` to the active locale already;
+                    // sort and search must target that locale's JSON key.
+                    ->searchable(query: fn ($query, string $search) => $query
+                        ->where("name->{$locale}", 'like', "%{$search}%"))
+                    ->sortable(query: fn ($query, string $direction) => $query
+                        ->orderBy("name->{$locale}", $direction)),
+
+                TextColumn::make('slug')
+                    ->label(__('panel.categories.fields.slug'))
+                    ->color('gray')
+                    ->toggleable(isToggledHiddenByDefault: true),
+
+                TranslationStatusColumn::make('translations')
+                    ->label(__('panel.pages.fields.translations')),
+
+                TextColumn::make('pages_count')
+                    ->label(__('panel.categories.fields.pages_count'))
+                    ->counts('pages')
+                    ->badge()
+                    ->sortable(),
+
+                IconColumn::make('is_visible')
+                    ->label(__('panel.categories.fields.is_visible'))
+                    ->boolean()
+                    ->sortable(),
+            ])
+            ->filters([
+                TernaryFilter::make('is_visible')
+                    ->label(__('panel.categories.fields.is_visible')),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+}

app/Filament/Resources/Clients/ClientResource.php

@@ -0,0 +1,220 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Clients;
+
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Clients\Pages\CreateClient;
+use App\Filament\Resources\Clients\Pages\EditClient;
+use App\Filament\Resources\Clients\Pages\ListClients;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Client;
+use BackedEnum;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+use UnitEnum;
+
+/**
+ * The organisations the work was for.
+ *
+ * This used to be a name typed into every project by hand. Being a record
+ * makes the wall of logos possible, stops the same association becoming two
+ * entities because of a typo, and gives "everything we did for them" an
+ * answer.
+ */
+class ClientResource extends Resource
+{
+    protected static ?string $model = Client::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedBuildingOffice2;
+
+    protected static ?int $navigationSort = 5;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.clients.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.clients.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->name;
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    // A proper noun: an association is called what it is called
+                    // in every language, so this is not translated.
+                    TextInput::make('name')
+                        ->label(__('panel.clients.fields.name'))
+                        ->required()
+                        ->maxLength(255)
+                        ->live(onBlur: true)
+                        ->afterStateUpdated(function (?string $state, callable $get, callable $set) {
+                            if (blank($get('slug'))) {
+                                $set('slug', Str::slug((string) $state));
+                            }
+                        }),
+
+                    TextInput::make('slug')
+                        ->label(__('panel.clients.fields.slug'))
+                        ->required()
+                        ->maxLength(255)
+                        ->rules(fn ($record) => [
+                            Rule::unique('clients', 'slug')->ignore($record?->id),
+                        ]),
+
+                    TextInput::make('url')
+                        ->label(__('panel.clients.fields.url'))
+                        ->url()
+                        ->maxLength(2048)
+                        ->columnSpanFull(),
+
+                    FileUpload::make('logo')
+                        ->label(__('panel.clients.fields.logo'))
+                        ->image()
+                        ->disk(config('media.disk'))
+                        ->directory('clients')
+                        ->helperText(__('panel.clients.fields.logo_hint'))
+                        ->columnSpanFull(),
+
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("sector.{$locale}")
+                            ->label(__('panel.clients.fields.sector'))
+                            ->maxLength(120)
+                            ->columnSpanFull(),
+                    ])->columnSpanFull(),
+
+                    Toggle::make('is_public')
+                        ->label(__('panel.clients.fields.is_public'))
+                        // Not everybody wants to appear on somebody else's
+                        // website, and that is their call, not ours.
+                        ->helperText(__('panel.clients.fields.is_public_hint'))
+                        ->default(true),
+
+                    TextInput::make('position')
+                        ->label(__('panel.clients.fields.position'))
+                        ->numeric()
+                        ->default(0),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('position')
+            ->reorderable('position')
+            ->columns([
+                ImageColumn::make('logo')
+                    ->label('')
+                    ->disk(config('media.disk'))
+                    ->height(32),
+
+                TextColumn::make('name')
+                    ->label(__('panel.clients.fields.name'))
+                    ->weight('medium')
+                    ->description(fn (Client $record) => $record->getTranslation('sector', app()->getLocale(), false) ?: null)
+                    ->searchable()
+                    ->sortable(),
+
+                TextColumn::make('projects_count')
+                    ->label(__('panel.clients.fields.projects'))
+                    ->counts('projects')
+                    ->badge()
+                    ->color('gray'),
+
+                IconColumn::make('is_public')
+                    ->label(__('panel.clients.fields.is_public'))
+                    ->boolean(),
+
+                TextColumn::make('url')
+                    ->label(__('panel.clients.fields.url'))
+                    ->url(fn (Client $record) => $record->url)
+                    ->openUrlInNewTab()
+                    ->placeholder('—')
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->filters([
+                TernaryFilter::make('is_public')->label(__('panel.clients.fields.is_public')),
+
+                // A client with no logo is a hole in the wall of logos.
+                Filter::make('without_logo')
+                    ->label(__('panel.clients.filters.without_logo'))
+                    ->query(fn (Builder $query) => $query->whereNull('logo')),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['name'];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListClients::route('/'),
+            'create' => CreateClient::route('/create'),
+            'edit' => EditClient::route('/{record}/edit'),
+        ];
+    }
+}

app/Filament/Resources/Clients/Pages/CreateClient.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Clients\Pages;
+
+use App\Filament\Resources\Clients\ClientResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateClient extends CreateRecord
+{
+    protected static string $resource = ClientResource::class;
+}

app/Filament/Resources/Clients/Pages/EditClient.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Clients\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Clients\ClientResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditClient extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = ClientResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Clients/Pages/ListClients.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Clients\Pages;
+
+use App\Filament\Resources\Clients\ClientResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListClients extends ListRecords
+{
+    protected static string $resource = ClientResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Media/MediaResource.php

@@ -0,0 +1,203 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Media;
+
+use App\Filament\Resources\Media\Pages\ListMedia;
+use App\Jobs\ProcessMedia;
+use App\Models\Media;
+use BackedEnum;
+use Filament\Actions\Action;
+use Filament\Actions\DeleteAction;
+use Filament\Notifications\Notification;
+use Filament\Resources\Resource;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Storage;
+use UnitEnum;
+
+/**
+ * Everything that has been uploaded, and what is known about it.
+ *
+ * Nothing here is authored: the rows are derived from the files, so this is a
+ * place to look rather than to write. What it answers is the set of questions
+ * nowhere else could — what is taking up the disk, which images never got
+ * processed, and which files nothing points at any more.
+ */
+class MediaResource extends Resource
+{
+    protected static ?string $model = Media::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedPhoto;
+
+    protected static ?int $navigationSort = 86;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.media.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.media.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->path;
+    }
+
+    public static function canCreate(): bool
+    {
+        // Files arrive by being uploaded on a record, not from here.
+        return false;
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                ImageColumn::make('path')
+                    ->label('')
+                    ->disk(fn (Media $record) => $record->disk)
+                    ->height(48),
+
+                TextColumn::make('path')
+                    ->label(__('panel.media.fields.file'))
+                    ->fontFamily('mono')
+                    ->size('xs')
+                    ->wrap()
+                    ->searchable()
+                    ->description(fn (Media $record) => $record->mime),
+
+                TextColumn::make('width')
+                    ->label(__('panel.media.fields.size'))
+                    ->state(fn (Media $record) => $record->width
+                        ? "{$record->width}×{$record->height}"
+                        : __('panel.media.pending'))
+                    ->badge()
+                    ->color(fn (Media $record) => $record->width ? 'gray' : 'warning'),
+
+                TextColumn::make('variants')
+                    ->label(__('panel.media.fields.versions'))
+                    ->state(fn (Media $record) => count($record->variants ?? []))
+                    ->badge()
+                    ->color(fn (int $state) => $state > 0 ? 'success' : 'gray'),
+
+                // Original plus every derived version: the number that
+                // explains where the disk went.
+                TextColumn::make('size')
+                    ->label(__('panel.media.fields.weight'))
+                    ->state(fn (Media $record) => round($record->totalSize() / 1024).' KB')
+                    ->sortable(),
+
+                TextColumn::make('used')
+                    ->label(__('panel.media.fields.used'))
+                    ->state(fn (Media $record) => $record->isReferenced()
+                        ? __('panel.media.in_use')
+                        : __('panel.media.orphan'))
+                    ->badge()
+                    ->color(fn (Media $record) => $record->isReferenced() ? 'success' : 'warning'),
+
+                TextColumn::make('error')
+                    ->label(__('panel.media.fields.error'))
+                    ->wrap()
+                    ->color('danger')
+                    ->placeholder('—')
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->filters([
+                Filter::make('pending')
+                    ->label(__('panel.media.filters.pending'))
+                    ->query(fn (Builder $query) => $query->pending()),
+
+                Filter::make('failed')
+                    ->label(__('panel.media.filters.failed'))
+                    ->query(fn (Builder $query) => $query->whereNotNull('error')),
+
+                // Everything the prune command would take away.
+                Filter::make('orphans')
+                    ->label(__('panel.media.filters.orphans'))
+                    ->query(fn (Builder $query) => $query
+                        ->whereNotIn('path', Media::referencedPaths())),
+
+                Filter::make('missing')
+                    ->label(__('panel.media.filters.missing'))
+                    ->query(fn (Builder $query) => $query
+                        ->whereIn('id', Media::query()->get()
+                            ->reject(fn (Media $m) => $m->exists())
+                            ->pluck('id'))),
+            ])
+            ->recordActions([
+                Action::make('open')
+                    ->label(__('panel.media.actions.open'))
+                    ->icon('heroicon-o-arrow-top-right-on-square')
+                    ->url(fn (Media $record) => $record->url())
+                    ->openUrlInNewTab(),
+
+                Action::make('reprocess')
+                    ->label(__('panel.media.actions.reprocess'))
+                    ->icon('heroicon-o-arrow-path')
+                    ->color('gray')
+                    ->action(function (Media $record): void {
+                        ProcessMedia::dispatch($record);
+
+                        Notification::make()
+                            ->title(__('panel.media.actions.reprocess_queued'))
+                            ->success()
+                            ->send();
+                    }),
+
+                // Only offered for files nothing points at: deleting one in
+                // use would put a broken image on the public site.
+                DeleteAction::make()
+                    ->visible(fn (Media $record) => ! $record->isReferenced())
+                    ->before(function (Media $record): void {
+                        $record->deleteDerived();
+                        Storage::disk($record->disk)->delete($record->path);
+                    }),
+            ])
+            ->emptyStateHeading(__('panel.media.empty.heading'))
+            ->emptyStateDescription(__('panel.media.empty.description'))
+            ->emptyStateIcon('heroicon-o-photo');
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['path'];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListMedia::route('/'),
+        ];
+    }
+
+    public static function getNavigationBadge(): ?string
+    {
+        $pending = static::getModel()::query()->pending()->count();
+
+        return $pending > 0 ? (string) $pending : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'warning';
+    }
+}

app/Filament/Resources/Media/Pages/ListMedia.php

@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Media\Pages;
+
+use App\Filament\Resources\Media\MediaResource;
+use App\Models\Media;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification;
+use Filament\Resources\Pages\ListRecords;
+use Illuminate\Support\Facades\Auth;
+
+class ListMedia extends ListRecords
+{
+    protected static string $resource = MediaResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            // The media table is derived, so rebuilding it is always safe and
+            // is the answer to "I changed the widths, now what?".
+            Action::make('reprocess_all')
+                ->label(__('panel.media.actions.reprocess_all'))
+                ->icon('heroicon-o-arrow-path')
+                ->color('gray')
+                ->requiresConfirmation()
+                ->modalDescription(__('panel.media.actions.reprocess_all_hint'))
+                ->visible(fn () => Auth::user()?->can('media.view_any'))
+                ->action(function (): void {
+                    Media::query()->update(['processed_at' => null]);
+
+                    Notification::make()
+                        ->title(__('panel.media.actions.reprocess_queued'))
+                        ->success()
+                        ->send();
+                }),
+        ];
+    }
+
+    public function getSubheading(): ?string
+    {
+        $total = Media::query()->get()->sum(fn (Media $m) => $m->totalSize());
+
+        return __('panel.media.subheading', [
+            'count' => Media::query()->count(),
+            'size' => round($total / 1024 / 1024, 1),
+        ]);
+    }
+}

app/Filament/Resources/Members/MemberResource.php

@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members;
+
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Members\Pages\CreateMember;
+use App\Filament\Resources\Members\Pages\EditMember;
+use App\Filament\Resources\Members\Pages\ListMembers;
+use App\Filament\Resources\Members\Schemas\MemberForm;
+use App\Filament\Resources\Members\Tables\MembersTable;
+use App\Models\Member;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\SoftDeletingScope;
+use UnitEnum;
+
+/**
+ * People in the collective.
+ *
+ * Deliberately separate from User: most members never need panel access, and
+ * removing someone's admin rights must not remove them from the website.
+ */
+class MemberResource extends Resource
+{
+    protected static ?string $model = Member::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedUserGroup;
+
+    protected static ?int $navigationSort = 2;
+
+    protected static ?string $recordTitleAttribute = 'name';
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.members.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.members.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return MemberForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return MembersTable::configure($table);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['name'];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListMembers::route('/'),
+            'create' => CreateMember::route('/create'),
+            'edit' => EditMember::route('/{record}/edit'),
+        ];
+    }
+
+    public static function getRecordRouteBindingEloquentQuery(): Builder
+    {
+        return parent::getRecordRouteBindingEloquentQuery()
+            ->withoutGlobalScopes([SoftDeletingScope::class]);
+    }
+}

app/Filament/Resources/Members/Pages/CreateMember.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members\Pages;
+
+use App\Filament\Resources\Members\MemberResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateMember extends CreateRecord
+{
+    protected static string $resource = MemberResource::class;
+}

app/Filament/Resources/Members/Pages/EditMember.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Members\MemberResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditMember extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = MemberResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Members/Pages/ListMembers.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members\Pages;
+
+use App\Filament\Resources\Members\MemberResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListMembers extends ListRecords
+{
+    protected static string $resource = MemberResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Members/Schemas/MemberForm.php

@@ -0,0 +1,121 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members\Schemas;
+
+use App\Filament\Support\TranslatableTabs;
+use Filament\Forms\Components\DatePicker;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+
+class MemberForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    TextInput::make('name')
+                        ->label(__('panel.members.fields.name'))
+                        ->required()
+                        ->maxLength(255)
+                        ->live(onBlur: true)
+                        ->afterStateUpdated(function (?string $state, callable $get, callable $set) {
+                            if (blank($get('slug'))) {
+                                $set('slug', Str::slug((string) $state));
+                            }
+                        }),
+
+                    TextInput::make('slug')
+                        ->label(__('panel.members.fields.slug'))
+                        ->required()
+                        ->maxLength(255)
+                        ->rules(fn ($record) => [Rule::unique('members', 'slug')->ignore($record?->id)]),
+
+                    FileUpload::make('avatar')
+                        ->label(__('panel.members.fields.avatar'))
+                        ->image()
+                        ->avatar()
+                        // Explicit: the default disk is private, and the
+                        // frontend runs on another host.
+                        ->disk(config('media.disk'))
+                        ->directory('members')
+                        ->imageEditor()
+                        // A portrait is described by the person's name, so
+                        // there is no alt field here to fill in wrong.
+                        ->helperText(__('panel.members.fields.avatar_hint')),
+
+                    // The link that makes commit attribution and the git
+                    // integration line up with a real person.
+                    TextInput::make('github_username')
+                        ->label(__('panel.members.fields.github_username'))
+                        ->prefix('github.com/')
+                        ->maxLength(120),
+
+                    Select::make('user_id')
+                        ->label(__('panel.members.fields.user'))
+                        ->relationship('user', 'name')
+                        ->searchable()
+                        ->preload()
+                        ->helperText(__('panel.members.fields.user_hint')),
+
+                    Select::make('technologies')
+                        ->label(__('panel.members.fields.technologies'))
+                        ->relationship('technologies', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable(),
+                ]),
+
+            Section::make(__('panel.members.sections.profile'))
+                ->description(__('panel.members.sections.profile_hint'))
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                        TextInput::make("headline.{$locale}")
+                            ->label(__('panel.members.fields.headline'))
+                            ->maxLength(255)
+                            ->columnSpanFull(),
+
+                        Textarea::make("bio.{$locale}")
+                            ->label(__('panel.members.fields.bio'))
+                            ->rows(5)
+                            ->columnSpanFull(),
+                    ]),
+                ]),
+
+            Section::make(__('panel.members.sections.membership'))
+                ->columns(3)
+                ->schema([
+                    Toggle::make('is_public')
+                        ->label(__('panel.members.fields.is_public'))
+                        ->default(true),
+
+                    Toggle::make('is_founder')
+                        ->label(__('panel.members.fields.is_founder')),
+
+                    TextInput::make('position')
+                        ->label(__('panel.members.fields.position'))
+                        ->numeric()
+                        ->default(0),
+
+                    DatePicker::make('joined_at')
+                        ->label(__('panel.members.fields.joined_at')),
+
+                    // Leaving hides them from the current roster without
+                    // erasing the work they did.
+                    DatePicker::make('left_at')
+                        ->label(__('panel.members.fields.left_at'))
+                        ->helperText(__('panel.members.fields.left_at_hint')),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Members/Tables/MembersTable.php

@@ -0,0 +1,102 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Members\Tables;
+
+use App\Models\Member;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+
+class MembersTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->defaultSort('position')
+            ->reorderable('position')
+            ->columns([
+                ImageColumn::make('avatar')
+                    ->label('')
+                    ->circular()
+                    ->disk(config('media.disk'))
+                    ->defaultImageUrl(fn (Member $r) => 'https://ui-avatars.com/api/?name='.urlencode($r->name)),
+
+                TextColumn::make('name')
+                    ->label(__('panel.members.fields.name'))
+                    ->weight('medium')
+                    ->description(fn (Member $r) => $r->getTranslation('headline', app()->getLocale(), false) ?: null)
+                    ->searchable(['name', 'slug', 'github_username'])
+                    ->sortable(),
+
+                TextColumn::make('technologies.name')
+                    ->label(__('panel.members.fields.technologies'))
+                    ->badge()
+                    ->color('gray')
+                    ->limitList(3)
+                    ->expandableLimitedList()
+                    ->toggleable(),
+
+                TextColumn::make('projects_count')
+                    ->label(__('panel.members.fields.projects'))
+                    ->counts('projects')
+                    ->badge(),
+
+                IconColumn::make('is_founder')
+                    ->label(__('panel.members.fields.is_founder'))
+                    ->boolean()
+                    ->toggleable(),
+
+                IconColumn::make('is_public')
+                    ->label(__('panel.members.fields.is_public'))
+                    ->boolean(),
+
+                TextColumn::make('left_at')
+                    ->label(__('panel.members.fields.left_at'))
+                    ->date()
+                    ->placeholder('—')
+                    ->toggleable(),
+            ])
+            ->filters([
+                TernaryFilter::make('is_public')
+                    ->label(__('panel.members.fields.is_public')),
+
+                SelectFilter::make('technologies')
+                    ->label(__('panel.members.fields.technologies'))
+                    ->relationship('technologies', 'name')
+                    ->multiple()
+                    ->preload(),
+
+                Filter::make('current')
+                    ->label(__('panel.members.filters.current'))
+                    ->default()
+                    ->query(fn (Builder $q) => $q->whereNull('left_at')),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+}

app/Filament/Resources/MissingUrls/MissingUrlResource.php

@@ -0,0 +1,287 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\MissingUrls;
+
+use App\Enums\MissingUrlStatus;
+use App\Filament\Resources\MissingUrls\Pages\ListMissingUrls;
+use App\Models\MissingUrl;
+use App\Models\Redirect;
+use BackedEnum;
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Notifications\Notification;
+use Filament\Resources\Resource;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Database\Eloquent\Model;
+use UnitEnum;
+
+/**
+ * Addresses visitors asked for and the frontend could not answer.
+ *
+ * Redirects were only ever written from one side: a slug renamed here leaves a
+ * note behind, because that is the moment the old address is still known. The
+ * links that break without anybody renaming anything — the previous website's,
+ * an address on a poster, another site's link to a page that moved years ago —
+ * failed silently, in front of a visitor, and never reached this panel.
+ *
+ * This is the other half. Nothing here is authored: rows arrive from the
+ * frontend, and the only decision to make about one is whether it deserves a
+ * redirect. Which is why the whole screen is really one button.
+ */
+class MissingUrlResource extends Resource
+{
+    protected static ?string $model = MissingUrl::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedMagnifyingGlassCircle;
+
+    // Directly under Redirects: the two are read together, and this one is
+    // where the other one's entries come from.
+    protected static ?int $navigationSort = 86;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.missing_urls.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.missing_urls.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->path;
+    }
+
+    public static function canCreate(): bool
+    {
+        // These are reported, not written. A hand-typed one would be a
+        // redirect somebody had not got round to creating yet.
+        return false;
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            // Worst first: how many people hit it, not when it last happened.
+            // One address requested two hundred times is the whole point of
+            // the screen; a hundred requested once each are noise.
+            ->defaultSort('hits', 'desc')
+            ->columns([
+                TextColumn::make('path')
+                    ->label(__('panel.missing_urls.fields.path'))
+                    ->fontFamily('mono')
+                    ->searchable()
+                    ->wrap()
+                    // The strongest signal on the row: a referrer on our own
+                    // domain means something we publish links here.
+                    ->description(fn (MissingUrl $record) => $record->isInternalReferrer()
+                        ? __('panel.missing_urls.linked_from_us')
+                        : null),
+
+                TextColumn::make('hits')
+                    ->label(__('panel.missing_urls.fields.hits'))
+                    ->badge()
+                    ->color(fn (int $state) => match (true) {
+                        $state >= 10 => 'danger',
+                        $state >= 2 => 'warning',
+                        default => 'gray',
+                    })
+                    ->sortable(),
+
+                TextColumn::make('locale')
+                    ->label(__('panel.missing_urls.fields.locale'))
+                    ->badge()
+                    ->color('gray')
+                    ->toggleable(),
+
+                TextColumn::make('status')
+                    ->label(__('panel.missing_urls.fields.status'))
+                    ->badge(),
+
+                TextColumn::make('referrer')
+                    ->label(__('panel.missing_urls.fields.referrer'))
+                    ->placeholder(__('panel.missing_urls.no_referrer'))
+                    ->wrap()
+                    ->size('xs')
+                    ->color(fn (MissingUrl $record) => $record->isInternalReferrer() ? 'danger' : 'gray')
+                    ->toggleable(),
+
+                TextColumn::make('last_seen_at')
+                    ->label(__('panel.missing_urls.fields.last_seen'))
+                    ->since()
+                    ->dateTimeTooltip()
+                    ->sortable(),
+            ])
+            ->filters([
+                SelectFilter::make('status')
+                    ->label(__('panel.missing_urls.fields.status'))
+                    ->options(MissingUrlStatus::options())
+                    // The list is a to-do list, so it opens as one.
+                    ->default(MissingUrlStatus::Pending->value),
+
+                Filter::make('internal')
+                    ->label(__('panel.missing_urls.filters.internal'))
+                    ->query(fn (Builder $query) => $query
+                        ->where('referrer', 'like', rtrim((string) config('site.url'), '/').'%')),
+
+                Filter::make('repeated')
+                    ->label(__('panel.missing_urls.filters.repeated'))
+                    ->query(fn (Builder $query) => $query->where('hits', '>=', 2)),
+            ])
+            ->recordActions([
+                Action::make('redirect')
+                    ->label(__('panel.missing_urls.actions.redirect'))
+                    ->icon('heroicon-o-arrows-right-left')
+                    ->color('primary')
+                    ->authorize('redirect')
+                    ->visible(fn (MissingUrl $record) => $record->status !== MissingUrlStatus::Resolved)
+                    ->modalHeading(__('panel.missing_urls.actions.redirect_heading'))
+                    ->modalDescription(__('panel.missing_urls.actions.redirect_hint'))
+                    ->schema([
+                        // Read-only: the origin is the address that failed. It
+                        // is here to be seen while typing the destination, not
+                        // to be edited.
+                        TextInput::make('from')
+                            ->label(__('panel.redirects.fields.from'))
+                            ->disabled()
+                            ->dehydrated(false)
+                            ->default(fn (MissingUrl $record) => $record->path),
+
+                        TextInput::make('to')
+                            ->label(__('panel.redirects.fields.to'))
+                            ->required()
+                            ->maxLength(500)
+                            ->placeholder('/proyectos/nombre-nuevo')
+                            ->dehydrateStateUsing(fn (string $state) => Redirect::normalise($state)),
+
+                        Select::make('status')
+                            ->label(__('panel.redirects.fields.status'))
+                            ->options([
+                                301 => __('panel.redirects.statuses.301'),
+                                302 => __('panel.redirects.statuses.302'),
+                            ])
+                            ->default(301)
+                            ->required(),
+
+                        Select::make('locale')
+                            ->label(__('panel.redirects.fields.locale'))
+                            ->helperText(__('panel.missing_urls.actions.locale_hint'))
+                            ->options(fn () => collect(config('locales.supported'))
+                                ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                                ->all())
+                            ->default(fn (MissingUrl $record) => $record->locale)
+                            ->placeholder(__('panel.redirects.every_locale')),
+                    ])
+                    ->action(function (MissingUrl $record, array $data): void {
+                        // The record is marked resolved by the redirect being
+                        // created, not from here, so a rule written anywhere
+                        // else closes its report too.
+                        Redirect::create([
+                            'from' => $record->path,
+                            'to' => $data['to'],
+                            'status' => $data['status'],
+                            'locale' => $data['locale'] ?? null,
+                            'is_enabled' => true,
+                        ]);
+
+                        Notification::make()
+                            ->title(__('panel.missing_urls.actions.redirected'))
+                            ->success()
+                            ->send();
+                    }),
+
+                Action::make('ignore')
+                    ->label(__('panel.missing_urls.actions.ignore'))
+                    ->icon('heroicon-o-eye-slash')
+                    ->color('gray')
+                    ->authorize('update')
+                    ->visible(fn (MissingUrl $record) => $record->status !== MissingUrlStatus::Ignored)
+                    ->action(fn (MissingUrl $record) => $record->update([
+                        'status' => MissingUrlStatus::Ignored,
+                    ])),
+
+                Action::make('unignore')
+                    ->label(__('panel.missing_urls.actions.unignore'))
+                    ->icon('heroicon-o-eye')
+                    ->color('gray')
+                    ->authorize('update')
+                    ->visible(fn (MissingUrl $record) => $record->status === MissingUrlStatus::Ignored)
+                    ->action(fn (MissingUrl $record) => $record->update([
+                        'status' => MissingUrlStatus::Pending,
+                    ])),
+
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    // The bulk action that matters: a scan produces dozens of
+                    // rows at once and dismissing them one by one is how a
+                    // list stops being read.
+                    BulkAction::make('ignore')
+                        ->label(__('panel.missing_urls.actions.ignore'))
+                        ->icon('heroicon-o-eye-slash')
+                        ->authorize('updateAny')
+                        ->deselectRecordsAfterCompletion()
+                        ->action(fn (Collection $records) => MissingUrl::query()
+                            ->whereKey($records->pluck('id'))
+                            ->update(['status' => MissingUrlStatus::Ignored])),
+
+                    DeleteBulkAction::make(),
+                ]),
+            ])
+            ->emptyStateHeading(__('panel.missing_urls.empty.heading'))
+            ->emptyStateDescription(__('panel.missing_urls.empty.description'))
+            ->emptyStateIcon('heroicon-o-magnifying-glass-circle');
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['path'];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListMissingUrls::route('/'),
+        ];
+    }
+
+    /**
+     * Only what somebody still has to decide about, and only when it has
+     * happened more than once — a badge counting one-off scans would be a
+     * number that never reaches zero, which is a number nobody looks at.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $pending = static::getModel()::query()->pending()->where('hits', '>=', 2)->count();
+
+        return $pending > 0 ? (string) $pending : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'warning';
+    }
+}

app/Filament/Resources/MissingUrls/Pages/ListMissingUrls.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\MissingUrls\Pages;
+
+use App\Filament\Resources\MissingUrls\MissingUrlResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListMissingUrls extends ListRecords
+{
+    protected static string $resource = MissingUrlResource::class;
+
+    // No create action: the frontend is the only author there is.
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Resources/Pages/PageResource.php

@@ -0,0 +1,103 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages;
+
+use App\Filament\RelationManagers\ReviewsRelationManager;
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Pages\Pages\CreatePage;
+use App\Filament\Resources\Pages\Pages\EditPage;
+use App\Filament\Resources\Pages\Pages\ListPages;
+use App\Filament\Resources\Pages\Schemas\PageForm;
+use App\Filament\Resources\Pages\Tables\PagesTable;
+use App\Models\Page;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\SoftDeletingScope;
+use UnitEnum;
+
+class PageResource extends Resource
+{
+    protected static ?string $model = Page::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedDocumentText;
+
+    protected static ?int $navigationSort = 10;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.pages.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.pages.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.content');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->getTranslation('title', app()->getLocale());
+    }
+
+    /**
+     * Global search looks inside the admin's current language only, so results
+     * read the way they expect rather than surfacing a stray English match.
+     *
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['title->'.app()->getLocale()];
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return PageForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return PagesTable::configure($table);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            ReviewsRelationManager::class,
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListPages::route('/'),
+            'create' => CreatePage::route('/create'),
+            'edit' => EditPage::route('/{record}/edit'),
+        ];
+    }
+
+    public static function getRecordRouteBindingEloquentQuery(): Builder
+    {
+        return parent::getRecordRouteBindingEloquentQuery()
+            ->withoutGlobalScopes([SoftDeletingScope::class]);
+    }
+
+    public static function getNavigationBadge(): ?string
+    {
+        $drafts = static::getModel()::query()->where('status', 'draft')->count();
+
+        return $drafts > 0 ? (string) $drafts : null;
+    }
+}

app/Filament/Resources/Pages/Pages/CreatePage.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Pages;
+
+use App\Enums\PageStatus;
+use App\Filament\Resources\Pages\PageResource;
+use Filament\Resources\Pages\CreateRecord;
+use Illuminate\Support\Facades\Auth;
+
+class CreatePage extends CreateRecord
+{
+    protected static string $resource = PageResource::class;
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeCreate(array $data): array
+    {
+        $data['author_id'] ??= Auth::id();
+
+        // Creating something already marked published goes live now unless a
+        // date was chosen deliberately.
+        if (($data['status'] ?? null) === PageStatus::Published->value && blank($data['published_at'] ?? null)) {
+            $data['published_at'] = now();
+        }
+
+        return $data;
+    }
+}

app/Filament/Resources/Pages/Pages/EditPage.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Pages;
+
+use App\Enums\PageStatus;
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Pages\PageResource;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\ForceDeleteAction;
+use Filament\Actions\RestoreAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditPage extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = PageResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+            ForceDeleteAction::make(),
+            RestoreAction::make(),
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeSave(array $data): array
+    {
+        if (($data['status'] ?? null) === PageStatus::Published->value && blank($data['published_at'] ?? null)) {
+            $data['published_at'] = now();
+        }
+
+        return $data;
+    }
+}

app/Filament/Resources/Pages/Pages/ListPages.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Pages;
+
+use App\Filament\Resources\Pages\PageResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListPages extends ListRecords
+{
+    protected static string $resource = PageResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Pages/Schemas/PageForm.php

@@ -0,0 +1,176 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Schemas;
+
+use App\Enums\PageStatus;
+use App\Filament\Resources\Pages\PageResource;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Page;
+use App\Rules\UniqueTranslatedSlug;
+use App\Support\DuplicateTitles;
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\RichEditor;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
+
+class PageForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.pages.sections.content'))
+                ->description(__('panel.pages.sections.content_hint'))
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                        TextInput::make("title.{$locale}")
+                            ->label(__('panel.pages.fields.title'))
+                            ->required($isDefault)
+                            ->maxLength(255)
+                            ->columnSpanFull()
+                            ->live(onBlur: true)
+                            ->afterStateUpdated(function (?string $state, ?Model $record, callable $get, callable $set) use ($locale, $isDefault) {
+                                if (blank($get("slug.{$locale}"))) {
+                                    $set("slug.{$locale}", Str::slug((string) $state));
+                                }
+
+                                // Only the language content is actually
+                                // written in matters here: a near-duplicate
+                                // in a language nobody is looking at right
+                                // now would be a warning about the wrong
+                                // thing.
+                                if ($isDefault) {
+                                    DuplicateTitles::warnIfSimilar(
+                                        Page::class,
+                                        PageResource::class,
+                                        $state,
+                                        $locale,
+                                        $record?->getKey(),
+                                    );
+                                }
+                            }),
+
+                        TextInput::make("slug.{$locale}")
+                            ->label(__('panel.pages.fields.slug'))
+                            ->required($isDefault)
+                            ->maxLength(255)
+                            ->columnSpanFull()
+                            ->rules(fn ($record) => [new UniqueTranslatedSlug(Page::class, $record?->id)]),
+
+                        Textarea::make("excerpt.{$locale}")
+                            ->label(__('panel.pages.fields.excerpt'))
+                            ->rows(2)
+                            ->maxLength(500)
+                            ->columnSpanFull(),
+
+                        RichEditor::make("body.{$locale}")
+                            ->label(__('panel.pages.fields.body'))
+                            ->columnSpanFull(),
+                    ]),
+                ]),
+
+            Section::make(__('panel.pages.sections.publishing'))
+                ->columns(2)
+                ->schema([
+                    Select::make('status')
+                        ->label(__('panel.pages.fields.status'))
+                        ->options(PageStatus::class)
+                        ->default(PageStatus::Draft)
+                        ->required()
+                        ->live()
+                        // Editing content and pushing it live are separate
+                        // permissions, so the status field itself is locked
+                        // for users who may only write.
+                        ->disabled(fn () => Auth::user()?->cannot('pages.publish'))
+                        ->dehydrated(),
+
+                    DateTimePicker::make('published_at')
+                        ->label(__('panel.pages.fields.published_at'))
+                        ->seconds(false)
+                        ->helperText(__('panel.pages.fields.published_at_hint')),
+
+                    // The date nobody remembers on their own. A notice about
+                    // something that already happened stays up until somebody
+                    // trips over it.
+                    DateTimePicker::make('unpublish_at')
+                        ->label(__('panel.pages.fields.unpublish_at'))
+                        ->helperText(__('panel.pages.fields.unpublish_at_hint'))
+                        ->seconds(false)
+                        ->after('published_at')
+                        ->disabled(fn () => Auth::user()?->cannot('pages.publish'))
+                        ->dehydrated(),
+
+                    Select::make('category_id')
+                        ->label(__('panel.pages.fields.category'))
+                        ->relationship('category', 'name->'.config('locales.default'))
+                        ->searchable()
+                        ->preload(),
+
+                    Select::make('author_id')
+                        ->label(__('panel.pages.fields.author'))
+                        ->relationship('author', 'name')
+                        ->searchable()
+                        ->preload()
+                        ->default(fn () => Auth::id())
+                        ->visible(fn () => Auth::user()?->can('users.view_any')),
+
+                    FileUpload::make('featured_image')
+                        ->label(__('panel.pages.fields.featured_image'))
+                        ->image()
+                        // Explicit: the default disk is private, and the
+                        // frontend runs on another host and has to be able to
+                        // fetch what you upload.
+                        ->disk(config('media.disk'))
+                        ->directory('pages')
+                        ->imageEditor()
+                        // So the description field appears as soon as there is
+                        // something to describe.
+                        ->live()
+                        ->columnSpanFull(),
+
+                    // Alt text lives with the record rather than with the
+                    // file, because the same image can need a different
+                    // description depending on where it is used.
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("featured_image_alt.{$locale}")
+                            ->label(__('panel.pages.fields.featured_image_alt'))
+                            ->helperText(__('panel.pages.fields.featured_image_alt_hint'))
+                            ->maxLength(255)
+                            ->columnSpanFull(),
+                    ])
+                        ->visible(fn (callable $get) => filled($get('featured_image')))
+                        ->columnSpanFull(),
+
+                    Toggle::make('is_featured')
+                        ->label(__('panel.pages.fields.is_featured')),
+                ]),
+
+            Section::make(__('panel.pages.sections.seo'))
+                ->description(__('panel.pages.sections.seo_hint'))
+                ->collapsed()
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("meta_title.{$locale}")
+                            ->label(__('panel.pages.fields.meta_title'))
+                            ->maxLength(60)
+                            ->columnSpanFull(),
+
+                        Textarea::make("meta_description.{$locale}")
+                            ->label(__('panel.pages.fields.meta_description'))
+                            ->rows(2)
+                            ->maxLength(160)
+                            ->columnSpanFull(),
+                    ], label: __('panel.pages.sections.seo')),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Pages/Tables/PagesTable.php

@@ -0,0 +1,270 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Pages\Tables;
+
+use App\Enums\PageStatus;
+use App\Filament\Support\PreviewAction;
+use App\Filament\Support\ReviewActions;
+use App\Filament\Support\ReviewStatusColumn;
+use App\Filament\Support\TranslationStatusColumn;
+use App\Filament\Support\ViewsColumn;
+use App\Models\Page;
+use App\Support\TranslationFreshness;
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\ReplicateAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Notifications\Notification;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\Auth;
+
+class PagesTable
+{
+    public static function configure(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            // One grouped query for the whole page of rows, so the reading
+            // figures cost the listing nothing per row.
+            ->modifyQueryUsing(fn (Builder $query) => $query->withRecentViews())
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('title')
+                    ->label(__('panel.pages.fields.title'))
+                    ->weight('medium')
+                    ->description(fn (Page $record) => $record->getTranslation('slug', $locale, false) ?: null)
+                    ->searchable(query: fn (Builder $query, string $search) => $query
+                        ->where("title->{$locale}", 'like', "%{$search}%"))
+                    ->sortable(query: fn (Builder $query, string $direction) => $query
+                        ->orderBy("title->{$locale}", $direction)),
+
+                TranslationStatusColumn::make('translations')
+                    ->label(__('panel.pages.fields.translations'))
+                    ->trackedAttribute('title'),
+
+                // The state the *site* is in, not only the one stored. A
+                // page waiting for its date, or one whose date has passed, is
+                // not "Published" however the column reads.
+                TextColumn::make('status')
+                    ->label(__('panel.pages.fields.status'))
+                    ->badge()
+                    ->formatStateUsing(fn (PageStatus $state, Page $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired'),
+                        $record->isScheduled() && $state === PageStatus::Published => __('panel.publishing.scheduled'),
+                        default => $state->getLabel(),
+                    })
+                    ->color(fn (PageStatus $state, Page $record) => match (true) {
+                        $record->hasExpired() => 'gray',
+                        $record->isScheduled() && $state === PageStatus::Published => 'info',
+                        default => $state->getColor(),
+                    })
+                    ->description(fn (Page $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired_at', ['time' => $record->unpublish_at->isoFormat('LLL')]),
+                        $record->isScheduled() => $record->published_at->diffForHumans(),
+                        $record->expiresSoon() => __('panel.publishing.expires_in', ['time' => $record->unpublish_at->diffForHumans()]),
+                        default => null,
+                    })
+                    ->sortable(),
+
+                ReviewStatusColumn::make('review')
+                    ->label(__('panel.reviews.column')),
+
+                TextColumn::make('category.name')
+                    ->label(__('panel.pages.fields.category'))
+                    ->badge()
+                    ->color('gray')
+                    ->toggleable(),
+
+                TextColumn::make('author.name')
+                    ->label(__('panel.pages.fields.author'))
+                    ->toggleable(isToggledHiddenByDefault: true),
+
+                IconColumn::make('is_featured')
+                    ->label(__('panel.pages.fields.is_featured'))
+                    ->boolean()
+                    ->toggleable(),
+
+                ViewsColumn::make('recent_views')
+                    ->label(__('panel.views.column'))
+                    ->tooltip(__('panel.views.column_hint')),
+
+                TextColumn::make('published_at')
+                    ->label(__('panel.pages.fields.published_at'))
+                    ->dateTime()
+                    ->sortable()
+                    ->placeholder('—'),
+            ])
+            ->filters([
+                SelectFilter::make('status')
+                    ->label(__('panel.pages.fields.status'))
+                    ->options(PageStatus::options())
+                    ->multiple(),
+
+                // The reviewer's own queue. Unaddressed requests are in it
+                // too: a review nobody was named for is everybody's.
+                Filter::make('awaiting_review')
+                    ->label(__('panel.reviews.filters.mine'))
+                    ->query(fn (Builder $query) => Auth::user()
+                        ? $query->awaitingReviewBy(Auth::user())
+                        : $query->awaitingReview()),
+
+                SelectFilter::make('category')
+                    ->label(__('panel.pages.fields.category'))
+                    ->relationship('category', 'name->'.config('locales.default'))
+                    ->searchable()
+                    ->preload(),
+
+                TernaryFilter::make('is_featured')
+                    ->label(__('panel.pages.fields.is_featured')),
+
+                // The editorial workhorse: "what still needs translating?"
+                SelectFilter::make('missing_translation')
+                    ->label(__('panel.pages.filters.missing_translation'))
+                    ->options(fn () => collect(config('locales.supported'))
+                        ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                        ->all())
+                    ->query(function (Builder $query, array $data): Builder {
+                        if (blank($data['value'] ?? null)) {
+                            return $query;
+                        }
+
+                        $target = $data['value'];
+
+                        return $query->where(fn (Builder $q) => $q
+                            ->whereNull("title->{$target}")
+                            ->orWhere("title->{$target}", ''));
+                    }),
+
+                // Translated and left behind by the original. Worked out
+                // from the change history rather than a column, so it is
+                // resolved here and handed to the query as a list.
+                Filter::make('stale_translation')
+                    ->label(__('panel.translations.filters.stale'))
+                    ->query(fn (Builder $query) => $query->whereIn(
+                        'id',
+                        TranslationFreshness::staleIds($query->getModel()::query()),
+                    )),
+
+                Filter::make('published')
+                    ->label(__('enums.page_status.published'))
+                    ->query(fn (Builder $query) => $query->published()),
+
+                // Published and, as far as anybody can tell, read by nobody.
+                Filter::make('unread')
+                    ->label(__('panel.views.filters.unread'))
+                    ->query(fn (Builder $query) => $query
+                        ->published()
+                        ->whereDoesntHave('views', fn (Builder $views) => $views->since(30))),
+
+                Filter::make('scheduled')
+                    ->label(__('panel.publishing.scheduled'))
+                    ->query(fn (Builder $query) => $query->scheduled()),
+
+                Filter::make('expired')
+                    ->label(__('panel.publishing.expired'))
+                    ->query(fn (Builder $query) => $query->expired()),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                ReviewActions::request(),
+                ReviewActions::returnForChanges(),
+
+                // One-click publish for users who hold the separate
+                // pages.publish permission.
+                Action::make('publish')
+                    ->label(__('panel.pages.actions.publish'))
+                    ->icon('heroicon-o-check-circle')
+                    ->color('success')
+                    ->requiresConfirmation()
+                    ->visible(fn (Page $record) => $record->status !== PageStatus::Published
+                        && Auth::user()?->can('publish', $record))
+                    ->action(fn (Page $record) => $record->update([
+                        'status' => PageStatus::Published,
+                        'published_at' => $record->published_at ?? now(),
+                    ])),
+
+                Action::make('unpublish')
+                    ->label(__('panel.pages.actions.unpublish'))
+                    ->icon('heroicon-o-eye-slash')
+                    ->color('warning')
+                    ->requiresConfirmation()
+                    ->visible(fn (Page $record) => $record->status === PageStatus::Published
+                        && Auth::user()?->can('publish', $record))
+                    ->action(fn (Page $record) => $record->update(['status' => PageStatus::Draft])),
+
+                // A near-copy is a real workflow: the third similar service,
+                // next year's call. The slug is cleared because two records
+                // cannot answer at the same URL.
+                ReplicateAction::make()
+                    ->label(__('panel.actions.duplicate'))
+                    ->icon('heroicon-o-document-duplicate')
+                    ->excludeAttributes(['slug', 'published_at', 'unpublish_at'])
+                    ->modalHeading(__('panel.actions.duplicate_heading'))
+                    ->successNotificationTitle(__('panel.actions.duplicated')),
+
+                PreviewAction::for('page'),
+
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    ReviewActions::requestBulk(Page::class),
+
+                    BulkAction::make('publish')
+                        ->label(__('panel.pages.actions.publish'))
+                        ->icon('heroicon-o-check-circle')
+                        ->color('success')
+                        ->requiresConfirmation()
+                        ->visible(fn () => Auth::user()?->can('pages.publish') ?? false)
+                        ->deselectRecordsAfterCompletion()
+                        ->action(function (Collection $records): void {
+                            $published = 0;
+
+                            // One at a time, not a single UPDATE across every
+                            // selected row: publishing fires the revision
+                            // entry and closes any pending review, and a mass
+                            // update would skip both without a sound.
+                            foreach ($records as $record) {
+                                if ($record->status === PageStatus::Published) {
+                                    continue;
+                                }
+
+                                $record->update([
+                                    'status' => PageStatus::Published,
+                                    'published_at' => $record->published_at ?? now(),
+                                ]);
+
+                                $published++;
+                            }
+
+                            Notification::make()
+                                ->title(trans_choice('panel.publishing.published_count', $published, ['count' => $published]))
+                                ->success()
+                                ->send();
+                        }),
+
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+}

app/Filament/Resources/Projects/Pages/CreateProject.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\Pages;
+
+use App\Filament\Resources\Projects\ProjectResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateProject extends CreateRecord
+{
+    protected static string $resource = ProjectResource::class;
+}

app/Filament/Resources/Projects/Pages/EditProject.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Projects\ProjectResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditProject extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = ProjectResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Projects/Pages/ListProjects.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\Pages;
+
+use App\Filament\Resources\Projects\ProjectResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListProjects extends ListRecords
+{
+    protected static string $resource = ProjectResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Projects/ProjectResource.php

@@ -0,0 +1,113 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects;
+
+use App\Filament\RelationManagers\ReviewsRelationManager;
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Projects\Pages\CreateProject;
+use App\Filament\Resources\Projects\Pages\EditProject;
+use App\Filament\Resources\Projects\Pages\ListProjects;
+use App\Filament\Resources\Projects\RelationManagers\GalleryRelationManager;
+use App\Filament\Resources\Projects\RelationManagers\RepositoriesRelationManager;
+use App\Filament\Resources\Projects\Schemas\ProjectForm;
+use App\Filament\Resources\Projects\Tables\ProjectsTable;
+use App\Models\Project;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\SoftDeletingScope;
+use UnitEnum;
+
+class ProjectResource extends Resource
+{
+    protected static ?string $model = Project::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedRocketLaunch;
+
+    protected static ?int $navigationSort = 1;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.projects.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.projects.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->getTranslation('title', app()->getLocale());
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['title->'.app()->getLocale()];
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return ProjectForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return ProjectsTable::configure($table);
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            ReviewsRelationManager::class,
+            RevisionsRelationManager::class,
+            GalleryRelationManager::class,
+            RepositoriesRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListProjects::route('/'),
+            'create' => CreateProject::route('/create'),
+            'edit' => EditProject::route('/{record}/edit'),
+        ];
+    }
+
+    public static function getRecordRouteBindingEloquentQuery(): Builder
+    {
+        return parent::getRecordRouteBindingEloquentQuery()
+            ->withoutGlobalScopes([SoftDeletingScope::class]);
+    }
+
+    /**
+     * Surfaces how many projects are asking for contributors — the number the
+     * collective most wants to act on.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $count = static::getModel()::query()->needingHelp()->count();
+
+        return $count > 0 ? (string) $count : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'warning';
+    }
+}

app/Filament/Resources/Projects/RelationManagers/GalleryRelationManager.php

@@ -0,0 +1,142 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\RelationManagers;
+
+use App\Filament\Support\TranslatableTabs;
+use App\Models\ImageAttachment;
+use Filament\Actions\CreateAction;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\TextInput;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Schemas\Schema;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * The gallery of a project.
+ *
+ * A table rather than a repeater inside the form, because the thing you need
+ * to see while editing a gallery is the images themselves, and because the
+ * order matters — it is dragged here rather than typed into a number field.
+ */
+class GalleryRelationManager extends RelationManager
+{
+    protected static string $relationship = 'images';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.gallery.title');
+    }
+
+    public static function getBadge(Model $ownerRecord, string $pageClass): ?string
+    {
+        $count = $ownerRecord->images()->count();
+
+        return $count > 0 ? (string) $count : null;
+    }
+
+    public function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            FileUpload::make('path')
+                ->label(__('panel.gallery.fields.image'))
+                ->image()
+                // Explicit: the default disk is private, and the frontend runs
+                // on another host.
+                ->disk(config('media.disk'))
+                ->directory('projects/gallery')
+                ->imageEditor()
+                ->required()
+                ->columnSpanFull(),
+
+            TranslatableTabs::make(fn (string $locale) => [
+                TextInput::make("alt.{$locale}")
+                    ->label(__('panel.gallery.fields.alt'))
+                    ->helperText(__('panel.gallery.fields.alt_hint'))
+                    ->maxLength(255)
+                    ->columnSpanFull(),
+
+                // Shown to everyone, unlike the alt text. "Before" and
+                // "after" belong here.
+                TextInput::make("caption.{$locale}")
+                    ->label(__('panel.gallery.fields.caption'))
+                    ->helperText(__('panel.gallery.fields.caption_hint'))
+                    ->maxLength(255)
+                    ->columnSpanFull(),
+            ])->columnSpanFull(),
+        ]);
+    }
+
+    public function table(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            ->defaultSort('position')
+            ->reorderable('position')
+            // The table shows each image's real dimensions; loaded up front so
+            // that costs one query rather than one per row.
+            ->modifyQueryUsing(fn (Builder $query) => $query->with('media'))
+            ->columns([
+                ImageColumn::make('path')
+                    ->label('')
+                    ->disk(config('media.disk'))
+                    ->height(56),
+
+                TextColumn::make('caption')
+                    ->label(__('panel.gallery.fields.caption'))
+                    ->state(fn (ImageAttachment $record) => $record->getTranslation('caption', $locale, false) ?: null)
+                    ->placeholder('—')
+                    ->wrap(),
+
+                TextColumn::make('alt')
+                    ->label(__('panel.gallery.fields.alt'))
+                    ->state(fn (ImageAttachment $record) => $record->getTranslation('alt', $locale, false) ?: null)
+                    // An image nobody described is the one worth spotting from
+                    // the listing.
+                    ->placeholder(__('panel.gallery.missing_alt'))
+                    ->color(fn (ImageAttachment $record) => $record->getTranslation('alt', $locale, false)
+                        ? null
+                        : 'warning')
+                    ->wrap()
+                    ->toggleable(),
+
+                TextColumn::make('media.width')
+                    ->label(__('panel.gallery.fields.size'))
+                    ->state(fn (ImageAttachment $record) => $record->media?->width
+                        ? "{$record->media->width}×{$record->media->height}"
+                        : __('panel.gallery.pending'))
+                    ->badge()
+                    ->color(fn (ImageAttachment $record) => $record->media?->width ? 'gray' : 'warning')
+                    ->toggleable(),
+            ])
+            ->headerActions([
+                CreateAction::make()
+                    ->label(__('panel.gallery.actions.add'))
+                    // New images go at the end rather than jumping to the top.
+                    ->mutateDataUsing(function (array $data): array {
+                        $data['position'] = (int) $this->getOwnerRecord()->images()->max('position') + 1;
+
+                        return $data;
+                    }),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                DeleteBulkAction::make(),
+            ])
+            ->emptyStateHeading(__('panel.gallery.empty.heading'))
+            ->emptyStateDescription(__('panel.gallery.empty.description'))
+            ->emptyStateIcon('heroicon-o-photo');
+    }
+}

app/Filament/Resources/Projects/RelationManagers/RepositoriesRelationManager.php

@@ -0,0 +1,136 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\RelationManagers;
+
+use App\Enums\GitProvider;
+use App\Models\Repository;
+use App\Services\Git\GitException;
+use App\Services\Git\GitManager;
+use Filament\Actions\Action;
+use Filament\Actions\CreateAction;
+use Filament\Actions\DeleteAction;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Notifications\Notification;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Schemas\Schema;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * Connect repositories from inside a project, which is where the person adding
+ * them is already working.
+ *
+ * A newly attached repository is synced immediately so its stats appear at
+ * once, rather than staying blank until the hourly schedule runs.
+ */
+class RepositoriesRelationManager extends RelationManager
+{
+    protected static string $relationship = 'repositories';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.repositories.plural');
+    }
+
+    public function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Select::make('provider')
+                ->label(__('panel.repositories.fields.provider'))
+                ->options(GitProvider::class)
+                ->default(GitProvider::default())
+                ->required()
+                ->disableOptionWhen(fn (string $value) => ! GitProvider::from($value)->isSupported()),
+
+            TextInput::make('full_name')
+                ->label(__('panel.repositories.fields.full_name'))
+                ->placeholder('colectivo/mi-proyecto')
+                ->helperText(__('panel.repositories.fields.full_name_hint'))
+                ->required()
+                ->maxLength(255),
+
+            Toggle::make('is_primary')
+                ->label(__('panel.repositories.fields.is_primary')),
+
+            Toggle::make('show_publicly')
+                ->label(__('panel.repositories.fields.show_publicly'))
+                ->default(true),
+        ]);
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->recordTitleAttribute('full_name')
+            ->columns([
+                TextColumn::make('full_name')
+                    ->label(__('panel.repositories.fields.full_name'))
+                    ->url(fn (Repository $r) => $r->html_url, shouldOpenInNewTab: true),
+
+                TextColumn::make('primary_language')
+                    ->label(__('panel.repositories.fields.language'))
+                    ->badge()
+                    ->placeholder('—'),
+
+                TextColumn::make('stars')->label('★')->badge()->color('warning'),
+
+                TextColumn::make('good_first_issues_count')
+                    ->label(__('panel.repositories.fields.good_first_issues'))
+                    ->counts('goodFirstIssues')
+                    ->badge(),
+
+                TextColumn::make('pushed_at')
+                    ->label(__('panel.repositories.fields.pushed_at'))
+                    ->since()
+                    ->color(fn (Repository $r) => $r->isDormant() ? 'danger' : null)
+                    ->placeholder('—'),
+            ])
+            ->headerActions([
+                CreateAction::make()
+                    // Sync straight away so the stats are not blank until the
+                    // next scheduled run.
+                    ->after(function (Repository $record, GitManager $git): void {
+                        try {
+                            $git->sync($record);
+                        } catch (GitException $e) {
+                            Notification::make()
+                                ->warning()
+                                ->title(__('panel.repositories.notifications.sync_failed'))
+                                ->body($e->getMessage())
+                                ->send();
+                        }
+                    }),
+            ])
+            ->recordActions([
+                Action::make('sync')
+                    ->label(__('panel.repositories.actions.sync'))
+                    ->icon('heroicon-o-arrow-path')
+                    ->color('gray')
+                    ->visible(fn () => Auth::user()?->can('repositories.sync'))
+                    ->action(function (Repository $record, GitManager $git): void {
+                        try {
+                            $git->sync($record);
+
+                            Notification::make()
+                                ->success()
+                                ->title(__('panel.repositories.notifications.synced'))
+                                ->send();
+                        } catch (GitException $e) {
+                            Notification::make()
+                                ->danger()
+                                ->title(__('panel.repositories.notifications.sync_failed'))
+                                ->body($e->getMessage())
+                                ->send();
+                        }
+                    }),
+
+                DeleteAction::make(),
+            ]);
+    }
+}

app/Filament/Resources/Projects/Schemas/ProjectForm.php

@@ -0,0 +1,226 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\Schemas;
+
+use App\Enums\ProjectStatus;
+use App\Filament\Resources\Projects\ProjectResource;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Project;
+use App\Rules\UniqueTranslatedSlug;
+use App\Support\DuplicateTitles;
+use Filament\Forms\Components\DatePicker;
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\RichEditor;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
+
+class ProjectForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.projects.sections.content'))
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                        TextInput::make("title.{$locale}")
+                            ->label(__('panel.projects.fields.title'))
+                            ->required($isDefault)
+                            ->maxLength(255)
+                            ->columnSpanFull()
+                            ->live(onBlur: true)
+                            ->afterStateUpdated(function (?string $state, ?Model $record, callable $get, callable $set) use ($locale, $isDefault) {
+                                if (blank($get("slug.{$locale}"))) {
+                                    $set("slug.{$locale}", Str::slug((string) $state));
+                                }
+
+                                if ($isDefault) {
+                                    DuplicateTitles::warnIfSimilar(
+                                        Project::class,
+                                        ProjectResource::class,
+                                        $state,
+                                        $locale,
+                                        $record?->getKey(),
+                                    );
+                                }
+                            }),
+
+                        TextInput::make("slug.{$locale}")
+                            ->label(__('panel.projects.fields.slug'))
+                            ->required($isDefault)
+                            ->maxLength(255)
+                            ->columnSpanFull()
+                            ->rules(fn ($record) => [new UniqueTranslatedSlug(Project::class, $record?->id)]),
+
+                        Textarea::make("tagline.{$locale}")
+                            ->label(__('panel.projects.fields.tagline'))
+                            ->rows(2)
+                            ->maxLength(300)
+                            ->columnSpanFull(),
+
+                        RichEditor::make("description.{$locale}")
+                            ->label(__('panel.projects.fields.description'))
+                            ->columnSpanFull(),
+                    ]),
+                ]),
+
+            // The part that makes a project worth reading rather than just
+            // looking at. Collapsed by default so it never blocks publishing.
+            Section::make(__('panel.projects.sections.writeup'))
+                ->description(__('panel.projects.sections.writeup_hint'))
+                ->collapsed()
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale) => [
+                        RichEditor::make("decisions.{$locale}")
+                            ->label(__('panel.projects.fields.decisions'))
+                            ->helperText(__('panel.projects.fields.decisions_hint'))
+                            ->columnSpanFull(),
+
+                        RichEditor::make("postmortem.{$locale}")
+                            ->label(__('panel.projects.fields.postmortem'))
+                            ->helperText(__('panel.projects.fields.postmortem_hint'))
+                            ->columnSpanFull(),
+                    ], label: __('panel.projects.sections.writeup')),
+                ]),
+
+            Section::make(__('panel.projects.sections.details'))
+                ->columns(2)
+                ->schema([
+                    Select::make('status')
+                        ->label(__('panel.projects.fields.status'))
+                        ->options(ProjectStatus::class)
+                        ->default(ProjectStatus::Idea)
+                        ->required(),
+
+                    DateTimePicker::make('published_at')
+                        ->label(__('panel.projects.fields.published_at'))
+                        ->seconds(false)
+                        ->helperText(__('panel.projects.fields.published_at_hint'))
+                        ->disabled(fn () => Auth::user()?->cannot('projects.publish'))
+                        ->dehydrated(),
+
+                    DateTimePicker::make('unpublish_at')
+                        ->label(__('panel.projects.fields.unpublish_at'))
+                        ->helperText(__('panel.projects.fields.unpublish_at_hint'))
+                        ->seconds(false)
+                        ->after('published_at')
+                        ->disabled(fn () => Auth::user()?->cannot('projects.publish'))
+                        ->dehydrated(),
+
+                    Select::make('technologies')
+                        ->label(__('panel.projects.fields.technologies'))
+                        ->relationship('technologies', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable()
+                        ->columnSpanFull(),
+
+                    Select::make('lead_member_id')
+                        ->label(__('panel.projects.fields.lead'))
+                        ->relationship('lead', 'name')
+                        ->searchable()
+                        ->preload(),
+
+                    Select::make('members')
+                        ->label(__('panel.projects.fields.members'))
+                        ->relationship('members', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable(),
+
+                    // Was two free-text fields, which made the same
+                    // association two entities and left the logo nowhere to
+                    // live. New ones can still be added without leaving the
+                    // project.
+                    Select::make('client_id')
+                        ->label(__('panel.projects.fields.client'))
+                        ->helperText(__('panel.projects.fields.client_hint'))
+                        ->relationship('client', 'name')
+                        ->searchable()
+                        ->preload()
+                        ->createOptionForm([
+                            TextInput::make('name')
+                                ->label(__('panel.clients.fields.name'))
+                                ->required()
+                                ->maxLength(255),
+
+                            TextInput::make('slug')
+                                ->label(__('panel.clients.fields.slug'))
+                                ->required()
+                                ->maxLength(255)
+                                ->rules(['unique:clients,slug']),
+
+                            TextInput::make('url')
+                                ->label(__('panel.clients.fields.url'))
+                                ->url()
+                                ->maxLength(2048),
+                        ]),
+
+                    Select::make('services')
+                        ->label(__('panel.projects.fields.services'))
+                        // The order is given explicitly because Filament
+                        // would otherwise sort a `select distinct` by a JSON
+                        // path, and Postgres refuses an ORDER BY expression
+                        // that is not in the select list.
+                        ->relationship(
+                            name: 'services',
+                            titleAttribute: 'title->'.config('locales.default'),
+                            modifyQueryUsing: fn (Builder $query) => $query->orderBy('position'),
+                        )
+                        ->multiple()
+                        ->preload()
+                        ->searchable(),
+
+                    TextInput::make('demo_url')
+                        ->label(__('panel.projects.fields.demo_url'))
+                        ->url()
+                        ->maxLength(2048),
+
+                    FileUpload::make('cover_image')
+                        ->label(__('panel.projects.fields.cover_image'))
+                        ->image()
+                        // Explicit: the default disk is private, and the
+                        // frontend runs on another host.
+                        ->disk(config('media.disk'))
+                        ->directory('projects')
+                        ->imageEditor()
+                        ->live(),
+
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("cover_image_alt.{$locale}")
+                            ->label(__('panel.projects.fields.cover_image_alt'))
+                            ->helperText(__('panel.projects.fields.cover_image_alt_hint'))
+                            ->maxLength(255)
+                            ->columnSpanFull(),
+                    ])
+                        ->visible(fn (callable $get) => filled($get('cover_image')))
+                        ->columnSpanFull(),
+
+                    DatePicker::make('started_at')
+                        ->label(__('panel.projects.fields.started_at')),
+
+                    DatePicker::make('ended_at')
+                        ->label(__('panel.projects.fields.ended_at')),
+
+                    Toggle::make('is_featured')
+                        ->label(__('panel.projects.fields.is_featured')),
+
+                    // Drives the "we need help" listings on the public site,
+                    // which is the main thing the site is trying to achieve.
+                    Toggle::make('needs_help')
+                        ->label(__('panel.projects.fields.needs_help'))
+                        ->helperText(__('panel.projects.fields.needs_help_hint')),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Projects/Tables/ProjectsTable.php

@@ -0,0 +1,254 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Projects\Tables;
+
+use App\Enums\ProjectStatus;
+use App\Filament\Support\PreviewAction;
+use App\Filament\Support\ReviewActions;
+use App\Filament\Support\ReviewStatusColumn;
+use App\Filament\Support\TranslationStatusColumn;
+use App\Filament\Support\ViewsColumn;
+use App\Models\Project;
+use App\Support\TranslationFreshness;
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\ReplicateAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Notifications\Notification;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\Auth;
+
+class ProjectsTable
+{
+    public static function configure(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            // One grouped query for the whole page of rows, so the reading
+            // figures cost the listing nothing per row.
+            ->modifyQueryUsing(fn (Builder $query) => $query->withRecentViews())
+            ->defaultSort('position')
+            ->reorderable('position')
+            ->columns([
+                TextColumn::make('title')
+                    ->label(__('panel.projects.fields.title'))
+                    ->weight('medium')
+                    ->description(fn (Project $record) => $record->getTranslation('tagline', $locale, false) ?: null)
+                    ->wrap()
+                    ->searchable(query: fn (Builder $q, string $search) => $q
+                        ->where("title->{$locale}", 'like', "%{$search}%"))
+                    ->sortable(query: fn (Builder $q, string $direction) => $q
+                        ->orderBy("title->{$locale}", $direction)),
+
+                TranslationStatusColumn::make('translations')
+                    ->label(__('panel.pages.fields.translations'))
+                    ->trackedAttribute('title'),
+
+                TextColumn::make('status')
+                    ->label(__('panel.projects.fields.status'))
+                    ->badge()
+                    ->sortable(),
+
+                TextColumn::make('technologies.name')
+                    ->label(__('panel.projects.fields.technologies'))
+                    ->badge()
+                    ->color('gray')
+                    ->limitList(3)
+                    ->expandableLimitedList()
+                    ->toggleable(),
+
+                // Live repository activity, so the panel shows the same signs
+                // of life the public site does.
+                TextColumn::make('repositories_sum_stars')
+                    ->label('★')
+                    ->sum('repositories', 'stars')
+                    ->badge()
+                    ->color('warning')
+                    ->toggleable(),
+
+                IconColumn::make('needs_help')
+                    ->label(__('panel.projects.fields.needs_help'))
+                    ->boolean()
+                    ->trueIcon('heroicon-o-hand-raised')
+                    ->falseIcon('heroicon-o-minus-small')
+                    ->trueColor('warning')
+                    ->falseColor('gray')
+                    ->sortable(),
+
+                IconColumn::make('is_featured')
+                    ->label(__('panel.projects.fields.is_featured'))
+                    ->boolean()
+                    ->toggleable(),
+
+                // A project's status is its lifecycle, not its visibility —
+                // those are different questions, so the window gets its own
+                // column rather than overwriting the answer to the first.
+                ViewsColumn::make('recent_views')
+                    ->label(__('panel.views.column'))
+                    ->tooltip(__('panel.views.column_hint')),
+
+                ReviewStatusColumn::make('review')
+                    ->label(__('panel.reviews.column')),
+
+                TextColumn::make('published_at')
+                    ->label(__('panel.projects.fields.published_at'))
+                    ->badge()
+                    ->formatStateUsing(fn (?string $state, Project $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired'),
+                        $record->isScheduled() => __('panel.publishing.scheduled'),
+                        blank($state) => __('panel.publishing.unpublished'),
+                        default => __('panel.publishing.live'),
+                    })
+                    ->color(fn (?string $state, Project $record) => match (true) {
+                        $record->hasExpired() => 'gray',
+                        $record->isScheduled() => 'info',
+                        blank($state) => 'gray',
+                        default => 'success',
+                    })
+                    ->description(fn (Project $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired_at', ['time' => $record->unpublish_at->isoFormat('LLL')]),
+                        $record->isScheduled() => $record->published_at->diffForHumans(),
+                        $record->expiresSoon() => __('panel.publishing.expires_in', ['time' => $record->unpublish_at->diffForHumans()]),
+                        default => $record->published_at?->isoFormat('LL'),
+                    })
+                    ->sortable()
+                    ->placeholder('—'),
+            ])
+            ->filters([
+                // The reviewer's own queue. Unaddressed requests are in it
+                // too: a review nobody was named for is everybody's.
+                Filter::make('awaiting_review')
+                    ->label(__('panel.reviews.filters.mine'))
+                    ->query(fn (Builder $query) => Auth::user()
+                        ? $query->awaitingReviewBy(Auth::user())
+                        : $query->awaitingReview()),
+
+                Filter::make('scheduled')
+                    ->label(__('panel.publishing.scheduled'))
+                    ->query(fn (Builder $query) => $query->scheduled()),
+
+                Filter::make('expired')
+                    ->label(__('panel.publishing.expired'))
+                    ->query(fn (Builder $query) => $query->expired()),
+
+                SelectFilter::make('status')
+                    ->label(__('panel.projects.fields.status'))
+                    ->options(ProjectStatus::options())
+                    ->multiple(),
+
+                SelectFilter::make('technologies')
+                    ->label(__('panel.projects.fields.technologies'))
+                    ->relationship('technologies', 'name')
+                    ->multiple()
+                    ->preload(),
+
+                TernaryFilter::make('needs_help')
+                    ->label(__('panel.projects.fields.needs_help')),
+
+                // Published and, as far as anybody can tell, read by nobody.
+                Filter::make('unread')
+                    ->label(__('panel.views.filters.unread'))
+                    ->query(fn (Builder $query) => $query
+                        ->published()
+                        ->whereDoesntHave('views', fn (Builder $views) => $views->since(30))),
+
+                // Translated and left behind by the original. Worked out
+                // from the change history rather than a column, so it is
+                // resolved here and handed to the query as a list.
+                Filter::make('stale_translation')
+                    ->label(__('panel.translations.filters.stale'))
+                    ->query(fn (Builder $query) => $query->whereIn(
+                        'id',
+                        TranslationFreshness::staleIds($query->getModel()::query()),
+                    )),
+
+                Filter::make('unpublished')
+                    ->label(__('panel.projects.filters.unpublished'))
+                    ->query(fn (Builder $q) => $q->whereNull('published_at')),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                ReviewActions::request(),
+                ReviewActions::returnForChanges(),
+
+                Action::make('publish')
+                    ->label(__('panel.projects.actions.publish'))
+                    ->icon('heroicon-o-globe-alt')
+                    ->color('success')
+                    ->requiresConfirmation()
+                    ->visible(fn (Project $record) => $record->published_at === null
+                        && Auth::user()?->can('publish', $record))
+                    ->action(fn (Project $record) => $record->update(['published_at' => now()])),
+
+                // A near-copy is a real workflow: the third similar service,
+                // next year's call. The slug is cleared because two records
+                // cannot answer at the same URL.
+                ReplicateAction::make()
+                    ->label(__('panel.actions.duplicate'))
+                    ->icon('heroicon-o-document-duplicate')
+                    ->excludeAttributes(['slug', 'published_at', 'unpublish_at'])
+                    ->modalHeading(__('panel.actions.duplicate_heading'))
+                    ->successNotificationTitle(__('panel.actions.duplicated')),
+
+                PreviewAction::for('project'),
+
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    ReviewActions::requestBulk(Project::class),
+
+                    BulkAction::make('publish')
+                        ->label(__('panel.projects.actions.publish'))
+                        ->icon('heroicon-o-globe-alt')
+                        ->color('success')
+                        ->requiresConfirmation()
+                        ->visible(fn () => Auth::user()?->can('projects.publish') ?? false)
+                        ->deselectRecordsAfterCompletion()
+                        ->action(function (Collection $records): void {
+                            $published = 0;
+
+                            // One at a time: publishing fires the revision
+                            // entry and closes any pending review, and a mass
+                            // update would skip both without a sound.
+                            foreach ($records as $record) {
+                                if ($record->published_at !== null) {
+                                    continue;
+                                }
+
+                                $record->update(['published_at' => now()]);
+
+                                $published++;
+                            }
+
+                            Notification::make()
+                                ->title(trans_choice('panel.publishing.published_count', $published, ['count' => $published]))
+                                ->success()
+                                ->send();
+                        }),
+
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+}

app/Filament/Resources/Redirects/Pages/CreateRedirect.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Redirects\Pages;
+
+use App\Filament\Resources\Redirects\RedirectResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateRedirect extends CreateRecord
+{
+    protected static string $resource = RedirectResource::class;
+}

app/Filament/Resources/Redirects/Pages/EditRedirect.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Redirects\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Redirects\RedirectResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditRedirect extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = RedirectResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Redirects/Pages/ListRedirects.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Redirects\Pages;
+
+use App\Filament\Resources\Redirects\RedirectResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListRedirects extends ListRecords
+{
+    protected static string $resource = RedirectResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Redirects/RedirectResource.php

@@ -0,0 +1,210 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Redirects;
+
+use App\Filament\Resources\Redirects\Pages\CreateRedirect;
+use App\Filament\Resources\Redirects\Pages\EditRedirect;
+use App\Filament\Resources\Redirects\Pages\ListRedirects;
+use App\Models\Redirect;
+use BackedEnum;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use UnitEnum;
+
+/**
+ * URLs that used to work, and where they go now.
+ *
+ * Most of this list is never typed by anybody: renaming a slug writes an entry
+ * on the way past, because that is the only moment the old address is still
+ * known. The rest is for the links that existed before this application did.
+ */
+class RedirectResource extends Resource
+{
+    protected static ?string $model = Redirect::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedArrowsRightLeft;
+
+    protected static ?int $navigationSort = 85;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.redirects.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.redirects.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->from;
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()
+                ->description(__('panel.redirects.hint'))
+                ->columns(2)
+                ->schema([
+                    TextInput::make('from')
+                        ->label(__('panel.redirects.fields.from'))
+                        ->helperText(__('panel.redirects.fields.from_hint'))
+                        ->required()
+                        ->maxLength(500)
+                        ->placeholder('/proyectos/nombre-viejo')
+                        // Normalised on the way in so a rule typed by hand
+                        // matches one written automatically.
+                        ->dehydrateStateUsing(fn (string $state) => Redirect::normalise($state)),
+
+                    TextInput::make('to')
+                        ->label(__('panel.redirects.fields.to'))
+                        ->required()
+                        ->maxLength(500)
+                        ->placeholder('/proyectos/nombre-nuevo')
+                        ->dehydrateStateUsing(fn (string $state) => Redirect::normalise($state))
+                        ->different('from'),
+
+                    Select::make('status')
+                        ->label(__('panel.redirects.fields.status'))
+                        ->helperText(__('panel.redirects.fields.status_hint'))
+                        ->options([
+                            301 => __('panel.redirects.statuses.301'),
+                            302 => __('panel.redirects.statuses.302'),
+                        ])
+                        ->default(301)
+                        ->required(),
+
+                    Select::make('locale')
+                        ->label(__('panel.redirects.fields.locale'))
+                        ->helperText(__('panel.redirects.fields.locale_hint'))
+                        ->options(fn () => collect(config('locales.supported'))
+                            ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                            ->all())
+                        ->placeholder(__('panel.redirects.every_locale')),
+
+                    Toggle::make('is_enabled')
+                        ->label(__('panel.redirects.fields.is_enabled'))
+                        ->default(true),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('created_at', 'desc')
+            ->columns([
+                TextColumn::make('from')
+                    ->label(__('panel.redirects.fields.from'))
+                    ->fontFamily('mono')
+                    ->searchable()
+                    ->wrap(),
+
+                TextColumn::make('to')
+                    ->label(__('panel.redirects.fields.to'))
+                    ->fontFamily('mono')
+                    ->searchable()
+                    ->wrap()
+                    // A rule pointing at its own source would send a browser
+                    // round in circles.
+                    ->color(fn (Redirect $record) => $record->isCircular() ? 'danger' : null),
+
+                TextColumn::make('status')
+                    ->label(__('panel.redirects.fields.status'))
+                    ->badge()
+                    ->color(fn (int $state) => $state === 301 ? 'gray' : 'info'),
+
+                TextColumn::make('locale')
+                    ->label(__('panel.redirects.fields.locale'))
+                    ->badge()
+                    ->color('gray')
+                    ->placeholder(__('panel.redirects.every_locale'))
+                    ->toggleable(),
+
+                // The number that decides whether a rule can ever be deleted:
+                // is anybody still following it?
+                TextColumn::make('hits')
+                    ->label(__('panel.redirects.fields.hits'))
+                    ->badge()
+                    ->color(fn (int $state) => $state > 0 ? 'success' : 'gray')
+                    ->description(fn (Redirect $record) => $record->last_used_at?->diffForHumans())
+                    ->sortable(),
+
+                TextColumn::make('source_type')
+                    ->label(__('panel.redirects.fields.origin'))
+                    ->badge()
+                    ->color('gray')
+                    ->formatStateUsing(fn (?string $state) => $state
+                        ? __('panel.redirects.automatic')
+                        : __('panel.redirects.manual'))
+                    ->toggleable(),
+
+                IconColumn::make('is_enabled')
+                    ->label(__('panel.redirects.fields.is_enabled'))
+                    ->boolean(),
+            ])
+            ->filters([
+                TernaryFilter::make('is_enabled')->label(__('panel.redirects.fields.is_enabled')),
+
+                Filter::make('automatic')
+                    ->label(__('panel.redirects.automatic'))
+                    ->query(fn (Builder $query) => $query->whereNotNull('source_type')),
+
+                Filter::make('unused')
+                    ->label(__('panel.redirects.filters.unused'))
+                    ->query(fn (Builder $query) => $query->where('hits', 0)),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([DeleteBulkAction::make()]),
+            ])
+            ->emptyStateHeading(__('panel.redirects.empty.heading'))
+            ->emptyStateDescription(__('panel.redirects.empty.description'))
+            ->emptyStateIcon('heroicon-o-arrows-right-left');
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['from', 'to'];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListRedirects::route('/'),
+            'create' => CreateRedirect::route('/create'),
+            'edit' => EditRedirect::route('/{record}/edit'),
+        ];
+    }
+}

app/Filament/Resources/Repositories/Pages/CreateRepository.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Repositories\Pages;
+
+use App\Filament\Resources\Repositories\RepositoryResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateRepository extends CreateRecord
+{
+    protected static string $resource = RepositoryResource::class;
+}

app/Filament/Resources/Repositories/Pages/EditRepository.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Repositories\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Repositories\RepositoryResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditRepository extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = RepositoryResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Repositories/Pages/ListRepositories.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Repositories\Pages;
+
+use App\Filament\Resources\Repositories\RepositoryResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListRepositories extends ListRecords
+{
+    protected static string $resource = RepositoryResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Repositories/RepositoryResource.php

@@ -0,0 +1,135 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Repositories;
+
+use App\Enums\GitProvider;
+use App\Filament\Resources\Repositories\Pages\CreateRepository;
+use App\Filament\Resources\Repositories\Pages\EditRepository;
+use App\Filament\Resources\Repositories\Pages\ListRepositories;
+use App\Filament\Resources\Repositories\Tables\RepositoriesTable;
+use App\Models\Repository;
+use BackedEnum;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use UnitEnum;
+
+/**
+ * Git repositories connected to the collective's projects.
+ *
+ * The form is intentionally tiny: a repository is identified by its provider
+ * and "owner/repo", and everything else — stars, languages, contributors,
+ * newcomer-friendly issues — arrives from the provider on each sync. Nothing
+ * synced is editable, because a hand-typed star count is a lie waiting to
+ * happen.
+ */
+class RepositoryResource extends Resource
+{
+    protected static ?string $model = Repository::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedCodeBracketSquare;
+
+    protected static ?int $navigationSort = 5;
+
+    protected static ?string $recordTitleAttribute = 'full_name';
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.repositories.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.repositories.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    Select::make('provider')
+                        ->label(__('panel.repositories.fields.provider'))
+                        ->options(GitProvider::class)
+                        ->default(GitProvider::default())
+                        ->required()
+                        // Only providers with a driver registered in
+                        // config/git.php can actually be synced.
+                        ->disableOptionWhen(fn (string $value) => ! GitProvider::from($value)->isSupported()),
+
+                    TextInput::make('full_name')
+                        ->label(__('panel.repositories.fields.full_name'))
+                        ->placeholder('colectivo/mi-proyecto')
+                        ->helperText(__('panel.repositories.fields.full_name_hint'))
+                        ->required()
+                        ->maxLength(255)
+                        ->rules(['regex:/^[\w.-]+\/[\w.-]+$|^[\w.-]+$/']),
+
+                    Select::make('project_id')
+                        ->label(__('panel.repositories.fields.project'))
+                        ->relationship('project', 'title->'.config('locales.default'))
+                        ->searchable()
+                        ->preload(),
+
+                    Toggle::make('is_primary')
+                        ->label(__('panel.repositories.fields.is_primary'))
+                        ->helperText(__('panel.repositories.fields.is_primary_hint')),
+
+                    Toggle::make('show_publicly')
+                        ->label(__('panel.repositories.fields.show_publicly'))
+                        ->default(true),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return RepositoriesTable::configure($table);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['full_name'];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListRepositories::route('/'),
+            'create' => CreateRepository::route('/create'),
+            'edit' => EditRepository::route('/{record}/edit'),
+        ];
+    }
+
+    /**
+     * Flags repositories whose sync keeps failing — usually renamed or deleted
+     * upstream — so stale numbers do not sit on the public site unnoticed.
+     */
+    public static function getNavigationBadge(): ?string
+    {
+        $failing = static::getModel()::query()->failing()->count();
+
+        return $failing > 0 ? (string) $failing : null;
+    }
+
+    public static function getNavigationBadgeColor(): ?string
+    {
+        return 'danger';
+    }
+}

app/Filament/Resources/Repositories/Tables/RepositoriesTable.php

@@ -0,0 +1,178 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Repositories\Tables;
+
+use App\Jobs\SyncRepository;
+use App\Models\Repository;
+use App\Services\Git\GitException;
+use App\Services\Git\GitManager;
+use Filament\Actions\Action;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Notifications\Notification;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Auth;
+
+class RepositoriesTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->defaultSort('stars', 'desc')
+            ->columns([
+                TextColumn::make('full_name')
+                    ->label(__('panel.repositories.fields.full_name'))
+                    ->weight('medium')
+                    ->description(fn (Repository $r) => $r->description)
+                    ->wrap()
+                    ->url(fn (Repository $r) => $r->html_url, shouldOpenInNewTab: true)
+                    ->searchable()
+                    ->sortable(),
+
+                TextColumn::make('project.title')
+                    ->label(__('panel.repositories.fields.project'))
+                    ->badge()
+                    ->color('gray')
+                    ->placeholder('—')
+                    ->toggleable(),
+
+                TextColumn::make('primary_language')
+                    ->label(__('panel.repositories.fields.language'))
+                    ->badge()
+                    ->placeholder('—'),
+
+                TextColumn::make('stars')
+                    ->label('★')
+                    ->badge()
+                    ->color('warning')
+                    ->sortable(),
+
+                TextColumn::make('contributors_count')
+                    ->label(__('panel.repositories.fields.contributors'))
+                    ->badge()
+                    ->color('gray')
+                    ->sortable(),
+
+                TextColumn::make('good_first_issues_count')
+                    ->label(__('panel.repositories.fields.good_first_issues'))
+                    ->counts('goodFirstIssues')
+                    ->badge()
+                    ->color(fn ($state) => $state > 0 ? 'success' : 'gray'),
+
+                TextColumn::make('pushed_at')
+                    ->label(__('panel.repositories.fields.pushed_at'))
+                    ->since()
+                    // A repository nobody has touched in months is worth
+                    // spotting: it is what makes a site look abandoned.
+                    ->color(fn (Repository $r) => $r->isDormant() ? 'danger' : null)
+                    ->placeholder('—')
+                    ->sortable(),
+
+                IconColumn::make('show_publicly')
+                    ->label(__('panel.repositories.fields.show_publicly'))
+                    ->boolean()
+                    ->toggleable(),
+
+                TextColumn::make('last_synced_at')
+                    ->label(__('panel.repositories.fields.last_synced_at'))
+                    ->since()
+                    ->description(fn (Repository $r) => $r->sync_error
+                        ? str($r->sync_error)->limit(60)->toString()
+                        : null)
+                    ->color(fn (Repository $r) => $r->sync_error ? 'danger' : 'gray')
+                    ->placeholder(__('panel.repositories.never_synced')),
+            ])
+            ->filters([
+                TernaryFilter::make('show_publicly')
+                    ->label(__('panel.repositories.fields.show_publicly')),
+
+                Filter::make('failing')
+                    ->label(__('panel.repositories.filters.failing'))
+                    ->query(fn (Builder $q) => $q->failing()),
+
+                Filter::make('dormant')
+                    ->label(__('panel.repositories.filters.dormant'))
+                    ->query(fn (Builder $q) => $q->where(fn (Builder $sub) => $sub
+                        ->whereNull('pushed_at')
+                        ->orWhere('pushed_at', '<', now()->subDays(180)))),
+            ])
+            ->recordActions([
+                self::syncAction(),
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    self::syncBulkAction(),
+                    DeleteBulkAction::make(),
+                ]),
+            ]);
+    }
+
+    /**
+     * Runs inline rather than queueing, so the person who clicked sees the
+     * result — including the reason when it fails.
+     */
+    protected static function syncAction(): Action
+    {
+        return Action::make('sync')
+            ->label(__('panel.repositories.actions.sync'))
+            ->icon('heroicon-o-arrow-path')
+            ->color('gray')
+            ->visible(fn () => Auth::user()?->can('repositories.sync'))
+            ->action(function (Repository $record, GitManager $git): void {
+                try {
+                    $record = $git->sync($record);
+
+                    Notification::make()
+                        ->success()
+                        ->title(__('panel.repositories.notifications.synced'))
+                        ->body(__('panel.repositories.notifications.synced_body', [
+                            'stars' => $record->stars,
+                            'issues' => $record->goodFirstIssues()->count(),
+                        ]))
+                        ->send();
+                } catch (GitException $e) {
+                    Notification::make()
+                        ->danger()
+                        ->title(__('panel.repositories.notifications.sync_failed'))
+                        ->body($e->getMessage())
+                        ->persistent()
+                        ->send();
+                }
+            });
+    }
+
+    /**
+     * Syncing many repositories at once can exhaust the provider's rate limit,
+     * so this one goes through the queue instead of blocking the request.
+     */
+    protected static function syncBulkAction(): BulkAction
+    {
+        return BulkAction::make('syncAll')
+            ->label(__('panel.repositories.actions.sync_selected'))
+            ->icon('heroicon-o-arrow-path')
+            ->requiresConfirmation()
+            ->visible(fn () => Auth::user()?->can('repositories.sync'))
+            ->action(function (Collection $records): void {
+                $records->each(fn (Repository $r) => SyncRepository::dispatch($r));
+
+                Notification::make()
+                    ->success()
+                    ->title(__('panel.repositories.notifications.queued', ['count' => $records->count()]))
+                    ->send();
+            })
+            ->deselectRecordsAfterCompletion();
+    }
+}

app/Filament/Resources/RepositoryIssuesResource.php

@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources;
+
+use App\Filament\Resources\RepositoryIssuesResource\Pages\EditRepositoryIssue;
+use App\Filament\Resources\RepositoryIssuesResource\Pages\ListRepositoryIssues;
+use App\Filament\Resources\RepositoryIssuesResource\Schemas\RepositoryIssueForm;
+use App\Filament\Resources\RepositoryIssuesResource\Tables\RepositoryIssuesTable;
+use App\Models\RepositoryIssue;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use UnitEnum;
+
+class RepositoryIssuesResource extends Resource
+{
+    protected static ?string $model = RepositoryIssue::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedBugAnt;
+
+    protected static ?int $navigationSort = 3;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.issues.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.issues.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->title;
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return RepositoryIssueForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return RepositoryIssuesTable::configure($table);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListRepositoryIssues::route('/'),
+            'edit' => EditRepositoryIssue::route('/{record}/edit'),
+        ];
+    }
+
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+
+    public static function canDelete($record): bool
+    {
+        return true;
+    }
+}

app/Filament/Resources/RepositoryIssuesResource/Pages/EditRepositoryIssue.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\RepositoryIssuesResource\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\RepositoryIssuesResource;
+use Filament\Resources\Pages\EditRecord;
+
+class EditRepositoryIssue extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = RepositoryIssuesResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Resources/RepositoryIssuesResource/Pages/ListRepositoryIssues.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\RepositoryIssuesResource\Pages;
+
+use App\Filament\Resources\RepositoryIssuesResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListRepositoryIssues extends ListRecords
+{
+    protected static string $resource = RepositoryIssuesResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [];
+    }
+}

app/Filament/Resources/RepositoryIssuesResource/Schemas/RepositoryIssueForm.php

@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\RepositoryIssuesResource\Schemas;
+
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\Placeholder;
+use Filament\Forms\Components\Section;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Schema;
+
+class RepositoryIssueForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.issues.sections.details'))
+                ->schema([
+                    Placeholder::make('number')
+                        ->label(__('panel.issues.fields.number'))
+                        ->content(fn ($record) => $record?->number ? "#{$record->number}" : '—'),
+
+                    TextInput::make('title')
+                        ->label(__('panel.issues.fields.title'))
+                        ->disabled()
+                        ->columnSpanFull(),
+
+                    Select::make('repository_id')
+                        ->label(__('panel.issues.fields.repository'))
+                        ->relationship('repository', 'full_name')
+                        ->disabled()
+                        ->searchable(),
+
+                    TextInput::make('author')
+                        ->label(__('panel.issues.fields.author'))
+                        ->disabled(),
+
+                    TextInput::make('assignee')
+                        ->label(__('panel.issues.fields.assignee'))
+                        ->helperText(__('panel.issues.fields.assignee_hint')),
+
+                    TextInput::make('html_url')
+                        ->label(__('panel.issues.fields.url'))
+                        ->disabled()
+                        ->url()
+                        ->columnSpanFull(),
+                ]),
+
+            Section::make(__('panel.issues.sections.classification'))
+                ->schema([
+                    Toggle::make('is_good_first_issue')
+                        ->label(__('panel.issues.fields.is_good_first_issue'))
+                        ->helperText(__('panel.issues.fields.is_good_first_issue_hint')),
+
+                    Toggle::make('is_help_wanted')
+                        ->label(__('panel.issues.fields.is_help_wanted'))
+                        ->helperText(__('panel.issues.fields.is_help_wanted_hint')),
+                ]),
+
+            Section::make(__('panel.issues.sections.metadata'))
+                ->collapsed()
+                ->schema([
+                    TextInput::make('comments')
+                        ->label(__('panel.issues.fields.comments'))
+                        ->disabled()
+                        ->numeric(),
+
+                    DateTimePicker::make('issue_created_at')
+                        ->label(__('panel.issues.fields.issue_created_at'))
+                        ->disabled(),
+
+                    DateTimePicker::make('issue_updated_at')
+                        ->label(__('panel.issues.fields.issue_updated_at'))
+                        ->disabled(),
+
+                    Textarea::make('labels')
+                        ->label(__('panel.issues.fields.labels'))
+                        ->disabled()
+                        ->rows(3)
+                        ->columnSpanFull(),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/RepositoryIssuesResource/Tables/RepositoryIssuesTable.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\RepositoryIssuesResource\Tables;
+
+use Filament\Actions\DeleteAction;
+use Filament\Actions\EditAction;
+use Filament\Tables\Columns\BadgeColumn;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+
+class RepositoryIssuesTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('number')
+                    ->label(__('panel.issues.fields.number'))
+                    ->formatStateUsing(fn ($state) => "#{$state}")
+                    ->sortable()
+                    ->width('80px'),
+
+                TextColumn::make('title')
+                    ->label(__('panel.issues.fields.title'))
+                    ->weight('medium')
+                    ->searchable()
+                    ->wrap()
+                    ->limit(60),
+
+                TextColumn::make('repository.full_name')
+                    ->label(__('panel.issues.fields.repository'))
+                    ->searchable()
+                    ->sortable(),
+
+                IconColumn::make('is_good_first_issue')
+                    ->label(__('panel.issues.fields.is_good_first_issue'))
+                    ->boolean()
+                    ->trueIcon('heroicon-o-check-circle')
+                    ->falseIcon('heroicon-o-x-circle'),
+
+                IconColumn::make('is_help_wanted')
+                    ->label(__('panel.issues.fields.is_help_wanted'))
+                    ->boolean()
+                    ->trueIcon('heroicon-o-check-circle')
+                    ->falseIcon('heroicon-o-x-circle'),
+
+                BadgeColumn::make('assignee')
+                    ->label(__('panel.issues.fields.assignee'))
+                    ->color(fn ($state) => $state ? 'success' : 'gray')
+                    ->formatStateUsing(fn ($state) => $state ?? __('panel.issues.fields.unassigned')),
+
+                TextColumn::make('issue_created_at')
+                    ->label(__('panel.issues.fields.issue_created_at'))
+                    ->dateTime()
+                    ->sortable()
+                    ->toggleable(isToggledHiddenByDefault: true),
+            ])
+            ->actions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->filters([
+                SelectFilter::make('repository_id')
+                    ->label(__('panel.issues.filters.repository'))
+                    ->relationship('repository', 'full_name'),
+
+                Filter::make('is_good_first_issue')
+                    ->label(__('panel.issues.filters.good_first_issue'))
+                    ->toggle()
+                    ->query(fn (Builder $q) => $q->where('is_good_first_issue', true)),
+
+                Filter::make('is_help_wanted')
+                    ->label(__('panel.issues.filters.help_wanted'))
+                    ->toggle()
+                    ->query(fn (Builder $q) => $q->where('is_help_wanted', true)),
+
+                Filter::make('unclaimed')
+                    ->label(__('panel.issues.filters.unclaimed'))
+                    ->toggle()
+                    ->query(fn (Builder $q) => $q->whereNull('assignee')),
+
+                Filter::make('claimed')
+                    ->label(__('panel.issues.filters.claimed'))
+                    ->toggle()
+                    ->query(fn (Builder $q) => $q->whereNotNull('assignee')),
+            ])
+            ->defaultSort('issue_created_at', 'desc');
+    }
+}

app/Filament/Resources/Roles/Pages/CreateRole.php

@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles\Pages;
+
+use App\Filament\Resources\Roles\RoleResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateRole extends CreateRecord
+{
+    use HandlesRolePermissions;
+
+    protected static string $resource = RoleResource::class;
+}

app/Filament/Resources/Roles/Pages/EditRole.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Roles\RoleResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditRole extends EditRecord
+{
+    use HandlesRolePermissions, WarnsOfConcurrentEditing;
+
+    protected static string $resource = RoleResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Roles/Pages/HandlesRolePermissions.php

@@ -0,0 +1,100 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles\Pages;
+
+use App\Support\Permissions;
+use Spatie\Permission\PermissionRegistrar;
+
+/**
+ * Bridges the form's per-group checkbox state and the role's single
+ * `permissions` relationship.
+ *
+ * The form splits permissions across one component per resource for
+ * readability; the database wants one flat set. This trait converts in both
+ * directions and keeps the two in step.
+ */
+trait HandlesRolePermissions
+{
+    /**
+     * Permission names captured on the way to saving, held here because the
+     * relationship can only be synced once the role row exists.
+     *
+     * @var array<int, string>
+     */
+    protected array $selectedPermissions = [];
+
+    /**
+     * Expand the role's flat permission set into the form's grouped shape.
+     *
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeFill(array $data): array
+    {
+        $held = $this->getRecord()->permissions->pluck('name')->all();
+
+        foreach (Permissions::grouped() as $group => $permissions) {
+            $data['permission_groups'][$group] = array_values(array_intersect($permissions, $held));
+        }
+
+        return $data;
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeSave(array $data): array
+    {
+        return $this->extractPermissions($data);
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function mutateFormDataBeforeCreate(array $data): array
+    {
+        return $this->extractPermissions($data);
+    }
+
+    protected function afterSave(): void
+    {
+        $this->syncSelectedPermissions();
+    }
+
+    protected function afterCreate(): void
+    {
+        $this->syncSelectedPermissions();
+    }
+
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    protected function extractPermissions(array $data): array
+    {
+        $groups = $data['permission_groups'] ?? [];
+        unset($data['permission_groups']);
+
+        // Intersecting with the catalogue means a stale or hand-crafted value
+        // in the payload cannot grant a permission the app does not define.
+        $this->selectedPermissions = array_values(array_intersect(
+            array_merge(...array_values(array_map(fn ($v) => (array) $v, $groups)) ?: [[]]),
+            Permissions::all(),
+        ));
+
+        return $data;
+    }
+
+    protected function syncSelectedPermissions(): void
+    {
+        $this->getRecord()->syncPermissions($this->selectedPermissions);
+
+        // spatie caches the permission map; without this the change would not
+        // take effect until the cache expired.
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+    }
+}

app/Filament/Resources/Roles/Pages/ListRoles.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles\Pages;
+
+use App\Filament\Resources\Roles\RoleResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListRoles extends ListRecords
+{
+    protected static string $resource = RoleResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Roles/RoleResource.php

@@ -0,0 +1,69 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles;
+
+use App\Filament\Resources\Roles\Pages\CreateRole;
+use App\Filament\Resources\Roles\Pages\EditRole;
+use App\Filament\Resources\Roles\Pages\ListRoles;
+use App\Filament\Resources\Roles\Schemas\RoleForm;
+use App\Filament\Resources\Roles\Tables\RolesTable;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use Spatie\Permission\Models\Role;
+use UnitEnum;
+
+/**
+ * The authorisation model, editable in the panel.
+ *
+ * This is where "who may do what in this app" is decided — the identity server
+ * has no say in it.
+ */
+class RoleResource extends Resource
+{
+    protected static ?string $model = Role::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedShieldCheck;
+
+    protected static ?int $navigationSort = 40;
+
+    protected static ?string $recordTitleAttribute = 'name';
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.roles.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.roles.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return RoleForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return RolesTable::configure($table);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListRoles::route('/'),
+            'create' => CreateRole::route('/create'),
+            'edit' => EditRole::route('/{record}/edit'),
+        ];
+    }
+}

app/Filament/Resources/Roles/Schemas/RoleForm.php

@@ -0,0 +1,85 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles\Schemas;
+
+use App\Support\Permissions;
+use Filament\Forms\Components\CheckboxList;
+use Filament\Forms\Components\TextInput;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Validation\Rule;
+
+class RoleForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()->schema([
+                TextInput::make('name')
+                    ->label(__('panel.roles.fields.name'))
+                    ->required()
+                    ->maxLength(120)
+                    ->rules(fn ($record) => [
+                        Rule::unique('roles', 'name')->ignore($record?->id),
+                    ])
+                    // Renaming a structural role would break the code that
+                    // looks it up by name.
+                    ->disabled(fn ($record) => $record && in_array($record->name, Permissions::protectedRoles(), true))
+                    ->helperText(fn ($record) => $record && in_array($record->name, Permissions::protectedRoles(), true)
+                        ? __('panel.roles.protected')
+                        : null),
+            ]),
+
+            // One collapsible section per resource, generated from
+            // App\Support\Permissions — adding a permission there makes it
+            // appear here with no further work.
+            //
+            // Each group writes to its own state path rather than binding the
+            // `permissions` relationship directly: several components sharing
+            // one relationship would overwrite each other on save. The page
+            // classes flatten these back into a single syncPermissions() call
+            // (see HandlesRolePermissions).
+            ...collect(Permissions::grouped())
+                ->map(fn (array $permissions, string $group) => Section::make(
+                    __("panel.permissions.groups.{$group}")
+                )
+                    ->collapsible()
+                    ->collapsed($group !== 'general')
+                    ->schema([
+                        CheckboxList::make("permission_groups.{$group}")
+                            ->hiddenLabel()
+                            ->options(collect($permissions)
+                                ->mapWithKeys(fn (string $name) => [$name => self::abilityLabel($name)])
+                                ->all())
+                            ->bulkToggleable()
+                            ->columns(3),
+                    ]))
+                ->values()
+                ->all(),
+        ]);
+    }
+
+    /**
+     * Human label for a permission, e.g. "pages.force_delete" becomes
+     * "Eliminar definitivamente".
+     */
+    public static function abilityLabel(string $permission): string
+    {
+        if ($permission === Permissions::PANEL_ACCESS) {
+            return __('panel.permissions.abilities.panel_access');
+        }
+
+        $ability = str_contains($permission, '.')
+            ? substr($permission, strpos($permission, '.') + 1)
+            : $permission;
+
+        $key = "panel.permissions.abilities.{$ability}";
+        $label = __($key);
+
+        // Fall back to the raw name if the catalogue grows a permission that
+        // has no translation yet, rather than printing the missing key.
+        return $label === $key ? $permission : $label;
+    }
+}

app/Filament/Resources/Roles/Tables/RolesTable.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Roles\Tables;
+
+use App\Support\Permissions;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\EditAction;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Spatie\Permission\Models\Role;
+
+class RolesTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->defaultSort('name')
+            ->columns([
+                TextColumn::make('name')
+                    ->label(__('panel.roles.fields.name'))
+                    ->weight('medium')
+                    ->badge()
+                    ->color(fn (string $state) => $state === 'super_admin' ? 'danger' : 'primary')
+                    ->description(fn (Role $record) => in_array($record->name, Permissions::protectedRoles(), true)
+                        ? __('panel.roles.protected')
+                        : null)
+                    ->searchable()
+                    ->sortable(),
+
+                TextColumn::make('permissions_count')
+                    ->label(__('panel.roles.fields.permissions'))
+                    ->counts('permissions')
+                    // super_admin holds no permission rows: it is granted
+                    // everything by the Gate::before hook instead.
+                    ->formatStateUsing(fn ($state, Role $record) => $record->name === 'super_admin'
+                        ? '∞'
+                        : $state)
+                    ->badge(),
+
+                TextColumn::make('users_count')
+                    ->label(__('panel.roles.fields.users_count'))
+                    ->counts('users')
+                    ->badge()
+                    ->color('gray'),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ]);
+    }
+}

app/Filament/Resources/Services/Pages/CreateService.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Services\Pages;
+
+use App\Filament\Resources\Services\ServiceResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateService extends CreateRecord
+{
+    protected static string $resource = ServiceResource::class;
+}

app/Filament/Resources/Services/Pages/EditService.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Services\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Services\ServiceResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditService extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = ServiceResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Services/Pages/ListServices.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Services\Pages;
+
+use App\Filament\Resources\Services\ServiceResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListServices extends ListRecords
+{
+    protected static string $resource = ServiceResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Services/ServiceResource.php

@@ -0,0 +1,408 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Services;
+
+use App\Filament\RelationManagers\ReviewsRelationManager;
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Services\Pages\CreateService;
+use App\Filament\Resources\Services\Pages\EditService;
+use App\Filament\Resources\Services\Pages\ListServices;
+use App\Filament\Support\PreviewAction;
+use App\Filament\Support\ReviewActions;
+use App\Filament\Support\ReviewStatusColumn;
+use App\Filament\Support\TranslatableTabs;
+use App\Filament\Support\TranslationStatusColumn;
+use App\Filament\Support\ViewsColumn;
+use App\Models\Service;
+use App\Rules\UniqueTranslatedSlug;
+use App\Support\DuplicateTitles;
+use App\Support\TranslationFreshness;
+use BackedEnum;
+use Filament\Actions\BulkAction;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\ReplicateAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Forms\Components\DateTimePicker;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Notifications\Notification;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\Filter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
+use UnitEnum;
+
+/**
+ * What the collective offers to do.
+ *
+ * The counterpart to a project: one says what has been built, this says what
+ * somebody would be asking for. The relation to projects is what keeps it
+ * honest — a service that cannot point at real work is a promise.
+ */
+class ServiceResource extends Resource
+{
+    protected static ?string $model = Service::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedSparkles;
+
+    protected static ?int $navigationSort = 1;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.services.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.services.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->getTranslation('title', app()->getLocale());
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()->schema([
+                TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                    TextInput::make("title.{$locale}")
+                        ->label(__('panel.services.fields.title'))
+                        ->required($isDefault)
+                        ->maxLength(255)
+                        ->columnSpanFull()
+                        ->live(onBlur: true)
+                        ->afterStateUpdated(function (?string $state, ?Model $record, callable $get, callable $set) use ($locale, $isDefault) {
+                            if (blank($get("slug.{$locale}"))) {
+                                $set("slug.{$locale}", Str::slug((string) $state));
+                            }
+
+                            if ($isDefault) {
+                                DuplicateTitles::warnIfSimilar(
+                                    Service::class,
+                                    ServiceResource::class,
+                                    $state,
+                                    $locale,
+                                    $record?->getKey(),
+                                );
+                            }
+                        }),
+
+                    TextInput::make("slug.{$locale}")
+                        ->label(__('panel.services.fields.slug'))
+                        ->required($isDefault)
+                        ->maxLength(255)
+                        ->columnSpanFull()
+                        ->rules(fn ($record) => [new UniqueTranslatedSlug(Service::class, $record?->id)]),
+
+                    Textarea::make("tagline.{$locale}")
+                        ->label(__('panel.services.fields.tagline'))
+                        ->helperText(__('panel.services.fields.tagline_hint'))
+                        ->rows(2)
+                        ->maxLength(255)
+                        ->columnSpanFull(),
+
+                    Textarea::make("description.{$locale}")
+                        ->label(__('panel.services.fields.description'))
+                        ->rows(6)
+                        ->columnSpanFull(),
+                ]),
+            ]),
+
+            Section::make(__('panel.services.sections.evidence'))
+                ->description(__('panel.services.sections.evidence_hint'))
+                ->schema([
+                    Select::make('projects')
+                        ->label(__('panel.services.fields.projects'))
+                        // Explicit order: Filament would otherwise sort a
+                        // `select distinct` by a JSON path, which Postgres
+                        // rejects.
+                        ->relationship(
+                            name: 'projects',
+                            titleAttribute: 'title->'.config('locales.default'),
+                            modifyQueryUsing: fn (Builder $query) => $query->orderByDesc('published_at'),
+                        )
+                        ->multiple()
+                        ->preload()
+                        ->searchable()
+                        ->columnSpanFull(),
+
+                    Select::make('technologies')
+                        ->label(__('panel.services.fields.technologies'))
+                        ->relationship('technologies', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable()
+                        ->columnSpanFull(),
+                ]),
+
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    TextInput::make('icon')
+                        ->label(__('panel.services.fields.icon'))
+                        ->helperText(__('panel.services.fields.icon_hint'))
+                        ->placeholder('heroicon-o-code-bracket')
+                        ->maxLength(120),
+
+                    TextInput::make('position')
+                        ->label(__('panel.services.fields.position'))
+                        ->numeric()
+                        ->default(0),
+
+                    Toggle::make('is_published')
+                        ->label(__('panel.services.fields.is_published'))
+                        // Writing the offer and putting it on the website are
+                        // separate permissions, exactly as with projects.
+                        ->disabled(fn () => Auth::user()?->cannot('services.publish'))
+                        ->dehydrated(),
+
+                    Toggle::make('is_featured')
+                        ->label(__('panel.services.fields.is_featured'))
+                        ->helperText(__('panel.services.fields.is_featured_hint')),
+
+                    DateTimePicker::make('published_at')
+                        ->label(__('panel.services.fields.published_at'))
+                        ->helperText(__('panel.services.fields.published_at_hint'))
+                        ->seconds(false)
+                        ->disabled(fn () => Auth::user()?->cannot('services.publish'))
+                        ->dehydrated(),
+
+                    DateTimePicker::make('unpublish_at')
+                        ->label(__('panel.services.fields.unpublish_at'))
+                        ->helperText(__('panel.services.fields.unpublish_at_hint'))
+                        ->seconds(false)
+                        ->after('published_at')
+                        ->disabled(fn () => Auth::user()?->cannot('services.publish'))
+                        ->dehydrated(),
+                ]),
+
+            Section::make(__('panel.services.sections.seo'))
+                ->collapsed()
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("meta_title.{$locale}")
+                            ->label(__('panel.services.fields.meta_title'))
+                            ->maxLength(60)
+                            ->columnSpanFull(),
+
+                        Textarea::make("meta_description.{$locale}")
+                            ->label(__('panel.services.fields.meta_description'))
+                            ->rows(2)
+                            ->maxLength(160)
+                            ->columnSpanFull(),
+                    ]),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            // One grouped query for the whole page of rows, so the reading
+            // figures cost the listing nothing per row.
+            ->modifyQueryUsing(fn (Builder $query) => $query->withRecentViews())
+            ->defaultSort('position')
+            ->reorderable('position')
+            ->columns([
+                TextColumn::make('title')
+                    ->label(__('panel.services.fields.title'))
+                    ->weight('medium')
+                    ->description(fn (Service $record) => $record->getTranslation('tagline', $locale, false) ?: null)
+                    ->wrap()
+                    ->searchable(query: fn (Builder $q, string $search) => $q
+                        ->where("title->{$locale}", 'like', "%{$search}%")),
+
+                TranslationStatusColumn::make('translations')
+                    ->label(__('panel.services.fields.translations'))
+                    ->trackedAttribute('title'),
+
+                // The number that says whether this is an offer or a promise.
+                TextColumn::make('projects_count')
+                    ->label(__('panel.services.fields.projects'))
+                    ->counts('projects')
+                    ->badge()
+                    ->color(fn (int $state) => $state > 0 ? 'success' : 'warning')
+                    ->tooltip(fn (int $state) => $state > 0 ? null : __('panel.services.no_projects')),
+
+                // What the site is doing, not only what is stored: a service
+                // waiting for its date is not "published" however the switch
+                // is set.
+                IconColumn::make('is_published')
+                    ->label(__('panel.services.fields.is_published'))
+                    ->boolean()
+                    ->tooltip(fn (Service $record) => match (true) {
+                        $record->hasExpired() => __('panel.publishing.expired'),
+                        $record->isScheduled() => __('panel.publishing.scheduled'),
+                        default => null,
+                    })
+                    ->color(fn (Service $record) => match (true) {
+                        $record->hasExpired() => 'gray',
+                        $record->isScheduled() => 'info',
+                        default => null,
+                    }),
+
+                ViewsColumn::make('recent_views')
+                    ->label(__('panel.views.column'))
+                    ->tooltip(__('panel.views.column_hint')),
+
+                ReviewStatusColumn::make('review')
+                    ->label(__('panel.reviews.column')),
+
+                IconColumn::make('is_featured')
+                    ->label(__('panel.services.fields.is_featured'))
+                    ->boolean()
+                    ->toggleable(),
+            ])
+            ->filters([
+                // The reviewer's own queue. Unaddressed requests are in it
+                // too: a review nobody was named for is everybody's.
+                Filter::make('awaiting_review')
+                    ->label(__('panel.reviews.filters.mine'))
+                    ->query(fn (Builder $query) => Auth::user()
+                        ? $query->awaitingReviewBy(Auth::user())
+                        : $query->awaitingReview()),
+
+                TernaryFilter::make('is_published')->label(__('panel.services.fields.is_published')),
+                TernaryFilter::make('is_featured')->label(__('panel.services.fields.is_featured')),
+
+                // Published and, as far as anybody can tell, read by nobody.
+                Filter::make('unread')
+                    ->label(__('panel.views.filters.unread'))
+                    ->query(fn (Builder $query) => $query
+                        ->published()
+                        ->whereDoesntHave('views', fn (Builder $views) => $views->since(30))),
+
+                // Translated and left behind by the original. Worked out
+                // from the change history rather than a column, so it is
+                // resolved here and handed to the query as a list.
+                Filter::make('stale_translation')
+                    ->label(__('panel.translations.filters.stale'))
+                    ->query(fn (Builder $query) => $query->whereIn(
+                        'id',
+                        TranslationFreshness::staleIds($query->getModel()::query()),
+                    )),
+
+                Filter::make('scheduled')
+                    ->label(__('panel.publishing.scheduled'))
+                    ->query(fn (Builder $query) => $query->scheduled()),
+
+                Filter::make('expired')
+                    ->label(__('panel.publishing.expired'))
+                    ->query(fn (Builder $query) => $query->expired()),
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                ReviewActions::request(),
+                ReviewActions::returnForChanges(),
+
+                // A near-copy is a real workflow: the third similar service,
+                // next year's call. The slug is cleared because two records
+                // cannot answer at the same URL.
+                ReplicateAction::make()
+                    ->label(__('panel.actions.duplicate'))
+                    ->icon('heroicon-o-document-duplicate')
+                    ->excludeAttributes(['slug', 'published_at', 'unpublish_at'])
+                    ->modalHeading(__('panel.actions.duplicate_heading'))
+                    ->successNotificationTitle(__('panel.actions.duplicated')),
+
+                PreviewAction::for('service'),
+
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    ReviewActions::requestBulk(Service::class),
+
+                    BulkAction::make('publish')
+                        ->label(__('panel.services.actions.publish'))
+                        ->icon('heroicon-o-check-circle')
+                        ->color('success')
+                        ->requiresConfirmation()
+                        ->visible(fn () => Auth::user()?->can('services.publish') ?? false)
+                        ->deselectRecordsAfterCompletion()
+                        ->action(function (Collection $records): void {
+                            $published = 0;
+
+                            // One at a time: publishing fires the revision
+                            // entry and closes any pending review, and a mass
+                            // update would skip both without a sound.
+                            foreach ($records as $record) {
+                                if ($record->is_published) {
+                                    continue;
+                                }
+
+                                $record->update([
+                                    'is_published' => true,
+                                    'published_at' => $record->published_at ?? now(),
+                                ]);
+
+                                $published++;
+                            }
+
+                            Notification::make()
+                                ->title(trans_choice('panel.publishing.published_count', $published, ['count' => $published]))
+                                ->success()
+                                ->send();
+                        }),
+
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['title->'.app()->getLocale()];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            ReviewsRelationManager::class,
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListServices::route('/'),
+            'create' => CreateService::route('/create'),
+            'edit' => EditService::route('/{record}/edit'),
+        ];
+    }
+}

app/Filament/Resources/SettingsResource.php

@@ -0,0 +1,69 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources;
+
+use App\Filament\Resources\SettingsResource\Pages\EditSettings;
+use App\Filament\Resources\SettingsResource\Pages\ListSettings;
+use App\Filament\Resources\SettingsResource\Schemas\SettingsForm;
+use App\Filament\Resources\SettingsResource\Tables\SettingsTable;
+use App\Models\Setting;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use UnitEnum;
+
+class SettingsResource extends Resource
+{
+    protected static ?string $model = Setting::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedCog6Tooth;
+
+    protected static ?int $navigationSort = 99;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.settings.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.settings.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return SettingsForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return SettingsTable::configure($table);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListSettings::route('/'),
+            'edit' => EditSettings::route('/{record}/edit'),
+        ];
+    }
+
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+
+    public static function canDelete($record): bool
+    {
+        return false;
+    }
+}

app/Filament/Resources/SettingsResource/Pages/EditSettings.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\SettingsResource\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\SettingsResource;
+use Filament\Resources\Pages\EditRecord;
+
+class EditSettings extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = SettingsResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            // Settings should not be deleted from the UI
+        ];
+    }
+}

app/Filament/Resources/SettingsResource/Pages/ListSettings.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\SettingsResource\Pages;
+
+use App\Filament\Resources\SettingsResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListSettings extends ListRecords
+{
+    protected static string $resource = SettingsResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            // Settings are managed individually, no bulk create
+        ];
+    }
+}

app/Filament/Resources/SettingsResource/Schemas/SettingsForm.php

@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\SettingsResource\Schemas;
+
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+
+class SettingsForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.settings.sections.general'))
+                ->schema([
+                    TextInput::make('key')
+                        ->label(__('panel.settings.fields.key'))
+                        ->disabled()
+                        ->columnSpanFull(),
+
+                    /*
+                     * Raw JSON rather than a key/value editor.
+                     *
+                     * A setting holds whatever it holds: `site.maintenance` is
+                     * a map containing another map of translations. A
+                     * key/value grid can only show one flat level, so it would
+                     * render the nested part as text and write that text back
+                     * on save — quietly destroying every translation of the
+                     * maintenance notice.
+                     *
+                     * Showing the value as it really is cannot lie about it,
+                     * and the `json` rule means a typo is refused rather than
+                     * stored.
+                     */
+                    Textarea::make('value')
+                        ->label(__('panel.settings.fields.value'))
+                        ->helperText(__('panel.settings.fields.value_hint'))
+                        ->rows(12)
+                        ->columnSpanFull()
+                        ->extraInputAttributes(['class' => 'font-mono text-sm'])
+                        ->rule('json')
+                        ->formatStateUsing(fn (mixed $state): string => json_encode(
+                            $state,
+                            JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES,
+                        ) ?: 'null')
+                        ->dehydrateStateUsing(fn (?string $state): mixed => json_decode(
+                            (string) $state,
+                            associative: true,
+                        )),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/SettingsResource/Tables/SettingsTable.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\SettingsResource\Tables;
+
+use Filament\Actions\EditAction;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Columns\ViewColumn;
+use Filament\Tables\Table;
+
+class SettingsTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->columns([
+                TextColumn::make('key')
+                    ->label(__('panel.settings.fields.key'))
+                    ->searchable()
+                    ->sortable()
+                    ->weight('medium')
+                    ->fontFamily('mono'),
+
+                // A ViewColumn is a bare column: it has no `wrap()`, and does
+                // not need one — the view below does its own wrapping.
+                ViewColumn::make('value')
+                    ->label(__('panel.settings.fields.value'))
+                    ->view('filament.tables.columns.json-value'),
+            ])
+            ->recordActions([
+                EditAction::make(),
+            ]);
+    }
+}

app/Filament/Resources/Talks/Pages/CreateTalk.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Talks\Pages;
+
+use App\Filament\Resources\Talks\TalkResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateTalk extends CreateRecord
+{
+    protected static string $resource = TalkResource::class;
+}

app/Filament/Resources/Talks/Pages/EditTalk.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Talks\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Talks\TalkResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditTalk extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = TalkResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Talks/Pages/ListTalks.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Talks\Pages;
+
+use App\Filament\Resources\Talks\TalkResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListTalks extends ListRecords
+{
+    protected static string $resource = TalkResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Talks/TalkResource.php

@@ -0,0 +1,220 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Talks;
+
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Talks\Pages\CreateTalk;
+use App\Filament\Resources\Talks\Pages\EditTalk;
+use App\Filament\Resources\Talks\Pages\ListTalks;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Talk;
+use BackedEnum;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Forms\Components\DatePicker;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use UnitEnum;
+
+/**
+ * Talks given somewhere that is not this website.
+ *
+ * The cheapest content there is to keep a site looking alive, and the only
+ * kind that shows the collective exists outside its own pages. Written once,
+ * it shows both on the landing page and on the profile of whoever gave it.
+ */
+class TalkResource extends Resource
+{
+    protected static ?string $model = Talk::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedMicrophone;
+
+    protected static ?int $navigationSort = 7;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.talks.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.talks.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->title;
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    // The name of a talk that was given once, in one language.
+                    // Translating it would invent a talk that never happened.
+                    TextInput::make('title')
+                        ->label(__('panel.talks.fields.title'))
+                        ->helperText(__('panel.talks.fields.title_hint'))
+                        ->required()
+                        ->maxLength(255)
+                        ->columnSpanFull(),
+
+                    TextInput::make('event')
+                        ->label(__('panel.talks.fields.event'))
+                        ->required()
+                        ->maxLength(255),
+
+                    TextInput::make('city')
+                        ->label(__('panel.talks.fields.city'))
+                        ->maxLength(120),
+
+                    DatePicker::make('held_at')
+                        ->label(__('panel.talks.fields.held_at')),
+
+                    Select::make('language')
+                        ->label(__('panel.talks.fields.language'))
+                        ->options(fn () => collect(config('locales.supported'))
+                            ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                            ->all())
+                        ->default(config('locales.default'))
+                        ->required(),
+
+                    TextInput::make('video_url')
+                        ->label(__('panel.talks.fields.video_url'))
+                        ->url()
+                        ->maxLength(2048),
+
+                    TextInput::make('slides_url')
+                        ->label(__('panel.talks.fields.slides_url'))
+                        ->url()
+                        ->maxLength(2048),
+                ]),
+
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    Select::make('member_id')
+                        ->label(__('panel.talks.fields.member'))
+                        ->helperText(__('panel.talks.fields.member_hint'))
+                        ->relationship('member', 'name')
+                        ->searchable()
+                        ->preload(),
+
+                    Select::make('project_id')
+                        ->label(__('panel.talks.fields.project'))
+                        ->relationship('project', 'title->'.config('locales.default'))
+                        ->searchable()
+                        ->preload(),
+
+                    TranslatableTabs::make(fn (string $locale) => [
+                        Textarea::make("summary.{$locale}")
+                            ->label(__('panel.talks.fields.summary'))
+                            ->rows(3)
+                            ->maxLength(500)
+                            ->columnSpanFull(),
+                    ])->columnSpanFull(),
+
+                    Toggle::make('is_public')
+                        ->label(__('panel.talks.fields.is_public'))
+                        ->default(true),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('held_at', 'desc')
+            ->columns([
+                TextColumn::make('title')
+                    ->label(__('panel.talks.fields.title'))
+                    ->weight('medium')
+                    ->description(fn (Talk $record) => trim($record->event.' · '.($record->city ?? ''), ' ·'))
+                    ->wrap()
+                    ->searchable(['title', 'event']),
+
+                TextColumn::make('member.name')
+                    ->label(__('panel.talks.fields.member'))
+                    ->placeholder('—')
+                    ->toggleable(),
+
+                TextColumn::make('held_at')
+                    ->label(__('panel.talks.fields.held_at'))
+                    ->date()
+                    ->placeholder('—')
+                    ->sortable(),
+
+                IconColumn::make('video_url')
+                    ->label(__('panel.talks.fields.video_url'))
+                    ->boolean()
+                    ->toggleable(),
+
+                IconColumn::make('is_public')
+                    ->label(__('panel.talks.fields.is_public'))
+                    ->boolean(),
+            ])
+            ->filters([
+                TernaryFilter::make('is_public')->label(__('panel.talks.fields.is_public')),
+
+                SelectFilter::make('member')
+                    ->label(__('panel.talks.fields.member'))
+                    ->relationship('member', 'name')
+                    ->searchable()
+                    ->preload(),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([DeleteBulkAction::make()]),
+            ]);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['title', 'event'];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListTalks::route('/'),
+            'create' => CreateTalk::route('/create'),
+            'edit' => EditTalk::route('/{record}/edit'),
+        ];
+    }
+}

app/Filament/Resources/Technologies/Pages/CreateTechnology.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Technologies\Pages;
+
+use App\Filament\Resources\Technologies\TechnologyResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateTechnology extends CreateRecord
+{
+    protected static string $resource = TechnologyResource::class;
+}

app/Filament/Resources/Technologies/Pages/EditTechnology.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Technologies\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Technologies\TechnologyResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditTechnology extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = TechnologyResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Technologies/Pages/ListTechnologies.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Technologies\Pages;
+
+use App\Filament\Resources\Technologies\TechnologyResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListTechnologies extends ListRecords
+{
+    protected static string $resource = TechnologyResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Technologies/TechnologyResource.php

@@ -0,0 +1,234 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Technologies;
+
+use App\Enums\RadarRing;
+use App\Enums\TechnologyCategory;
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Technologies\Pages\CreateTechnology;
+use App\Filament\Resources\Technologies\Pages\EditTechnology;
+use App\Filament\Resources\Technologies\Pages\ListTechnologies;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Technology;
+use BackedEnum;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Forms\Components\ColorPicker;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\ColorColumn;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
+use UnitEnum;
+
+/**
+ * The shared vocabulary of the site, and the source of the tech radar.
+ *
+ * Names are not translatable — "Rust" is "Rust" in every language. Only the
+ * prose explaining a choice is.
+ */
+class TechnologyResource extends Resource
+{
+    protected static ?string $model = Technology::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedCpuChip;
+
+    protected static ?int $navigationSort = 4;
+
+    protected static ?string $recordTitleAttribute = 'name';
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.technologies.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.technologies.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make()
+                ->columns(2)
+                ->schema([
+                    TextInput::make('name')
+                        ->label(__('panel.technologies.fields.name'))
+                        ->required()
+                        ->maxLength(120)
+                        ->live(onBlur: true)
+                        ->afterStateUpdated(function (?string $state, callable $get, callable $set) {
+                            if (blank($get('slug'))) {
+                                $set('slug', Str::slug((string) $state));
+                            }
+                        }),
+
+                    TextInput::make('slug')
+                        ->label(__('panel.technologies.fields.slug'))
+                        ->required()
+                        ->maxLength(120)
+                        ->rules(fn ($record) => [Rule::unique('technologies', 'slug')->ignore($record?->id)]),
+
+                    Select::make('category')
+                        ->label(__('panel.technologies.fields.category'))
+                        ->options(TechnologyCategory::class)
+                        ->default(TechnologyCategory::Tool)
+                        ->required(),
+
+                    // Leaving the ring empty keeps a technology usable as a tag
+                    // without putting it on the public radar.
+                    Select::make('radar_ring')
+                        ->label(__('panel.technologies.fields.radar_ring'))
+                        ->options(RadarRing::class)
+                        ->helperText(__('panel.technologies.fields.radar_ring_hint'))
+                        ->placeholder(__('panel.technologies.off_radar')),
+
+                    ColorPicker::make('color')->label(__('panel.technologies.fields.color')),
+
+                    // A file rather than the name of an icon from a set the
+                    // frontend may or may not bundle.
+                    FileUpload::make('logo')
+                        ->label(__('panel.technologies.fields.logo'))
+                        ->helperText(__('panel.technologies.fields.logo_hint'))
+                        ->image()
+                        ->disk(config('media.disk'))
+                        ->directory('technologies')
+                        ->columnSpanFull(),
+
+                    TextInput::make('website')
+                        ->label(__('panel.technologies.fields.website'))
+                        ->url()
+                        ->maxLength(2048),
+
+                    TextInput::make('position')
+                        ->label(__('panel.technologies.fields.position'))
+                        ->numeric()
+                        ->default(0),
+                ]),
+
+            Section::make(__('panel.technologies.sections.prose'))
+                ->collapsed()
+                ->schema([
+                    TranslatableTabs::make(fn (string $locale) => [
+                        Textarea::make("description.{$locale}")
+                            ->label(__('panel.technologies.fields.description'))
+                            ->rows(3)
+                            ->columnSpanFull(),
+
+                        // Why this sits in that ring. The part of a tech radar
+                        // people actually read.
+                        Textarea::make("radar_note.{$locale}")
+                            ->label(__('panel.technologies.fields.radar_note'))
+                            ->helperText(__('panel.technologies.fields.radar_note_hint'))
+                            ->rows(3)
+                            ->columnSpanFull(),
+                    ], label: __('panel.technologies.sections.prose')),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('name')
+            ->columns([
+                ImageColumn::make('logo')
+                    ->label('')
+                    ->disk(config('media.disk'))
+                    ->height(24),
+
+                ColorColumn::make('color')->label(''),
+
+                TextColumn::make('name')
+                    ->label(__('panel.technologies.fields.name'))
+                    ->weight('medium')
+                    ->searchable()
+                    ->sortable(),
+
+                TextColumn::make('category')
+                    ->label(__('panel.technologies.fields.category'))
+                    ->badge()
+                    ->sortable(),
+
+                TextColumn::make('radar_ring')
+                    ->label(__('panel.technologies.fields.radar_ring'))
+                    ->badge()
+                    ->placeholder(__('panel.technologies.off_radar'))
+                    ->sortable(),
+
+                TextColumn::make('projects_count')
+                    ->label(__('panel.technologies.fields.projects'))
+                    ->counts('projects')
+                    ->badge()
+                    ->color('gray'),
+
+                TextColumn::make('members_count')
+                    ->label(__('panel.technologies.fields.members'))
+                    ->counts('members')
+                    ->badge()
+                    ->color('gray'),
+            ])
+            ->filters([
+                SelectFilter::make('category')
+                    ->label(__('panel.technologies.fields.category'))
+                    ->options(TechnologyCategory::options())
+                    ->multiple(),
+
+                SelectFilter::make('radar_ring')
+                    ->label(__('panel.technologies.fields.radar_ring'))
+                    ->options(RadarRing::options())
+                    ->multiple(),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([DeleteBulkAction::make()]),
+            ]);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['name'];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListTechnologies::route('/'),
+            'create' => CreateTechnology::route('/create'),
+            'edit' => EditTechnology::route('/{record}/edit'),
+        ];
+    }
+}

app/Filament/Resources/Testimonials/Pages/CreateTestimonial.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Testimonials\Pages;
+
+use App\Filament\Resources\Testimonials\TestimonialResource;
+use Filament\Resources\Pages\CreateRecord;
+
+class CreateTestimonial extends CreateRecord
+{
+    protected static string $resource = TestimonialResource::class;
+}

app/Filament/Resources/Testimonials/Pages/EditTestimonial.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Testimonials\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Testimonials\TestimonialResource;
+use Filament\Actions\DeleteAction;
+use Filament\Resources\Pages\EditRecord;
+
+class EditTestimonial extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = TestimonialResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            DeleteAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Testimonials/Pages/ListTestimonials.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Testimonials\Pages;
+
+use App\Filament\Resources\Testimonials\TestimonialResource;
+use Filament\Actions\CreateAction;
+use Filament\Resources\Pages\ListRecords;
+
+class ListTestimonials extends ListRecords
+{
+    protected static string $resource = TestimonialResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            CreateAction::make(),
+        ];
+    }
+}

app/Filament/Resources/Testimonials/TestimonialResource.php

@@ -0,0 +1,252 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Testimonials;
+
+use App\Filament\RelationManagers\RevisionsRelationManager;
+use App\Filament\Resources\Testimonials\Pages\CreateTestimonial;
+use App\Filament\Resources\Testimonials\Pages\EditTestimonial;
+use App\Filament\Resources\Testimonials\Pages\ListTestimonials;
+use App\Filament\Support\TranslatableTabs;
+use App\Models\Testimonial;
+use BackedEnum;
+use Filament\Actions\BulkActionGroup;
+use Filament\Actions\DeleteAction;
+use Filament\Actions\DeleteBulkAction;
+use Filament\Actions\EditAction;
+use Filament\Actions\ForceDeleteBulkAction;
+use Filament\Actions\RestoreBulkAction;
+use Filament\Forms\Components\DatePicker;
+use Filament\Forms\Components\FileUpload;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\Textarea;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Resources\Resource;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Filters\TrashedFilter;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use UnitEnum;
+
+/**
+ * What somebody else says about the work.
+ *
+ * Attached to a client, a project or a service rather than to "the home page":
+ * the frontend asks for the ones belonging to whatever it is rendering, which
+ * is what keeps this a content type rather than a page-builder block.
+ */
+class TestimonialResource extends Resource
+{
+    protected static ?string $model = Testimonial::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedChatBubbleBottomCenterText;
+
+    protected static ?int $navigationSort = 6;
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.testimonials.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.testimonials.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.collective');
+    }
+
+    public static function getRecordTitle(?Model $record): ?string
+    {
+        return $record?->author_name;
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return $schema->components([
+            Section::make(__('panel.testimonials.sections.quote'))
+                ->description(__('panel.testimonials.sections.quote_hint'))
+                ->schema([
+                    Select::make('original_locale')
+                        ->label(__('panel.testimonials.fields.original_locale'))
+                        ->helperText(__('panel.testimonials.fields.original_locale_hint'))
+                        ->options(fn () => collect(config('locales.supported'))
+                            ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                            ->all())
+                        ->default(config('locales.default'))
+                        ->required(),
+
+                    TranslatableTabs::make(fn (string $locale, bool $isDefault) => [
+                        Textarea::make("quote.{$locale}")
+                            ->label(__('panel.testimonials.fields.quote'))
+                            ->required($isDefault)
+                            ->rows(4)
+                            ->maxLength(1000)
+                            ->columnSpanFull(),
+                    ])->columnSpanFull(),
+                ]),
+
+            Section::make(__('panel.testimonials.sections.author'))
+                ->columns(2)
+                ->schema([
+                    TextInput::make('author_name')
+                        ->label(__('panel.testimonials.fields.author_name'))
+                        ->required()
+                        ->maxLength(255),
+
+                    DatePicker::make('given_at')
+                        ->label(__('panel.testimonials.fields.given_at')),
+
+                    TranslatableTabs::make(fn (string $locale) => [
+                        TextInput::make("author_role.{$locale}")
+                            ->label(__('panel.testimonials.fields.author_role'))
+                            ->maxLength(255)
+                            ->columnSpanFull(),
+                    ])->columnSpanFull(),
+
+                    FileUpload::make('avatar')
+                        ->label(__('panel.testimonials.fields.avatar'))
+                        ->image()
+                        ->avatar()
+                        ->disk(config('media.disk'))
+                        ->directory('testimonials')
+                        ->columnSpanFull(),
+                ]),
+
+            Section::make(__('panel.testimonials.sections.about'))
+                ->description(__('panel.testimonials.sections.about_hint'))
+                ->columns(3)
+                ->schema([
+                    Select::make('client_id')
+                        ->label(__('panel.testimonials.fields.client'))
+                        ->relationship('client', 'name')
+                        ->searchable()
+                        ->preload(),
+
+                    Select::make('project_id')
+                        ->label(__('panel.testimonials.fields.project'))
+                        ->relationship('project', 'title->'.config('locales.default'))
+                        ->searchable()
+                        ->preload(),
+
+                    Select::make('service_id')
+                        ->label(__('panel.testimonials.fields.service'))
+                        ->relationship('service', 'title->'.config('locales.default'))
+                        ->searchable()
+                        ->preload(),
+
+                    Toggle::make('is_public')
+                        ->label(__('panel.testimonials.fields.is_public'))
+                        ->default(true),
+
+                    TextInput::make('position')
+                        ->label(__('panel.testimonials.fields.position'))
+                        ->numeric()
+                        ->default(0),
+                ]),
+        ]);
+    }
+
+    public static function table(Table $table): Table
+    {
+        $locale = app()->getLocale();
+
+        return $table
+            ->defaultSort('position')
+            ->reorderable('position')
+            ->columns([
+                ImageColumn::make('avatar')
+                    ->label('')
+                    ->circular()
+                    ->disk(config('media.disk')),
+
+                TextColumn::make('quote')
+                    ->label(__('panel.testimonials.fields.quote'))
+                    ->state(fn (Testimonial $record) => $record->getTranslation('quote', $locale, false) ?: null)
+                    ->wrap()
+                    ->limit(120),
+
+                TextColumn::make('author_name')
+                    ->label(__('panel.testimonials.fields.author_name'))
+                    ->description(fn (Testimonial $record) => $record->getTranslation('author_role', $locale, false) ?: null)
+                    ->searchable(),
+
+                // Whose words these are matters: a quote with nothing behind
+                // it is a sentence somebody wrote about themselves.
+                TextColumn::make('client.name')
+                    ->label(__('panel.testimonials.fields.client'))
+                    ->badge()
+                    ->color('gray')
+                    ->placeholder('—')
+                    ->toggleable(),
+
+                TextColumn::make('original_locale')
+                    ->label(__('panel.testimonials.fields.original_locale'))
+                    ->badge()
+                    ->color('gray')
+                    ->formatStateUsing(fn (string $state) => config("locales.supported.{$state}.native", $state))
+                    ->toggleable(),
+
+                IconColumn::make('is_public')
+                    ->label(__('panel.testimonials.fields.is_public'))
+                    ->boolean(),
+            ])
+            ->filters([
+                TernaryFilter::make('is_public')->label(__('panel.testimonials.fields.is_public')),
+
+                SelectFilter::make('client')
+                    ->label(__('panel.testimonials.fields.client'))
+                    ->relationship('client', 'name')
+                    ->searchable()
+                    ->preload(),
+
+                TrashedFilter::make(),
+            ])
+            ->recordActions([
+                EditAction::make(),
+                DeleteAction::make(),
+            ])
+            ->toolbarActions([
+                BulkActionGroup::make([
+                    DeleteBulkAction::make(),
+                    ForceDeleteBulkAction::make(),
+                    RestoreBulkAction::make(),
+                ]),
+            ]);
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['author_name'];
+    }
+
+    public static function getRelations(): array
+    {
+        return [
+            RevisionsRelationManager::class,
+        ];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListTestimonials::route('/'),
+            'create' => CreateTestimonial::route('/create'),
+            'edit' => EditTestimonial::route('/{record}/edit'),
+        ];
+    }
+}

app/Filament/Resources/Users/Pages/EditUser.php

@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Users\Pages;
+
+use App\Filament\Concerns\WarnsOfConcurrentEditing;
+use App\Filament\Resources\Users\UserResource;
+use Filament\Resources\Pages\EditRecord;
+
+class EditUser extends EditRecord
+{
+    use WarnsOfConcurrentEditing;
+
+    protected static string $resource = UserResource::class;
+}

app/Filament/Resources/Users/Pages/ListUsers.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Users\Pages;
+
+use App\Filament\Resources\Users\UserResource;
+use Filament\Resources\Pages\ListRecords;
+
+class ListUsers extends ListRecords
+{
+    protected static string $resource = UserResource::class;
+}

app/Filament/Resources/Users/RelationManagers/SessionsRelationManager.php

@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Users\RelationManagers;
+
+use App\Models\UserSession;
+use Filament\Actions\Action;
+use Filament\Notifications\Notification;
+use Filament\Resources\RelationManagers\RelationManager;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Table;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Str;
+
+/**
+ * Every browser this account is signed in from, right now.
+ *
+ * Deactivating somebody (`is_active = false`) already cuts them off the
+ * moment the guard next checks — but that check runs on their *next*
+ * request, and until now there was nowhere to see whether one was still in
+ * progress, let alone end it early. This is that place: read straight from
+ * the `sessions` table Laravel's own database session driver already
+ * maintains, nothing new written anywhere.
+ */
+class SessionsRelationManager extends RelationManager
+{
+    protected static string $relationship = 'sessions';
+
+    public static function getTitle(Model $ownerRecord, string $pageClass): string
+    {
+        return __('panel.sessions.title');
+    }
+
+    public static function getBadge(Model $ownerRecord, string $pageClass): ?string
+    {
+        $count = $ownerRecord->sessions()->count();
+
+        return $count > 0 ? (string) $count : null;
+    }
+
+    /**
+     * Gated on the same permission that governs the rest of this screen,
+     * rather than a permission of its own: whoever may already deactivate an
+     * account is exactly who should be able to see, and end, where it is
+     * currently signed in.
+     */
+    public static function canViewForRecord(Model $ownerRecord, string $pageClass): bool
+    {
+        return (bool) Auth::user()?->can('users.update');
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->recordTitleAttribute('id')
+            ->defaultSort('last_activity', 'desc')
+            ->columns([
+                TextColumn::make('ip_address')
+                    ->label(__('panel.sessions.fields.ip_address'))
+                    ->fontFamily('mono')
+                    ->placeholder('—'),
+
+                TextColumn::make('user_agent')
+                    ->label(__('panel.sessions.fields.device'))
+                    ->state(fn (UserSession $record) => self::describeUserAgent($record->user_agent))
+                    ->description(fn (UserSession $record) => $record->isCurrent()
+                        ? __('panel.sessions.this_one')
+                        : null),
+
+                TextColumn::make('last_activity')
+                    ->label(__('panel.sessions.fields.last_activity'))
+                    ->state(fn (UserSession $record) => $record->last_activity)
+                    ->since()
+                    ->dateTimeTooltip(),
+            ])
+            ->recordActions([
+                Action::make('revoke')
+                    ->label(__('panel.sessions.actions.revoke'))
+                    ->icon('heroicon-o-x-circle')
+                    ->color('danger')
+                    ->requiresConfirmation()
+                    // The one row this screen must never offer to end: doing
+                    // so would sign out whoever is looking at it, mid-click.
+                    ->visible(fn (UserSession $record) => ! $record->isCurrent())
+                    ->action(function (UserSession $record): void {
+                        $record->delete();
+
+                        Notification::make()
+                            ->title(__('panel.sessions.revoked'))
+                            ->success()
+                            ->send();
+                    }),
+            ])
+            ->emptyStateHeading(__('panel.sessions.empty.heading'))
+            ->emptyStateDescription(__('panel.sessions.empty.description'))
+            ->emptyStateIcon('heroicon-o-computer-desktop');
+    }
+
+    /**
+     * Browser and platform, guessed from the raw string every session row
+     * already carries — not a parsing library, just enough of one to turn
+     * "Mozilla/5.0 (Macintosh…) AppleWebKit… Safari/605.1" into something a
+     * person recognises at a glance.
+     */
+    protected static function describeUserAgent(?string $userAgent): string
+    {
+        if (blank($userAgent)) {
+            return __('panel.sessions.unknown_device');
+        }
+
+        $browser = match (true) {
+            Str::contains($userAgent, 'Edg/') => 'Edge',
+            Str::contains($userAgent, 'OPR/') => 'Opera',
+            Str::contains($userAgent, 'Firefox/') => 'Firefox',
+            Str::contains($userAgent, 'Chrome/') => 'Chrome',
+            Str::contains($userAgent, 'Safari/') => 'Safari',
+            default => null,
+        };
+
+        $platform = match (true) {
+            Str::contains($userAgent, 'iPhone') || Str::contains($userAgent, 'iPad') => 'iOS',
+            Str::contains($userAgent, 'Android') => 'Android',
+            Str::contains($userAgent, 'Mac OS X') => 'macOS',
+            Str::contains($userAgent, 'Windows') => 'Windows',
+            Str::contains($userAgent, 'Linux') => 'Linux',
+            default => null,
+        };
+
+        return match (true) {
+            $browser && $platform => "{$browser} · {$platform}",
+            $browser !== null => $browser,
+            $platform !== null => $platform,
+            default => __('panel.sessions.unknown_device'),
+        };
+    }
+}

app/Filament/Resources/Users/Schemas/UserForm.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Users\Schemas;
+
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Forms\Components\Toggle;
+use Filament\Schemas\Components\Section;
+use Filament\Schemas\Schema;
+use Illuminate\Support\Facades\Auth;
+use Spatie\Permission\Models\Role;
+
+class UserForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema->components([
+            // Everything the identity server owns. Shown for context, disabled
+            // because any edit here would be overwritten on the user's next
+            // sign-in — these fields are changed at oauth.pireon.dev.
+            Section::make(__('panel.users.sections.identity'))
+                ->description(__('panel.users.sections.identity_hint'))
+                ->columns(2)
+                ->schema([
+                    TextInput::make('name')
+                        ->label(__('panel.users.fields.name'))
+                        ->disabled(),
+
+                    TextInput::make('email')
+                        ->label(__('panel.users.fields.email'))
+                        ->disabled(),
+
+                    TextInput::make('oauth_id')
+                        ->label(__('panel.users.fields.oauth_id'))
+                        ->disabled(),
+
+                    TextInput::make('remote_roles')
+                        ->label(__('panel.users.fields.remote_roles'))
+                        ->formatStateUsing(fn ($state) => implode(', ', (array) $state) ?: '—')
+                        ->helperText(__('pireon.account.remote_roles_hint'))
+                        ->disabled()
+                        ->dehydrated(false),
+                ]),
+
+            // Everything this application owns.
+            Section::make(__('panel.users.sections.access'))
+                ->description(__('panel.users.sections.access_hint'))
+                ->columns(2)
+                ->schema([
+                    Select::make('roles')
+                        ->label(__('panel.users.fields.roles'))
+                        ->relationship('roles', 'name')
+                        ->multiple()
+                        ->preload()
+                        ->searchable()
+                        // Only a super admin can hand out super_admin; without
+                        // this, an admin could promote themselves.
+                        ->options(fn () => Role::query()
+                            ->when(
+                                ! Auth::user()?->hasRole('super_admin'),
+                                fn ($q) => $q->where('name', '!=', 'super_admin')
+                            )
+                            ->pluck('name', 'name')
+                            ->all())
+                        ->saveRelationshipsUsing(function ($record, ?array $state): void {
+                            $roles = $state ?? [];
+
+                            // Preserve a super_admin assignment the current
+                            // editor was not allowed to see in the list.
+                            if ($record->hasRole('super_admin') && ! Auth::user()?->hasRole('super_admin')) {
+                                $roles[] = 'super_admin';
+                            }
+
+                            $record->syncRoles(array_unique($roles));
+                        })
+                        ->columnSpanFull(),
+
+                    Select::make('locale')
+                        ->label(__('panel.users.fields.locale'))
+                        ->options(fn () => collect(config('locales.supported'))
+                            ->map(fn (array $meta, string $code) => $meta['native'] ?? $code)
+                            ->all())
+                        ->native(false),
+
+                    Toggle::make('is_active')
+                        ->label(__('panel.users.fields.is_active'))
+                        // Deactivating locally cuts off both the panel and the
+                        // API immediately, without touching the OAuth server.
+                        ->disabled(fn ($record) => $record?->id === Auth::id()),
+                ]),
+        ]);
+    }
+}

app/Filament/Resources/Users/Tables/UsersTable.php

@@ -0,0 +1,87 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Users\Tables;
+
+use App\Models\User;
+use Filament\Actions\Action;
+use Filament\Actions\EditAction;
+use Filament\Tables\Columns\IconColumn;
+use Filament\Tables\Columns\ImageColumn;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Filters\TernaryFilter;
+use Filament\Tables\Table;
+use Illuminate\Support\Facades\Auth;
+
+class UsersTable
+{
+    public static function configure(Table $table): Table
+    {
+        return $table
+            ->defaultSort('name')
+            ->columns([
+                ImageColumn::make('avatar_url')
+                    ->label('')
+                    ->circular()
+                    ->defaultImageUrl(fn (User $record) => 'https://ui-avatars.com/api/?name='.urlencode($record->name)),
+
+                TextColumn::make('name')
+                    ->label(__('panel.users.fields.name'))
+                    ->description(fn (User $record) => $record->email)
+                    ->searchable(['name', 'email'])
+                    ->sortable(),
+
+                TextColumn::make('roles.name')
+                    ->label(__('panel.users.fields.roles'))
+                    ->badge()
+                    ->color(fn (string $state) => $state === 'super_admin' ? 'danger' : 'primary')
+                    ->placeholder('—'),
+
+                TextColumn::make('locale')
+                    ->label(__('panel.users.fields.locale'))
+                    ->formatStateUsing(fn (?string $state) => $state
+                        ? (config("locales.supported.{$state}.native") ?? $state)
+                        : '—')
+                    ->toggleable(),
+
+                IconColumn::make('is_active')
+                    ->label(__('panel.users.fields.is_active'))
+                    ->boolean()
+                    ->sortable(),
+
+                TextColumn::make('last_login_at')
+                    ->label(__('panel.users.fields.last_login_at'))
+                    ->dateTime()
+                    ->since()
+                    ->placeholder(__('panel.users.fields.never'))
+                    ->sortable(),
+            ])
+            ->filters([
+                SelectFilter::make('roles')
+                    ->label(__('panel.users.fields.roles'))
+                    ->relationship('roles', 'name')
+                    ->multiple()
+                    ->preload(),
+
+                TernaryFilter::make('is_active')
+                    ->label(__('panel.users.fields.is_active')),
+            ])
+            ->recordActions([
+                Action::make('toggleActive')
+                    ->label(fn (User $record) => $record->is_active
+                        ? __('panel.users.actions.deactivate')
+                        : __('panel.users.actions.activate'))
+                    ->icon(fn (User $record) => $record->is_active ? 'heroicon-o-lock-closed' : 'heroicon-o-lock-open')
+                    ->color(fn (User $record) => $record->is_active ? 'danger' : 'success')
+                    ->requiresConfirmation()
+                    // Locking yourself out mid-session is never the intent.
+                    ->visible(fn (User $record) => $record->id !== Auth::id()
+                        && Auth::user()?->can('update', $record))
+                    ->action(fn (User $record) => $record->update(['is_active' => ! $record->is_active])),
+
+                EditAction::make(),
+            ]);
+    }
+}

app/Filament/Resources/Users/UserResource.php

@@ -0,0 +1,95 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Resources\Users;
+
+use App\Filament\Resources\Users\Pages\EditUser;
+use App\Filament\Resources\Users\Pages\ListUsers;
+use App\Filament\Resources\Users\RelationManagers\SessionsRelationManager;
+use App\Filament\Resources\Users\Schemas\UserForm;
+use App\Filament\Resources\Users\Tables\UsersTable;
+use App\Models\User;
+use BackedEnum;
+use Filament\Resources\Resource;
+use Filament\Schemas\Schema;
+use Filament\Support\Icons\Heroicon;
+use Filament\Tables\Table;
+use UnitEnum;
+
+/**
+ * Local user administration.
+ *
+ * There is deliberately no "create" page: accounts originate on the identity
+ * server and appear here on first sign-in. What this screen manages is the
+ * half this application owns — roles, the active flag, and locale.
+ */
+class UserResource extends Resource
+{
+    protected static ?string $model = User::class;
+
+    protected static string|BackedEnum|null $navigationIcon = Heroicon::OutlinedUsers;
+
+    protected static ?int $navigationSort = 30;
+
+    protected static ?string $recordTitleAttribute = 'name';
+
+    public static function getModelLabel(): string
+    {
+        return __('panel.users.label');
+    }
+
+    public static function getPluralModelLabel(): string
+    {
+        return __('panel.users.plural');
+    }
+
+    public static function getNavigationGroup(): string|UnitEnum|null
+    {
+        return __('panel.groups.administration');
+    }
+
+    public static function form(Schema $schema): Schema
+    {
+        return UserForm::configure($schema);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return UsersTable::configure($table);
+    }
+
+    /**
+     * @return array<int, class-string>
+     */
+    public static function getRelations(): array
+    {
+        return [
+            SessionsRelationManager::class,
+        ];
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public static function getGloballySearchableAttributes(): array
+    {
+        return ['name', 'email'];
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => ListUsers::route('/'),
+            'edit' => EditUser::route('/{record}/edit'),
+        ];
+    }
+
+    /**
+     * Accounts are provisioned by the OAuth login flow, never by hand.
+     */
+    public static function canCreate(): bool
+    {
+        return false;
+    }
+}

app/Filament/Support/PreviewAction.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Support;
+
+use App\Support\PreviewLink;
+use Filament\Actions\Action;
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * A button that produces a shareable link to a draft.
+ *
+ * The shared preview secret still works, but using it meant pasting a token
+ * into a curl command. This is a link somebody can send: scoped to one record
+ * and one language, and dead a few hours later.
+ */
+final class PreviewAction
+{
+    public static function for(string $type): Action
+    {
+        return Action::make('preview')
+            ->label(__('panel.preview.label'))
+            ->icon('heroicon-o-eye')
+            ->color('gray')
+            ->modalHeading(__('panel.preview.heading'))
+            ->modalDescription(__('panel.preview.hint', ['hours' => PreviewLink::HOURS]))
+            ->modalSubmitAction(false)
+            // Nothing to preview without a public address to preview it at.
+            ->visible(fn (Model $record) => filled(array_filter(
+                array_map(
+                    fn (string $locale) => $record->getTranslation('slug', $locale, false),
+                    array_keys((array) config('locales.supported')),
+                ),
+            )))
+            ->modalContent(fn (Model $record) => view('filament.partials.preview-links', [
+                'links' => collect(config('locales.supported'))
+                    ->mapWithKeys(fn (array $meta, string $locale) => [
+                        ($meta['native'] ?? $locale) => PreviewLink::for($record, $type, $locale),
+                    ])
+                    ->filter()
+                    ->all(),
+            ]));
+    }
+}