diff --git a/application/single_app/admin_settings_nav.py b/application/single_app/admin_settings_nav.py
new file mode 100644
index 000000000..84229254c
--- /dev/null
+++ b/application/single_app/admin_settings_nav.py
@@ -0,0 +1,586 @@
+# admin_settings_nav.py
+"""Single source of truth for the Admin Settings navigation.
+
+The top tab strip and the sidebar previously maintained the same
+structure twice, by hand, and had already drifted: tab order differed
+between them and three tabs carried different labels in each. Both now
+render from this one definition, so they cannot disagree.
+
+Structure is GROUP -> TAB -> SECTION. A section points at a card id in
+the rendered page; card ids are stable and are what cross-references
+resolve against, so cards can move between tabs without breaking links.
+"""
+
+
+ADMIN_NAV = [
+    {
+        "id": "appearance",
+        "label": "Appearance",
+        "icon": "bi-palette",
+        "tabs": [
+            {
+                "id": "branding",
+                "label": "Branding",
+                "icon": "bi-palette",
+                "sections": [
+                    {"id": "branding-section", "label": "Branding", "icon": "bi-palette"},
+                    {"id": "home-page-text-section", "label": "Home Page Text", "icon": "bi-house"},
+                    {"id": "appearance-section", "label": "Appearance", "icon": "bi-brush"},
+                ],
+            },
+            {
+                # Everything the app states to the user before or during use:
+                # banners, notices and the agreements they must accept.
+                "id": "notices",
+                "label": "Notices & Agreements",
+                "icon": "bi-megaphone",
+                "sections": [
+                    {"id": "classification-banner-section", "label": "Classification Banner", "icon": "bi-shield-exclamation"},
+                    {"id": "ai-notice-section", "label": "Chat AI Notice", "icon": "bi-robot"},
+                    {"id": "terms-of-use-section", "label": "Terms of Use", "icon": "bi-door-open"},
+                    {"id": "user-agreement-section", "label": "User Agreement", "icon": "bi-file-earmark-check"},
+                ],
+            },
+            {
+                "id": "custom-pages",
+                "label": "Pages & Links",
+                "icon": "bi-window-plus",
+                "sections": [
+                    {"id": "custom-pages-section", "label": "Static Pages", "icon": "bi-file-earmark-richtext"},
+                    {"id": "external-links-section", "label": "External Links", "icon": "bi-box-arrow-up-right"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "chat",
+        "label": "Chat",
+        "icon": "bi-chat-square-text",
+        "tabs": [
+            {
+                "id": "chat-experience",
+                "label": "Chat Experience",
+                "icon": "bi-chat-square-dots",
+                "sections": [
+                    {"id": "processing-thoughts-section", "label": "Processing Thoughts", "icon": "bi-stars"},
+                    {"id": "chat-file-uploads-section", "label": "Chat File Uploads", "icon": "bi-paperclip"},
+                    {"id": "conversation-contents-drawer-section", "label": "Conversation Contents Drawer", "icon": "bi-list-nested"},
+                    {"id": "workspace-scope-lock-section", "label": "Workspace Scope Lock", "icon": "bi-lock"},
+                    {"id": "conversation-history-section", "label": "Conversation History", "icon": "bi-clock-history"},
+                    {"id": "default-system-prompt-section", "label": "Default System Prompt", "icon": "bi-chat-square-quote"},
+                ],
+            },
+            {
+                "id": "feedback-alerts",
+                "label": "Feedback & Alerts",
+                "icon": "bi-chat-square-heart",
+                "sections": [
+                    {"id": "user-feedback-section", "label": "User Feedback", "icon": "bi-chat-square-heart"},
+                    {"id": "desktop-notifications-section", "label": "Desktop Conversation Notifications", "icon": "bi-bell"},
+                ],
+            },
+            {
+                "id": "citation",
+                "label": "Citations",
+                "icon": "bi-quote",
+                "sections": [
+                    {"id": "standard-citations-section", "label": "Standard", "icon": "bi-quote"},
+                    {"id": "enhanced-citations-section", "label": "Enhanced", "icon": "bi-star"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "ai-models",
+        "label": "AI Models",
+        "icon": "bi-cpu",
+        "tabs": [
+            {
+                # The Chat Model card is reached through the legacy model
+                # settings dialog opened from here, so it is listed with the
+                # endpoints rather than as a tab of its own.
+                "id": "model-endpoints",
+                "label": "Model Endpoints",
+                "icon": "bi-hdd-network",
+                "sections": [
+                    {"id": "multi-endpoint-configuration", "label": "Model Endpoints", "icon": "bi-hdd-network"},
+                    {"id": "gpt-config", "label": "Chat Model", "icon": "bi-chat-square-text"},
+                ],
+            },
+            {
+                "id": "embeddings",
+                "label": "Embeddings",
+                "icon": "bi-vector-pen",
+                "sections": [
+                    {"id": "embeddings-config", "label": "Embeddings", "icon": "bi-vector-pen"},
+                ],
+            },
+            {
+                "id": "image-generation",
+                "label": "Image Generation",
+                "icon": "bi-image",
+                "sections": [
+                    {"id": "image-config", "label": "Image Generation", "icon": "bi-image"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "agents-actions",
+        "label": "Agents & Actions",
+        "icon": "bi-robot",
+        "tabs": [
+            {
+                "id": "agents",
+                "label": "Agents",
+                "icon": "bi-robot",
+                "sections": [
+                    {"id": "agents-config", "label": "Agents Configuration", "icon": "bi-robot"},
+                    {"id": "agent-template-approvals-section", "label": "Agent Template Approvals", "icon": "bi-layers", "condition": "enable_agent_template_gallery"},
+                ],
+            },
+            {
+                "id": "actions",
+                "label": "Actions",
+                "icon": "bi-plugin",
+                "sections": [
+                    {"id": "document-action-capabilities-card", "label": "Document Action Capabilities", "icon": "bi-files"},
+                    {"id": "actions-config", "label": "Actions Configuration", "icon": "bi-plugin"},
+                ],
+            },
+            {
+                # The whole tab is behind mcp_ui_enabled, so the tab carries the
+                # condition rather than the single section inside it.
+                "id": "inbound-mcp",
+                "label": "Inbound MCP",
+                "icon": "bi-diagram-3",
+                "condition": "mcp_ui_enabled",
+                "sections": [
+                    {"id": "inbound-mcp-configuration", "label": "Inbound MCP", "icon": "bi-diagram-3", "condition": "mcp_ui_enabled"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "workspaces",
+        "label": "Workspaces",
+        "icon": "bi-folder",
+        "tabs": [
+            {
+                "id": "workspace-types",
+                "label": "Workspace Types",
+                "icon": "bi-folder",
+                "sections": [
+                    {"id": "personal-workspaces-section", "label": "Personal Workspaces", "icon": "bi-person"},
+                    {"id": "group-workspaces-section", "label": "Group Workspaces", "icon": "bi-people"},
+                    {"id": "public-workspaces-section", "label": "Public Workspaces", "icon": "bi-globe"},
+                ],
+            },
+            {
+                # Who may take a file out of a workspace, and who must approve
+                # it first.
+                "id": "files-sharing",
+                "label": "Files & Sharing",
+                "icon": "bi-share",
+                "sections": [
+                    {"id": "file-download-settings-section", "label": "File Downloads", "icon": "bi-download"},
+                    {"id": "file-sharing-section", "label": "File Sharing", "icon": "bi-share"},
+                    {"id": "shared-conversation-file-approvals-section", "label": "Shared Conversation File Approvals", "icon": "bi-check2-square"},
+                    {"id": "file-size-limit-section", "label": "Maximum File Size", "icon": "bi-file-earmark-arrow-up"},
+                ],
+            },
+            {
+                "id": "workspace-identities",
+                "label": "Global Identities",
+                "icon": "bi-person-badge",
+                "sections": [],
+            },
+        ],
+    },
+    {
+        # Workflow drives approvals and assignment across workspaces and is
+        # large enough to stand on its own rather than sit inside Workspaces.
+        "id": "workflow",
+        "label": "Workflow",
+        "icon": "bi-diagram-3",
+        "tabs": [
+            {
+                "id": "workflow",
+                "label": "Workflow",
+                "icon": "bi-diagram-3",
+                "sections": [
+                    {"id": "workflow-settings-section", "label": "Workflow", "icon": "bi-diagram-3"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "knowledge",
+        "label": "Knowledge",
+        "icon": "bi-search",
+        "tabs": [
+            {
+                # Reaching outside the tenant for material.
+                "id": "web-research",
+                "label": "Web & Research",
+                "icon": "bi-globe",
+                "sections": [
+                    {"id": "web-search-section", "label": "Web Search", "icon": "bi-globe"},
+                    {"id": "url-access-section", "label": "URL Access", "icon": "bi-link-45deg"},
+                    {"id": "source-review-section", "label": "Deep Research", "icon": "bi-binoculars"},
+                ],
+            },
+            {
+                "id": "search-index",
+                "label": "Search Index",
+                "icon": "bi-search",
+                "sections": [
+                    {"id": "azure-ai-search-section", "label": "Azure AI Search", "icon": "bi-search"},
+                ],
+            },
+            {
+                # Turning a document into something searchable.
+                "id": "extraction",
+                "label": "Document Extraction",
+                "icon": "bi-file-earmark-text",
+                "sections": [
+                    {"id": "document-intelligence-section", "label": "Document Intelligence", "icon": "bi-file-earmark-text"},
+                    {"id": "chunk-size-section", "label": "Chunk Sizes", "icon": "bi-collection"},
+                    {"id": "metadata-extraction-section", "label": "Metadata Extraction", "icon": "bi-file-earmark-code"},
+                    {"id": "multimodal-vision-section", "label": "Multi-Modal Vision Analysis", "icon": "bi-eye"},
+                ],
+            },
+            {
+                # Voice and video are extraction pipelines, not chat features.
+                "id": "audio-video",
+                "label": "Audio & Video",
+                "icon": "bi-play-circle",
+                "sections": [
+                    {"id": "video-intelligence-section", "label": "AI Video Intelligence", "icon": "bi-play-circle"},
+                    {"id": "ai-voice-chat-section", "label": "AI Voice Conversations", "icon": "bi-mic"},
+                ],
+            },
+            {
+                "id": "file-sync",
+                "label": "File Sync",
+                "icon": "bi-arrow-repeat",
+                "sections": [
+                    {"id": "file-sync-section", "label": "File Sync", "icon": "bi-arrow-repeat"},
+                    {"id": "file-sync-source-types-section", "label": "Visible Source Types", "icon": "bi-sliders"},
+                    {"id": "file-sync-personal-section", "label": "Personal Workspace Sync", "icon": "bi-person"},
+                    {"id": "file-sync-group-section", "label": "Group Workspace Sync", "icon": "bi-people"},
+                    {"id": "file-sync-public-section", "label": "Public Workspace Sync", "icon": "bi-globe"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "security",
+        "label": "Security",
+        "icon": "bi-shield-lock",
+        "tabs": [
+            {
+                # Who can get in and what role they need. Distinct from Content
+                # Safety, which is about what may be said once you are in.
+                "id": "access-roles",
+                "label": "Access & Roles",
+                "icon": "bi-person-check",
+                "sections": [
+                    {"id": "permissions-section", "label": "Permissions", "icon": "bi-person-check"},
+                    {"id": "app-role-requirements-section", "label": "App Role Requirements", "icon": "bi-person-badge"},
+                    {"id": "access-denied-message-section", "label": "Access Denied Message", "icon": "bi-shield-x"},
+                ],
+            },
+            {
+                "id": "secrets",
+                "label": "Secrets",
+                "icon": "bi-safe",
+                "sections": [
+                    {"id": "keyvault-section", "label": "Key Vault", "icon": "bi-safe"},
+                ],
+            },
+            {
+                "id": "content-safety",
+                "label": "Content Safety",
+                "icon": "bi-shield-exclamation",
+                "sections": [
+                    {"id": "content-safety-section", "label": "Content Safety", "icon": "bi-shield-exclamation"},
+                ],
+            },
+            {
+                # Idle timeout is the only thing left here. The rest of the old
+                # System Settings card was split out to the tabs that own each
+                # setting, without renaming a single field.
+                "id": "session",
+                "label": "Session",
+                "icon": "bi-hourglass-split",
+                "sections": [
+                    {"id": "idle-timeout-section", "label": "Idle Session Timeout", "icon": "bi-hourglass-split"},
+                ],
+            },
+            {
+                # Front Door configures authentication and redirect flows, so it
+                # belongs with Security rather than with throughput settings.
+                "id": "network",
+                "label": "Network",
+                "icon": "bi-door-open",
+                "sections": [
+                    {"id": "front-door-section", "label": "Azure Front Door", "icon": "bi-door-open"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "governance",
+        "label": "Governance",
+        "icon": "bi-clipboard-check",
+        "tabs": [
+            {
+                "id": "feature-governance",
+                "label": "Feature Governance",
+                "icon": "bi-braces-asterisk",
+                "sections": [
+                    {"id": "governance-feature-toggles-section", "label": "Governance Feature Toggles", "icon": "bi-braces-asterisk"},
+                ],
+            },
+            {
+                "id": "governance-policies",
+                "label": "Policies",
+                "icon": "bi-sliders2",
+                "sections": [
+                    {"id": "governance-feature-policies-section", "label": "Feature Policies", "icon": "bi-sliders2"},
+                    {"id": "governance-item-policies-section", "label": "Delegated Item Policies", "icon": "bi-list-check"},
+                ],
+            },
+            {
+                "id": "mcp-governance",
+                "label": "MCP Governance",
+                "icon": "bi-diagram-3",
+                "sections": [
+                    {"id": "governance-mcp-destination-section", "label": "MCP Action Destination Governance", "icon": "bi-diagram-3"},
+                    {"id": "governance-inbound-mcp-section", "label": "Inbound MCP Source Governance", "icon": "bi-box-arrow-in-down-right"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "data-lifecycle",
+        "label": "Data Lifecycle",
+        "icon": "bi-hourglass-split",
+        "tabs": [
+            {
+                "id": "retention",
+                "label": "Retention",
+                "icon": "bi-hourglass-split",
+                "sections": [
+                    {"id": "retention-policy-section", "label": "Retention Policy", "icon": "bi-hourglass-split"},
+                ],
+            },
+            {
+                "id": "classification",
+                "label": "Classification",
+                "icon": "bi-tags",
+                "sections": [
+                    {"id": "document-classification-section", "label": "Document Classification", "icon": "bi-tags"},
+                ],
+            },
+            {
+                "id": "archiving",
+                "label": "Archiving",
+                "icon": "bi-archive",
+                "sections": [
+                    {"id": "conversation-archiving-section", "label": "Conversation Archiving", "icon": "bi-archive"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "backup-recovery",
+        "label": "Backup & Recovery",
+        "icon": "bi-database",
+        "tabs": [
+            {
+                # Schedule, storage and encryption are cards nested inside the
+                # backup card, so they stay with it.
+                "id": "backup",
+                "label": "Backup",
+                "icon": "bi-archive",
+                "sections": [
+                    {"id": "data-management-readiness-section", "label": "Start Here", "icon": "bi-compass"},
+                    {"id": "data-management-backup-section", "label": "Backup", "icon": "bi-archive"},
+                    {"id": "data-management-schedule-section", "label": "Schedule", "icon": "bi-calendar-event"},
+                    {"id": "data-management-storage-section", "label": "Storage", "icon": "bi-hdd"},
+                    {"id": "data-management-encryption-section", "label": "Encryption", "icon": "bi-key"},
+                ],
+            },
+            {
+                "id": "migrate",
+                "label": "Migrate",
+                "icon": "bi-arrow-left-right",
+                "sections": [
+                    {"id": "data-management-migration-section", "label": "Migration", "icon": "bi-arrow-left-right"},
+                ],
+            },
+            {
+                "id": "restore",
+                "label": "Restore",
+                "icon": "bi-box-seam",
+                "sections": [
+                    {"id": "data-management-backup-inventory-section", "label": "Backup Inventory & Restore", "icon": "bi-box-seam"},
+                ],
+            },
+            {
+                # A direct database editor. It is a repair tool that belongs
+                # with the backup and restore tooling it shares a module with.
+                "id": "cosmos-editor",
+                "label": "Cosmos Editor",
+                "icon": "bi-database-exclamation",
+                "sections": [
+                    {"id": "data-management-cosmos-editor-section", "label": "Cosmos Editor", "icon": "bi-database-exclamation"},
+                ],
+            },
+            {
+                "id": "jobs",
+                "label": "Jobs",
+                "icon": "bi-clock-history",
+                "sections": [
+                    {"id": "data-management-jobs-section", "label": "Jobs", "icon": "bi-clock-history"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "scale",
+        "label": "Scale",
+        "icon": "bi-speedometer2",
+        "tabs": [
+            {
+                "id": "redis-caching",
+                "label": "Redis & Caching",
+                "icon": "bi-database",
+                "sections": [
+                    {"id": "redis-cache-section", "label": "Redis Cache", "icon": "bi-database"},
+                    {"id": "redis-monitoring-section", "label": "Redis Metrics", "icon": "bi-activity"},
+                    {"id": "conversation-cache-section", "label": "Conversation Cache", "icon": "bi-chat-square-text"},
+                ],
+            },
+            {
+                "id": "cosmos",
+                "label": "Cosmos",
+                "icon": "bi-diagram-3",
+                "sections": [
+                    {"id": "document-access-index-section", "label": "DAI Metrics", "icon": "bi-diagram-3"},
+                    {"id": "cosmos-maintenance-section", "label": "Cosmos Maintenance", "icon": "bi-tools"},
+                    {"id": "cosmos-throughput-section", "label": "Cosmos DB Throughput", "icon": "bi-speedometer2"},
+                    {"id": "cosmos-throughput-metrics-table-section", "label": "Cosmos Metrics", "icon": "bi-table"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "operations",
+        "label": "Operations",
+        "icon": "bi-activity",
+        "tabs": [
+            {
+                "id": "control-center-config",
+                "label": "Control Center",
+                "icon": "bi-speedometer2",
+                "sections": [
+                    {"id": "control-center-auto-refresh-section", "label": "Automatic Data Refresh", "icon": "bi-calendar-check"},
+                    {"id": "control-center-overview-section", "label": "Control Center Access", "icon": "bi-gear-wide-connected"},
+                ],
+            },
+            {
+                "id": "logging",
+                "label": "Logging & Health",
+                "icon": "bi-journal-text",
+                "sections": [
+                    {"id": "application-insights-section", "label": "Application Insights", "icon": "bi-graph-up"},
+                    {"id": "debug-logging-section", "label": "Debug Logging", "icon": "bi-bug"},
+                    {"id": "file-processing-logs-section", "label": "File Process Logging", "icon": "bi-file-earmark-text"},
+                    {"id": "health-check-section", "label": "Health Check", "icon": "bi-heart-pulse"},
+                    {"id": "swagger-section", "label": "API Documentation", "icon": "bi-file-earmark-code"},
+                ],
+            },
+        ],
+    },
+    {
+        "id": "help",
+        "label": "Help",
+        "icon": "bi-life-preserver",
+        "tabs": [
+            {
+                # Where an admin looks first when a user needs help, ahead of
+                # raising it with the project.
+                "id": "support-menu",
+                "label": "Support Menu",
+                "icon": "bi-life-preserver",
+                "sections": [
+                    {"id": "support-menu-section", "label": "Support", "icon": "bi-life-preserver"},
+                ],
+            },
+            {
+                "id": "send-feedback",
+                "label": "Send Feedback",
+                "icon": "bi-envelope-paper",
+                "sections": [
+                    {"id": "send-feedback-overview-card", "label": "Overview", "icon": "bi-info-circle"},
+                    {"id": "send-feedback-bug-card", "label": "Report a Bug", "icon": "bi-bug"},
+                    {"id": "send-feedback-feature-card", "label": "Request a Feature", "icon": "bi-lightbulb"},
+                ],
+            },
+            {
+                "id": "latest-features",
+                "label": "Latest Features",
+                "icon": "bi-lightning-charge",
+                "sections": [],
+                # Rendered specially: it can be hidden per user, carries a New
+                # badge and a hide/unhide menu, and its sections are generated
+                # from the release catalogue rather than declared here.
+                "render": "latest_features",
+            },
+        ],
+    },
+]
+
+
+def iter_tabs():
+    """Yield (group, tab) pairs in navigation order."""
+    for group in ADMIN_NAV:
+        for tab in group["tabs"]:
+            yield group, tab
+
+
+def get_tab_ids():
+    """Return every tab id in navigation order."""
+    return [tab["id"] for _, tab in iter_tabs()]
+
+
+def get_group_for_tab(tab_id):
+    """Return the group owning a tab, or None when the tab is unknown."""
+    for group, tab in iter_tabs():
+        if tab["id"] == tab_id:
+            return group
+    return None
+
+
+def get_landing_tab_id():
+    """Return the tab an admin lands on when no tab is requested.
+
+    This is the first tab of the first group rather than a fixed id, so the
+    landing pane follows the navigation map as cards are regrouped. Latest
+    Features is pinned last precisely so it can never win this.
+    """
+    for _, tab in iter_tabs():
+        return tab["id"]
+    return None
+
+
+def get_section_ids():
+    """Return every section target declared across the navigation."""
+    return [
+        section["id"]
+        for _, tab in iter_tabs()
+        for section in tab["sections"]
+    ]
\ No newline at end of file
diff --git a/application/single_app/app.py b/application/single_app/app.py
index fb6eade46..d8f837e33 100644
--- a/application/single_app/app.py
+++ b/application/single_app/app.py
@@ -31,6 +31,7 @@
 from functions_content import *
 from functions_documents import *
 from functions_latest_features_nav import should_hide_latest_features_nav
+from admin_settings_nav import ADMIN_NAV, get_landing_tab_id
 from functions_search import *
 from functions_settings import *
 from functions_mcp_server_config import is_mcp_ui_enabled
@@ -598,6 +599,8 @@ def inject_settings():
         app_settings=public_settings,
         user_settings=user_settings,
         custom_pages_nav=custom_pages_nav,
+        admin_nav=ADMIN_NAV,
+        admin_landing_tab=get_landing_tab_id(),
         latest_features_current_version=VERSION,
         latest_features_nav_hidden=latest_features_nav_hidden,
         latest_features_nav_hidden_by_development=IS_DEVELOPMENT,
diff --git a/application/single_app/config.py b/application/single_app/config.py
index 7dab85ab9..0c548824e 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -96,7 +96,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.260.011"
+VERSION = "0.260.018"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax')
diff --git a/application/single_app/static/js/admin/admin_access_roles_roster.js b/application/single_app/static/js/admin/admin_access_roles_roster.js
new file mode 100644
index 000000000..3b7993b16
--- /dev/null
+++ b/application/single_app/static/js/admin/admin_access_roles_roster.js
@@ -0,0 +1,148 @@
+// admin_access_roles_roster.js
+//
+// Access & Roles shows every "require an Entra app role" switch in one place.
+//
+// The switches themselves stay on the tabs that own them, because that is where
+// they make sense in context. Duplicating the real inputs here would submit
+// each setting twice, so this builds a roster of mirrors instead: each row
+// carries no name attribute and simply drives the canonical input.
+//
+// The roster is built from the page rather than from a hand-written list, so a
+// new role requirement anywhere in Admin Settings appears here on its own and
+// this list cannot fall out of step with reality.
+//
+// Roster links carry data-admin-link, which admin_card_links.js already handles
+// through a delegated listener, so no wiring is needed here.
+
+const ROLE_INPUT_SELECTOR = 'input[type="checkbox"][name^="require_member_of_"]';
+const LIST_ID = 'app-role-requirements-list';
+const EMPTY_ID = 'app-role-requirements-empty';
+const ROSTER_CARD_ID = 'app-role-requirements-section';
+
+/**
+ * Read the visible label for a control, falling back to its field name.
+ * @param {HTMLInputElement} input Canonical role checkbox.
+ * @returns {string} Human readable label.
+ */
+function labelFor(input) {
+    const explicit = input.id ? document.querySelector(`label[for="${input.id}"]`) : null;
+    if (explicit && explicit.textContent.trim()) {
+        return explicit.textContent.trim();
+    }
+
+    const wrapping = input.closest('label');
+    if (wrapping && wrapping.textContent.trim()) {
+        return wrapping.textContent.trim();
+    }
+
+    return input.name;
+}
+
+/**
+ * Find the card a control belongs to, so the roster can link back to it.
+ * @param {HTMLInputElement} input Canonical role checkbox.
+ * @returns {HTMLElement|null} The owning card, when it has an id.
+ */
+function owningCard(input) {
+    let card = input.closest('.card[id]');
+    while (card && card.id === ROSTER_CARD_ID) {
+        card = card.parentElement ? card.parentElement.closest('.card[id]') : null;
+    }
+    return card;
+}
+
+/**
+ * Read the heading of a card, used as the "where does this live" hint.
+ * @param {HTMLElement} card Owning card.
+ * @returns {string} Card title, or an empty string when it has none.
+ */
+function cardTitle(card) {
+    const heading = card ? card.querySelector('h5, h4, h6, .card-title') : null;
+    return heading ? heading.textContent.trim() : '';
+}
+
+/**
+ * Build one roster row: a mirror switch, its label, and a link to the setting.
+ * @param {HTMLInputElement} input Canonical role checkbox.
+ * @returns {HTMLElement} The row element.
+ */
+function buildRow(input) {
+    const row = document.createElement('div');
+    row.className = 'd-flex flex-wrap align-items-center gap-2';
+    row.setAttribute('data-role-requirement-row', input.name);
+
+    const wrapper = document.createElement('div');
+    wrapper.className = 'form-check form-switch mb-0 flex-grow-1';
+
+    // No name attribute: only the canonical input is submitted with the form.
+    const mirror = document.createElement('input');
+    mirror.type = 'checkbox';
+    mirror.className = 'form-check-input';
+    mirror.id = `${input.name}-roster-mirror`;
+    mirror.checked = input.checked;
+    mirror.disabled = input.disabled;
+    mirror.setAttribute('data-role-mirror-for', input.id || input.name);
+    mirror.setAttribute('data-ignore-settings-change', 'true');
+
+    const label = document.createElement('label');
+    label.className = 'form-check-label ms-2';
+    label.setAttribute('for', mirror.id);
+    label.textContent = labelFor(input);
+
+    wrapper.append(mirror, label);
+    row.appendChild(wrapper);
+
+    const card = owningCard(input);
+    if (card) {
+        const title = cardTitle(card);
+        const link = document.createElement('a');
+        link.href = `#${card.id}`;
+        link.className = 'small text-nowrap';
+        link.setAttribute('data-admin-link', card.id);
+        link.textContent = title ? `In ${title}` : 'Go to setting';
+        row.appendChild(link);
+    }
+
+    // Two-way: the mirror drives the real input, and the real input keeps the
+    // mirror honest when it is changed on its own tab.
+    mirror.addEventListener('change', () => {
+        if (input.checked === mirror.checked) {
+            return;
+        }
+        input.checked = mirror.checked;
+        input.dispatchEvent(new Event('change', { bubbles: true }));
+    });
+
+    input.addEventListener('change', () => {
+        mirror.checked = input.checked;
+        mirror.disabled = input.disabled;
+    });
+
+    return row;
+}
+
+/**
+ * Populate the Access & Roles roster from the role switches on the page.
+ */
+export function initAdminAccessRolesRoster() {
+    const list = document.getElementById(LIST_ID);
+    if (!list) {
+        return;
+    }
+
+    const empty = document.getElementById(EMPTY_ID);
+    const inputs = Array.from(document.querySelectorAll(ROLE_INPUT_SELECTOR))
+        .filter(input => !list.contains(input));
+
+    list.replaceChildren();
+    inputs
+        .map(input => ({ input, label: labelFor(input) }))
+        .sort((a, b) => a.label.localeCompare(b.label))
+        .forEach(({ input }) => list.appendChild(buildRow(input)));
+
+    if (empty) {
+        empty.classList.toggle('d-none', inputs.length > 0);
+    }
+}
+
+document.addEventListener('DOMContentLoaded', initAdminAccessRolesRoster);
diff --git a/application/single_app/static/js/admin/admin_card_links.js b/application/single_app/static/js/admin/admin_card_links.js
new file mode 100644
index 000000000..9da7cf139
--- /dev/null
+++ b/application/single_app/static/js/admin/admin_card_links.js
@@ -0,0 +1,103 @@
+// admin_card_links.js
+// Resolves links that point at an Admin Settings card rather than at a tab.
+//
+// Cross-tab links used to name a tab button directly, for example
+// switchTab(event, 'workspaces-tab'). That couples the link to a tab id, so a
+// tab rename or an information-architecture change silently breaks the link:
+// the button no longer exists, no pane is activated, and the URL hash is left
+// pointing at nothing.
+//
+// A link declares the card it wants instead:
+//
+//     <a href="#redis-cache-section" data-admin-link="redis-cache-section">
+//
+// The owning tab is resolved from the DOM at click time, so card ids are the
+// only contract. Cards can move between tabs, and tabs can be renamed or
+// regrouped, without touching a single link.
+
+const HIGHLIGHT_CLASS = 'admin-card-link-target';
+const HIGHLIGHT_MS = 1600;
+
+/**
+ * Find the tab pane that contains a card.
+ * @param {string} cardId Element id of the target card.
+ * @returns {{card: HTMLElement, paneId: string|null}|null}
+ */
+export function resolveAdminCard(cardId) {
+    const card = document.getElementById(cardId);
+    if (!card) {
+        return null;
+    }
+
+    const pane = card.closest('.tab-pane');
+    return { card, paneId: pane ? pane.id : null };
+}
+
+/**
+ * Activate the tab owning a card, scroll to it, and highlight it briefly.
+ * @param {string} cardId Element id of the target card.
+ * @returns {boolean} Whether the card was found.
+ */
+export function openAdminCard(cardId) {
+    const resolved = resolveAdminCard(cardId);
+    if (!resolved) {
+        console.warn(`openAdminCard: no card with id "${cardId}"`);
+        return false;
+    }
+
+    const { card, paneId } = resolved;
+
+    if (paneId && typeof window.showAdminTab === 'function') {
+        window.showAdminTab(paneId);
+        syncSidebarActiveState(paneId);
+    }
+
+    // Let the pane become visible before measuring scroll position.
+    window.setTimeout(() => {
+        card.scrollIntoView({ behavior: 'smooth', block: 'start' });
+        card.classList.add(HIGHLIGHT_CLASS);
+        window.setTimeout(() => card.classList.remove(HIGHLIGHT_CLASS), HIGHLIGHT_MS);
+    }, 120);
+
+    return true;
+}
+
+/**
+ * Mirror the activated tab in the sidebar, when the sidebar layout is in use.
+ * @param {string} paneId Tab pane id that was activated.
+ */
+function syncSidebarActiveState(paneId) {
+    const navLink = document.querySelector(`.admin-nav-tab[data-tab="${paneId}"]`);
+    if (!navLink) {
+        return;
+    }
+
+    document.querySelectorAll('.admin-nav-tab, .admin-nav-section').forEach((link) => {
+        link.classList.remove('active');
+    });
+    navLink.classList.add('active');
+}
+
+/**
+ * Delegate clicks so links added after load keep working.
+ */
+export function initAdminCardLinks() {
+    document.addEventListener('click', (event) => {
+        const link = event.target.closest('[data-admin-link]');
+        if (!link) {
+            return;
+        }
+
+        const cardId = link.getAttribute('data-admin-link');
+        if (!cardId) {
+            return;
+        }
+
+        event.preventDefault();
+        openAdminCard(cardId);
+    });
+}
+
+window.openAdminCard = openAdminCard;
+
+document.addEventListener('DOMContentLoaded', initAdminCardLinks);
diff --git a/application/single_app/static/js/admin/admin_data_management.js b/application/single_app/static/js/admin/admin_data_management.js
index 481b2069f..e8c2761a9 100644
--- a/application/single_app/static/js/admin/admin_data_management.js
+++ b/application/single_app/static/js/admin/admin_data_management.js
@@ -388,7 +388,8 @@ function bindEvents() {
         pendingDataManagementBackupDelete = null;
     });
     elements.dataManagementConfirmBackupDeleteBtn?.addEventListener("click", deleteDataManagementBackup);
-    elements.dataManagementKeyVaultLink?.addEventListener("click", openKeyVaultSettings);
+    // The Key Vault link carries data-admin-link, so admin_card_links.js
+    // resolves the owning tab from the DOM and scrolls to the card.
     elements.dataManagementCosmosEditorOpenDangerBtn?.addEventListener("click", showCosmosEditorDangerModal);
     elements.datamanagementcosmoseditordangeraccept?.addEventListener("change", updateCosmosEditorDangerAcceptState);
     elements.dataManagementCosmosEditorAcceptDangerBtn?.addEventListener("click", acceptCosmosEditorDanger);
@@ -909,20 +910,6 @@ function setKeyStorageAlert(variant, iconClass, title, message, linkText) {
     setText(elements.dataManagementKeyVaultLink, linkText);
 }
 
-function openKeyVaultSettings(event) {
-    event?.preventDefault();
-    const securityTabButton = document.getElementById("security-tab");
-    if (securityTabButton && window.bootstrap?.Tab) {
-        window.bootstrap.Tab.getOrCreateInstance(securityTabButton).show();
-    } else if (securityTabButton) {
-        securityTabButton.click();
-    }
-    window.location.hash = "security";
-    window.setTimeout(() => {
-        document.getElementById("keyvault-section")?.scrollIntoView({ block: "start", behavior: "smooth" });
-    }, 100);
-}
-
 function collectSettings() {
     const backupStorageAuthenticationType = getValue(elements.datamanagementstorageauth) || backupStorageAuthManagedIdentity;
     return {
diff --git a/application/single_app/static/js/admin/admin_settings.js b/application/single_app/static/js/admin/admin_settings.js
index 26726f5f3..722a3d49f 100644
--- a/application/single_app/static/js/admin/admin_settings.js
+++ b/application/single_app/static/js/admin/admin_settings.js
@@ -1508,7 +1508,12 @@ function validateCosmosThroughputSettings(options = {}) {
 
     setCosmosThroughputValidationMessage(errors);
     if (options.report && invalidFields.length > 0) {
-        document.getElementById('scale-tab')?.click();
+        // Navigate to wherever the invalid field actually lives rather than to
+        // a named tab, so this keeps working when settings are regrouped.
+        const owningCard = invalidFields[0].closest('.card[id]');
+        if (owningCard && typeof window.openAdminCard === 'function') {
+            window.openAdminCard(owningCard.id);
+        }
         invalidFields[0].focus({ preventScroll: false });
         invalidFields[0].reportValidity();
     }
@@ -9227,31 +9232,6 @@ function clearStatusAlert(statusAlert) {
 }
 
 
-function switchTab(event, tabButtonId) {
-    event.preventDefault();
-    const triggerEl = document.getElementById(tabButtonId);
-    if (triggerEl) {
-        const tabObj = new bootstrap.Tab(triggerEl);
-        tabObj.show();
-        return;
-    }
-
-    const inferredTabId = tabButtonId.replace(/-tab$/, '');
-    if (typeof window.showAdminTab === 'function') {
-        window.showAdminTab(inferredTabId);
-
-        const navLink = document.querySelector(`.admin-nav-tab[data-tab="${inferredTabId}"]`);
-        if (navLink) {
-            document.querySelectorAll('.admin-nav-tab, .admin-nav-section').forEach(link => {
-                link.classList.remove('active');
-            });
-            navLink.classList.add('active');
-        }
-    }
-}
-
-window.switchTab = switchTab;
-
 function togglePassword(btnId, inputId) {
     const btn = document.getElementById(btnId);
     const inp = document.getElementById(inputId);
@@ -10073,111 +10053,55 @@ function findPreviousApplicableStep(currentStep) {
 }
 
 /**
- * Navigate to the appropriate tab based on the walkthrough step
+ * Navigate to the setting a walkthrough step is about.
+ *
+ * Steps used to name a tab id directly, which meant the same knowledge was
+ * recorded twice and went stale the moment a setting moved to another tab.
+ * Steps now name the card they are about, and openAdminCard finds the owning
+ * tab from the page itself, so this cannot drift again.
+ *
  * @param {number} stepNumber - The current step number
  */
 function handleTabNavigation(stepNumber) {
-    // Map steps to tabs that need to be activated
-    const stepToTab = {
-        1: 'general-tab',     // App title and logo (General tab)
-        2: 'ai-models-tab',   // GPT settings (now in AI Models tab)
-        3: 'ai-models-tab',   // GPT model selection (now in AI Models tab)
-        4: 'workspaces-tab',  // Workspace and groups settings
-        5: 'ai-models-tab',   // Embedding settings (now in AI Models tab)
-        6: 'search-extract-tab', // AI Search settings
-        7: 'search-extract-tab', // Document Intelligence settings
-        8: 'search-extract-tab',  // Video support
-        9: 'search-extract-tab',  // Audio support
-        10: 'safety-tab',     // Content safety
-        11: 'safety-tab',     // User feedback and archiving (changed from system-tab)
-        12: 'citation-tab'    // Enhanced Citations and Image Generation
+    // card: the setting this step is about.
+    // focus: an optional finer scroll target inside that card.
+    const stepToCard = {
+        1:  { card: 'branding-section' },
+        2:  { card: 'multi-endpoint-configuration' },
+        3:  { card: 'multi-endpoint-configuration' },
+        4:  { card: 'personal-workspaces-section' },
+        5:  { card: 'embeddings-configuration' },
+        6:  { card: 'azure-ai-search-section' },
+        7:  { card: 'document-intelligence-section' },
+        8:  { card: 'video-intelligence-section', focus: 'enable_video_file_support' },
+        9:  { card: 'ai-voice-chat-section', focus: 'enable_audio_file_support' },
+        10: { card: 'content-safety-section' },
+        11: { card: 'user-feedback-section' },
+        12: { card: 'enhanced-citations-section' },
     };
-    
-    // Activate the appropriate tab
-    const tabId = stepToTab[stepNumber];
-    if (tabId) {
-        // Check if we're using sidebar navigation or tab navigation
-        const sidebarToggle = document.getElementById('admin-settings-toggle');
-        
-        if (sidebarToggle) {
-            // Using sidebar navigation - call showAdminTab function
-            const tabName = tabId.replace('-tab', ''); // Remove '-tab' suffix
-            if (typeof showAdminTab === 'function') {
-                showAdminTab(tabName);
-            } else if (typeof window.showAdminTab === 'function') {
-                window.showAdminTab(tabName);
-            }
-        } else {
-            // Using Bootstrap tabs
-            const tab = document.getElementById(tabId);
-            if (tab) {
-                // Use bootstrap Tab to show the tab
-                const bootstrapTab = new bootstrap.Tab(tab);
-                bootstrapTab.show();
-            }
-        }
-        
-        // Scroll to the relevant section after a small delay to allow tab to switch
-        setTimeout(() => {
-            scrollToRelevantSection(stepNumber, tabId);
-        }, 300);
+
+    const target = stepToCard[stepNumber];
+    if (!target) {
+        return;
     }
-}
 
-/**
- * Scroll to relevant section within a tab based on the step
- * @param {number} stepNumber - The current step number
- * @param {string} tabId - The ID of the tab that was activated
- */
-function scrollToRelevantSection(stepNumber, tabId) {
-    // Define which sections to scroll to for each step
-    let targetElement = null;
-    
-    switch (stepNumber) {
-        case 1: // App title and logo
-            targetElement = document.getElementById('branding-section');
-            break;
-        case 2: // GPT settings
-            targetElement = document.getElementById('gpt-configuration');
-            break;
-        case 3: // GPT model selection
-            targetElement = document.getElementById('gpt_models_list')?.closest('.mb-3');
-            break;
-        case 4: // Workspaces toggle section
-            targetElement = document.getElementById('personal-workspaces-section');
-            break;
-        case 5: // Embedding settings
-            targetElement = document.getElementById('embeddings-configuration');
-            break;
-        case 6: // AI Search settings
-            targetElement = document.getElementById('azure-ai-search-section');
-            break;
-        case 7: // Document Intelligence settings
-            targetElement = document.getElementById('document-intelligence-section');
-            break;
-        case 8: // Video file support
-            targetElement = document.getElementById('enable_video_file_support')?.closest('.form-group');
-            break;
-        case 9: // Audio file support
-            targetElement = document.getElementById('enable_audio_file_support')?.closest('.form-group');
-            break;
-        case 10: // Content safety
-            targetElement = document.getElementById('content-safety-section');
-            break;
-        case 11: // User feedback and archiving
-            targetElement = document.getElementById('user-feedback-section');
-            break;
-        case 12: // Enhanced citations and image generation
-            targetElement = document.getElementById('enhanced-citations-section');
-            break;
-        default:
-            // For other steps, no specific scrolling
-            break;
+    const opened = typeof window.openAdminCard === 'function'
+        ? window.openAdminCard(target.card)
+        : false;
+
+    if (!opened) {
+        console.warn(`handleTabNavigation: could not open card "${target.card}" for step ${stepNumber}`);
+        return;
     }
-    
-    // If we found a target element, scroll to it
-    if (targetElement) {
-        targetElement.scrollIntoView({ behavior: 'smooth', block: 'start' });
+
+    if (target.focus) {
+        // openAdminCard scrolls to the card first, so refine afterwards.
+        window.setTimeout(() => {
+            const element = document.getElementById(target.focus);
+            if (element) {
+                element.scrollIntoView({ behavior: 'smooth', block: 'center' });
+            }
+        }, 400);
     }
 }
 
diff --git a/application/single_app/static/js/admin/admin_settings_dependencies.js b/application/single_app/static/js/admin/admin_settings_dependencies.js
new file mode 100644
index 000000000..266490a18
--- /dev/null
+++ b/application/single_app/static/js/admin/admin_settings_dependencies.js
@@ -0,0 +1,220 @@
+// admin_settings_dependencies.js
+// Announces and enforces Admin Settings options that require another option.
+//
+// Some settings only work when a different setting is enabled, and those two
+// settings often live in different tabs. Previously that was communicated in
+// prose, or in a tooltip, or only by a flash message after saving, so an admin
+// could turn something on and have nothing happen with no visible reason.
+//
+// A dependent card declares what it needs:
+//
+//     <div class="card" id="file-sync-section"
+//          data-requires="enable_redis_cache"
+//          data-requires-label="Redis Cache"
+//          data-requires-target="redis-cache-section"
+//          data-requires-mode="warn">
+//
+// When the prerequisite is off, a notice is inserted at the top of the card
+// containing a mirror of the prerequisite control and a link to its card, so
+// the admin can satisfy it inline or jump to the full configuration.
+//
+// Modes:
+//   block (default) disables the dependent inputs until the prerequisite is on
+//   warn            leaves inputs usable, for prerequisites the backend already
+//                   accepts as intent and reconciles later
+//
+// This is a usability layer only. The backend remains authoritative and still
+// refuses or flashes on unmet prerequisites.
+
+const NOTICE_CLASS = 'admin-dependency-notice';
+const DISABLED_FLAG = 'data-dependency-disabled';
+
+/**
+ * Read every dependency declared in the document.
+ * @returns {Array<object>} Parsed dependency descriptors.
+ */
+function collectDependencies() {
+    return Array.from(document.querySelectorAll('[data-requires]')).map((card) => ({
+        card,
+        prerequisiteId: card.getAttribute('data-requires'),
+        label: card.getAttribute('data-requires-label') || 'another setting',
+        targetCardId: card.getAttribute('data-requires-target') || '',
+        mode: card.getAttribute('data-requires-mode') === 'warn' ? 'warn' : 'block',
+        description: card.getAttribute('data-requires-description') || '',
+        // Optional selector limiting which controls the dependency guards, for
+        // cards that hold a mix of dependent and independent settings.
+        scope: card.getAttribute('data-requires-scope') || '',
+    }));
+}
+
+/**
+ * Whether a prerequisite control is currently satisfied.
+ * @param {HTMLElement|null} control Prerequisite input.
+ * @returns {boolean}
+ */
+function isSatisfied(control) {
+    if (!control) {
+        return true;
+    }
+    if (control.type === 'checkbox' || control.type === 'radio') {
+        return control.checked;
+    }
+    return Boolean(control.value);
+}
+
+/**
+ * Build the notice shown when a prerequisite is unmet.
+ * @param {object} dependency Dependency descriptor.
+ * @param {HTMLElement} prerequisite Prerequisite control.
+ * @returns {HTMLElement}
+ */
+function buildNotice(dependency, prerequisite) {
+    const notice = document.createElement('div');
+    notice.className = `alert ${dependency.mode === 'warn' ? 'alert-warning' : 'alert-info'} ${NOTICE_CLASS}`;
+    notice.setAttribute('role', 'note');
+
+    const heading = document.createElement('div');
+    heading.className = 'fw-semibold mb-1';
+    const icon = document.createElement('i');
+    icon.className = 'bi bi-info-circle me-2';
+    icon.setAttribute('aria-hidden', 'true');
+    heading.append(icon, document.createTextNode(`This needs ${dependency.label}`));
+    notice.appendChild(heading);
+
+    const body = document.createElement('p');
+    body.className = 'mb-2';
+    body.textContent = dependency.description
+        || (dependency.mode === 'warn'
+            ? `These settings are saved, but stay inactive until ${dependency.label} is enabled and configured.`
+            : `These settings are unavailable until ${dependency.label} is enabled.`);
+    notice.appendChild(body);
+
+    const actions = document.createElement('div');
+    actions.className = 'd-flex flex-wrap align-items-center gap-3';
+
+    // Inline mirror: satisfy the prerequisite without leaving this tab. It
+    // carries no name attribute, so only the canonical input is submitted.
+    if (prerequisite && prerequisite.type === 'checkbox') {
+        const wrapper = document.createElement('div');
+        wrapper.className = 'form-check form-switch mb-0';
+
+        const proxy = document.createElement('input');
+        proxy.type = 'checkbox';
+        proxy.className = 'form-check-input';
+        proxy.id = `${dependency.card.id}-requires-proxy`;
+        proxy.checked = prerequisite.checked;
+        proxy.setAttribute('data-dependency-proxy-for', prerequisite.id);
+        proxy.setAttribute('data-ignore-settings-change', 'true');
+
+        proxy.addEventListener('change', () => {
+            prerequisite.checked = proxy.checked;
+            prerequisite.dispatchEvent(new Event('change', { bubbles: true }));
+        });
+
+        const proxyLabel = document.createElement('label');
+        proxyLabel.className = 'form-check-label ms-2';
+        proxyLabel.setAttribute('for', proxy.id);
+        proxyLabel.textContent = `Enable ${dependency.label}`;
+
+        wrapper.append(proxy, proxyLabel);
+        actions.appendChild(wrapper);
+    }
+
+    if (dependency.targetCardId) {
+        const link = document.createElement('a');
+        link.href = `#${dependency.targetCardId}`;
+        link.setAttribute('data-admin-link', dependency.targetCardId);
+        link.className = 'small';
+        link.textContent = `Go to ${dependency.label}`;
+        actions.appendChild(link);
+    }
+
+    notice.appendChild(actions);
+    return notice;
+}
+
+/**
+ * Enable or disable the controls a dependency guards.
+ * @param {object} dependency Dependency descriptor.
+ * @param {boolean} satisfied Whether the prerequisite is met.
+ */
+function setControlsDisabled(dependency, satisfied) {
+    if (dependency.mode === 'warn') {
+        return;
+    }
+
+    const selector = dependency.scope || 'input, select, textarea, button';
+    dependency.card.querySelectorAll(selector).forEach((control) => {
+        if (control.closest(`.${NOTICE_CLASS}`)) {
+            return;
+        }
+
+        if (!satisfied) {
+            // Remember controls that were already disabled for other
+            // reasons so re-enabling does not override them.
+            if (!control.disabled) {
+                control.setAttribute(DISABLED_FLAG, 'true');
+                control.disabled = true;
+            }
+        } else if (control.getAttribute(DISABLED_FLAG) === 'true') {
+            control.removeAttribute(DISABLED_FLAG);
+            control.disabled = false;
+        }
+    });
+}
+
+/**
+ * Apply the current state of one dependency.
+ * @param {object} dependency Dependency descriptor.
+ */
+function applyDependency(dependency) {
+    const prerequisite = document.getElementById(dependency.prerequisiteId);
+    const satisfied = isSatisfied(prerequisite);
+
+    const existing = dependency.card.querySelector(`:scope > .${NOTICE_CLASS}`);
+    if (existing) {
+        existing.remove();
+    }
+
+    setControlsDisabled(dependency, satisfied);
+
+    if (satisfied) {
+        return;
+    }
+
+    const notice = buildNotice(dependency, prerequisite);
+    const heading = dependency.card.querySelector('h4, h5, h6');
+    if (heading && heading.parentElement === dependency.card) {
+        heading.insertAdjacentElement('afterend', notice);
+    } else {
+        dependency.card.prepend(notice);
+    }
+}
+
+/**
+ * Wire up every declared dependency and keep it live.
+ */
+export function initAdminSettingsDependencies() {
+    const dependencies = collectDependencies();
+    if (!dependencies.length) {
+        return;
+    }
+
+    dependencies.forEach((dependency) => {
+        applyDependency(dependency);
+
+        const prerequisite = document.getElementById(dependency.prerequisiteId);
+        if (!prerequisite) {
+            console.warn(
+                `admin dependencies: "${dependency.card.id}" requires missing control `
+                + `"${dependency.prerequisiteId}"`,
+            );
+            return;
+        }
+
+        prerequisite.addEventListener('change', () => applyDependency(dependency));
+        prerequisite.addEventListener('input', () => applyDependency(dependency));
+    });
+}
+
+document.addEventListener('DOMContentLoaded', initAdminSettingsDependencies);
diff --git a/application/single_app/static/js/admin/admin_sidebar_nav.js b/application/single_app/static/js/admin/admin_sidebar_nav.js
index ff628ec79..b452447c9 100644
--- a/application/single_app/static/js/admin/admin_sidebar_nav.js
+++ b/application/single_app/static/js/admin/admin_sidebar_nav.js
@@ -1,6 +1,10 @@
 // admin_sidebar_nav.js
 // Admin Sidebar Navigation
 document.addEventListener('DOMContentLoaded', function() {
+    // The top-nav group pills exist only in the tab layout, so they are wired
+    // independently of the sidebar.
+    setupAdminGroupPills();
+
     // Only initialize if we're on admin settings page with sidebar nav
     if (!document.getElementById('admin-settings-toggle')) return;
     
@@ -77,6 +81,10 @@ function initAdminSidebarNav() {
         });
     }
     
+    // Set up group expand/collapse. Groups are the level above tabs, so a
+    // collapsed group hides its tabs without affecting which tab is active.
+    setupAdminGroupToggles();
+
     // Set up tab navigation
     document.querySelectorAll('.admin-nav-tab').forEach(tabLink => {
         tabLink.addEventListener('click', function(e) {
@@ -135,20 +143,218 @@ function initAdminSidebarNav() {
         });
     });
     
-    // Set the initial active tab (General) - but only if no tab is already active
+    // Set the initial active tab - but only if no tab is already active.
+    // Latest Features is deliberately excluded so it never opens by default.
+    // The landing tab is whichever tab the nav map renders first rather than a
+    // hardcoded id, so it stays correct as the information architecture moves.
     const activeTab = document.querySelector('.admin-nav-tab.active, .admin-nav-section.active');
     if (!activeTab) {
-        const firstTab = document.querySelector('.admin-nav-tab[data-tab="latest-features"]');
-        if (firstTab) {
+        const firstTab = document.querySelector('.admin-nav-tab[data-tab]');
+        const firstTabId = firstTab ? firstTab.getAttribute('data-tab') : null;
+        if (firstTabId) {
             firstTab.classList.add('active');
-            showAdminTab('latest-features');
+            showAdminTab(firstTabId);
         }
     } else {
         console.log('initAdminSidebarNav - Found existing active tab, preserving current state:', activeTab.getAttribute('data-tab'));
+        syncAdminGroupSharedRegions(activeTab.getAttribute('data-tab'));
+    }
+
+    // Clicking a tab button directly does not go through showAdminTab, so the
+    // shared regions are synced from Bootstrap's own event as well.
+    document.querySelectorAll('button.nav-link[data-bs-target^="#"]').forEach(button => {
+        button.addEventListener('shown.bs.tab', event => {
+            const target = event.target.getAttribute('data-bs-target');
+            if (target) {
+                syncAdminGroupSharedRegions(target.slice(1));
+            }
+        });
+    });
+}
+
+function setupAdminGroupToggles() {
+    document.querySelectorAll('[data-admin-group-toggle]').forEach(toggle => {
+        toggle.addEventListener('click', function (e) {
+            e.preventDefault();
+            const groupId = this.getAttribute('data-admin-group-toggle');
+            setAdminGroupExpanded(groupId, !isAdminGroupExpanded(groupId), true);
+        });
+    });
+}
+
+/**
+ * Wire the top-nav group pills, which filter the tab strip to one group.
+ * Only relevant in the tab layout; the sidebar layout uses group headers.
+ */
+function setupAdminGroupPills() {
+    const pills = document.querySelectorAll('[data-admin-group-pill]');
+    if (!pills.length) {
+        return;
+    }
+
+    pills.forEach(pill => {
+        pill.addEventListener('click', function () {
+            showAdminGroupTabs(this.getAttribute('data-admin-group-pill'), true);
+        });
+    });
+}
+
+/**
+ * Show one group's tabs in the top strip.
+ * @param {string} groupId Group to reveal.
+ * @param {boolean} activateFirstTab Whether to open that group's first tab.
+ */
+function showAdminGroupTabs(groupId, activateFirstTab) {
+    document.querySelectorAll('[data-admin-group-pill]').forEach(pill => {
+        const selected = pill.getAttribute('data-admin-group-pill') === groupId;
+        pill.classList.toggle('active', selected);
+        pill.setAttribute('aria-selected', selected ? 'true' : 'false');
+    });
+
+    let firstTabButton = null;
+    document.querySelectorAll('.admin-tab-item').forEach(item => {
+        const inGroup = item.getAttribute('data-admin-group') === groupId;
+        item.hidden = !inGroup;
+        if (inGroup && !firstTabButton) {
+            firstTabButton = item.querySelector('button[data-bs-target]');
+        }
+    });
+
+    if (activateFirstTab && firstTabButton) {
+        const target = firstTabButton.getAttribute('data-bs-target') || '';
+        showAdminTab(target.replace('#', ''));
+    }
+}
+
+/**
+ * Reveal the group owning a tab in the top strip, so a deep link or a
+ * cross-reference never activates a pane whose tab is filtered out of view.
+ * @param {string} tabId Tab pane id.
+ */
+function revealAdminGroupPillForTab(tabId) {
+    const item = document.querySelector(`.admin-tab-item [data-bs-target="#${tabId}"]`);
+    const groupItem = item && item.closest('.admin-tab-item');
+    if (!groupItem) {
+        return;
+    }
+
+    const groupId = groupItem.getAttribute('data-admin-group');
+    if (groupId && groupItem.hidden) {
+        showAdminGroupTabs(groupId, false);
+    }
+}
+
+function getAdminGroupElements(groupId) {
+    return {
+        toggle: document.querySelector(`[data-admin-group-toggle="${groupId}"]`),
+        list: document.getElementById(`admin-group-${groupId}`),
+    };
+}
+
+function isAdminGroupExpanded(groupId) {
+    const { list } = getAdminGroupElements(groupId);
+    return Boolean(list) && !list.classList.contains('d-none');
+}
+
+/**
+ * Expand or collapse a nav group.
+ * @param {string} groupId Group identifier.
+ * @param {boolean} expanded Desired state.
+ * @param {boolean} persist Whether to remember the state for this user.
+ */
+function setAdminGroupExpanded(groupId, expanded, persist) {
+    const { toggle, list } = getAdminGroupElements(groupId);
+    if (!toggle || !list) {
+        return;
+    }
+
+    list.classList.toggle('d-none', !expanded);
+    toggle.setAttribute('aria-expanded', expanded ? 'true' : 'false');
+
+    const caret = toggle.querySelector('.admin-nav-group-caret');
+    if (caret) {
+        caret.classList.toggle('collapsed', !expanded);
+    }
+
+    if (persist && typeof window.setPersistentSidebarMenuExpanded === 'function') {
+        window.setPersistentSidebarMenuExpanded(`adminGroup:${groupId}`, expanded);
     }
 }
 
-function showAdminTab(tabId) {    
+/**
+ * Open the group that owns a tab, so activating a tab never leaves it hidden.
+ * @param {string} tabId Tab pane id.
+ */
+function revealAdminGroupForTab(tabId) {
+    const tabLink = document.querySelector(`.admin-nav-tab[data-tab="${tabId}"]`);
+    const groupItem = tabLink && tabLink.closest('[data-admin-group]');
+    if (!groupItem) {
+        return;
+    }
+
+    const groupId = groupItem.getAttribute('data-admin-group');
+    if (!isAdminGroupExpanded(groupId)) {
+        setAdminGroupExpanded(groupId, true, true);
+    }
+}
+
+// Tabs that existed before the information architecture rework, mapped to
+// where their content now lives. Old bookmarks and links keep working.
+const LEGACY_TAB_REDIRECTS = {
+    'governance': 'feature-governance',
+    'scale': 'redis-caching',
+    'general': 'branding',
+    'safety': 'access-roles',
+    'security': 'secrets',
+    'workspaces': 'workspace-types',
+    'search-extract': 'web-research',
+    'ai-models': 'model-endpoints',
+    'data-management': 'backup',
+};
+
+function resolveAdminTabId(tabId) {
+    return LEGACY_TAB_REDIRECTS[tabId] || tabId;
+}
+
+/**
+ * Some groups share one set of controls across all of their tabs, such as the
+ * single save button that serves every Backup & Recovery tab. Those controls
+ * cannot be duplicated into each pane without repeating element ids, and they
+ * cannot sit in one pane because the other tabs would lose them, so they live
+ * outside the panes and are revealed only while their group is active.
+ */
+function syncAdminGroupSharedRegions(tabId) {
+    const regions = document.querySelectorAll('[data-admin-group-shared]');
+    if (!regions.length) {
+        return;
+    }
+
+    // Only one of the two navigations is rendered at a time, so resolve the
+    // owning group from whichever is present. Looking only at the top tab strip
+    // would leave the region hidden for good in the sidebar layout.
+    const tabButton = document.querySelector(`.admin-tab-item[data-admin-group] button[data-bs-target="#${tabId}"]`);
+    let owner = tabButton ? tabButton.closest('[data-admin-group]') : null;
+    if (!owner) {
+        const sidebarLink = document.querySelector(`.admin-nav-tab[data-tab="${tabId}"]`);
+        owner = sidebarLink ? sidebarLink.closest('[data-admin-group]') : null;
+    }
+    const activeGroup = owner ? owner.getAttribute('data-admin-group') : null;
+
+    regions.forEach(region => {
+        const ownerGroup = region.getAttribute('data-admin-group-shared');
+        region.hidden = ownerGroup !== activeGroup;
+    });
+}
+
+function showAdminTab(requestedTabId) {
+    const tabId = resolveAdminTabId(requestedTabId);
+
+    // Open the owning group first, in whichever layout is active, so
+    // activating a tab never leaves it hidden behind a collapsed group header
+    // or filtered out of the top strip.
+    revealAdminGroupForTab(tabId);
+    revealAdminGroupPillForTab(tabId);
+
     const bootstrapTabButton = document.querySelector(`button.nav-link[data-bs-target="#${tabId}"]`);
     if (bootstrapTabButton && typeof bootstrap !== 'undefined' && typeof bootstrap.Tab === 'function') {
         const tab = bootstrap.Tab.getOrCreateInstance(bootstrapTabButton);
@@ -170,6 +376,7 @@ function showAdminTab(tabId) {
     
     // Update the hash in URL for deep linking
     window.location.hash = tabId;
+    syncAdminGroupSharedRegions(tabId);
     if (typeof window.updateAdminSettingsSaveButtonState === 'function') {
         window.updateAdminSettingsSaveButtonState();
     }
@@ -179,91 +386,17 @@ function showAdminTab(tabId) {
 window.showAdminTab = showAdminTab;
 
 function scrollToSection(sectionId) {
-    // Map section IDs to actual element IDs/classes in the admin settings
+    // Resolve a sidebar data-section value to the element it should scroll to.
     const sectionMap = {
+        // Only genuine aliases belong here. Any sidebar data-section value
+        // that already matches its element id resolves through the
+        // `sectionMap[sectionId] || sectionId` fallback below.
         'gpt-config': 'gpt-configuration',
-        'embeddings-config': 'embeddings-configuration', 
+        'embeddings-config': 'embeddings-configuration',
         'image-config': 'image-generation-configuration',
-        'multi-endpoint-configuration': 'multi-endpoint-configuration',
-        'document-action-capabilities-card': 'document-action-capabilities-card',
         'agents-config': 'agents-configuration',
-        'agent-template-approvals-section': 'agent-template-approvals-section',
         'actions-config': 'actions-configuration',
-        // Governance tab sections
-        'governance-feature-toggles-section': 'governance-feature-toggles-section',
-        'governance-mcp-destination-section': 'governance-mcp-destination-section',
-        'governance-inbound-mcp-section': 'governance-inbound-mcp-section',
-        'governance-feature-policies-section': 'governance-feature-policies-section',
-        'governance-item-policies-section': 'governance-item-policies-section',
-        // General tab sections
-        'branding-section': 'branding-section',
-        'home-page-text-section': 'home-page-text-section',
-        'appearance-section': 'appearance-section',
-        'classification-banner-section': 'classification-banner-section',
-        'ai-notice-section': 'ai-notice-section',
-        'terms-of-use-section': 'terms-of-use-section',
-        'custom-pages-section': 'custom-pages-section',
-        'external-links-section': 'external-links-section',
-        'health-check-section': 'health-check-section',
-        'system-settings-section': 'system-settings-section',
-        'control-center-admin-section': 'control-center-admin-section',
-        // Control Center tab sections
-        'control-center-auto-refresh-section': 'control-center-auto-refresh-section',
-        'control-center-overview-section': 'control-center-overview-section',
-        // Logging tab sections
-        'application-insights-section': 'application-insights-section',
-        'debug-logging-section': 'debug-logging-section',
-        'file-processing-logs-section': 'file-processing-logs-section',
-        // Scale tab sections
-        'redis-cache-section': 'redis-cache-section',
-        'redis-monitoring-section': 'redis-monitoring-section',
-        'conversation-cache-section': 'conversation-cache-section',
-        'document-access-index-section': 'document-access-index-section',
-        'cosmos-maintenance-section': 'cosmos-maintenance-section',
-        'cosmos-throughput-section': 'cosmos-throughput-section',
-        'cosmos-throughput-metrics-table-section': 'cosmos-throughput-metrics-table-section',
-        'front-door-section': 'front-door-section',
-        // Workspaces tab sections
-        'personal-workspaces-section': 'personal-workspaces-section',
-        'group-workspaces-section': 'group-workspaces-section',
-        'public-workspaces-section': 'public-workspaces-section',
-        'file-sharing-section': 'file-sharing-section',
-        'file-download-settings-section': 'file-download-settings-section',
-        'chat-file-uploads-section': 'chat-file-uploads-section',
-        'metadata-extraction-section': 'metadata-extraction-section',
-        'multimodal-vision-section': 'multimodal-vision-section',
-        'document-classification-section': 'document-classification-section',
-        'workspace-scope-lock-section': 'workspace-scope-lock-section',
-        // Citations tab sections
-        'standard-citations-section': 'standard-citations-section',
-        'enhanced-citations-section': 'enhanced-citations-section',
-        // Safety tab sections
-        'content-safety-section': 'content-safety-section',
-        'user-feedback-section': 'user-feedback-section',
-        'desktop-notifications-section': 'desktop-notifications-section',
-        'permissions-section': 'permissions-section',
-        'conversation-archiving-section': 'conversation-archiving-section',
-        // Security tab sections
-        'keyvault-section': 'keyvault-section',
-        // Data Management tab sections
-        'data-management-readiness-section': 'data-management-readiness-section',
-        'data-management-backup-section': 'data-management-backup-section',
-        'data-management-schedule-section': 'data-management-schedule-section',
-        'data-management-storage-section': 'data-management-storage-section',
-        'data-management-encryption-section': 'data-management-encryption-section',
-        'data-management-migration-section': 'data-management-migration-section',
-        'data-management-target-cosmos-section': 'data-management-target-cosmos-section',
-        'data-management-backup-inventory-section': 'data-management-backup-inventory-section',
-        'data-management-jobs-section': 'data-management-jobs-section',
-        // Search & Extract tab sections
         'web-search-section': 'web-search-foundry-section',
-        'url-access-section': 'url-access-section',
-        'source-review-section': 'source-review-section',
-        'azure-ai-search-section': 'azure-ai-search-section',
-        'document-intelligence-section': 'document-intelligence-section',
-        'chunk-size-section': 'chunk-size-section',
-        'video-intelligence-section': 'video-intelligence-section',
-        'ai-voice-chat-section': 'ai-voice-chat-section'
     };
     
     const targetElementId = sectionMap[sectionId] || sectionId;
@@ -320,112 +453,171 @@ style.textContent = `
     .admin-search-hidden {
         display: none !important;
     }
+    .admin-nav-group {
+        font-weight: 500;
+        letter-spacing: 0.01em;
+    }
+    .admin-nav-group:hover {
+        background-color: rgba(0, 0, 0, 0.05);
+    }
+    .admin-nav-group-caret {
+        font-size: 0.75em;
+        transition: transform 0.2s ease;
+    }
+    .admin-nav-group-caret.collapsed {
+        transform: rotate(-90deg);
+    }
 `;
 document.head.appendChild(style);
 
 // Admin search functionality
 function filterAdminSections(searchTerm) {
     const normalizedSearch = searchTerm.toLowerCase().trim();
-    
+
     if (!normalizedSearch) {
-        // Show all sections if search is empty
         showAllAdminSections();
         return;
     }
-    
+
     let hasVisibleSections = false;
-    
-    // Get all admin nav items
+
+    const groupItems = document.querySelectorAll('.admin-nav-group-item');
     const allTabs = document.querySelectorAll('.admin-nav-tab');
     const allSections = document.querySelectorAll('.admin-nav-section');
-    
-    // Hide all sections and tabs initially
+
+    // Start from everything hidden, then reveal what matches.
+    groupItems.forEach(group => group.classList.add('admin-search-hidden'));
+    document.querySelectorAll('.admin-nav-group').forEach(group => {
+        group.classList.remove('admin-search-highlight');
+    });
+
     allTabs.forEach(tab => {
         tab.closest('li').classList.add('admin-search-hidden');
-        // Hide submenu
+        tab.classList.remove('admin-search-highlight');
         const submenu = document.getElementById(tab.getAttribute('data-tab') + '-submenu');
         if (submenu) {
             submenu.style.display = 'none';
         }
     });
-    
+
     allSections.forEach(section => {
         section.closest('li').classList.add('admin-search-hidden');
         section.classList.remove('admin-search-highlight');
     });
-    
-    // Search through tabs and sections
+
+    /**
+     * Reveal the group containing an element and expand its tab list, so a
+     * match is never left hidden behind a collapsed group.
+     * @param {HTMLElement} element Element inside a group.
+     */
+    const revealGroupOf = (element) => {
+        const groupItem = element.closest('.admin-nav-group-item');
+        if (!groupItem) {
+            return;
+        }
+        groupItem.classList.remove('admin-search-hidden');
+        const list = groupItem.querySelector('.admin-nav-group-tabs');
+        if (list) {
+            list.classList.remove('d-none');
+        }
+    };
+
+    // A group matching by name reveals everything it holds.
+    document.querySelectorAll('.admin-nav-group').forEach(group => {
+        const label = group.querySelector('.nav-text');
+        if (!label || !label.textContent.toLowerCase().includes(normalizedSearch)) {
+            return;
+        }
+
+        group.classList.add('admin-search-highlight');
+        revealGroupOf(group);
+        hasVisibleSections = true;
+
+        const groupItem = group.closest('.admin-nav-group-item');
+        groupItem.querySelectorAll('.admin-nav-tab').forEach(tab => {
+            tab.closest('li').classList.remove('admin-search-hidden');
+        });
+    });
+
     allTabs.forEach(tab => {
-        const tabText = tab.querySelector('.nav-text').textContent.toLowerCase();
+        const label = tab.querySelector('.nav-text');
+        const tabText = label ? label.textContent.toLowerCase() : '';
         const tabId = tab.getAttribute('data-tab');
         let tabHasMatch = false;
-        
-        // Check if tab name matches
+
         if (tabText.includes(normalizedSearch)) {
             tab.closest('li').classList.remove('admin-search-hidden');
             tab.classList.add('admin-search-highlight');
+            revealGroupOf(tab);
             tabHasMatch = true;
             hasVisibleSections = true;
-            
-            // Show submenu for matched tab
+
             const submenu = document.getElementById(tabId + '-submenu');
             if (submenu) {
                 submenu.style.display = 'block';
-                // Show all sections under this tab
                 submenu.querySelectorAll('.admin-nav-section').forEach(section => {
                     section.closest('li').classList.remove('admin-search-hidden');
                 });
             }
         }
-        
-        // Check sections under this tab
+
         const sections = document.querySelectorAll(`.admin-nav-section[data-tab="${tabId}"]`);
         let sectionHasMatch = false;
-        
+
         sections.forEach(section => {
-            const sectionText = section.querySelector('.nav-text').textContent.toLowerCase();
-            
+            const sectionLabel = section.querySelector('.nav-text');
+            const sectionText = sectionLabel ? sectionLabel.textContent.toLowerCase() : '';
+
             if (sectionText.includes(normalizedSearch)) {
-                // Show the section
                 section.closest('li').classList.remove('admin-search-hidden');
                 section.classList.add('admin-search-highlight');
                 sectionHasMatch = true;
                 hasVisibleSections = true;
-                
-                // Show the parent tab
+
                 tab.closest('li').classList.remove('admin-search-hidden');
-                
-                // Show the submenu
+                revealGroupOf(tab);
+
                 const submenu = document.getElementById(tabId + '-submenu');
                 if (submenu) {
                     submenu.style.display = 'block';
                 }
             }
         });
-        
-        // If tab has matching sections but doesn't match itself, remove tab highlight
+
+        // A tab surfaced only because a section matched is not itself a hit.
         if (sectionHasMatch && !tabHasMatch) {
             tab.classList.remove('admin-search-highlight');
         }
     });
-    
-    // Show "No results" message if nothing found
+
     showSearchResults(hasVisibleSections, normalizedSearch);
 }
 
 function showAllAdminSections() {
-    // Remove all search-related classes and show all items
-    document.querySelectorAll('.admin-nav-tab, .admin-nav-section').forEach(item => {
-        item.closest('li').classList.remove('admin-search-hidden');
+    // Restore the normal browsing state: nothing hidden, nothing highlighted,
+    // submenus closed, and groups back to their persisted expansion.
+    document.querySelectorAll('.admin-nav-group-item').forEach(group => {
+        group.classList.remove('admin-search-hidden');
+    });
+
+    document.querySelectorAll('.admin-nav-tab, .admin-nav-section, .admin-nav-group').forEach(item => {
+        const listItem = item.closest('li');
+        if (listItem) {
+            listItem.classList.remove('admin-search-hidden');
+        }
         item.classList.remove('admin-search-highlight');
     });
-    
-    // Hide all submenus (normal collapsed state)
+
     document.querySelectorAll('[id$="-submenu"]').forEach(submenu => {
         submenu.style.display = 'none';
     });
-    
-    // Remove search results message
+
+    document.querySelectorAll('[data-admin-group-toggle]').forEach(toggle => {
+        const groupId = toggle.getAttribute('data-admin-group-toggle');
+        const expanded = toggle.getAttribute('aria-expanded') === 'true';
+        setAdminGroupExpanded(groupId, expanded, false);
+    });
+
     hideSearchResults();
 }
 
@@ -462,4 +654,4 @@ function hideSearchResults() {
     if (noResults) {
         noResults.remove();
     }
-}
\ No newline at end of file
+}
diff --git a/application/single_app/templates/_sidebar_nav.html b/application/single_app/templates/_sidebar_nav.html
index 198eab56b..8c2880678 100644
--- a/application/single_app/templates/_sidebar_nav.html
+++ b/application/single_app/templates/_sidebar_nav.html
@@ -441,7 +441,28 @@
         </div>
       </div>
       <div id="admin-settings-section"{% if not admin_settings_menu_expanded %} class="d-none"{% endif %} aria-hidden="{{ 'false' if admin_settings_menu_expanded else 'true' }}">
-        <ul class="nav flex-column mb-2">
+        <ul class="nav flex-column mb-2" id="admin-nav-groups">
+          {% for admin_group in admin_nav %}
+          {% set group_state_key = 'adminGroup:' ~ admin_group.id %}
+          {% set group_expanded = sidebar_menu_state.get(group_state_key, false) %}
+          <li class="nav-item admin-nav-group-item" data-admin-group="{{ admin_group.id }}">
+            <a class="nav-link d-flex align-items-center justify-content-between admin-nav-group"
+               href="#"
+               role="button"
+               aria-expanded="{{ 'true' if group_expanded else 'false' }}"
+               aria-controls="admin-group-{{ admin_group.id }}"
+               data-admin-group-toggle="{{ admin_group.id }}">
+              <span class="d-flex align-items-center">
+                <i class="bi {{ admin_group.icon }} me-2" aria-hidden="true"></i>
+                <span class="nav-text">{{ admin_group.label }}</span>
+              </span>
+              <i class="bi bi-chevron-down admin-nav-group-caret{% if not group_expanded %} collapsed{% endif %}"
+                 aria-hidden="true"></i>
+            </a>
+            <ul class="nav flex-column ms-2 admin-nav-group-tabs{% if not group_expanded %} d-none{% endif %}"
+                id="admin-group-{{ admin_group.id }}">
+              {% for admin_tab in admin_group.tabs %}
+              {% if admin_tab.render == 'latest_features' %}
           {% if not latest_features_nav_is_hidden %}
           <li class="nav-item latest-features-nav-item" data-latest-features-nav-item>
             <div class="d-flex align-items-center">
@@ -495,530 +516,36 @@
             </ul>
           </li>
           {% endif %}
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="general">
-              <i class="bi bi-gear me-2"></i><span class="nav-text">General</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="general-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="branding-section">
-                  <i class="bi bi-palette me-2" style="font-size: 0.8em;"></i><span class="nav-text">Branding</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="home-page-text-section">
-                  <i class="bi bi-house me-2" style="font-size: 0.8em;"></i><span class="nav-text">Home Page Text</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="appearance-section">
-                  <i class="bi bi-brush me-2" style="font-size: 0.8em;"></i><span class="nav-text">Appearance</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="health-check-section">
-                  <i class="bi bi-heart-pulse me-2" style="font-size: 0.8em;"></i><span class="nav-text">Health Check</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="swagger-section">
-                  <i class="bi bi-file-earmark-code me-2" style="font-size: 0.8em;"></i><span class="nav-text">API Documentation</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="classification-banner-section">
-                  <i class="bi bi-shield-exclamation me-2" style="font-size: 0.8em;"></i><span class="nav-text">Classification Banner</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="ai-notice-section">
-                  <i class="bi bi-robot me-2" style="font-size: 0.8em;"></i><span class="nav-text">Chat AI Notice</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="terms-of-use-section">
-                  <i class="bi bi-door-open me-2" style="font-size: 0.8em;"></i><span class="nav-text">Terms of Use</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="support-menu-section">
-                  <i class="bi bi-life-preserver me-2" style="font-size: 0.8em;"></i><span class="nav-text">Support</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="external-links-section">
-                  <i class="bi bi-box-arrow-up-right me-2" style="font-size: 0.8em;"></i><span class="nav-text">External Links</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="general" data-section="system-settings-section">
-                  <i class="bi bi-gear-fill me-2" style="font-size: 0.8em;"></i><span class="nav-text">System Settings</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="custom-pages">
-              <i class="bi bi-window-plus me-2"></i><span class="nav-text">Custom Pages</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="custom-pages-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="custom-pages" data-section="custom-pages-section">
-                  <i class="bi bi-file-earmark-richtext me-2" style="font-size: 0.8em;"></i><span class="nav-text">Static Pages</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="ai-models">
-              <i class="bi bi-cpu me-2"></i><span class="nav-text">AI Models</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="ai-models-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="ai-models" data-section="multi-endpoint-configuration">
-                  <i class="bi bi-hdd-network me-2" style="font-size: 0.8em;"></i><span class="nav-text">Model Endpoints</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="ai-models" data-section="processing-thoughts-section">
-                  <i class="bi bi-stars me-2" style="font-size: 0.8em;"></i><span class="nav-text">Processing Thoughts</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="ai-models" data-section="embeddings-config">
-                  <i class="bi bi-vector-pen me-2" style="font-size: 0.8em;"></i><span class="nav-text">Embeddings</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="ai-models" data-section="image-config">
-                  <i class="bi bi-image me-2" style="font-size: 0.8em;"></i><span class="nav-text">Image Generation</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="ai-models" data-section="gpt-config">
-                  <i class="bi bi-chat-square-text me-2" style="font-size: 0.8em;"></i><span class="nav-text">Chat Model</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="agents">
-              <i class="bi bi-robot me-2"></i><span class="nav-text">Agents and Actions</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="agents-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="agents" data-section="document-action-capabilities-card">
-                  <i class="bi bi-files me-2" style="font-size: 0.8em;"></i><span class="nav-text">Document Action Capabilities</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="agents" data-section="agents-config">
-                  <i class="bi bi-robot me-2" style="font-size: 0.8em;"></i><span class="nav-text">Agents Configuration</span>
-                </a>
-              </li>
-              {% if app_settings.enable_agent_template_gallery %}
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="agents" data-section="agent-template-approvals-section">
-                  <i class="bi bi-layers me-2" style="font-size: 0.8em;"></i><span class="nav-text">Agent Template Approvals</span>
-                </a>
+              {% else %}
+              {% if not admin_tab.condition
+                    or (admin_tab.condition == 'enable_agent_template_gallery' and app_settings.enable_agent_template_gallery)
+                    or (admin_tab.condition == 'mcp_ui_enabled' and mcp_ui_enabled) %}
+              <li class="nav-item">
+                <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="{{ admin_tab.id }}">
+                  <i class="bi {{ admin_tab.icon }} me-2" aria-hidden="true"></i><span class="nav-text">{{ admin_tab.label }}</span>
+                </a>
+                {% if admin_tab.sections %}
+                <ul class="nav flex-column ms-3" style="display: none;" id="{{ admin_tab.id }}-submenu">
+                  {% for admin_section in admin_tab.sections %}
+                  {% if not admin_section.condition
+                        or (admin_section.condition == 'enable_agent_template_gallery' and app_settings.enable_agent_template_gallery)
+                        or (admin_section.condition == 'mcp_ui_enabled' and mcp_ui_enabled) %}
+                  <li class="nav-item">
+                    <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="{{ admin_tab.id }}" data-section="{{ admin_section.id }}">
+                      <i class="bi {{ admin_section.icon }} me-2" style="font-size: 0.8em;" aria-hidden="true"></i><span class="nav-text">{{ admin_section.label }}</span>
+                    </a>
+                  </li>
+                  {% endif %}
+                  {% endfor %}
+                </ul>
+                {% endif %}
               </li>
               {% endif %}
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="agents" data-section="actions-config">
-                  <i class="bi bi-plugin me-2" style="font-size: 0.8em;"></i><span class="nav-text">Actions Configuration</span>
-                </a>
-              </li>
-              {% if mcp_ui_enabled %}
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="agents" data-section="inbound-mcp-configuration">
-                  <i class="bi bi-diagram-3 me-2" style="font-size: 0.8em;"></i><span class="nav-text">Inbound MCP</span>
-                </a>
-              </li>
               {% endif %}
+              {% endfor %}
             </ul>
           </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="logging">
-              <i class="bi bi-journal-text me-2"></i><span class="nav-text">Logging</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="logging-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="logging" data-section="application-insights-section">
-                  <i class="bi bi-graph-up me-2" style="font-size: 0.8em;"></i><span class="nav-text">Application Insights</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="logging" data-section="debug-logging-section">
-                  <i class="bi bi-bug me-2" style="font-size: 0.8em;"></i><span class="nav-text">Debug Logging</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="logging" data-section="file-processing-logs-section">
-                  <i class="bi bi-file-earmark-text me-2" style="font-size: 0.8em;"></i><span class="nav-text">File Process Logging</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="scale">
-              <i class="bi bi-diagram-3 me-2"></i><span class="nav-text">Scale</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="scale-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="scale" data-section="redis-cache-section">
-                  <i class="bi bi-database me-2" style="font-size: 0.8em;"></i><span class="nav-text">Redis Cache</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="scale" data-section="redis-monitoring-section">
-                  <i class="bi bi-activity me-2" style="font-size: 0.8em;"></i><span class="nav-text">Redis Metrics</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="scale" data-section="conversation-cache-section">
-                  <i class="bi bi-chat-square-text me-2" style="font-size: 0.8em;"></i><span class="nav-text">Conversation Cache</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="scale" data-section="document-access-index-section">
-                  <i class="bi bi-diagram-3 me-2" style="font-size: 0.8em;"></i><span class="nav-text">DAI Metrics</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="scale" data-section="cosmos-maintenance-section">
-                  <i class="bi bi-tools me-2" style="font-size: 0.8em;"></i><span class="nav-text">Cosmos Maintenance</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="scale" data-section="cosmos-throughput-section">
-                  <i class="bi bi-speedometer2 me-2" style="font-size: 0.8em;"></i><span class="nav-text">Cosmos DB Throughput</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="scale" data-section="cosmos-throughput-metrics-table-section">
-                  <i class="bi bi-table me-2" style="font-size: 0.8em;"></i><span class="nav-text">Cosmos Metrics</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="scale" data-section="front-door-section">
-                  <i class="bi bi-door-open me-2" style="font-size: 0.8em;"></i><span class="nav-text">Azure Front Door</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="control-center-config">
-              <i class="bi bi-speedometer2 me-2"></i><span class="nav-text">Control Center</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="control-center-config-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="control-center-config" data-section="control-center-auto-refresh-section">
-                  <i class="bi bi-calendar-check me-2" style="font-size: 0.8em;"></i><span class="nav-text">Automatic Data Refresh</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="control-center-config" data-section="control-center-overview-section">
-                  <i class="bi bi-gear-wide-connected me-2" style="font-size: 0.8em;"></i><span class="nav-text">Control Center Access</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="data-management">
-              <i class="bi bi-database-check me-2"></i><span class="nav-text">Backup, Migrate &amp; Restore</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="data-management-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="data-management" data-section="data-management-readiness-section">
-                  <i class="bi bi-compass me-2" style="font-size: 0.8em;"></i><span class="nav-text">Start Here</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="data-management" data-section="data-management-backup-section">
-                  <i class="bi bi-archive me-2" style="font-size: 0.8em;"></i><span class="nav-text">Backup</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="data-management" data-section="data-management-schedule-section">
-                  <i class="bi bi-calendar-event me-2" style="font-size: 0.8em;"></i><span class="nav-text">Schedule</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="data-management" data-section="data-management-storage-section">
-                  <i class="bi bi-hdd me-2" style="font-size: 0.8em;"></i><span class="nav-text">Storage</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="data-management" data-section="data-management-encryption-section">
-                  <i class="bi bi-key me-2" style="font-size: 0.8em;"></i><span class="nav-text">Encryption</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="data-management" data-section="data-management-migration-section">
-                  <i class="bi bi-arrow-left-right me-2" style="font-size: 0.8em;"></i><span class="nav-text">Migration</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="data-management" data-section="data-management-cosmos-editor-section">
-                  <i class="bi bi-database-exclamation me-2" style="font-size: 0.8em;"></i><span class="nav-text">Cosmos Editor</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="data-management" data-section="data-management-backup-inventory-section">
-                  <i class="bi bi-box-seam me-2" style="font-size: 0.8em;"></i><span class="nav-text">Backup Inventory &amp; Restore</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="data-management" data-section="data-management-jobs-section">
-                  <i class="bi bi-clock-history me-2" style="font-size: 0.8em;"></i><span class="nav-text">Jobs</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="governance">
-              <i class="bi bi-braces-asterisk me-2"></i><span class="nav-text">Governance</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="governance-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="governance" data-section="governance-feature-toggles-section">
-                  <i class="bi bi-braces-asterisk me-2" style="font-size: 0.8em;"></i><span class="nav-text">Governance Feature Toggles</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="governance" data-section="governance-mcp-destination-section">
-                  <i class="bi bi-diagram-3 me-2" style="font-size: 0.8em;"></i><span class="nav-text">MCP Action Destination Governance</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="governance" data-section="governance-inbound-mcp-section">
-                  <i class="bi bi-box-arrow-in-down-right me-2" style="font-size: 0.8em;"></i><span class="nav-text">Inbound MCP Source Governance</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="governance" data-section="governance-feature-policies-section">
-                  <i class="bi bi-sliders2 me-2" style="font-size: 0.8em;"></i><span class="nav-text">Feature Policies</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="governance" data-section="governance-item-policies-section">
-                  <i class="bi bi-list-check me-2" style="font-size: 0.8em;"></i><span class="nav-text">Delegated Item Policies</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="workspaces">
-              <i class="bi bi-folder me-2"></i><span class="nav-text">Workspaces</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="workspaces-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="personal-workspaces-section">
-                  <i class="bi bi-person me-2" style="font-size: 0.8em;"></i><span class="nav-text">Personal Workspaces</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="workflow-settings-section">
-                  <i class="bi bi-diagram-3 me-2" style="font-size: 0.8em;"></i><span class="nav-text">Workflow</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="file-download-settings-section">
-                  <i class="bi bi-download me-2" style="font-size: 0.8em;"></i><span class="nav-text">File Downloads</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="group-workspaces-section">
-                  <i class="bi bi-people me-2" style="font-size: 0.8em;"></i><span class="nav-text">Group Workspaces</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="public-workspaces-section">
-                  <i class="bi bi-globe me-2" style="font-size: 0.8em;"></i><span class="nav-text">Public Workspaces</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="file-sharing-section">
-                  <i class="bi bi-share me-2" style="font-size: 0.8em;"></i><span class="nav-text">File Sharing</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="chat-file-uploads-section">
-                  <i class="bi bi-paperclip me-2" style="font-size: 0.8em;"></i><span class="nav-text">Chat File Uploads</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="metadata-extraction-section">
-                  <i class="bi bi-file-earmark-code me-2" style="font-size: 0.8em;"></i><span class="nav-text">Metadata Extraction</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="multimodal-vision-section">
-                  <i class="bi bi-eye me-2" style="font-size: 0.8em;"></i><span class="nav-text">Multi-Modal Vision Analysis</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="document-classification-section">
-                  <i class="bi bi-tags me-2" style="font-size: 0.8em;"></i><span class="nav-text">Document Classification</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="retention-policy-section">
-                  <i class="bi bi-hourglass-split me-2" style="font-size: 0.8em;"></i><span class="nav-text">Retention Policy</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="workspace-scope-lock-section">
-                  <i class="bi bi-lock me-2" style="font-size: 0.8em;"></i><span class="nav-text">Workspace Scope Lock</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="workspaces" data-section="user-agreement-section">
-                  <i class="bi bi-file-earmark-check me-2" style="font-size: 0.8em;"></i><span class="nav-text">User Agreement</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="file-sync">
-              <i class="bi bi-arrow-repeat me-2"></i><span class="nav-text">File Sync</span>
-            </a>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="workspace-identities">
-              <i class="bi bi-person-badge me-2"></i><span class="nav-text">Global Identities</span>
-            </a>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="citation">
-              <i class="bi bi-quote me-2"></i><span class="nav-text">Citations</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="citation-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="citation" data-section="standard-citations-section">
-                  <i class="bi bi-quote me-2" style="font-size: 0.8em;"></i><span class="nav-text">Standard</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="citation" data-section="enhanced-citations-section">
-                  <i class="bi bi-star me-2" style="font-size: 0.8em;"></i><span class="nav-text">Enhanced</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="safety">
-              <i class="bi bi-shield-check me-2"></i><span class="nav-text">Safety</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="safety-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="safety" data-section="content-safety-section">
-                  <i class="bi bi-shield-exclamation me-2" style="font-size: 0.8em;"></i><span class="nav-text">Content Safety</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="safety" data-section="user-feedback-section">
-                  <i class="bi bi-chat-square-heart me-2" style="font-size: 0.8em;"></i><span class="nav-text">User Feedback</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="safety" data-section="desktop-notifications-section">
-                  <i class="bi bi-bell me-2" style="font-size: 0.8em;"></i><span class="nav-text">Desktop Conversation Notifications</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="safety" data-section="permissions-section">
-                  <i class="bi bi-person-check me-2" style="font-size: 0.8em;"></i><span class="nav-text">Permissions</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="safety" data-section="conversation-archiving-section">
-                  <i class="bi bi-archive me-2" style="font-size: 0.8em;"></i><span class="nav-text">Conversation Archiving</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="security">
-              <i class="bi bi-shield-lock me-2"></i><span class="nav-text">Security</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="security-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="security" data-section="keyvault-section">
-                  <i class="bi bi-safe me-2" style="font-size: 0.8em;"></i><span class="nav-text">Key Vault</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="search-extract">
-              <i class="bi bi-search me-2"></i><span class="nav-text">Search & Extract</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="search-extract-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="search-extract" data-section="web-search-section">
-                  <i class="bi bi-globe me-2" style="font-size: 0.8em;"></i><span class="nav-text">Web Search</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="search-extract" data-section="url-access-section">
-                  <i class="bi bi-link-45deg me-2" style="font-size: 0.8em;"></i><span class="nav-text">URL Access</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="search-extract" data-section="source-review-section">
-                  <i class="bi bi-binoculars me-2" style="font-size: 0.8em;"></i><span class="nav-text">Deep Research</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="search-extract" data-section="azure-ai-search-section">
-                  <i class="bi bi-search me-2" style="font-size: 0.8em;"></i><span class="nav-text">Azure AI Search</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="search-extract" data-section="document-intelligence-section">
-                  <i class="bi bi-file-earmark-text me-2" style="font-size: 0.8em;"></i><span class="nav-text">Document Intelligence</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="search-extract" data-section="chunk-size-section">
-                  <i class="bi bi-collection me-2" style="font-size: 0.8em;"></i><span class="nav-text">Chunk Sizes</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="search-extract" data-section="video-intelligence-section">
-                  <i class="bi bi-play-circle me-2" style="font-size: 0.8em;"></i><span class="nav-text">AI Video Intelligence</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="search-extract" data-section="ai-voice-chat-section">
-                  <i class="bi bi-mic me-2" style="font-size: 0.8em;"></i><span class="nav-text">AI Voice Conversations</span>
-                </a>
-              </li>
-            </ul>
-          </li>
-          <li class="nav-item">
-            <a class="nav-link d-flex align-items-center admin-nav-tab" href="#" data-tab="send-feedback">
-              <i class="bi bi-envelope-paper me-2"></i><span class="nav-text">Send Feedback</span>
-            </a>
-            <ul class="nav flex-column ms-3" style="display: none;" id="send-feedback-submenu">
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="send-feedback" data-section="send-feedback-overview-card">
-                  <i class="bi bi-info-circle me-2" style="font-size: 0.8em;"></i><span class="nav-text">Overview</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="send-feedback" data-section="send-feedback-bug-card">
-                  <i class="bi bi-bug me-2" style="font-size: 0.8em;"></i><span class="nav-text">Report a Bug</span>
-                </a>
-              </li>
-              <li class="nav-item">
-                <a class="nav-link d-flex align-items-center admin-nav-section" href="#" data-tab="send-feedback" data-section="send-feedback-feature-card">
-                  <i class="bi bi-lightbulb me-2" style="font-size: 0.8em;"></i><span class="nav-text">Request a Feature</span>
-                </a>
-              </li>
-            </ul>
-          </li>
+          {% endfor %}
         </ul>
       </div>
     </div>
diff --git a/application/single_app/templates/admin/_panes/access-roles.html b/application/single_app/templates/admin/_panes/access-roles.html
new file mode 100644
index 000000000..e87ef059d
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/access-roles.html
@@ -0,0 +1,79 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'access-roles' %} show active{% endif %}" id="access-roles" role="tabpanel" aria-labelledby="access-roles-tab">
+                <div class="card p-3 mb-3" id="permissions-section"
+                    data-requires="enable_user_feedback"
+                    data-requires-label="User Feedback"
+                    data-requires-target="user-feedback-section"
+                    data-requires-scope="#require_member_of_feedback_admin"
+                    data-requires-description="The FeedbackAdmin role only controls access to the User Feedback report, so it does nothing until User Feedback is enabled.">
+                    <h5>
+                        <i class="bi bi-person-check me-2"></i>Permissions
+                    </h5>
+                    <p class="text-muted">Control which users can access specific administrative views related to safety and feedback.</p>
+
+
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_safety_violation_admin"
+                            name="require_member_of_safety_violation_admin"
+                            {% if settings.require_member_of_safety_violation_admin %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_member_of_safety_violation_admin">
+                            Require SafetyViolationAdmin App Role
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the SafetyViolationAdmin Enterprise App role can access safety violation reports."></i>
+                    </div>
+                     <p class="text-muted small mb-3">
+                        Required app role value: <code>SafetyViolationAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the Safety Violations admin page.
+                    </p>
+
+
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_feedback_admin"
+                            name="require_member_of_feedback_admin"
+                            {% if settings.require_member_of_feedback_admin %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_member_of_feedback_admin">
+                            Require FeedbackAdmin App Role
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the FeedbackAdmin Enterprise App role can access user feedback reports."></i>
+                    </div>
+                     <p class="text-muted small mb-0">
+                        Required app role value: <code>FeedbackAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the User Feedback admin page. Requires <strong>Enable User Feedback</strong> to be active.
+                    </p>
+                </div>
+
+                <div class="card p-3 mb-3" id="app-role-requirements-section">
+                    <h5>
+                        <i class="bi bi-person-badge me-2"></i>App Role Requirements
+                    </h5>
+                    <p class="text-muted">
+                        Every setting that can require an Entra app role, gathered here so the
+                        full access policy can be read in one place. Each switch is a mirror of
+                        the setting on its own tab, so changing it here changes it there.
+                    </p>
+                    {# Rows are built from the page itself by
+                       admin_access_roles_roster.js, so a new role requirement appears here
+                       automatically and this list can never fall out of step. #}
+                    <div id="app-role-requirements-list" class="d-flex flex-column gap-2"></div>
+                    <p class="text-muted small mb-0 d-none" id="app-role-requirements-empty">
+                        No app role requirements are available on this page.
+                    </p>
+                </div>
+
+                <div class="card p-3 mb-3" id="access-denied-message-section">
+                    <h5>
+                        <i class="bi bi-shield-x me-2"></i>Access Denied Message
+                    </h5>
+                    <p class="text-muted">
+                        Shown to a user whose account does not carry a required role.
+                    </p>
+                    <div class="mb-3">
+                        <label for="access_denied_message" class="form-label">Access Denied Message</label>
+                        <small class="text-muted d-block mb-1">Shown to signed-in users who lack the required roles. Use Enter for line breaks.</small>
+                        <textarea class="form-control" id="access_denied_message" name="access_denied_message"
+                            rows="3">{{ settings.access_denied_message }}</textarea>
+                    </div>
+                </div>
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/actions.html b/application/single_app/templates/admin/_panes/actions.html
new file mode 100644
index 000000000..221cfac5b
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/actions.html
@@ -0,0 +1,205 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'actions' %} show active{% endif %}" id="actions" role="tabpanel" aria-labelledby="actions-tab">
+                <div class="card p-3 mb-4" id="document-action-capabilities-card">
+                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3 mb-3">
+                        <div>
+                            <h5 class="mb-1"><i class="bi bi-files me-2"></i>Document Action Capabilities</h5>
+                            <p class="text-muted small mb-0">Configure the document actions shown in the <strong>Action</strong> dropdown in Chat and Workflow. These controls live in the Agents and Actions tab, but remain separate from the global agent and custom action cards below.</p>
+                        </div>
+                        <span class="badge text-bg-light border align-self-start align-self-lg-center">Chat: 2-300 | Workflow: 2-1000</span>
+                    </div>
+                    <div class="alert alert-light border small mb-3" role="alert">
+                        Use these settings to explicitly allow Analyze and Document Comparison in the Chat and Workflow <strong>Action</strong> dropdowns without bundling them into the global agent or custom action configuration cards below.
+                    </div>
+                    <div class="row g-3">
+                        <div class="col-xl-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="form-check form-switch mb-3">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="document_action_analyze_enabled" name="document_action_analyze_enabled" {% if analyze_capability.enabled %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="document_action_analyze_enabled">Enable Analyze</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to run deterministic analysis across selected documents in chat and workflows."></i>
+                                </div>
+                                <div class="mb-3">
+                                    <div class="d-flex justify-content-between align-items-center mb-1">
+                                        <label for="document_action_analyze_chat_max_documents" class="form-label mb-0">Chat max documents</label>
+                                        <span id="document_action_analyze_chat_max_documents_value" class="small text-muted fw-semibold">{{ analyze_capability.chat_max_documents }}</span>
+                                    </div>
+                                    <div class="row g-2 align-items-center">
+                                        <div class="col-lg-8">
+                                            <input type="range" class="form-range document-action-capability-range" id="document_action_analyze_chat_max_documents_range" min="2" max="300" step="1" value="{{ analyze_capability.chat_max_documents }}" data-range-sync="document_action_analyze_chat_max_documents" data-range-display="document_action_analyze_chat_max_documents_value" />
+                                        </div>
+                                        <div class="col-lg-4">
+                                            <input type="number" class="form-control" id="document_action_analyze_chat_max_documents" name="document_action_analyze_chat_max_documents" min="2" max="300" value="{{ analyze_capability.chat_max_documents }}" />
+                                        </div>
+                                    </div>
+                                    <div class="d-flex justify-content-between small text-muted">
+                                        <span>2</span>
+                                        <span>300</span>
+                                    </div>
+                                </div>
+                                <div>
+                                    <div class="d-flex justify-content-between align-items-center mb-1">
+                                        <label for="document_action_analyze_workflow_max_documents" class="form-label mb-0">Workflow max documents</label>
+                                        <span id="document_action_analyze_workflow_max_documents_value" class="small text-muted fw-semibold">{{ analyze_capability.workflow_max_documents }}</span>
+                                    </div>
+                                    <div class="row g-2 align-items-center">
+                                        <div class="col-lg-8">
+                                            <input type="range" class="form-range document-action-capability-range" id="document_action_analyze_workflow_max_documents_range" min="2" max="1000" step="1" value="{{ analyze_capability.workflow_max_documents }}" data-range-sync="document_action_analyze_workflow_max_documents" data-range-display="document_action_analyze_workflow_max_documents_value" />
+                                        </div>
+                                        <div class="col-lg-4">
+                                            <input type="number" class="form-control" id="document_action_analyze_workflow_max_documents" name="document_action_analyze_workflow_max_documents" min="2" max="1000" value="{{ analyze_capability.workflow_max_documents }}" />
+                                        </div>
+                                    </div>
+                                    <div class="d-flex justify-content-between small text-muted">
+                                        <span>2</span>
+                                        <span>1000</span>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                        <div class="col-xl-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="form-check form-switch mb-3">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="document_action_comparison_enabled" name="document_action_comparison_enabled" {% if comparison_capability.enabled %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="document_action_comparison_enabled">Enable Document Comparison</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to compare one baseline document against one or more selected documents in chat and workflows."></i>
+                                </div>
+                                <div class="mb-3">
+                                    <div class="d-flex justify-content-between align-items-center mb-1">
+                                        <label for="document_action_comparison_chat_max_documents" class="form-label mb-0">Chat max documents</label>
+                                        <span id="document_action_comparison_chat_max_documents_value" class="small text-muted fw-semibold">{{ comparison_capability.chat_max_documents }}</span>
+                                    </div>
+                                    <div class="row g-2 align-items-center">
+                                        <div class="col-lg-8">
+                                            <input type="range" class="form-range document-action-capability-range" id="document_action_comparison_chat_max_documents_range" min="2" max="300" step="1" value="{{ comparison_capability.chat_max_documents }}" data-range-sync="document_action_comparison_chat_max_documents" data-range-display="document_action_comparison_chat_max_documents_value" />
+                                        </div>
+                                        <div class="col-lg-4">
+                                            <input type="number" class="form-control" id="document_action_comparison_chat_max_documents" name="document_action_comparison_chat_max_documents" min="2" max="300" value="{{ comparison_capability.chat_max_documents }}" />
+                                        </div>
+                                    </div>
+                                    <div class="d-flex justify-content-between small text-muted">
+                                        <span>2</span>
+                                        <span>300</span>
+                                    </div>
+                                </div>
+                                <div>
+                                    <div class="d-flex justify-content-between align-items-center mb-1">
+                                        <label for="document_action_comparison_workflow_max_documents" class="form-label mb-0">Workflow max documents</label>
+                                        <span id="document_action_comparison_workflow_max_documents_value" class="small text-muted fw-semibold">{{ comparison_capability.workflow_max_documents }}</span>
+                                    </div>
+                                    <div class="row g-2 align-items-center">
+                                        <div class="col-lg-8">
+                                            <input type="range" class="form-range document-action-capability-range" id="document_action_comparison_workflow_max_documents_range" min="2" max="1000" step="1" value="{{ comparison_capability.workflow_max_documents }}" data-range-sync="document_action_comparison_workflow_max_documents" data-range-display="document_action_comparison_workflow_max_documents_value" />
+                                        </div>
+                                        <div class="col-lg-4">
+                                            <input type="number" class="form-control" id="document_action_comparison_workflow_max_documents" name="document_action_comparison_workflow_max_documents" min="2" max="1000" value="{{ comparison_capability.workflow_max_documents }}" />
+                                        </div>
+                                    </div>
+                                    <div class="d-flex justify-content-between small text-muted">
+                                        <span>2</span>
+                                        <span>1000</span>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- Agents Configuration Section -->
+                <div class="card p-3 mb-4" id="actions-configuration">
+                    <h5 class="card-title">
+                        <i class="bi bi-plugin me-2"></i>Global Actions Configuration
+                    </h5>
+                    <p class="text-muted small">
+                        Configure custom actions and tools to extend functionality with integrations and specialized capabilities.
+                    </p>
+
+                    {% if not settings.enable_semantic_kernel %}
+                        <div class="alert alert-info">
+                            <strong>Actions are not available while agents are disabled.</strong> Enable agents above to configure actions.
+                        </div>
+                    {% else %}
+                        <div>
+                            <div class="d-flex justify-content-between align-items-center mb-3">
+                                <h6>Global Actions</h6>
+                                <button type="button" class="btn btn-primary btn-sm" id="add-plugin-btn">Add Action</button>
+                            </div>
+                            <p class="text-muted small">Disable a global action to keep the configuration without exposing it to runtime action loading until it is re-enabled.</p>
+                            {% if settings.per_user_semantic_kernel %}
+                            <!-- Action Feature Flags -->
+                                <div class="card p-3 mb-3" id="plugin-feature-toggles">
+                                    <h6 class="mb-2">Workspace Action Feature Toggles</h6>
+                                    <div class="form-check form-switch mb-2">
+                                        <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-user-plugins" name="allow_user_plugins" {% if settings.allow_user_plugins %}checked{% endif %}>
+                                        <label class="form-check-label ms-2" for="toggle-allow-user-plugins">Allow Personal Actions</label>
+                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage their own workspace-level actions/plugins for personal use."></i>
+                                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_user_actions">Govern</button>
+                                    </div>
+                                    <div class="form-check form-switch mb-2">
+                                        <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-group-plugins" name="allow_group_plugins" {% if settings.allow_group_plugins %}checked{% endif %}>
+                                        <label class="form-check-label ms-2" for="toggle-allow-group-plugins">Allow Group Actions</label>
+                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage group-level actions/plugins that can be shared within workgroups."></i>
+                                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_group_actions">Govern</button>
+                                    </div>
+                                </div>
+                            {% endif %}
+
+                            <!-- Core Plugin Toggles -->
+                            <div class="card p-3 mb-3" id="core-plugin-toggles">
+                                <h6 class="mb-2">Core Action Toggles</h6>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-time-plugin" name="enable_time_plugin" {% if settings.enable_time_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-time-plugin">Enable Time Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to get current date, time, and perform time-related calculations and conversions."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-http-plugin" name="enable_http_plugin" {% if settings.enable_http_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-http-plugin">Enable HTTP Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to make HTTP requests to websites for data retrieval and integration."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-wait-plugin" name="enable_wait_plugin" {% if settings.enable_wait_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-wait-plugin">Enable Wait Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to pause execution for specified time periods, useful for delays and timing control in workflows."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-math-plugin" name="enable_math_plugin" {% if settings.enable_math_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-math-plugin">Enable Math Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to perform mathematical calculations, solve equations, and handle complex mathematical operations."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-text-plugin" name="enable_text_plugin" {% if settings.enable_text_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-text-plugin">Enable Text Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to perform text processing operations like formatting, validation, and manipulation of strings and text content."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-default-embedding-model-plugin" name="enable_default_embedding_model_plugin" {% if settings.enable_default_embedding_model_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-default-embedding-model-plugin">Enable Default Embedding Model Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to access and use the default embedding model for text similarity and vector operations."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-fact-memory-plugin" name="enable_fact_memory_plugin" {% if settings.enable_fact_memory_plugin %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-fact-memory-plugin">Enable Fact Memory Action</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to store and retrieve facts and information across conversations for improved memory and context retention."></i>
+                                </div>
+                                <div class="mb-2" id="tabular-processing-toggle-wrapper">
+                                    <div class="d-flex align-items-center">
+                                        <span class="fw-semibold">Tabular Processing Action</span>
+                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Agents can analyze tabular data files (CSV, XLSX) using pandas for aggregations, filtering, and full dataset operations. This action is automatically enabled whenever Enhanced Citations is enabled."></i>
+                                    </div>
+                                    <small class="text-muted d-block ms-4" id="tabular-processing-dependency-note">Automatically enabled when Enhanced Citations is enabled</small>
+                                </div>
+                            </div>
+                            <table class="table table-bordered" id="plugins-table">
+                                <thead>
+                                    <tr>
+                                        <th>Display Name</th>
+                                        <th>Description</th>
+                                        <th>Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="admin-plugins-table-body"></tbody>
+                            </table>
+                        </div>
+                    {% endif %}
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/agents.html b/application/single_app/templates/admin/_panes/agents.html
new file mode 100644
index 000000000..889caa9cc
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/agents.html
@@ -0,0 +1,283 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'agents' %} show active{% endif %}" id="agents" role="tabpanel" aria-labelledby="agents-tab">
+
+                <p class="text-muted">
+                    Configure AI agents and actions for enhanced functionality. Agents provide AI-driven task automation while Actions extend functionality with custom tools and integrations.
+                </p>
+
+                <div class="alert alert-info d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3" role="alert">
+                    <div>
+                        <strong>Agent model lifecycle review lives in AI Models.</strong>
+
+                        <div class="small mt-1">
+                            Use AI Models to review inherited agents, selectively override explicit agent model choices, and move agents to newer default models as costs or model releases change.
+                        </div>
+                    </div>
+                    <button type="button" class="btn btn-outline-primary btn-sm align-self-start" data-open-admin-tab="#ai-models">
+                        <i class="bi bi-box-arrow-up-right me-1"></i>Open AI Models
+                    </button>
+                </div>
+
+                <div class="alert alert-warning mb-3" role="alert">
+                    <strong>Note:</strong> All changes to global agents and actions require a restart of the web app to take effect.
+                </div>
+
+                {% set analyze_capability = settings.document_action_capabilities.analyze %}
+                {% set comparison_capability = settings.document_action_capabilities.comparison %}
+                <div class="card p-3 mb-4" id="agents-configuration">
+                    <h5 class="card-title">
+                        <i class="bi bi-robot me-2"></i>Agents Configuration
+                    </h5>
+                    <p class="text-muted small">
+                        Configure AI agents powered by Semantic Kernel for task automation and orchestration.
+                    </p>
+                    <div class="card p-3 mb-3" id="agents-page-customization-card">
+                        <h6 class="mb-2">
+                            <i class="bi bi-palette me-2"></i>Agents Page Customization
+                        </h6>
+                        <p class="text-muted small">Customize the public Agents page hero, color treatment, and optional guidance message.</p>
+                        <div class="row g-3">
+                            <div class="col-lg-6">
+                                <label for="agents_page_title" class="form-label">Hero Title</label>
+                                <input type="text" class="form-control" id="agents_page_title" name="agents_page_title" maxlength="120" value="{{ settings.agents_page_title | default('Find your next AI partner') }}" />
+                            </div>
+                            <div class="col-lg-6">
+                                <label for="agents_page_subtitle" class="form-label">Hero Subtitle</label>
+                                <input type="text" class="form-control" id="agents_page_subtitle" name="agents_page_subtitle" maxlength="240" value="{{ settings.agents_page_subtitle | default('Explore specialized agents built to accelerate how you work.') }}" />
+                            </div>
+                            <div class="col-md-4">
+                                <label for="agents_page_hero_color_mode" class="form-label">Hero Color Mode</label>
+                                <select class="form-select" id="agents_page_hero_color_mode" name="agents_page_hero_color_mode">
+                                    <option value="single" {% if settings.agents_page_hero_color_mode != 'two_tone' %}selected{% endif %}>Single color</option>
+                                    <option value="two_tone" {% if settings.agents_page_hero_color_mode == 'two_tone' %}selected{% endif %}>Two tone gradient</option>
+                                </select>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="agents_page_hero_primary_color" class="form-label">Primary Color</label>
+                                <input type="color" class="form-control form-control-color" id="agents_page_hero_primary_color" name="agents_page_hero_primary_color" value="{{ settings.agents_page_hero_primary_color | default('#0f172a') }}" />
+                            </div>
+                            <div class="col-md-4">
+                                <label for="agents_page_hero_secondary_color" class="form-label">Secondary Color</label>
+                                <input type="color" class="form-control form-control-color" id="agents_page_hero_secondary_color" name="agents_page_hero_secondary_color" value="{{ settings.agents_page_hero_secondary_color | default('#1e293b') }}" />
+                                <div class="form-text">Used when two tone gradient is selected.</div>
+                            </div>
+                            <div class="col-12">
+                                <label for="agents_page_disclaimer_markdown" class="form-label">Disclaimer / Guidance Text <span class="text-muted fw-normal">(Markdown supported)</span></label>
+                                <textarea class="form-control" id="agents_page_disclaimer_markdown" name="agents_page_disclaimer_markdown" rows="4" maxlength="3000" placeholder="Need a new agent? Contact ai-support@example.com.">{{ settings.agents_page_disclaimer_markdown | default('') }}</textarea>
+                                <div class="form-text">Shown below the Agents page hero. Use this for contact details, request guidance, or governance reminders.</div>
+                            </div>
+                            <div class="col-12">
+                                <div class="form-check form-switch">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="agents_page_show_instructions_in_details" name="agents_page_show_instructions_in_details" {% if settings.agents_page_show_instructions_in_details | default(true) %}checked{% endif %} />
+                                    <label class="form-check-label" for="agents_page_show_instructions_in_details">Show agent instructions in Agents page details</label>
+                                </div>
+                                <div class="form-text">When disabled, the Agents tab details popup hides instructions and the catalog API response omits them.</div>
+                            </div>
+                            <div class="col-12">
+                                <hr class="my-2" />
+                                <h6 class="mb-2">Promoted Popular Agents</h6>
+                                <p class="text-muted small mb-3">Highlight selected agents in the Popular tab even before they have usage counts. Users only see promoted agents that are already visible to them.</p>
+                                <textarea class="d-none" id="agents_page_promoted_popular_agents_json" name="agents_page_promoted_popular_agents_json">{{ settings.agents_page_promoted_popular_agents | default([], true) | tojson }}</textarea>
+                                <div class="row g-3 mb-3">
+                                    <div class="col-lg-4">
+                                        <label for="agents_page_promoted_popular_order" class="form-label">Placement</label>
+                                        <select class="form-select" id="agents_page_promoted_popular_order" name="agents_page_promoted_popular_order">
+                                            <option value="before" {% if settings.agents_page_promoted_popular_order | default('before') == 'before' %}selected{% endif %}>Before actual popular agents</option>
+                                            <option value="after" {% if settings.agents_page_promoted_popular_order | default('before') == 'after' %}selected{% endif %}>After actual popular agents</option>
+                                            <option value="mixed" {% if settings.agents_page_promoted_popular_order | default('before') == 'mixed' %}selected{% endif %}>Mixed by usage</option>
+                                        </select>
+                                    </div>
+                                    <div class="col-lg-4">
+                                        <label for="agents_page_promoted_popular_tag_label" class="form-label">Promoted Tag Label</label>
+                                        <input type="text" class="form-control" id="agents_page_promoted_popular_tag_label" name="agents_page_promoted_popular_tag_label" maxlength="40" value="{{ settings.agents_page_promoted_popular_tag_label | default('Promoted') }}" />
+                                    </div>
+                                    <div class="col-lg-4 d-flex align-items-end">
+                                        <div>
+                                            <div class="form-check form-switch">
+                                                <input class="form-check-input" type="checkbox" role="switch" id="agents_page_promoted_popular_tag_enabled" name="agents_page_promoted_popular_tag_enabled" {% if settings.agents_page_promoted_popular_tag_enabled | default(true) %}checked{% endif %} />
+                                                <label class="form-check-label" for="agents_page_promoted_popular_tag_enabled">Show promoted tag</label>
+                                            </div>
+                                            <div class="form-text">When enabled, promoted agents show the configured tag in the Popular tab.</div>
+                                        </div>
+                                    </div>
+                                </div>
+                                <div class="row g-2 align-items-end mb-3">
+                                    <div class="col-lg-9">
+                                        <label for="agents-page-promoted-agent-select" class="form-label">Add Agent</label>
+                                        <select class="form-select" id="agents-page-promoted-agent-select">
+                                            <option value="">Loading available agents...</option>
+                                        </select>
+                                    </div>
+                                    <div class="col-lg-3">
+                                        <button type="button" class="btn btn-outline-primary w-100" id="agents-page-promoted-agent-add">
+                                            <i class="bi bi-plus-lg me-1" aria-hidden="true"></i>Add Agent
+                                        </button>
+                                    </div>
+                                </div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle mb-2">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Agent</th>
+                                                <th scope="col" class="text-nowrap">Show In</th>
+                                                <th scope="col" class="text-end">Actions</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="agents-page-promoted-popular-tbody"></tbody>
+                                    </table>
+                                </div>
+                                <div class="alert alert-info py-2 mb-0" id="agents-page-promoted-popular-empty">No agents are promoted yet.</div>
+                                <div class="alert alert-warning py-2 mt-2 mb-0 d-none" id="agents-page-promoted-popular-load-error" role="status"></div>
+                            </div>
+                        </div>
+                    </div>
+                <div class="mb-3">
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" role="switch" id="toggle-enable-agents-agents" name="enable_semantic_kernel" {% if settings.enable_semantic_kernel %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="toggle-enable-agents-agents">Enable Agents</label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the agents system powered by Semantic Kernel for AI-driven task automation and orchestration."></i>
+                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_global_agents_usage">Govern Global Agents</button>
+                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_global_actions_usage">Govern Global Actions</button>
+                    </div>
+                    <div id="per-user-sk-restart-msg" class="text-muted small mb-2" style="display:none;">Requires a restart to take effect.</div>
+                </div>
+                {% if not settings.enable_semantic_kernel %}
+                    <div class="alert alert-info">
+                        <strong>Agents UI is not available while agents are disabled.</strong>
+                    </div>
+                {% else %}
+                    <div>
+                        <div class="form-check form-switch mb-2">
+                            <input class="form-check-input" type="checkbox" role="switch" id="toggle-per-user-sk" name="per_user_semantic_kernel" {% if settings.per_user_semantic_kernel %}checked{% endif %} {% if not settings.enable_semantic_kernel %}disabled{% endif %}>
+                            <label class="form-check-label ms-2" for="toggle-per-user-sk">Workspace Mode (workspace-specific agents/plugins and disables global configuration)</label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="If enabled, each user gets their own agent/plugin set. If disabled, all users share the same global set."></i>
+                        </div>
+                        {% if settings.per_user_semantic_kernel %}
+                            <!-- Agent Feature Flags -->
+                            <div class="card p-3 mb-3" id="agent-toggles-card">
+                                <h6 class="mb-2">Workspace Feature Toggles</h6>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-user-agents" name="allow_user_agents" {% if settings.allow_user_agents %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-allow-user-agents">Allow User Agents</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage their own workspace-level agents for personal use and customization."></i>
+                                    <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_user_agents">Govern</button>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-group-agents" name="allow_group_agents" {% if settings.allow_group_agents %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-allow-group-agents">Allow Group Agents</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage group-level agents that can be shared within workgroups and teams."></i>
+                                    <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_group_agents">Govern</button>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-user-custom-endpoints" name="allow_user_custom_endpoints" {% if settings.allow_user_custom_endpoints %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-allow-user-custom-endpoints">Allow User Custom Endpoints</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to configure custom endpoints for their personal workspace agents and model endpoints."></i>
+                                    <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_user_endpoints">Govern</button>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-group-custom-endpoints" name="allow_group_custom_endpoints" {% if settings.allow_group_custom_endpoints %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-allow-group-custom-endpoints">Allow Group Custom Endpoints</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to configure custom endpoints for group workspace agents and model endpoints."></i>
+                                    <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_group_endpoints">Govern</button>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-merge-global-sk" name="merge_global_semantic_kernel_with_workspace" {% if settings.merge_global_semantic_kernel_with_workspace %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-merge-global-sk">Merge Global Agents/Plugins into Workspace</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="If enabled, workspace agents/plugins will include global ones as well."></i>
+                                </div>
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-enable-agent-template-gallery" name="enable_agent_template_gallery" {% if settings.enable_agent_template_gallery %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-enable-agent-template-gallery">Enable Agent Template Gallery</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow workspace users to browse approved templates and submit their own for review."></i>
+                                </div>
+                            </div>
+                            <!-- End Agent Feature Flags -->
+
+                        {% endif %}
+                        <!-- Orchestration Settings Card -->
+                        <div class="d-flex justify-content-between align-items-center mb-3">
+                            <h4>Agent Orchestration Settings</h4>
+                        </div>
+                        <div class="card p-3 mb-3">
+                            <p class="text-muted mb-1">Configure how the chat system orchestrates agents (single or multi-agent group chat).</p>
+                            <div class="mb-3">
+                                <label for="orchestration_type" class="form-label">Orchestration Type</label>
+                                <select class="form-select" id="orchestration_type" name="orchestration_type"></select>
+                            </div>
+                            <div class="mb-3" id="max_rounds_per_agent_group" style="display:none;">
+                                <label for="max_rounds_per_agent" class="form-label">Max Rounds Per Agent (Group Chat)</label>
+                                <input type="number" class="form-control" id="max_rounds_per_agent" name="max_rounds_per_agent" min="1" value="1">
+                            </div>
+                            <button type="button" class="btn btn-primary" id="save-orchestration-settings-btn">Save Orchestration Settings</button>
+                        </div>
+                        <div class="d-flex justify-content-between align-items-center mb-3">
+                            <h4>Global  Agents</h4>
+                            <div class="d-flex align-items-center gap-2">
+                                <button type="button" class="btn btn-outline-info btn-sm agent-examples-trigger" data-bs-toggle="modal" data-bs-target="#agentExamplesModal" data-trigger-button="#add-agent-btn">
+                                    <i class="bi bi-magic"></i>
+                                    Agent Templates
+                                </button>
+                                <button type="button" class="btn btn-primary" id="add-agent-btn">Add Agent</button>
+                            </div>
+                        </div>
+                        <p class="text-muted small">Disable a global agent to keep it saved for admins while hiding it from runtime selection until it is re-enabled.</p>
+                        <div class="mb-3 d-flex align-items-center">
+                            {% if settings.orchestration_type == "default_agent" %}
+                                <label for="default-agent-select" class="form-label me-2 mb-0">Selected Agent:</label>
+                            {% else %}
+                                <label for="default-agent-select" class="form-label me-2 mb-0">Orchestrator Agent:</label>
+                            {% endif %}
+                            <select id="default-agent-select" class="form-select w-auto" style="min-width:200px;"></select>
+                            <span id="default-agent-select-msg" class="ms-2 text-muted small"></span>
+                        </div>
+                        <table class="table table-bordered" id="agents-table">
+                            <thead>
+                                <tr>
+                                    <th>Name</th>
+                                    <th>Display Name</th>
+                                    <th>Description</th>
+                                    {% if settings.orchestration_type == "default_agent" %}
+                                        <th>Selected Agent</th>
+                                    {% else %}
+                                        <th>Orchestrator Agent</th>
+                                    {% endif %}
+                                    <th>Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="agents-table-body"></tbody>
+                        </table>
+                    </div>
+                {% endif %}
+                </div>
+
+                {% if settings.enable_agent_template_gallery %}
+                <div class="card p-3 mb-4" id="agent-template-approvals-section">
+                    <div class="row g-3 mb-3">
+                        <div class="col-xl-6">
+                            <div class="form-check form-switch mb-0">
+                                <input class="form-check-input" type="checkbox" role="switch" id="toggle-agent-template-submissions" name="agent_templates_allow_user_submission" {% if settings.agent_templates_allow_user_submission %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="toggle-agent-template-submissions">Allow User Template Submissions</label>
+                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow workspace users to submit their custom agents for review."></i>
+                            </div>
+                        </div>
+                        <div class="col-xl-6">
+                            <div class="form-check form-switch mb-0">
+                                <input class="form-check-input" type="checkbox" role="switch" id="toggle-agent-template-approval" name="agent_templates_require_approval" {% if settings.agent_templates_require_approval %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="toggle-agent-template-approval">Require Admin Approval</label>
+                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Keep user submissions pending until an admin approves them."></i>
+                            </div>
+                        </div>
+                    </div>
+                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3">
+                        <div>
+                            <h5 class="mb-1">
+                                <i class="bi bi-layers me-2"></i>Agent Template Approvals
+                            </h5>
+                            <p class="text-muted small mb-0">Template submissions are now reviewed from the shared approvals page.</p>
+                        </div>
+                        <a class="btn btn-outline-primary align-self-start align-self-lg-center" href="/approvals#agent-template-approvals">
+                            <i class="bi bi-box-arrow-up-right me-1"></i>Open Approvals Queue
+                        </a>
+                    </div>
+                </div>
+                {% endif %}
+            </div>
diff --git a/application/single_app/templates/admin/_panes/archiving.html b/application/single_app/templates/admin/_panes/archiving.html
new file mode 100644
index 000000000..d2943f47d
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/archiving.html
@@ -0,0 +1,21 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'archiving' %} show active{% endif %}" id="archiving" role="tabpanel" aria-labelledby="archiving-tab">
+                <div class="card p-3 mb-3" id="conversation-archiving-section">
+                    <h5>
+                        <i class="bi bi-archive me-2"></i>Conversation Archiving
+                    </h5>
+                    <p class="text-muted">When enabled, conversation deletions will be archived instead of permanently deleted.</p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_conversation_archiving"
+                            name="enable_conversation_archiving"
+                            {% if settings.enable_conversation_archiving %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_conversation_archiving">
+                            Enable Conversation Archiving
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Archive conversations instead of permanently deleting them, allowing for recovery and compliance with data retention policies."></i>
+                    </div>
+                </div>
+            </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/audio-video.html b/application/single_app/templates/admin/_panes/audio-video.html
new file mode 100644
index 000000000..fba46cabe
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/audio-video.html
@@ -0,0 +1,472 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'audio-video' %} show active{% endif %}" id="audio-video" role="tabpanel" aria-labelledby="audio-video-tab">
+                <div class="card p-4 mb-4 border-info shadow-sm" id="video-intelligence-section">
+                    <div class="d-flex align-items-center justify-content-between mb-3">
+                        <div class="d-flex align-items-center">
+                            <div class="bg-info text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
+                                <i class="bi bi-camera-video-fill fs-4"></i>
+                            </div>
+                            <div>
+                                <h4 class="mb-1">
+                                    <i class="bi bi-play-circle me-2"></i>AI Video Intelligence
+                                </h4>
+                                <p class="text-muted mb-0 small">Extract insights and make video content searchable and interactive</p>
+                            </div>
+                        </div>
+                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#videoIndexerInfoModal">
+                            <i class="bi bi-info-circle me-1"></i>Setup Guide
+                        </button>
+                    </div>
+
+                    <div class="alert alert-info mb-4">
+                        <i class="bi bi-lightbulb-fill me-2"></i>
+                        <strong>Make Video Content Fully Searchable:</strong> Upload videos to your workspace and automatically extract transcripts, identify speakers, detect topics, and generate searchable timestamps. Your AI can then answer questions about video content, cite specific moments, and provide deep insights.
+                    </div>
+
+                    <!-- Video File Support Toggle -->
+                    <div class="mb-4">
+                        <div class="form-check form-switch mb-2">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="enable_video_file_support"
+                                name="enable_video_file_support"
+                                {% if settings.enable_video_file_support %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2 fw-bold" for="enable_video_file_support">
+                                <i class="bi bi-camera-video me-1"></i> Enable Video File Upload & Processing
+                            </label>
+                        </div>
+                        <p class="text-muted small ms-4 ps-3 mb-2">
+                            Upload video files (MP4, AVI, MOV, etc.) to workspaces where Azure Video Indexer automatically processes them.
+                            Extract spoken content, identify speakers, detect faces, recognize brands, and generate searchable metadata—perfect for meetings, presentations, training videos, and recorded content.
+                        </p>
+                        <div class="ms-4 ps-3">
+                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
+                                <i class="bi bi-search me-1"></i> Full-Text Search
+                            </span>
+                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
+                                <i class="bi bi-person-badge me-1"></i> Speaker ID
+                            </span>
+                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
+                                <i class="bi bi-clock-history me-1"></i> Timestamped Citations
+                            </span>
+                            <span class="badge bg-primary-subtle text-primary-emphasis">
+                                <i class="bi bi-translate me-1"></i> Multi-Language
+                            </span>
+                        </div>
+                    </div>
+
+                    {% set public_video_indexer_endpoint = "https://api.videoindexer.ai" %}
+                    {% set government_video_indexer_endpoint = "https://api.videoindexer.ai.azure.us" %}
+                    {% set configured_video_indexer_endpoint = settings.video_indexer_endpoint or default_video_indexer_endpoint %}
+                    {% if configured_video_indexer_endpoint == government_video_indexer_endpoint %}
+                        {% set video_indexer_cloud = "usgovernment" %}
+                    {% elif configured_video_indexer_endpoint == public_video_indexer_endpoint %}
+                        {% set video_indexer_cloud = "public" %}
+                    {% else %}
+                        {% set video_indexer_cloud = "custom" %}
+                    {% endif %}
+                    {% if azure_environment == "usgovernment" %}
+                        {% set azure_environment_label = "Azure Government" %}
+                    {% elif azure_environment == "custom" %}
+                        {% set azure_environment_label = "Custom Cloud" %}
+                    {% else %}
+                        {% set azure_environment_label = "Azure Public / Commercial" %}
+                    {% endif %}
+
+                    <!-- Video Indexer Configuration (collapsible) -->
+                    <div id="video_indexer_settings" class="border-top pt-3{% if not settings.enable_video_file_support %} d-none{% endif %}">
+                        <h5 class="mb-3">
+                            <i class="bi bi-gear-fill me-2"></i>Azure Video Indexer Configuration
+                        </h5>
+                        <p class="text-muted small mb-3">Connect to your Azure Video Indexer resource for advanced video processing and content extraction.</p>
+
+                        <div class="alert alert-info">
+                            <strong><i class="bi bi-info-circle"></i> Identity overview:</strong>
+                            <ul class="mb-0 mt-2">
+                                <li>Video Indexer can use its own managed identity to reach the linked Storage account during account creation.</li>
+                                <li>SimpleChat authenticates to Video Indexer with the <strong>App Service system-assigned managed identity</strong>.</li>
+                                <li>The App Service managed identity must have <strong>Contributor</strong> on the Video Indexer resource.</li>
+                                <li>See <a href="https://learn.microsoft.com/azure/azure-video-indexer/connect-to-azure" target="_blank">Azure Video Indexer documentation</a> for setup details</li>
+                            </ul>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_cloud" class="form-label">Cloud / Endpoint Mode</label>
+                            <select
+                                class="form-select"
+                                id="video_indexer_cloud"
+                                data-public-endpoint="{{ public_video_indexer_endpoint }}"
+                                data-government-endpoint="{{ government_video_indexer_endpoint }}"
+                                data-runtime-cloud="{{ azure_environment }}"
+                            >
+                                <option value="public" {% if video_indexer_cloud == 'public' %}selected{% endif %}>Azure Public / Commercial</option>
+                                <option value="usgovernment" {% if video_indexer_cloud == 'usgovernment' %}selected{% endif %}>Azure Government</option>
+                                <option value="custom" {% if video_indexer_cloud == 'custom' %}selected{% endif %}>Custom Endpoint</option>
+                            </select>
+                            <div class="form-text">Choose the endpoint family that matches your deployed cloud. Use Custom only when you need a non-standard Video Indexer endpoint.</div>
+                        </div>
+
+                        <div class="alert alert-secondary py-2">
+                            <strong>Current App Service environment:</strong> {{ azure_environment_label }}. This selector saves the Video Indexer API endpoint. If you are switching between Azure Public, Azure Government, or a custom cloud, update <code>AZURE_ENVIRONMENT</code> in your App Service configuration as well.
+                        </div>
+
+                        <div class="alert alert-warning py-2 mb-3 d-none" id="video_indexer_cloud_mismatch_alert">
+                            The selected Video Indexer cloud does not match this app's current <code>AZURE_ENVIRONMENT</code>. Update the App Service configuration if you are moving to a different cloud.
+                        </div>
+
+                        <input type="hidden" id="video_indexer_endpoint" name="video_indexer_endpoint" value="{{ configured_video_indexer_endpoint }}" />
+
+                        <div class="mb-3{% if video_indexer_cloud != 'custom' %} d-none{% endif %}" id="video_indexer_custom_endpoint_group">
+                            <label for="video_indexer_custom_endpoint" class="form-label">Custom API Endpoint</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="video_indexer_custom_endpoint"
+                                value="{% if video_indexer_cloud == 'custom' %}{{ configured_video_indexer_endpoint }}{% endif %}"
+                                placeholder="https://your-video-indexer-endpoint.example.com"
+                            />
+                            <div class="form-text">Only required when using a custom cloud or non-standard Video Indexer endpoint.</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_endpoint_display" class="form-label">Effective API Endpoint</label>
+                            <input type="text" class="form-control" id="video_indexer_endpoint_display" value="{{ configured_video_indexer_endpoint }}" readonly />
+                            <div class="form-text">Saved endpoint value used for Video Indexer API calls.</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_resource_group" class="form-label">Resource Group <span class="text-danger">*</span></label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_resource_group" name="video_indexer_resource_group"
+                                value="{{ settings.video_indexer_resource_group or '' }}"
+                                placeholder="e.g., rg-videoindexer-prod">
+                            <div class="form-text">The Azure resource group containing your Video Indexer account</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_subscription_id" class="form-label">Subscription ID <span class="text-danger">*</span></label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_subscription_id" name="video_indexer_subscription_id"
+                                value="{{ settings.video_indexer_subscription_id or '' }}"
+                                placeholder="e.g., 12345678-1234-1234-1234-123456789abc">
+                            <div class="form-text">Your Azure subscription ID</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_account_name" class="form-label">Account Name <span class="text-danger">*</span></label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_account_name" name="video_indexer_account_name"
+                                value="{{ settings.video_indexer_account_name or '' }}"
+                                placeholder="e.g., my-video-indexer">
+                            <div class="form-text">The name of your Video Indexer account resource</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_location" class="form-label">Location <span class="text-danger">*</span></label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_location" name="video_indexer_location"
+                                value="{{ settings.video_indexer_location or '' }}"
+                                placeholder="e.g., eastus">
+                            <div class="form-text">Azure region where your Video Indexer account is deployed (e.g., eastus, westus2, northeurope)</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_account_id" class="form-label">Account ID <span class="text-danger">*</span></label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_account_id" name="video_indexer_account_id"
+                                value="{{ settings.video_indexer_account_id or '' }}"
+                                placeholder="e.g., 12345678-abcd-1234-abcd-123456789abc">
+                            <div class="form-text">Found in the Video Indexer account Overview page in Azure Portal</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_indexer_arm_api_version" class="form-label">ARM API Version</label>
+                            <input type="text" class="form-control"
+                                id="video_indexer_arm_api_version" name="video_indexer_arm_api_version"
+                                value="{{ settings.video_indexer_arm_api_version or default_video_indexer_arm_api_version }}">
+                            <div class="form-text">Default for {{ azure_environment_label }}: {{ default_video_indexer_arm_api_version }}</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="video_index_timeout" class="form-label">Timeout (seconds)</label>
+                            <input type="number" class="form-control"
+                                id="video_index_timeout" name="video_index_timeout"
+                                value="{{ settings.video_index_timeout or 600 }}">
+                        </div>
+                    </div>
+                </div>
+
+                    <!-- AI Voice Chat Card -->
+                    <div class="card p-4 mb-4 border-primary shadow-sm" id="ai-voice-chat-section">
+                        <div class="d-flex align-items-center justify-content-between mb-3">
+                            <div class="d-flex align-items-center">
+                                <div class="bg-primary text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
+                                    <i class="bi bi-mic-fill fs-4"></i>
+                                </div>
+                                <div>
+                                    <h4 class="mb-1">
+                                        <i class="bi bi-soundwave me-2"></i>AI Voice Conversations
+                                    </h4>
+                                    <p class="text-muted mb-0 small">Transform your AI experience with natural voice interactions</p>
+                                </div>
+                            </div>
+                            <button type="button" class="btn btn-outline-primary btn-sm" data-bs-toggle="modal" data-bs-target="#speechServiceInfoModal">
+                                <i class="bi bi-info-circle me-1"></i>Setup Guide
+                            </button>
+                        </div>
+
+                        <!-- AI Response Completion Audio -->
+                        <div class="mb-4">
+                            <div class="form-check form-switch mb-2">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="enable_chat_completion_audio_cues"
+                                    name="enable_chat_completion_audio_cues"
+                                    {% if settings.enable_chat_completion_audio_cues %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2 fw-bold" for="enable_chat_completion_audio_cues">
+                                    <i class="bi bi-bell-fill me-1"></i> Enable AI Response Completion Audio Cues
+                                </label>
+                            </div>
+                            <p class="text-muted small ms-4 ps-3 mb-0">
+                                Let users opt in to a bundled sound when an AI response finishes outside their active view.
+                                These local cues do not require Azure Speech Service.
+                            </p>
+                        </div>
+
+                        <div class="alert alert-info mb-4" id="speech_service_shared_alert">
+                            <i class="bi bi-lightbulb-fill me-2"></i>
+                            <strong>One Speech resource, three features:</strong> Audio file uploads, Voice Input, and Voice Responses all use the same Azure Speech Service section below. Configure the Speech resource once, then turn on whichever speech features you need.
+                        </div>
+
+                        <!-- Audio File Support -->
+                        <div class="mb-4">
+                            {% set audio_runtime = audio_runtime_capabilities or {} %}
+                            {% set audio_supported_extensions = audio_runtime.supported_extensions or [] %}
+                            {% set audio_direct_extensions = audio_runtime.direct_transcription_extensions or [] %}
+                            <div class="form-check form-switch mb-2">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="enable_audio_file_support"
+                                    name="enable_audio_file_support"
+                                    {% if settings.enable_audio_file_support %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2 fw-bold" for="enable_audio_file_support">
+                                    <i class="bi bi-file-earmark-music me-1"></i> Enable Audio File Upload & Processing
+                                </label>
+                            </div>
+                            <p class="text-muted small ms-4 ps-3 mb-0">
+                                Upload audio files (MP3, WAV, M4A, etc.) to workspaces where they're automatically transcribed and indexed.
+                                The AI can then search, analyze, and answer questions about audio content—perfect for meetings, interviews, lectures, and podcasts.
+                            </p>
+                            <div class="ms-4 ps-3 mt-2">
+                                <div class="small {% if audio_runtime.broad_transcoding_available %}text-success{% else %}text-warning{% endif %}" id="audio_runtime_status">
+                                    <i class="bi {% if audio_runtime.broad_transcoding_available %}bi-check-circle{% else %}bi-exclamation-triangle{% endif %} me-1"></i>{{ audio_runtime.message or 'Audio runtime support has not been checked yet.' }}
+                                </div>
+                                <div class="small text-muted mt-1" id="audio_supported_extensions">
+                                    Supported audio upload extensions: {{ audio_supported_extensions|join(', ') }}
+                                </div>
+                                {% if audio_direct_extensions %}
+                                <div class="small text-muted mt-1">
+                                    Without FFmpeg, source-file fallback is best for: {{ audio_direct_extensions|join(', ') }}. Container builds can include FFmpeg for broader codec support.
+                                </div>
+                                {% endif %}
+                            </div>
+                        </div>
+
+                        <!-- Speech-to-Text -->
+                        <div class="mb-4">
+                            <div class="form-check form-switch mb-2">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="enable_speech_to_text_input"
+                                    name="enable_speech_to_text_input"
+                                    {% if settings.enable_speech_to_text_input %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2 fw-bold" for="enable_speech_to_text_input">
+                                    <i class="bi bi-mic me-1"></i> Enable Voice Input (Speech-to-Text)
+                                </label>
+                            </div>
+                            <p class="text-muted small ms-4 ps-3 mb-2">
+                                Talk to your AI instead of typing. Record voice messages up to 90 seconds directly in the chat interface.
+                                Azure Speech Service instantly transcribes your speech with high accuracy, supporting multiple languages and accents.
+                            </p>
+                            <div class="ms-4 ps-3">
+                                <span class="badge bg-success-subtle text-success-emphasis me-2">
+                                    <i class="bi bi-hand-thumbs-up-fill me-1"></i> Hands-Free
+                                </span>
+                                <span class="badge bg-success-subtle text-success-emphasis me-2">
+                                    <i class="bi bi-universal-access me-1"></i> Accessible
+                                </span>
+                                <span class="badge bg-success-subtle text-success-emphasis">
+                                    <i class="bi bi-lightning-fill me-1"></i> Fast Input
+                                </span>
+                            </div>
+                        </div>
+
+                        <!-- Text-to-Speech -->
+                        <div class="mb-4">
+                            <div class="form-check form-switch mb-2">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="enable_text_to_speech"
+                                    name="enable_text_to_speech"
+                                    {% if settings.enable_text_to_speech %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2 fw-bold" for="enable_text_to_speech">
+                                    <i class="bi bi-volume-up me-1"></i> Enable Voice Responses (Text-to-Speech)
+                                </label>
+                            </div>
+                            <p class="text-muted small ms-4 ps-3 mb-2">
+                                Hear AI responses read aloud in natural, human-like voices powered by Azure's advanced neural Text-to-Speech.
+                                Each message includes a speaker button—click to listen while multitasking, commuting, or whenever reading isn't convenient.
+                            </p>
+                            <div class="ms-4 ps-3">
+                                <span class="badge bg-info-subtle text-info-emphasis me-2">
+                                    <i class="bi bi-ear-fill me-1"></i> Natural Voices
+                                </span>
+                                <span class="badge bg-info-subtle text-info-emphasis me-2">
+                                    <i class="bi bi-arrows-fullscreen me-1"></i> Multitask-Friendly
+                                </span>
+                                <span class="badge bg-info-subtle text-info-emphasis">
+                                    <i class="bi bi-globe me-1"></i> Multi-Language
+                                </span>
+                            </div>
+                        </div>
+
+                        <!-- Speech Service Configuration (collapsible) -->
+                        <div id="audio_service_settings" class="border-top pt-3{% if not (settings.enable_audio_file_support or settings.enable_speech_to_text_input or settings.enable_text_to_speech) %} d-none{% endif %}">
+                            <h5 class="mb-3">
+                                <i class="bi bi-gear-fill me-2"></i>Azure Speech Service Configuration
+                            </h5>
+                            <p class="text-muted small mb-3">Configure the shared Azure Speech resource used by audio transcription, voice input, and text-to-speech.</p>
+
+                        <div class="alert alert-info py-2">
+                            <strong>Shared configuration:</strong> These settings apply to all enabled speech features. If you use managed identity and also enable Voice Responses, fill in the Speech Resource ID field so the Speech SDK can authenticate synthesis requests.
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="speech_service_endpoint" class="form-label">Endpoint</label>
+                            <input type="text" class="form-control"
+                                id="speech_service_endpoint" name="speech_service_endpoint"
+                                value="{{ settings.speech_service_endpoint or '' }}"
+                                placeholder="https://<location or custom domain>.cognitiveservices.azure.<com or us>/">
+                            <div class="form-text">Use the resource-specific custom-domain endpoint when selecting Managed Identity.</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="speech_service_location" class="form-label">Location</label>
+                            <input type="text" class="form-control"
+                                id="speech_service_location" name="speech_service_location"
+                                value="{{ settings.speech_service_location or '' }}">
+                            <div class="form-text">Required for speech recognition locale defaults and for text-to-speech when using Managed Identity.</div>
+                        </div>
+
+                        <div class="mb-3{% if settings.speech_service_authentication_type != 'managed_identity' %} d-none{% endif %}" id="speech_service_resource_id_container">
+                            <div class="alert alert-secondary py-2 mb-3">
+                                <strong>Resource ID builder:</strong> If the full ARM resource ID is hard to find in the portal, enter the subscription ID, resource group, and Speech resource name below. Simple Chat can build the resource ID for you.
+                            </div>
+
+                            <div class="row g-3 mb-3">
+                                <div class="col-md-6">
+                                    <label for="speech_service_subscription_id" class="form-label">Speech Subscription ID</label>
+                                    <input type="text" class="form-control"
+                                        id="speech_service_subscription_id" name="speech_service_subscription_id"
+                                        value="{{ settings.speech_service_subscription_id or '' }}"
+                                        placeholder="12345678-1234-1234-1234-123456789abc">
+                                </div>
+                                <div class="col-md-6">
+                                    <label for="speech_service_resource_group" class="form-label">Speech Resource Group</label>
+                                    <input type="text" class="form-control"
+                                        id="speech_service_resource_group" name="speech_service_resource_group"
+                                        value="{{ settings.speech_service_resource_group or '' }}"
+                                        placeholder="rg-speech-prod">
+                                </div>
+                                <div class="col-md-6">
+                                    <label for="speech_service_resource_name" class="form-label">Speech Resource Name</label>
+                                    <input type="text" class="form-control"
+                                        id="speech_service_resource_name" name="speech_service_resource_name"
+                                        value="{{ settings.speech_service_resource_name or '' }}"
+                                        placeholder="my-speech-resource">
+                                    <div class="form-text">If you use a custom-domain Speech endpoint, this is usually the first part of that hostname.</div>
+                                </div>
+                                <div class="col-md-6 d-flex align-items-end">
+                                    <button type="button" class="btn btn-outline-secondary w-100" id="build_speech_resource_id_btn">
+                                        Build Resource ID
+                                    </button>
+                                </div>
+                            </div>
+
+                            <div class="form-text mb-2" id="speech_resource_id_builder_status">Provide Subscription ID, Resource Group, and Speech Resource Name to auto-build the ARM resource ID.</div>
+
+                            <label for="speech_service_resource_id" class="form-label">Speech Resource ID</label>
+                            <input type="text" class="form-control"
+                                id="speech_service_resource_id" name="speech_service_resource_id"
+                                value="{{ settings.speech_service_resource_id or '' }}"
+                                placeholder="/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<speech-resource>">
+                            <div class="form-text">Required for Voice Responses when using Managed Identity. You can paste the full value manually, or let the fields above build it for you.</div>
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="speech_service_locale" class="form-label">Locale</label>
+                            <input type="text" class="form-control"
+                                id="speech_service_locale" name="speech_service_locale"
+                                value="{{ settings.speech_service_locale or '' }}">
+                        </div>
+
+                        <div class="mb-3">
+                            <label for="speech_service_authentication_type" class="form-label">
+                                Authentication Type
+                            </label>
+                            <select class="form-select" id="speech_service_authentication_type" name="speech_service_authentication_type">
+                                <option value="key" {% if settings.speech_service_authentication_type == 'key' or not settings.speech_service_authentication_type %}selected{% endif %}>
+                                    Key
+                                </option>
+                                <option value="managed_identity" {% if settings.speech_service_authentication_type == 'managed_identity' %}selected{% endif %}>
+                                    Managed Identity
+                                </option>
+                            </select>
+                        </div>
+                        <div class="mb-3{% if settings.speech_service_authentication_type == 'managed_identity' %} d-none{% endif %}" id="speech_service_key_container">
+                            <label for="speech_service_key" class="form-label">
+                                API Key
+                            </label>
+                            <div class="input-group">
+                                <input
+                                    type="password"
+                                    class="form-control"
+                                    id="speech_service_key"
+                                    name="speech_service_key"
+                                    value="{{ settings.speech_service_key or '' }}"
+                                >
+                                <button
+                                    type="button"
+                                    class="btn btn-outline-secondary"
+                                    id="toggle_speech_service_key"
+                                >
+                                    Show
+                                </button>
+                            </div>
+                            <div class="form-text">Required only when Authentication Type is set to Key.</div>
+                        </div>
+
+                        <div class="alert alert-secondary mt-3 mb-0">
+                            <strong>Managed identity roles:</strong> Start with <strong>Cognitive Services Speech User</strong>. If fast transcription or other write-style speech operations still return authorization errors, add <strong>Cognitive Services Speech Contributor</strong>. Managed identity also requires a custom-domain endpoint.
+                        </div>
+
+                    </div>
+                    <p class="mt-2 mb-0">
+                        <small class="text-muted">
+                            <a href="#enhanced-citations-section" data-admin-link="enhanced-citations-section">
+                                Enhanced Citations
+                            </a>
+                             will dramatically improve the citation experience for video and audio files.
+                        </small>
+                    </p>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/backup.html b/application/single_app/templates/admin/_panes/backup.html
new file mode 100644
index 000000000..a00542658
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/backup.html
@@ -0,0 +1,323 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'backup' %} show active{% endif %}" id="backup" role="tabpanel" aria-labelledby="backup-tab" data-testid="backup-tab-pane" data-ignore-settings-change="true">
+                <div class="card p-4 mb-4 border-info shadow-sm" id="data-management-readiness-section">
+                    <div class="d-flex flex-column flex-xl-row justify-content-between gap-3 mb-3">
+                        <div>
+                            <h4 class="mb-1"><i class="bi bi-compass me-2"></i>Start Here</h4>
+                            <p class="text-muted mb-0 small">Use these checkpoints before running backup, migration, restore, or advanced repair actions.</p>
+                        </div>
+                        <button type="button" class="btn btn-outline-info align-self-start" data-bs-toggle="modal" data-bs-target="#data-management-setup-guide-modal">
+                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
+                        </button>
+                    </div>
+                    <div class="row g-3">
+                        <div class="col-xl-3 col-md-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <h5 class="h6 mb-2"><i class="bi bi-archive me-1"></i>Back up</h5>
+                                <p class="small text-muted mb-2">Configure dedicated storage, encryption, schedule, and backup scope before queueing jobs.</p>
+                                <button type="button" class="btn btn-link btn-sm p-0" data-bs-toggle="modal" data-bs-target="#data-management-backup-guide-modal">Backup setup details</button>
+                            </div>
+                        </div>
+                        <div class="col-xl-3 col-md-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <h5 class="h6 mb-2"><i class="bi bi-arrow-left-right me-1"></i>Migrate</h5>
+                                <p class="small text-muted mb-2">Connect a destination, choose who moves, run preflight, then execute a recoverable transfer.</p>
+                                <button type="button" class="btn btn-link btn-sm p-0" data-bs-toggle="modal" data-bs-target="#data-management-migration-guide-modal">Migration guide</button>
+                            </div>
+                        </div>
+                        <div class="col-xl-3 col-md-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <h5 class="h6 mb-2"><i class="bi bi-arrow-counterclockwise me-1"></i>Restore</h5>
+                                <p class="small text-muted mb-2">Review backup readiness and stage restore decisions from Backup Inventory.</p>
+                                <button type="button" class="btn btn-link btn-sm p-0" data-bs-toggle="modal" data-bs-target="#data-management-restore-guide-modal">Restore guide</button>
+                            </div>
+                        </div>
+                        <div class="col-xl-3 col-md-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <h5 class="h6 mb-2"><i class="bi bi-speedometer me-1"></i>RU Boost</h5>
+                                <p class="small text-muted mb-2">Temporarily raise eligible Cosmos capacity during approved backup or migration windows.</p>
+                                <button type="button" class="btn btn-link btn-sm p-0" data-bs-toggle="modal" data-bs-target="#data-management-ru-boost-guide-modal">RU Boost permissions</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-4 mb-4 border-primary shadow-sm" id="data-management-backup-section">
+                    <div class="d-flex align-items-center mb-3">
+                        <div class="bg-primary text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
+                            <i class="bi bi-archive fs-4"></i>
+                        </div>
+                        <div>
+                            <h4 class="mb-1">Backup</h4>
+                            <p class="text-muted mb-0 small">Configure when backups run, where artifacts are stored, and how backup files are encrypted.</p>
+                        </div>
+                    </div>
+
+                    <div class="card p-3 mb-3 border-primary-subtle" id="data-management-schedule-section">
+                        <div class="d-flex align-items-center justify-content-between mb-3">
+                            <div>
+                                <h5 class="mb-1">Schedule</h5>
+                                <p class="text-muted mb-0 small">Full backups run on the selected cadence; partial backups run daily only.</p>
+                            </div>
+                        </div>
+                        <div class="form-check form-switch mb-3">
+                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_enabled">
+                            <label class="form-check-label ms-2 fw-bold" for="data_management_enabled">Enable scheduled backups</label>
+                        </div>
+                        <div class="row g-3">
+                            <div class="col-md-4">
+                                <label class="form-label" for="data_management_full_frequency">Full backup frequency</label>
+                                <select class="form-select" id="data_management_full_frequency">
+                                    <option value="daily">Daily</option>
+                                    <option value="weekly">Weekly</option>
+                                    <option value="14_days">Every 14 days</option>
+                                    <option value="30_days">Every 30 days</option>
+                                </select>
+                            </div>
+                            <div class="col-md-4">
+                                <label class="form-label" for="data_management_scheduled_time_utc">Scheduled time (UTC)</label>
+                                <input class="form-control" type="time" id="data_management_scheduled_time_utc" value="03:00">
+                                <div class="form-text">Default is 03:00 UTC.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label class="form-label" for="data_management_retention_value">Delete backups after</label>
+                                <div class="input-group">
+                                    <input class="form-control" type="number" id="data_management_retention_value" min="1" max="3650" value="30" aria-describedby="data-management-retention-help">
+                                    <label class="visually-hidden" for="data_management_retention_unit">Retention unit</label>
+                                    <select class="form-select" id="data_management_retention_unit" aria-label="Retention unit">
+                                        <option value="days">Days</option>
+                                        <option value="weeks">Weeks</option>
+                                        <option value="months">Months</option>
+                                        <option value="years">Years</option>
+                                    </select>
+                                </div>
+                                <input type="hidden" id="data_management_retention_days" value="30">
+                                <div class="form-text" id="data-management-retention-help">Automatic cleanup keeps the newest successful full backup as a safety baseline.</div>
+                            </div>
+                        </div>
+                        <div class="row g-3 mt-1">
+                            <div class="col-md-6">
+                                <div class="form-check form-switch">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_partial_enabled" checked>
+                                    <label class="form-check-label" for="data_management_partial_enabled">Run partial backups daily between full backups</label>
+                                </div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_low_impact_mode" checked>
+                                    <label class="form-check-label" for="data_management_low_impact_mode">Use low impact mode for scheduled jobs</label>
+                                </div>
+                            </div>
+                        </div>
+                        <div class="mt-3">
+                            <button class="btn btn-outline-secondary btn-sm" type="button" data-bs-toggle="collapse" data-bs-target="#data-management-advanced-scope-drawer" aria-expanded="false" aria-controls="data-management-advanced-scope-drawer">
+                                <i class="bi bi-sliders me-1"></i>Advanced backup scope
+                            </button>
+                        </div>
+                        <div class="collapse mt-3" id="data-management-advanced-scope-drawer">
+                            <div class="card card-body border-warning-subtle bg-warning-subtle">
+                                <div class="alert alert-warning mb-3" role="alert">
+                                    <i class="bi bi-exclamation-triangle-fill me-2"></i>
+                                    These backup scope controls are advanced. Modify them at your own risk because excluding a surface can create backups that are incomplete for restore or migration scenarios.
+                                </div>
+                                <div class="row g-3">
+                                    <div class="col-md-4">
+                                        <div class="form-check form-switch">
+                                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_include_cosmos" checked aria-describedby="data-management-include-cosmos-help">
+                                            <label class="form-check-label" for="data_management_include_cosmos">
+                                                Include Cosmos DB data
+                                                <i class="bi bi-info-circle ms-1" data-bs-toggle="tooltip" title="Exports SimpleChat application records such as settings, users, workspaces, conversations, documents, agents, actions, prompts, and identities."></i>
+                                            </label>
+                                            <div class="form-text" id="data-management-include-cosmos-help">Core application records required for meaningful restore and migration.</div>
+                                        </div>
+                                    </div>
+                                    <div class="col-md-4">
+                                        <div class="form-check form-switch">
+                                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_include_ai_search" checked aria-describedby="data-management-include-ai-search-help">
+                                            <label class="form-check-label" for="data_management_include_ai_search">
+                                                Include AI Search indexes
+                                                <i class="bi bi-info-circle ms-1" data-bs-toggle="tooltip" title="Exports AI Search index schemas and retrievable documents for personal, group, and public search indexes."></i>
+                                            </label>
+                                            <div class="form-text" id="data-management-include-ai-search-help">Search index schemas and retrievable indexed documents.</div>
+                                        </div>
+                                    </div>
+                                    <div class="col-md-4">
+                                        <div class="form-check form-switch">
+                                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_include_source_blobs" aria-describedby="data-management-include-source-blobs-help data-management-source-blobs-lock-message">
+                                            <label class="form-check-label" for="data_management_include_source_blobs">
+                                                Include source document blobs
+                                                <i class="bi bi-info-circle ms-1" data-bs-toggle="tooltip" title="Copies original source files stored by Enhanced Citations. This is only available when Enhanced Citations is enabled."></i>
+                                            </label>
+                                            <div class="form-text" id="data-management-include-source-blobs-help">Original source files used by Enhanced Citations.</div>
+                                            <div class="form-text text-muted" id="data-management-source-blobs-lock-message"></div>
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="card p-3 mb-3 border-secondary-subtle" id="data-management-storage-section">
+                        <div class="d-flex align-items-center justify-content-between mb-3">
+                            <div>
+                                <h5 class="mb-1">Storage</h5>
+                                <p class="text-muted mb-0 small">Store backup artifacts in Azure Blob Storage.</p>
+                            </div>
+                            <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-test-storage-btn">
+                                <i class="bi bi-plug me-1"></i>Test Storage
+                            </button>
+                        </div>
+                        <div class="alert alert-info py-2 mb-3" id="data-management-storage-isolation-notice" role="note">
+                            <i class="bi bi-info-circle me-2"></i>
+                            Use a dedicated backup storage account. Data Management will reject storage that matches the Enhanced Citations connection string or Blob endpoint.
+                        </div>
+                        <div class="row g-3">
+                            <div class="col-md-4">
+                                <label class="form-label" for="data_management_storage_auth">Authentication</label>
+                                <select class="form-select" id="data_management_storage_auth">
+                                    <option value="managed_identity">Managed identity</option>
+                                    <option value="connection_string">Connection string</option>
+                                </select>
+                            </div>
+                            <div class="col-md-4" id="data-management-blob-endpoint-field">
+                                <label class="form-label" for="data_management_blob_endpoint">Blob endpoint</label>
+                                <input class="form-control" type="url" id="data_management_blob_endpoint" placeholder="https://account.blob.core.windows.net">
+                            </div>
+                            <div class="col-md-4">
+                                <label class="form-label" for="data_management_container_name">Container</label>
+                                <input class="form-control" type="text" id="data_management_container_name" value="simplechat-backups">
+                            </div>
+                        </div>
+                        <div class="row g-3 mt-1">
+                            <div class="col-md-8" id="data-management-connection-string-field">
+                                <label class="form-label" for="data_management_connection_string">Connection string</label>
+                                <input class="form-control" type="password" id="data_management_connection_string" autocomplete="off" placeholder="Paste a connection string to save or replace it" aria-describedby="data-management-connection-string-status">
+                                <div class="form-text" id="data-management-connection-string-status">No connection string saved yet.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label class="form-label" for="data_management_path_prefix">Blob prefix</label>
+                                <input class="form-control" type="text" id="data_management_path_prefix" value="simplechat-backups">
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="card p-3 border-info-subtle" id="data-management-encryption-section">
+                        <div class="d-flex align-items-center justify-content-between mb-3">
+                            <div>
+                                <h5 class="mb-1">Encryption</h5>
+                                <p class="text-muted mb-0 small">Generate a 256-bit backup encryption key.</p>
+                            </div>
+                            <button type="button" class="btn btn-outline-primary btn-sm" id="data-management-generate-key-btn">
+                                <i class="bi bi-key me-1"></i>Generate Key
+                            </button>
+                        </div>
+                        <div class="form-check form-switch mb-3">
+                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_encryption_enabled" checked>
+                            <label class="form-check-label" for="data_management_encryption_enabled">Encrypt backup artifacts</label>
+                        </div>
+                        <dl class="row mb-0">
+                            <dt class="col-sm-3">Key storage</dt>
+                            <dd class="col-sm-9" id="data-management-key-storage">Not configured</dd>
+                            <dt class="col-sm-3">Key reference</dt>
+                            <dd class="col-sm-9" id="data-management-key-reference">Not configured</dd>
+                        </dl>
+                        <div class="alert alert-warning d-flex align-items-start gap-2 mt-3 mb-0" id="data-management-key-storage-alert" role="status" aria-live="polite">
+                            <i class="bi bi-exclamation-triangle-fill mt-1" id="data-management-key-storage-alert-icon"></i>
+                            <div>
+                                <div class="fw-semibold" id="data-management-key-storage-alert-title">Key Vault is strongly recommended</div>
+                                <div class="small" id="data-management-key-storage-alert-message">Generated backup encryption keys are stored in the Data Management settings document when Key Vault is not enabled.</div>
+                                <a href="#keyvault-section" data-admin-link="keyvault-section" id="data-management-key-vault-link">Open Key Vault settings</a>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="card p-3 mt-3 border-success-subtle" id="data-management-backup-performance-section">
+                        <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
+                            <div>
+                                <h5 class="mb-1">Cosmos Backup Performance</h5>
+                                <p class="text-muted mb-0 small">Backups stream deterministic checkpoint batches and commit only verified work. Higher concurrency can increase source Cosmos cost and pressure.</p>
+                            </div>
+                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#data-management-ru-boost-guide-modal">
+                                <i class="bi bi-info-circle me-1"></i>RU Boost Guide
+                            </button>
+                        </div>
+
+                        <div class="card p-3 mt-3 border-info-subtle" id="data-management-blob-backup-performance-section">
+                            <div class="mb-3">
+                                <h5 class="mb-1">Source Blob Backup Performance</h5>
+                                <p class="text-muted mb-0 small">Source files stream through bounded chunks and durable per-file checkpoints. Peak transfer buffering is bounded by concurrent transfers multiplied by chunk size.</p>
+                            </div>
+                            <div class="row g-3">
+                                <div class="col-md-4">
+                                    <label class="form-label" for="data_management_backup_blob_max_parallel_operations">Concurrent blob transfers</label>
+                                    <input class="form-control" type="number" id="data_management_backup_blob_max_parallel_operations" min="1" max="8" value="4" aria-describedby="data-management-backup-blob-memory-help">
+                                </div>
+                                <div class="col-md-4">
+                                    <label class="form-label" for="data_management_backup_blob_chunk_size_mib">Transfer chunk size (MiB)</label>
+                                    <input class="form-control" type="number" id="data_management_backup_blob_chunk_size_mib" min="1" max="16" value="8" aria-describedby="data-management-backup-blob-memory-help">
+                                </div>
+                                <div class="col-md-4">
+                                    <label class="form-label" for="data_management_backup_blob_retry_count">Blob retry attempts</label>
+                                    <input class="form-control" type="number" id="data_management_backup_blob_retry_count" min="1" max="10" value="5">
+                                </div>
+                            </div>
+                            <div class="form-text mt-2" id="data-management-backup-blob-memory-help">Defaults bound application transfer buffering to approximately 32 MiB, excluding Azure SDK overhead. Throttling temporarily reduces active transfers.</div>
+                        </div>
+                        <div class="row g-3">
+                            <div class="col-md-4">
+                                <label class="form-label" for="data_management_backup_max_parallel_operations">Concurrent batch staging</label>
+                                <input class="form-control" type="number" id="data_management_backup_max_parallel_operations" min="1" max="16" value="4">
+                            </div>
+                            <div class="col-md-4">
+                                <label class="form-label" for="data_management_backup_retry_count">Retry attempts</label>
+                                <input class="form-control" type="number" id="data_management_backup_retry_count" min="1" max="10" value="5">
+                            </div>
+                            <div class="col-md-4">
+                                <label class="form-label" for="data_management_backup_capacity_failure_policy">If source RU Boost is unavailable</label>
+                                <select class="form-select" id="data_management_backup_capacity_failure_policy">
+                                    <option value="continue_without_boost">Continue without boost</option>
+                                    <option value="fail">Fail before export</option>
+                                </select>
+                            </div>
+                        </div>
+                        <div class="form-check form-switch mt-3">
+                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_backup_temporary_source_ru_enabled">
+                            <label class="form-check-label" for="data_management_backup_temporary_source_ru_enabled">Enable source RU Boost for backups</label>
+                        </div>
+                        <div class="row g-3 mt-1" id="data-management-backup-temporary-ru-field">
+                            <div class="col-md-4">
+                                <label class="form-label" for="data_management_backup_temporary_source_ru">Source RU Boost target</label>
+                                <input class="form-control" type="number" id="data_management_backup_temporary_source_ru" min="1000" max="10000" step="1000" value="10000">
+                            </div>
+                            <div class="col-md-8 d-flex align-items-end">
+                                <div class="form-text mb-2">The backup records the current source capacity, raises only eligible targets up to 10,000 RU/s, and restores the original setting after completion, cancellation, failure, or recovery. This can increase Cosmos charges and requires source ARM throughput permission.</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="card p-3 mt-3 border-success-subtle" id="data-management-backup-operations-section">
+                        <div class="d-flex flex-wrap justify-content-between align-items-start gap-3">
+                            <div>
+                                <h5 class="mb-1">Backup Operations</h5>
+                                <p class="text-muted mb-0 small">Queue immediate full or partial backup jobs using the settings above.</p>
+                            </div>
+                            <div class="d-flex flex-wrap gap-2">
+                                <button type="button" class="btn btn-primary" id="data-management-run-full-backup-btn">
+                                    <i class="bi bi-archive me-1"></i>Queue Full Backup
+                                </button>
+                                <button type="button" class="btn btn-outline-primary" id="data-management-run-partial-backup-btn">
+                                    <i class="bi bi-archive-fill me-1"></i>Queue Partial Backup
+                                </button>
+                            </div>
+                        </div>
+                        <p class="text-muted mb-0 mt-2">Jobs use Cosmos-backed leases so scaled-out App Service workers do not run the same backup twice.</p>
+                    </div>
+                </div>
+
+                <!--
+                    THESIS: Migration is an evidence-gated operation, not a long settings form; this flow refuses the three-column picker wall.
+                    OWN-WORLD: Restrained Bootstrap admin surfaces, slate neutrals, one blue action accent, and semantic amber/red/green states.
+                    STORY: Configure a destination, define exhaustive scope, choose transfer behavior, prove readiness, confirm risk, then operate the durable job.
+                    FIRST VIEWPORT: A compact six-step rail sits above one focused work area with the current task, evidence, and one next action.
+                    FORM: Established-world extension, ranked first as a control-room checkpoint flow; staging is one focused panel at a time.
+                -->
+            </div>
diff --git a/application/single_app/templates/admin/_panes/branding.html b/application/single_app/templates/admin/_panes/branding.html
new file mode 100644
index 000000000..c648c07fa
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/branding.html
@@ -0,0 +1,165 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'branding' %} show active{% endif %}" id="branding" role="tabpanel" aria-labelledby="branding-tab">
+
+                 <p class="text-muted">
+                    Configure general application settings, including the application's title, logo, and landing page text.
+                </p>
+                <div class="card p-3 mb-3" id="branding-section">
+                    <h5>
+                        <i class="bi bi-palette me-2"></i>Branding
+                    </h5>
+                    <p class="text-muted small">
+                        Configure your application's title, logo, and branding elements.
+                    </p>
+                    <div class="mb-3">
+                        <label for="app_title" class="form-label">Application Title</label>
+                        <input type="text" class="form-control" id="app_title" name="app_title" value="{{ settings.app_title }}">
+                    </div>
+                    <h6 class="mt-3">Logo Settings</h6>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox" class="form-check-input" id="show_logo" name="show_logo"
+                            {% if settings.show_logo %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="show_logo">Show Logo</label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display the application logo in the header and navigation areas of the interface."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox" class="form-check-input" id="hide_app_title" name="hide_app_title"
+                            {% if settings.hide_app_title %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="hide_app_title">Hide Application Title</label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Hide the application title from the header and navigation, showing only the logo if enabled."></i>
+                    </div>
+                    <div class="form-group mb-3">
+                        <div class="d-flex justify-content-between align-items-center">
+                            <label for="landing_page_logo_scale_percent" class="form-label mb-0">Main Page Logo Size</label>
+                            <span id="landing-page-logo-scale-value" class="small text-muted fw-semibold">{{ settings.landing_page_logo_scale_percent | default(100) }}%</span>
+                        </div>
+                        <input
+                            type="range"
+                            class="form-range"
+                            id="landing_page_logo_scale_percent"
+                            name="landing_page_logo_scale_percent"
+                            min="50"
+                            max="500"
+                            step="10"
+                            value="{{ settings.landing_page_logo_scale_percent | default(100) }}"
+                            aria-describedby="landing-page-logo-scale-help"
+                        />
+                        <div class="d-flex justify-content-between small text-muted">
+                            <span>50%</span>
+                            <span>500%</span>
+                        </div>
+                        <small id="landing-page-logo-scale-help" class="form-text text-muted">
+                            Adjust the logo size on the home page only. This does not change the logo size in the top or sidebar navigation.
+                        </small>
+                    </div>
+                    <div class="form-group mb-3">
+                        <label for="logo_file">Upload Custom Logo (Light Mode)</label>
+                        <input type="file" class="form-control" name="logo_file" id="logo_file" accept=".png,.jpg,.jpeg">
+                        <small class="form-text text-muted">This logo will be displayed in light mode and stored at up to 500px tall so the main page can render it sharply without keeping oversized assets in settings.</small>
+                    </div>
+                    <div class="form-group mb-3">
+                        <label for="logo_dark_file">Upload Custom Logo (Dark Mode)</label>
+                        <input type="file" class="form-control" name="logo_dark_file" id="logo_dark_file" accept=".png,.jpg,.jpeg">
+                        <small class="form-text text-muted">This logo will be displayed in dark mode. If not provided, the light mode logo will be used in both themes. Dark logos are also stored at up to 500px tall.</small>
+                    </div>
+                    <div class="form-group mb-3">
+                        <label for="favicon_file">Upload Custom Favicon</label>
+                        <input type="file" class="form-control" name="favicon_file" id="favicon_file" accept=".png,.jpg,.jpeg,.ico">
+                        <small class="form-text text-muted">Recommended: 16x16 or 32x32 pixel png or jpg or ico.</small>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="home-page-text-section">
+                    <h5>
+                        <i class="bi bi-house me-2"></i>Home Page Text
+                    </h5>
+                    <p class="text-muted small">Configure the text content displayed on your application's home page using Markdown formatting.</p>
+
+                    <div class="mb-3">
+                        <label for="landing_page_alignment" class="form-label">Markdown Alignment</label>
+                        <select class="form-select" id="landing_page_alignment" name="landing_page_alignment">
+                            <option value="left" {% if settings.landing_page_alignment == "left" or not settings.landing_page_alignment %}selected{% endif %}>Left</option>
+                            <option value="center" {% if settings.landing_page_alignment == "center" %}selected{% endif %}>Center</option>
+                            <option value="right" {% if settings.landing_page_alignment == "right" %}selected{% endif %}>Right</option>
+                        </select>
+                        <small class="form-text text-muted">Choose how the landing page markdown is aligned on the home page.</small>
+                    </div>
+
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="toggleLandingPageEditor"
+                            name="enable_landing_page_editor"
+                            {% if settings.enable_landing_page_editor %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="toggleLandingPageEditor">
+                            Enable Markdown Editor
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the markdown editor for editing landing page content, otherwise text will be displayed as read-only preview."></i>
+                    </div>
+
+                    <div id="landingPageEditorContainer" style="display: none;">
+                        <textarea
+                            class="form-control"
+                            id="landing_page_text_editor"
+                            name="landing_page_text"
+                            rows="5"
+                        >{{ settings.landing_page_text }}</textarea>
+                    </div>
+
+                    <div
+                        id="landingPageMarkdownPreview"
+                        class="p-2 border rounded"
+                        style="white-space: pre-wrap; display: none;"
+                    ></div>
+                </div>
+
+                <div class="card p-3 mb-3" id="appearance-section">
+                    <h5>
+                        <i class="bi bi-brush me-2"></i>Appearance
+                    </h5>
+                    <p class="text-muted small">Configure the app appearance and theme settings.</p>
+
+                    <div class="mb-3">
+                        <label class="form-label">Default Theme</label>
+                        <div class="form-group form-check form-switch mb-3">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="enable_dark_mode_default"
+                                name="enable_dark_mode_default"
+                                {% if settings.enable_dark_mode_default %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="enable_dark_mode_default">
+                                Enable Dark Mode by Default
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Set dark mode as the default theme for new users. Users can still toggle between themes individually."></i>
+                        </div>
+                        <p class="text-muted small">Users can still toggle dark mode individually from the navigation bar.</p>
+                    </div>
+
+                    <div class="mb-3">
+                        <label class="form-label">Default Navigation</label>
+                        <div class="form-group form-check form-switch mb-3">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="enable_left_nav_default"
+                                name="enable_left_nav_default"
+                                {% if settings.enable_left_nav_default %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="enable_left_nav_default">
+                                Enable Left Nav by Default
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show the left navigation sidebar by default for new users. Users can still toggle the sidebar visibility individually."></i>
+                        </div>
+                        <p class="text-muted small">Users can still toggle the left navigation sidebar individually from the header.</p>
+                    </div>
+                </div>
+
+
+
+
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/chat-experience.html b/application/single_app/templates/admin/_panes/chat-experience.html
new file mode 100644
index 000000000..9073b87ba
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/chat-experience.html
@@ -0,0 +1,130 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'chat-experience' %} show active{% endif %}" id="chat-experience" role="tabpanel" aria-labelledby="chat-experience-tab">
+                <div class="card p-3 mb-4" id="processing-thoughts-section">
+                    <h5>
+                        <i class="bi bi-stars me-2"></i>Processing Thoughts
+                    </h5>
+                    <p class="text-muted">When enabled, real-time processing steps are shown to users during chat responses and persisted for later review.</p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_thoughts"
+                            name="enable_thoughts"
+                            {% if settings.enable_thoughts %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_thoughts">
+                            Enable Processing Thoughts
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show real-time processing steps (searching documents, web search, agent calls, etc.) to users during chat. Steps are stored in Cosmos DB and can be reviewed per-message via a stars icon."></i>
+                    </div>
+                </div>
+
+                <!-- Shared Conversation File Approvals Section -->
+                <div class="card mb-3 p-3" id="chat-file-uploads-section">
+                    <h5>
+                        <i class="bi bi-paperclip me-2"></i>Chat File Uploads
+                    </h5>
+                    <p class="text-muted">
+                        Control whether users can upload files directly into chat conversations.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_chat_file_uploads"
+                            name="enable_chat_file_uploads"
+                            {% if settings.enable_chat_file_uploads %}checked{% endif %} />
+                        <label class="form-check-label ms-2" for="enable_chat_file_uploads">
+                            Enable Chat File Uploads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to upload files directly into personal, group, and multi-user chat conversations."></i>
+                    </div>
+
+                    <div class="card mb-3 p-3" id="conversation-contents-drawer-section">
+                        <h5>
+                            <i class="bi bi-list-nested me-2"></i>Conversation Contents Drawer
+                        </h5>
+                        <p class="text-muted">
+                            Let users navigate long conversations from a list of their prompts.
+                        </p>
+                        <div class="form-group form-check form-switch mb-2">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="enable_conversation_contents_drawer"
+                                name="enable_conversation_contents_drawer"
+                                {% if settings.enable_conversation_contents_drawer %}checked{% endif %}
+                            />
+                            <label class="form-check-label ms-2" for="enable_conversation_contents_drawer">
+                                Enable Conversation Contents Drawer
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to open a responsive contents drawer that lists persisted user messages and jumps to them."></i>
+                        </div>
+                        <p class="text-muted small mb-0">
+                            When enabled, users can turn the drawer off for their own account from Profile settings.
+                        </p>
+                    </div>
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_chat_file_upload_user"
+                            name="require_member_of_chat_file_upload_user"
+                            {% if settings.require_member_of_chat_file_upload_user %}checked{% endif %} />
+                        <label class="form-check-label ms-2" for="require_member_of_chat_file_upload_user">
+                            Require ChatFileUploadUser App Role
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the ChatFileUploadUser Enterprise App role can upload files into chat."></i>
+                    </div>
+                    <p class="text-muted small mb-0">
+                        Required app role value: <code>ChatFileUploadUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. Existing chat attachments remain visible; this only controls new uploads.
+                    </p>
+                </div>
+                <div class="card mb-3 p-3" id="workspace-scope-lock-section">
+                    <h5>
+                        <i class="bi bi-lock me-2"></i>Workspace Scope Lock
+                    </h5>
+                    <p class="text-muted">
+                        Control whether users can unlock workspace scope in chat conversations. When scope is locked, conversations are restricted to the workspaces that produced search results, preventing accidental cross-contamination with other data sources.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enforce_workspace_scope_lock"
+                            name="enforce_workspace_scope_lock"
+                            {% if settings.enforce_workspace_scope_lock %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enforce_workspace_scope_lock">
+                            Enforce Workspace Scope Lock
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users cannot unlock the workspace scope on conversations. Scope automatically locks after the first AI search and remains locked. Disable this to allow users to manually unlock scope."></i>
+                    </div>
+                </div>
+                <div class="card p-3 mb-3" id="conversation-history-section">
+                    <h5>
+                        <i class="bi bi-clock-history me-2"></i>Conversation History
+                    </h5>
+                    <p class="text-muted">
+                        How many previous messages are carried into each new request.
+                    </p>
+                    <div class="mb-3">
+                        <label for="conversation_history_limit" class="form-label">
+                            Conversation History Limit
+                        </label>
+                        <input type="number" class="form-control" id="conversation_history_limit"
+                            name="conversation_history_limit" value="{{ settings.conversation_history_limit }}">
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="default-system-prompt-section">
+                    <h5>
+                        <i class="bi bi-chat-square-quote me-2"></i>Default System Prompt
+                    </h5>
+                    <p class="text-muted">
+                        The system prompt applied to conversations that do not set their own.
+                    </p>
+                    <div class="mb-3">
+                        <label for="default_system_prompt" class="form-label">Default System Prompt</label>
+                        <textarea class="form-control" id="default_system_prompt" name="default_system_prompt"
+                            rows="5">{{ settings.default_system_prompt }}</textarea>
+                    </div>
+                </div>
+
+            </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/citation.html b/application/single_app/templates/admin/_panes/citation.html
new file mode 100644
index 000000000..4d42286e9
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/citation.html
@@ -0,0 +1,244 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'citation' %} show active{% endif %}" id="citation" role="tabpanel" aria-labelledby="citation-tab">
+
+                 <p class="text-muted">
+                    Configure standard and enhanced citations features for your and group workspaces.
+                </p>
+
+
+                <div class="card p-3 mb-3" id="standard-citations-section">
+                    <h5>
+                        <i class="bi bi-quote me-2"></i>Standard Citations
+                    </h5>
+                    <p class="text-muted">
+                        Standard citations is always enabled for both Your Workspace and Group Workspace.
+                    </p>
+                    <p class="mb-0">
+                        Users can see text content of the source/citation for documents.
+                    </p>
+                </div>
+
+
+                <div class="card p-3" id="enhanced-citations-section">
+                    <h5>
+                        <i class="bi bi-star me-2"></i>Enhanced Citations
+                    </h5>
+                    <p class="text-muted mb-2">
+                        Enable Enhanced Citation to store files in a Storage Account,
+                        and show direct references (Preview feature, files are saved to storage, presentation
+                        layer will be available in a future release).
+                    </p>
+
+                    {% set ec_storage_status = settings.enhanced_citations_storage_status or {} %}
+                    {% set ec_storage_state = ec_storage_status.state or 'not_initialized' %}
+                    {% if settings.enable_enhanced_citations %}
+                    <div
+                        class="alert {% if ec_storage_state in ['initialization_failed', 'not_initialized'] %}alert-warning{% else %}alert-info{% endif %} mb-3"
+                        id="enhanced-citations-storage-startup-status"
+                    >
+                        <div class="fw-semibold">Enhanced Citations storage startup status</div>
+                        <div>{{ ec_storage_status.message or 'Enhanced Citations storage status is not available for this process.' }}</div>
+                        <div class="small mt-1">
+                            Startup skips live storage container checks so storage outages do not block application boot.
+                            Use the connection test to validate current storage reachability and container access.
+                        </div>
+                        <button
+                            type="button"
+                            class="btn btn-outline-secondary btn-sm mt-2"
+                            id="test_enhanced_citations_storage_button"
+                        >
+                            Test Enhanced Citations Storage
+                        </button>
+                        <div class="mt-2" id="test_enhanced_citations_storage_result"></div>
+                    </div>
+                    {% endif %}
+
+
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_enhanced_citations"
+                            name="enable_enhanced_citations"
+                            {% if settings.enable_enhanced_citations %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_enhanced_citations">
+                            Enable Enhanced Citations
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Store original files in Azure Storage and provide direct file references and previews in citations for improved source tracking."></i>
+                    </div>
+
+
+                    <div id="enhanced_citation_settings" style="display: none;">
+
+                        <div class="card mb-3 p-3">
+                            <h6><strong>All filetypes</strong></h6>
+                            <div class="mb-3">
+                                <label for="office_docs_authentication_type" class="form-label">
+                                    Storage Account Authentication Type
+                                </label>
+                                <select class="form-select" id="office_docs_authentication_type" name="office_docs_authentication_type">
+                                    <option value="key" {% if settings.office_docs_authentication_type == "key" or not settings.office_docs_authentication_type %}selected{% endif %}>Connection String</option>
+                                    <option value="managed_identity" {% if settings.office_docs_authentication_type == "managed_identity" %}selected{% endif %}>Managed Identity</option>
+                                </select>
+                            </div>
+
+                            <div class="mb-3" id="office_docs_storage_conn_str_group" {% if settings.office_docs_authentication_type == "managed_identity" %}style="display:none;"{% endif %}>
+                                <label for="office_docs_storage_account_url" class="form-label">
+                                    Storage Account Connection String
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="office_docs_storage_account_url"
+                                        name="office_docs_storage_account_url"
+                                        value="{{ settings.office_docs_storage_account_url or '' }}"
+                                    >
+                                    <button type="button" class="btn btn-outline-secondary" id="toggle_office_conn_str">Show</button>
+                                </div>
+                            </div>
+
+                            <div class="mb-3" id="office_docs_storage_url_group" {% if settings.office_docs_authentication_type != "managed_identity" %}style="display:none;"{% endif %}>
+                                <label for="office_docs_storage_account_blob_endpoint" class="form-label">
+                                    Storage Account Blob Service Endpoint
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="office_docs_storage_account_blob_endpoint"
+                                        name="office_docs_storage_account_blob_endpoint"
+                                        value="{{ settings.office_docs_storage_account_blob_endpoint or '' }}"
+                                    >
+                                    <button type="button" class="btn btn-outline-secondary" id="toggle_office_url">Show</button>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="card mb-3 p-3">
+                            <h6><strong>Tabular Preview Limits</strong></h6>
+                            <div class="mb-3">
+                                <label for="tabular_preview_max_blob_size_mb" class="form-label">
+                                    Maximum File Size for Tabular Preview (MB)
+                                </label>
+                                <input type="number" class="form-control" id="tabular_preview_max_blob_size_mb"
+                                    name="tabular_preview_max_blob_size_mb"
+                                    min="1" max="1024"
+                                    value="{{ settings.tabular_preview_max_blob_size_mb or 200 }}">
+                                <small class="form-text text-muted">
+                                    Maximum blob size (in MB) allowed for tabular file previews (CSV, XLSX). Files larger than this will not be previewed.
+                                    Increase for larger files if your compute has sufficient memory, or decrease to protect smaller instances. Default: 200 MB.
+                                </small>
+                            </div>
+                            <hr>
+                            <h6><strong>Large Tabular Run Controls</strong></h6>
+                            <div class="form-check form-switch mb-3">
+                                <input class="form-check-input" type="checkbox" role="switch" id="enable_tabular_durable_run_confirmation" name="enable_tabular_durable_run_confirmation" {% if settings.enable_tabular_durable_run_confirmation | default(true) %}checked{% endif %}>
+                                <label class="form-check-label" for="enable_tabular_durable_run_confirmation">Confirm very large row-level runs before starting</label>
+                                <div class="form-text">When a prompt includes an explicit large row count, users are asked to continue or narrow scope before the run starts.</div>
+                            </div>
+                            <div class="row g-3 mb-3">
+                                <div class="col-md-6">
+                                    <label for="tabular_durable_run_confirmation_threshold_rows" class="form-label">Confirmation Row Threshold</label>
+                                    <input type="number" class="form-control" id="tabular_durable_run_confirmation_threshold_rows" name="tabular_durable_run_confirmation_threshold_rows" min="1" max="1000000" value="{{ settings.tabular_durable_run_confirmation_threshold_rows | default(500, true) }}">
+                                </div>
+                                <div class="col-md-6">
+                                    <label for="tabular_durable_run_confirmation_threshold_batches" class="form-label">Confirmation Batch Threshold</label>
+                                    <input type="number" class="form-control" id="tabular_durable_run_confirmation_threshold_batches" name="tabular_durable_run_confirmation_threshold_batches" min="1" max="100000" value="{{ settings.tabular_durable_run_confirmation_threshold_batches | default(75, true) }}">
+                                </div>
+                            </div>
+                            <div class="row g-3">
+                                <div class="col-md-6">
+                                    <label for="tabular_generated_output_chunk_model_mode" class="form-label">Chunk Processing Model</label>
+                                    <select class="form-select" id="tabular_generated_output_chunk_model_mode" name="tabular_generated_output_chunk_model_mode">
+                                        <option value="current" {% if settings.tabular_generated_output_chunk_model_mode | default('current', true) != 'configured' %}selected{% endif %}>Use the user's selected model</option>
+                                        <option value="configured" {% if settings.tabular_generated_output_chunk_model_mode | default('current', true) == 'configured' %}selected{% endif %}>Use a configured deployment for chunk work</option>
+                                    </select>
+                                </div>
+                                <div class="col-md-6">
+                                    <label for="tabular_generated_output_chunk_model_deployment" class="form-label">Configured Chunk Model Deployment</label>
+                                    <input type="text" class="form-control" id="tabular_generated_output_chunk_model_deployment" name="tabular_generated_output_chunk_model_deployment" maxlength="120" value="{{ settings.tabular_generated_output_chunk_model_deployment | default('', true) }}" autocomplete="off">
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <!-- <div class="card mb-3 p-3">
+                            <h6><strong>Video Files</strong></h6>
+                            {% if settings.enable_video_file_support %}
+
+                                <div class="mb-3">
+                                    <label for="video_files_storage_account_url" class="form-label">
+                                        Storage Account Connection String
+                                    </label>
+
+                                    <div class="input-group">
+                                        <input
+                                            type="password"
+                                            class="form-control"
+                                            id="video_files_storage_account_url"
+                                            name="video_files_storage_account_url"
+                                            value="{{ settings.video_files_storage_account_url or '' }}"
+                                        >
+                                        <button type="button" class="btn btn-outline-secondary" id="toggle_video_conn_str">Show</button>
+                                    </div>
+
+                                </div>
+                            {% else %}
+
+                                <p class="text-danger mb-1">
+                                    Video support is currently disabled in the Workspaces tab.
+                                </p>
+                                <p class="mt-2 mb-0">
+                                    <small class="text-muted">
+                                        Reference:
+                                        <a href="#video-intelligence-section" data-admin-link="video-intelligence-section">
+                                            Enable Video File Support
+                                        </a>
+                                        (see AI Video Intelligence under Search and Extract)
+                                    </small>
+                                </p>
+                            {% endif %}
+                        </div>
+
+
+                        <div class="card mb-3 p-3">
+                            <h6><strong>Audio Files</strong></h6>
+                            {% if settings.enable_audio_file_support %}
+
+                                <div class="mb-3">
+                                    <label for="audio_files_storage_account_url" class="form-label">
+                                        Storage Account Connection String
+                                    </label>
+
+                                    <div class="input-group">
+                                        <input
+                                            type="password"
+                                            class="form-control"
+                                            id="audio_files_storage_account_url"
+                                            name="audio_files_storage_account_url"
+                                            value="{{ settings.audio_files_storage_account_url or '' }}"
+                                        >
+                                        <button type="button" class="btn btn-outline-secondary" id="toggle_audio_conn_str">Show</button>
+                                    </div>
+
+                                </div>
+                            {% else %}
+
+                                <p class="text-danger mb-1">
+                                    Audio support is currently disabled in the Workspaces tab.
+                                </p>
+                                <p class="mt-2 mb-0">
+                                    <small class="text-muted">
+                                        Reference:
+                                        <a href="#ai-voice-chat-section" data-admin-link="ai-voice-chat-section">
+                                            Enable Audio File Support
+                                        </a>
+                                        (see AI Voice Conversations under Search and Extract)
+                                    </small>
+                                </p>
+                            {% endif %}
+                        </div> -->
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/classification.html b/application/single_app/templates/admin/_panes/classification.html
new file mode 100644
index 000000000..8a4dc6e11
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/classification.html
@@ -0,0 +1,45 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'classification' %} show active{% endif %}" id="classification" role="tabpanel" aria-labelledby="classification-tab">
+                <div class="card mb-3 p-3" id="document-classification-section">
+                    <h5>
+                        <i class="bi bi-tags me-2"></i>Document Classification
+                    </h5>
+                    <p class="text-muted">
+                        Enable this feature to allow users to classify documents uploaded to their workspaces using predefined categories.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_document_classification"
+                            name="enable_document_classification"
+                            {% if settings.enable_document_classification %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_document_classification">
+                            Enable Document Classification
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to classify uploaded documents with predefined categories for better organization and search filtering."></i>
+                    </div>
+
+
+                    <div id="document_classification_settings" {% if not settings.enable_document_classification %}style="display: none;"{% endif %}>
+                        <h6>Classification Categories</h6>
+                        <p class="text-muted small">Define the labels and corresponding colors for document classification.</p>
+                        <table class="table table-sm table-bordered">
+                            <thead class="table-light">
+                                <tr>
+                                    <th style="width: 50%;">Label</th>
+                                    <th style="width: 30%;">Color</th>
+                                    <th style="width: 20%;">Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="classification-categories-tbody">
+
+                            </tbody>
+                        </table>
+                        <button type="button" id="add-classification-btn" class="btn btn-success btn-sm mt-2">
+                            <i class="bi bi-plus-circle"></i> Add New Category
+                        </button>
+
+                        <input type="hidden" name="document_classification_categories_json" id="document_classification_categories_json">
+                    </div>
+                </div>
+            </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/content-safety.html b/application/single_app/templates/admin/_panes/content-safety.html
new file mode 100644
index 000000000..88eae95bb
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/content-safety.html
@@ -0,0 +1,181 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'content-safety' %} show active{% endif %}" id="content-safety" role="tabpanel" aria-labelledby="content-safety-tab">
+
+                 <p class="text-muted">
+                    Configure content safety, archiving, and user feedback settings. If Content Safety is enabled, user
+                    messages will be sent to the safety endpoint for analysis. If User Feedback is enabled, users will see
+                    thumbs up/down to provide feedback on AI responses.
+                </p>
+                <div class="card p-3 mb-3" id="content-safety-section">
+                    <h5>
+                        <i class="bi bi-shield-exclamation me-2"></i>Content Safety
+                    </h5>
+                    <p class="text-muted">Enable content safety to filter out inappropriate content.</p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_content_safety"
+                            name="enable_content_safety"
+                            {% if settings.enable_content_safety %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_content_safety">
+                            Enable Content Safety
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Filter user messages and AI responses through Azure Content Safety service to detect and block inappropriate content."></i>
+                    </div>
+
+
+                    <div id="content_safety_settings"
+                         {% if not settings.enable_content_safety %}style="display: none;"{% endif %}>
+
+
+                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                            <input
+                                type="checkbox"
+                                class="form-check-input me-2"
+                                id="enable_content_safety_apim"
+                                name="enable_content_safety_apim"
+                                {% if settings.enable_content_safety_apim %}checked{% endif %}
+                            >
+                            <label class="form-check-label" for="enable_content_safety_apim">
+                                Use APIM instead of direct Content Safety endpoint
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route content safety requests through Azure API Management instead of directly to the Content Safety service for centralized monitoring and control."></i>
+                        </div>
+
+
+                        <div id="non_apim_content_safety_settings"
+                             {% if settings.enable_content_safety_apim %}style="display: none;"{% endif %}>
+                            <div class="mb-3">
+                                <label for="content_safety_endpoint" class="form-label">
+                                    Content Safety Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="content_safety_endpoint"
+                                    name="content_safety_endpoint"
+                                    value="{{ settings.content_safety_endpoint or '' }}"
+                                >
+                            </div>
+                            <div class="mb-3">
+                                <label for="content_safety_authentication_type" class="form-label">
+                                    Authentication Type
+                                </label>
+                                <select class="form-select" id="content_safety_authentication_type" name="content_safety_authentication_type">
+                                    <option value="key" {% if settings.content_safety_authentication_type=='key' %}selected{% endif %}>
+                                        Key
+                                    </option>
+                                    <option value="managed_identity" {% if settings.content_safety_authentication_type=='managed_identity' %}selected{% endif %}>
+                                        Managed Identity
+                                    </option>
+                                </select>
+                            </div>
+                            <div class="mb-3" id="content_safety_key_container" {% if settings.content_safety_authentication_type !='key' %}style="display: none;"{% endif %}>
+                                <label for="content_safety_key" class="form-label">
+                                    Content Safety Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="content_safety_key"
+                                        name="content_safety_key"
+                                        value="{{ settings.content_safety_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_content_safety_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <div id="apim_content_safety_settings"
+                             {% if not settings.enable_content_safety_apim %}style="display: none;"{% endif %}>
+                            <div class="mb-3">
+                                <label for="azure_apim_content_safety_endpoint" class="form-label">
+                                    Azure APIM Content Safety Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_apim_content_safety_endpoint"
+                                    name="azure_apim_content_safety_endpoint"
+                                    value="{{ settings.azure_apim_content_safety_endpoint or '' }}"
+                                >
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_apim_content_safety_subscription_key" class="form-label">
+                                    Azure APIM Content Safety Subscription Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_apim_content_safety_subscription_key"
+                                        name="azure_apim_content_safety_subscription_key"
+                                        value="{{ settings.azure_apim_content_safety_subscription_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_azure_apim_content_safety_subscription_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <div class="mb-3">
+                            <label for="content_safety_violation_message" class="form-label">
+                                Safety Violation Message <span class="text-muted fw-normal">(Markdown supported)</span>
+                            </label>
+                            <textarea
+                                class="form-control"
+                                id="content_safety_violation_message"
+                                name="content_safety_violation_message"
+                                rows="4"
+                                maxlength="3000"
+                                placeholder="Your message was blocked by Content Safety."
+                            >{{ settings.content_safety_violation_message or '' }}</textarea>
+                            <div class="form-text">Displayed when Content Safety blocks a chat message.</div>
+                        </div>
+
+                        <div class="form-group form-check form-switch mb-2">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="content_safety_include_trigger_information"
+                                name="content_safety_include_trigger_information"
+                                {% if settings.content_safety_include_trigger_information %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="content_safety_include_trigger_information">
+                                Include Trigger Information
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show the reason, detected categories and severities, and blocklist matches below the safety message."></i>
+                        </div>
+                        <p class="form-text text-muted mb-3">Disable this option to show only the configured message.</p>
+
+                        <button type="button" class="btn btn-secondary mt-3" id="test_safety_button">
+                            Test Safety Connection
+                        </button>
+                        <div id="test_safety_result" class="mt-2"></div>
+                    </div>
+                </div>
+
+
+
+
+
+
+
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/control-center-config.html b/application/single_app/templates/admin/_panes/control-center-config.html
new file mode 100644
index 000000000..6567e5537
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/control-center-config.html
@@ -0,0 +1,180 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'control-center-config' %} show active{% endif %}" id="control-center-config" role="tabpanel" aria-labelledby="control-center-config-tab">
+                <p class="text-muted">
+                    Configure Control Center access and permissions for administrators.
+                </p>
+
+                <div class="card p-4 mb-4 border-primary shadow-sm" id="control-center-auto-refresh-section">
+                    <div class="d-flex align-items-center justify-content-between mb-3">
+                        <div class="d-flex align-items-center">
+                            <div class="bg-primary text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
+                                <i class="bi bi-arrow-repeat fs-4"></i>
+                            </div>
+                            <div>
+                                <h4 class="mb-1">
+                                    <i class="bi bi-calendar-check me-2"></i>Automatic Data Refresh
+                                </h4>
+                                <p class="text-muted mb-0 small">Run the Control Center metrics refresh overnight on a daily timezone-aware schedule</p>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            role="switch"
+                            id="control_center_auto_refresh_enabled"
+                            name="control_center_auto_refresh_enabled"
+                            {% if settings.control_center_auto_refresh_enabled %}checked{% endif %}
+                        />
+                        <label class="form-check-label ms-2 fw-bold" for="control_center_auto_refresh_enabled">
+                            Enable Daily Control Center Refresh
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Automatically refresh cached Control Center metrics once per day. Execution timestamps are stored in UTC."></i>
+                    </div>
+
+                    <div id="control-center-auto-refresh-inputs" class="row g-3 {% if not settings.control_center_auto_refresh_enabled %}d-none{% endif %}">
+                        <div class="col-md-4">
+                            <label for="control_center_auto_refresh_time" class="form-label">
+                                Refresh Time ({{ settings.control_center_auto_refresh_timezone or 'America/New_York' }})
+                            </label>
+                            <input
+                                type="time"
+                                class="form-control"
+                                id="control_center_auto_refresh_time"
+                                name="control_center_auto_refresh_time"
+                                value="{{ settings.control_center_auto_refresh_time or '02:00' }}"
+                            />
+                            <input
+                                type="hidden"
+                                id="control_center_auto_refresh_timezone"
+                                name="control_center_auto_refresh_timezone"
+                                value="{{ settings.control_center_auto_refresh_timezone or 'America/New_York' }}"
+                            />
+                            <div class="form-text">
+                                Your browser timezone is <span id="control-center-auto-refresh-viewer-timezone">local time</span>.
+                            </div>
+                        </div>
+                        <div class="col-md-8">
+                            <label class="form-label">Next scheduled refresh:</label>
+                            <div
+                                id="control-center-auto-refresh-next-run"
+                                class="form-control-plaintext text-info fw-bold"
+                                data-next-run-utc="{{ settings.control_center_auto_refresh_next_run or '' }}"
+                            >
+                                {% if settings.control_center_auto_refresh_next_run %}
+                                    Loading local time...
+                                {% else %}
+                                    Will be calculated when saved
+                                {% endif %}
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- Control Center Overview Card -->
+                <div class="card p-4 mb-4 border-success shadow-sm" id="control-center-overview-section">
+                    <div class="d-flex align-items-center justify-content-between mb-3">
+                        <div class="d-flex align-items-center">
+                            <div class="bg-success text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
+                                <i class="bi bi-speedometer2 fs-4"></i>
+                            </div>
+                            <div>
+                                <h4 class="mb-1">
+                                    <i class="bi bi-gear-wide-connected me-2"></i>Control Center Access
+                                </h4>
+                                <p class="text-muted mb-0 small">Manage who can access Control Center features and administrative tools</p>
+                            </div>
+                        </div>
+                        <button type="button" class="btn btn-outline-success btn-sm" data-bs-toggle="modal" data-bs-target="#controlCenterRolesInfoModal">
+                            <i class="bi bi-question-circle me-1"></i>Role Setup Guide
+                        </button>
+                    </div>
+
+                    <div class="alert alert-info mb-4">
+                        <i class="bi bi-info-circle-fill me-2"></i>
+                        <strong>About Control Center:</strong> The Control Center is a powerful administrative dashboard that provides user management, group oversight, public workspace control, and detailed activity monitoring. Use role-based access controls below to delegate administrative responsibilities.
+                    </div>
+
+                    <!-- ControlCenterAdmin Role -->
+                    <div class="mb-4">
+                        <div class="form-check form-switch mb-2">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="require_member_of_control_center_admin"
+                                name="require_member_of_control_center_admin"
+                                {% if settings.require_member_of_control_center_admin %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2 fw-bold" for="require_member_of_control_center_admin">
+                                <i class="bi bi-shield-fill-check me-1"></i> Require ControlCenterAdmin App Role
+                            </label>
+                        </div>
+                        <p class="text-muted small ms-4 ps-3 mb-2">
+                            Required app role value: <code>ControlCenterAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only users assigned this role can access the Control Center and all management features. Regular Admins will lose access.
+                        </p>
+                        <div class="ms-4 ps-3">
+                            <span class="badge bg-success-subtle text-success-emphasis me-2">
+                                <i class="bi bi-people-fill me-1"></i> User Management
+                            </span>
+                            <span class="badge bg-success-subtle text-success-emphasis me-2">
+                                <i class="bi bi-collection me-1"></i> Group Management
+                            </span>
+                            <span class="badge bg-success-subtle text-success-emphasis me-2">
+                                <i class="bi bi-folder2-open me-1"></i> Public Workspaces
+                            </span>
+                            <span class="badge bg-success-subtle text-success-emphasis">
+                                <i class="bi bi-clock-history me-1"></i> Activity Logs
+                            </span>
+                        </div>
+                    </div>
+
+                    <!-- ControlCenterDashboardReader Role -->
+                    <div class="mb-4">
+                        <div class="form-check form-switch mb-2">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="require_member_of_control_center_dashboard_reader"
+                                name="require_member_of_control_center_dashboard_reader"
+                                {% if settings.require_member_of_control_center_dashboard_reader %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2 fw-bold" for="require_member_of_control_center_dashboard_reader">
+                                <i class="bi bi-eye me-1"></i> Allow ControlCenterDashboardReader App Role
+                            </label>
+                        </div>
+                        <p class="text-muted small ms-4 ps-3 mb-2">
+                            Dashboard-only app role value: <code>ControlCenterDashboardReader</code>. Assign this role to users or groups in the Enterprise App before enabling dashboard-only access. Users assigned <code>ControlCenterAdmin</code> can also access the dashboard when Control Center app-role enforcement is enabled.
+                        </p>
+                        <div class="ms-4 ps-3">
+                            <span class="badge bg-info-subtle text-info-emphasis me-2">
+                                <i class="bi bi-speedometer2 me-1"></i> Dashboard Statistics
+                            </span>
+                            <span class="badge bg-info-subtle text-info-emphasis me-2">
+                                <i class="bi bi-graph-up me-1"></i> Activity Trends
+                            </span>
+                            <span class="badge bg-info-subtle text-info-emphasis">
+                                <i class="bi bi-bar-chart-line me-1"></i> Usage Metrics
+                            </span>
+                        </div>
+                    </div>
+
+                    <div class="alert alert-warning-subtle border-warning mb-3">
+                        <i class="bi bi-exclamation-triangle-fill me-2"></i>
+                        <strong>Important:</strong> Configure these roles in your identity provider (Entra ID). When role requirements are enabled, standard Admins without the specific roles will be denied access to Control Center features.
+                    </div>
+
+                    <!-- Best Practices -->
+                    <div class="border-top pt-3">
+                        <h5 class="mb-3">
+                            <i class="bi bi-lightbulb-fill me-2"></i>Best Practices
+                        </h5>
+                        <ul class="text-muted small">
+                            <li><code>ControlCenterAdmin</code>: Grant to IT administrators who need full control over users, groups, and workspaces</li>
+                            <li><code>ControlCenterDashboardReader</code>: Grant to managers, compliance officers, or stakeholders who need visibility into platform usage without administrative powers</li>
+                            <li><strong>Separation of Duties:</strong> Enable role requirements if you need to restrict Control Center access from general application admins</li>
+                            <li><strong>Audit Trail:</strong> All Control Center actions are logged in Activity Logs for compliance and security auditing</li>
+                        </ul>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/cosmos-editor.html b/application/single_app/templates/admin/_panes/cosmos-editor.html
new file mode 100644
index 000000000..3639ba706
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/cosmos-editor.html
@@ -0,0 +1,49 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'cosmos-editor' %} show active{% endif %}" id="cosmos-editor" role="tabpanel" aria-labelledby="cosmos-editor-tab" data-testid="cosmos-editor-tab-pane" data-ignore-settings-change="true">
+                <div class="card p-4 mb-4 border-danger shadow-sm" id="data-management-cosmos-editor-section" data-ignore-data-management-change="true">
+                    <div class="d-flex flex-wrap align-items-start justify-content-between gap-3 mb-3">
+                        <div>
+                            <h4 class="mb-1"><i class="bi bi-database-exclamation me-2"></i>Cosmos DB JSON Editor</h4>
+                            <p class="text-muted mb-0 small">Query SimpleChat Cosmos DB containers, inspect one document, and save JSON changes with ETag protection.</p>
+                        </div>
+                        <button type="button" class="btn btn-danger" id="data-management-cosmos-editor-open-danger-btn">
+                            <i class="bi bi-unlock me-1"></i>Unlock Editor
+                        </button>
+                    </div>
+                    <div class="alert alert-danger mb-3" role="alert">
+                        This tool can modify production Cosmos DB documents directly. Use it only for targeted admin repair or investigation after you understand the impact.
+                    </div>
+                    <div class="alert alert-warning mb-3" id="data-management-cosmos-editor-locked-message" role="status">
+                        The Cosmos DB JSON editor is locked. Acknowledge the danger prompt before querying or editing data.
+                    </div>
+                    <div class="d-none" id="data-management-cosmos-editor-workspace">
+                        <div class="row g-3">
+                            <div class="col-lg-4">
+                                <label class="form-label" for="data_management_cosmos_editor_container">Container</label>
+                                <select class="form-select" id="data_management_cosmos_editor_container">
+                                    <option value="">Loading containers...</option>
+                                </select>
+                                <div class="form-text" id="data-management-cosmos-editor-container-help">Choose a known SimpleChat Cosmos DB container.</div>
+                            </div>
+                            <div class="col-lg-2">
+                                <label class="form-label" for="data_management_cosmos_editor_page_size">Page size</label>
+                                <input class="form-control" type="number" id="data_management_cosmos_editor_page_size" min="1" max="100" value="100">
+                                <div class="form-text">Max 100 per request.</div>
+                            </div>
+                            <div class="col-lg-6">
+                                <label class="form-label" for="data_management_cosmos_editor_query">SELECT query</label>
+                                <textarea class="form-control font-monospace" id="data_management_cosmos_editor_query" rows="4" placeholder="Leave empty to browse the first 100 documents. Custom queries must start with SELECT."></textarea>
+                                <div class="form-text">Empty query returns only the first 100 documents. Custom SELECT queries can page beyond 100 with Next Page.</div>
+                            </div>
+                        </div>
+                        <div class="d-flex flex-wrap align-items-center gap-2 mt-3">
+                            <button type="button" class="btn btn-primary" id="data-management-cosmos-editor-run-query-btn">
+                                <i class="bi bi-search me-1"></i>Run Query
+                            </button>
+                            <span class="small text-muted" id="data-management-cosmos-editor-query-status">No query has run yet.</span>
+                        </div>
+                        <div class="form-text mt-2">
+                            Query results and the JSON editor open in a modal so the Data Management page stays compact.
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/cosmos.html b/application/single_app/templates/admin/_panes/cosmos.html
new file mode 100644
index 000000000..6163be982
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/cosmos.html
@@ -0,0 +1,1141 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'cosmos' %} show active{% endif %}" id="cosmos" role="tabpanel" aria-labelledby="cosmos-tab">
+                <div class="card p-3 mb-3" id="document-access-index-section" data-testid="document-access-index-section">
+                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
+                        <div>
+                            <h5 class="mb-1">
+                                <i class="bi bi-diagram-3 me-2"></i>Cosmos Document Access Index
+                            </h5>
+                            <p class="text-muted mb-0">
+                                Monitor the document access projection used to remove expensive cross-partition document access queries.
+                            </p>
+                        </div>
+                        <div class="d-flex flex-wrap gap-2" role="group" aria-label="Document access index actions">
+                            <button type="button" class="btn btn-outline-secondary btn-sm" id="document-access-index-refresh-btn">
+                                <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh Status
+                            </button>
+                            {% if enable_dai_debug %}
+                            <button type="button" class="btn btn-outline-primary btn-sm" id="document-access-index-run-batch-btn">
+                                <i class="bi bi-play-circle me-1" aria-hidden="true"></i>Run One Backfill Batch
+                            </button>
+                            <button type="button" class="btn btn-outline-danger btn-sm" id="document-access-index-reset-btn" data-bs-toggle="modal" data-bs-target="#documentAccessIndexResetModal">
+                                <i class="bi bi-arrow-counterclockwise me-1" aria-hidden="true"></i>Reset Checkpoint
+                            </button>
+                            {% endif %}
+                        </div>
+                    </div>
+
+                    <div class="alert alert-info small mb-3">
+                        <i class="bi bi-info-circle me-2" aria-hidden="true"></i>
+                        Document access projection maintenance is automatic. The background scheduler repairs fail-open projection records first, then runs bounded backfill batches repeatedly while work remains. Production read metrics below show DAI-served reads, Redis cache hits, source fallbacks, RU, and latency without requiring shadow validation.
+                        {% if enable_dai_debug %}Debug controls and shadow validation diagnostics are visible because <code>enable_dai_debug</code> is enabled in app settings.{% endif %}
+                    </div>
+
+                    <div id="document-access-index-message" class="alert alert-info d-none" role="status" aria-live="polite"></div>
+
+                    <div class="row g-3 mb-3">
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Container</div>
+                                <span class="badge text-bg-secondary" id="document-access-index-container-status">Not loaded</span>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Write-through</div>
+                                <span class="badge text-bg-secondary" id="document-access-index-write-through-status">Not loaded</span>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Read Path</div>
+                                <span class="badge text-bg-secondary" id="document-access-index-read-status">Not loaded</span>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Redis List Cache</div>
+                                <span class="badge text-bg-secondary" id="document-access-index-cache-status">Not loaded</span>
+                            </div>
+                        </div>
+                        {% if enable_dai_debug %}
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Shadow Validation</div>
+                                <span class="badge text-bg-secondary" id="document-access-index-shadow-status">Not loaded</span>
+                            </div>
+                        </div>
+                        {% endif %}
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Auto Maintenance</div>
+                                <span class="badge text-bg-secondary" id="document-access-index-maintenance-mode">Not loaded</span>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Next Maintenance Action</div>
+                                <div class="fw-semibold" id="document-access-index-maintenance-next-action">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">More Work Pending</div>
+                                <div class="fw-semibold" id="document-access-index-maintenance-more-work">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Active Loop Interval</div>
+                                <div class="fw-semibold" id="document-access-index-maintenance-active-interval">Not loaded</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    {% if enable_dai_debug %}
+                    <div class="border rounded p-3 mb-3" data-testid="document-access-index-debug-controls">
+                        <h6 class="mb-3">Automatic Maintenance and Diagnostics</h6>
+                        <div class="row g-3 align-items-start">
+                            <div class="col-md-6 col-xl-3">
+                                <div class="form-check form-switch">
+                                    <input
+                                        class="form-check-input"
+                                        type="checkbox"
+                                        id="enable_document_access_index_write_through"
+                                        name="enable_document_access_index_write_through"
+                                        checked
+                                        disabled
+                                        aria-describedby="document-access-index-write-through-help"
+                                    >
+                                    <label class="form-check-label" for="enable_document_access_index_write_through">
+                                        Write-through projection
+                                    </label>
+                                </div>
+                                <div class="form-text" id="document-access-index-write-through-help">Always on. New and changed documents synchronize into the access index and fail open to repair records if projection updates fail.</div>
+                            </div>
+                            <div class="col-md-6 col-xl-3">
+                                <div class="form-check form-switch">
+                                    <input
+                                        class="form-check-input"
+                                        type="checkbox"
+                                        id="enable_startup_document_access_index_backfill"
+                                        name="enable_startup_document_access_index_backfill"
+                                        checked
+                                        disabled
+                                        aria-describedby="document-access-index-backfill-help"
+                                    >
+                                    <label class="form-check-label" for="enable_startup_document_access_index_backfill">
+                                        Automatic repair/backfill
+                                    </label>
+                                </div>
+                                <div class="form-text" id="document-access-index-backfill-help">Always on. Maintenance keeps running bounded repair and backfill batches until DAI is healthy.</div>
+                            </div>
+                            <div class="col-md-6 col-xl-3">
+                                <div class="form-check form-switch">
+                                    <input
+                                        class="form-check-input"
+                                        type="checkbox"
+                                        id="enable_document_access_index_shadow_validation"
+                                        name="enable_document_access_index_shadow_validation"
+                                        {% if settings.enable_document_access_index_shadow_validation %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label" for="enable_document_access_index_shadow_validation">
+                                        Enable shadow validation
+                                    </label>
+                                </div>
+                                <div class="form-text">Compares source list results to projection rows and logs mismatches without changing reads.</div>
+                            </div>
+                            <div class="col-md-6 col-xl-3">
+                                <label for="document_access_index_backfill_batch_size" class="form-label">Backfill Batch Size</label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="document_access_index_backfill_batch_size"
+                                    name="document_access_index_backfill_batch_size"
+                                    min="1"
+                                    max="1000"
+                                    value="{{ settings.document_access_index_backfill_batch_size or 200 }}"
+                                >
+                                <div class="form-text">Documents processed per manual or scheduled batch.</div>
+                            </div>
+                            <div class="col-md-6 col-xl-3">
+                                <label for="document_access_index_repair_batch_size" class="form-label">Repair Batch Size</label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="document_access_index_repair_batch_size"
+                                    name="document_access_index_repair_batch_size"
+                                    min="1"
+                                    max="500"
+                                    value="{{ settings.document_access_index_repair_batch_size or 100 }}"
+                                >
+                                <div class="form-text">Fail-open repair records reconciled before each backfill batch.</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="border rounded p-3 mb-3" data-testid="document-access-index-debug-read-controls">
+                        <h6 class="mb-3">Default Read Path</h6>
+                        <div class="row g-3">
+                            <div class="col-md-6">
+                                <div class="form-check form-switch">
+                                    <input
+                                        class="form-check-input"
+                                        type="checkbox"
+                                        id="enable_document_access_index_reads"
+                                        name="enable_document_access_index_reads"
+                                        checked
+                                        disabled
+                                        aria-describedby="document-access-index-reads-help"
+                                    >
+                                    <label class="form-check-label" for="enable_document_access_index_reads">
+                                        Document access index reads
+                                        <span class="badge text-bg-success ms-1">Wave 5B default</span>
+                                    </label>
+                                </div>
+                                <div class="form-text" id="document-access-index-reads-help">Always on. DAI-backed document and tag list reads are the normal path; source-container fallback remains automatic when backfill is not ready, repairs are pending, or a DAI query fails.</div>
+                            </div>
+                            <div class="col-md-6 col-xl-3">
+                                <div class="form-check form-switch">
+                                    <input
+                                        class="form-check-input"
+                                        type="checkbox"
+                                        role="switch"
+                                        id="enable_document_access_index_cache"
+                                        name="enable_document_access_index_cache"
+                                        {% if settings.enable_document_access_index_cache %}checked{% endif %}
+                                        aria-describedby="document-access-index-cache-help"
+                                    >
+                                    <label class="form-check-label" for="enable_document_access_index_cache">
+                                        Redis document list cache
+                                        <span class="badge text-bg-info ms-1">Wave 6</span>
+                                    </label>
+                                </div>
+                                <div class="form-text" id="document-access-index-cache-help">Uses Redis read-through caching for DAI document, tag, and legacy-count reads. If Redis is unavailable, reads bypass cache and use DAI directly.</div>
+                            </div>
+                            <div class="col-md-6 col-xl-3">
+                                <label for="document_access_index_cache_ttl_seconds" class="form-label">Cache TTL Seconds</label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="document_access_index_cache_ttl_seconds"
+                                    name="document_access_index_cache_ttl_seconds"
+                                    min="60"
+                                    max="900"
+                                    value="{{ settings.document_access_index_cache_ttl_seconds or 900 }}"
+                                    aria-describedby="document-access-index-cache-ttl-help"
+                                >
+                                <div class="form-text" id="document-access-index-cache-ttl-help">Default 900 seconds. Scope-version invalidation makes document changes visible immediately; TTL clears unreachable old entries.</div>
+                            </div>
+                        </div>
+                    </div>
+                    {% endif %}
+
+                    <div class="row g-3">
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Backfill State</div>
+                                <span class="badge text-bg-secondary" id="document-access-index-backfill-status">Not loaded</span>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Repair Backlog</div>
+                                <div class="fw-semibold" id="document-access-index-repair-count">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m DAI Read Attempts</div>
+                                <div class="fw-semibold" id="document-access-index-read-15m-attempts">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Redis Cache Hit Rate</div>
+                                <div class="fw-semibold" id="document-access-index-cache-15m-hit-rate">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Cache Hits / Misses</div>
+                                <div class="fw-semibold" id="document-access-index-cache-15m-hits-misses">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Cache Bypasses / Errors</div>
+                                <div class="fw-semibold" id="document-access-index-cache-15m-bypasses-errors">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Cache Invalidations</div>
+                                <div class="fw-semibold" id="document-access-index-cache-15m-invalidations">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Served from DAI</div>
+                                <div class="fw-semibold" id="document-access-index-read-15m-served">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Source Fallbacks</div>
+                                <div class="fw-semibold" id="document-access-index-read-15m-fallbacks">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Fallback Rate</div>
+                                <div class="fw-semibold" id="document-access-index-read-15m-fallback-rate">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m DAI Read RU</div>
+                                <div class="fw-semibold" id="document-access-index-read-15m-ru">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Avg / P95 Latency</div>
+                                <div class="fw-semibold" id="document-access-index-read-15m-latency">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last Fallback Reason</div>
+                                <div class="fw-semibold text-break" id="document-access-index-read-last-fallback">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last DAI Read Metric</div>
+                                <div class="fw-semibold text-break" id="document-access-index-read-last-sample">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last Cache Event</div>
+                                <div class="fw-semibold text-break" id="document-access-index-cache-last-event">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-12">
+                            <div class="alert alert-secondary small mb-0">
+                                <i class="bi bi-speedometer2 me-2" aria-hidden="true"></i>
+                                Production read metrics are lightweight in-process counters for the current app worker. Application Insights logs remain the durable fleet-wide source for fallback warnings and query failures.
+                            </div>
+                        </div>
+                        {% if enable_dai_debug %}
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last Shadow Result</div>
+                                <span class="badge text-bg-secondary" id="document-access-index-shadow-last-status">Not run</span>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Shadow Mismatches</div>
+                                <div class="fw-semibold" id="document-access-index-shadow-mismatches">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Source / Validation RU</div>
+                                <div class="fw-semibold" id="document-access-index-shadow-ru-comparison">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Validation Index RU</div>
+                                <div class="fw-semibold" id="document-access-index-shadow-validation-ru">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Candidate Read RU</div>
+                                <div class="fw-semibold" id="document-access-index-shadow-candidate-ru">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Estimated Wave 5 Savings</div>
+                                <div class="fw-semibold" id="document-access-index-shadow-wave5-ru-savings">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Source / Candidate Latency</div>
+                                <div class="fw-semibold" id="document-access-index-shadow-ms-comparison">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Estimated Wave 5 Latency</div>
+                                <div class="fw-semibold" id="document-access-index-shadow-ms-savings">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-12">
+                            <div class="alert alert-secondary small mb-0">
+                                <i class="bi bi-graph-up-arrow me-2" aria-hidden="true"></i>
+                                Rolling decision metrics aggregate shadow-validation samples over recent windows. Use these totals to compare source container RU with candidate access-index RU before enabling the future read path or Redis document access cache.
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">5m Source / Candidate RU</div>
+                                <div class="fw-semibold" id="document-access-index-rolling-5m-ru-comparison">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">5m Estimated Wave 5 Savings</div>
+                                <div class="fw-semibold" id="document-access-index-rolling-5m-wave5-ru-savings">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Source / Candidate RU</div>
+                                <div class="fw-semibold" id="document-access-index-rolling-15m-ru-comparison">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Estimated Wave 5 Savings</div>
+                                <div class="fw-semibold" id="document-access-index-rolling-15m-wave5-ru-savings">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Validation Overhead</div>
+                                <div class="fw-semibold" id="document-access-index-rolling-15m-validation-overhead">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Shadow Samples</div>
+                                <div class="fw-semibold" id="document-access-index-rolling-15m-samples">Not loaded</div>
+                            </div>
+                        </div>
+                        {% endif %}
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Current Scope</div>
+                                <div class="fw-semibold" id="document-access-index-current-scope">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Completed Scopes</div>
+                                <div class="fw-semibold" id="document-access-index-completed-scopes">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Total Documents Processed</div>
+                                <div class="fw-semibold" id="document-access-index-total-processed">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Total Documents Failed</div>
+                                <div class="fw-semibold" id="document-access-index-total-failed">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Rows Upserted</div>
+                                <div class="fw-semibold" id="document-access-index-total-upserted">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Rows Deleted</div>
+                                <div class="fw-semibold" id="document-access-index-total-deleted">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last Batch Completed</div>
+                                <div class="fw-semibold text-break" id="document-access-index-last-completed">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last Error</div>
+                                <div class="fw-semibold text-break" id="document-access-index-last-error">Not loaded</div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="cosmos-maintenance-section" data-testid="cosmos-maintenance-section">
+                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
+                        <div>
+                            <h5 class="mb-1">
+                                <i class="bi bi-tools me-2"></i>Cosmos Maintenance
+                            </h5>
+                            <p class="text-muted mb-0">
+                                Review expected indexing policies and clean up stale operational cache documents without touching source configuration or user data.
+                            </p>
+                        </div>
+                        <div class="d-flex flex-wrap gap-2" role="group" aria-label="Cosmos maintenance actions">
+                            <button type="button" class="btn btn-outline-secondary btn-sm" id="cosmos-maintenance-refresh-btn">
+                                <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh Status
+                            </button>
+                            <button type="button" class="btn btn-outline-warning btn-sm" id="cosmos-indexing-policy-apply-btn" data-bs-toggle="modal" data-bs-target="#cosmosIndexingPolicyApplyModal">
+                                <i class="bi bi-lightning-charge me-1" aria-hidden="true"></i>Apply Missing Indexes
+                            </button>
+                            <button type="button" class="btn btn-outline-primary btn-sm" id="stale-cache-cleanup-dry-run-btn">
+                                <i class="bi bi-search me-1" aria-hidden="true"></i>Dry Run Cleanup
+                            </button>
+                            <button type="button" class="btn btn-outline-danger btn-sm" id="stale-cache-cleanup-apply-btn" data-bs-toggle="modal" data-bs-target="#staleCacheCleanupApplyModal">
+                                <i class="bi bi-trash3 me-1" aria-hidden="true"></i>Delete Stale Cache Docs
+                            </button>
+                        </div>
+                    </div>
+
+                    <div class="alert alert-info small mb-3">
+                        <i class="bi bi-info-circle me-2" aria-hidden="true"></i>
+                        Indexing maintenance only adds missing expected composite indexes and preserves existing policy paths. Composite indexes can increase write-index overhead while improving supported lookup and ordered-query speed. Stale cleanup is allowlisted to obsolete cache artifacts, supports dry-run review, and deletes at most one bounded batch per run.
+                    </div>
+                    <div id="cosmos-maintenance-message" class="alert alert-info d-none" role="status" aria-live="polite"></div>
+
+                    <div class="row g-3">
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Indexing Policy Status</div>
+                                <span class="badge text-bg-secondary" id="cosmos-indexing-policy-status">Not loaded</span>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Indexing Mode</div>
+                                <div class="fw-semibold" id="cosmos-indexing-policy-mode">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Containers Checked</div>
+                                <div class="fw-semibold" id="cosmos-indexing-policy-container-count">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Missing Expected Indexes</div>
+                                <div class="fw-semibold" id="cosmos-indexing-policy-missing-count">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Updated Containers</div>
+                                <div class="fw-semibold" id="cosmos-indexing-policy-updated-count">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Indexing Failures</div>
+                                <div class="fw-semibold" id="cosmos-indexing-policy-failed-count">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last Indexing Evaluation</div>
+                                <div class="fw-semibold text-break" id="cosmos-indexing-policy-last-evaluated">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Stale Cleanup Status</div>
+                                <span class="badge text-bg-secondary" id="stale-cache-cleanup-status">Not loaded</span>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Cleanup Mode</div>
+                                <div class="fw-semibold" id="stale-cache-cleanup-mode">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Cleanup Candidates</div>
+                                <div class="fw-semibold" id="stale-cache-cleanup-candidates">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Deleted Docs</div>
+                                <div class="fw-semibold" id="stale-cache-cleanup-deleted">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Cleanup Failures</div>
+                                <div class="fw-semibold" id="stale-cache-cleanup-failed">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">More Candidates</div>
+                                <div class="fw-semibold" id="stale-cache-cleanup-more-candidates">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Cleanup Categories</div>
+                                <div class="fw-semibold text-break" id="stale-cache-cleanup-categories">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last Cleanup Evaluation</div>
+                                <div class="fw-semibold text-break" id="stale-cache-cleanup-last-evaluated">Not loaded</div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="cosmosIndexingPolicyApplyModal" tabindex="-1" aria-labelledby="cosmosIndexingPolicyApplyModalLabel" aria-hidden="true">
+                    <div class="modal-dialog">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="cosmosIndexingPolicyApplyModalLabel">
+                                    <i class="bi bi-exclamation-triangle me-2"></i>Apply Missing Cosmos Indexes
+                                </h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <p>
+                                    This adds any missing expected composite indexes to the configured hot Cosmos containers. Existing included paths, excluded paths, default indexes, TTL settings, and full-text policies are preserved.
+                                </p>
+                                <p>
+                                    Composite indexes can improve lookup and ordered-query performance, but Cosmos will maintain those indexes on future writes and may temporarily run index transformation after the policy update.
+                                </p>
+                                <p class="mb-0 text-muted small">
+                                    Choose Apply only when you accept the additional write-index overhead for the faster supported query patterns shown in the maintenance status.
+                                </p>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Decline</button>
+                                <button type="button" class="btn btn-warning" id="cosmos-indexing-policy-apply-confirm-btn">
+                                    Apply Indexes
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="staleCacheCleanupApplyModal" tabindex="-1" aria-labelledby="staleCacheCleanupApplyModalLabel" aria-hidden="true">
+                    <div class="modal-dialog">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="staleCacheCleanupApplyModalLabel">
+                                    <i class="bi bi-exclamation-triangle me-2"></i>Delete Stale Cache Documents
+                                </h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <p>
+                                    This deletes only allowlisted stale cache artifacts from the settings container, such as retired conversation cache version documents and obsolete volatile cache payloads.
+                                </p>
+                                <p class="mb-0 text-muted small">
+                                    It does not delete app settings, active cache-version documents, DAI state, maintenance state, source documents, or user data. Run a dry run first if you want to review the candidate count.
+                                </p>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Cancel</button>
+                                <button type="button" class="btn btn-danger" id="stale-cache-cleanup-apply-confirm-btn">
+                                    Delete Stale Cache Docs
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                {% if enable_dai_debug %}
+                <div class="modal fade" id="documentAccessIndexResetModal" tabindex="-1" aria-labelledby="documentAccessIndexResetModalLabel" aria-hidden="true">
+                    <div class="modal-dialog">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="documentAccessIndexResetModalLabel">
+                                    <i class="bi bi-exclamation-triangle me-2"></i>Reset Document Access Backfill
+                                </h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <p>
+                                    Resetting the checkpoint makes the next batch start from the first source scope again. The operation is idempotent, but it may reprocess documents that already have projection rows.
+                                </p>
+                                <p class="mb-0 text-muted small">
+                                    This does not delete source documents or projection rows. It only resets backfill progress and immediately runs one saved-size backfill batch.
+                                </p>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Cancel</button>
+                                <button type="button" class="btn btn-danger" id="document-access-index-reset-confirm-btn">
+                                    Reset and Run Batch
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                {% endif %}
+
+                <div class="card p-3 mb-3" id="cosmos-throughput-section" data-testid="cosmos-throughput-section">
+                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
+                        <div>
+                            <h5 class="mb-1">
+                                <i class="bi bi-speedometer2 me-2"></i>Cosmos DB Throughput
+                            </h5>
+                            <p class="text-muted mb-0">
+                                Monitor RU utilization and automatically adjust shared database or dedicated container throughput.
+                            </p>
+                        </div>
+                        <button type="button" class="btn btn-outline-info btn-sm" id="cosmos-throughput-setup-guide-btn" data-bs-toggle="modal" data-bs-target="#cosmosThroughputSetupModal">
+                            <i class="bi bi-journal-text me-1"></i>Setup Guide
+                        </button>
+                    </div>
+
+                    <div class="d-flex flex-wrap gap-2 mb-3" role="group" aria-label="Cosmos throughput actions">
+                        <button type="button" class="btn btn-outline-secondary btn-sm" id="cosmos-throughput-refresh-btn">
+                            <i class="bi bi-arrow-clockwise me-1"></i>Refresh
+                        </button>
+                        <button type="button" class="btn btn-outline-success btn-sm" id="cosmos-throughput-validate-access-btn">
+                            <i class="bi bi-shield-check me-1"></i>Validate Access
+                        </button>
+                        <button type="button" class="btn btn-outline-secondary btn-sm" id="cosmos-throughput-container-policies-btn" data-bs-toggle="modal" data-bs-target="#cosmosThroughputContainerModal">
+                            <i class="bi bi-sliders me-1"></i>Containers
+                        </button>
+                        <button type="button" class="btn btn-outline-primary btn-sm" id="cosmos-throughput-convert-autoscale-btn" title="Convert database manual throughput to Cosmos autoscale">
+                            <i class="bi bi-lightning-charge me-1"></i>Convert
+                        </button>
+                        <button type="button" class="btn btn-outline-primary btn-sm" id="cosmos-throughput-scale-up-btn">
+                            <i class="bi bi-arrow-up-circle me-1"></i>Scale Up
+                        </button>
+                        <button type="button" class="btn btn-outline-secondary btn-sm" id="cosmos-throughput-scale-down-btn">
+                            <i class="bi bi-arrow-down-circle me-1"></i>Scale Down
+                        </button>
+                    </div>
+
+                    <div class="alert alert-info small mb-3">
+                        <i class="bi bi-info-circle me-2"></i>
+                        Automation checks Cosmos throughput on the Metrics Window cadence while enabled and saves the last observed database or container view. SimpleChat can scale throughput up or down at 10,000 RU/s or lower. Above 10,000 RU/s, SimpleChat monitors utilization only; use the Azure portal for capacity changes, which can take 4 to 6 hours. Native Cosmos autoscale conversion is separate from SimpleChat scale-up and scale-down automation.
+                    </div>
+
+                    <textarea class="d-none" id="cosmos_throughput_container_policies_json" name="cosmos_throughput_container_policies_json">{{ settings.cosmos_throughput_container_policies | tojson }}</textarea>
+
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="cosmos_throughput_autoscale_enabled"
+                            name="cosmos_throughput_autoscale_enabled"
+                            {% if settings.cosmos_throughput_autoscale_enabled %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="cosmos_throughput_autoscale_enabled">
+                            Enable Cosmos throughput automation
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, a background task checks recent Cosmos DB RU utilization and scales the configured database up or down within the saved guardrails."></i>
+                    </div>
+
+                    <div id="cosmos-throughput-automation-settings" class="{% if not settings.cosmos_throughput_autoscale_enabled %}d-none{% endif %}">
+                        <div class="row g-3 mb-3">
+                            <div class="col-md-6 col-xl-3">
+                                <label for="cosmos_throughput_subscription_id" class="form-label">Subscription ID</label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="cosmos_throughput_subscription_id"
+                                    name="cosmos_throughput_subscription_id"
+                                    value="{{ settings.cosmos_throughput_subscription_id or settings.cosmos_throughput_resolved_subscription_id or '' }}"
+                                    autocomplete="off"
+                                >
+                            </div>
+                            <div class="col-md-6 col-xl-3">
+                                <label for="cosmos_throughput_resource_group" class="form-label">Resource Group</label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="cosmos_throughput_resource_group"
+                                    name="cosmos_throughput_resource_group"
+                                    value="{{ settings.cosmos_throughput_resource_group or settings.cosmos_throughput_resolved_resource_group or '' }}"
+                                    autocomplete="off"
+                                >
+                            </div>
+                            <div class="col-md-6 col-xl-3">
+                                <label for="cosmos_throughput_account_name" class="form-label">Cosmos Account</label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="cosmos_throughput_account_name"
+                                    name="cosmos_throughput_account_name"
+                                    value="{{ settings.cosmos_throughput_account_name or settings.cosmos_throughput_resolved_account_name or '' }}"
+                                    autocomplete="off"
+                                >
+                            </div>
+                            <div class="col-md-6 col-xl-3">
+                                <label for="cosmos_throughput_database_name" class="form-label">Database</label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="cosmos_throughput_database_name"
+                                    name="cosmos_throughput_database_name"
+                                    value="{{ settings.cosmos_throughput_database_name or settings.cosmos_throughput_resolved_database_name or 'SimpleChat' }}"
+                                    autocomplete="off"
+                                >
+                            </div>
+                        </div>
+
+                        <div class="border rounded p-3 mb-3">
+                            <h6 class="mb-3">Metrics Window</h6>
+                            <div class="row g-3">
+                                <div class="col-md-6 col-xl-3">
+                                    <label for="cosmos_throughput_metrics_window_minutes" class="form-label">Metrics Window</label>
+                                    <div class="input-group">
+                                        <input type="number" class="form-control" id="cosmos_throughput_metrics_window_minutes" name="cosmos_throughput_metrics_window_minutes" min="1" max="60" value="{{ settings.cosmos_throughput_metrics_window_minutes }}">
+                                        <span class="input-group-text">min</span>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="border rounded p-3 mb-3" id="cosmos-throughput-scale-up-policy">
+                            <h6 class="mb-3">Scale Up Policy</h6>
+                            <div class="row g-3 align-items-start">
+                                <div class="col-md-6 col-xl-3">
+                                    <div class="form-check form-switch mt-4 pt-2">
+                                        <input class="form-check-input" type="checkbox" id="cosmos_throughput_auto_scale_up_enabled" name="cosmos_throughput_auto_scale_up_enabled" {% if settings.cosmos_throughput_auto_scale_up_enabled %}checked{% endif %}>
+                                        <label class="form-check-label" for="cosmos_throughput_auto_scale_up_enabled">Auto scale up</label>
+                                    </div>
+                                </div>
+                                <div class="col-md-6 col-xl-3">
+                                    <label for="cosmos_throughput_scale_up_threshold_percent" class="form-label">Scale Up At</label>
+                                    <div class="input-group">
+                                        <input type="number" class="form-control" id="cosmos_throughput_scale_up_threshold_percent" name="cosmos_throughput_scale_up_threshold_percent" min="1" max="100" value="{{ settings.cosmos_throughput_scale_up_threshold_percent }}">
+                                        <span class="input-group-text">%</span>
+                                    </div>
+                                </div>
+                                <div class="col-md-6 col-xl-3">
+                                    <label for="cosmos_throughput_scale_up_step_ru" class="form-label">Scale Up Step</label>
+                                    <div class="input-group">
+                                        <input type="number" class="form-control" id="cosmos_throughput_scale_up_step_ru" name="cosmos_throughput_scale_up_step_ru" min="1000" step="1000" value="{{ settings.cosmos_throughput_scale_up_step_ru }}">
+                                        <span class="input-group-text">RU/s</span>
+                                    </div>
+                                </div>
+                                <div class="col-md-6 col-xl-3">
+                                    <label for="cosmos_throughput_scale_up_cooldown_minutes" class="form-label">Scale Up Interval</label>
+                                    <div class="input-group">
+                                        <input type="number" class="form-control" id="cosmos_throughput_scale_up_cooldown_minutes" name="cosmos_throughput_scale_up_cooldown_minutes" min="1" max="1440" value="{{ settings.cosmos_throughput_scale_up_cooldown_minutes }}">
+                                        <span class="input-group-text">min</span>
+                                    </div>
+                                </div>
+                                <div class="col-md-6 col-xl-3">
+                                    <label for="cosmos_throughput_max_ru" class="form-label">Maximum RU/s</label>
+                                    <input type="number" class="form-control" id="cosmos_throughput_max_ru" name="cosmos_throughput_max_ru" min="1000" max="10000" step="1000" value="{{ settings.cosmos_throughput_max_ru }}">
+                                    <div class="form-text">SimpleChat-managed scaling stops at 10,000 RU/s. Use the Azure portal above this limit.</div>
+                                </div>
+                                <div class="col-md-6 col-xl-3">
+                                    <div class="form-check mt-4 pt-2">
+                                        <input class="form-check-input" type="checkbox" id="cosmos_throughput_ignore_max_limit" name="cosmos_throughput_ignore_max_limit" {% if settings.cosmos_throughput_ignore_max_limit %}checked{% endif %}>
+                                        <label class="form-check-label" for="cosmos_throughput_ignore_max_limit">Ignore maximum guardrail</label>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="border rounded p-3 mb-3" id="cosmos-throughput-scale-down-policy">
+                            <h6 class="mb-3">Scale Down Policy</h6>
+                            <div class="row g-3 align-items-start">
+                                <div class="col-md-6 col-xl-3">
+                                    <div class="form-check form-switch mt-4 pt-2">
+                                        <input class="form-check-input" type="checkbox" id="cosmos_throughput_auto_scale_down_enabled" name="cosmos_throughput_auto_scale_down_enabled" {% if settings.cosmos_throughput_auto_scale_down_enabled %}checked{% endif %}>
+                                        <label class="form-check-label" for="cosmos_throughput_auto_scale_down_enabled">Auto scale down</label>
+                                    </div>
+                                </div>
+                                <div class="col-md-6 col-xl-3">
+                                    <label for="cosmos_throughput_scale_down_threshold_percent" class="form-label">Scale Down At</label>
+                                    <div class="input-group">
+                                        <input type="number" class="form-control" id="cosmos_throughput_scale_down_threshold_percent" name="cosmos_throughput_scale_down_threshold_percent" min="0" max="99" value="{{ settings.cosmos_throughput_scale_down_threshold_percent }}">
+                                        <span class="input-group-text">%</span>
+                                    </div>
+                                </div>
+                                <div class="col-md-6 col-xl-3">
+                                    <label for="cosmos_throughput_scale_down_step_ru" class="form-label">Scale Down Step</label>
+                                    <div class="input-group">
+                                        <input type="number" class="form-control" id="cosmos_throughput_scale_down_step_ru" name="cosmos_throughput_scale_down_step_ru" min="1000" step="1000" value="{{ settings.cosmos_throughput_scale_down_step_ru }}">
+                                        <span class="input-group-text">RU/s</span>
+                                    </div>
+                                </div>
+                                <div class="col-md-6 col-xl-3">
+                                    <label for="cosmos_throughput_scale_down_cooldown_minutes" class="form-label">Scale Down Interval</label>
+                                    <div class="input-group">
+                                        <input type="number" class="form-control" id="cosmos_throughput_scale_down_cooldown_minutes" name="cosmos_throughput_scale_down_cooldown_minutes" min="1" max="1440" value="{{ settings.cosmos_throughput_scale_down_cooldown_minutes }}">
+                                        <span class="input-group-text">min</span>
+                                    </div>
+                                </div>
+                                <div class="col-md-6 col-xl-3">
+                                    <label for="cosmos_throughput_min_ru" class="form-label">Minimum RU/s</label>
+                                    <input type="number" class="form-control" id="cosmos_throughput_min_ru" name="cosmos_throughput_min_ru" min="1000" step="1000" value="{{ settings.cosmos_throughput_min_ru }}">
+                                </div>
+                                <div class="col-md-6 col-xl-3">
+                                    <div class="form-check mt-4 pt-2">
+                                        <input class="form-check-input" type="checkbox" id="cosmos_throughput_ignore_min_limit" name="cosmos_throughput_ignore_min_limit" {% if settings.cosmos_throughput_ignore_min_limit %}checked{% endif %}>
+                                        <label class="form-check-label" for="cosmos_throughput_ignore_min_limit">Ignore minimum guardrail</label>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div id="cosmos-throughput-validation-message" class="alert alert-danger d-none" role="alert" aria-live="polite"></div>
+
+                        <div class="border rounded p-3 mb-3">
+                            <div class="form-check form-switch mb-3">
+                                <input
+                                    class="form-check-input"
+                                    type="checkbox"
+                                    id="cosmos_throughput_convert_manual_to_autoscale_enabled"
+                                    name="cosmos_throughput_convert_manual_to_autoscale_enabled"
+                                    {% if settings.cosmos_throughput_convert_manual_to_autoscale_enabled %}checked{% endif %}
+                                >
+                                <label class="form-check-label fw-semibold" for="cosmos_throughput_convert_manual_to_autoscale_enabled">
+                                    Convert manual throughput to Cosmos autoscale
+                                </label>
+                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, background automation converts manual database or dedicated container throughput to native Cosmos autoscale before applying RU guardrails. The autoscale max preserves the current manual RU/s rounded up to Cosmos autoscale increments."></i>
+                            </div>
+                            <div class="form-check form-switch">
+                                <input
+                                    class="form-check-input"
+                                    type="checkbox"
+                                    id="cosmos_throughput_enforce_container_defaults"
+                                    name="cosmos_throughput_enforce_container_defaults"
+                                    {% if settings.cosmos_throughput_enforce_container_defaults %}checked{% endif %}
+                                >
+                                <label class="form-check-label fw-semibold" for="cosmos_throughput_enforce_container_defaults">
+                                    Enforce global policy for all containers
+                                </label>
+                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, every dedicated-throughput container uses the global thresholds, intervals, step sizes, and guardrails above. New containers discovered later inherit the same policy automatically."></i>
+                            </div>
+                            <div class="small text-muted mt-1">
+                                Use this when container throughput should follow one standard automation policy instead of per-container overrides. Global policy also applies the Cosmos autoscale conversion setting above to current and future dedicated-throughput containers.
+                            </div>
+                        </div>
+                    </div>
+
+                    <div id="cosmos-throughput-message" class="alert d-none mt-3" role="status"></div>
+
+                    <div class="row g-3 mt-1" id="cosmos-throughput-status-panel">
+                        <div class="col-md-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Mode</div>
+                                <div class="fw-semibold" id="cosmos-throughput-mode">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Current RU/s</div>
+                                <div class="fw-semibold" id="cosmos-throughput-current-ru">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">RU Utilization</div>
+                                <div class="fw-semibold" id="cosmos-throughput-utilization">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last Checked</div>
+                                <div class="fw-semibold" id="cosmos-throughput-last-checked">Not loaded</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="d-flex flex-wrap justify-content-between align-items-end gap-2 mt-3">
+                        <div class="flex-grow-1">
+                            <label for="cosmos-throughput-container-filter" class="form-label mb-1">Filter Containers</label>
+                            <div class="input-group input-group-sm">
+                                <span class="input-group-text">
+                                    <i class="bi bi-search" aria-hidden="true"></i>
+                                </span>
+                                <input
+                                    type="search"
+                                    class="form-control"
+                                    id="cosmos-throughput-container-filter"
+                                    placeholder="Filter by container name"
+                                    aria-describedby="cosmos-throughput-container-filter-count"
+                                    autocomplete="off"
+                                    data-ignore-settings-change="true"
+                                >
+                            </div>
+                        </div>
+                        <div class="d-flex flex-wrap align-items-center gap-2 mb-1">
+                            <div id="cosmos-throughput-container-filter-count" class="small text-muted" aria-live="polite"></div>
+                            <button type="button" class="btn btn-outline-secondary btn-sm" id="cosmos-throughput-refresh-table-btn">
+                                <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh Table
+                            </button>
+                        </div>
+                    </div>
+
+                    <div class="table-responsive mt-2" id="cosmos-throughput-metrics-table-section">
+                        <table class="table table-sm align-middle mb-0">
+                            <thead>
+                                <tr>
+                                    <th scope="col" aria-sort="ascending">
+                                        <button type="button" class="btn btn-link btn-sm p-0 text-body text-decoration-none cosmos-throughput-container-sort" data-sort-field="container_name" aria-label="Sort containers by container name">
+                                            Container <i class="bi bi-arrow-up-short ms-1" aria-hidden="true"></i>
+                                        </button>
+                                    </th>
+                                    <th scope="col">Mode</th>
+                                    <th scope="col" aria-sort="none">
+                                        <button type="button" class="btn btn-link btn-sm p-0 text-body text-decoration-none cosmos-throughput-container-sort" data-sort-field="current_ru" aria-label="Sort containers by current RU/s">
+                                            Current RU/s <i class="bi bi-arrow-down-up ms-1" aria-hidden="true"></i>
+                                        </button>
+                                    </th>
+                                    <th scope="col" aria-sort="none">
+                                        <button type="button" class="btn btn-link btn-sm p-0 text-body text-decoration-none cosmos-throughput-container-sort" data-sort-field="ru_utilization" aria-label="Sort containers by RU utilization">
+                                            RU Utilization <i class="bi bi-arrow-down-up ms-1" aria-hidden="true"></i>
+                                        </button>
+                                        <i class="bi bi-info-circle ms-1" data-bs-toggle="tooltip" title="Highest normalized RU percentage Azure Monitor reported for the selected window. If that metric is not available, SimpleChat estimates average utilization from request units divided by current RU/s."></i>
+                                    </th>
+                                    <th scope="col" aria-sort="none">
+                                        <button type="button" class="btn btn-link btn-sm p-0 text-body text-decoration-none cosmos-throughput-container-sort" data-sort-field="request_units" aria-label="Sort containers by request units">
+                                            Request Units <i class="bi bi-arrow-down-up ms-1" aria-hidden="true"></i>
+                                        </button>
+                                        <i class="bi bi-info-circle ms-1" data-bs-toggle="tooltip" title="Total request units consumed during the selected metrics window. This is consumption volume, not a percentage."></i>
+                                    </th>
+                                    <th scope="col" aria-sort="none">
+                                        <button type="button" class="btn btn-link btn-sm p-0 text-body text-decoration-none cosmos-throughput-container-sort" data-sort-field="policy" aria-label="Sort containers by policy">
+                                            Policy <i class="bi bi-arrow-down-up ms-1" aria-hidden="true"></i>
+                                        </button>
+                                    </th>
+                                    <th scope="col">Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="cosmos-throughput-containers-body">
+                                <tr>
+                                    <td colspan="7" class="text-muted">Refresh to load Cosmos metrics.</td>
+                                </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="cosmosThroughputSetupModal" tabindex="-1" aria-labelledby="cosmosThroughputSetupModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="cosmosThroughputSetupModalLabel">
+                                    <i class="bi bi-journal-text me-2"></i>Cosmos Throughput Setup Guide
+                                </h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="alert alert-info small mb-3">
+                                    Validate Access runs the same read checks automation depends on using the current form values: resource identity, Azure Resource Manager throughput reads, container discovery, and Azure Monitor metrics.
+                                </div>
+                                <div class="mb-3">
+                                    <h6>Required Azure Access</h6>
+                                    <ul class="mb-0">
+                                        <li>Assign roles to the Azure App Service managed identity service principal, not the Microsoft Entra sign-in app registration. In the Azure portal, open the Web App, select Identity, copy the Object (principal) ID, then find the matching Enterprise Application if you need to inspect it in Microsoft Entra ID.</li>
+                                        <li>For SimpleChat deployments, assign the custom <code>SimpleChat Cosmos Throughput Operator</code> role to that web app identity at the resource group scope that contains the Cosmos DB account, or directly at the Cosmos account scope.</li>
+                                        <li>The custom role must include management-plane actions to read the Cosmos account, database, and containers; read and write SQL database and container <code>throughputSettings</code>; run <code>migrateToAutoscale</code>; read throughput operation results; and read <code>Microsoft.Insights/metrics</code>.</li>
+                                        <li>If the custom role is not available, assign equivalent custom RBAC permissions. Broad built-in roles such as Contributor can validate access, but are not the preferred least-privilege configuration.</li>
+                                    </ul>
+                                </div>
+                                <div class="mb-3">
+                                    <h6>Capacity Scope</h6>
+                                    <ul class="mb-0">
+                                        <li>Database mode scales the shared <code>SimpleChat</code> database throughput.</li>
+                                        <li>Container-targeted mode scales only containers with dedicated throughput.</li>
+                                        <li>Containers that inherit shared database throughput are visible but not individually scalable.</li>
+                                        <li>Manual throughput can be converted to native Cosmos autoscale only when the admin enables conversion globally or for the container policy.</li>
+                                    </ul>
+                                </div>
+                                <div>
+                                    <h6>Metrics</h6>
+                                    <ul class="mb-0">
+                                        <li>RU Utilization is a percentage of available throughput for the selected metrics window.</li>
+                                        <li>Request Units is the total RU volume consumed during the selected metrics window.</li>
+                                        <li>Azure Monitor metrics can lag by a few minutes after traffic changes.</li>
+                                    </ul>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
+                                <button type="button" class="btn btn-primary" id="cosmos-throughput-run-setup-test-btn" data-bs-dismiss="modal">
+                                    <i class="bi bi-shield-check me-1"></i>Validate Access
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="cosmosThroughputContainerModal" tabindex="-1" aria-labelledby="cosmosThroughputContainerModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="cosmosThroughputContainerModalLabel">
+                                    <i class="bi bi-sliders me-2"></i>Container Throughput Policies
+                                </h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="alert alert-info small mb-3">
+                                    Dedicated container throughput is controlled per row unless global policy enforcement is enabled. Containers using shared database throughput are shown for visibility, but cannot be scaled or converted individually until they have dedicated throughput. Containers above 10,000 RU/s are monitor-only in SimpleChat; change their capacity in the Azure portal and plan for a 4 to 6 hour provisioning window.
+                                </div>
+                                <div class="d-flex flex-wrap justify-content-between align-items-end gap-2 mb-3">
+                                    <div class="flex-grow-1">
+                                        <label for="cosmos-throughput-container-policy-filter" class="form-label mb-1">Filter Container Policies</label>
+                                        <div class="input-group input-group-sm">
+                                            <span class="input-group-text">
+                                                <i class="bi bi-search" aria-hidden="true"></i>
+                                            </span>
+                                            <input
+                                                type="search"
+                                                class="form-control"
+                                                id="cosmos-throughput-container-policy-filter"
+                                                placeholder="Filter by container name"
+                                                aria-describedby="cosmos-throughput-container-policy-filter-count"
+                                                autocomplete="off"
+                                                data-ignore-settings-change="true"
+                                            >
+                                        </div>
+                                    </div>
+                                    <div id="cosmos-throughput-container-policy-filter-count" class="small text-muted mb-1" aria-live="polite"></div>
+                                </div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Container</th>
+                                                <th scope="col">Enabled</th>
+                                                <th scope="col">Scale Up</th>
+                                                <th scope="col">Scale Down</th>
+                                                <th scope="col">Cosmos Autoscale</th>
+                                                <th scope="col">Min RU/s</th>
+                                                <th scope="col">Max RU/s</th>
+                                                <th scope="col">Manual</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="cosmos-throughput-container-policies-body">
+                                            <tr>
+                                                <td colspan="8" class="text-muted">Refresh Cosmos throughput status to load containers.</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-primary" id="cosmos-throughput-apply-global-policy-btn">
+                                    <i class="bi bi-arrow-repeat me-1"></i>Apply Global Policy
+                                </button>
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
+                                <button type="button" class="btn btn-primary" id="cosmos-throughput-save-container-policies-btn" data-bs-dismiss="modal">
+                                    Save Container Policies
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/custom-pages.html b/application/single_app/templates/admin/_panes/custom-pages.html
new file mode 100644
index 000000000..00fc68987
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/custom-pages.html
@@ -0,0 +1,133 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'custom-pages' %} show active{% endif %}" id="custom-pages" role="tabpanel" aria-labelledby="custom-pages-tab">
+                <p class="text-muted">
+                    Enable trusted deployment-time custom pages and manage metadata for simple static pages served from the application custom_pages folders.
+                </p>
+
+                <div class="card p-3 mb-3" id="custom-pages-section">
+                    <div class="d-flex flex-column flex-md-row align-items-md-center justify-content-between gap-2 mb-3">
+                        <h5 class="mb-0">
+                            <i class="bi bi-window-plus me-2"></i>Custom Pages
+                        </h5>
+                        <button type="button" class="btn btn-sm btn-outline-info" id="custom-pages-guide-btn">
+                            <i class="bi bi-book me-1"></i>Developer Guide
+                        </button>
+                    </div>
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" id="enable_custom_pages" name="enable_custom_pages"
+                            {% if settings.enable_custom_pages %}checked{% endif %}>
+                        <input type="hidden" id="custom_pages_restart_acknowledged" name="custom_pages_restart_acknowledged" value="">
+                        <label class="form-check-label ms-2" for="enable_custom_pages">
+                            Enable Custom Pages
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow trusted custom pages deployed under application/single_app/custom_pages to appear in navigation and be served under /custom."></i>
+                    </div>
+                    <p class="text-muted small">When disabled, /custom routes return Not Found before loading custom metadata, files, or Python extensions.</p>
+
+                    <div id="custom_pages_settings" class="{% if not settings.enable_custom_pages %}d-none{% endif %}">
+                        <div class="mb-3">
+                            <label for="custom_pages_menu_name" class="form-label">Menu Name</label>
+                            <input type="text" class="form-control" id="custom_pages_menu_name" name="custom_pages_menu_name"
+                                value="{{ settings.custom_pages_menu_name or 'Custom Pages' }}" placeholder="Custom Pages">
+                            <small class="form-text text-muted">This name appears when custom pages are grouped into a menu.</small>
+                        </div>
+
+                        <div class="form-check form-switch mb-3">
+                            <input class="form-check-input" type="checkbox" id="custom_pages_force_menu" name="custom_pages_force_menu"
+                                {% if settings.custom_pages_force_menu %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="custom_pages_force_menu">
+                                Force Menu Display
+                            </label>
+                            <small class="form-text text-muted d-block">When disabled, 1-2 custom pages show as top-level nav items and 3+ pages show as a menu.</small>
+                        </div>
+
+                        <div class="d-flex align-items-center justify-content-between mb-2">
+                            <div>
+                                <h6 class="mb-1">Static Page Metadata</h6>
+                                <p class="text-muted small mb-0">Create metadata contracts for simple pages that use files from custom_pages/html, css, js, assets, and json.</p>
+                            </div>
+                            <div class="d-flex flex-wrap gap-2 justify-content-end">
+                                <button type="button" class="btn btn-sm btn-outline-success" id="create-request-access-page-btn">
+                                    <i class="bi bi-person-plus me-1"></i>Add Request Access Page
+                                </button>
+                                <button type="button" class="btn btn-sm btn-outline-primary" id="add-custom-page-btn">
+                                    <i class="bi bi-plus-circle me-1"></i>New Static Page
+                                </button>
+                            </div>
+                        </div>
+
+                        <div class="table-responsive">
+                            <table class="table table-sm table-bordered align-middle">
+                                <thead>
+                                    <tr>
+                                        <th>Slug</th>
+                                        <th>Title</th>
+                                        <th>Type</th>
+                                        <th>Access</th>
+                                        <th>Roles</th>
+                                        <th>Status</th>
+                                        <th>Nav</th>
+                                        <th>Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="custom-pages-tbody">
+                                    <tr>
+                                        <td colspan="8" class="text-muted text-center">Loading custom pages...</td>
+                                    </tr>
+                                </tbody>
+                            </table>
+                        </div>
+                    </div>
+                </div>
+                <div class="card p-3 mb-3" id="external-links-section">
+                    <h5>
+                        <i class="bi bi-box-arrow-up-right me-2"></i>External Links
+                    </h5>
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" id="enable_external_links" name="enable_external_links"
+                            {% if settings.enable_external_links %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_external_links">
+                            Enable External Links in Navigation
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a menu of external links in the navigation bar for quick access to external resources and websites."></i>
+                    </div>
+                    <p class="text-muted small">When enabled, external links will be displayed in the navigation bar for easy access to external resources.</p>
+
+                    <div id="external_links_settings" {% if not settings.enable_external_links %}style="display: none;"{% endif %}>
+                        <div class="mb-3">
+                            <label for="external_links_menu_name" class="form-label">Menu Name</label>
+                            <input type="text" class="form-control" id="external_links_menu_name" name="external_links_menu_name"
+                                   value="{{ settings.external_links_menu_name or 'External Links' }}" placeholder="External Links">
+                            <small class="form-text text-muted">This name will appear in the navigation bar as the menu title.</small>
+                        </div>
+
+                        <div class="form-check form-switch mb-3">
+                            <input class="form-check-input" type="checkbox" id="external_links_force_menu" name="external_links_force_menu"
+                                {% if settings.external_links_force_menu %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="external_links_force_menu">
+                                Force Menu Display
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Always show external links as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu."></i>
+                            <small class="form-text text-muted d-block">When enabled, external links will always display as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu.</small>
+                        </div>
+
+                        <h6>External Links</h6>
+                        <p class="text-muted small">Define custom links that will appear in the navigation bar for users to access external resources.</p>
+
+                        <table class="table table-sm table-bordered">
+                            <thead>
+                                <tr>
+                                    <th>Label</th>
+                                    <th>URL</th>
+                                    <th>Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="external-links-tbody">
+                                <!-- Populated by JavaScript -->
+                            </tbody>
+                        </table>
+
+                        <button type="button" class="btn btn-sm btn-outline-primary" id="add-external-link-btn">Add New Link</button>
+                        <input type="hidden" name="external_links_json" id="external_links_json">
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/embeddings.html b/application/single_app/templates/admin/_panes/embeddings.html
new file mode 100644
index 000000000..f05c7d66f
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/embeddings.html
@@ -0,0 +1,148 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'embeddings' %} show active{% endif %}" id="embeddings" role="tabpanel" aria-labelledby="embeddings-tab">
+                <div class="card p-3 mb-4" id="embeddings-configuration">
+                    <h5 class="card-title">
+                        <i class="bi bi-vector-pen me-2"></i>Embeddings Configuration
+                    </h5>
+                    <p class="text-muted small">
+                        Configure your embeddings settings. These are used for semantic search, knowledge-base lookups, etc.
+                    </p>
+                    <button type="button" class="btn btn-sm btn-outline-secondary mb-3 align-self-start" data-bs-toggle="modal" data-bs-target="#legacyModelDiscoveryIdentityGuideModal">
+                        <i class="bi bi-question-circle me-1"></i>Setup Guide
+                    </button>
+
+                <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                    <input type="checkbox" class="form-check-input me-2" id="enable_embedding_apim"
+                        name="enable_embedding_apim" {% if settings.enable_embedding_apim %}checked{% endif %}>
+                    <label class="form-check-label" for="enable_embedding_apim">Use APIM instead of direct to Azure
+                        OpenAI endpoint</label>
+                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route embedding model requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
+                </div>
+
+                <div id="non_apim_embedding_settings" {% if settings.enable_embedding_apim %}style="display: none;" {%
+                    endif %}>
+                    <div class="card p-3 mb-3">
+                        <div class="mb-3">
+                            <label for="azure_openai_embedding_endpoint" class="form-label">
+                                Azure OpenAI Embedding Endpoint
+                            </label>
+                            <input type="text" class="form-control" id="azure_openai_embedding_endpoint"
+                                name="azure_openai_embedding_endpoint"
+                                value="{{ settings.azure_openai_embedding_endpoint or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_openai_embedding_authentication_type" class="form-label">
+                                Authentication Type
+                            </label>
+                            <select class="form-select" id="azure_openai_embedding_authentication_type"
+                                name="azure_openai_embedding_authentication_type">
+                                <option value="key" {% if settings.azure_openai_embedding_authentication_type=='key'
+                                    %}selected{% endif %}>
+                                    Key
+                                </option>
+                                <option value="managed_identity" {% if
+                                    settings.azure_openai_embedding_authentication_type=='managed_identity' %}selected{% endif %}>
+                                    Managed Identity
+                                </option>
+                            </select>
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_openai_embedding_subscription_id" class="form-label">Subscription
+                                ID</label>
+                            <input type="text" class="form-control" id="azure_openai_embedding_subscription_id"
+                                name="azure_openai_embedding_subscription_id"
+                                value="{{ settings.azure_openai_embedding_subscription_id or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_openai_embedding_resource_group" class="form-label">Resource Group</label>
+                            <input type="text" class="form-control" id="azure_openai_embedding_resource_group"
+                                name="azure_openai_embedding_resource_group"
+                                value="{{ settings.azure_openai_embedding_resource_group or '' }}">
+                        </div>
+                        <div class="mb-3" id="embedding_key_container" {% if
+                            settings.azure_openai_embedding_authentication_type !='key' %}style="display: none;" {%
+                            endif %}>
+                            <label for="azure_openai_embedding_key" class="form-label">Azure OpenAI Embedding
+                                Key</label>
+                            <div class="input-group">
+                                <input type="password" class="form-control" id="azure_openai_embedding_key"
+                                    name="azure_openai_embedding_key"
+                                    value="{{ settings.azure_openai_embedding_key or '' }}">
+                                <button type="button" class="btn btn-outline-secondary"
+                                    id="toggle_embedding_key">Show</button>
+                            </div>
+                        </div>
+                        <div class="mb-3">
+                            <div id="embedding_models_list" class="mt-2 mb-3">
+
+                            </div>
+                            <small>Save pending changes to settings before clicking Fetch Embedding Models</small><br>
+
+                            <input type="hidden" name="embedding_model_json" id="embedding_model_json" />
+
+
+                            <input type="hidden" id="embedding_model" value="{{ settings.embedding_model.selected[0].deploymentName if settings.embedding_model.selected else '' }}" />
+
+
+                            <button type="button" class="btn btn-secondary" id="fetch_embedding_models_btn">
+                                Fetch Embedding Models
+                            </button>
+                        </div>
+                        <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
+                            data-bs-target="#advancedEmbeddingsFields" aria-expanded="false"
+                            aria-controls="advancedEmbeddingsFields">
+                            Show Advanced
+                        </a>
+                        <div class="collapse" id="advancedEmbeddingsFields">
+                            <div class="card card-body mt-2">
+                                <div class="mb-3">
+                                    <label for="azure_openai_embedding_api_version" class="form-label">
+                                        Azure OpenAI Embedding API Version
+                                    </label>
+                                    <input type="text" class="form-control" id="azure_openai_embedding_api_version"
+                                        name="azure_openai_embedding_api_version"
+                                        value="{{ settings.azure_openai_embedding_api_version or '' }}">
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div id="apim_embedding_settings" class="card p-3 mb-3" {% if not settings.enable_embedding_apim
+                    %}style="display: none;" {% endif %}>
+                    <div class="mb-3">
+                        <label for="azure_apim_embedding_endpoint" class="form-label">Azure APIM Endpoint</label>
+                        <input type="text" class="form-control" id="azure_apim_embedding_endpoint"
+                            name="azure_apim_embedding_endpoint"
+                            value="{{ settings.azure_apim_embedding_endpoint or '' }}">
+                    </div>
+                    <div class="mb-3">
+                        <label for="azure_apim_embedding_api_version" class="form-label">Azure APIM API Version</label>
+                        <input type="text" class="form-control" id="azure_apim_embedding_api_version"
+                            name="azure_apim_embedding_api_version"
+                            value="{{ settings.azure_apim_embedding_api_version or '' }}">
+                    </div>
+                    <div class="mb-3">
+                        <label for="azure_apim_embedding_deployment" class="form-label">Azure APIM Deployment</label>
+                        <input type="text" class="form-control" id="azure_apim_embedding_deployment"
+                            name="azure_apim_embedding_deployment"
+                            value="{{ settings.azure_apim_embedding_deployment or '' }}">
+                    </div>
+                    <div class="mb-3">
+                        <label for="azure_apim_embedding_subscription_key" class="form-label">Azure APIM Subscription
+                            Key</label>
+                        <div class="input-group">
+                            <input type="password" class="form-control" id="azure_apim_embedding_subscription_key"
+                                name="azure_apim_embedding_subscription_key"
+                                value="{{ settings.azure_apim_embedding_subscription_key or '' }}">
+                            <button type="button" class="btn btn-outline-secondary"
+                                id="toggle_azure_apim_embedding_subscription_key">Show</button>
+                        </div>
+                    </div>
+                </div>
+
+                <button type="button" class="btn btn-secondary mt-3" id="test_embedding_button">
+                    Test Embedding Connection
+                </button>
+                <div id="test_embedding_result" class="mt-2"></div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/extraction.html b/application/single_app/templates/admin/_panes/extraction.html
new file mode 100644
index 000000000..9a056e8db
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/extraction.html
@@ -0,0 +1,724 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'extraction' %} show active{% endif %}" id="extraction" role="tabpanel" aria-labelledby="extraction-tab">
+                <div class="card p-3 mb-3" id="document-intelligence-section">
+                    <h5><i class="bi bi-file-earmark-text me-2"></i>Document Intelligence</h5>
+                    <p class="text-muted">
+                        Configure Azure Document Intelligence settings. Document Intelligence always powers
+                        <strong>Standard</strong> extraction and is required for workspaces and chat file uploads.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                        <input
+                            type="checkbox"
+                            class="form-check-input me-2"
+                            id="enable_enhanced_extraction"
+                            name="enable_enhanced_extraction"
+                            {% if settings.enable_enhanced_extraction %}checked{% endif %}
+                        >
+                        <label class="form-check-label" for="enable_enhanced_extraction">
+                            Enable Enhanced extraction
+                        </label>
+                        <button
+                            type="button"
+                            class="btn btn-sm btn-outline-secondary rounded-circle ms-2"
+                            data-bs-toggle="modal"
+                            data-bs-target="#documentIntelligenceExtractionHelpModal"
+                            aria-label="Enhanced extraction guidance"
+                            title="Enhanced extraction guidance"
+                        >
+                            <i class="bi bi-question-lg" aria-hidden="true"></i>
+                        </button>
+                    </div>
+
+                    <div id="enhanced_extraction_settings" class="{% if not settings.enable_enhanced_extraction %}d-none{% endif %}">
+                        {% if content_understanding_supported %}
+                        <div class="alert alert-info small" role="note">
+                            Enhanced extraction uses <strong>Azure AI Content Understanding</strong>, which returns tables,
+                            page structure, checkbox states, and AI-generated descriptions of figures, charts, and images.
+                            Configure the connection below.
+                        </div>
+                        {% else %}
+                        <div class="alert alert-secondary small" id="enhanced_extraction_fallback_notice" role="note">
+                            Azure AI Content Understanding is not available in the
+                            <strong>{{ azure_environment }}</strong> cloud, so Enhanced extraction uses
+                            <strong>Document Intelligence Layout</strong> here. There is nothing more to configure —
+                            Enhanced still captures tables, page structure, forms, and checkbox states.
+                        </div>
+                        {% endif %}
+
+                        <div class="mb-3">
+                            <label for="document_intelligence_pdf_image_extraction_mode" class="form-label mb-0">
+                                PDF and Image Extraction Mode
+                            </label>
+                            <select
+                                class="form-select"
+                                id="document_intelligence_pdf_image_extraction_mode"
+                                name="document_intelligence_pdf_image_extraction_mode"
+                            >
+                                <option value="read" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'read' %}selected{% endif %}>
+                                    Standard - faster text extraction
+                                </option>
+                                <option value="layout" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'layout' %}selected{% endif %}>
+                                    Enhanced - richer structure, tables, and checkbox states
+                                </option>
+                                <option value="auto" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'auto' %}selected{% endif %}>
+                                    Auto - sample first pages, then choose Standard or Enhanced
+                                </option>
+                            </select>
+                            <div class="form-text">
+                                Enhanced captures more document detail for PDFs and images, including tables, page structure, and checked or unchecked marks. It adds latency and has a 6X increase for every 1000 pages when selected.
+                            </div>
+                            <div
+                                class="mt-3 {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') != 'auto' %}d-none{% endif %}"
+                                id="document_intelligence_auto_sample_pages_group"
+                            >
+                                <label for="document_intelligence_auto_sample_pages" class="form-label">
+                                    Auto Sample Pages
+                                </label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="document_intelligence_auto_sample_pages"
+                                    name="document_intelligence_auto_sample_pages"
+                                    min="1"
+                                    max="20"
+                                    value="{{ settings.document_intelligence_auto_sample_pages|default(3) }}"
+                                >
+                                <div class="form-text">
+                                    Auto samples this many first PDF pages with Document Intelligence Layout. If it detects tables, selection marks, or figures, the full PDF uses Enhanced; otherwise it finishes with Standard. Images use Enhanced in Auto mode.
+                                </div>
+                            </div>
+                            <div class="alert alert-light border mt-3 mb-0 small" role="note">
+                                <div><strong>Standard:</strong> Document Intelligence Read. Fastest and lowest-cost path for plain text PDFs and images.</div>
+                                <div><strong>Enhanced:</strong> best for tables, section structure, page layout, forms, checkbox states, and figure descriptions. Expect more latency and higher cost.</div>
+                                <div><strong>Auto:</strong> samples the first pages with Document Intelligence Layout, then uses Enhanced only when the sample shows tables, selection marks, or figures.</div>
+                            </div>
+                        </div>
+
+                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                            <input
+                                type="checkbox"
+                                class="form-check-input me-2"
+                                id="enable_document_intelligence_formula_extraction"
+                                name="enable_document_intelligence_formula_extraction"
+                                {% if settings.enable_document_intelligence_formula_extraction %}checked{% endif %}
+                            >
+                            <label class="form-check-label" for="enable_document_intelligence_formula_extraction">
+                                Extract mathematical formulas
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Requests the Document Intelligence formulas add-on so equations are captured as LaTeX instead of approximated as OCR text."></i>
+                        </div>
+                        <div class="form-text mb-3">
+                            Captures equations in PDFs and images as LaTeX rather than approximate OCR text. This is a
+                            <strong>billed Document Intelligence add-on</strong> that adds per-page cost to every Enhanced
+                            extraction, so it is off by default. It applies to the Layout model only, so it has no effect
+                            while extraction is set to Standard.
+                        </div>
+
+                        {% if content_understanding_supported %}
+                        <div class="card p-3 mb-3 bg-body-tertiary" id="content-understanding-section">
+                            <div class="d-flex align-items-center gap-2 flex-wrap mb-2">
+                                <h6 class="mb-0"><i class="bi bi-stars me-2"></i>Azure AI Content Understanding</h6>
+                                <button
+                                    type="button"
+                                    class="btn btn-sm btn-outline-secondary rounded-circle"
+                                    data-bs-toggle="modal"
+                                    data-bs-target="#contentUnderstandingSetupHelpModal"
+                                    aria-label="Content Understanding setup guide"
+                                    title="Content Understanding setup guide"
+                                >
+                                    <i class="bi bi-question-lg" aria-hidden="true"></i>
+                                </button>
+                            </div>
+                            <p class="text-muted small">
+                                Required for Enhanced extraction. Deployed from a Microsoft Foundry resource.
+                                If this is left blank, Enhanced falls back to Document Intelligence Layout.
+                            </p>
+
+                            <div class="mb-3">
+                                <label for="azure_content_understanding_endpoint" class="form-label">
+                                    Foundry Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_content_understanding_endpoint"
+                                    name="azure_content_understanding_endpoint"
+                                    placeholder="https://your-resource.services.ai.azure.com"
+                                    value="{{ settings.azure_content_understanding_endpoint or '' }}"
+                                >
+                                <div class="form-text">
+                                    Your Microsoft Foundry resource endpoint, without a trailing path.
+                                </div>
+                            </div>
+
+                            <div class="mb-3">
+                                <label for="azure_content_understanding_authentication_type" class="form-label">
+                                    Authentication Type
+                                </label>
+                                <select class="form-select" id="azure_content_understanding_authentication_type" name="azure_content_understanding_authentication_type">
+                                    <option value="key" {% if settings.azure_content_understanding_authentication_type != 'managed_identity' %}selected{% endif %}>
+                                        Key
+                                    </option>
+                                    <option value="managed_identity" {% if settings.azure_content_understanding_authentication_type == 'managed_identity' %}selected{% endif %}>
+                                        Managed Identity
+                                    </option>
+                                </select>
+                                <div class="form-text">
+                                    Managed identity requires the <strong>Cognitive Services User</strong> role on the Foundry resource.
+                                </div>
+                            </div>
+
+                            <div class="mb-3 {% if settings.azure_content_understanding_authentication_type == 'managed_identity' %}d-none{% endif %}" id="azure_content_understanding_key_container">
+                                <label for="azure_content_understanding_key" class="form-label">
+                                    Content Understanding Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_content_understanding_key"
+                                        name="azure_content_understanding_key"
+                                        value="{{ settings.azure_content_understanding_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_content_understanding_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+
+                            <div class="row g-3 mb-3">
+                                <div class="col-md-4">
+                                    <label for="azure_content_understanding_api_version" class="form-label">API Version</label>
+                                    <input
+                                        type="text"
+                                        class="form-control"
+                                        id="azure_content_understanding_api_version"
+                                        name="azure_content_understanding_api_version"
+                                        value="{{ settings.azure_content_understanding_api_version or content_understanding_api_version_default }}"
+                                    >
+                                    <div class="form-text">Default: {{ content_understanding_api_version_default }}</div>
+                                </div>
+                                <div class="col-md-4">
+                                    <label for="azure_content_understanding_analyzer_id" class="form-label">Document Analyzer</label>
+                                    <input
+                                        type="text"
+                                        class="form-control"
+                                        id="azure_content_understanding_analyzer_id"
+                                        name="azure_content_understanding_analyzer_id"
+                                        value="{{ settings.azure_content_understanding_analyzer_id or content_understanding_document_analyzer_default }}"
+                                    >
+                                    <div class="form-text">Default: {{ content_understanding_document_analyzer_default }}</div>
+                                </div>
+                                <div class="col-md-4">
+                                    <label for="azure_content_understanding_image_analyzer_id" class="form-label">Image Analyzer</label>
+                                    <input
+                                        type="text"
+                                        class="form-control"
+                                        id="azure_content_understanding_image_analyzer_id"
+                                        name="azure_content_understanding_image_analyzer_id"
+                                        value="{{ settings.azure_content_understanding_image_analyzer_id or content_understanding_image_analyzer_default }}"
+                                    >
+                                    <div class="form-text">Default: {{ content_understanding_image_analyzer_default }}</div>
+                                </div>
+                            </div>
+
+                            <button
+                                type="button"
+                                class="btn btn-secondary"
+                                style="width: auto;"
+                                id="test_content_understanding_button"
+                            >
+                                Test Content Understanding Connection
+                            </button>
+                            <div id="test_content_understanding_result" class="mt-2"></div>
+                        </div>
+                        {% endif %}
+                    </div>
+
+                    <div class="card p-3 mb-3 bg-body-tertiary" id="office-embedded-image-section">
+                        <h6 class="mb-2"><i class="bi bi-images me-2"></i>Images Inside Office Files</h6>
+                        <p class="text-muted small">
+                            Neither extraction engine describes figures inside Word and PowerPoint files. When this is on,
+                            embedded images are pulled out of the file, analyzed with whichever engine backs the selected
+                            extraction mode, and indexed as their own citable chunks. This works with Standard extraction
+                            too, using Document Intelligence.
+                        </p>
+                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                            <input
+                                type="checkbox"
+                                class="form-check-input me-2"
+                                id="enable_office_embedded_image_analysis"
+                                name="enable_office_embedded_image_analysis"
+                                {% if settings.enable_office_embedded_image_analysis %}checked{% endif %}
+                            >
+                            <label class="form-check-label" for="enable_office_embedded_image_analysis">
+                                Analyze images embedded in DOCX and PPTX files
+                            </label>
+                        </div>
+                        <div class="row g-3 {% if not settings.enable_office_embedded_image_analysis %}d-none{% endif %}" id="office_embedded_image_options">
+                            <div class="col-md-6">
+                                <label for="office_embedded_image_min_pixels" class="form-label">Minimum Image Size (pixels)</label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="office_embedded_image_min_pixels"
+                                    name="office_embedded_image_min_pixels"
+                                    min="1"
+                                    max="2000"
+                                    value="{{ settings.office_embedded_image_min_pixels|default(150) }}"
+                                >
+                                <div class="form-text">Images narrower or shorter than this are skipped as icons or spacers.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="office_embedded_image_max_per_document" class="form-label">Maximum Images Per Document</label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="office_embedded_image_max_per_document"
+                                    name="office_embedded_image_max_per_document"
+                                    min="0"
+                                    max="200"
+                                    value="{{ settings.office_embedded_image_max_per_document|default(25) }}"
+                                >
+                                <div class="form-text">Caps per-document cost. Duplicate images are analyzed once.</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="modal fade" id="documentIntelligenceExtractionHelpModal" tabindex="-1" aria-labelledby="documentIntelligenceExtractionHelpModalLabel" aria-hidden="true">
+                        <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                            <div class="modal-content">
+                                <div class="modal-header">
+                                    <h5 class="modal-title" id="documentIntelligenceExtractionHelpModalLabel">Standard, Enhanced, and Auto</h5>
+                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                                </div>
+                                <div class="modal-body">
+                                    <p><strong>Standard</strong> always uses Azure Document Intelligence Read. It is the fastest and lowest-cost path for mostly text-based PDFs and images, and it is what runs when Enhanced extraction is turned off.</p>
+                                    <p><strong>Enhanced</strong> is for documents where structure matters: tables, page layout, headings, forms, checked or unchecked boxes, and figures.</p>
+                                    <ul>
+                                        <li>In Azure commercial clouds, Enhanced uses <strong>Azure AI Content Understanding</strong>, which additionally generates natural-language descriptions of figures, charts, and diagrams.</li>
+                                        <li>In Azure Government and custom clouds, Content Understanding is unavailable, so Enhanced automatically uses <strong>Document Intelligence Layout</strong> instead. Tables and checkbox states still work; figure descriptions do not.</li>
+                                        <li>If Content Understanding is enabled but unreachable, the document falls back to Document Intelligence Layout and the reason is recorded on the document.</li>
+                                    </ul>
+                                    <p><strong>Auto</strong> lets the platform decide per document. It samples the configured number of first PDF pages with Document Intelligence Layout, which is the cheaper detector. If those pages contain tables, selection marks, or figures, the full document is extracted with Enhanced; otherwise it is extracted with Standard. Images always use Enhanced in Auto mode because they are single-page inputs that benefit from figure and spatial analysis.</p>
+                                    <p class="mb-0"><strong>Cost:</strong> Enhanced adds latency and cost on every document. Content Understanding also invokes a language model per document, so it is more expensive than Document Intelligence Layout. Auto is usually the best value.</p>
+                                </div>
+                                <div class="modal-footer">
+                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="modal fade" id="contentUnderstandingSetupHelpModal" tabindex="-1" aria-labelledby="contentUnderstandingSetupHelpModalLabel" aria-hidden="true">
+                        <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                            <div class="modal-content">
+                                <div class="modal-header">
+                                    <h5 class="modal-title" id="contentUnderstandingSetupHelpModalLabel">Set Up Azure AI Content Understanding</h5>
+                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                                </div>
+                                <div class="modal-body">
+                                    <p>Content Understanding is part of Microsoft Foundry. Follow these steps, then paste the endpoint and key below.</p>
+                                    <h6>1. Create a Microsoft Foundry resource</h6>
+                                    <p>
+                                        In the Azure portal, create a <strong>Microsoft Foundry</strong> resource in one of the supported regions:
+                                        East US, East US 2, West US, West US 3, South Central US, North Europe, West Europe, Sweden Central,
+                                        UK South, Australia East, Japan East, or Southeast Asia. You need Contributor or higher on the subscription
+                                        or resource group.
+                                    </p>
+                                    <div class="alert alert-warning small">
+                                        Content Understanding is not offered in Azure Government or other sovereign clouds. In those clouds
+                                        SimpleChat automatically uses Document Intelligence Layout for Enhanced extraction.
+                                    </div>
+                                    <h6>2. Deploy the models Content Understanding needs</h6>
+                                    <p>
+                                        Analyzers that describe figures require a completion model and an embedding model to be deployed and set
+                                        as resource defaults. In the
+                                        <a href="https://contentunderstanding.ai.azure.com/settings" target="_blank" rel="noopener noreferrer">Content Understanding settings page</a>,
+                                        add your Foundry resource and leave
+                                        <em>Enable autodeployment for required models if no defaults are available</em> checked. Without this step,
+                                        analysis requests fail with a missing model deployment error.
+                                    </p>
+                                    <h6>3. Copy the endpoint and key</h6>
+                                    <p>
+                                        In the Azure portal, open the Foundry resource and go to
+                                        <strong>Resource Management &rarr; Keys and Endpoint</strong>. The endpoint looks like
+                                        <code>https://your-resource.services.ai.azure.com</code>. Paste it into
+                                        <strong>Content Understanding Endpoint</strong>, and paste either key into
+                                        <strong>Content Understanding Key</strong>.
+                                    </p>
+                                    <h6>4. Or use managed identity instead of a key</h6>
+                                    <p>
+                                        Set <strong>Authentication Type</strong> to Managed Identity and assign this application's identity the
+                                        <strong>Cognitive Services User</strong> role on the Foundry resource. That role assignment is required even
+                                        for resource owners.
+                                    </p>
+                                    <h6>5. Test the connection</h6>
+                                    <p class="mb-0">
+                                        Use <strong>Test Content Understanding Connection</strong> to confirm the endpoint, credentials, and analyzer
+                                        are reachable before saving.
+                                        See the
+                                        <a href="https://learn.microsoft.com/azure/ai-services/content-understanding/quickstart/use-rest-api" target="_blank" rel="noopener noreferrer">Content Understanding quickstart</a>
+                                        for more detail.
+                                    </p>
+                                </div>
+                                <div class="modal-footer">
+                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                        <input
+                            type="checkbox"
+                            class="form-check-input me-2"
+                            id="enable_document_intelligence_apim"
+                            name="enable_document_intelligence_apim"
+                            {% if settings.enable_document_intelligence_apim %}checked{% endif %}
+                        >
+                        <label class="form-check-label" for="enable_document_intelligence_apim">
+                            Use APIM instead of direct Document Intelligence endpoint
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route Document Intelligence requests through API Management for centralized monitoring and control instead of direct service access."></i>
+                    </div>
+
+                    <div>
+
+                        <div id="non_apim_document_intelligence_settings" {% if settings.enable_document_intelligence_apim %}style="display: none;"{% endif %}>
+                            <div class="mb-3">
+                                <label for="azure_document_intelligence_endpoint" class="form-label">
+                                    Document Intelligence Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_document_intelligence_endpoint"
+                                    name="azure_document_intelligence_endpoint"
+                                    value="{{ settings.azure_document_intelligence_endpoint or '' }}"
+                                >
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_document_intelligence_authentication_type" class="form-label">
+                                    Authentication Type
+                                </label>
+                                <select class="form-select" id="azure_document_intelligence_authentication_type" name="azure_document_intelligence_authentication_type">
+                                    <option value="key" {% if settings.azure_document_intelligence_authentication_type=='key' %}selected{% endif %}>
+                                        Key
+                                    </option>
+                                    <option value="managed_identity" {% if settings.azure_document_intelligence_authentication_type=='managed_identity' %}selected{% endif %}>
+                                        Managed Identity
+                                    </option>
+                                </select>
+                            </div>
+                            <div class="mb-3" id="azure_document_intelligence_key_container" {% if settings.azure_document_intelligence_authentication_type !='key' %}style="display: none;"{% endif %}>
+                                <label for="azure_document_intelligence_key" class="form-label">
+                                    Document Intelligence Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_document_intelligence_key"
+                                        name="azure_document_intelligence_key"
+                                        value="{{ settings.azure_document_intelligence_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_docintel_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <div id="apim_document_intelligence_settings" {% if not settings.enable_document_intelligence_apim %}style="display: none;"{% endif %}>
+                            <div class="mb-3">
+                                <label for="azure_apim_document_intelligence_endpoint" class="form-label">
+                                    Azure APIM Document Intelligence Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_apim_document_intelligence_endpoint"
+                                    name="azure_apim_document_intelligence_endpoint"
+                                    value="{{ settings.azure_apim_document_intelligence_endpoint or '' }}"
+                                >
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_apim_document_intelligence_subscription_key" class="form-label">
+                                    Azure APIM Document Intelligence Subscription Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_apim_document_intelligence_subscription_key"
+                                        name="azure_apim_document_intelligence_subscription_key"
+                                        value="{{ settings.azure_apim_document_intelligence_subscription_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_azure_apim_document_intelligence_subscription_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <button
+                            type="button"
+                            class="btn btn-secondary mt-3"
+                            style="width: auto;"
+                            id="test_azure_doc_intelligence_button"
+                        >
+                            Test Document Intelligence Connection
+                        </button>
+                        <div id="test_azure_doc_intelligence_result" class="mt-2"></div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="chunk-size-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0"><i class="bi bi-collection me-2"></i>Chunk Sizes</h5>
+                        <span class="badge bg-primary-subtle text-primary-emphasis">Cap: {{ chunk_size_cap }}</span>
+                    </div>
+                    <p class="text-muted mb-2 small">Custom chunk sizes apply to new uploads only. Existing documents keep their current chunks.</p>
+                    <div class="alert alert-warning small mb-3">
+                        <strong>Heads up:</strong> Overrides are capped at {{ chunk_size_cap }} (2x embedding context window, fallback 16,384).
+                    </div>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_chunk_size_override"
+                            name="enable_chunk_size_override"
+                            {% if settings.enable_chunk_size_override %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_chunk_size_override">
+                            Enable custom chunk sizes by file type
+                        </label>
+                    </div>
+
+                    <div id="chunk-size-fields" class="{% if not settings.enable_chunk_size_override %}d-none{% endif %}">
+                        <div id="chunk-size-cap-warning" class="alert alert-warning d-none" role="alert">
+                            <span id="chunk-size-cap-warning-text">Chunk sizes above the cap will be reduced automatically.</span>
+                        </div>
+                        <input type="hidden" id="chunk_size_cap" value="{{ chunk_size_cap }}" />
+                        {% set chunk_settings = chunk_size_settings or {} %}
+                        {% set chunk_defaults = chunk_size_defaults or {} %}
+                        <div class="row g-3">
+                            <div class="col-md-6">
+                                <label for="chunk_size_txt" class="form-label">TXT (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="TXT" id="chunk_size_txt" name="chunk_size_txt" value="{{ chunk_settings.get('txt', {}).get('value', chunk_defaults.get('txt', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_log" class="form-label">LOG (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="LOG" id="chunk_size_log" name="chunk_size_log" value="{{ chunk_settings.get('log', {}).get('value', chunk_defaults.get('log', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="chunk_size_doc" class="form-label">DOC (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOC" id="chunk_size_doc" name="chunk_size_doc" value="{{ chunk_settings.get('doc', {}).get('value', chunk_defaults.get('doc', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="chunk_size_docm" class="form-label">DOCM (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOCM" id="chunk_size_docm" name="chunk_size_docm" value="{{ chunk_settings.get('docm', {}).get('value', chunk_defaults.get('docm', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="chunk_size_docx" class="form-label">DOCX (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOCX" id="chunk_size_docx" name="chunk_size_docx" value="{{ chunk_settings.get('docx', {}).get('value', chunk_defaults.get('docx', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_html" class="form-label">HTML (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="HTML" id="chunk_size_html" name="chunk_size_html" value="{{ chunk_settings.get('html', {}).get('value', chunk_defaults.get('html', {}).get('value')) }}">
+                                <div class="form-text">Minimum enforced at 50% of target on merge.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_md" class="form-label">Markdown (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="MD" id="chunk_size_md" name="chunk_size_md" value="{{ chunk_settings.get('md', {}).get('value', chunk_defaults.get('md', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_xml" class="form-label">XML (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="XML" id="chunk_size_xml" name="chunk_size_xml" value="{{ chunk_settings.get('xml', {}).get('value', chunk_defaults.get('xml', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_yaml" class="form-label">YAML (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="YAML" id="chunk_size_yaml" name="chunk_size_yaml" value="{{ chunk_settings.get('yaml', {}).get('value', chunk_defaults.get('yaml', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_yml" class="form-label">YML (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="YML" id="chunk_size_yml" name="chunk_size_yml" value="{{ chunk_settings.get('yml', {}).get('value', chunk_defaults.get('yml', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_json" class="form-label">JSON (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="JSON" id="chunk_size_json" name="chunk_size_json" value="{{ chunk_settings.get('json', {}).get('value', chunk_defaults.get('json', {}).get('value')) }}">
+                            </div>
+                            <!--
+                            <div class="col-md-6">
+                                <label for="chunk_size_csv" class="form-label">CSV (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="CSV" id="chunk_size_csv" name="chunk_size_csv" value="{{ chunk_settings.get('csv', {}).get('value', chunk_defaults.get('csv', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_excel" class="form-label">Excel (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="EXCEL" id="chunk_size_excel" name="chunk_size_excel" value="{{ chunk_settings.get('excel', {}).get('value', chunk_defaults.get('excel', {}).get('value')) }}">
+                            </div>
+                            -->
+                            <div class="col-md-6">
+                                <label for="chunk_size_transcript" class="form-label">Transcripts (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="TRANSCRIPT" id="chunk_size_transcript" name="chunk_size_transcript" value="{{ chunk_settings.get('transcript', {}).get('value', chunk_defaults.get('transcript', {}).get('value')) }}">
+                                <div class="form-text">Applies to new audio transcripts.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_pdf" class="form-label">PDF (pages)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="PDF" id="chunk_size_pdf" name="chunk_size_pdf" value="{{ chunk_settings.get('pdf', {}).get('value', chunk_defaults.get('pdf', {}).get('value')) }}">
+                                <div class="form-text">Pages per chunk after extraction.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_pptx" class="form-label">PPT/PPTX (slides)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="PPT/PPTX" id="chunk_size_pptx" name="chunk_size_pptx" value="{{ chunk_settings.get('pptx', {}).get('value', chunk_defaults.get('pptx', {}).get('value')) }}">
+                                <div class="form-text">Slides per chunk after extraction.</div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- AI Video Intelligence Card -->
+                <div class="card mb-3 p-3" id="metadata-extraction-section">
+                    <h5>
+                        <i class="bi bi-file-earmark-code me-2"></i>Metadata Extraction
+                    </h5>
+                    <p class="text-muted">
+                      Enable this to automatically parse and store file metadata for advanced indexing and search.
+                    </p>
+                    <div class="form-check form-switch mb-3">
+                      <input
+                        type="checkbox"
+                        class="form-check-input"
+                        id="enable_extract_meta_data"
+                        name="enable_extract_meta_data"
+                        {% if settings.enable_extract_meta_data %}checked{% endif %}>
+                      <label class="form-check-label ms-2" for="enable_extract_meta_data">
+                        Enable Extract Meta Data
+                      </label>
+                      <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Automatically extract and index metadata from uploaded files for enhanced search capabilities and content organization."></i>
+                    </div>
+
+                    <div id="metadata_extraction_model_settings" class="mb-3"
+                         {% if not settings.enable_extract_meta_data %}style="display: none;"{% endif %}>
+                                            <label for="metadata_extraction_model" class="form-label">Extraction Model</label>
+                                            <select class="form-select" id="metadata_extraction_model" name="metadata_extraction_model">
+                                                <option value="">No metadata extraction model selected</option>
+                                            </select>
+                                            <input type="hidden" name="metadata_extraction_model_selection_json" id="metadata_extraction_model_selection_json" />
+                                            <div class="form-text">
+                                                Uses Global Endpoints when multi-endpoint model management is enabled; otherwise uses the legacy GPT/APIM deployment settings.
+                                            </div>
+                    </div>
+                </div>
+
+                <!-- Multi-Modal Vision Analysis Section -->
+                <div class="card mb-3 p-3" id="multimodal-vision-section">
+                    <h5>
+                        <i class="bi bi-eye me-2"></i>Multi-Modal Vision Analysis
+                    </h5>
+                    <p class="text-muted">
+                        Enable AI-powered vision analysis for images uploaded to chat or workspace. When enabled alongside Document Intelligence OCR, images will receive both text extraction (OCR) and semantic understanding (vision AI).
+                    </p>
+
+                    <div class="alert alert-info mb-3">
+                        <strong><i class="bi bi-info-circle"></i> How it works:</strong>
+                        <ul class="mb-0 mt-2">
+                            <li><strong>Document Intelligence</strong>: Extracts text from images (OCR)</li>
+                            <li><strong>Vision Model</strong>: Provides semantic analysis, object detection, and contextual understanding</li>
+                            <li>Both analyses are combined and available in citations when Enhanced Citations is enabled</li>
+                        </ul>
+                    </div>
+
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_multimodal_vision"
+                            name="enable_multimodal_vision"
+                            {% if settings.enable_multimodal_vision %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_multimodal_vision">
+                            Enable Multi-Modal Vision Analysis
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Use GPT-4 Vision or similar models to analyze images for semantic content, objects, and contextual information beyond OCR."></i>
+                    </div>
+
+                    <div id="multimodal_vision_model_settings" class="mb-3"
+                         {% if not settings.enable_multimodal_vision %}style="display: none;"{% endif %}>
+                        <label for="multimodal_vision_model" class="form-label">
+                            Vision Model <span class="text-danger">*</span>
+                        </label>
+                        <select class="form-select" id="multimodal_vision_model" name="multimodal_vision_model"
+                                data-prev="{{ settings.multimodal_vision_model or '' }}">
+                            <option value="">Select a vision-capable model...</option>
+
+                            {#
+                                Multi-endpoint aware vision model selection.
+                                Preference order:
+                                1. When multi-endpoint is enabled and model_endpoints has entries, use those.
+                                2. Otherwise, fall back to legacy gpt_model.selected / APIM settings.
+                            #}
+
+                            {% set has_multi_endpoints = settings.enable_multi_model_endpoints and settings.model_endpoints %}
+
+                            {% if has_multi_endpoints %}
+                                {# Iterate all enabled endpoints and models, filter to vision-capable #}
+                                {% for endpoint in settings.model_endpoints if endpoint.enabled %}
+                                    {% for m in endpoint.models if m.enabled %}
+                                        {% if is_vision_capable_model is defined and is_vision_capable_model(m) %}
+                                            {% set option_value = m.deploymentName %}
+                                            <option value="{{ option_value }}"
+                                                data-endpoint-id="{{ endpoint.id or '' }}"
+                                                data-model-id="{{ m.id or '' }}"
+                                                data-provider="{{ endpoint.provider or '' }}"
+                                                data-model-name="{{ m.modelName or '' }}"
+                                                {% if settings.multimodal_vision_model == option_value %}selected{% endif %}>
+                                                {{ m.displayName or m.deploymentName }}{% if m.modelName %} ({{ m.modelName }}){% endif %}
+                                            </option>
+                                        {% endif %}
+                                    {% endfor %}
+                                {% endfor %}
+                            {% elif settings.enable_gpt_apim %}
+                                {# Legacy APIM-based GPT configuration #}
+                                {% for d in (settings.azure_apim_gpt_deployment or '').split(',') if d %}
+                                    {% set d_trim = d.strip() %}
+                                    {% if is_vision_capable_model is defined and is_vision_capable_model(d_trim) %}
+                                        <option value="{{ d_trim }}"
+                                            {% if settings.multimodal_vision_model == d_trim %}selected{% endif %}>
+                                            {{ d_trim }}
+                                        </option>
+                                    {% endif %}
+                                {% endfor %}
+                            {% else %}
+                                {# Legacy single-endpoint GPT configuration #}
+                                {% for m in settings.gpt_model.selected %}
+                                    {% if is_vision_capable_model is defined and is_vision_capable_model(m) %}
+                                        <option value="{{ m.deploymentName }}"
+                                            {% if settings.multimodal_vision_model == m.deploymentName %}selected{% endif %}>
+                                            {{ m.deploymentName }}{% if m.modelName %} ({{ m.modelName }}){% endif %}
+                                        </option>
+                                    {% endif %}
+                                {% endfor %}
+                            {% endif %}
+                        </select>
+                        <div class="form-text">Select a GPT model with vision capabilities (for example, gpt-4o or supported GPT 5 and later models). Only vision-capable models are shown.</div>
+
+                        <button type="button" class="btn btn-secondary mt-3" id="test_multimodal_vision_button">
+                            <i class="bi bi-clipboard-check me-1"></i>Test Vision Analysis
+                        </button>
+                        <div id="test_multimodal_vision_result" class="mt-2"></div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/feature-governance.html b/application/single_app/templates/admin/_panes/feature-governance.html
new file mode 100644
index 000000000..0b7dcfed1
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/feature-governance.html
@@ -0,0 +1,67 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'feature-governance' %} show active{% endif %}" id="feature-governance" role="tabpanel" aria-labelledby="feature-governance-tab">
+                <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-2 mb-3">
+                    <p class="text-muted mb-0">
+                        Configure governance enforcement for endpoint, agent, and action creation or usage. Governance is disabled by default and only enforced when toggled on.
+                    </p>
+                    <button type="button" class="btn btn-outline-info btn-sm flex-shrink-0" id="governance-info-guide-btn" data-bs-toggle="modal" data-bs-target="#governanceInfoModal">
+                        <i class="bi bi-info-circle me-1"></i>Configuration Guide
+                    </button>
+                </div>
+
+                <div class="card p-3 mb-3" id="governance-feature-toggles-section">
+                    <h5>
+                        <i class="bi bi-braces-asterisk me-2"></i>Governance Feature Toggles
+                    </h5>
+                    <p class="text-muted">Turn on governance checks for each feature area. Save with the main Settings button to persist these toggles.</p>
+
+                    <div class="row">
+                        <div class="col-md-4">
+                            <div class="fw-semibold mb-2">Personal Scope</div>
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="governance_user_endpoints" name="governance_user_endpoints" {% if settings.governance_user_endpoints %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="governance_user_endpoints">Govern Personal Endpoints</label>
+                            </div>
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="governance_user_agents" name="governance_user_agents" {% if settings.governance_user_agents %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="governance_user_agents">Govern Personal Agents</label>
+                            </div>
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="governance_user_actions" name="governance_user_actions" {% if settings.governance_user_actions %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="governance_user_actions">Govern Personal Actions</label>
+                            </div>
+                        </div>
+                        <div class="col-md-4">
+                            <div class="fw-semibold mb-2">Group Scope</div>
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="governance_group_endpoints" name="governance_group_endpoints" {% if settings.governance_group_endpoints %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="governance_group_endpoints">Govern Group Endpoints</label>
+                            </div>
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="governance_group_agents" name="governance_group_agents" {% if settings.governance_group_agents %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="governance_group_agents">Govern Group Agents</label>
+                            </div>
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="governance_group_actions" name="governance_group_actions" {% if settings.governance_group_actions %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="governance_group_actions">Govern Group Actions</label>
+                            </div>
+                        </div>
+                        <div class="col-md-4">
+                            <div class="fw-semibold mb-2">Global Scope</div>
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="governance_global_endpoints" name="governance_global_endpoints" checked disabled data-governance-locked="true">
+                                <label class="form-check-label ms-2" for="governance_global_endpoints">Govern Global Endpoints</label>
+                                <span class="badge bg-info text-dark ms-2">Always On</span>
+                            </div>
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="governance_global_agents_usage" name="governance_global_agents_usage" {% if settings.governance_global_agents_usage %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="governance_global_agents_usage">Govern Global Agents</label>
+                            </div>
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="governance_global_actions_usage" name="governance_global_actions_usage" {% if settings.governance_global_actions_usage %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="governance_global_actions_usage">Govern Global Actions</label>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/feedback-alerts.html b/application/single_app/templates/admin/_panes/feedback-alerts.html
new file mode 100644
index 000000000..5488e7242
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/feedback-alerts.html
@@ -0,0 +1,44 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'feedback-alerts' %} show active{% endif %}" id="feedback-alerts" role="tabpanel" aria-labelledby="feedback-alerts-tab">
+                <div class="card p-3 mb-3" id="user-feedback-section">
+                    <h5>
+                        <i class="bi bi-chat-square-heart me-2"></i>User Feedback
+                    </h5>
+                    <p class="text-muted">Enable user feedback (thumbs up/down) for AI responses.</p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_user_feedback"
+                            name="enable_user_feedback"
+                            {% if settings.enable_user_feedback %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_user_feedback">
+                            Enable User Feedback (Thumbs Up/Down)
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to provide thumbs up/down feedback on AI responses for quality monitoring and improvement."></i>
+                    </div>
+                </div>
+                <div class="card p-3 mb-3" id="desktop-notifications-section">
+                    <h5>
+                        <i class="bi bi-bell me-2"></i>Desktop Conversation Notifications
+                    </h5>
+                    <p class="text-muted">
+                        Allow users to receive an operating system notification when an AI response finishes while SimpleChat is open in a hidden or unfocused browser tab.
+                    </p>
+                    <div class="form-group form-check form-switch mb-2">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_desktop_notifications"
+                            name="enable_desktop_notifications"
+                            {% if settings.enable_desktop_notifications %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_desktop_notifications">
+                            Enable Desktop Conversation Notifications
+                        </label>
+                    </div>
+                    <p class="form-text text-muted mb-0">
+                        Users can turn notifications off from Profile. Browser permission is required, and notifications stop when the SimpleChat tab is closed.
+                    </p>
+                </div>
+            </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/file-sync.html b/application/single_app/templates/admin/_panes/file-sync.html
new file mode 100644
index 000000000..eb440758a
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/file-sync.html
@@ -0,0 +1,416 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'file-sync' %} show active{% endif %}" id="file-sync" role="tabpanel" aria-labelledby="file-sync-tab">
+                <p class="text-muted">
+                    Configure file synchronization for personal, group, and public workspaces.
+                </p>
+
+                <div class="card mb-3 p-3" id="file-sync-section"
+                    data-requires="enable_redis_cache"
+                    data-requires-label="Redis Cache"
+                    data-requires-target="redis-cache-section"
+                    data-requires-mode="warn"
+                    data-requires-description="File Sync settings can be saved now, but sync runs stay inactive until Redis Cache is enabled and configured.">
+                    <div class="d-flex flex-wrap justify-content-between align-items-center gap-2 mb-2">
+                        <h5 class="mb-0">
+                            <i class="bi bi-arrow-repeat me-2"></i>File Sync
+                        </h5>
+                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#file-sync-app-role-setup-modal">
+                            <i class="bi bi-info-circle me-1"></i>App Role Setup
+                        </button>
+                    </div>
+                    <p class="text-muted">
+                        Enable File Sync globally, set conservative run limits, and choose whether workspace managers or SimpleChat admins manage sync sources.
+                    </p>
+
+                    <div class="alert alert-warning" role="alert">
+                        File Sync can scan large remote shares and create many document versions. Start with narrow filters, conservative schedules, and low per-run limits before enabling broad workspace access.
+                    </div>
+
+                    {% if settings.enable_redis_cache and not settings.file_sync_redis_ready %}
+                    <div class="alert alert-danger" role="alert">
+                        Redis Cache is enabled but not fully configured, so File Sync cannot run yet. Check the Redis URL and credentials.
+                    </div>
+                    {% elif settings.requested_enable_file_sync and not settings.file_sync_effective_enabled %}
+                    <div class="alert alert-warning" role="alert">
+                        File Sync is saved as requested but is not currently active. Check Redis configuration and scope controls.
+                    </div>
+                    {% endif %}
+
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_file_sync"
+                            name="enable_file_sync"
+                            {% if settings.requested_enable_file_sync %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_file_sync">
+                            Enable File Sync
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable File Sync source management and sync runs for allowed workspaces. Redis Cache is required before sync is active."></i>
+                    </div>
+
+                    <div id="file_sync_settings" class="{% if not settings.requested_enable_file_sync %}d-none{% endif %}">
+                        <div class="row g-3 mb-3">
+                            <div class="col-md-3">
+                                <label for="file_sync_max_sources_per_scope" class="form-label">Max Sources</label>
+                                <input type="number" class="form-control" id="file_sync_max_sources_per_scope" name="file_sync_max_sources_per_scope" min="1" max="100" value="{{ settings.file_sync_max_sources_per_scope }}">
+                            </div>
+                            <div class="col-md-3">
+                                <label for="file_sync_min_schedule_interval_minutes" class="form-label">Min Schedule Minutes</label>
+                                <input type="number" class="form-control" id="file_sync_min_schedule_interval_minutes" name="file_sync_min_schedule_interval_minutes" min="5" max="1440" value="{{ settings.file_sync_min_schedule_interval_minutes }}">
+                            </div>
+                            <div class="col-md-3">
+                                <label for="file_sync_max_files_per_run" class="form-label">Max Files Per Run</label>
+                                <input type="number" class="form-control" id="file_sync_max_files_per_run" name="file_sync_max_files_per_run" min="1" max="100000" value="{{ settings.file_sync_max_files_per_run }}">
+                            </div>
+                            <div class="col-md-3">
+                                <label for="file_sync_max_gb_per_run" class="form-label">Max GB Per Run</label>
+                                <input type="number" class="form-control" id="file_sync_max_gb_per_run" name="file_sync_max_gb_per_run" min="1" value="{{ settings.file_sync_max_gb_per_run }}">
+                            </div>
+                        </div>
+
+                        <div class="row g-3 mb-4">
+                            <div class="col-md-4">
+                                <label for="file_sync_max_concurrent_runs" class="form-label">Max Concurrent Runs</label>
+                                <input type="number" class="form-control" id="file_sync_max_concurrent_runs" name="file_sync_max_concurrent_runs" min="1" max="25" value="{{ settings.file_sync_max_concurrent_runs }}">
+                            </div>
+                            <div class="col-md-4 d-flex align-items-end">
+                                <div class="form-check form-switch mb-2">
+                                    <input type="checkbox" class="form-check-input" id="file_sync_allow_recursive_sources" name="file_sync_allow_recursive_sources" {% if settings.file_sync_allow_recursive_sources %}checked{% endif %}>
+                                    <label class="form-check-label" for="file_sync_allow_recursive_sources">Allow Recursive Sources</label>
+                                </div>
+                            </div>
+                        </div>
+
+                        {% set file_sync_visible_source_types = settings.file_sync_visible_source_types|default(['smb', 'azure_files']) %}
+                        <div class="border rounded p-3 mb-4" id="file-sync-source-types-section">
+                            <h6 class="mb-2"><i class="bi bi-sliders me-2"></i>Visible Source Types</h6>
+                            <p class="text-muted small mb-3">
+                                Choose which source types appear in the Add Source workflow. OneDrive, SharePoint, and Google Workspace connectors are coming soon while validation continues.
+                            </p>
+                            <div class="row g-3">
+                                <div class="col-md-4">
+                                    <div class="form-check">
+                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_smb" name="file_sync_visible_source_types" value="smb" {% if 'smb' in file_sync_visible_source_types %}checked{% endif %}>
+                                        <label class="form-check-label" for="file_sync_visible_source_type_smb">SMB Share</label>
+                                        <div class="form-text">Available now.</div>
+                                    </div>
+                                </div>
+                                <div class="col-md-4">
+                                    <div class="form-check">
+                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_azure_files" name="file_sync_visible_source_types" value="azure_files" {% if 'azure_files' in file_sync_visible_source_types %}checked{% endif %}>
+                                        <label class="form-check-label" for="file_sync_visible_source_type_azure_files">Azure Files</label>
+                                        <div class="form-text">Available now.</div>
+                                    </div>
+                                </div>
+                                <div class="col-md-4">
+                                    <div class="form-check">
+                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_azure_blob" name="file_sync_visible_source_types" value="azure_blob" {% if 'azure_blob' in file_sync_visible_source_types %}checked{% endif %}>
+                                        <label class="form-check-label" for="file_sync_visible_source_type_azure_blob">Azure Blob Storage</label>
+                                        <div class="form-text">Available now.</div>
+                                    </div>
+                                </div>
+                                <div class="col-md-4">
+                                    <div class="form-check">
+                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_onedrive" value="onedrive" disabled>
+                                        <label class="form-check-label" for="file_sync_visible_source_type_onedrive">OneDrive</label>
+                                        <div class="form-text">Coming Soon.</div>
+                                    </div>
+                                </div>
+                                <div class="col-md-4">
+                                    <div class="form-check">
+                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_sharepoint_on_prem" value="sharepoint_on_prem" disabled>
+                                        <label class="form-check-label" for="file_sync_visible_source_type_sharepoint_on_prem">On-prem SharePoint</label>
+                                        <div class="form-text">Coming Soon.</div>
+                                    </div>
+                                </div>
+                                <div class="col-md-4">
+                                    <div class="form-check">
+                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_google_workspace" value="google_workspace" disabled>
+                                        <label class="form-check-label" for="file_sync_visible_source_type_google_workspace">Google Workspace</label>
+                                        <div class="form-text">Coming Soon.</div>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="alert alert-info mb-4" role="alert">
+                            <div class="fw-semibold mb-1">Cloud drive connector identities</div>
+                            <div class="small">
+                                OneDrive, SharePoint, and Google Workspace File Sync connectors are coming soon. Any existing global connector identities can remain configured for future use.
+                            </div>
+                        </div>
+
+                        <div class="row g-3">
+                            <div class="col-12">
+                                <div class="border rounded h-100 p-3" id="file-sync-personal-section" data-testid="file-sync-personal-card">
+                                    <h6 class="mb-3"><i class="bi bi-person me-2"></i>Personal Workspace Sync</h6>
+                                    <div class="form-check form-switch mb-3">
+                                        <input type="checkbox" class="form-check-input" id="enable_file_sync_personal" name="enable_file_sync_personal" {% if settings.enable_file_sync_personal %}checked{% endif %}>
+                                        <label class="form-check-label" for="enable_file_sync_personal">Enable personal sync</label>
+                                    </div>
+                                    <div class="form-check form-switch mb-3">
+                                        <input type="checkbox" class="form-check-input" id="file_sync_personal_admin_only" name="file_sync_personal_admin_only" {% if settings.file_sync_personal_admin_only %}checked{% endif %}>
+                                        <label class="form-check-label" for="file_sync_personal_admin_only">Admins manage sources only</label>
+                                    </div>
+                                    <div class="form-check form-switch mb-2">
+                                        <input type="checkbox" class="form-check-input" id="file_sync_personal_require_app_role" name="file_sync_personal_require_app_role" {% if settings.file_sync_personal_require_app_role %}checked{% endif %}>
+                                        <label class="form-check-label" for="file_sync_personal_require_app_role">Require PersonalFileSyncUser App Role</label>
+                                    </div>
+                                    <div class="form-text mb-3">Required app role value: <code>PersonalFileSyncUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement for personal sync.</div>
+                                    <hr />
+                                    <div data-file-sync-admin-target data-scope="personal" data-search-endpoint="/api/admin/file-sync/users/search" data-results-key="users" data-value-field="id" data-title-field="displayName" data-subtitle-field="email">
+                                        <label class="form-label" for="file-sync-admin-personal-target-query">Manage User Sources</label>
+                                        <div class="input-group mb-2">
+                                            <input type="search" class="form-control" id="file-sync-admin-personal-target-query" data-file-sync-admin-target-query placeholder="Search user" aria-label="Search user to manage" />
+                                            <button class="btn btn-outline-secondary" type="button" data-file-sync-admin-target-search>Search</button>
+                                        </div>
+                                        <div class="list-group small mb-2 d-none" data-file-sync-admin-target-results></div>
+                                        <div class="input-group">
+                                            <input type="text" class="form-control" data-file-sync-admin-target-id placeholder="User ID" aria-label="Target user ID" />
+                                            <button class="btn btn-primary" type="button" data-file-sync-admin-target-manage disabled>Manage Sources</button>
+                                        </div>
+                                        <div class="form-text" data-file-sync-admin-target-label>No user selected.</div>
+                                    </div>
+                                </div>
+                            </div>
+
+                            <div class="col-12">
+                                <div class="border rounded h-100 p-3" id="file-sync-group-section" data-testid="file-sync-group-card">
+                                    <h6 class="mb-3"><i class="bi bi-people me-2"></i>Group Workspace Sync</h6>
+                                    <div class="form-check form-switch mb-3">
+                                        <input type="checkbox" class="form-check-input" id="enable_file_sync_group" name="enable_file_sync_group" {% if settings.enable_file_sync_group %}checked{% endif %}>
+                                        <label class="form-check-label" for="enable_file_sync_group">Enable group sync</label>
+                                    </div>
+                                    <div class="form-check form-switch mb-3">
+                                        <input type="checkbox" class="form-check-input" id="file_sync_group_admin_only" name="file_sync_group_admin_only" {% if settings.file_sync_group_admin_only %}checked{% endif %}>
+                                        <label class="form-check-label" for="file_sync_group_admin_only">Admins manage sources only</label>
+                                    </div>
+                                    <div class="form-check form-switch mb-2">
+                                        <input type="checkbox" class="form-check-input" id="require_group_assignment_for_file_sync" name="require_group_assignment_for_file_sync" {% if settings.require_group_assignment_for_file_sync %}checked{% endif %}>
+                                        <label class="form-check-label" for="require_group_assignment_for_file_sync">Require Group Assignment to Use File Sync</label>
+                                    </div>
+                                    <div class="d-flex flex-wrap align-items-center gap-2 mb-3">
+                                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-sync-groups-btn" data-bs-toggle="modal" data-bs-target="#fileSyncGroupAssignmentModal">
+                                            <i class="bi bi-people me-1"></i>Manage Groups
+                                        </button>
+                                        <span class="text-muted small" id="file-sync-group-assignment-summary">No groups assigned.</span>
+                                    </div>
+                                    <textarea class="d-none" id="file_sync_allowed_group_ids" name="file_sync_allowed_group_ids">{{ settings.file_sync_allowed_group_ids|default([], true)|tojson }}</textarea>
+                                    <hr />
+                                    <div data-file-sync-admin-target data-scope="group" data-search-endpoint="/api/admin/file-sync/groups/search" data-results-key="groups" data-value-field="id" data-title-field="name" data-subtitle-field="description">
+                                        <label class="form-label" for="file-sync-admin-group-target-query">Manage Group Sources</label>
+                                        <div class="input-group mb-2">
+                                            <input type="search" class="form-control" id="file-sync-admin-group-target-query" data-file-sync-admin-target-query placeholder="Search group" aria-label="Search group to manage" />
+                                            <button class="btn btn-outline-secondary" type="button" data-file-sync-admin-target-search>Search</button>
+                                        </div>
+                                        <div class="list-group small mb-2 d-none" data-file-sync-admin-target-results></div>
+                                        <div class="input-group">
+                                            <input type="text" class="form-control" data-file-sync-admin-target-id placeholder="Group ID" aria-label="Target group ID" />
+                                            <button class="btn btn-primary" type="button" data-file-sync-admin-target-manage disabled>Manage Sources</button>
+                                        </div>
+                                        <div class="form-text" data-file-sync-admin-target-label>No group selected.</div>
+                                    </div>
+                                </div>
+                            </div>
+
+                            <div class="col-12">
+                                <div class="border rounded h-100 p-3" id="file-sync-public-section" data-testid="file-sync-public-card">
+                                    <h6 class="mb-3"><i class="bi bi-globe me-2"></i>Public Workspace Sync</h6>
+                                    <div class="form-check form-switch mb-3">
+                                        <input type="checkbox" class="form-check-input" id="enable_file_sync_public" name="enable_file_sync_public" {% if settings.enable_file_sync_public %}checked{% endif %}>
+                                        <label class="form-check-label" for="enable_file_sync_public">Enable public sync</label>
+                                    </div>
+                                    <div class="form-check form-switch mb-3">
+                                        <input type="checkbox" class="form-check-input" id="file_sync_public_admin_only" name="file_sync_public_admin_only" {% if settings.file_sync_public_admin_only %}checked{% endif %}>
+                                        <label class="form-check-label" for="file_sync_public_admin_only">Admins manage sources only</label>
+                                    </div>
+                                    <div class="form-check form-switch mb-2">
+                                        <input type="checkbox" class="form-check-input" id="require_public_workspace_assignment_for_file_sync" name="require_public_workspace_assignment_for_file_sync" {% if settings.require_public_workspace_assignment_for_file_sync %}checked{% endif %}>
+                                        <label class="form-check-label" for="require_public_workspace_assignment_for_file_sync">Require Public Workspace Assignment to Use File Sync</label>
+                                    </div>
+                                    <div class="d-flex flex-wrap align-items-center gap-2 mb-3">
+                                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-sync-public-workspaces-btn" data-bs-toggle="modal" data-bs-target="#fileSyncPublicWorkspaceAssignmentModal">
+                                            <i class="bi bi-globe me-1"></i>Manage Public Workspaces
+                                        </button>
+                                        <span class="text-muted small" id="file-sync-public-workspace-assignment-summary">No public workspaces assigned.</span>
+                                    </div>
+                                    <textarea class="d-none" id="file_sync_allowed_public_workspace_ids" name="file_sync_allowed_public_workspace_ids">{{ settings.file_sync_allowed_public_workspace_ids|default([], true)|tojson }}</textarea>
+                                    <hr />
+                                    <div data-file-sync-admin-target data-scope="public" data-search-endpoint="/api/admin/file-sync/public-workspaces/search" data-results-key="workspaces" data-value-field="id" data-title-field="name" data-subtitle-field="description">
+                                        <label class="form-label" for="file-sync-admin-public-target-query">Manage Public Workspace Sources</label>
+                                        <div class="input-group mb-2">
+                                            <input type="search" class="form-control" id="file-sync-admin-public-target-query" data-file-sync-admin-target-query placeholder="Search public workspace" aria-label="Search public workspace to manage" />
+                                            <button class="btn btn-outline-secondary" type="button" data-file-sync-admin-target-search>Search</button>
+                                        </div>
+                                        <div class="list-group small mb-2 d-none" data-file-sync-admin-target-results></div>
+                                        <div class="input-group">
+                                            <input type="text" class="form-control" data-file-sync-admin-target-id placeholder="Public workspace ID" aria-label="Target public workspace ID" />
+                                            <button class="btn btn-primary" type="button" data-file-sync-admin-target-manage disabled>Manage Sources</button>
+                                        </div>
+                                        <div class="form-text" data-file-sync-admin-target-label>No public workspace selected.</div>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="form-text mt-3">
+                            SMB source credentials are stored in Azure Key Vault when Key Vault secret storage is enabled; otherwise they use the app's existing encrypted settings path.
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="file-sync-admin-manager-modal" tabindex="-1" aria-labelledby="file-sync-admin-manager-title" aria-hidden="true">
+                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <div>
+                                    <h5 class="modal-title" id="file-sync-admin-manager-title">Manage File Sync Sources</h5>
+                                    <div class="text-muted small" id="file-sync-admin-manager-context"></div>
+                                </div>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div id="file-sync-admin-manager-container"></div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="fileSyncGroupAssignmentModal" tabindex="-1" aria-labelledby="fileSyncGroupAssignmentModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <div>
+                                    <h5 class="modal-title mb-0" id="fileSyncGroupAssignmentModalLabel">File Sync Group Assignments</h5>
+                                    <small class="text-muted">Choose which groups can use File Sync when group assignment is required.</small>
+                                </div>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="row g-2 align-items-end mb-3">
+                                    <div class="col">
+                                        <label for="file-sync-group-assignment-search" class="form-label">Search Groups</label>
+                                        <input type="search" class="form-control" id="file-sync-group-assignment-search" placeholder="Search by group name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
+                                    </div>
+                                    <div class="col-auto">
+                                        <button type="button" class="btn btn-outline-primary" id="file-sync-group-assignment-search-btn">
+                                            <i class="bi bi-search me-1"></i>Search
+                                        </button>
+                                    </div>
+                                </div>
+                                <div class="alert alert-danger d-none" id="file-sync-group-assignment-error"></div>
+                                <div class="small text-muted mb-2" id="file-sync-group-assignment-status">No groups loaded.</div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Group</th>
+                                                <th scope="col">Description</th>
+                                                <th scope="col" class="text-end">Assignment</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="file-sync-group-assignment-body">
+                                            <tr>
+                                                <td colspan="3" class="text-center text-muted py-3">Search for groups to assign.</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="fileSyncPublicWorkspaceAssignmentModal" tabindex="-1" aria-labelledby="fileSyncPublicWorkspaceAssignmentModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <div>
+                                    <h5 class="modal-title mb-0" id="fileSyncPublicWorkspaceAssignmentModalLabel">File Sync Public Workspace Assignments</h5>
+                                    <small class="text-muted">Choose which public workspaces can use File Sync when public workspace assignment is required.</small>
+                                </div>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="row g-2 align-items-end mb-3">
+                                    <div class="col">
+                                        <label for="file-sync-public-workspace-assignment-search" class="form-label">Search Public Workspaces</label>
+                                        <input type="search" class="form-control" id="file-sync-public-workspace-assignment-search" placeholder="Search by public workspace name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
+                                    </div>
+                                    <div class="col-auto">
+                                        <button type="button" class="btn btn-outline-primary" id="file-sync-public-workspace-assignment-search-btn">
+                                            <i class="bi bi-search me-1"></i>Search
+                                        </button>
+                                    </div>
+                                </div>
+                                <div class="alert alert-danger d-none" id="file-sync-public-workspace-assignment-error"></div>
+                                <div class="small text-muted mb-2" id="file-sync-public-workspace-assignment-status">Enter at least 2 characters to search.</div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Public Workspace</th>
+                                                <th scope="col">Description</th>
+                                                <th scope="col" class="text-end">Assignment</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="file-sync-public-workspace-assignment-body">
+                                            <tr>
+                                                <td colspan="3" class="text-center text-muted py-3">Search for public workspaces to assign.</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="file-sync-app-role-setup-modal" tabindex="-1" aria-labelledby="file-sync-app-role-setup-title" aria-hidden="true">
+                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="file-sync-app-role-setup-title">Personal File Sync App Role Setup</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <p class="text-muted">
+                                    Create the personal File Sync app role on the SimpleChat app registration, then assign users or groups to the role in the Enterprise App before enabling the personal require-role toggle.
+                                </p>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Capability</th>
+                                                <th scope="col">App role value</th>
+                                                <th scope="col">Typical assignment</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody>
+                                            <tr>
+                                                <td>Personal File Sync</td>
+                                                <td><code>PersonalFileSyncUser</code></td>
+                                                <td>Users allowed to manage personal sync sources</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                                <ol class="mb-0">
+                                    <li>Open Microsoft Entra admin center and edit the SimpleChat app registration.</li>
+                                    <li>Add the app role with allowed member type <strong>Users/Groups</strong> and value exactly matching the table.</li>
+                                    <li>Open the Enterprise App for SimpleChat and assign users or groups to the app role.</li>
+                                    <li>Have affected users sign out and sign back in so their role claims refresh.</li>
+                                </ol>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/files-sharing.html b/application/single_app/templates/admin/_panes/files-sharing.html
new file mode 100644
index 000000000..a856abdff
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/files-sharing.html
@@ -0,0 +1,237 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'files-sharing' %} show active{% endif %}" id="files-sharing" role="tabpanel" aria-labelledby="files-sharing-tab">
+                <div class="card mb-3 p-3" id="file-download-settings-section">
+                    <h5>
+                        <i class="bi bi-download me-2"></i>File Downloads
+                    </h5>
+                    <p class="text-muted">
+                        Control when users can download original workspace document files from personal, group, and public workspaces.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="allow_personal_workspace_file_downloads"
+                            name="allow_personal_workspace_file_downloads"
+                            {% if settings.allow_personal_workspace_file_downloads %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="allow_personal_workspace_file_downloads">
+                            Enable Personal Workspace Downloads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to download original files from their personal workspace document menus and bulk selection bar."></i>
+                    </div>
+                    <hr>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="allow_group_workspace_file_downloads"
+                            name="allow_group_workspace_file_downloads"
+                            {% if settings.allow_group_workspace_file_downloads %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="allow_group_workspace_file_downloads">
+                            Enable Group Workspace Downloads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow group workspace document downloads when global policy and each group's local setting allow it."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_group_assignment_for_file_downloads"
+                            name="require_group_assignment_for_file_downloads"
+                            {% if settings.require_group_assignment_for_file_downloads %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_group_assignment_for_file_downloads">
+                            Require Group Assignment for Downloads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only groups selected in Manage Groups can offer document downloads, unless a group owner or admin disables downloads locally."></i>
+                    </div>
+                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
+                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-download-groups-btn" data-bs-toggle="modal" data-bs-target="#fileDownloadGroupAssignmentModal">
+                            <i class="bi bi-people me-1"></i>Manage Groups
+                        </button>
+                        <span class="text-muted small" id="file-download-group-assignment-summary">No groups assigned.</span>
+                    </div>
+                    <textarea class="d-none" id="file_download_allowed_group_ids" name="file_download_allowed_group_ids">{{ settings.file_download_allowed_group_ids|default([], true)|tojson }}</textarea>
+                    <hr>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="allow_public_workspace_file_downloads"
+                            name="allow_public_workspace_file_downloads"
+                            {% if settings.allow_public_workspace_file_downloads %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="allow_public_workspace_file_downloads">
+                            Enable Public Workspace Downloads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow public workspace document downloads when global policy and each workspace's local setting allow it."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_public_workspace_assignment_for_file_downloads"
+                            name="require_public_workspace_assignment_for_file_downloads"
+                            {% if settings.require_public_workspace_assignment_for_file_downloads %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_public_workspace_assignment_for_file_downloads">
+                            Require Public Workspace Assignment for Downloads
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only selected public workspaces can offer document downloads, unless a workspace owner or admin disables downloads locally."></i>
+                    </div>
+                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
+                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-download-public-workspaces-btn" data-bs-toggle="modal" data-bs-target="#fileDownloadPublicWorkspaceAssignmentModal">
+                            <i class="bi bi-globe me-1"></i>Manage Public Workspaces
+                        </button>
+                        <span class="text-muted small" id="file-download-public-workspace-assignment-summary">No public workspaces assigned.</span>
+                    </div>
+                    <textarea class="d-none" id="file_download_allowed_public_workspace_ids" name="file_download_allowed_public_workspace_ids">{{ settings.file_download_allowed_public_workspace_ids|default([], true)|tojson }}</textarea>
+                </div>
+
+                <div class="modal fade" id="fileDownloadGroupAssignmentModal" tabindex="-1" aria-labelledby="fileDownloadGroupAssignmentModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <div>
+                                    <h5 class="modal-title mb-0" id="fileDownloadGroupAssignmentModalLabel">File Download Group Assignments</h5>
+                                    <small class="text-muted">Choose which groups can download files when group assignment is required.</small>
+                                </div>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="row g-2 align-items-end mb-3">
+                                    <div class="col">
+                                        <label for="file-download-group-assignment-search" class="form-label">Search Groups</label>
+                                        <input type="search" class="form-control" id="file-download-group-assignment-search" placeholder="Search by group name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
+                                    </div>
+                                    <div class="col-auto">
+                                        <button type="button" class="btn btn-outline-primary" id="file-download-group-assignment-search-btn">
+                                            <i class="bi bi-search me-1"></i>Search
+                                        </button>
+                                    </div>
+                                </div>
+                                <div class="alert alert-danger d-none" id="file-download-group-assignment-error"></div>
+                                <div class="small text-muted mb-2" id="file-download-group-assignment-status">No groups loaded.</div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Group</th>
+                                                <th scope="col">Description</th>
+                                                <th scope="col" class="text-end">Assignment</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="file-download-group-assignment-body">
+                                            <tr>
+                                                <td colspan="3" class="text-center text-muted py-3">Search for groups to assign.</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="fileDownloadPublicWorkspaceAssignmentModal" tabindex="-1" aria-labelledby="fileDownloadPublicWorkspaceAssignmentModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <div>
+                                    <h5 class="modal-title mb-0" id="fileDownloadPublicWorkspaceAssignmentModalLabel">File Download Public Workspace Assignments</h5>
+                                    <small class="text-muted">Choose which public workspaces can download files when public workspace assignment is required.</small>
+                                </div>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="row g-2 align-items-end mb-3">
+                                    <div class="col">
+                                        <label for="file-download-public-workspace-assignment-search" class="form-label">Search Public Workspaces</label>
+                                        <input type="search" class="form-control" id="file-download-public-workspace-assignment-search" placeholder="Search by public workspace name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
+                                    </div>
+                                    <div class="col-auto">
+                                        <button type="button" class="btn btn-outline-primary" id="file-download-public-workspace-assignment-search-btn">
+                                            <i class="bi bi-search me-1"></i>Search
+                                        </button>
+                                    </div>
+                                </div>
+                                <div class="alert alert-danger d-none" id="file-download-public-workspace-assignment-error"></div>
+                                <div class="small text-muted mb-2" id="file-download-public-workspace-assignment-status">Enter at least 2 characters to search.</div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Public Workspace</th>
+                                                <th scope="col">Description</th>
+                                                <th scope="col" class="text-end">Assignment</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="file-download-public-workspace-assignment-body">
+                                            <tr>
+                                                <td colspan="3" class="text-center text-muted py-3">Search for public workspaces to assign.</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+
+                <div class="card mb-3 p-3" id="file-sharing-section">
+                    <h5>
+                        <i class="bi bi-share me-2"></i>File Sharing
+                    </h5>
+                    <p class="text-muted">
+                        Turn this on to enable file sharing capabilities between users and workspaces.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_file_sharing"
+                            name="enable_file_sharing"
+                            {% if settings.enable_file_sharing %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_file_sharing">
+                            Enable File Sharing
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to upload, share, and manage files within workspaces for document-based AI interactions and collaboration."></i>
+                    </div>
+                </div>
+
+
+
+
+
+                <div class="card p-3 mb-4" id="shared-conversation-file-approvals-section">
+                    <h5>
+                        <i class="bi bi-file-earmark-lock me-2"></i>Shared Conversation File Approvals
+                    </h5>
+                    <p class="text-muted">Files generated by participants in a shared conversation are saved into the conversation owner's storage. When enabled, those files are held until an approver releases them.</p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="require_shared_conversation_file_approval"
+                            name="require_shared_conversation_file_approval"
+                            {% if settings.require_shared_conversation_file_approval %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="require_shared_conversation_file_approval">
+                            Require approval for participant-generated files
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When a participant who does not own a shared conversation generates a downloadable file (CSV, XLSX, DOCX, PDF, JSON, XML), the file is created but withheld until the conversation owner approves it. In group conversations, any group Owner, Admin, or Document Manager can approve. Unapproved files are automatically declined and deleted after 3 days. Generated images and charts are never gated."></i>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="file-size-limit-section">
+                    <h5>
+                        <i class="bi bi-file-earmark-arrow-up me-2"></i>Maximum File Size
+                    </h5>
+                    <p class="text-muted">
+                        The largest file a user may upload into a workspace.
+                    </p>
+                    <div class="mb-3">
+                        <label for="max_file_size_mb" class="form-label">Maximum File Size (MB)</label>
+                        <input type="number" class="form-control" id="max_file_size_mb" name="max_file_size_mb"
+                            value="{{ settings.max_file_size_mb }}">
+                    </div>
+                </div>
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/governance-policies.html b/application/single_app/templates/admin/_panes/governance-policies.html
new file mode 100644
index 000000000..da2b94fd1
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/governance-policies.html
@@ -0,0 +1,94 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'governance-policies' %} show active{% endif %}" id="governance-policies" role="tabpanel" aria-labelledby="governance-policies-tab">
+                <div class="card p-3 mb-3" id="governance-feature-policies-section">
+                    <div class="d-flex justify-content-between align-items-center mb-2">
+                        <h5 class="mb-0"><i class="bi bi-sliders2 me-2"></i>Feature Policies</h5>
+                        <button type="button" class="btn btn-primary btn-sm" id="governance-save-feature-policies-btn">Save Feature Policies</button>
+                    </div>
+                    <p class="text-muted">Set allow-all, explicit allow lists, and block lists for each governed feature. Block lists override allow settings.</p>
+                    <div class="table-responsive">
+                        <table class="table table-bordered" id="governance-feature-policies-table">
+                            <thead>
+                                <tr>
+                                    <th>Feature</th>
+                                    <th>Allow All</th>
+                                    <th>Allow List</th>
+                                    <th>Block List</th>
+                                </tr>
+                            </thead>
+                            <tbody id="governance-feature-policies-body"></tbody>
+                        </table>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="governance-item-policies-section">
+                    <div class="d-flex justify-content-between align-items-center mb-2">
+                        <h5 class="mb-0"><i class="bi bi-list-check me-2"></i>Delegated Item Policies</h5>
+                        <div class="d-flex gap-2">
+                            <button type="button" class="btn btn-primary btn-sm" id="governance-new-item-policy-btn">New Policy</button>
+                            <button type="button" class="btn btn-outline-secondary btn-sm" id="governance-refresh-item-policies-btn">Refresh</button>
+                        </div>
+                    </div>
+                    <p class="text-muted mb-1">Manage delegated governance for configured global resources and action type entitlements that admins assign to specific users or groups.</p>
+                    <div class="alert alert-info py-2 small" role="alert">
+                        Delegated item policies are OR combined allow lists with optional block lists. Blocked users and groups are denied even when Allow All or another allow list would grant access.
+                    </div>
+
+                    <div class="row g-2 align-items-end mb-3" id="governance-item-policy-card-controls">
+                        <div class="col-lg-5 col-md-6">
+                            <label class="form-label" for="governance-item-review-search">Search</label>
+                            <input type="search" class="form-control" id="governance-item-review-search" placeholder="Search users, groups, endpoint IDs, or item IDs">
+                        </div>
+                        <div class="col-lg-3 col-md-6">
+                            <label class="form-label" for="governance-item-review-entity-type">Entity Type</label>
+                            <select class="form-select" id="governance-item-review-entity-type">
+                                <option value="">All</option>
+                                <option value="global_endpoint">Global Endpoint</option>
+                                <option value="global_agent">Global Agent</option>
+                                <option value="global_action">Global Action</option>
+                                <option value="personal_action_type">Personal Action Type</option>
+                                <option value="group_action_type">Group Action Type</option>
+                                <option value="global_action_type">Global Action Type</option>
+                                <option value="mcp_personal_destination">MCP Personal Destination</option>
+                                <option value="mcp_group_destination">MCP Group Destination</option>
+                                <option value="mcp_global_destination">MCP Global Destination</option>
+                                <option value="inbound_mcp_source">Inbound MCP Source</option>
+                            </select>
+                        </div>
+                        <div class="col-lg-2 col-md-4">
+                            <label class="form-label" for="governance-item-review-page-size">Page Size</label>
+                            <select class="form-select" id="governance-item-review-page-size">
+                                <option value="10">10</option>
+                                <option value="25" selected>25</option>
+                                <option value="50">50</option>
+                            </select>
+                        </div>
+                        <div class="col-lg-2 col-md-8 d-flex gap-2">
+                            <button type="button" class="btn btn-primary flex-fill" id="governance-item-review-search-btn">Search</button>
+                            <button type="button" class="btn btn-outline-secondary flex-fill" id="governance-item-review-reset-btn">Reset</button>
+                        </div>
+                    </div>
+
+                    <div class="table-responsive">
+                        <table class="table table-sm table-striped align-middle" id="governance-item-policies-table">
+                            <thead>
+                                <tr>
+                                    <th>Policy</th>
+                                    <th>Entity Type</th>
+                                    <th>Item</th>
+                                    <th>Allow All</th>
+                                    <th>Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="governance-item-policies-review-body"></tbody>
+                        </table>
+                    </div>
+
+                    <div class="d-flex align-items-center justify-content-between gap-2 mt-3">
+                        <div class="text-muted small" id="governance-item-review-summary"></div>
+                        <div class="btn-group" role="group" aria-label="Delegated item policy pagination">
+                            <button type="button" class="btn btn-outline-secondary btn-sm" id="governance-item-review-prev-btn">Previous</button>
+                            <button type="button" class="btn btn-outline-secondary btn-sm" id="governance-item-review-next-btn">Next</button>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/image-generation.html b/application/single_app/templates/admin/_panes/image-generation.html
new file mode 100644
index 000000000..ee9293278
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/image-generation.html
@@ -0,0 +1,165 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'image-generation' %} show active{% endif %}" id="image-generation" role="tabpanel" aria-labelledby="image-generation-tab">
+                <div class="card p-3 mb-4" id="image-generation-configuration">
+                    <h5 class="card-title">
+                        <i class="bi bi-image me-2"></i>Image Generation Configuration
+                    </h5>
+                    <p class="text-muted small">
+                        Configure image generation settings. Enable/disable, set endpoints, and choose a model.
+                    </p>
+                    <button type="button" class="btn btn-sm btn-outline-secondary mb-3 align-self-start" data-bs-toggle="modal" data-bs-target="#legacyModelDiscoveryIdentityGuideModal">
+                        <i class="bi bi-question-circle me-1"></i>Setup Guide
+                    </button>
+
+                <div class="form-group form-check form-switch mb-3">
+                    <input type="checkbox" class="form-check-input" id="enable_image_generation"
+                        name="enable_image_generation" {% if settings.enable_image_generation %}checked{% endif %}>
+                    <label class="form-check-label ms-2" for="enable_image_generation">
+                        Enable Image Generation
+                    </label>
+                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable AI-powered image generation capabilities using DALL-E models for creating images from text descriptions."></i>
+                </div>
+                <div id="image_gen_settings" {% if not settings.enable_image_generation %}style="display: none;" {%
+                    endif %}>
+
+                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                        <input type="checkbox" class="form-check-input me-2" id="enable_image_gen_apim"
+                            name="enable_image_gen_apim" {% if settings.enable_image_gen_apim %}checked{% endif %}>
+                        <label class="form-check-label" for="enable_image_gen_apim">Use APIM instead of direct to Azure
+                            OpenAI endpoint.</label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route image generation requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
+                    </div>
+
+                    <div id="non_apim_image_gen_settings" {% if settings.enable_image_gen_apim %}style="display: none;"
+                        {% endif %}>
+                        <div class="card p-3 mb-3">
+                            <div class="mb-3">
+                                <label for="azure_openai_image_gen_endpoint" class="form-label">
+                                    Azure OpenAI Image Generation Endpoint
+                                </label>
+                                <input type="text" class="form-control" id="azure_openai_image_gen_endpoint"
+                                    name="azure_openai_image_gen_endpoint"
+                                    value="{{ settings.azure_openai_image_gen_endpoint or '' }}">
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_openai_image_gen_authentication_type" class="form-label">
+                                    Authentication Type
+                                </label>
+                                <select class="form-select" id="azure_openai_image_gen_authentication_type"
+                                    name="azure_openai_image_gen_authentication_type">
+                                    <option value="key" {% if settings.azure_openai_image_gen_authentication_type=='key'
+                                        %}selected{% endif %}>
+                                        Key
+                                    </option>
+                                    <option value="managed_identity" {% if
+                                        settings.azure_openai_image_gen_authentication_type=='managed_identity'
+                                        %}selected{% endif %}>
+                                        Managed Identity
+                                    </option>
+                                </select>
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_openai_image_gen_subscription_id" class="form-label">Subscription
+                                    ID</label>
+                                <input type="text" class="form-control" id="azure_openai_image_gen_subscription_id"
+                                    name="azure_openai_image_gen_subscription_id"
+                                    value="{{ settings.azure_openai_image_gen_subscription_id or '' }}">
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_openai_image_gen_resource_group" class="form-label">Resource
+                                    Group</label>
+                                <input type="text" class="form-control" id="azure_openai_image_gen_resource_group"
+                                    name="azure_openai_image_gen_resource_group"
+                                    value="{{ settings.azure_openai_image_gen_resource_group or '' }}">
+                            </div>
+                            <div class="mb-3" id="image_gen_key_container" {% if
+                                settings.azure_openai_image_gen_authentication_type !='key' %}style="display: none;" {%
+                                endif %}>
+                                <label for="azure_openai_image_gen_key" class="form-label">Azure OpenAI Image Generation
+                                    Key</label>
+                                <div class="input-group">
+                                    <input type="password" class="form-control" id="azure_openai_image_gen_key"
+                                        name="azure_openai_image_gen_key"
+                                        value="{{ settings.azure_openai_image_gen_key or '' }}">
+                                    <button type="button" class="btn btn-outline-secondary"
+                                        id="toggle_image_gen_key">Show</button>
+                                </div>
+                            </div>
+                            <div class="mb-3">
+                                <div id="image_models_list" class="mt-2 mb-3">
+
+                                </div>
+
+                                <small>Save pending changes to settings before clicking Fetch Image Generation Models</small><br>
+
+                                <input type="hidden" name="image_gen_model_json" id="image_gen_model_json" />
+
+
+                                <input type="hidden" id="image_gen_model" value="{{ settings.image_gen_model.selected[0].deploymentName if settings.image_gen_model.selected else '' }}" />
+
+
+                                <button type="button" class="btn btn-secondary" id="fetch_image_models_btn">
+                                    Fetch Image Generation Models
+                                </button>
+                            </div>
+                            <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
+                                data-bs-target="#advancedImageGenFields" aria-expanded="false"
+                                aria-controls="advancedImageGenFields">
+                                Show Advanced
+                            </a>
+                            <div class="collapse" id="advancedImageGenFields">
+                                <div class="card card-body mt-2">
+                                    <div class="mb-3">
+                                        <label for="azure_openai_image_gen_api_version" class="form-label">
+                                            Azure OpenAI Image Gen API Version
+                                        </label>
+                                        <input type="text" class="form-control" id="azure_openai_image_gen_api_version"
+                                            name="azure_openai_image_gen_api_version"
+                                            value="{{ settings.azure_openai_image_gen_api_version or '' }}">
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div id="apim_image_gen_settings" class="card p-3 mb-3" {% if not settings.enable_image_gen_apim
+                        %}style="display: none;" {% endif %}>
+                        <div class="mb-3">
+                            <label for="azure_apim_image_gen_endpoint" class="form-label">Azure APIM Endpoint</label>
+                            <input type="text" class="form-control" id="azure_apim_image_gen_endpoint"
+                                name="azure_apim_image_gen_endpoint"
+                                value="{{ settings.azure_apim_image_gen_endpoint or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_apim_image_gen_api_version" class="form-label">Azure APIM API
+                                Version</label>
+                            <input type="text" class="form-control" id="azure_apim_image_gen_api_version"
+                                name="azure_apim_image_gen_api_version"
+                                value="{{ settings.azure_apim_image_gen_api_version or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_apim_image_gen_deployment" class="form-label">Azure APIM
+                                Deployment</label>
+                            <input type="text" class="form-control" id="azure_apim_image_gen_deployment"
+                                name="azure_apim_image_gen_deployment"
+                                value="{{ settings.azure_apim_image_gen_deployment or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="azure_apim_image_gen_subscription_key" class="form-label">Azure APIM
+                                Subscription Key</label>
+                            <div class="input-group">
+                                <input type="password" class="form-control" id="azure_apim_image_gen_subscription_key"
+                                    name="azure_apim_image_gen_subscription_key"
+                                    value="{{ settings.azure_apim_image_gen_subscription_key or '' }}">
+                                <button type="button" class="btn btn-outline-secondary"
+                                    id="toggle_azure_apim_image_gen_subscription_key">Show</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <button type="button" class="btn btn-secondary mt-3" id="test_image_button">
+                    Test Image Connection
+                </button>
+                <div id="test_image_result" class="mt-2"></div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/inbound-mcp.html b/application/single_app/templates/admin/_panes/inbound-mcp.html
new file mode 100644
index 000000000..3676ea641
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/inbound-mcp.html
@@ -0,0 +1,535 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'inbound-mcp' %} show active{% endif %}" id="inbound-mcp" role="tabpanel" aria-labelledby="inbound-mcp-tab">
+                {% if mcp_ui_enabled %}
+                <div class="card p-3 mb-4" id="inbound-mcp-configuration" data-default-tenant-id="{{ inbound_mcp_easy_auth_script_context.tenant_id }}">
+                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-3 mb-3">
+                        <div>
+                            <h5 class="card-title mb-1">
+                                <i class="bi bi-diagram-3 me-2"></i>Inbound MCP Server
+                            </h5>
+                            <p class="text-muted small mb-0">
+                                Configure the governed SimpleChat MCP endpoint used by external MCP clients. Personal tools use delegated user tokens by default; tool access remains deny-by-default until authentication, source, client, and governance policy all allow the request.
+                            </p>
+                        </div>
+                        <div class="d-flex flex-column gap-2 align-items-lg-end">
+                            <span class="badge text-bg-warning align-self-start align-self-lg-end">Preview</span>
+                            <button type="button" class="btn btn-sm btn-outline-primary" data-bs-toggle="modal" data-bs-target="#inboundMcpInfoModal">
+                                <i class="bi bi-info-circle me-1"></i>About MCP &amp; Tools
+                            </button>
+                        </div>
+                    </div>
+
+                    <div class="alert alert-info small" role="alert">
+                        Enable only after the Microsoft Entra delegated scope, delegated user app role, client app allowlist, source allowlist, and SimpleChat governance item policies are configured. Personal MCP tools require delegated user context plus an assigned user role. The app-only role is reserved for future non-personal service/admin tools.
+                    </div>
+
+                    <div class="row g-3">
+                        <div class="col-xl-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <h6 class="mb-3">Runtime Gate</h6>
+                                <div class="form-check form-switch mb-3">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="enable_inbound_mcp_server" name="enable_inbound_mcp_server" {% if settings.enable_inbound_mcp_server %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="enable_inbound_mcp_server">Enable inbound MCP server</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Controls whether authenticated requests to the SimpleChat inbound MCP endpoint are accepted."></i>
+                                </div>
+                                <div class="mb-3">
+                                    <label class="form-label" for="inbound_mcp_required_scope">Required delegated scope</label>
+                                    <input class="form-control" type="text" id="inbound_mcp_required_scope" name="inbound_mcp_required_scope" value="{{ settings.inbound_mcp_required_scope }}" autocomplete="off">
+                                    <div class="form-text">Default: <code>DelegatedMcpServerAccess</code>. VS Code and other user clients must present this delegated scope.</div>
+                                </div>
+                                <div class="mb-3">
+                                    <label class="form-label" for="inbound_mcp_required_user_role">Required delegated user role</label>
+                                    <input class="form-control" type="text" id="inbound_mcp_required_user_role" name="inbound_mcp_required_user_role" value="{{ settings.inbound_mcp_required_user_role }}" autocomplete="off">
+                                    <div class="form-text">Default: <code>InboundMCPUserAccess</code>. Governance determines which users/groups can use tools after this Entra role and delegated scope pass.</div>
+                                </div>
+                                <div class="mb-0">
+                                    <label class="form-label" for="inbound_mcp_required_app_role">Required app-only role</label>
+                                    <input class="form-control" type="text" id="inbound_mcp_required_app_role" name="inbound_mcp_required_app_role" value="{{ settings.inbound_mcp_required_app_role }}" autocomplete="off">
+                                    <div class="form-text">Default: <code>InboundMCPAppAccess</code>. Reserved for future app-only MCP tools and still governed separately.</div>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="col-xl-6">
+                            <div class="border rounded-3 p-3 h-100">
+                                <h6 class="mb-3">Endpoint Contract</h6>
+                                <dl class="row small mb-0">
+                                    <dt class="col-sm-5">MCP endpoint</dt>
+                                    <dd class="col-sm-7"><code>{{ inbound_mcp_resource_path }}</code></dd>
+                                    <dt class="col-sm-5">Protected resource metadata</dt>
+                                    <dd class="col-sm-7"><code>{{ inbound_mcp_prm_path }}</code></dd>
+                                    <dt class="col-sm-5">Transport</dt>
+                                    <dd class="col-sm-7">Streamable HTTP JSON-RPC</dd>
+                                    <dt class="col-sm-5">Current tool surface</dt>
+                                    <dd class="col-sm-7">Personal delegated tools only.</dd>
+                                    <dt class="col-sm-5">Tool identity</dt>
+                                    <dd class="col-sm-7">Delegated user token required for personal data.</dd>
+                                </dl>
+                                <div class="alert alert-light border small mt-3 mb-0" role="alert">
+                                    Endpoint paths are fixed in application routing for this initial UI slice. Change the app setting below for the source header only.
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="col-12">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-2 mb-3">
+                                    <div>
+                                        <h6 class="mb-1">Request Size &amp; Throttling</h6>
+                                        <div class="small text-muted">Protect the inbound MCP endpoint from oversized payloads and noisy clients. Rate limits are enforced per caller and tool category across app instances.</div>
+                                    </div>
+                                    <div class="form-check form-switch">
+                                        <input class="form-check-input" type="checkbox" role="switch" id="enable_inbound_mcp_rate_limits" name="enable_inbound_mcp_rate_limits" {% if settings.enable_inbound_mcp_rate_limits %}checked{% endif %}>
+                                        <label class="form-check-label ms-2" for="enable_inbound_mcp_rate_limits">Enable tool throttles</label>
+                                    </div>
+                                </div>
+                                <div class="row g-3">
+                                    <div class="col-md-6 col-xl-3">
+                                        <label class="form-label" for="inbound_mcp_max_request_bytes">Max request bytes</label>
+                                        <input class="form-control" type="number" id="inbound_mcp_max_request_bytes" name="inbound_mcp_max_request_bytes" min="1024" max="1048576" step="1" value="{{ settings.inbound_mcp_max_request_bytes }}">
+                                        <div class="form-text">Default: <code>65536</code>. Range: 1 KB to 1 MB.</div>
+                                    </div>
+                                    <div class="col-md-6 col-xl-3">
+                                        <label class="form-label" for="inbound_mcp_rate_limit_window_seconds">Rate window seconds</label>
+                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_window_seconds" name="inbound_mcp_rate_limit_window_seconds" min="10" max="3600" step="1" value="{{ settings.inbound_mcp_rate_limit_window_seconds }}">
+                                        <div class="form-text">Default: <code>60</code>. Applies to each throttle category.</div>
+                                    </div>
+                                    <div class="col-md-4 col-xl-2">
+                                        <label class="form-label" for="inbound_mcp_rate_limit_read_per_window">Read limit</label>
+                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_read_per_window" name="inbound_mcp_rate_limit_read_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_read_per_window }}">
+                                        <div class="form-text">Default: <code>120</code>.</div>
+                                    </div>
+                                    <div class="col-md-4 col-xl-2">
+                                        <label class="form-label" for="inbound_mcp_rate_limit_search_per_window">Search limit</label>
+                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_search_per_window" name="inbound_mcp_rate_limit_search_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_search_per_window }}">
+                                        <div class="form-text">Default: <code>30</code>.</div>
+                                    </div>
+                                    <div class="col-md-4 col-xl-2">
+                                        <label class="form-label" for="inbound_mcp_rate_limit_write_per_window">Write limit</label>
+                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_write_per_window" name="inbound_mcp_rate_limit_write_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_write_per_window }}">
+                                        <div class="form-text">Default: <code>10</code>.</div>
+                                    </div>
+                                </div>
+                                <div class="alert alert-light border small mt-3 mb-0" role="alert">
+                                    Application Insights events include <code>mcp_request_id</code>, caller app, delegated user, source, tool, duration, result status, and rate-limit category without recording prompts, document content, bearer tokens, or secrets.
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="col-12">
+                            <input type="hidden" id="inbound_mcp_allowed_client_app_entries_json" name="inbound_mcp_allowed_client_app_entries_json" value='{{ settings.inbound_mcp_allowed_client_app_entries | default([], true) | tojson }}'>
+                            <input type="hidden" id="inbound_mcp_allowed_tenant_entries_json" name="inbound_mcp_allowed_tenant_entries_json" value='{{ settings.inbound_mcp_allowed_tenant_entries | default([], true) | tojson }}'>
+                            <input type="hidden" id="inbound_mcp_allowed_source_entries_json" name="inbound_mcp_allowed_source_entries_json" value='{{ settings.inbound_mcp_allowed_source_entries | default([], true) | tojson }}'>
+                        </div>
+
+                        <div class="col-12">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="d-flex justify-content-between align-items-start gap-2 mb-2">
+                                    <div>
+                                        <h6 class="mb-1">Allowed client app IDs</h6>
+                                        <div class="small text-muted">Required allowlist. Empty means no MCP clients can connect.</div>
+                                    </div>
+                                    <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="clients">Add</button>
+                                </div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle mb-2">
+                                        <thead>
+                                            <tr>
+                                                <th>Client app ID</th>
+                                                <th>Description</th>
+                                                <th class="text-end">Actions</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="inbound-mcp-client-app-entries-body"></tbody>
+                                    </table>
+                                </div>
+                                <div class="small text-muted" id="inbound-mcp-client-app-entries-summary"></div>
+                            </div>
+                        </div>
+
+                        <div class="col-12">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="inbound_mcp_allow_external_tenants" name="inbound_mcp_allow_external_tenants" {% if settings.inbound_mcp_allow_external_tenants %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="inbound_mcp_allow_external_tenants">Allow additional tenant IDs</label>
+                                </div>
+                                <div class="small text-muted mb-3">
+                                    Off allows only the configured SimpleChat tenant. Turning this on auto-includes the SimpleChat tenant and lets admins add more tenants.
+                                </div>
+                                <div id="inbound-mcp-tenant-list-container" class="{% if not settings.inbound_mcp_allow_external_tenants %}d-none{% endif %}">
+                                    <div class="d-flex justify-content-between align-items-center mb-2">
+                                        <h6 class="mb-0">Allowed tenant IDs</h6>
+                                        <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="tenants">Add</button>
+                                    </div>
+                                    <div class="table-responsive">
+                                        <table class="table table-sm align-middle mb-2">
+                                            <thead>
+                                                <tr>
+                                                    <th>Tenant ID</th>
+                                                    <th>Description</th>
+                                                    <th class="text-end">Actions</th>
+                                                </tr>
+                                            </thead>
+                                            <tbody id="inbound-mcp-tenant-entries-body"></tbody>
+                                        </table>
+                                    </div>
+                                    <div class="small text-muted" id="inbound-mcp-tenant-entries-summary"></div>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="col-12">
+                            <div class="border rounded-3 p-3 h-100">
+                                <div class="form-check form-switch mb-2">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="inbound_mcp_allow_all_source_ids" name="inbound_mcp_allow_all_source_ids" {% if settings.inbound_mcp_allow_all_source_ids %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="inbound_mcp_allow_all_source_ids">Allow all source IDs</label>
+                                </div>
+                                <div class="small text-muted mb-3">
+                                    Default on accepts any source signal at the runtime allowlist layer. Turn off to require explicit source values here. In both modes, admins must still create an inbound MCP source governance policy before tools are returned.
+                                </div>
+                                <div class="mb-3">
+                                    <label class="form-label" for="inbound_mcp_source_header">Source header name</label>
+                                    <input class="form-control" type="text" id="inbound_mcp_source_header" name="inbound_mcp_source_header" value="{{ settings.inbound_mcp_source_header }}" autocomplete="off">
+                                    <div class="form-text">Default: <code>X-SimpleChat-MCP-Source</code>.</div>
+                                </div>
+                                <div class="alert alert-warning py-2 small" role="alert">
+                                    Source IDs are read from the configured header when present. This is a client-provided value and can be spoofed unless a trusted gateway, APIM policy, or similar control sets/enforces it.
+                                </div>
+                                <div id="inbound-mcp-all-source-governance-callout" class="alert alert-info py-2 small {% if not settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}" role="alert">
+                                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-2">
+                                        <div>
+                                            Create an <code>inbound_mcp_source</code> policy for <code>*</code> to choose which users or groups can use inbound MCP from any accepted source.
+                                        </div>
+                                        <button
+                                            type="button"
+                                            class="btn btn-sm btn-outline-primary governance-new-inbound-mcp-policy-btn"
+                                            data-governance-inbound-mcp-entity="inbound_mcp_source"
+                                            data-governance-inbound-mcp-item="*"
+                                            data-governance-inbound-mcp-policy-name="Inbound MCP all source access"
+                                            data-governance-inbound-mcp-resource-label="All accepted source IDs (*)"
+                                            data-governance-open-tab="true"
+                                        >
+                                            Create Wildcard Source Policy
+                                        </button>
+                                    </div>
+                                </div>
+                                <div id="inbound-mcp-controlled-source-governance-callout" class="alert alert-info py-2 small {% if settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}" role="alert">
+                                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-2">
+                                        <div>
+                                            After adding allowed source IDs, create an <code>inbound_mcp_source</code> policy for <code>*</code> or a specific source to choose which users or groups can use inbound MCP.
+                                        </div>
+                                        <button
+                                            type="button"
+                                            class="btn btn-sm btn-outline-primary governance-new-inbound-mcp-policy-btn"
+                                            data-governance-inbound-mcp-entity="inbound_mcp_source"
+                                            data-governance-inbound-mcp-policy-name="Inbound MCP source access"
+                                            data-governance-open-tab="true"
+                                        >
+                                            Create Source Policy
+                                        </button>
+                                    </div>
+                                </div>
+                                <div id="inbound-mcp-source-list-container" class="{% if settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}">
+                                    <div class="d-flex justify-content-between align-items-center mb-2">
+                                        <h6 class="mb-0">Allowed source IDs</h6>
+                                        <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="sources">Add</button>
+                                    </div>
+                                    <div class="table-responsive">
+                                        <table class="table table-sm align-middle mb-2">
+                                            <thead>
+                                                <tr>
+                                                    <th>Source value</th>
+                                                    <th>Description</th>
+                                                    <th class="text-end">Actions</th>
+                                                </tr>
+                                            </thead>
+                                            <tbody id="inbound-mcp-source-entries-body"></tbody>
+                                        </table>
+                                    </div>
+                                    <div class="small text-muted" id="inbound-mcp-source-entries-summary"></div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="modal fade" id="inboundMcpEntryModal" tabindex="-1" aria-labelledby="inboundMcpEntryModalLabel" aria-hidden="true" data-ignore-settings-change="true">
+                    <div class="modal-dialog">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="inboundMcpEntryModalLabel">Add MCP Entry</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <input type="hidden" id="inbound-mcp-entry-list-key">
+                                <input type="hidden" id="inbound-mcp-entry-edit-index">
+                                <div class="mb-3">
+                                    <label class="form-label" for="inbound-mcp-entry-value" id="inbound-mcp-entry-value-label">Value</label>
+                                    <input class="form-control" type="text" id="inbound-mcp-entry-value" autocomplete="off">
+                                    <div class="invalid-feedback" id="inbound-mcp-entry-value-error">Value is required.</div>
+                                </div>
+                                <div class="mb-0">
+                                    <label class="form-label" for="inbound-mcp-entry-description">Description</label>
+                                    <input class="form-control" type="text" id="inbound-mcp-entry-description" autocomplete="off" maxlength="256">
+                                    <div class="form-text">Use descriptions to explain who owns this app, tenant, or source value without making the value easy to guess.</div>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                                <button type="button" class="btn btn-primary" id="inbound-mcp-entry-save-btn">Save Entry</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="modal fade" id="inboundMcpInfoModal" tabindex="-1" aria-labelledby="inboundMcpInfoModalLabel" aria-hidden="true" data-ignore-settings-change="true">
+                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="inboundMcpInfoModalLabel">Inbound MCP overview</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="alert alert-info small" role="alert">
+                                    SimpleChat exposes a governed Streamable HTTP MCP endpoint for approved external MCP clients. Authentication handles tenant, client, delegated scope, and Entra role checks; governance decides which users/groups and source IDs can use tools.
+                                </div>
+                                <div class="row g-3 mb-3">
+                                    <div class="col-lg-6">
+                                        <h6>Runtime checks</h6>
+                                        <ul class="small mb-0">
+                                            <li>Client app ID must be in the allowed client list.</li>
+                                            <li>Tenant must be the SimpleChat tenant unless additional tenants are enabled.</li>
+                                            <li>Delegated personal tools require the configured scope and user role.</li>
+                                            <li>Governance uses <code>inbound_mcp_source</code> policies to decide which users or groups can use each accepted source.</li>
+                                        </ul>
+                                    </div>
+                                    <div class="col-lg-6">
+                                        <h6>Source header guidance</h6>
+                                        <p class="small mb-0">
+                                            The configured source header is an advisory control-plane signal. Treat it like an APIM subscription-key label, not strong identity. For stronger assurance, set or overwrite it at a trusted gateway and avoid relying on client-provided values alone.
+                                        </p>
+                                    </div>
+                                </div>
+                                <h6>Available MCP tools</h6>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th>Tool</th>
+                                                <th>Scope</th>
+                                                <th>Operation</th>
+                                                <th>Description</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody>
+                                            {% for tool in inbound_mcp_tools %}
+                                            <tr>
+                                                <td>
+                                                    <div class="fw-semibold">{{ tool.display_name }}</div>
+                                                    <code>{{ tool.id }}</code>
+                                                </td>
+                                                <td>{{ tool.scope }}</td>
+                                                <td>{{ tool.resource_family }} / {{ tool.operation }}</td>
+                                                <td>{{ tool.description }}</td>
+                                            </tr>
+                                            {% endfor %}
+                                        </tbody>
+                                    </table>
+                                </div>
+                                <hr />
+                                <h6>Application Insights starter queries</h6>
+                                <p class="small text-muted">
+                                    Use these KQL queries in Application Insights Logs to validate inbound MCP traffic, denials, and tool latency. They rely on safe structured dimensions emitted by the inbound MCP route and do not require prompt, message, document, token, or secret values.
+                                </p>
+                                <div class="accordion" id="inbound-mcp-observability-accordion">
+                                    <div class="accordion-item">
+                                        <h2 class="accordion-header" id="inbound-mcp-kql-request-trends-heading">
+                                            <button class="accordion-button" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-request-trends-collapse" aria-expanded="true" aria-controls="inbound-mcp-kql-request-trends-collapse">
+                                                Request and failure trends
+                                            </button>
+                                        </h2>
+                                        <div id="inbound-mcp-kql-request-trends-collapse" class="accordion-collapse collapse show" aria-labelledby="inbound-mcp-kql-request-trends-heading" data-bs-parent="#inbound-mcp-observability-accordion">
+                                            <div class="accordion-body">
+                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-request-trends">
+                                                    <i class="bi bi-clipboard me-1"></i>Copy query
+                                                </button>
+                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-request-trends">traces
+| where timestamp > ago(24h)
+| where message has "[InboundMCP]"
+| summarize requests=count(), failures=countif(tostring(customDimensions.result_status) !in ("", "success", "accepted")) by bin(timestamp, 1h)
+| order by timestamp desc</code></pre>
+                                            </div>
+                                        </div>
+                                    </div>
+                                    <div class="accordion-item">
+                                        <h2 class="accordion-header" id="inbound-mcp-kql-error-categories-heading">
+                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-error-categories-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-error-categories-collapse">
+                                                Error categories by caller and source
+                                            </button>
+                                        </h2>
+                                        <div id="inbound-mcp-kql-error-categories-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-error-categories-heading" data-bs-parent="#inbound-mcp-observability-accordion">
+                                            <div class="accordion-body">
+                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-error-categories">
+                                                    <i class="bi bi-clipboard me-1"></i>Copy query
+                                                </button>
+                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-error-categories">traces
+| where timestamp > ago(24h)
+| where message has "[InboundMCP]"
+| where isnotempty(tostring(customDimensions.error_type))
+| summarize events=count() by tostring(customDimensions.error_type), tostring(customDimensions.caller_app_id), tostring(customDimensions.source_id)
+| order by events desc</code></pre>
+                                            </div>
+                                        </div>
+                                    </div>
+                                    <div class="accordion-item">
+                                        <h2 class="accordion-header" id="inbound-mcp-kql-tool-latency-heading">
+                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-tool-latency-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-tool-latency-collapse">
+                                                Tool latency and result status
+                                            </button>
+                                        </h2>
+                                        <div id="inbound-mcp-kql-tool-latency-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-tool-latency-heading" data-bs-parent="#inbound-mcp-observability-accordion">
+                                            <div class="accordion-body">
+                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-tool-latency">
+                                                    <i class="bi bi-clipboard me-1"></i>Copy query
+                                                </button>
+                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-tool-latency">traces
+| where timestamp > ago(24h)
+| where message has "Inbound MCP tool call"
+| where isnotempty(tostring(customDimensions.tool_id))
+| summarize calls=count(), avg_duration_ms=avg(todouble(customDimensions.duration_ms)), p95_duration_ms=percentile(todouble(customDimensions.duration_ms), 95) by tostring(customDimensions.tool_id), tostring(customDimensions.result_status)
+| order by calls desc</code></pre>
+                                            </div>
+                                        </div>
+                                    </div>
+                                    <div class="accordion-item">
+                                        <h2 class="accordion-header" id="inbound-mcp-kql-rate-limits-heading">
+                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-rate-limits-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-rate-limits-collapse">
+                                                Rate-limit denials
+                                            </button>
+                                        </h2>
+                                        <div id="inbound-mcp-kql-rate-limits-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-rate-limits-heading" data-bs-parent="#inbound-mcp-observability-accordion">
+                                            <div class="accordion-body">
+                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-rate-limits">
+                                                    <i class="bi bi-clipboard me-1"></i>Copy query
+                                                </button>
+                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-rate-limits">traces
+| where timestamp > ago(24h)
+| where message has "Inbound MCP tool call denied by rate limit"
+| summarize denials=count() by tostring(customDimensions.rate_limit_category), tostring(customDimensions.tool_id), tostring(customDimensions.caller_app_id)
+| order by denials desc</code></pre>
+                                            </div>
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="modal fade" id="inboundMcpEasyAuthModal" tabindex="-1" aria-labelledby="inboundMcpEasyAuthModalLabel" aria-hidden="true" data-ignore-settings-change="true">
+                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="inboundMcpEasyAuthModalLabel">Verify App Service Authentication exclusions</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="alert alert-warning">
+                                    <strong>Required before enabling inbound MCP:</strong>
+                                    If Azure App Service Authentication redirects unauthenticated requests, add excluded paths so MCP clients can discover protected resource metadata and so SimpleChat can enforce bearer-token MCP access itself.
+                                </div>
+                                <p>
+                                    Run the following PowerShell with Azure CLI from Azure Cloud Shell or any authenticated terminal. SimpleChat pre-fills the script from this App Service's environment when possible.
+                                </p>
+                                <div class="row g-2 small mb-3">
+                                    <div class="col-lg-6">
+                                        <div class="border rounded p-2 h-100">
+                                            <div class="fw-semibold">Derived deployment values</div>
+                                            <dl class="row mb-0">
+                                                <dt class="col-sm-5">Azure environment</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.azure_environment }}</code></dd>
+                                                <dt class="col-sm-5">Resource Manager</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.resource_manager_endpoint }}</code></dd>
+                                                <dt class="col-sm-5">Resource group</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.resource_group }}</code></dd>
+                                                <dt class="col-sm-5">App Service</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.app_name }}</code></dd>
+                                                <dt class="col-sm-5">Subscription</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.subscription_id or "Current Azure CLI account" }}</code></dd>
+                                                <dt class="col-sm-5">API client ID</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.simplechat_api_client_id }}</code></dd>
+                                                <dt class="col-sm-5">Delegated scope</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_delegated_scope }}</code></dd>
+                                                <dt class="col-sm-5">User role</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_user_roles | join(", ") }}</code></dd>
+                                                <dt class="col-sm-5">App-only role</dt>
+                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_app_roles | join(", ") }}</code></dd>
+                                            </dl>
+                                        </div>
+                                    </div>
+                                    <div class="col-lg-6">
+                                        <div class="border rounded p-2 h-100">
+                                            <div class="fw-semibold">Script behavior</div>
+                                            <ul class="mb-0">
+                                                <li>Sets the Azure CLI cloud before login.</li>
+                                                <li>Logs in with the configured SimpleChat tenant.</li>
+                                                <li>Attempts to verify that the SimpleChat API app exposes the required delegated scope and inbound MCP app roles.</li>
+                                                <li>Uses SimpleChat's Resource Manager endpoint for public, government, or custom clouds.</li>
+                                                <li>Creates a timestamped backup of current <code>authsettingsV2</code> before applying changes.</li>
+                                            </ul>
+                                        </div>
+                                    </div>
+                                </div>
+                                {% if inbound_mcp_easy_auth_script_context.missing_values %}
+                                <div class="alert alert-danger small">
+                                    SimpleChat could not derive every required value. Replace the placeholders in the script before running it:
+                                    <strong>{{ inbound_mcp_easy_auth_script_context.missing_values | join(", ") }}</strong>.
+                                </div>
+                                {% endif %}
+                                {% if inbound_mcp_easy_auth_script_context.scope_check_missing_values %}
+                                <div class="alert alert-warning small">
+                                    SimpleChat could not derive every value needed for the delegated-scope and role preflight. Replace these placeholders if you want the script to validate the app registration before changing Easy Auth:
+                                    <strong>{{ inbound_mcp_easy_auth_script_context.scope_check_missing_values | join(", ") }}</strong>.
+                                </div>
+                                {% endif %}
+                                {% if inbound_mcp_easy_auth_script_context.uses_custom_cloud_match %}
+                                <div class="alert alert-info small">
+                                    This deployment uses a custom Azure environment. The script searches your registered Azure CLI clouds for one with the same Resource Manager endpoint. If none is registered, register the custom cloud first and rerun the script.
+                                </div>
+                                {% endif %}
+                                <div class="position-relative mb-3">
+                                    <button type="button" class="btn btn-outline-secondary btn-sm position-absolute top-0 end-0 m-2" id="inbound-mcp-copy-script" aria-label="Copy PowerShell script">
+                                        <i class="bi bi-clipboard" aria-hidden="true"></i>
+                                    </button>
+                                    <pre class="bg-body-tertiary border rounded p-3 pe-5 small mb-0"><code id="inbound-mcp-easy-auth-script-code">{{ inbound_mcp_easy_auth_script }}</code></pre>
+                                </div>
+                                <div class="alert alert-info small">
+                                    The verification checks these public unauthenticated endpoints and expects SimpleChat JSON responses, not Microsoft sign-in HTML:
+                                    <ul class="mb-0">
+                                        <li><code>/.well-known/oauth-protected-resource</code></li>
+                                        <li><code>/.well-known/oauth-protected-resource/api/mcp</code></li>
+                                        <li><code>/.well-known/oauth-protected-resource/mcp</code></li>
+                                        <li><code>/.well-known/oauth-authorization-server</code></li>
+                                        <li><code>/api/mcp</code></li>
+                                        <li><code>/api/mcp/health</code></li>
+                                    </ul>
+                                </div>
+                                <div class="form-check mb-3">
+                                    <input class="form-check-input" type="checkbox" id="inbound-mcp-easy-auth-confirm">
+                                    <label class="form-check-label" for="inbound-mcp-easy-auth-confirm">
+                                        I have added the required App Service Authentication excluded paths for this SimpleChat App Service.
+                                    </label>
+                                </div>
+                                <div id="inbound-mcp-easy-auth-status" class="alert alert-info d-none" role="status"></div>
+                                <ul id="inbound-mcp-easy-auth-results" class="list-group small d-none"></ul>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Cancel</button>
+                                <button type="button" class="btn btn-primary" id="inbound-mcp-easy-auth-verify" disabled>
+                                    I accept, verify endpoints
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                {% endif %}
+            </div>
diff --git a/application/single_app/templates/admin/_panes/jobs.html b/application/single_app/templates/admin/_panes/jobs.html
new file mode 100644
index 000000000..98c939eed
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/jobs.html
@@ -0,0 +1,89 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'jobs' %} show active{% endif %}" id="jobs" role="tabpanel" aria-labelledby="jobs-tab" data-testid="jobs-tab-pane" data-ignore-settings-change="true">
+                <div class="card p-4 mb-4 border-dark shadow-sm" id="data-management-jobs-section">
+                    <div class="d-flex align-items-center justify-content-between mb-3">
+                        <h4 class="mb-0">Job History</h4>
+                        <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-refresh-jobs-btn">
+                            <i class="bi bi-arrow-clockwise me-1"></i>Refresh
+                        </button>
+                    </div>
+                    <div class="row g-2 align-items-end mb-3" aria-label="Job history filters">
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_job_operation_filter">Operation</label>
+                            <select class="form-select form-select-sm" id="data_management_job_operation_filter">
+                                <option value="" selected>All operations</option>
+                                <option value="backup">Backup</option>
+                                <option value="migration">Migration</option>
+                                <option value="restore">Restore</option>
+                                <option value="dry_run">Dry run</option>
+                            </select>
+                        </div>
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_job_status_filter">Status</label>
+                            <select class="form-select form-select-sm" id="data_management_job_status_filter">
+                                <option value="" selected>All statuses</option>
+                                <option value="queued">Queued</option>
+                                <option value="running">Running</option>
+                                <option value="completed">Completed</option>
+                                <option value="completed_with_warnings">Completed with warnings</option>
+                                <option value="failed">Failed</option>
+                                <option value="canceled">Canceled</option>
+                            </select>
+                        </div>
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_job_scheduled_filter">Run type</label>
+                            <select class="form-select form-select-sm" id="data_management_job_scheduled_filter">
+                                <option value="all" selected>Scheduled and manual</option>
+                                <option value="scheduled">Scheduled</option>
+                                <option value="manual">Manual</option>
+                            </select>
+                        </div>
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_job_created_from">Created from</label>
+                            <input class="form-control form-control-sm" type="date" id="data_management_job_created_from" />
+                        </div>
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_job_created_to">Created through</label>
+                            <input class="form-control form-control-sm" type="date" id="data_management_job_created_to" />
+                        </div>
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_job_page_size">Rows per page</label>
+                            <select class="form-select form-select-sm" id="data_management_job_page_size">
+                                <option value="10">10</option>
+                                <option value="25" selected>25</option>
+                                <option value="50">50</option>
+                                <option value="100">100</option>
+                            </select>
+                        </div>
+                    </div>
+                    <div class="table-responsive">
+                        <table class="table table-sm align-middle">
+                            <thead>
+                                <tr>
+                                    <th scope="col">Created</th>
+                                    <th scope="col">Operation</th>
+                                    <th scope="col">Status</th>
+                                    <th scope="col">Progress</th>
+                                    <th scope="col">Message</th>
+                                    <th scope="col">Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="data-management-jobs-tbody">
+                                <tr>
+                                    <td colspan="6" class="text-muted">Job history has not loaded yet.</td>
+                                </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                    <nav class="d-flex flex-wrap align-items-center justify-content-between gap-2" aria-label="Job history pagination">
+                        <span class="small text-muted" id="data-management-job-pagination-status" role="status" aria-live="polite">Page 1 has not loaded yet.</span>
+                        <div class="btn-group btn-group-sm" role="group" aria-label="Job history pages">
+                            <button type="button" class="btn btn-outline-secondary" id="data-management-job-previous-page-btn" disabled aria-disabled="true">
+                                <i class="bi bi-chevron-left me-1"></i>Previous
+                            </button>
+                            <button type="button" class="btn btn-outline-secondary" id="data-management-job-next-page-btn" disabled aria-disabled="true">
+                                Next<i class="bi bi-chevron-right ms-1"></i>
+                            </button>
+                        </div>
+                    </nav>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/latest-features.html b/application/single_app/templates/admin/_panes/latest-features.html
new file mode 100644
index 000000000..a5d8c5f5d
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/latest-features.html
@@ -0,0 +1,1253 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'latest-features' %} show active{% endif %}" id="latest-features" role="tabpanel" aria-labelledby="latest-features-tab">
+                <p class="text-muted mb-2">
+                    Review the main capabilities introduced in v{{ config['VERSION'] }} and use this page as an admin-facing overview for what to highlight with your teams.
+                </p>
+                <div class="alert alert-primary" role="alert">
+                    This tab is intentionally curated. It groups related improvements together and mirrors a small number of high-impact settings so admins can enable them from the same overview.
+                </div>
+
+                {% for release_group in admin_latest_feature_release_groups %}
+                {% if release_group.id == 'current_release' %}
+                <div class="d-flex flex-column flex-lg-row align-items-lg-center justify-content-between gap-2 mb-3">
+                    <div>
+                        <h5 class="mb-1">{{ release_group.label }}</h5>
+                        <p class="text-muted mb-0">{{ release_group.description }}</p>
+                    </div>
+                    {% if release_group.release_version %}
+                    <span class="badge bg-primary-subtle text-primary border border-primary-subtle">v{{ release_group.release_version }}</span>
+                    {% endif %}
+                </div>
+
+                {% for feature in release_group.features %}
+                {% set feature_card_id = 'latest-features-' ~ feature.id|replace('_', '-') ~ '-card' %}
+                {% set feature_collapse_id = feature_card_id ~ '-details' %}
+                <div class="card p-3 mb-3 latest-feature-card" id="{{ feature_card_id }}">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1"><i class="bi {{ feature.icon }} me-2"></i>{{ feature.title }}</h5>
+                            <p class="text-muted mb-0">{{ feature.summary }}</p>
+                        </div>
+                        <a href="#{{ feature_collapse_id }}" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="{{ feature_collapse_id }}">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="{{ feature_collapse_id }}">
+                        <div class="card card-body">
+                            {% if feature.details %}
+                            <p class="mb-2">{{ feature.details }}</p>
+                            {% endif %}
+                            {% if feature.why %}
+                            <div class="alert alert-secondary mb-3" role="alert">{{ feature.why }}</div>
+                            {% endif %}
+                            {% if feature.guidance %}
+                            <h6 class="mb-2">{% if feature.images %}Screenshot and rollout notes{% else %}Rollout notes{% endif %}</h6>
+                            <ul class="mb-3">
+                                {% for tip in feature.guidance %}
+                                <li>{{ tip }}</li>
+                                {% endfor %}
+                            </ul>
+                            {% endif %}
+                            {% if feature.images %}
+                            <div class="latest-feature-gallery mb-3">
+                                {% for image in feature.images %}
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename=image.path) }}"
+                                    data-latest-feature-image-title="{{ image.title }}"
+                                    data-latest-feature-image-caption="{{ image.caption }}"
+                                >
+                                    <div class="latest-feature-thumbnail-card h-100">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename=image.path) }}" alt="{{ image.alt }}">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">{{ image.label }}</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                {% endfor %}
+                            </div>
+                            {% endif %}
+                            {% if feature.actions %}
+                            <div class="d-flex flex-wrap gap-2">
+                                {% for action in feature.actions %}
+                                <a
+                                    class="btn btn-outline-primary btn-sm"
+                                    href="{% if action.href %}{{ action.href }}{% else %}{{ url_for(action.endpoint) }}{% if action.fragment %}#{{ action.fragment }}{% endif %}{% endif %}"
+                                    {% if action.is_external %}target="_blank" rel="noopener noreferrer"{% endif %}
+                                    {% if action.admin_tab %}data-open-admin-tab="{{ action.admin_tab }}"{% endif %}
+                                    {% if action.admin_section %}data-open-admin-section="{{ action.admin_section }}"{% endif %}
+                                >
+                                    <i class="bi {{ action.icon }} me-1"></i>{{ action.label }}
+                                </a>
+                                {% endfor %}
+                            </div>
+                            {% endif %}
+                        </div>
+                    </div>
+                </div>
+                {% endfor %}
+                {% else %}
+                {% set release_card_id = 'latest-features-' ~ release_group.id|replace('_', '-') ~ '-card' %}
+                {% set release_collapse_id = release_group.collapse_id %}
+                <div class="card p-3 mb-3 latest-feature-card" id="{{ release_card_id }}">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1"><i class="bi bi-clock-history me-2"></i>{{ release_group.label }}</h5>
+                            <p class="text-muted mb-0">{{ release_group.description }}</p>
+                        </div>
+                        <a href="#{{ release_collapse_id }}" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="{{ release_collapse_id }}">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="{{ release_collapse_id }}">
+                        <div class="card card-body">
+                            {% if release_group.release_version %}
+                            <div class="alert alert-secondary mb-3" role="alert">
+                                These were the headline admin-facing items in the earlier v{{ release_group.release_version }} release set.
+                            </div>
+                            {% endif %}
+                            <div class="row g-3">
+                                {% for feature in release_group.features %}
+                                <div class="col-xl-6">
+                                    <div class="border rounded p-3 h-100 bg-body-tertiary">
+                                        <div class="d-flex flex-column gap-3 h-100">
+                                            <div>
+                                                <h6 class="mb-1"><i class="bi {{ feature.icon }} me-2"></i>{{ feature.title }}</h6>
+                                                <p class="text-muted small mb-0">{{ feature.summary }}</p>
+                                            </div>
+                                            <p class="small mb-0">{{ feature.details }}</p>
+                                            {% if feature.guidance %}
+                                            <ul class="small mb-0">
+                                                {% for tip in feature.guidance %}
+                                                <li>{{ tip }}</li>
+                                                {% endfor %}
+                                            </ul>
+                                            {% endif %}
+                                            {% if feature.images %}
+                                            <div class="latest-feature-gallery">
+                                                {% for image in feature.images %}
+                                                <button
+                                                    type="button"
+                                                    class="latest-feature-thumbnail-trigger"
+                                                    data-latest-feature-image-src="{{ url_for('static', filename=image.path) }}"
+                                                    data-latest-feature-image-title="{{ image.title }}"
+                                                    data-latest-feature-image-caption="{{ image.caption }}"
+                                                >
+                                                    <div class="latest-feature-thumbnail-card h-100">
+                                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename=image.path) }}" alt="{{ image.alt }}">
+                                                        <div class="latest-feature-thumbnail-body">
+                                                            <div class="latest-feature-thumbnail-title">{{ image.label }}</div>
+                                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                                        </div>
+                                                    </div>
+                                                </button>
+                                                {% endfor %}
+                                            </div>
+                                            {% endif %}
+                                            {% if feature.actions %}
+                                            <div class="d-flex flex-wrap gap-2 mt-auto pt-2">
+                                                {% for action in feature.actions %}
+                                                <a
+                                                    class="btn btn-outline-primary btn-sm"
+                                                    href="{% if action.href %}{{ action.href }}{% else %}{{ url_for(action.endpoint) }}{% if action.fragment %}#{{ action.fragment }}{% endif %}{% endif %}"
+                                                    {% if action.is_external %}target="_blank" rel="noopener noreferrer"{% endif %}
+                                                    {% if action.admin_tab %}data-open-admin-tab="{{ action.admin_tab }}"{% endif %}
+                                                    {% if action.admin_section %}data-open-admin-section="{{ action.admin_section }}"{% endif %}
+                                                >
+                                                    <i class="bi {{ action.icon }} me-1"></i>{{ action.label }}
+                                                </a>
+                                                {% endfor %}
+                                            </div>
+                                            {% endif %}
+                                        </div>
+                                    </div>
+                                </div>
+                                {% endfor %}
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                {% endif %}
+                {% endfor %}
+
+                {% if false %}
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-release-notifications-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-megaphone me-2"></i>Registered / Unregistered Badge
+                            </h5>
+                            <p class="text-muted mb-0">The badge next to the Admin Settings version number shows whether this admin instance is registered for latest release and community call notifications.</p>
+                        </div>
+                        <a href="#latestFeaturesReleaseNotifications" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesReleaseNotifications">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesReleaseNotifications">
+                        <div class="card card-body">
+                            <div class="alert alert-secondary mb-3" role="alert">
+                                Admin-only explainer: this badge belongs to Admin Settings only and does not need to appear in the user-facing Latest Features pages.
+                            </div>
+                            <p class="mb-2">Use this badge as the quick status check for whether your environment is already registered to receive SimpleChat release updates.</p>
+                            <ul class="mb-0">
+                                <li><strong>Unregistered</strong> means this environment has not saved release notification registration details yet.</li>
+                                <li><strong>Registered</strong> means the environment already has saved contact details for release and community call notifications.</li>
+                                <li>Clicking the badge opens the registration modal where admins can add or edit the name, email, and organization for this instance.</li>
+                                <li>Submitting the form opens a prefilled email draft to <strong>simplechat@microsoft.com</strong> and stores the registration details back in Admin Settings.</li>
+                                <li>The badge lives beside the version number at the top of Admin Settings so admins can confirm status without hunting through tabs.</li>
+                            </ul>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-deployment-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-hdd-rack me-2"></i>Performance Improvements for Apps running Native Python (not containers)
+                            </h5>
+                            <p class="text-muted mb-0">Native Python App Service deployments should use Gunicorn as the startup command. Container deployments already do this for you.</p>
+                        </div>
+                        <a href="#latestFeaturesDeployment" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesDeployment">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesDeployment">
+                        <div class="card card-body">
+                            <p class="mb-2">If you run the native Python App Service deployment instead of the container deployment, set the App Service Startup command to the following:</p>
+                            <pre class="latest-feature-command">python -m gunicorn -c gunicorn.conf.py app:app</pre>
+                            <p class="mt-3 mb-2">Use container deployments when possible if you want the runtime defaults and startup behavior handled by the shipped image.</p>
+                            <div class="d-flex flex-wrap gap-2 mb-3">
+                                <a href="https://github.com/microsoft/simplechat/blob/main/docs/explanation/features/SIMPLECHAT_STARTUP.md" target="_blank" rel="noopener noreferrer" class="btn btn-outline-primary btn-sm">
+                                    <i class="bi bi-box-arrow-up-right me-1"></i>Startup Guidance
+                                </a>
+                                <a href="https://github.com/microsoft/simplechat/blob/main/README.md#deployment-runtime-notes" target="_blank" rel="noopener noreferrer" class="btn btn-outline-secondary btn-sm">
+                                    <i class="bi bi-box-arrow-up-right me-1"></i>Runtime Notes
+                                </a>
+                            </div>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/gunicorn_startup_guidance.png') }}"
+                                    data-latest-feature-image-title="Gunicorn Startup Guidance"
+                                    data-latest-feature-image-caption="Native Python App Service startup command guidance preview."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/gunicorn_startup_guidance.png') }}" alt="Gunicorn startup guidance screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Gunicorn Startup Guidance</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-guided-tutorials-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-signpost-split me-2"></i>Guided Tutorials
+                            </h5>
+                            <p class="text-muted mb-0">New guided walkthroughs help users learn the live chat and personal workspace interfaces without leaving the app.</p>
+                        </div>
+                        <a href="#latestFeaturesGuidedTutorials" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesGuidedTutorials">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesGuidedTutorials">
+                        <div class="card card-body">
+                            <p class="mb-2">Admins can use these walkthroughs to accelerate onboarding for new users and reduce orientation time across the primary product surfaces.</p>
+                            <ul class="mb-3">
+                                <li>Guided Chat Tutorial covers the active chat experience, message actions, search flows, citations, thoughts, and export-related actions.</li>
+                                <li>Personal Workspace Guided Tutorial walks through uploads, search, filters, list and grid views, prompts, agents, actions, and tags.</li>
+                            </ul>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/guided_tutorials_chat.png') }}"
+                                    data-latest-feature-image-title="Guided Chat Tutorial"
+                                    data-latest-feature-image-caption="Chat walkthrough preview for end users."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/guided_tutorials_chat.png') }}" alt="Guided chat tutorial screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Guided Chat Tutorial</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/guided_tutorials_workspace.png') }}"
+                                    data-latest-feature-image-title="Workspace Guided Tutorial"
+                                    data-latest-feature-image-caption="Personal workspace walkthrough preview."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/guided_tutorials_workspace.png') }}" alt="Workspace guided tutorial screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Workspace Guided Tutorial</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-background-chat-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-bell me-2"></i>Background Chat Completion
+                            </h5>
+                            <p class="text-muted mb-0">Personal chats can continue finishing after a user leaves the chat page, and completed responses surface as notifications with unread indicators.</p>
+                        </div>
+                        <a href="#latestFeaturesBackgroundChat" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesBackgroundChat">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesBackgroundChat">
+                        <div class="card card-body">
+                            <p class="mb-2">This makes long-running responses more reliable for users who navigate into other areas of the app before generation finishes.</p>
+                            <ul class="mb-3">
+                                <li>Completion notifications deep-link back into the finished conversation.</li>
+                                <li>Unread markers remain visible until the response is actually opened.</li>
+                                <li>Personal, workspace, and navigation flows now behave more consistently while chat completion continues in the background.</li>
+                            </ul>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/background_completion_notifications-01.png') }}"
+                                    data-latest-feature-image-title="Background Completion Notification"
+                                    data-latest-feature-image-caption="Unread completion notification state for background chat responses."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/background_completion_notifications-01.png') }}" alt="Background completion notification screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Notification State</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/background_completion_notifications-02.png') }}"
+                                    data-latest-feature-image-title="Background Completion Deep Link"
+                                    data-latest-feature-image-caption="Finished response entry point back into the completed chat."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/background_completion_notifications-02.png') }}" alt="Background completion deep link screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Deep Link Back to Chat</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-model-selection-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-cpu me-2"></i>Multi-Endpoint GPT Selection
+                            </h5>
+                            <p class="text-muted mb-0">Admins can expose multiple GPT choices across Azure OpenAI and Azure AI Foundry, set a saved default fallback model, and now review agent rebinding in a modal before applying changes.</p>
+                        </div>
+                        <a href="#latestFeaturesModelSelection" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesModelSelection">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesModelSelection">
+                        <div class="card card-body">
+                            <p class="mb-2">This is the high-value admin control for teams that want broader GPT choice without locking every workflow to a single deployment.</p>
+                            <ul class="mb-3">
+                                <li>Configure multiple model endpoints and choose which GPT deployments are available to users.</li>
+                                <li>Set a default fallback model so summarization, agent requests, and other background flows still resolve a usable GPT when an explicit selection is missing.</li>
+                                <li>Use the admin-only Agent Default Model Review modal to inspect inherited agents, search and filter large agent sets, and explicitly choose which review rows should be overridden to the saved default.</li>
+                            </ul>
+                            <div class="alert alert-info mb-3" role="alert">
+                                <strong>Admin-only workflow:</strong> The review modal is intended for administrators who need to standardize agents on a new default model, control cost, or intentionally replace older explicit bindings as new models are released.
+                            </div>
+                            <div class="alert alert-secondary mb-3" role="alert">
+                                Review endpoint and fallback configuration in the <a href="#multi-endpoint-configuration" data-admin-link="multi-endpoint-configuration">AI Models</a> tab.
+                            </div>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/model_selection_multi_endpoint_admin.png') }}"
+                                    data-latest-feature-image-title="Admin Multi-Endpoint Model Management"
+                                    data-latest-feature-image-caption="Admin endpoint table showing Azure OpenAI and Foundry model endpoints with configured GPT choices."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/model_selection_multi_endpoint_admin.png') }}" alt="Admin multi-endpoint model management screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Admin Endpoint Table</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/agent_default_model_review_summary.png') }}"
+                                    data-latest-feature-image-title="Agent Default Model Review Summary"
+                                    data-latest-feature-image-caption="AI Models summary card showing recommended agents, explicit override candidates, and the saved default model before opening the review modal."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/agent_default_model_review_summary.png') }}" alt="Agent default model review summary screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Review Summary Card</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/agent_default_model_review_action.png') }}"
+                                    data-latest-feature-image-title="Agent Default Model Review Modal"
+                                    data-latest-feature-image-caption="Admin modal for searching, filtering, and selecting the exact agents that should adopt the saved default model."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/agent_default_model_review_action.png') }}" alt="Agent default model review modal screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Review Modal Action</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-tabular-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-table me-2"></i>Tabular Data Analysis
+                            </h5>
+                            <p class="text-muted mb-0">Enhanced citations now unlock a more consistent tabular analysis experience for normal chat and workspace-backed files, not just dedicated agent scenarios.</p>
+                        </div>
+                        <a href="#latestFeaturesTabular" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesTabular">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesTabular">
+                        <div class="card card-body">
+                            <p class="mb-2">This is the highest-impact settings area to mirror here because it combines storage-backed citations, tabular previews, and consistent behavior across workspace and chat uploads.</p>
+                            <ul class="mb-3">
+                                <li>Tabular files can be analyzed with the same core approach whether they come from chat uploads or any workspace container.</li>
+                                <li>Enhanced citations provide the blob-backed dependency for richer tabular processing and citation transparency.</li>
+                                <li>Admins can right-size tabular preview limits based on the memory profile of their runtime.</li>
+                            </ul>
+                            <div class="alert alert-secondary mb-3" role="alert">
+                                These controls mirror the saved values in the <a href="#enhanced-citations-section" data-admin-link="enhanced-citations-section">Citations</a> tab.
+                            </div>
+                            <div class="form-check form-switch mb-3">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="latest_features_enable_enhanced_citations"
+                                    name="latest_features_enable_enhanced_citations_proxy"
+                                    autocomplete="off"
+                                    data-ignore-settings-change="true"
+                                    data-lpignore="true"
+                                    data-1p-ignore="true"
+                                    data-bwignore="true"
+                                    {% if settings.enable_enhanced_citations %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2" for="latest_features_enable_enhanced_citations">
+                                    Enable Enhanced Citations
+                                </label>
+                            </div>
+
+                            <div id="latest_features_enhanced_citation_settings" class="{% if not settings.enable_enhanced_citations %}d-none{% endif %}">
+                                <div class="card mb-3 p-3">
+                                    <h6><strong>All filetypes</strong></h6>
+                                    <div class="mb-3">
+                                        <label for="latest_features_office_docs_authentication_type" class="form-label">
+                                            Storage Account Authentication Type
+                                        </label>
+                                        <select class="form-select" id="latest_features_office_docs_authentication_type" name="latest_features_office_docs_authentication_type_proxy" autocomplete="off" data-ignore-settings-change="true" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
+                                            <option value="key" {% if settings.office_docs_authentication_type == "key" or not settings.office_docs_authentication_type %}selected{% endif %}>Connection String</option>
+                                            <option value="managed_identity" {% if settings.office_docs_authentication_type == "managed_identity" %}selected{% endif %}>Managed Identity</option>
+                                        </select>
+                                    </div>
+
+                                    <div class="mb-3 {% if settings.office_docs_authentication_type == 'managed_identity' %}d-none{% endif %}" id="latest_features_office_docs_storage_conn_str_group">
+                                        <label for="latest_features_office_docs_storage_account_url" class="form-label">
+                                            Storage Account Connection String
+                                        </label>
+                                        <div class="input-group">
+                                            <input
+                                                type="password"
+                                                class="form-control"
+                                                id="latest_features_office_docs_storage_account_url"
+                                                name="latest_features_office_docs_storage_account_url_proxy"
+                                                autocomplete="off"
+                                                data-ignore-settings-change="true"
+                                                data-lpignore="true"
+                                                data-1p-ignore="true"
+                                                data-bwignore="true"
+                                                value="{{ settings.office_docs_storage_account_url or '' }}"
+                                            >
+                                            <button type="button" class="btn btn-outline-secondary" id="toggle_latest_features_office_conn_str">Show</button>
+                                        </div>
+                                    </div>
+
+                                    <div class="mb-3 {% if settings.office_docs_authentication_type != 'managed_identity' %}d-none{% endif %}" id="latest_features_office_docs_storage_url_group">
+                                        <label for="latest_features_office_docs_storage_account_blob_endpoint" class="form-label">
+                                            Storage Account Blob Service Endpoint
+                                        </label>
+                                        <div class="input-group">
+                                            <input
+                                                type="password"
+                                                class="form-control"
+                                                id="latest_features_office_docs_storage_account_blob_endpoint"
+                                                name="latest_features_office_docs_storage_account_blob_endpoint_proxy"
+                                                autocomplete="off"
+                                                data-ignore-settings-change="true"
+                                                data-lpignore="true"
+                                                data-1p-ignore="true"
+                                                data-bwignore="true"
+                                                value="{{ settings.office_docs_storage_account_blob_endpoint or '' }}"
+                                            >
+                                            <button type="button" class="btn btn-outline-secondary" id="toggle_latest_features_office_url">Show</button>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <div class="card mb-3 p-3">
+                                    <h6><strong>Tabular Preview Limits</strong></h6>
+                                    <div class="mb-3">
+                                        <label for="latest_features_tabular_preview_max_blob_size_mb" class="form-label">
+                                            Maximum File Size for Tabular Preview (MB)
+                                        </label>
+                                        <input type="number" class="form-control" id="latest_features_tabular_preview_max_blob_size_mb" name="latest_features_tabular_preview_max_blob_size_mb_proxy" autocomplete="off" inputmode="numeric" data-ignore-settings-change="true" data-lpignore="true" data-1p-ignore="true" data-bwignore="true"
+                                            min="1" max="1024"
+                                            value="{{ settings.tabular_preview_max_blob_size_mb or 200 }}">
+                                        <small class="form-text text-muted">
+                                            Mirror of the Citations setting. Larger values support bigger previews but increase runtime memory pressure.
+                                        </small>
+                                    </div>
+                                </div>
+                            </div>
+
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/tabular_analysis_enhanced_citations.png') }}"
+                                    data-latest-feature-image-title="Tabular Analysis with Enhanced Citations"
+                                    data-latest-feature-image-caption="Enhanced citations and tabular analysis preview."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/tabular_analysis_enhanced_citations.png') }}" alt="Tabular analysis enhanced citations screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Tabular Analysis Preview</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-citation-improvements-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-journal-text me-2"></i>Citation Improvements
+                            </h5>
+                            <p class="text-muted mb-0">Conversation history citation replay and citation amplification keep more grounded evidence available across follow-up turns without making the chat history unwieldy.</p>
+                        </div>
+                        <a href="#latestFeaturesCitationImprovements" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesCitationImprovements">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesCitationImprovements">
+                        <div class="card card-body">
+                            <p class="mb-2">These improvements make follow-up questions more reliable because the system can reuse prior grounded evidence instead of relying only on the assistant's last prose response.</p>
+                            <ul class="mb-3">
+                                <li>Conversation history citations carry forward prior citation summaries so later prompts can reuse earlier grounded results.</li>
+                                <li>Citation amplification keeps richer supporting payloads available for inspection and export while keeping prompt history compact.</li>
+                                <li>This is especially useful for larger or tabular outputs where users often ask multiple follow-up questions against the same evidence chain.</li>
+                            </ul>
+                            <div class="alert alert-secondary mb-3" role="alert">
+                                These improvements complement the <a href="#enhanced-citations-section" data-admin-link="enhanced-citations-section">Citations</a> configuration and the enhanced-citation storage flow.
+                            </div>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/citation_improvements_history_replay.png') }}"
+                                    data-latest-feature-image-title="Conversation History Citation Replay"
+                                    data-latest-feature-image-caption="Follow-up chat where prior citation summaries are replayed into the next turn's reasoning context."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/citation_improvements_history_replay.png') }}" alt="Conversation history citation replay screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">History Citation Replay</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/citation_improvements_amplified_results.png') }}"
+                                    data-latest-feature-image-title="Citation Amplification Details"
+                                    data-latest-feature-image-caption="Expanded citation detail showing amplified supporting evidence and fuller artifact-backed results."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/citation_improvements_amplified_results.png') }}" alt="Citation amplification details screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Amplified Citation Detail</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-document-versioning-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-files me-2"></i>Document Revisioning and Management
+                            </h5>
+                            <p class="text-muted mb-0">Uploading a document with the same name now creates a new revision instead of overwriting the previous file, while older versions remain available for traceability and later analysis.</p>
+                        </div>
+                        <a href="#latestFeaturesDocumentVersioning" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesDocumentVersioning">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesDocumentVersioning">
+                        <div class="card card-body">
+                            <p class="mb-2">This improves both document management and citation integrity for long-lived conversations that span multiple document updates.</p>
+                            <ul class="mb-3">
+                                <li>Same-name uploads create a revision family with an incremented current version instead of destroying prior history.</li>
+                                <li>Previous versions are retained for analysis or comparison, while workspace and search views focus on the current revision by default.</li>
+                                <li>Older conversations can still resolve citations against the correct historical document version.</li>
+                                <li>Updated revisions inherit document classifications and tags so admins do not have to reapply metadata after every refresh.</li>
+                            </ul>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/document_revision_workspace.png') }}"
+                                    data-latest-feature-image-title="Current Revision in Workspace"
+                                    data-latest-feature-image-caption="Workspace document list showing the current revision state for same-name uploads."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/document_revision_workspace.png') }}" alt="Document revision workspace screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Current Revision View</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/document_revision_delete_compare.png') }}"
+                                    data-latest-feature-image-title="Revision Actions and Comparison"
+                                    data-latest-feature-image-caption="Version-aware actions such as comparison, analysis of previous revisions, or current-versus-all-versions deletion choices."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/document_revision_delete_compare.png') }}" alt="Document revision actions screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Revision Actions</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-export-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-file-earmark-arrow-down me-2"></i>Conversation Summaries and Export
+                            </h5>
+                            <p class="text-muted mb-0">Conversation export now includes persistent summaries, PDF output, and easier per-message reuse and sharing actions.</p>
+                        </div>
+                        <a href="#latestFeaturesExports" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesExports">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesExports">
+                        <div class="card card-body">
+                            <ul class="mb-3">
+                                <li>Conversation details now surface a summary card with generate and regenerate actions.</li>
+                                <li>Export supports PDF alongside existing export options.</li>
+                                <li>Per-message actions support Markdown export, Word export, open in email, and use as prompt.</li>
+                            </ul>
+                            <div class="row g-3">
+                                <div class="col-lg-6">
+                                    <button
+                                        type="button"
+                                        class="latest-feature-thumbnail-trigger"
+                                        data-latest-feature-image-src="{{ url_for('static', filename='images/features/conversation_summary_card.png') }}"
+                                        data-latest-feature-image-title="Conversation Summary Card"
+                                        data-latest-feature-image-caption="Conversation summary panel preview in the chat experience."
+                                    >
+                                        <div class="latest-feature-thumbnail-card h-100">
+                                            <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/conversation_summary_card.png') }}" alt="Conversation summary card screenshot">
+                                            <div class="latest-feature-thumbnail-body">
+                                                <div class="latest-feature-thumbnail-title">Conversation Summary Card</div>
+                                                <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                            </div>
+                                        </div>
+                                    </button>
+                                </div>
+                                <div class="col-lg-6">
+                                    <div class="latest-feature-gallery h-100">
+                                        <button
+                                            type="button"
+                                            class="latest-feature-thumbnail-trigger"
+                                            data-latest-feature-image-src="{{ url_for('static', filename='images/features/pdf_export_option.png') }}"
+                                            data-latest-feature-image-title="PDF Export Option"
+                                            data-latest-feature-image-caption="PDF export entry in the conversation export workflow."
+                                        >
+                                            <div class="latest-feature-thumbnail-card h-100">
+                                                <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/pdf_export_option.png') }}" alt="PDF export option screenshot">
+                                                <div class="latest-feature-thumbnail-body">
+                                                    <div class="latest-feature-thumbnail-title">PDF Export Option</div>
+                                                    <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                                </div>
+                                            </div>
+                                        </button>
+                                        <button
+                                            type="button"
+                                            class="latest-feature-thumbnail-trigger"
+                                            data-latest-feature-image-src="{{ url_for('static', filename='images/features/per_message_export_menu.png') }}"
+                                            data-latest-feature-image-title="Per-Message Export Menu"
+                                            data-latest-feature-image-caption="Expanded per-message export and reuse actions."
+                                        >
+                                            <div class="latest-feature-thumbnail-card h-100">
+                                                <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/per_message_export_menu.png') }}" alt="Per-message export menu screenshot">
+                                                <div class="latest-feature-thumbnail-body">
+                                                    <div class="latest-feature-thumbnail-title">Per-Message Export Menu</div>
+                                                    <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                                </div>
+                                            </div>
+                                        </button>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-agent-ops-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-grid me-2"></i>Agent and Action Operations
+                            </h5>
+                            <p class="text-muted mb-0">Recent updates improve manageability for agents and actions with richer views, easier SQL connectivity checks, and better operational tracking.</p>
+                        </div>
+                        <a href="#latestFeaturesAgentOps" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesAgentOps">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesAgentOps">
+                        <div class="card card-body">
+                            <ul class="mb-3">
+                                <li>List and grid view toggles give admins and users a better way to browse agents and actions.</li>
+                                <li>SQL actions now include an inline Test Connection button before save.</li>
+                                <li>User tracking and activity logging improve auditability for agent and action changes.</li>
+                            </ul>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/agent_action_grid_view.png') }}"
+                                    data-latest-feature-image-title="Agent and Action Grid View"
+                                    data-latest-feature-image-caption="Grid browsing experience for agents and actions."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/agent_action_grid_view.png') }}" alt="Agent and action grid view screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Grid View</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/sql_test_connection.png') }}"
+                                    data-latest-feature-image-title="SQL Test Connection"
+                                    data-latest-feature-image-caption="Inline SQL connection test preview before save."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/sql_test_connection.png') }}" alt="SQL test connection screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">SQL Test Connection</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-thoughts-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-stars me-2"></i>AI Transparency
+                            </h5>
+                            <p class="text-muted mb-0">Processing Thoughts provide a clearer view into model activity, duration, and execution flow while responses are being generated.</p>
+                        </div>
+                        <a href="#latestFeaturesThoughts" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesThoughts">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesThoughts">
+                        <div class="card card-body">
+                            <p class="mb-2">Admins can enable this once and let users see more of the model pipeline, including sending, generating, and responded states with clearer timing information.</p>
+                            <div class="alert alert-secondary mb-3" role="alert">
+                                This toggle mirrors the saved value in the <a href="#processing-thoughts-section" data-admin-link="processing-thoughts-section">Chat Experience</a> tab.
+                            </div>
+                            <div class="form-check form-switch mb-3">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="latest_features_enable_thoughts"
+                                    name="latest_features_enable_thoughts_proxy"
+                                    autocomplete="off"
+                                    data-ignore-settings-change="true"
+                                    data-lpignore="true"
+                                    data-1p-ignore="true"
+                                    data-bwignore="true"
+                                    {% if settings.enable_thoughts %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2" for="latest_features_enable_thoughts">
+                                    Enable Processing Thoughts
+                                </label>
+                            </div>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/thoughts_visibility.png') }}"
+                                    data-latest-feature-image-title="Processing Thoughts Visibility"
+                                    data-latest-feature-image-caption="Processing thoughts state and timing details preview."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/thoughts_visibility.png') }}" alt="Processing thoughts visibility screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Processing Thoughts</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-fact-memory-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-journal-bookmark me-2"></i>Fact Memory
+                            </h5>
+                            <p class="text-muted mb-0">Users can now save Instructions and Facts on their profile so the assistant can apply durable preferences every time and recall relevant personal context only when needed.</p>
+                        </div>
+                        <a href="#latestFeaturesFactMemory" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesFactMemory">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesFactMemory">
+                        <div class="card card-body">
+                            <p class="mb-2">Fact Memory gives users a compact profile experience for managing two distinct memory types: always-on Instructions and relevance-based Facts.</p>
+                            <ul class="mb-3">
+                                <li>Instructions act like stable user preferences and are applied on every prompt unless the current message overrides them.</li>
+                                <li>Facts are recalled only when relevant and now appear as dedicated thought and citation entries in chat.</li>
+                                <li>The profile page includes a compact add flow plus a popup manager for search, paging, edit, retag, and delete actions.</li>
+                                <li>Admins can choose whether this announcement is visible on the user-facing Latest Features page from <strong>General > User-Facing Latest Features</strong>.</li>
+                            </ul>
+                            <div class="alert alert-secondary mb-3" role="alert">
+                                Use the <a href="#support-menu-section" data-admin-link="support-menu-section">Support Menu</a> tab when you want to show or hide the Fact Memory announcement for end users.
+                            </div>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/facts_memory_view_profile.png') }}"
+                                    data-latest-feature-image-title="Fact Memory on Profile"
+                                    data-latest-feature-image-caption="Profile page section for adding saved instructions and facts and opening the manager modal."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/facts_memory_view_profile.png') }}" alt="Profile fact memory section screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Profile Entry Point</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/fact_memory_management.png') }}"
+                                    data-latest-feature-image-title="Manage Fact Memories"
+                                    data-latest-feature-image-caption="Compact popup manager showing saved instructions and facts with search, paging, edit, and type controls."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/fact_memory_management.png') }}" alt="Fact memory management modal screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Memory Manager</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/facts_citation_and_thoughts.png') }}"
+                                    data-latest-feature-image-title="Instruction Memory and Fact Recall in Chat"
+                                    data-latest-feature-image-caption="Chat response showing instruction memory and fact recall surfaced as dedicated thoughts and citations."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/facts_citation_and_thoughts.png') }}" alt="Chat fact memory thoughts and citations screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Chat Recall</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-redis-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-key me-2"></i>Redis and Key Vault
+                            </h5>
+                            <p class="text-muted mb-0">Redis configuration now supports using a Key Vault secret name instead of storing the access key directly in settings.</p>
+                        </div>
+                        <a href="#latestFeaturesRedis" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesRedis">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesRedis">
+                        <div class="card card-body">
+                            <p class="mb-2">This is useful for teams standardizing on Key Vault-backed secret storage while still using Redis for cache and session scenarios.</p>
+                            <ul class="mb-3">
+                                <li>Use Redis authentication type <strong>Key Vault</strong> when you want the stored value to represent a secret name instead of a raw Redis key.</li>
+                                <li>This works best when Key Vault is already configured for the app.</li>
+                            </ul>
+                            <div class="alert alert-secondary mb-3" role="alert">
+                                These controls mirror the saved values in the <a href="#redis-cache-section" data-admin-link="redis-cache-section">Redis &amp; Caching</a> tab.
+                            </div>
+                            <div class="form-check form-switch mb-3">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="latest_features_enable_redis_cache"
+                                    name="latest_features_enable_redis_cache_proxy"
+                                    autocomplete="off"
+                                    data-ignore-settings-change="true"
+                                    data-lpignore="true"
+                                    data-1p-ignore="true"
+                                    data-bwignore="true"
+                                    {% if settings.enable_redis_cache %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2" for="latest_features_enable_redis_cache">
+                                    Enable Redis Cache
+                                </label>
+                            </div>
+
+                            <div id="latest_features_redis_settings" class="{% if not settings.enable_redis_cache %}d-none{% endif %}">
+                                <div class="card mb-3 p-3">
+                                    <h6><strong>Redis Cache Settings</strong></h6>
+                                    <div class="mb-3">
+                                        <label for="latest_features_redis_url" class="form-label">Redis Server Host Name</label>
+                                        <input
+                                            type="text"
+                                            class="form-control"
+                                            id="latest_features_redis_url"
+                                            name="latest_features_redis_url_proxy"
+                                            autocomplete="off"
+                                            data-ignore-settings-change="true"
+                                            data-lpignore="true"
+                                            data-1p-ignore="true"
+                                            data-bwignore="true"
+                                            value="{{ settings.redis_url or '' }}"
+                                        >
+                                    </div>
+                                    <div class="mb-3">
+                                        <label for="latest_features_redis_auth_type" class="form-label">Redis Authentication Type</label>
+                                        <select
+                                            class="form-select"
+                                            id="latest_features_redis_auth_type"
+                                            name="latest_features_redis_auth_type_proxy"
+                                            autocomplete="off"
+                                            data-ignore-settings-change="true"
+                                            data-lpignore="true"
+                                            data-1p-ignore="true"
+                                            data-bwignore="true"
+                                        >
+                                            <option value="key" {% if settings.redis_auth_type == 'key' or not settings.redis_auth_type %}selected{% endif %}>Key</option>
+                                            <option value="managed_identity" {% if settings.redis_auth_type == 'managed_identity' %}selected{% endif %}>Managed Identity</option>
+                                            <option value="key_vault" {% if settings.redis_auth_type == 'key_vault' %}selected{% endif %}>Key Vault</option>
+                                        </select>
+                                    </div>
+                                    <div class="mb-3 {% if settings.redis_auth_type == 'managed_identity' %}d-none{% endif %}" id="latest_features_redis_key_container">
+                                        <label for="latest_features_redis_key" class="form-label" id="latest_features_redis_key_label">
+                                            {%- if settings.redis_auth_type == 'key_vault' -%}
+                                                Key Vault Secret Name
+                                            {%- else -%}
+                                                Redis Access Key
+                                            {%- endif -%}
+                                        </label>
+                                        <div class="input-group">
+                                            <input
+                                                type="password"
+                                                class="form-control"
+                                                id="latest_features_redis_key"
+                                                name="latest_features_redis_key_proxy"
+                                                autocomplete="off"
+                                                data-ignore-settings-change="true"
+                                                data-lpignore="true"
+                                                data-1p-ignore="true"
+                                                data-bwignore="true"
+                                                value="{{ settings.redis_key or '' }}"
+                                            >
+                                            <button type="button" class="btn btn-outline-secondary" id="toggle_latest_features_redis_key">Show</button>
+                                        </div>
+                                        <div id="latest_features_redis_key_vault_hint" class="form-text text-muted {% if settings.redis_auth_type != 'key_vault' %}d-none{% endif %}">
+                                            When using Key Vault, store the secret name here instead of the raw Redis key.
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/redis_key_vault.png') }}"
+                                    data-latest-feature-image-title="Redis Key Vault Configuration"
+                                    data-latest-feature-image-caption="Redis authentication with Key Vault secret name preview."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/redis_key_vault.png') }}" alt="Redis Key Vault configuration screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Redis Key Vault</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-send-feedback-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-envelope-paper me-2"></i>Send Feedback to the SimpleChat Team
+                            </h5>
+                            <p class="text-muted mb-0">Admins now have a dedicated Send Feedback tab for bug reports and feature requests that opens a prefilled email draft and writes an audit record to the activity log.</p>
+                        </div>
+                        <a href="#latestFeaturesSendFeedback" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesSendFeedback">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesSendFeedback">
+                        <div class="card card-body">
+                            <p class="mb-3">Use the Send Feedback tab when you want to report a bug or suggest a feature directly from Admin Settings without leaving the page.</p>
+                            <ul class="mb-3">
+                                <li>Opens a prefilled email draft addressed to <strong>simplechat@microsoft.com</strong>.</li>
+                                <li>Logs the action to the activity log so admins can audit when feedback emails were prepared.</li>
+                                <li>Keeps the workflow simple by using text-only email content with no confusing pseudo-attachment step.</li>
+                            </ul>
+                            <a href="#send-feedback-overview-card" data-admin-link="send-feedback-overview-card" class="btn btn-outline-primary align-self-start">
+                                <i class="bi bi-envelope-paper me-1"></i>Open Send Feedback
+                            </a>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-support-menu-card">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-life-preserver me-2"></i>Support Menu
+                            </h5>
+                            <p class="text-muted mb-0">Support can now expose user-facing Latest Features and Send Feedback workflows directly in everyday navigation.</p>
+                        </div>
+                        <a href="#latestFeaturesSupportMenu" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesSupportMenu">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="latestFeaturesSupportMenu">
+                        <div class="card card-body">
+                            <div class="alert alert-success mb-3" role="alert">
+                                Support is now configurable from the General tab so admins can choose exactly what users see.
+                            </div>
+                            <ul class="mb-3">
+                                <li>Admins can enable or disable the Support menu and rename it for user navigation.</li>
+                                <li>Send Feedback now routes users to an internal recipient email address defined by admins.</li>
+                                <li>The user-facing Latest Features page can be curated feature-by-feature so teams only share the items they want visible.</li>
+                                <li>The General tab now includes a dedicated User-Facing Latest Features checklist so admins can quickly confirm which announcements will be visible to end users.</li>
+                            </ul>
+                            <a href="#support-menu-section" data-admin-link="support-menu-section" class="btn btn-outline-primary align-self-start mb-3">
+                                <i class="bi bi-gear me-1"></i>Open General Settings
+                            </a>
+                            <div class="latest-feature-gallery">
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/support_menu_entry.png') }}"
+                                    data-latest-feature-image-title="User Support Menu Entry"
+                                    data-latest-feature-image-caption="User-facing Support menu entry exposing Latest Features and Send Feedback."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/support_menu_entry.png') }}" alt="Support menu entry screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">Support Menu Entry</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                                <button
+                                    type="button"
+                                    class="latest-feature-thumbnail-trigger"
+                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/enable_support_menu_for_end_users.png') }}"
+                                    data-latest-feature-image-title="User-Facing Latest Features in General Settings"
+                                    data-latest-feature-image-caption="General tab Support settings showing Enable Support Menu for End Users and the User-Facing Latest Features checklist that controls what gets shared."
+                                >
+                                    <div class="latest-feature-thumbnail-card">
+                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/enable_support_menu_for_end_users.png') }}" alt="User-facing latest features checklist in general settings screenshot">
+                                        <div class="latest-feature-thumbnail-body">
+                                            <div class="latest-feature-thumbnail-title">General Tab Feature Sharing</div>
+                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                        </div>
+                                    </div>
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                {% endif %}
+
+                {% for release_group in support_latest_feature_release_groups_preview %}
+                {% if release_group.id != 'current_release' %}
+                {% set preview_card_id = 'latest-features-user-preview-' ~ release_group.id|replace('_', '-') ~ '-card' %}
+                {% set preview_collapse_id = 'latestFeaturesUserPreview' ~ release_group.id|replace('_', ' ')|title|replace(' ', '') %}
+                <div class="card p-3 mb-3 latest-feature-card" id="{{ preview_card_id }}">
+                    <div class="latest-feature-header">
+                        <div class="latest-feature-copy">
+                            <h5 class="mb-1">
+                                <i class="bi bi-clock-history me-2"></i>{{ release_group.label }}
+                            </h5>
+                            <p class="text-muted mb-0">{{ release_group.description }}</p>
+                        </div>
+                        <a href="#{{ preview_collapse_id }}" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="{{ preview_collapse_id }}">
+                            Show Details
+                        </a>
+                    </div>
+                    <div class="collapse mt-3" id="{{ preview_collapse_id }}">
+                        <div class="card card-body">
+                            <div class="alert alert-secondary mb-3" role="alert">
+                                These were the headline user-facing items in the earlier v{{ release_group.release_version }} release set. Keeping them here gives admins a simple previous-and-archive release view without mixing older items into the current release list.
+                            </div>
+                            <div class="row g-3">
+                                {% for feature in release_group.features %}
+                                <div class="col-xl-6">
+                                    <div class="border rounded p-3 h-100 bg-body-tertiary">
+                                        <div class="d-flex flex-column gap-3 h-100">
+                                            <div class="d-flex align-items-start justify-content-between gap-3">
+                                                <div>
+                                                    <h6 class="mb-1"><i class="bi {{ feature.icon }} me-2"></i>{{ feature.title }}</h6>
+                                                    <p class="text-muted small mb-0">{{ feature.summary }}</p>
+                                                </div>
+                                                <span class="badge {% if settings.support_latest_features_visibility.get(feature.id, true) %}bg-success{% else %}bg-secondary{% endif %}">
+                                                    {% if settings.support_latest_features_visibility.get(feature.id, true) %}Shared with Users{% else %}Hidden from Users{% endif %}
+                                                </span>
+                                            </div>
+                                            <p class="small mb-0">{{ feature.details }}</p>
+                                            {% if feature.guidance %}
+                                            <ul class="small mb-0">
+                                                {% for tip in feature.guidance %}
+                                                <li>{{ tip }}</li>
+                                                {% endfor %}
+                                            </ul>
+                                            {% endif %}
+                                            {% if feature.images %}
+                                            <div class="latest-feature-gallery">
+                                                {% for image in feature.images %}
+                                                <button
+                                                    type="button"
+                                                    class="latest-feature-thumbnail-trigger"
+                                                    data-latest-feature-image-src="{{ url_for('static', filename=image.path) }}"
+                                                    data-latest-feature-image-title="{{ image.title }}"
+                                                    data-latest-feature-image-caption="{{ image.caption }}"
+                                                >
+                                                    <div class="latest-feature-thumbnail-card h-100">
+                                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename=image.path) }}" alt="{{ image.alt }}">
+                                                        <div class="latest-feature-thumbnail-body">
+                                                            <div class="latest-feature-thumbnail-title">{{ image.label }}</div>
+                                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
+                                                        </div>
+                                                    </div>
+                                                </button>
+                                                {% endfor %}
+                                            </div>
+                                            {% endif %}
+                                            {% if feature.actions %}
+                                            <div class="d-flex flex-wrap gap-2 mt-auto pt-2">
+                                                {% for action in feature.actions %}
+                                                <a
+                                                    class="btn btn-outline-primary btn-sm"
+                                                    href="{% if action.href %}{{ action.href }}{% else %}{{ url_for(action.endpoint) }}{% if action.fragment %}#{{ action.fragment }}{% endif %}{% endif %}"
+                                                    {% if action.is_external %}target="_blank" rel="noopener noreferrer"{% endif %}
+                                                >
+                                                    <i class="bi {{ action.icon }} me-1"></i>{{ action.label }}
+                                                </a>
+                                                {% endfor %}
+                                            </div>
+                                            {% endif %}
+                                        </div>
+                                    </div>
+                                </div>
+                                {% endfor %}
+                            </div>
+                            <p class="text-muted small mb-0 mt-3">Visibility still comes from <strong>General &gt; User-Facing Latest Features</strong>, so admins can keep previous and archived release content available without promoting every item forever.</p>
+                        </div>
+                    </div>
+                </div>
+                {% endif %}
+                {% endfor %}
+            </div>
diff --git a/application/single_app/templates/admin/_panes/logging.html b/application/single_app/templates/admin/_panes/logging.html
new file mode 100644
index 000000000..a32454471
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/logging.html
@@ -0,0 +1,274 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'logging' %} show active{% endif %}" id="logging" role="tabpanel" aria-labelledby="logging-tab">
+                <p class="text-muted">
+                    Configure logging settings for monitoring, debugging, and auditing purposes. These settings control various types of logging throughout the application including application insights, debug messages, and file processing events.
+                </p>
+
+                <div class="card p-3 mb-3" id="application-insights-section">
+                    <h5>
+                        <i class="bi bi-graph-up me-2"></i>Application Insights Logging
+                    </h5>
+                    <p class="text-muted">Enable global logging to Application Insights for all agents and orchestration events.</p>
+                    <div class="form-check form-switch mb-3">
+                        <input class="form-check-input" type="checkbox" role="switch" id="enable_appinsights_global_logging" name="enable_appinsights_global_logging" {% if settings.enable_appinsights_global_logging %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_appinsights_global_logging">
+                            Enable Application Insights Global Logging
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Toggle to enable or disable global logging to Application Insights for all agents and orchestration events."></i>
+                    </div>
+                    <div class="alert alert-warning mt-3" role="alert">
+                        <strong>Note:</strong> Changing this setting requires an application restart to take effect.
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="debug-logging-section">
+                    <h5>
+                        <i class="bi bi-bug me-2"></i>Debug Logging
+                    </h5>
+                    <p class="text-muted">Control debug print statements across the application for development and troubleshooting.</p>
+                    <div class="form-check form-switch mb-3">
+                        <input class="form-check-input" type="checkbox" role="switch" id="enable_debug_logging" name="enable_debug_logging" {% if settings.enable_debug_logging %}checked{% endif %} onchange="toggleTimeControls('debug')">
+                        <label class="form-check-label ms-2" for="enable_debug_logging">
+                            Enable Debug Logging
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Toggle to enable or disable debug print statements across the application for troubleshooting and development."></i>
+                    </div>
+
+                    <!-- Time-based turnoff controls for Debug Logging -->
+                    <div id="debug-time-controls" class="mt-3" style="{% if not settings.enable_debug_logging %}display: none;{% endif %}">
+                        <div class="form-check form-switch mb-3">
+                            <input class="form-check-input" type="checkbox" role="switch" id="enable_debug_logging_timer" name="enable_debug_logging_timer" {% if settings.debug_logging_timer_enabled %}checked{% endif %} onchange="toggleTimerInputs('debug')">
+                            <label class="form-check-label ms-2" for="enable_debug_logging_timer">
+                                Enable Time-based Auto Turnoff
+                            </label>
+                            <i class="bi bi-clock ms-2" data-bs-toggle="tooltip" title="Automatically disable debug logging after a specified time period to manage cost and risk."></i>
+                        </div>
+
+                        <div id="debug-timer-inputs" class="row g-3" style="{% if not settings.debug_logging_timer_enabled %}display: none;{% endif %}">
+                            <div class="col-md-4">
+                                <label for="debug_timer_value" class="form-label">Duration</label>
+                                <input type="number" class="form-control" id="debug_timer_value" name="debug_timer_value" min="1" max="120" value="{{ settings.debug_timer_value or 1 }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="debug_timer_unit" class="form-label">Time Unit</label>
+                                <select class="form-select" id="debug_timer_unit" name="debug_timer_unit">
+                                    <option value="minutes" {% if settings.debug_timer_unit == 'minutes' %}selected{% endif %}>Minutes (1-120)</option>
+                                    <option value="hours" {% if settings.debug_timer_unit == 'hours' %}selected{% endif %}>Hours (1-24)</option>
+                                    <option value="days" {% if settings.debug_timer_unit == 'days' %}selected{% endif %}>Days (1-7)</option>
+                                    <option value="weeks" {% if settings.debug_timer_unit == 'weeks' %}selected{% endif %}>Weeks (1-52)</option>
+                                </select>
+                            </div>
+                            <div class="col-md-4">
+                                <label class="form-label">Will turn off at:</label>
+                                <div id="debug-turnoff-time" class="form-control-plaintext text-info fw-bold">
+                                    {% if settings.debug_logging_turnoff_time %}
+                                        {% if settings.debug_logging_turnoff_time is string %}
+                                            {{ settings.debug_logging_turnoff_time }}
+                                        {% else %}
+                                            {{ settings.debug_logging_turnoff_time.strftime('%Y-%m-%d %H:%M:%S') }}
+                                        {% endif %}
+                                    {% else %}
+                                        Will be calculated when saved
+                                    {% endif %}
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="alert alert-info mt-2" role="alert">
+                        <strong>Info:</strong> This controls all DEBUG print statements throughout the application. Useful for development and troubleshooting. Tokens and keys will be collected during this process.
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="file-processing-logs-section">
+                    <h5>
+                        <i class="bi bi-file-earmark-text me-2"></i>File Process Logging
+                    </h5>
+                    <p class="text-muted">Enable logging of file processing events for debugging and auditing purposes. Logs are stored in the file_processing container in Cosmos DB.</p>
+                    <div class="form-check form-switch mb-3">
+                        <input class="form-check-input" type="checkbox" role="switch" id="enable_file_processing_logs" name="enable_file_processing_logs" {% if settings.enable_file_processing_logs %}checked{% endif %} onchange="toggleTimeControls('file')">
+                        <label class="form-check-label ms-2" for="enable_file_processing_logs">
+                            Enable File Processing Logs
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Toggle to enable or disable logging of file processing events for debugging and auditing purposes."></i>
+                    </div>
+
+                    <!-- Time-based turnoff controls for File Processing Logs -->
+                    <div id="file-time-controls" class="mt-3" style="{% if not settings.enable_file_processing_logs %}display: none;{% endif %}">
+                        <div class="form-check form-switch mb-3">
+                            <input class="form-check-input" type="checkbox" role="switch" id="enable_file_processing_logs_timer" name="enable_file_processing_logs_timer" {% if settings.file_processing_logs_timer_enabled %}checked{% endif %} onchange="toggleTimerInputs('file')">
+                            <label class="form-check-label ms-2" for="enable_file_processing_logs_timer">
+                                Enable Time-based Auto Turnoff
+                            </label>
+                            <i class="bi bi-clock ms-2" data-bs-toggle="tooltip" title="Automatically disable file processing logs after a specified time period to manage cost and risk."></i>
+                        </div>
+
+                        <div id="file-timer-inputs" class="row g-3" style="{% if not settings.file_processing_logs_timer_enabled %}display: none;{% endif %}">
+                            <div class="col-md-4">
+                                <label for="file_timer_value" class="form-label">Duration</label>
+                                <input type="number" class="form-control" id="file_timer_value" name="file_timer_value" min="1" max="120" value="{{ settings.file_timer_value or 1 }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="file_timer_unit" class="form-label">Time Unit</label>
+                                <select class="form-select" id="file_timer_unit" name="file_timer_unit">
+                                    <option value="minutes" {% if settings.file_timer_unit == 'minutes' %}selected{% endif %}>Minutes (1-120)</option>
+                                    <option value="hours" {% if settings.file_timer_unit == 'hours' %}selected{% endif %}>Hours (1-24)</option>
+                                    <option value="days" {% if settings.file_timer_unit == 'days' %}selected{% endif %}>Days (1-7)</option>
+                                    <option value="weeks" {% if settings.file_timer_unit == 'weeks' %}selected{% endif %}>Weeks (1-52)</option>
+                                </select>
+                            </div>
+                            <div class="col-md-4">
+                                <label class="form-label">Will turn off at:</label>
+                                <div id="file-turnoff-time" class="form-control-plaintext text-info fw-bold">
+                                    {% if settings.file_processing_logs_turnoff_time %}
+                                        {% if settings.file_processing_logs_turnoff_time is string %}
+                                            {{ settings.file_processing_logs_turnoff_time }}
+                                        {% else %}
+                                            {{ settings.file_processing_logs_turnoff_time.strftime('%Y-%m-%d %H:%M:%S') }}
+                                        {% endif %}
+                                    {% else %}
+                                        Will be calculated when saved
+                                    {% endif %}
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <hr class="my-4" />
+                    <section aria-labelledby="file-processing-log-cleanup-heading" data-ignore-settings-change="true">
+                        <h6 id="file-processing-log-cleanup-heading">Delete stored logs</h6>
+                        <p class="text-muted small">
+                            Permanently remove file processing logs from Cosmos DB. One month is treated as 30 days.
+                        </p>
+                        <div class="row g-3 align-items-end">
+                            <div class="col-sm-4">
+                                <label for="file-processing-log-cleanup-age" class="form-label">Delete logs older than</label>
+                                <input
+                                    type="number"
+                                    class="form-control"
+                                    id="file-processing-log-cleanup-age"
+                                    min="1"
+                                    step="1"
+                                    value="30"
+                                    aria-describedby="file-processing-log-cleanup-age-feedback"
+                                />
+                                <div id="file-processing-log-cleanup-age-feedback" class="invalid-feedback">
+                                    Enter a whole number greater than zero.
+                                </div>
+                            </div>
+                            <div class="col-sm-3">
+                                <label for="file-processing-log-cleanup-unit" class="form-label">Age unit</label>
+                                <select class="form-select" id="file-processing-log-cleanup-unit">
+                                    <option value="days" selected>Days</option>
+                                    <option value="weeks">Weeks</option>
+                                    <option value="months">Months (30 days)</option>
+                                </select>
+                            </div>
+                            <div class="col-sm-5 d-flex flex-wrap gap-2">
+                                <button type="button" class="btn btn-outline-danger" id="delete-old-file-processing-logs-btn">
+                                    <i class="bi bi-trash me-1" aria-hidden="true"></i>Delete older logs
+                                </button>
+                                <button type="button" class="btn btn-danger" id="delete-all-file-processing-logs-btn">
+                                    <i class="bi bi-trash3 me-1" aria-hidden="true"></i>Delete all logs
+                                </button>
+                            </div>
+                        </div>
+                    </section>
+                </div>
+                <div class="card p-3 mb-3" id="health-check-section">
+                    <div class="d-flex justify-content-between align-items-center mb-2">
+                        <h5 class="mb-0">
+                            <i class="bi bi-heart-pulse me-2"></i>Health Check
+                        </h5>
+                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#healthCheckInfoModal">
+                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
+                        </button>
+                    </div>
+                    <p class="text-muted mb-3">Configure health check endpoint for external monitoring systems.</p>
+
+                    <div class="row g-3">
+                        <div class="col-lg-6">
+                            <div class="border rounded p-3 h-100 bg-body-tertiary-subtle">
+                                <div class="d-flex align-items-start justify-content-between gap-2">
+                                    <div>
+                                        <h6 class="mb-1">Authenticated Endpoint</h6>
+                                        <p class="text-muted small mb-0">Use when your monitoring system can reach a protected route and you want the endpoint governed by the normal app access boundary.</p>
+                                    </div>
+                                    <span class="badge text-bg-primary">Protected</span>
+                                </div>
+                                <div class="form-check form-switch mt-3 mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="enable_external_healthcheck"
+                                        name="enable_external_healthcheck"
+                                        {% if settings.enable_external_healthcheck %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="enable_external_healthcheck">
+                                        Enable /external/healthcheck
+                                    </label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the authenticated /external/healthcheck endpoint for external monitoring systems."></i>
+                                </div>
+                                <p class="text-muted small mb-0">Best for internal monitors or diagnostics tooling that already authenticates to the application.</p>
+                            </div>
+                        </div>
+                        <div class="col-lg-6">
+                            <div class="border rounded p-3 h-100 border-warning-subtle bg-warning-subtle">
+                                <div class="d-flex align-items-start justify-content-between gap-2">
+                                    <div>
+                                        <h6 class="mb-1">Unauthenticated Endpoint</h6>
+                                        <p class="text-muted small mb-0">Use when a platform health probe cannot sign in and only needs a lightweight availability response.</p>
+                                    </div>
+                                    <span class="badge text-bg-warning">No Auth</span>
+                                </div>
+                                <div class="form-check form-switch mt-3 mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="enable_no_auth_external_healthcheck"
+                                        name="enable_no_auth_external_healthcheck"
+                                        {% if settings.enable_no_auth_external_healthcheck %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="enable_no_auth_external_healthcheck">
+                                        Enable /external/healthcheckz
+                                    </label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the unauthenticated /external/healthcheckz endpoint for probes that cannot authenticate."></i>
+                                </div>
+                                <div class="alert alert-warning small mb-0" role="alert">
+                                    <strong>Security note:</strong> This route is intentionally unauthenticated. Only enable it for trusted health probes or controlled network paths.
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+                <div class="card p-3 mb-3" id="swagger-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0">
+                            <i class="bi bi-file-earmark-code me-2"></i>API Documentation
+                        </h5>
+                        <div class="btn-group" role="group">
+                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#swaggerInfoModal">
+                                <i class="bi bi-info-circle me-1"></i>Why Enable Swagger?
+                            </button>
+                            <a href="/swagger" class="btn btn-primary btn-sm" target="_blank">
+                                <i class="bi bi-box-arrow-up-right me-1"></i>Open Swagger UI
+                            </a>
+                        </div>
+                    </div>
+                    <p class="text-muted mb-3">Configure automatic OpenAPI/Swagger documentation for API endpoints.</p>
+
+                    <div class="form-check form-switch mb-2">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_swagger"
+                            name="enable_swagger"
+                            {% if settings.enable_swagger %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_swagger">
+                            Enable Swagger/OpenAPI Documentation (/swagger)
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable automatic API documentation with Swagger UI interface for testing and exploring endpoints."></i>
+                    </div>
+                    <p class="text-muted small mb-0">
+                        Provides interactive API documentation, endpoint testing, and schema validation.
+                        Useful for developers, API integration, and system troubleshooting.
+                    </p>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/mcp-governance.html b/application/single_app/templates/admin/_panes/mcp-governance.html
new file mode 100644
index 000000000..8a57389de
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/mcp-governance.html
@@ -0,0 +1,91 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'mcp-governance' %} show active{% endif %}" id="mcp-governance" role="tabpanel" aria-labelledby="mcp-governance-tab">
+                <div class="card p-3 mb-3" id="governance-mcp-destination-section">
+                    <h5>
+                        <i class="bi bi-diagram-3 me-2"></i>MCP Action Destination Governance
+                    </h5>
+                    <p class="text-muted mb-2">
+                        Restrict outbound remote MCP servers by destination pattern and scope. Destination policies reuse delegated item policies, so admins can allow all users, specific users, or workspace groups for each approved destination.
+                    </p>
+                    <div class="row g-3 align-items-start">
+                        <div class="col-lg-4">
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="enable_mcp_destination_governance" name="enable_mcp_destination_governance" {% if settings.enable_mcp_destination_governance %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="enable_mcp_destination_governance">Enforce MCP Destination Allowlist</label>
+                            </div>
+                            <div class="form-check form-switch mb-2">
+                                <input class="form-check-input" type="checkbox" role="switch" id="mcp_block_unsafe_destinations" name="mcp_block_unsafe_destinations" {% if settings.mcp_block_unsafe_destinations %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="mcp_block_unsafe_destinations">Block Private/Local Literal IP Destinations</label>
+                            </div>
+                            <div class="form-text">
+                                Save with the main Settings button. Unsafe literal-IP blocking can be enabled even before the allowlist is enforced.
+                            </div>
+                        </div>
+                        <div class="col-lg-5">
+                            <div class="small fw-semibold mb-1">Supported destination patterns</div>
+                            <ul class="small text-muted mb-0">
+                                <li><code>*</code> for any remote MCP destination after identity/auth checks.</li>
+                                <li><code>preconfiguration:microsoft_learn</code> or <code>preset:generic</code>.</li>
+                                <li><code>*.contoso.com</code>, <code>https://example.com/mcp*</code>, or <code>transport:streamable-http</code>.</li>
+                                <li><code>group:&lt;group-id&gt;::preconfiguration:github</code> for one group-specific override.</li>
+                            </ul>
+                        </div>
+                        <div class="col-lg-3">
+                            <div class="d-grid gap-2 governance-policy-action-list">
+                                <div class="input-group input-group-sm">
+                                    <button type="button" class="btn btn-outline-primary flex-grow-1 governance-new-mcp-destination-policy-btn" data-governance-mcp-destination-entity="mcp_personal_destination">New Personal Destination Policy</button>
+                                    <button type="button" class="btn btn-outline-info governance-policy-help-btn" data-governance-help-key="mcp_personal_destination" aria-label="About personal MCP destination policies" title="About personal MCP destination policies">
+                                        <i class="bi bi-info-circle" aria-hidden="true"></i>
+                                    </button>
+                                </div>
+                                <div class="input-group input-group-sm">
+                                    <button type="button" class="btn btn-outline-primary flex-grow-1 governance-new-mcp-destination-policy-btn" data-governance-mcp-destination-entity="mcp_group_destination">New Group Destination Policy</button>
+                                    <button type="button" class="btn btn-outline-info governance-policy-help-btn" data-governance-help-key="mcp_group_destination" aria-label="About group MCP destination policies" title="About group MCP destination policies">
+                                        <i class="bi bi-info-circle" aria-hidden="true"></i>
+                                    </button>
+                                </div>
+                                <div class="input-group input-group-sm">
+                                    <button type="button" class="btn btn-outline-primary flex-grow-1 governance-new-mcp-destination-policy-btn" data-governance-mcp-destination-entity="mcp_global_destination">New Global Destination Policy</button>
+                                    <button type="button" class="btn btn-outline-info governance-policy-help-btn" data-governance-help-key="mcp_global_destination" aria-label="About global MCP destination policies" title="About global MCP destination policies">
+                                        <i class="bi bi-info-circle" aria-hidden="true"></i>
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="governance-inbound-mcp-section">
+                    <h5>
+                        <i class="bi bi-box-arrow-in-down-right me-2"></i>Inbound MCP Source Governance
+                    </h5>
+                    <p class="text-muted mb-2">
+                        Control which delegated users and groups can use SimpleChat as an inbound MCP server through source-scoped policies.
+                    </p>
+                    <div class="alert alert-warning py-2 small" role="alert">
+                        Quick-create inbound MCP policies open in restricted user/group mode by default. Only use "Allow all users" when every delegated user with the required Entra role and delegated scope should be able to satisfy that policy.
+                    </div>
+                    <div class="row g-3 align-items-start">
+                        <div class="col-lg-7">
+                            <div class="small fw-semibold mb-1">Policy required for inbound MCP</div>
+                            <ul class="small text-muted mb-2">
+                                <li><code>inbound_mcp_source</code> with delegated item <code>*</code>: allows selected users or groups to use any accepted source ID.</li>
+                                <li><code>inbound_mcp_source</code> with a configured source ID: allows selected users or groups to use only requests with that source value.</li>
+                            </ul>
+                            <div class="small text-muted">
+                                Client, tenant, delegated scope, and Entra role checks remain in Inbound MCP configuration. The source ID comes from the configured header when present and is advisory unless a trusted gateway sets or validates it.
+                            </div>
+                        </div>
+                        <div class="col-lg-5">
+                            <div class="d-grid gap-2 governance-policy-action-list">
+                                <div class="input-group input-group-sm">
+                                    <button type="button" class="btn btn-outline-primary flex-grow-1 governance-new-inbound-mcp-policy-btn" data-governance-inbound-mcp-entity="inbound_mcp_source">New Inbound MCP Source Access Policy</button>
+                                    <button type="button" class="btn btn-outline-info governance-policy-help-btn" data-governance-help-key="inbound_mcp_source" aria-label="About inbound MCP source policies" title="About inbound MCP source policies">
+                                        <i class="bi bi-info-circle" aria-hidden="true"></i>
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/migrate.html b/application/single_app/templates/admin/_panes/migrate.html
new file mode 100644
index 000000000..ad6290a15
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/migrate.html
@@ -0,0 +1,578 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'migrate' %} show active{% endif %}" id="migrate" role="tabpanel" aria-labelledby="migrate-tab" data-testid="migrate-tab-pane" data-ignore-settings-change="true">
+                <section class="card p-0 mb-4 shadow-sm migration-workflow" id="data-management-migration-section" aria-labelledby="data-management-migration-title">
+                    <header class="migration-workflow-header">
+                        <div>
+                            <h4 class="mb-1" id="data-management-migration-title">
+                                <i class="bi bi-arrow-left-right me-2" aria-hidden="true"></i>Migration
+                            </h4>
+                            <p class="mb-0">Move SimpleChat data through a reviewed, recoverable environment transfer.</p>
+                        </div>
+                        <div class="migration-workflow-readiness" id="data-management-migration-readiness" role="status" aria-live="polite">
+                            <span class="migration-readiness-dot" aria-hidden="true"></span>
+                            <span>Not reviewed</span>
+                        </div>
+                    </header>
+
+                    <div class="migration-workflow-body" id="data-management-migration-workflow-section">
+                        <nav class="migration-stepper" aria-label="Migration workflow">
+                            <button type="button" class="migration-step is-active" data-migration-step-button="target" aria-current="step">
+                                <span class="migration-step-marker">1</span>
+                                <span class="migration-step-copy">
+                                    <span class="migration-step-label">Target</span>
+                                    <span class="migration-step-state">Configure services</span>
+                                </span>
+                            </button>
+                            <button type="button" class="migration-step" data-migration-step-button="scope">
+                                <span class="migration-step-marker">2</span>
+                                <span class="migration-step-copy">
+                                    <span class="migration-step-label">Scope</span>
+                                    <span class="migration-step-state">Choose principals</span>
+                                </span>
+                            </button>
+                            <button type="button" class="migration-step" data-migration-step-button="options">
+                                <span class="migration-step-marker">3</span>
+                                <span class="migration-step-copy">
+                                    <span class="migration-step-label">What Moves</span>
+                                    <span class="migration-step-state">Choose behavior</span>
+                                </span>
+                            </button>
+                            <button type="button" class="migration-step" data-migration-step-button="review">
+                                <span class="migration-step-marker">4</span>
+                                <span class="migration-step-copy">
+                                    <span class="migration-step-label">Review</span>
+                                    <span class="migration-step-state">Run preflight</span>
+                                </span>
+                            </button>
+                            <button type="button" class="migration-step" data-migration-step-button="confirm">
+                                <span class="migration-step-marker">5</span>
+                                <span class="migration-step-copy">
+                                    <span class="migration-step-label">Confirm</span>
+                                    <span class="migration-step-state">Authorize execution</span>
+                                </span>
+                            </button>
+                            <button type="button" class="migration-step" data-migration-step-button="progress">
+                                <span class="migration-step-marker">6</span>
+                                <span class="migration-step-copy">
+                                    <span class="migration-step-label">Progress</span>
+                                    <span class="migration-step-state">Operate the job</span>
+                                </span>
+                            </button>
+                        </nav>
+
+                        <div class="alert alert-danger d-none mt-3 mb-0" id="data-management-migration-step-error" role="alert" tabindex="-1"></div>
+
+                        <!-- Target Step -->
+                        <section class="migration-stage" data-migration-step-panel="target" aria-labelledby="data-management-migration-target-heading">
+                            <div class="migration-stage-heading">
+                                <div>
+                                    <h5 id="data-management-migration-target-heading">Connect the destination</h5>
+                                    <p>Configure the services this migration will write to. Stored credentials remain redacted.</p>
+                                </div>
+                                <span class="badge text-bg-light border">Destination database: SimpleChat</span>
+                            </div>
+
+                            <div class="migration-target-grid">
+                                <section class="migration-service-panel" id="data-management-target-cosmos-section" aria-labelledby="data-management-target-cosmos-heading">
+                                    <div class="migration-service-heading">
+                                        <div>
+                                            <h6 id="data-management-target-cosmos-heading"><i class="bi bi-database me-2" aria-hidden="true"></i>Target Cosmos Database</h6>
+                                            <p>Required for every migration.</p>
+                                        </div>
+                                        <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-test-target-cosmos-btn">
+                                            <i class="bi bi-plug me-1" aria-hidden="true"></i>Test Cosmos
+                                        </button>
+                                    </div>
+                                    <div class="alert alert-info small" role="note">
+                                        Managed identity requires Cosmos DB Data Contributor and target network access.
+                                    </div>
+                                    <div class="row g-3">
+                                        <div class="col-md-4">
+                                            <label class="form-label" for="data_management_target_cosmos_auth">Authentication</label>
+                                            <select class="form-select" id="data_management_target_cosmos_auth">
+                                                <option value="managed_identity">Managed identity</option>
+                                                <option value="key">Account key</option>
+                                            </select>
+                                        </div>
+                                        <div class="col-md-5">
+                                            <label class="form-label" for="data_management_target_cosmos_endpoint">Endpoint</label>
+                                            <input class="form-control" type="url" id="data_management_target_cosmos_endpoint" placeholder="https://account.documents.azure.com:443/" autocomplete="off">
+                                        </div>
+                                        <div class="col-md-3">
+                                            <label class="form-label" for="data_management_target_cosmos_database">Database</label>
+                                            <input class="form-control" type="text" id="data_management_target_cosmos_database" value="SimpleChat" readonly aria-readonly="true" aria-describedby="data-management-target-cosmos-database-help">
+                                            <div class="form-text" id="data-management-target-cosmos-database-help">Fixed app contract.</div>
+                                        </div>
+                                    </div>
+                                    <div class="mt-3" id="data-management-target-cosmos-key-field">
+                                        <label class="form-label" for="data_management_target_cosmos_key">Account key</label>
+                                        <input class="form-control" type="password" id="data_management_target_cosmos_key" autocomplete="off" placeholder="Stored keys stay redacted after save">
+                                    </div>
+                                </section>
+
+                                <section class="migration-service-panel" id="data-management-target-ai-search-section" aria-labelledby="data-management-target-search-heading">
+                                    <div class="migration-service-heading">
+                                        <div>
+                                            <h6 id="data-management-target-search-heading"><i class="bi bi-search me-2" aria-hidden="true"></i>Target Search</h6>
+                                            <p>Required when AI Search documents are included.</p>
+                                        </div>
+                                        <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-test-target-search-btn">
+                                            <i class="bi bi-plug me-1" aria-hidden="true"></i>Test Search
+                                        </button>
+                                    </div>
+                                    <div class="row g-3">
+                                        <div class="col-md-4">
+                                            <label class="form-label" for="data_management_target_ai_search_auth">Authentication</label>
+                                            <select class="form-select" id="data_management_target_ai_search_auth">
+                                                <option value="managed_identity">Managed identity</option>
+                                                <option value="key">Admin key</option>
+                                            </select>
+                                        </div>
+                                        <div class="col-md-5">
+                                            <label class="form-label" for="data_management_target_ai_search_endpoint">Endpoint</label>
+                                            <input class="form-control" type="url" id="data_management_target_ai_search_endpoint" placeholder="https://search-service.search.windows.net" autocomplete="off">
+                                        </div>
+                                        <div class="col-md-3" id="data-management-target-ai-search-key-field">
+                                            <label class="form-label" for="data_management_target_ai_search_key">Admin key</label>
+                                            <input class="form-control" type="password" id="data_management_target_ai_search_key" autocomplete="off" placeholder="Stored keys stay redacted after save">
+                                        </div>
+                                    </div>
+                                </section>
+
+                                <section class="migration-service-panel" id="data-management-target-enhanced-citations-section" aria-labelledby="data-management-target-storage-heading">
+                                    <div class="migration-service-heading">
+                                        <div>
+                                            <h6 id="data-management-target-storage-heading"><i class="bi bi-file-earmark-lock me-2" aria-hidden="true"></i>Target Enhanced Citation Storage</h6>
+                                            <p>Required only when source document blobs are included.</p>
+                                        </div>
+                                        <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-test-target-ec-storage-btn">
+                                            <i class="bi bi-plug me-1" aria-hidden="true"></i>Test Storage
+                                        </button>
+                                    </div>
+                                    <div class="row g-3">
+                                        <div class="col-md-4">
+                                            <label class="form-label" for="data_management_target_ec_storage_auth">Authentication</label>
+                                            <select class="form-select" id="data_management_target_ec_storage_auth">
+                                                <option value="managed_identity">Managed identity</option>
+                                                <option value="connection_string">Connection string</option>
+                                            </select>
+                                        </div>
+                                        <div class="col-md-5" id="data-management-target-ec-blob-endpoint-field">
+                                            <label class="form-label" for="data_management_target_ec_blob_endpoint">Blob endpoint</label>
+                                            <input class="form-control" type="url" id="data_management_target_ec_blob_endpoint" placeholder="https://account.blob.core.windows.net" autocomplete="off">
+                                        </div>
+                                        <div class="col-md-8" id="data-management-target-ec-connection-string-field">
+                                            <label class="form-label" for="data_management_target_ec_connection_string">Connection string</label>
+                                            <input class="form-control" type="password" id="data_management_target_ec_connection_string" autocomplete="off" placeholder="Paste a connection string to save or replace it">
+                                        </div>
+                                    </div>
+                                </section>
+                            </div>
+                        </section>
+
+                        <!-- Scope Step -->
+                        <section class="migration-stage d-none" data-migration-step-panel="scope" aria-labelledby="data-management-migration-scope-heading">
+                            <div class="migration-stage-heading">
+                                <div>
+                                    <h5 id="data-management-migration-scope-heading">Choose who and what moves</h5>
+                                    <p>Selections persist while you search and page. “All” always uses the exhaustive server count.</p>
+                                </div>
+                                <div class="migration-scope-total" id="data-management-migration-scope-total" aria-live="polite">0 principal scopes selected</div>
+                            </div>
+
+                            <div class="migration-scope-tabs" role="tablist" aria-label="Migration scope type">
+                                <button type="button" class="btn btn-outline-primary active" data-migration-scope-tab="users" role="tab" aria-selected="true">Users <span class="badge text-bg-light ms-1" data-migration-scope-count="users">0</span></button>
+                                <button type="button" class="btn btn-outline-primary" data-migration-scope-tab="groups" role="tab" aria-selected="false">Groups <span class="badge text-bg-light ms-1" data-migration-scope-count="groups">0</span></button>
+                                <button type="button" class="btn btn-outline-primary" data-migration-scope-tab="public_workspaces" role="tab" aria-selected="false">Public workspaces <span class="badge text-bg-light ms-1" data-migration-scope-count="public_workspaces">0</span></button>
+                            </div>
+
+                            <section class="migration-scope-pane" data-migration-scope-pane="users" role="tabpanel" aria-label="Users">
+                                <input type="hidden" id="data_management_migration_users_mode" value="none">
+                                <fieldset>
+                                    <legend class="h6">Migration mode</legend>
+                                    <div class="migration-mode-options">
+                                        <label class="migration-mode-option">
+                                            <input type="radio" name="data_management_migration_users_mode_choice" value="none" data-migration-mode-option="users" checked>
+                                            <span><strong>None</strong><small>Skip users</small></span>
+                                        </label>
+                                        <label class="migration-mode-option">
+                                            <input type="radio" name="data_management_migration_users_mode_choice" value="selected" data-migration-mode-option="users">
+                                            <span><strong>Selected</strong><small>Choose across pages</small></span>
+                                        </label>
+                                        <label class="migration-mode-option">
+                                            <input type="radio" name="data_management_migration_users_mode_choice" value="all" data-migration-mode-option="users">
+                                            <span><strong>All</strong><small>Use exhaustive count</small></span>
+                                        </label>
+                                    </div>
+                                </fieldset>
+
+                                <div class="migration-catalog-workspace d-none" data-migration-catalog-workspace="users">
+                                    <div class="migration-catalog-column">
+                                        <div class="d-flex flex-wrap justify-content-between align-items-end gap-2 mb-2">
+                                            <div>
+                                                <h6 class="mb-1">Available users</h6>
+                                                <p class="small text-muted mb-0" data-migration-catalog-status="users">Search the server catalog.</p>
+                                            </div>
+                                            <div class="input-group input-group-sm migration-catalog-search">
+                                                <label class="visually-hidden" for="data_management_migration_users_search">Search users</label>
+                                                <input type="search" class="form-control" id="data_management_migration_users_search" placeholder="Search users" autocomplete="off">
+                                                <button type="button" class="btn btn-outline-secondary" id="data-management-search-users-btn">Search</button>
+                                            </div>
+                                        </div>
+                                        <div class="migration-catalog-list list-group" id="data-management-migration-users-available" aria-live="polite"></div>
+                                        <div class="migration-catalog-pagination">
+                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-previous="users" disabled>
+                                                <i class="bi bi-chevron-left me-1" aria-hidden="true"></i>Previous
+                                            </button>
+                                            <span class="small text-muted" data-migration-page-status="users">Page 1</span>
+                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-next="users" disabled>
+                                                Next<i class="bi bi-chevron-right ms-1" aria-hidden="true"></i>
+                                            </button>
+                                        </div>
+                                    </div>
+                                    <aside class="migration-selection-column" aria-label="Selected users">
+                                        <div class="d-flex justify-content-between align-items-center mb-2">
+                                            <h6 class="mb-0">Selected</h6>
+                                            <span class="badge text-bg-primary" data-migration-selected-count="users">0</span>
+                                        </div>
+                                        <div class="migration-selected-list list-group" id="data-management-migration-users-selected"></div>
+                                    </aside>
+                                </div>
+
+                                <div class="migration-all-summary d-none" data-migration-all-summary="users" role="status">
+                                    <i class="bi bi-collection-fill" aria-hidden="true"></i>
+                                    <div>
+                                        <strong data-migration-all-count="users">Loading exhaustive count…</strong>
+                                        <span>Every current user record will be resolved by the server when the job starts.</span>
+                                    </div>
+                                </div>
+
+                                <div class="form-check form-switch mt-3">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_users_documents" disabled>
+                                    <label class="form-check-label" for="data_management_migration_users_documents">Include users' documents</label>
+                                </div>
+                            </section>
+
+                            <section class="migration-scope-pane d-none" data-migration-scope-pane="groups" role="tabpanel" aria-label="Groups">
+                                <input type="hidden" id="data_management_migration_groups_mode" value="none">
+                                <fieldset>
+                                    <legend class="h6">Migration mode</legend>
+                                    <div class="migration-mode-options">
+                                        <label class="migration-mode-option">
+                                            <input type="radio" name="data_management_migration_groups_mode_choice" value="none" data-migration-mode-option="groups" checked>
+                                            <span><strong>None</strong><small>Skip groups</small></span>
+                                        </label>
+                                        <label class="migration-mode-option">
+                                            <input type="radio" name="data_management_migration_groups_mode_choice" value="selected" data-migration-mode-option="groups">
+                                            <span><strong>Selected</strong><small>Choose across pages</small></span>
+                                        </label>
+                                        <label class="migration-mode-option">
+                                            <input type="radio" name="data_management_migration_groups_mode_choice" value="all" data-migration-mode-option="groups">
+                                            <span><strong>All</strong><small>Use exhaustive count</small></span>
+                                        </label>
+                                    </div>
+                                </fieldset>
+                                <div class="migration-catalog-workspace d-none" data-migration-catalog-workspace="groups">
+                                    <div class="migration-catalog-column">
+                                        <div class="d-flex flex-wrap justify-content-between align-items-end gap-2 mb-2">
+                                            <div>
+                                                <h6 class="mb-1">Available groups</h6>
+                                                <p class="small text-muted mb-0" data-migration-catalog-status="groups">Search the server catalog.</p>
+                                            </div>
+                                            <div class="input-group input-group-sm migration-catalog-search">
+                                                <label class="visually-hidden" for="data_management_migration_groups_search">Search groups</label>
+                                                <input type="search" class="form-control" id="data_management_migration_groups_search" placeholder="Search groups" autocomplete="off">
+                                                <button type="button" class="btn btn-outline-secondary" id="data-management-search-groups-btn">Search</button>
+                                            </div>
+                                        </div>
+                                        <div class="migration-catalog-list list-group" id="data-management-migration-groups-available" aria-live="polite"></div>
+                                        <div class="migration-catalog-pagination">
+                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-previous="groups" disabled><i class="bi bi-chevron-left me-1" aria-hidden="true"></i>Previous</button>
+                                            <span class="small text-muted" data-migration-page-status="groups">Page 1</span>
+                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-next="groups" disabled>Next<i class="bi bi-chevron-right ms-1" aria-hidden="true"></i></button>
+                                        </div>
+                                    </div>
+                                    <aside class="migration-selection-column" aria-label="Selected groups">
+                                        <div class="d-flex justify-content-between align-items-center mb-2">
+                                            <h6 class="mb-0">Selected</h6>
+                                            <span class="badge text-bg-primary" data-migration-selected-count="groups">0</span>
+                                        </div>
+                                        <div class="migration-selected-list list-group" id="data-management-migration-groups-selected"></div>
+                                    </aside>
+                                </div>
+                                <div class="migration-all-summary d-none" data-migration-all-summary="groups" role="status">
+                                    <i class="bi bi-collection-fill" aria-hidden="true"></i>
+                                    <div>
+                                        <strong data-migration-all-count="groups">Loading exhaustive count…</strong>
+                                        <span>Every current group record will be resolved by the server when the job starts.</span>
+                                    </div>
+                                </div>
+                                <div class="form-check form-switch mt-3">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_groups_documents" disabled>
+                                    <label class="form-check-label" for="data_management_migration_groups_documents">Include group documents</label>
+                                </div>
+                            </section>
+
+                            <section class="migration-scope-pane d-none" data-migration-scope-pane="public_workspaces" role="tabpanel" aria-label="Public Workspaces">
+                                <input type="hidden" id="data_management_migration_public_workspaces_mode" value="none">
+                                <fieldset>
+                                    <legend class="h6">Migration mode</legend>
+                                    <div class="migration-mode-options">
+                                        <label class="migration-mode-option">
+                                            <input type="radio" name="data_management_migration_public_workspaces_mode_choice" value="none" data-migration-mode-option="public_workspaces" checked>
+                                            <span><strong>None</strong><small>Skip public workspaces</small></span>
+                                        </label>
+                                        <label class="migration-mode-option">
+                                            <input type="radio" name="data_management_migration_public_workspaces_mode_choice" value="selected" data-migration-mode-option="public_workspaces">
+                                            <span><strong>Selected</strong><small>Choose across pages</small></span>
+                                        </label>
+                                        <label class="migration-mode-option">
+                                            <input type="radio" name="data_management_migration_public_workspaces_mode_choice" value="all" data-migration-mode-option="public_workspaces">
+                                            <span><strong>All</strong><small>Use exhaustive count</small></span>
+                                        </label>
+                                    </div>
+                                </fieldset>
+                                <div class="migration-catalog-workspace d-none" data-migration-catalog-workspace="public_workspaces">
+                                    <div class="migration-catalog-column">
+                                        <div class="d-flex flex-wrap justify-content-between align-items-end gap-2 mb-2">
+                                            <div>
+                                                <h6 class="mb-1">Available public workspaces</h6>
+                                                <p class="small text-muted mb-0" data-migration-catalog-status="public_workspaces">Search the server catalog.</p>
+                                            </div>
+                                            <div class="input-group input-group-sm migration-catalog-search">
+                                                <label class="visually-hidden" for="data_management_migration_public_workspaces_search">Search public workspaces</label>
+                                                <input type="search" class="form-control" id="data_management_migration_public_workspaces_search" placeholder="Search public workspaces" autocomplete="off">
+                                                <button type="button" class="btn btn-outline-secondary" id="data-management-search-public-workspaces-btn">Search</button>
+                                            </div>
+                                        </div>
+                                        <div class="migration-catalog-list list-group" id="data-management-migration-public-workspaces-available" aria-live="polite"></div>
+                                        <div class="migration-catalog-pagination">
+                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-previous="public_workspaces" disabled><i class="bi bi-chevron-left me-1" aria-hidden="true"></i>Previous</button>
+                                            <span class="small text-muted" data-migration-page-status="public_workspaces">Page 1</span>
+                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-next="public_workspaces" disabled>Next<i class="bi bi-chevron-right ms-1" aria-hidden="true"></i></button>
+                                        </div>
+                                    </div>
+                                    <aside class="migration-selection-column" aria-label="Selected public workspaces">
+                                        <div class="d-flex justify-content-between align-items-center mb-2">
+                                            <h6 class="mb-0">Selected</h6>
+                                            <span class="badge text-bg-primary" data-migration-selected-count="public_workspaces">0</span>
+                                        </div>
+                                        <div class="migration-selected-list list-group" id="data-management-migration-public-workspaces-selected"></div>
+                                    </aside>
+                                </div>
+                                <div class="migration-all-summary d-none" data-migration-all-summary="public_workspaces" role="status">
+                                    <i class="bi bi-collection-fill" aria-hidden="true"></i>
+                                    <div>
+                                        <strong data-migration-all-count="public_workspaces">Loading exhaustive count…</strong>
+                                        <span>Every current public workspace record will be resolved by the server when the job starts.</span>
+                                    </div>
+                                </div>
+                                <div class="form-check form-switch mt-3">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_public_workspaces_documents" disabled>
+                                    <label class="form-check-label" for="data_management_migration_public_workspaces_documents">Include public workspace documents</label>
+                                </div>
+                            </section>
+                        </section>
+
+                        <!-- Content and Options Step -->
+                        <section class="migration-stage d-none" data-migration-step-panel="options" aria-labelledby="data-management-migration-options-heading">
+                            <div class="migration-stage-heading">
+                                <div>
+                                    <h5 id="data-management-migration-options-heading">Choose what happens at the destination</h5>
+                                    <p>Choose whether to copy only missing items, catch up changes, or make migrated destination data match the source.</p>
+                                </div>
+                            </div>
+
+                            <fieldset class="migration-option-section" id="data-management-migration-mode-section">
+                                <legend>Destination behavior</legend>
+                                <div class="btn-group flex-wrap" role="radiogroup" aria-label="Migration destination behavior">
+                                    <input class="btn-check" type="radio" name="data_management_migration_mode" id="data_management_migration_mode_new_only" value="new_only" checked>
+                                    <label class="btn btn-outline-primary" for="data_management_migration_mode_new_only">Copy missing items only</label>
+                                    <input class="btn-check" type="radio" name="data_management_migration_mode" id="data_management_migration_mode_delta_upsert" value="delta_upsert">
+                                    <label class="btn btn-outline-primary" for="data_management_migration_mode_delta_upsert">Catch up changed items</label>
+                                    <input class="btn-check" type="radio" name="data_management_migration_mode" id="data_management_migration_mode_mirror_with_deletions" value="mirror_with_deletions">
+                                    <label class="btn btn-outline-danger" for="data_management_migration_mode_mirror_with_deletions">Make destination match source</label>
+                                </div>
+                                <p class="text-muted small mt-2 mb-0" id="data-management-migration-mode-description" aria-live="polite">
+                                    Copies source items that are absent from the destination. Existing destination data is never updated or deleted.
+                                </p>
+                                <div class="row g-3 mt-1 d-none" id="data-management-migration-baseline-field">
+                                    <div class="col-lg-7">
+                                        <label class="form-label" for="data_management_migration_baseline_job_id">Previous completed migration job ID</label>
+                                        <input class="form-control" type="text" id="data_management_migration_baseline_job_id" autocomplete="off" placeholder="Leave blank to use the latest compatible completed migration">
+                                        <div class="form-text">Leave blank to let SimpleChat choose the latest compatible completed migration as the starting point for this catch-up run.</div>
+                                    </div>
+                                </div>
+                            </fieldset>
+
+                            <fieldset class="migration-option-section">
+                                <legend>Data surfaces</legend>
+                                <div class="row g-3">
+                                    <div class="col-lg-6">
+                                        <div class="form-check form-switch">
+                                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_include_ai_search" checked>
+                                            <label class="form-check-label" for="data_management_migration_include_ai_search">Migrate matching AI Search documents</label>
+                                        </div>
+                                        <div class="form-check mt-3" id="data-management-migration-search-write-freeze">
+                                            <input class="form-check-input" type="checkbox" id="data_management_migration_target_search_writes_frozen">
+                                            <label class="form-check-label" for="data_management_migration_target_search_writes_frozen">I confirm external destination AI Search writers are frozen</label>
+                                            <div class="form-text">SimpleChat pauses its own target indexing. Freeze other writers before review.</div>
+                                        </div>
+                                    </div>
+                                    <div class="col-lg-6">
+                                        <div class="form-check form-switch">
+                                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_include_source_blobs">
+                                            <label class="form-check-label" for="data_management_migration_include_source_blobs">Migrate selected source document blobs</label>
+                                            <div class="form-text">Requires Enhanced Citation storage at both source and destination.</div>
+                                        </div>
+                                    </div>
+                                </div>
+                            </fieldset>
+
+                            <fieldset class="migration-option-section" id="data-management-migration-performance-section">
+                                <legend>Performance and resume</legend>
+                                <p class="text-muted small">Migration uses durable resource checkpoints and retains the same migration ID after Retry or Resume.</p>
+                                <div class="row g-3">
+                                    <div class="col-md-4">
+                                        <label class="form-label" for="data_management_migration_max_parallel_operations">Concurrent operations</label>
+                                        <input class="form-control" type="number" id="data_management_migration_max_parallel_operations" min="1" max="32" value="8">
+                                    </div>
+                                    <div class="col-md-4">
+                                        <label class="form-label" for="data_management_migration_retry_count">Retry attempts</label>
+                                        <input class="form-control" type="number" id="data_management_migration_retry_count" min="1" max="10" value="5">
+                                    </div>
+                                    <div class="col-md-4">
+                                        <label class="form-label" for="data_management_migration_skip_recent_within_hours">Skip prior successes within hours</label>
+                                        <input class="form-control" type="number" id="data_management_migration_skip_recent_within_hours" min="0" max="8760" value="0">
+                                    </div>
+                                </div>
+                                <div class="form-check form-switch mt-3">
+                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_temporary_destination_ru_enabled">
+                                    <label class="form-check-label" for="data_management_migration_temporary_destination_ru_enabled">Enable destination RU Boost for this migration</label>
+                                    <button type="button" class="btn btn-outline-info btn-sm ms-2" data-bs-toggle="modal" data-bs-target="#data-management-ru-boost-guide-modal">
+                                        <i class="bi bi-info-circle me-1"></i>What permissions are needed?
+                                    </button>
+                                </div>
+                                <div class="row g-3 mt-1" id="data-management-migration-temporary-ru-field">
+                                    <div class="col-md-3">
+                                        <label class="form-label" for="data_management_migration_temporary_destination_ru">Destination RU Boost target</label>
+                                        <input class="form-control" type="number" id="data_management_migration_temporary_destination_ru" min="1000" max="10000" step="1000" value="10000">
+                                    </div>
+                                    <div class="col-md-3">
+                                        <label class="form-label" for="data_management_target_cosmos_subscription_id">Subscription ID</label>
+                                        <input class="form-control" type="text" id="data_management_target_cosmos_subscription_id" autocomplete="off" placeholder="Required for RU Boost">
+                                    </div>
+                                    <div class="col-md-3">
+                                        <label class="form-label" for="data_management_target_cosmos_resource_group">Resource group</label>
+                                        <input class="form-control" type="text" id="data_management_target_cosmos_resource_group" autocomplete="off" placeholder="Required for RU Boost">
+                                    </div>
+                                    <div class="col-md-3 d-flex align-items-end">
+                                        <button type="button" class="btn btn-outline-secondary w-100" id="data-management-test-target-cosmos-ru-boost-btn">
+                                            <i class="bi bi-speedometer me-1" aria-hidden="true"></i>Test RU Boost
+                                        </button>
+                                    </div>
+                                    <div class="col-12">
+                                        <div class="form-text">RU Boost validates Azure management-plane throughput permissions separately from Cosmos data-copy access. Eligible capacity is raised only up to 10,000 RU/s during execution and restored after completion or failure.</div>
+                                    </div>
+                                </div>
+                            </fieldset>
+                        </section>
+
+                        <!-- Review Step -->
+                        <section class="migration-stage d-none" data-migration-step-panel="review" aria-labelledby="data-management-migration-review-heading">
+                            <div class="migration-stage-heading">
+                                <div>
+                                    <h5 id="data-management-migration-review-heading">Prove the plan is ready</h5>
+                                    <p>Preflight runs server-owned access probes and inventory. Any earlier change makes this review stale.</p>
+                                </div>
+                                <div class="d-flex flex-wrap gap-2">
+                                    <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-test-migration-access-btn">
+                                        <i class="bi bi-shield-check me-1" aria-hidden="true"></i>Validate Cosmos Access
+                                    </button>
+                                    <button type="button" class="btn btn-primary" id="data-management-migration-preview-btn">
+                                        <i class="bi bi-clipboard2-check me-1" aria-hidden="true"></i>Run Preflight Review
+                                    </button>
+                                </div>
+                            </div>
+                            <div class="migration-review-empty" id="data-management-migration-review-empty">
+                                <i class="bi bi-clipboard2-pulse" aria-hidden="true"></i>
+                                <div>
+                                    <strong>Review has not run.</strong>
+                                    <span>Run preflight to verify target access, counts, collisions, locks, and capacity policy.</span>
+                                </div>
+                            </div>
+                            <div class="d-none" id="data-management-migration-summary" aria-live="polite"></div>
+                            <div class="d-none" id="data-management-migration-review-checks"></div>
+                            <button type="button" class="btn btn-link btn-sm px-0 mt-3 d-none" id="data-management-refresh-migration-summary-btn">
+                                <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh review
+                            </button>
+                        </section>
+
+                        <!-- Confirm Step -->
+                        <section class="migration-stage d-none" data-migration-step-panel="confirm" aria-labelledby="data-management-migration-confirm-heading">
+                            <div class="migration-stage-heading">
+                                <div>
+                                    <h5 id="data-management-migration-confirm-heading">Confirm execution</h5>
+                                    <p>Review the final server-normalized plan. Submission is guarded against duplicate requests.</p>
+                                </div>
+                            </div>
+                            <div class="migration-confirm-summary" id="data-management-migration-confirm-summary">
+                                <p class="text-muted mb-0">Complete preflight review before confirmation.</p>
+                            </div>
+                            <div class="alert alert-danger mt-3 mb-0 d-none" id="data-management-migration-mirror-confirmation" role="alert">
+                                <strong>Destructive destination cleanup.</strong> Only destination items previously created by SimpleChat migration may be deleted. Unowned destination data is retained and reported as a conflict.
+                                <label class="form-label mt-3" for="data_management_migration_mirror_confirmation_phrase">Type <code>MAKE DESTINATION MATCH SOURCE</code> to authorize this run</label>
+                                <input class="form-control" type="text" id="data_management_migration_mirror_confirmation_phrase" autocomplete="off">
+                            </div>
+                            <div class="form-check mt-3">
+                                <input class="form-check-input" type="checkbox" id="data_management_migration_final_confirmation">
+                                <label class="form-check-label" for="data_management_migration_final_confirmation">I reviewed the normalized plan, destination checks, warnings, and operational impact.</label>
+                            </div>
+                            <button type="button" class="btn btn-warning mt-3" id="data-management-execute-migration-btn" disabled aria-disabled="true">
+                                <i class="bi bi-arrow-left-right me-1" aria-hidden="true"></i>Execute Migration
+                            </button>
+                        </section>
+
+                        <!-- Progress Step -->
+                        <section class="migration-stage d-none" data-migration-step-panel="progress" aria-labelledby="data-management-migration-progress-heading">
+                            <div class="migration-stage-heading">
+                                <div>
+                                    <h5 id="data-management-migration-progress-heading">Operate the migration</h5>
+                                    <p>Progress comes from the durable job record. Cancel, Retry, and Resume retain verified checkpoints.</p>
+                                </div>
+                                <div class="d-flex flex-wrap gap-2">
+                                    <button type="button" class="btn btn-outline-primary btn-sm d-none" id="data-management-migration-start-new-btn">
+                                        <i class="bi bi-plus-circle me-1" aria-hidden="true"></i>Start new migration
+                                    </button>
+                                    <button type="button" class="btn btn-outline-secondary btn-sm d-none" id="data-management-migration-view-job-btn">
+                                        <i class="bi bi-list-check me-1" aria-hidden="true"></i>View full job log
+                                    </button>
+                                </div>
+                            </div>
+                            <div class="migration-progress-empty" id="data-management-migration-progress-empty">
+                                <i class="bi bi-hourglass-split" aria-hidden="true"></i>
+                                <div>
+                                    <strong>No migration is attached to this workflow yet.</strong>
+                                    <span>After execution, this stage follows the queued job and exposes its recovery actions.</span>
+                                </div>
+                            </div>
+                            <div class="d-none" id="data-management-migration-workflow-progress">
+                                <div id="data-management-migration-workflow-progress-summary"></div>
+                                <div id="data-management-migration-workflow-progress-state"></div>
+                                <div class="d-flex flex-wrap gap-2 mt-3" id="data-management-migration-workflow-progress-actions"></div>
+                            </div>
+                        </section>
+
+                        <footer class="migration-workflow-footer">
+                            <div>
+                                <button type="button" class="btn btn-outline-secondary" id="data-management-migration-back-btn" disabled>
+                                    <i class="bi bi-arrow-left me-1" aria-hidden="true"></i>Back
+                                </button>
+                                <button type="button" class="btn btn-primary" id="data-management-migration-next-btn">
+                                    Continue to Scope<i class="bi bi-arrow-right ms-1" aria-hidden="true"></i>
+                                </button>
+                            </div>
+                            <span class="small text-muted" id="data-management-migration-step-position">Step 1 of 6</span>
+                        </footer>
+                    </div>
+                </section>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/model-endpoints.html b/application/single_app/templates/admin/_panes/model-endpoints.html
new file mode 100644
index 000000000..5c9683ad4
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/model-endpoints.html
@@ -0,0 +1,401 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'model-endpoints' %} show active{% endif %}" id="model-endpoints" role="tabpanel" aria-labelledby="model-endpoints-tab">
+
+                <p class="text-muted">
+                    Configure all AI model settings including GPT for text generation, embeddings for semantic search, and image generation capabilities.
+                </p>
+
+                <div class="card p-3 mb-4" id="multi-endpoint-configuration">
+                    <h5 class="card-title">
+                        <i class="bi bi-hdd-network me-2"></i>Model Endpoints
+                    </h5>
+                    <p class="text-muted small">
+                        Manage multiple AI model endpoints (Azure OpenAI and Azure AI Foundry). When enabled, model selection in chat is driven by these endpoints.
+                    </p>
+
+                    {% if not settings.enable_multi_model_endpoints %}
+                    <div class="form-check form-switch mb-3 d-flex align-items-center">
+                        <input type="checkbox" class="form-check-input me-2" id="enable_multi_model_endpoints" name="enable_multi_model_endpoints" {% if settings.enable_multi_model_endpoints %}checked{% endif %}>
+                        <label class="form-check-label" for="enable_multi_model_endpoints">Enable multi-endpoint model management</label>
+                    </div>
+                    {% endif %}
+
+                    {% if settings.enable_semantic_kernel %}
+                    <div id="agent-default-model-migration-panel" class="border rounded p-3 mt-3">
+                        <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3">
+                            <div>
+                                <h6 class="mb-1"><i class="bi bi-arrow-repeat me-2"></i>Agent Default Model Review</h6>
+                                <p class="text-muted small mb-0">
+                                    Review local agents in a modal, bulk-bind inherited agents to the saved default model endpoint, and explicitly override selected agent model choices when you need to manage cost or move to newer models.
+                                </p>
+                            </div>
+                            <div class="d-flex flex-wrap gap-2">
+                                <button type="button" class="btn btn-outline-primary btn-sm" id="preview-agent-default-model-migration-btn">
+                                    <i class="bi bi-search me-1"></i>Review And Select Agents
+                                </button>
+                            </div>
+                        </div>
+                        <div id="agent-default-model-migration-status" class="form-text mt-2">
+                            {% if settings.enable_multi_model_endpoints %}
+                            Save your AI model settings before reviewing or migrating agents.
+                            {% else %}
+                            Enable multi-endpoint model management to review and rebind agents to a saved default model.
+                            {% endif %}
+                        </div>
+                        <div id="agent-default-model-migration-callout" class="alert alert-info d-none mt-3 mb-0" role="alert"></div>
+                    </div>
+
+                    <div id="agent-default-model-migration-results" class="d-none mt-3">
+                        <div class="d-flex flex-wrap gap-2 mb-3">
+                            <span class="badge text-bg-primary" id="agent-default-model-ready-count">Ready: 0</span>
+                            <span class="badge text-bg-warning" id="agent-default-model-needs-default-count">Needs Default: 0</span>
+                            <span class="badge text-bg-secondary" id="agent-default-model-manual-count">Manual Review: 0</span>
+                            <span class="badge text-bg-success" id="agent-default-model-migrated-count">Already Migrated: 0</span>
+                        </div>
+                        <div class="small text-muted mb-2" id="agent-default-model-current-label"></div>
+                        <div class="small text-muted">
+                            Open the review modal to search, filter, and selectively rebind agents to the saved default model.
+                        </div>
+                    </div>
+
+                    <div class="modal fade" id="agentDefaultModelMigrationModal" tabindex="-1" aria-labelledby="agentDefaultModelMigrationModalLabel" aria-hidden="true">
+                        <div class="modal-dialog modal-xl modal-dialog-scrollable">
+                            <div class="modal-content">
+                                <div class="modal-header">
+                                    <div>
+                                        <h5 class="modal-title" id="agentDefaultModelMigrationModalLabel">Agent Default Model Review</h5>
+                                        <p class="text-muted small mb-0">
+                                            Search, filter, and explicitly choose which agents should adopt the saved default model. Manual review rows are never selected automatically.
+                                        </p>
+                                    </div>
+                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                                </div>
+                                <div class="modal-body">
+                                    <div class="row g-2 mb-3">
+                                        <div class="col-lg-5">
+                                            <label for="agent-default-model-migration-search" class="form-label small mb-1">Search Agents</label>
+                                            <input type="search" class="form-control form-control-sm" id="agent-default-model-migration-search" placeholder="Search by scope, agent name, binding, or reason" />
+                                        </div>
+                                        <div class="col-lg-3">
+                                            <label for="agent-default-model-migration-filter" class="form-label small mb-1">Filter</label>
+                                            <select class="form-select form-select-sm" id="agent-default-model-migration-filter">
+                                                <option value="all">All Agents</option>
+                                                <option value="selected">Selected</option>
+                                                <option value="ready_to_migrate">Ready</option>
+                                                <option value="manual_review">Manual Review</option>
+                                                <option value="needs_default_model">Needs Default</option>
+                                                <option value="already_migrated">Already On Default</option>
+                                            </select>
+                                        </div>
+                                        <div class="col-lg-4">
+                                            <label class="form-label small mb-1">Selection Tools</label>
+                                            <div class="d-flex flex-wrap gap-2">
+                                                <button type="button" class="btn btn-outline-primary btn-sm" id="select-ready-agent-default-model-migration-btn">Select Recommended</button>
+                                                <button type="button" class="btn btn-outline-secondary btn-sm" id="select-manual-agent-default-model-migration-btn">Add Review Overrides</button>
+                                                <button type="button" class="btn btn-outline-danger btn-sm" id="clear-agent-default-model-migration-selection-btn">Clear</button>
+                                            </div>
+                                        </div>
+                                    </div>
+                                    <div class="small text-muted mb-3" id="agent-default-model-migration-selection-summary">No agents selected.</div>
+                                    <div class="table-responsive">
+                                        <table class="table table-sm table-bordered align-middle">
+                                            <thead>
+                                                <tr>
+                                                    <th style="width: 80px;">Select</th>
+                                                    <th>Scope</th>
+                                                    <th>Agent</th>
+                                                    <th>Status</th>
+                                                    <th>Current Binding</th>
+                                                    <th>Reason</th>
+                                                </tr>
+                                            </thead>
+                                            <tbody id="agent-default-model-migration-tbody">
+                                                <tr>
+                                                    <td colspan="6" class="text-center text-muted py-3">Run a review to load migration candidates.</td>
+                                                </tr>
+                                            </tbody>
+                                        </table>
+                                    </div>
+                                </div>
+                                <div class="modal-footer d-flex flex-column flex-md-row justify-content-between align-items-md-center gap-2">
+                                    <div class="small text-muted">
+                                        Review overrides are for intentional changes when you want to replace an agent's explicit model or legacy custom connection with the saved default model.
+                                    </div>
+                                    <div class="d-flex gap-2">
+                                        <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
+                                        <button type="button" class="btn btn-primary" id="run-agent-default-model-migration-btn">Apply Saved Default To Selected</button>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                    {% else %}
+                    <div id="agent-default-model-migration-disabled-state" class="alert alert-info mt-3" role="alert">
+                        <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3">
+                            <div>
+                                <h6 class="mb-1"><i class="bi bi-info-circle me-2"></i>Agent Default Model Review</h6>
+                                <p class="small mb-0">
+                                    Enable Agents first to use default-model review in AI Models. Once enabled, admins can use it to move inherited agents to new defaults, selectively override explicit agent model choices, and manage costs as models evolve.
+                                </p>
+                            </div>
+                            <button type="button" class="btn btn-outline-primary btn-sm align-self-start" data-open-admin-tab="#agents">
+                                <i class="bi bi-box-arrow-up-right me-1"></i>Open Agents Settings
+                            </button>
+                        </div>
+                    </div>
+                    {% endif %}
+
+                    <div class="border rounded p-3 mt-3">
+                        <div class="d-flex flex-column flex-lg-row justify-content-between gap-2">
+                            <div>
+                                <h6 class="mb-1"><i class="bi bi-fingerprint me-2"></i>Model Endpoint Identity Header</h6>
+                                <p class="text-muted small mb-0">
+                                    Send a stable HMAC-hashed user key to model endpoint backends for APIM counters, quota policies, or routing policies.
+                                </p>
+                            </div>
+                            <div class="form-check form-switch">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input"
+                                    id="model_endpoint_identity_header_enabled"
+                                    name="model_endpoint_identity_header_enabled"
+                                    {% if settings.model_endpoint_identity_header_enabled %}checked{% endif %}
+                                />
+                                <label class="form-check-label" for="model_endpoint_identity_header_enabled">Enable header</label>
+                            </div>
+                        </div>
+                        <div class="row g-3 mt-1">
+                            <div class="col-md-6">
+                                <label for="model_endpoint_identity_header_name" class="form-label">Header Name</label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="model_endpoint_identity_header_name"
+                                    name="model_endpoint_identity_header_name"
+                                    value="{{ settings.model_endpoint_identity_header_name or 'x-simplechat-identity-key' }}"
+                                />
+                                <div class="form-text">Reserved auth/protocol headers cannot be used.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="model_endpoint_identity_header_value_type" class="form-label">Identity Value</label>
+                                <select class="form-select" id="model_endpoint_identity_header_value_type" name="model_endpoint_identity_header_value_type">
+                                    <option value="user_oid_tenant_id" {% if settings.model_endpoint_identity_header_value_type == 'user_oid_tenant_id' %}selected{% endif %}>User object ID + tenant ID</option>
+                                    <option value="user_oid" {% if settings.model_endpoint_identity_header_value_type == 'user_oid' %}selected{% endif %}>User object ID</option>
+                                    <option value="user_upn_tenant_id" {% if settings.model_endpoint_identity_header_value_type == 'user_upn_tenant_id' %}selected{% endif %}>User UPN + tenant ID</option>
+                                    <option value="user_upn" {% if settings.model_endpoint_identity_header_value_type == 'user_upn' %}selected{% endif %}>User UPN</option>
+                                </select>
+                                <div class="form-text">The selected identity is HMAC-hashed before leaving SimpleChat. Missing identity values omit the header.</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div id="default-model-selection-wrapper" class="mt-3">
+                        <label for="default-model-selection" class="form-label">Default model for fallbacks</label>
+                        <select class="form-select" id="default-model-selection" aria-label="Default model for fallback selection"></select>
+                        <div class="form-text">
+                            Used for tasks such as conversation summarization, fallback, and other operations when an agent is selected.
+                        </div>
+                    </div>
+
+                    <input type="hidden" name="model_endpoints_json" id="model_endpoints_json" />
+                    <input type="hidden" name="default_model_selection_json" id="default_model_selection_json" />
+
+                    <div id="model-endpoints-wrapper" class="{% if not settings.enable_multi_model_endpoints %}d-none{% endif %}">
+                        <div class="d-flex justify-content-between align-items-center mb-2">
+                            <h6 class="mb-0">Global Endpoints</h6>
+                            <div class="d-flex flex-wrap gap-2">
+                                <button type="button" class="btn btn-sm btn-outline-secondary" data-bs-toggle="modal" data-bs-target="#modelEndpointIdentityGuideModal" data-testid="model-endpoint-identity-guide-open">
+                                    <i class="bi bi-question-circle me-1"></i>Setup Guide
+                                </button>
+                                <button type="button" class="btn btn-sm btn-outline-primary" id="add-model-endpoint-btn">
+                                    <i class="bi bi-plus-circle me-1"></i>Add Endpoint
+                                </button>
+                            </div>
+                        </div>
+                        <div class="table-responsive">
+                            <table class="table table-sm table-bordered">
+                                <thead>
+                                    <tr>
+                                        <th>Name</th>
+                                        <th>Provider</th>
+                                        <th>Selected Models</th>
+                                        <th>Status</th>
+                                        <th>Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="model-endpoints-tbody">
+                                    <!-- Populated by JavaScript -->
+                                </tbody>
+                            </table>
+                        </div>
+                    </div>
+                    {% if not settings.enable_multi_model_endpoints %}
+                        <button type="button" class="btn btn-outline-secondary" data-bs-toggle="modal" data-bs-target="#legacyModelSettingsModal">
+                            <i class="bi bi-sliders me-1"></i>Open Legacy Model Configuration
+                        </button>
+                    {% endif %}
+                </div>
+
+                <!-- Legacy AI Models Modal -->
+                <div class="modal fade" id="legacyModelSettingsModal" tabindex="-1" aria-labelledby="legacyModelSettingsModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="legacyModelSettingsModalLabel">Legacy AI Model Configuration</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <!-- Chat Model Section -->
+                                <div class="card p-3 mb-4" id="gpt-configuration">
+                                    <h5 class="card-title">
+                                        <i class="bi bi-chat-text me-2"></i>Chat Model
+                                    </h5>
+                                    <p class="text-muted small">
+                                        Configure your Chat Model settings. These are used for generating AI text responses.
+                                    </p>
+                                    <button type="button" class="btn btn-sm btn-outline-secondary mb-3 align-self-start" data-bs-toggle="modal" data-bs-target="#legacyModelDiscoveryIdentityGuideModal">
+                                        <i class="bi bi-question-circle me-1"></i>Setup Guide
+                                    </button>
+
+                                <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                                    <input type="checkbox" class="form-check-input me-2" id="enable_gpt_apim" name="enable_gpt_apim" {%
+                                        if settings.enable_gpt_apim %}checked{% endif %}>
+                                    <label class="form-check-label" for="enable_gpt_apim">Use APIM instead of direct to Azure OpenAI
+                                        endpoint</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route GPT model requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="APIM provides an additional layer for security, monitoring, and rate limiting. When using APIM, you'll need to manually specify your model names and will not be able to fetch models automatically."></i>
+                                </div>
+
+                                <div id="non_apim_gpt_settings" {% if settings.enable_gpt_apim %}style="display: none;" {% endif %}>
+                                    <div class="card p-3 mb-3">
+                                        <div class="mb-3">
+                                            <label for="azure_openai_gpt_endpoint" class="form-label">
+                                                Azure OpenAI Endpoint
+                                            </label>
+                                            <input type="text" class="form-control" id="azure_openai_gpt_endpoint"
+                                                name="azure_openai_gpt_endpoint" value="{{ settings.azure_openai_gpt_endpoint or '' }}">
+                                        </div>
+                                        <div class="mb-3">
+                                            <label for="azure_openai_gpt_authentication_type" class="form-label">
+                                                Authentication Type
+                                            </label>
+                                            <select class="form-select" id="azure_openai_gpt_authentication_type"
+                                                name="azure_openai_gpt_authentication_type">
+                                                <option value="key" {% if settings.azure_openai_gpt_authentication_type=='key'
+                                                    %}selected{% endif %}>
+                                                    Key
+                                                </option>
+                                                <option value="managed_identity" {% if
+                                                    settings.azure_openai_gpt_authentication_type=='managed_identity' %}selected{% endif
+                                                    %}>
+                                                    Managed Identity
+                                                </option>
+                                            </select>
+                                        </div>
+                                        <div class="mb-3">
+                                            <label for="azure_openai_gpt_subscription_id" class="form-label">Subscription ID</label>
+                                            <input type="text" class="form-control" id="azure_openai_gpt_subscription_id"
+                                                name="azure_openai_gpt_subscription_id"
+                                                value="{{ settings.azure_openai_gpt_subscription_id or '' }}">
+                                        </div>
+                                        <div class="mb-3">
+                                            <label for="azure_openai_gpt_resource_group" class="form-label">Resource Group</label>
+                                            <input type="text" class="form-control" id="azure_openai_gpt_resource_group"
+                                                name="azure_openai_gpt_resource_group"
+                                                value="{{ settings.azure_openai_gpt_resource_group or '' }}">
+                                        </div>
+                                        <div class="mb-3" id="gpt_key_container" {% if settings.azure_openai_gpt_authentication_type
+                                            !='key' %}style="display: none;" {% endif %}>
+                                            <label for="azure_openai_gpt_key" class="form-label">Azure OpenAI GPT Key</label>
+                                            <div class="input-group">
+                                                <input type="password" class="form-control" id="azure_openai_gpt_key"
+                                                    name="azure_openai_gpt_key" value="{{ settings.azure_openai_gpt_key or '' }}">
+                                                <button type="button" class="btn btn-outline-secondary"
+                                                    id="toggle_gpt_key">Show</button>
+                                            </div>
+                                        </div>
+                                        <div class="mb-3">
+                                            <label for="gpt_model" class="form-label">Azure OpenAI Model Selection</label>
+                                            <br><small>Each selected model will be available in the Chat UI as an option for the User. You can select multiple models.</small>
+                                            <br><small>Save Pending Changes to settings before clicking Fetch Models</small>
+                                            <div id="gpt_models_list" class="mt-2 mb-3">
+
+                                            </div>
+
+                                            <small>Save pending changes to settings before clicking Fetch Models</small><br>
+
+                                            <input type="hidden" name="gpt_model_json" id="gpt_model_json" />
+
+
+                                            <input type="hidden" id="gpt_model" value="{{ settings.gpt_model.selected[0].deploymentName if settings.gpt_model.selected else '' }}" />
+
+                                            <button type="button" class="btn btn-secondary" id="fetch_gpt_models_btn">
+                                                Fetch Models
+                                            </button>
+                                        </div>
+                                        <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
+                                            data-bs-target="#advancedGptFields" aria-expanded="false" aria-controls="advancedGptFields">
+                                            Show Advanced
+                                        </a>
+                                        <div class="collapse" id="advancedGptFields">
+                                            <div class="card card-body mt-2">
+                                                <div class="mb-3">
+                                                    <label for="azure_openai_gpt_api_version" class="form-label">
+                                                        Azure OpenAI API Version
+                                                    </label>
+                                                    <input type="text" class="form-control" id="azure_openai_gpt_api_version"
+                                                        name="azure_openai_gpt_api_version"
+                                                        value="{{ settings.azure_openai_gpt_api_version or '' }}">
+                                                </div>
+                                            </div>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <div id="apim_gpt_settings" class="card p-3 mb-3" {% if not settings.enable_gpt_apim
+                                    %}style="display: none;" {% endif %}>
+                                    <div class="mb-3">
+                                        <label for="azure_apim_gpt_endpoint" class="form-label">Azure APIM Endpoint</label>
+                                        <input type="text" class="form-control" id="azure_apim_gpt_endpoint"
+                                            name="azure_apim_gpt_endpoint" value="{{ settings.azure_apim_gpt_endpoint or '' }}">
+                                    </div>
+                                    <div class="mb-3">
+                                        <label for="azure_apim_gpt_api_version" class="form-label">Azure APIM API Version</label>
+                                        <input type="text" class="form-control" id="azure_apim_gpt_api_version"
+                                            name="azure_apim_gpt_api_version" value="{{ settings.azure_apim_gpt_api_version or '' }}">
+                                    </div>
+                                    <div class="mb-3">
+                                        <label for="azure_apim_gpt_deployment" class="form-label">Azure APIM Deployment</label>
+                                        <br><small class="text-muted">Each model defined here will be available in the Chat UI as an option for the User. You can include multiple models seperated by a comma (example: gpt-4o, o-1, o-3).</small>
+                                        <br><small class="text-muted">NOTE: The APIM GPT Test is against the first model in the list.</small>
+                                        <input type="text" class="form-control" id="azure_apim_gpt_deployment"
+                                            name="azure_apim_gpt_deployment" value="{{ settings.azure_apim_gpt_deployment or '' }}">
+                                    </div>
+                                    <div class="mb-3">
+                                        <label for="azure_apim_gpt_subscription_key" class="form-label">Azure APIM Subscription
+                                            Key</label>
+                                        <div class="input-group">
+                                            <input type="password" class="form-control" id="azure_apim_gpt_subscription_key"
+                                                name="azure_apim_gpt_subscription_key"
+                                                value="{{ settings.azure_apim_gpt_subscription_key or '' }}">
+                                            <button type="button" class="btn btn-outline-secondary"
+                                                id="toggle_azure_apim_gpt_subscription_key">Show</button>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <button type="button" class="btn btn-secondary mt-3" id="test_gpt_button">
+                                    Test Connection
+                                </button>
+                                <div id="test_gpt_result" class="mt-2"></div>
+                                </div>
+
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                {% include '_multiendpoint_modal.html' %}
+            </div>
diff --git a/application/single_app/templates/admin/_panes/network.html b/application/single_app/templates/admin/_panes/network.html
new file mode 100644
index 000000000..0f9216bad
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/network.html
@@ -0,0 +1,41 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'network' %} show active{% endif %}" id="network" role="tabpanel" aria-labelledby="network-tab">
+                <div class="card p-3 mb-3" id="front-door-section">
+                    <div class="d-flex justify-content-between align-items-center mb-2">
+                        <h5 class="mb-0">
+                            <i class="bi bi-globe me-2"></i>Front Door
+                        </h5>
+                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#frontDoorInfoModal">
+                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
+                        </button>
+                    </div>
+                    <p class="text-muted mb-1">Configure Front Door URL for authentication and redirect flows.</p>
+
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="enable_front_door"
+                            name="enable_front_door"
+                            {% if settings.enable_front_door %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_front_door">
+                            Enable Front Door Support
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable Azure Front Door integration for global load balancing, SSL termination, and improved performance with custom domain support."></i>
+                    </div>
+
+                    <div class="mb-3" id="front-door-url-settings">
+                        <label for="front_door_url" class="form-label">Front Door URL</label>
+                        <input type="url" class="form-control" id="front_door_url" name="front_door_url"
+                               value="{{ settings.front_door_url or '' }}"
+                               placeholder="https://your-frontdoor.azurefd.net">
+                        <small class="form-text text-muted">
+                            The base URL of your Front Door or load balancer. The system will automatically generate:
+                            <ul class="mb-0 mt-1">
+                                <li><strong>Home redirect:</strong> <code id="home-url-preview">https://your-frontdoor.azurefd.net</code></li>
+                                <li><strong>OAuth2 redirect:</strong> <code id="oauth-url-preview">https://your-frontdoor.azurefd.net/getAToken</code></li>
+                            </ul>
+                        </small>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/notices.html b/application/single_app/templates/admin/_panes/notices.html
new file mode 100644
index 000000000..c05ac2b68
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/notices.html
@@ -0,0 +1,288 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'notices' %} show active{% endif %}" id="notices" role="tabpanel" aria-labelledby="notices-tab">
+                <div class="card p-3 mb-3" id="classification-banner-section">
+                    <h5>
+                        <i class="bi bi-shield-exclamation me-2"></i>Classification Banner
+                    </h5>
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" id="classification_banner_enabled" name="classification_banner_enabled"
+                            {% if settings.classification_banner_enabled %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="classification_banner_enabled">
+                            Enable Classification Banner
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a security classification banner at the top of every page to indicate data sensitivity level."></i>
+                    </div>
+                    <div class="mb-2">
+                        <label for="classification_banner_text" class="form-label">Banner Text</label>
+                        <input type="text" class="form-control" id="classification_banner_text" name="classification_banner_text"
+                            value="{{ settings.classification_banner_text }}">
+                    </div>
+                    <div class="mb-2">
+                        <label for="classification_banner_color" class="form-label">Banner Color</label>
+                        <input type="color" class="form-control form-control-color" id="classification_banner_color" name="classification_banner_color"
+                            value="{{ settings.classification_banner_color or '#ffc107' }}" style="width: 3rem; height: 2rem;">
+                    </div>
+                    <div class="mb-2">
+                        <label for="classification_banner_text_color" class="form-label">Banner Text Color</label>
+                        <input type="color" class="form-control form-control-color" id="classification_banner_text_color" name="classification_banner_text_color"
+                            value="{{ settings.classification_banner_text_color or '#ffffff' }}" style="width: 3rem; height: 2rem;">
+                    </div>
+                    <div class="mb-2">
+                        <span id="classification-banner-preview"
+                              style="display:inline-block; padding:0.5em 1em; border-radius:0.3em; font-weight:bold; color:{{ settings.classification_banner_text_color or '#ffffff' }}; background:{{ settings.classification_banner_color or '#ffc107' }};">
+                            {{ settings.classification_banner_text or 'Banner Preview' }}
+                        </span>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="ai-notice-section">
+                    <h5>
+                        <i class="bi bi-robot me-2"></i>Chat AI Notice
+                    </h5>
+                    <p class="text-muted small">
+                        Display an administrator-provided reminder directly below the chat input, such as guidance that responses are AI-generated and should be reviewed.
+                    </p>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="enable_ai_notice"
+                            name="enable_ai_notice"
+                            {% if settings.enable_ai_notice %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_ai_notice">
+                            Show a custom AI notice below the chat input
+                        </label>
+                    </div>
+                    <div id="ai_notice_settings" class="{% if not settings.enable_ai_notice %}d-none{% endif %}">
+                        <div class="mb-3">
+                            <label for="ai_notice_message" class="form-label">Notice Text</label>
+                            <textarea
+                                class="form-control"
+                                id="ai_notice_message"
+                                name="ai_notice_message"
+                                rows="3"
+                                maxlength="1000"
+                                placeholder="AI-generated responses may contain errors. Review important information before relying on it."
+                            >{{ settings.ai_notice_message or '' }}</textarea>
+                            <div class="form-text">Plain text only. Line breaks are preserved.</div>
+                        </div>
+                        <div>
+                            <label for="ai_notice_frequency" class="form-label">Display Behavior</label>
+                            <select class="form-select" id="ai_notice_frequency" name="ai_notice_frequency">
+                                <option value="non_dismissible" {% if settings.ai_notice_frequency == 'non_dismissible' %}selected{% endif %}>Always visible; users cannot dismiss it</option>
+                                <option value="every_session" {% if settings.ai_notice_frequency == 'every_session' %}selected{% endif %}>Dismissible once per session</option>
+                                <option value="daily" {% if settings.ai_notice_frequency == 'daily' %}selected{% endif %}>Dismissible once per day</option>
+                                <option value="once" {% if settings.ai_notice_frequency == 'once' %}selected{% endif %}>Dismissible once per message version</option>
+                            </select>
+                            <div class="form-text">Changing the notice text or display behavior creates a new message version and shows it again.</div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="terms-of-use-section">
+                    <h5>
+                        <i class="bi bi-door-open me-2"></i>Terms of Use
+                    </h5>
+                    <p class="text-muted small">
+                        Require users to accept the Terms of Use before using SimpleChat. Standard Microsoft sign-in users see it before authentication; Teams SSO and other passive sign-in flows are gated immediately after the app session is created.
+                    </p>
+
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            class="form-check-input"
+                            type="checkbox"
+                            id="enable_terms_of_use"
+                            name="enable_terms_of_use"
+                            {% if settings.enable_terms_of_use %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_terms_of_use">
+                            Require terms of use
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the Terms of Use before accessing authenticated application pages or APIs."></i>
+                    </div>
+
+                    <div class="row g-3">
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_title" class="form-label">Popup Title</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="terms_of_use_title"
+                                name="terms_of_use_title"
+                                maxlength="160"
+                                value="{{ settings.terms_of_use_title or 'Terms of Use' }}"
+                            >
+                        </div>
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_frequency" class="form-label">Show Frequency</label>
+                            <select class="form-select" id="terms_of_use_frequency" name="terms_of_use_frequency">
+                                <option value="every_session" {% if settings.terms_of_use_frequency == 'every_session' %}selected{% endif %}>At the start of every session</option>
+                                <option value="daily" {% if settings.terms_of_use_frequency == 'daily' %}selected{% endif %}>Once per day</option>
+                                <option value="once" {% if settings.terms_of_use_frequency == 'once' %}selected{% endif %}>Just once per terms version</option>
+                            </select>
+                            <small class="form-text text-muted">Changing the title, message, or frequency creates a new terms version that users must accept again.</small>
+                        </div>
+                    </div>
+
+                    <div class="mb-3 mt-3">
+                        <label for="terms_of_use_message" class="form-label">Terms of Use Message</label>
+                        <textarea
+                            class="form-control"
+                            id="terms_of_use_message"
+                            name="terms_of_use_message"
+                            rows="7"
+                            maxlength="10000"
+                            placeholder="Enter the terms, notice, or rules of behavior users must accept before using the application."
+                        >{{ settings.terms_of_use_message or '' }}</textarea>
+                        <small class="form-text text-muted">Plain text is shown to users with line breaks preserved.</small>
+                    </div>
+
+                    <div class="mb-3">
+                        <label for="terms_of_use_decline_redirect_url" class="form-label">Cancel Redirect URL</label>
+                        <input
+                            type="text"
+                            class="form-control"
+                            id="terms_of_use_decline_redirect_url"
+                            name="terms_of_use_decline_redirect_url"
+                            value="{{ settings.terms_of_use_decline_redirect_url or '/' }}"
+                            placeholder="/"
+                        >
+                        <small class="form-text text-muted">Use a local path such as <code>/</code> or an admin-approved HTTP(S) URL. Signed-in users are locally logged out before this redirect.</small>
+                    </div>
+
+                    <div class="row g-3">
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_accept_button_text" class="form-label">Accept Button Text</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="terms_of_use_accept_button_text"
+                                name="terms_of_use_accept_button_text"
+                                maxlength="80"
+                                value="{{ settings.terms_of_use_accept_button_text or 'Accept and continue' }}"
+                            >
+                        </div>
+                        <div class="col-lg-6">
+                            <label for="terms_of_use_decline_button_text" class="form-label">Cancel Button Text</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="terms_of_use_decline_button_text"
+                                name="terms_of_use_decline_button_text"
+                                maxlength="80"
+                                value="{{ settings.terms_of_use_decline_button_text or 'Cancel' }}"
+                            >
+                        </div>
+                    </div>
+
+                    <div class="alert alert-info mt-3 mb-0" role="alert">
+                        <strong>Tracking:</strong> Every-session acceptance is stored in the Flask session. Daily and once-per-version acceptance are stored in user settings, and accepted or declined events are written to the activity log when the user identity is known.
+                    </div>
+                </div>
+
+
+
+                <div class="card mb-3 p-3" id="user-agreement-section">
+                    <h5>
+                        <i class="bi bi-file-earmark-check me-2"></i>User Agreement
+                    </h5>
+                    <p class="text-muted">
+                        Configure a user agreement that users must accept before uploading files.
+                        Supports Markdown formatting.
+                    </p>
+
+                    <!-- Enable Toggle -->
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_user_agreement"
+                            name="enable_user_agreement"
+                            {% if settings.enable_user_agreement %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_user_agreement">
+                            Enable User Agreement
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the agreement before uploading files in the selected workspace types."></i>
+                    </div>
+
+                    <!-- User Agreement Settings (shown when enabled) -->
+                    <div id="user_agreement_settings" {% if not settings.enable_user_agreement %}style="display: none;"{% endif %}>
+                        <hr>
+
+                        <!-- Apply To Checkboxes -->
+                        <div class="mb-3">
+                            <label class="form-label fw-bold">Apply to <span class="text-danger">*</span></label>
+                            <p class="text-muted small mb-2">Select where the user agreement should be shown (at least one required):</p>
+                            <div class="row">
+                                <div class="col-md-6">
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_personal" name="user_agreement_apply_personal"
+                                            {% if settings.user_agreement_apply_to and 'personal' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_personal">
+                                            <i class="bi bi-person me-1"></i>Personal Workspaces
+                                        </label>
+                                    </div>
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_group" name="user_agreement_apply_group"
+                                            {% if settings.user_agreement_apply_to and 'group' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_group">
+                                            <i class="bi bi-people me-1"></i>Group Workspaces
+                                        </label>
+                                    </div>
+                                </div>
+                                <div class="col-md-6">
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_public" name="user_agreement_apply_public"
+                                            {% if settings.user_agreement_apply_to and 'public' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_public">
+                                            <i class="bi bi-globe me-1"></i>Public Workspaces
+                                        </label>
+                                    </div>
+                                    <div class="form-check mb-2">
+                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_chat" name="user_agreement_apply_chat"
+                                            {% if settings.user_agreement_apply_to and 'chat' in settings.user_agreement_apply_to %}checked{% endif %}>
+                                        <label class="form-check-label" for="user_agreement_apply_chat">
+                                            <i class="bi bi-chat-dots me-1"></i>Chat
+                                        </label>
+                                    </div>
+                                </div>
+                            </div>
+                            <div id="user_agreement_apply_to_validation" class="text-danger small" style="display: none;">
+                                <i class="bi bi-exclamation-circle me-1"></i>At least one location must be selected
+                            </div>
+                        </div>
+
+                        <!-- Agreement Text -->
+                        <div class="mb-3">
+                            <label for="user_agreement_text" class="form-label fw-bold">
+                                Agreement Text <span class="text-danger">*</span>
+                                <span class="text-muted fw-normal ms-2">(Markdown supported)</span>
+                            </label>
+                            <textarea class="form-control" id="user_agreement_text" name="user_agreement_text" rows="6"
+                                placeholder="Enter the agreement text that users must accept before uploading files...&#10;&#10;Example:&#10;**I confirm that:**&#10;- The documents I am uploading do not contain PII&#10;- I have permission to share these documents">{{ settings.user_agreement_text or '' }}</textarea>
+                            <div class="d-flex justify-content-between mt-1">
+                                <small id="user_agreement_word_count" class="text-muted">0 / 200 words</small>
+                                <small id="user_agreement_word_warning" class="text-danger" style="display: none;">
+                                    <i class="bi bi-exclamation-circle me-1"></i>Exceeds 200 word limit
+                                </small>
+                            </div>
+                        </div>
+
+                        <!-- Daily Acceptance Option -->
+                        <div class="form-group form-check form-switch mb-3">
+                            <input type="checkbox" class="form-check-input" id="enable_user_agreement_daily" name="enable_user_agreement_daily"
+                                {% if settings.enable_user_agreement_daily %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="enable_user_agreement_daily">
+                                Allow users to accept once per day
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users only need to accept the agreement once per day instead of every time they upload files."></i>
+                        </div>
+
+                        <!-- Test Preview Button -->
+                        <div class="d-flex gap-2 flex-wrap">
+                            <button type="button" class="btn btn-outline-secondary" id="test_user_agreement_btn">
+                                <i class="bi bi-eye me-1"></i>Test Preview
+                            </button>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/redis-caching.html b/application/single_app/templates/admin/_panes/redis-caching.html
new file mode 100644
index 000000000..5bbaa8c4d
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/redis-caching.html
@@ -0,0 +1,448 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'redis-caching' %} show active{% endif %}" id="redis-caching" role="tabpanel" aria-labelledby="redis-caching-tab">
+                {% set enable_dai_debug = settings.enable_dai_debug | default(false) %}
+                <p class="text-muted">
+                    Configure Redis cache to improve enterprise scale and performance by caching session data. Enabling Redis allows you to horizontally scale your application across multiple instances without losing session data.
+                </p>
+                <div class="card p-3 mb-3" id="redis-cache-section">
+                    <h5>
+                        <i class="bi bi-database me-2"></i>Redis Cache
+                    </h5>
+                    <p class="text-muted">
+                        Enable Redis Cache to store session data in a distributed cache. This is recommended for production and multi-instance deployments.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_redis_cache"
+                            name="enable_redis_cache"
+                            {% if settings.enable_redis_cache %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_redis_cache">
+                            Enable Redis Cache
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable Redis Cache for distributed session storage, improving performance and enabling horizontal scaling across multiple application instances."></i>
+                    </div>
+                    <div id="redis_cache_settings" class="{% if not settings.enable_redis_cache %}d-none{% endif %}">
+                        <div class="mb-3">
+                            <label for="redis_url" class="form-label">Redis Server Host Name</label>
+                            <p class="text-muted">(example: simple-chat.redis.cache.windows.net)</p>
+                            <input type="text" class="form-control" id="redis_url" name="redis_url" value="{{ settings.redis_url or '' }}">
+                        </div>
+                        <div class="mb-3">
+                            <label for="redis_auth_type" class="form-label">Redis Authentication Type</label>
+                            <select class="form-select" id="redis_auth_type" name="redis_auth_type">
+                                <option value="key" {% if settings.redis_auth_type == 'key' or not settings.redis_auth_type %}selected{% endif %}>Key</option>
+                                <option value="managed_identity" {% if settings.redis_auth_type == 'managed_identity' %}selected{% endif %}>Managed Identity</option>
+                                <option value="key_vault" {% if settings.redis_auth_type == 'key_vault' %}selected{% endif %}>Key Vault</option>
+                            </select>
+                        </div>
+                        <div class="mb-3 {% if settings.redis_auth_type == 'managed_identity' %}d-none{% endif %}" id="redis_key_container">
+                            <label for="redis_key" class="form-label" id="redis_key_label">
+                                {%- if settings.redis_auth_type == 'key_vault' -%}
+                                    Key Vault Secret Name
+                                {%- else -%}
+                                    Redis Access Key
+                                {%- endif -%}
+                            </label>
+                            <div class="input-group">
+                                <input type="password" class="form-control" id="redis_key" name="redis_key" value="{{ settings.redis_key or '' }}">
+                                <button type="button" class="btn btn-outline-secondary" id="toggle_redis_key">Show</button>
+                            </div>
+                            <div id="redis_key_vault_hint" class="form-text text-muted {% if settings.redis_auth_type != 'key_vault' %}d-none{% endif %}">
+                                Enter the full Key Vault secret name. <a href="#keyvault-section" data-admin-link="keyvault-section">
+                                Enable Key Vault for Agent and Action Secrets
+                            </a> must be enabled and configured.
+                            </div>
+                        </div>
+                        <button type="button" class="btn btn-secondary mt-3" id="test_redis_button">
+                            Test Redis Connection
+                        </button>
+                        <div id="test_redis_result" class="mt-2"></div>
+                    </div>
+                    <div class="border rounded p-3 mt-4" id="redis-monitoring-section" data-testid="redis-monitoring-section">
+                        <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
+                            <div>
+                                <h6 class="mb-1">
+                                    <i class="bi bi-activity me-2" aria-hidden="true"></i>Redis Monitoring
+                                </h6>
+                                <p class="text-muted small mb-0">
+                                    Monitor Redis availability, memory pressure, hit rate, evictions, and runtime cache usage before Redis-backed document list caching is enabled.
+                                </p>
+                            </div>
+                            <div class="d-flex flex-wrap gap-2" role="group" aria-label="Redis monitoring actions">
+                                <button type="button" class="btn btn-outline-secondary btn-sm" id="redis-monitoring-refresh-btn">
+                                    <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh Redis Status
+                                </button>
+                                <button type="button" class="btn btn-outline-primary btn-sm" id="redis-explorer-open-btn" data-bs-toggle="modal" data-bs-target="#redisExplorerModal">
+                                    <i class="bi bi-search me-1" aria-hidden="true"></i>Redis Explorer
+                                </button>
+                            </div>
+                        </div>
+                        <div class="alert alert-info small mb-3 d-none" id="redis-monitoring-message" role="status" aria-live="polite"></div>
+                        <div class="row g-3 mb-3">
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Configuration</div>
+                                    <span class="badge text-bg-secondary" id="redis-monitoring-config-status">Not loaded</span>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Health</div>
+                                    <span class="badge text-bg-secondary" id="redis-monitoring-health-status">Not loaded</span>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">App Cache Runtime</div>
+                                    <span class="badge text-bg-secondary" id="redis-monitoring-app-cache-status">Not loaded</span>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Session Runtime</div>
+                                    <span class="badge text-bg-secondary" id="redis-monitoring-session-status">Not loaded</span>
+                                </div>
+                            </div>
+                        </div>
+                        <div class="row g-3">
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Ping Latency</div>
+                                    <div class="fw-semibold" id="redis-monitoring-ping-latency">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Memory Usage</div>
+                                    <div class="fw-semibold" id="redis-monitoring-memory-usage">Not loaded</div>
+                                    <div class="text-muted small" id="redis-monitoring-memory-policy">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Connected Clients</div>
+                                    <div class="fw-semibold" id="redis-monitoring-connected-clients">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Ops/sec</div>
+                                    <div class="fw-semibold" id="redis-monitoring-ops-per-sec">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Keyspace Hit Rate</div>
+                                    <div class="fw-semibold" id="redis-monitoring-hit-rate">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Tracked Keys</div>
+                                    <div class="fw-semibold" id="redis-monitoring-key-count">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">DAI Version Markers</div>
+                                    <div class="fw-semibold" id="redis-monitoring-dai-version-markers">Not loaded</div>
+                                    <div class="text-muted small" id="redis-monitoring-dai-version-marker-expiry">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">DAI Cache Payloads</div>
+                                    <div class="fw-semibold" id="redis-monitoring-dai-payload-keys">Not loaded</div>
+                                    <div class="text-muted small" id="redis-monitoring-dai-version-ttl-policy">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Expired / Evicted Keys</div>
+                                    <div class="fw-semibold">
+                                        <span id="redis-monitoring-expired-keys">Not loaded</span>
+                                        /
+                                        <span id="redis-monitoring-evicted-keys">Not loaded</span>
+                                    </div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Fragmentation Ratio</div>
+                                    <div class="fw-semibold" id="redis-monitoring-fragmentation">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Error Replies</div>
+                                    <div class="fw-semibold" id="redis-monitoring-errors">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Rejected Connections</div>
+                                    <div class="fw-semibold" id="redis-monitoring-rejected-connections">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Redis Version</div>
+                                    <div class="fw-semibold" id="redis-monitoring-version">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-3">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Monitoring Source</div>
+                                    <div class="fw-semibold" id="redis-monitoring-source">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Last Checked</div>
+                                    <div class="fw-semibold" id="redis-monitoring-checked-at">Not loaded</div>
+                                </div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="border rounded p-3 h-100">
+                                    <div class="text-muted small">Last Error</div>
+                                    <div class="fw-semibold" id="redis-monitoring-last-error">Not loaded</div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="redisExplorerModal" tabindex="-1" aria-labelledby="redisExplorerModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-xl modal-dialog-scrollable redis-explorer-dialog">
+                        <div class="modal-content redis-explorer-content">
+                            <div class="modal-header">
+                                <div>
+                                    <h5 class="modal-title" id="redisExplorerModalLabel">
+                                        <i class="bi bi-search me-2"></i>Redis Explorer
+                                    </h5>
+                                    <div class="small text-muted">
+                                        Read-only key browser with cursor pagination and sanitized value previews.
+                                    </div>
+                                </div>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body redis-explorer-body d-flex flex-column">
+                                <div class="redis-explorer-alerts">
+                                    <div class="alert alert-warning small mb-2">
+                                        <i class="bi bi-shield-lock me-2" aria-hidden="true"></i>
+                                        Value previews are sanitized and restricted for session, token, cookie, credential, password, and secret-like keys. Use this for troubleshooting cache behavior, not for exporting Redis data.
+                                    </div>
+                                    <div class="alert alert-info small mb-3">
+                                        <i class="bi bi-info-circle me-2" aria-hidden="true"></i>
+                                        Leave the filter blank and select <span class="fw-semibold">Browse All</span> to page through Redis keys. Cache keys may use uppercase names, prefixes, or internal identifiers; for example, app settings cache entries are stored as <span class="font-monospace">APP_SETTINGS_CACHE</span> and <span class="font-monospace">APP_SETTINGS_CACHE_VERSION</span>.
+                                    </div>
+                                    <div id="redis-explorer-message" class="alert alert-info d-none" role="status" aria-live="polite"></div>
+                                </div>
+                                <div class="row g-3 align-items-end mb-3 redis-explorer-toolbar">
+                                    <div class="col-md-7">
+                                        <label for="redis-explorer-filter" class="form-label">Key Filter</label>
+                                        <input
+                                            type="search"
+                                            class="form-control"
+                                            id="redis-explorer-filter"
+                                            placeholder="Leave blank to browse all keys, or type a substring"
+                                            autocomplete="off"
+                                            data-ignore-settings-change="true"
+                                        >
+                                        <div class="form-text">
+                                            Blank filter browses all keys. Filters are case sensitive. Redis SCAN order is server-defined, so use Next Page to keep browsing.
+                                        </div>
+                                    </div>
+                                    <div class="col-md-2">
+                                        <label for="redis-explorer-page-size" class="form-label">Page Size</label>
+                                        <select class="form-select" id="redis-explorer-page-size" data-ignore-settings-change="true">
+                                            <option value="10">10</option>
+                                            <option value="25" selected>25</option>
+                                            <option value="50">50</option>
+                                            <option value="100">100</option>
+                                        </select>
+                                    </div>
+                                    <div class="col-md-3 d-flex flex-wrap gap-2">
+                                        <button type="button" class="btn btn-primary flex-fill" id="redis-explorer-browse-all-btn">
+                                            Browse All
+                                        </button>
+                                        <button type="button" class="btn btn-primary flex-fill" id="redis-explorer-search-btn">
+                                            Apply Filter
+                                        </button>
+                                        <button type="button" class="btn btn-outline-secondary flex-fill" id="redis-explorer-refresh-btn">
+                                            Refresh
+                                        </button>
+                                    </div>
+                                </div>
+                                <div class="row g-3 redis-explorer-browser">
+                                    <div class="col-lg-5 redis-explorer-column d-flex flex-column">
+                                        <div class="d-flex justify-content-between align-items-center mb-2">
+                                            <div class="fw-semibold">Keys</div>
+                                            <div class="small text-muted" id="redis-explorer-key-count">Not loaded</div>
+                                        </div>
+                                        <div class="list-group redis-explorer-key-list border rounded" id="redis-explorer-key-list" role="listbox" aria-label="Redis keys"></div>
+                                        <div class="d-flex justify-content-between align-items-center mt-2 redis-explorer-pagination">
+                                            <button type="button" class="btn btn-outline-secondary btn-sm" id="redis-explorer-prev-btn" disabled>
+                                                Previous Page
+                                            </button>
+                                            <button type="button" class="btn btn-outline-secondary btn-sm" id="redis-explorer-next-btn" disabled>
+                                                Next Page
+                                            </button>
+                                        </div>
+                                    </div>
+                                    <div class="col-lg-7 redis-explorer-column d-flex flex-column">
+                                        <div class="border rounded p-3 h-100 redis-explorer-preview-card d-flex flex-column">
+                                            <div id="redis-explorer-preview-empty" class="text-muted">
+                                                Select a key to view sanitized metadata and preview content.
+                                            </div>
+                                            <div id="redis-explorer-preview-panel" class="d-none">
+                                                <div class="row g-2 mb-3">
+                                                    <div class="col-md-12">
+                                                        <div class="small text-muted">Key</div>
+                                                        <div class="fw-semibold text-break" id="redis-explorer-preview-key">Not loaded</div>
+                                                    </div>
+                                                    <div class="col-md-3">
+                                                        <div class="small text-muted">Type</div>
+                                                        <div class="fw-semibold" id="redis-explorer-preview-type">Not loaded</div>
+                                                    </div>
+                                                    <div class="col-md-3">
+                                                        <div class="small text-muted">TTL</div>
+                                                        <div class="fw-semibold" id="redis-explorer-preview-ttl">Not loaded</div>
+                                                    </div>
+                                                    <div class="col-md-3">
+                                                        <div class="small text-muted">Memory</div>
+                                                        <div class="fw-semibold" id="redis-explorer-preview-memory">Not loaded</div>
+                                                    </div>
+                                                    <div class="col-md-3">
+                                                        <div class="small text-muted">Sanitization</div>
+                                                        <div class="fw-semibold" id="redis-explorer-preview-redacted">Not loaded</div>
+                                                    </div>
+                                                </div>
+                                                <div class="border rounded bg-body-tertiary p-3 mb-3 d-none" id="redis-explorer-resolution-card">
+                                                    <div class="small text-muted mb-1">SimpleChat Resolution</div>
+                                                    <div class="fw-semibold" id="redis-explorer-resolution-kind">Not resolved</div>
+                                                    <div class="small text-muted" id="redis-explorer-resolution-entity">Not resolved</div>
+                                                    <div class="small text-muted text-break" id="redis-explorer-resolution-scope">Not resolved</div>
+                                                    <div class="small text-muted" id="redis-explorer-resolution-note">Not resolved</div>
+                                                </div>
+                                                <label for="redis-explorer-preview-content" class="form-label">Sanitized Preview</label>
+                                                <pre class="border rounded bg-body-tertiary p-3 small text-break mb-0 redis-explorer-preview-content" id="redis-explorer-preview-content" tabindex="0">Not loaded</pre>
+                                            </div>
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="conversation-cache-section" data-testid="conversation-cache-section">
+                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
+                        <div>
+                            <h5 class="mb-1">
+                                <i class="bi bi-chat-square-text me-2"></i>Conversation Cache
+                            </h5>
+                            <p class="text-muted mb-0">
+                                Cache conversation list, feed, and advanced-search results per user. Redis is optional; cache misses and disabled cache paths continue using source Cosmos queries.
+                            </p>
+                        </div>
+                        <button type="button" class="btn btn-outline-secondary btn-sm" id="conversation-cache-refresh-btn">
+                            <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh Metrics
+                        </button>
+                    </div>
+                    <div class="row g-3 align-items-start">
+                        <div class="col-md-6">
+                            <div class="form-check form-switch">
+                                <input
+                                    class="form-check-input"
+                                    type="checkbox"
+                                    role="switch"
+                                    id="enable_conversation_cache"
+                                    name="enable_conversation_cache"
+                                    {% if settings.enable_conversation_cache | default(true) %}checked{% endif %}
+                                    aria-describedby="conversation-cache-help"
+                                >
+                                <label class="form-check-label" for="enable_conversation_cache">
+                                    Enable conversation cache
+                                </label>
+                            </div>
+                            <div class="form-text" id="conversation-cache-help">When enabled, list/feed/search payloads are cached by user and version. Disabling this bypasses cache reads and writes without requiring Redis.</div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <label for="conversation_cache_ttl_seconds" class="form-label">Cache TTL Seconds</label>
+                            <input
+                                type="number"
+                                class="form-control"
+                                id="conversation_cache_ttl_seconds"
+                                name="conversation_cache_ttl_seconds"
+                                min="0"
+                                value="{{ settings.conversation_cache_ttl_seconds | default(120) }}"
+                                aria-describedby="conversation-cache-ttl-help"
+                            >
+                            <div class="form-text" id="conversation-cache-ttl-help">Default 120 seconds. User-scoped version invalidation refreshes changed conversations; set to 0 to skip writing new entries.</div>
+                        </div>
+                    </div>
+                    <div class="row g-3 mt-1">
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Runtime Status</div>
+                                <span class="badge text-bg-secondary" id="conversation-cache-runtime-status">Not loaded</span>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Cache Hit Rate</div>
+                                <div class="fw-semibold" id="conversation-cache-15m-hit-rate">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Cache Hits / Misses</div>
+                                <div class="fw-semibold" id="conversation-cache-15m-hits-misses">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Cache Bypasses / Errors</div>
+                                <div class="fw-semibold" id="conversation-cache-15m-bypasses-errors">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Writes / Invalidations</div>
+                                <div class="fw-semibold" id="conversation-cache-15m-writes-invalidations">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">15m Operation Mix</div>
+                                <div class="fw-semibold text-break" id="conversation-cache-15m-operation-counts">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last Cache Event</div>
+                                <div class="fw-semibold text-break" id="conversation-cache-last-event">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-md-6 col-xl-3">
+                            <div class="border rounded p-2 h-100">
+                                <div class="small text-muted">Last Invalidation</div>
+                                <div class="fw-semibold text-break" id="conversation-cache-last-invalidation">Not loaded</div>
+                            </div>
+                        </div>
+                        <div class="col-12">
+                            <div class="alert alert-secondary small mb-0">
+                                <i class="bi bi-speedometer2 me-2" aria-hidden="true"></i>
+                                Conversation cache metrics are lightweight in-process counters for the current app worker. Application Insights logs remain the durable fleet-wide source for cache warnings and fallback behavior.
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/restore.html b/application/single_app/templates/admin/_panes/restore.html
new file mode 100644
index 000000000..6b8e1ff5a
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/restore.html
@@ -0,0 +1,147 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'restore' %} show active{% endif %}" id="restore" role="tabpanel" aria-labelledby="restore-tab" data-testid="restore-tab-pane" data-ignore-settings-change="true">
+                <div class="card p-4 mb-4 border-primary shadow-sm" id="data-management-backup-inventory-section">
+                    <div class="d-flex flex-wrap align-items-start justify-content-between gap-3 mb-3">
+                        <div>
+                            <h4 class="mb-1">Backup Inventory</h4>
+                            <p class="text-muted mb-0 small">Track completed full and partial backups created by Data Management jobs.</p>
+                        </div>
+                        <div class="d-flex flex-wrap align-items-center gap-2">
+                            <button type="button" class="btn btn-outline-danger btn-sm" id="data-management-run-retention-cleanup-btn"
+                                    data-bs-toggle="tooltip" data-bs-placement="bottom"
+                                    title="Permanently deletes backups older than the configured retention period, along with their stored artifacts. Backups still inside the retention window are never touched.">
+                                <i class="bi bi-trash3 me-1"></i>Run Retention Cleanup
+                            </button>
+                            <button type="button" class="btn btn-link btn-sm p-0 text-decoration-none" id="data-management-retention-cleanup-info-btn"
+                                    data-bs-toggle="collapse" data-bs-target="#data-management-retention-cleanup-help"
+                                    aria-expanded="false" aria-controls="data-management-retention-cleanup-help"
+                                    aria-label="What does Run Retention Cleanup do?">
+                                <i class="bi bi-info-circle" aria-hidden="true"></i>
+                            </button>
+                            <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-refresh-backups-btn">
+                                <i class="bi bi-arrow-clockwise me-1"></i>Refresh
+                            </button>
+                        </div>
+                    </div>
+                    <div class="collapse mb-3" id="data-management-retention-cleanup-help">
+                        <div class="alert alert-info small mb-0" role="note">
+                            <div class="fw-semibold mb-1"><i class="bi bi-info-circle me-1" aria-hidden="true"></i>What does Run Retention Cleanup do?</div>
+                            <p class="mb-2">
+                                It permanently deletes backups whose age exceeds the retention period configured in Data Management settings,
+                                and removes their stored artifacts from the backup container. Backups newer than the retention cutoff are left alone.
+                            </p>
+                            <ul class="mb-2 ps-3">
+                                <li>Only backups in a finished state are eligible; running or queued jobs are skipped.</li>
+                                <li>When <em>Keep latest full backup</em> is enabled, the most recent successful full backup is protected even if it is past the cutoff.</li>
+                                <li>Each run deletes at most 25 backups, so very large cleanups may need several runs.</li>
+                                <li>Cleanup also runs automatically on the configured schedule; this button just runs it now.</li>
+                            </ul>
+                            <p class="mb-0 text-muted">
+                                Seeing &ldquo;found no expired backups to delete&rdquo; means every backup is still inside the retention window. That is expected, not an error.
+                            </p>
+                        </div>
+                    </div>
+                    <div class="row g-3 mb-3" role="group" aria-label="Backup inventory filters">
+                        <div class="col-lg-4">
+                            <button type="button" class="btn btn-primary w-100 h-100 text-start" id="data-management-view-all-backups-btn" data-backup-filter="all" aria-pressed="true">
+                                <span class="d-flex align-items-center gap-2 small text-white-50">
+                                    <i class="bi bi-check-circle"></i>
+                                    <span>Available backups</span>
+                                </span>
+                                <span class="d-block fs-3 fw-semibold" id="data-management-available-backup-count">0</span>
+                                <span class="d-block small text-white-50">Completed backups ready to inspect or restore later.</span>
+                            </button>
+                        </div>
+                        <div class="col-lg-4">
+                            <button type="button" class="btn btn-outline-primary w-100 h-100 text-start" id="data-management-view-full-backups-btn" data-backup-filter="full" aria-pressed="false">
+                                <span class="d-flex align-items-center gap-2 small text-muted">
+                                    <i class="bi bi-archive"></i>
+                                    <span>Full backups</span>
+                                </span>
+                                <span class="d-block fs-3 fw-semibold" id="data-management-full-backup-count">0</span>
+                                <span class="d-block small text-muted">Complete snapshots across the selected backup surfaces.</span>
+                            </button>
+                        </div>
+                        <div class="col-lg-4">
+                            <button type="button" class="btn btn-outline-primary w-100 h-100 text-start" id="data-management-view-partial-backups-btn" data-backup-filter="partial" aria-pressed="false">
+                                <span class="d-flex align-items-center gap-2 small text-muted">
+                                    <i class="bi bi-archive-fill"></i>
+                                    <span>Partial backups</span>
+                                </span>
+                                <span class="d-block fs-3 fw-semibold" id="data-management-partial-backup-count">0</span>
+                                <span class="d-block small text-muted">Daily change captures between full backup windows.</span>
+                            </button>
+                        </div>
+                    </div>
+                    <div class="row g-2 align-items-end mb-3" aria-label="Backup inventory query filters">
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_backup_status_filter">Status</label>
+                            <select class="form-select form-select-sm" id="data_management_backup_status_filter">
+                                <option value="available" selected>Available</option>
+                                <option value="">All statuses</option>
+                                <option value="completed">Completed</option>
+                                <option value="completed_with_warnings">Completed with warnings</option>
+                                <option value="queued">Queued</option>
+                                <option value="running">Running</option>
+                                <option value="failed">Failed</option>
+                                <option value="canceled">Canceled</option>
+                            </select>
+                        </div>
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_backup_scheduled_filter">Run type</label>
+                            <select class="form-select form-select-sm" id="data_management_backup_scheduled_filter">
+                                <option value="all" selected>Scheduled and manual</option>
+                                <option value="scheduled">Scheduled</option>
+                                <option value="manual">Manual</option>
+                            </select>
+                        </div>
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_backup_created_from">Created from</label>
+                            <input class="form-control form-control-sm" type="date" id="data_management_backup_created_from" />
+                        </div>
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_backup_created_to">Created through</label>
+                            <input class="form-control form-control-sm" type="date" id="data_management_backup_created_to" />
+                        </div>
+                        <div class="col-sm-6 col-lg-2">
+                            <label class="form-label small" for="data_management_backup_page_size">Rows per page</label>
+                            <select class="form-select form-select-sm" id="data_management_backup_page_size">
+                                <option value="10">10</option>
+                                <option value="25" selected>25</option>
+                                <option value="50">50</option>
+                                <option value="100">100</option>
+                            </select>
+                        </div>
+                    </div>
+                    <div class="table-responsive">
+                        <table class="table table-sm align-middle">
+                            <thead>
+                                <tr>
+                                    <th scope="col">Backup</th>
+                                    <th scope="col">Completed</th>
+                                    <th scope="col">Contents</th>
+                                    <th scope="col">Storage</th>
+                                    <th scope="col">Protection</th>
+                                    <th scope="col">Warnings</th>
+                                    <th scope="col">Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="data-management-backups-tbody">
+                                <tr>
+                                    <td colspan="7" class="text-muted">Backup inventory has not loaded yet.</td>
+                                </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                    <nav class="d-flex flex-wrap align-items-center justify-content-between gap-2" aria-label="Backup inventory pagination">
+                        <span class="small text-muted" id="data-management-backup-pagination-status" role="status" aria-live="polite">Page 1 has not loaded yet.</span>
+                        <div class="btn-group btn-group-sm" role="group" aria-label="Backup inventory pages">
+                            <button type="button" class="btn btn-outline-secondary" id="data-management-backup-previous-page-btn" disabled aria-disabled="true">
+                                <i class="bi bi-chevron-left me-1"></i>Previous
+                            </button>
+                            <button type="button" class="btn btn-outline-secondary" id="data-management-backup-next-page-btn" disabled aria-disabled="true">
+                                Next<i class="bi bi-chevron-right ms-1"></i>
+                            </button>
+                        </div>
+                    </nav>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/retention.html b/application/single_app/templates/admin/_panes/retention.html
new file mode 100644
index 000000000..1e90230a4
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/retention.html
@@ -0,0 +1,268 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'retention' %} show active{% endif %}" id="retention" role="tabpanel" aria-labelledby="retention-tab">
+                <div class="card p-3 mb-3" id="retention-policy-section">
+                    <h5>
+                        <i class="bi bi-hourglass-split me-2"></i>Retention Policy
+                    </h5>
+                    <p class="text-muted">Automatically delete aged conversations and documents based on configurable retention periods. Users, group owners, and public workspace admins can set their own retention policies.</p>
+
+                    <div class="alert alert-info mb-3" role="alert">
+                        <i class="bi bi-info-circle me-2"></i>
+                        <strong>How it works:</strong> Enable retention policy for workspace types below. Users/owners can then configure how many days to retain conversations and documents. Items older than the configured period are automatically deleted. Default is "none" (no deletion) until explicitly set by each user/owner.
+                    </div>
+
+                    <!-- Enable toggles for different workspace types -->
+                    <div class="row g-3 mb-3">
+                        <div class="col-md-4">
+                            <div class="form-check form-switch">
+                                <input class="form-check-input" type="checkbox" role="switch" id="enable_retention_policy_personal" name="enable_retention_policy_personal" {% if settings.enable_retention_policy_personal %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="enable_retention_policy_personal">
+                                    Enable for Personal Workspaces
+                                </label>
+                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to configure retention policies for their personal conversations and documents."></i>
+                            </div>
+                        </div>
+                        <div class="col-md-4">
+                            <div class="form-check form-switch">
+                                <input class="form-check-input" type="checkbox" role="switch" id="enable_retention_policy_group" name="enable_retention_policy_group" {% if settings.enable_retention_policy_group %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="enable_retention_policy_group">
+                                    Enable for Group Workspaces
+                                </label>
+                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow group owners and admins to configure retention policies for group conversations and documents."></i>
+                            </div>
+                        </div>
+                        <div class="col-md-4">
+                            <div class="form-check form-switch">
+                                <input class="form-check-input" type="checkbox" role="switch" id="enable_retention_policy_public" name="enable_retention_policy_public" {% if settings.enable_retention_policy_public %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="enable_retention_policy_public">
+                                    Enable for Public Workspaces
+                                </label>
+                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow public workspace owners and admins to configure retention policies for workspace conversations and documents."></i>
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Default Retention Policy Settings -->
+                    <div class="card bg-light p-3 mb-3">
+                        <h6 class="mb-3"><i class="bi bi-sliders me-2"></i>Default Retention Policies</h6>
+                        <p class="text-muted small mb-3">Set organization-wide default retention periods for each workspace type. Users can override these defaults with their own preferences. Setting a default here means new users/workspaces will start with this retention period.</p>
+
+                        <!-- Personal Workspace Defaults -->
+                        <div class="row g-3 mb-3" id="retention_defaults_personal" style="{% if not settings.enable_retention_policy_personal %}display: none;{% endif %}">
+                            <div class="col-12">
+                                <label class="form-label fw-bold"><i class="bi bi-person me-1"></i>Personal Workspace Defaults</label>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_conversation_personal" class="form-label">Conversation Retention</label>
+                                <select class="form-select" id="default_retention_conversation_personal" name="default_retention_conversation_personal">
+                                    <option value="none" {% if settings.default_retention_conversation_personal == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_conversation_personal == '1' or settings.default_retention_conversation_personal == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="2" {% if settings.default_retention_conversation_personal == '2' or settings.default_retention_conversation_personal == 2 %}selected{% endif %}>2 days</option>
+                                    <option value="3" {% if settings.default_retention_conversation_personal == '3' or settings.default_retention_conversation_personal == 3 %}selected{% endif %}>3 days</option>
+                                    <option value="4" {% if settings.default_retention_conversation_personal == '4' or settings.default_retention_conversation_personal == 4 %}selected{% endif %}>4 days</option>
+                                    <option value="5" {% if settings.default_retention_conversation_personal == '5' or settings.default_retention_conversation_personal == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="6" {% if settings.default_retention_conversation_personal == '6' or settings.default_retention_conversation_personal == 6 %}selected{% endif %}>6 days</option>
+                                    <option value="7" {% if settings.default_retention_conversation_personal == '7' or settings.default_retention_conversation_personal == 7 %}selected{% endif %}>7 days (1 week)</option>
+                                    <option value="10" {% if settings.default_retention_conversation_personal == '10' or settings.default_retention_conversation_personal == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="14" {% if settings.default_retention_conversation_personal == '14' or settings.default_retention_conversation_personal == 14 %}selected{% endif %}>14 days (2 weeks)</option>
+                                    <option value="21" {% if settings.default_retention_conversation_personal == '21' or settings.default_retention_conversation_personal == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_conversation_personal == '30' or settings.default_retention_conversation_personal == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_conversation_personal == '60' or settings.default_retention_conversation_personal == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_conversation_personal == '90' or settings.default_retention_conversation_personal == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_conversation_personal == '180' or settings.default_retention_conversation_personal == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_conversation_personal == '365' or settings.default_retention_conversation_personal == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_conversation_personal == '730' or settings.default_retention_conversation_personal == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_document_personal" class="form-label">Document Retention</label>
+                                <select class="form-select" id="default_retention_document_personal" name="default_retention_document_personal">
+                                    <option value="none" {% if settings.default_retention_document_personal == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_document_personal == '1' or settings.default_retention_document_personal == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="2" {% if settings.default_retention_document_personal == '2' or settings.default_retention_document_personal == 2 %}selected{% endif %}>2 days</option>
+                                    <option value="3" {% if settings.default_retention_document_personal == '3' or settings.default_retention_document_personal == 3 %}selected{% endif %}>3 days</option>
+                                    <option value="4" {% if settings.default_retention_document_personal == '4' or settings.default_retention_document_personal == 4 %}selected{% endif %}>4 days</option>
+                                    <option value="5" {% if settings.default_retention_document_personal == '5' or settings.default_retention_document_personal == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="6" {% if settings.default_retention_document_personal == '6' or settings.default_retention_document_personal == 6 %}selected{% endif %}>6 days</option>
+                                    <option value="7" {% if settings.default_retention_document_personal == '7' or settings.default_retention_document_personal == 7 %}selected{% endif %}>7 days (1 week)</option>
+                                    <option value="10" {% if settings.default_retention_document_personal == '10' or settings.default_retention_document_personal == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="14" {% if settings.default_retention_document_personal == '14' or settings.default_retention_document_personal == 14 %}selected{% endif %}>14 days (2 weeks)</option>
+                                    <option value="21" {% if settings.default_retention_document_personal == '21' or settings.default_retention_document_personal == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_document_personal == '30' or settings.default_retention_document_personal == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_document_personal == '60' or settings.default_retention_document_personal == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_document_personal == '90' or settings.default_retention_document_personal == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_document_personal == '180' or settings.default_retention_document_personal == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_document_personal == '365' or settings.default_retention_document_personal == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_document_personal == '730' or settings.default_retention_document_personal == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                        </div>
+
+                        <!-- Group Workspace Defaults -->
+                        <div class="row g-3 mb-3" id="retention_defaults_group" style="{% if not settings.enable_retention_policy_group %}display: none;{% endif %}">
+                            <div class="col-12">
+                                <label class="form-label fw-bold"><i class="bi bi-people me-1"></i>Group Workspace Defaults</label>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_conversation_group" class="form-label">Conversation Retention</label>
+                                <select class="form-select" id="default_retention_conversation_group" name="default_retention_conversation_group">
+                                    <option value="none" {% if settings.default_retention_conversation_group == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_conversation_group == '1' or settings.default_retention_conversation_group == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="2" {% if settings.default_retention_conversation_group == '2' or settings.default_retention_conversation_group == 2 %}selected{% endif %}>2 days</option>
+                                    <option value="3" {% if settings.default_retention_conversation_group == '3' or settings.default_retention_conversation_group == 3 %}selected{% endif %}>3 days</option>
+                                    <option value="4" {% if settings.default_retention_conversation_group == '4' or settings.default_retention_conversation_group == 4 %}selected{% endif %}>4 days</option>
+                                    <option value="5" {% if settings.default_retention_conversation_group == '5' or settings.default_retention_conversation_group == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="6" {% if settings.default_retention_conversation_group == '6' or settings.default_retention_conversation_group == 6 %}selected{% endif %}>6 days</option>
+                                    <option value="7" {% if settings.default_retention_conversation_group == '7' or settings.default_retention_conversation_group == 7 %}selected{% endif %}>7 days (1 week)</option>
+                                    <option value="10" {% if settings.default_retention_conversation_group == '10' or settings.default_retention_conversation_group == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="14" {% if settings.default_retention_conversation_group == '14' or settings.default_retention_conversation_group == 14 %}selected{% endif %}>14 days (2 weeks)</option>
+                                    <option value="21" {% if settings.default_retention_conversation_group == '21' or settings.default_retention_conversation_group == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_conversation_group == '30' or settings.default_retention_conversation_group == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_conversation_group == '60' or settings.default_retention_conversation_group == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_conversation_group == '90' or settings.default_retention_conversation_group == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_conversation_group == '180' or settings.default_retention_conversation_group == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_conversation_group == '365' or settings.default_retention_conversation_group == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_conversation_group == '730' or settings.default_retention_conversation_group == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_document_group" class="form-label">Document Retention</label>
+                                <select class="form-select" id="default_retention_document_group" name="default_retention_document_group">
+                                    <option value="none" {% if settings.default_retention_document_group == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_document_group == '1' or settings.default_retention_document_group == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="2" {% if settings.default_retention_document_group == '2' or settings.default_retention_document_group == 2 %}selected{% endif %}>2 days</option>
+                                    <option value="3" {% if settings.default_retention_document_group == '3' or settings.default_retention_document_group == 3 %}selected{% endif %}>3 days</option>
+                                    <option value="4" {% if settings.default_retention_document_group == '4' or settings.default_retention_document_group == 4 %}selected{% endif %}>4 days</option>
+                                    <option value="5" {% if settings.default_retention_document_group == '5' or settings.default_retention_document_group == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="6" {% if settings.default_retention_document_group == '6' or settings.default_retention_document_group == 6 %}selected{% endif %}>6 days</option>
+                                    <option value="7" {% if settings.default_retention_document_group == '7' or settings.default_retention_document_group == 7 %}selected{% endif %}>7 days (1 week)</option>
+                                    <option value="10" {% if settings.default_retention_document_group == '10' or settings.default_retention_document_group == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="14" {% if settings.default_retention_document_group == '14' or settings.default_retention_document_group == 14 %}selected{% endif %}>14 days (2 weeks)</option>
+                                    <option value="21" {% if settings.default_retention_document_group == '21' or settings.default_retention_document_group == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_document_group == '30' or settings.default_retention_document_group == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_document_group == '60' or settings.default_retention_document_group == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_document_group == '90' or settings.default_retention_document_group == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_document_group == '180' or settings.default_retention_document_group == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_document_group == '365' or settings.default_retention_document_group == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_document_group == '730' or settings.default_retention_document_group == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                        </div>
+
+                        <!-- Public Workspace Defaults -->
+                        <div class="row g-3" id="retention_defaults_public" style="{% if not settings.enable_retention_policy_public %}display: none;{% endif %}">
+                            <div class="col-12">
+                                <label class="form-label fw-bold"><i class="bi bi-globe me-1"></i>Public Workspace Defaults</label>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_conversation_public" class="form-label">Conversation Retention</label>
+                                <select class="form-select" id="default_retention_conversation_public" name="default_retention_conversation_public">
+                                    <option value="none" {% if settings.default_retention_conversation_public == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_conversation_public == '1' or settings.default_retention_conversation_public == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="2" {% if settings.default_retention_conversation_public == '2' or settings.default_retention_conversation_public == 2 %}selected{% endif %}>2 days</option>
+                                    <option value="3" {% if settings.default_retention_conversation_public == '3' or settings.default_retention_conversation_public == 3 %}selected{% endif %}>3 days</option>
+                                    <option value="4" {% if settings.default_retention_conversation_public == '4' or settings.default_retention_conversation_public == 4 %}selected{% endif %}>4 days</option>
+                                    <option value="5" {% if settings.default_retention_conversation_public == '5' or settings.default_retention_conversation_public == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="6" {% if settings.default_retention_conversation_public == '6' or settings.default_retention_conversation_public == 6 %}selected{% endif %}>6 days</option>
+                                    <option value="7" {% if settings.default_retention_conversation_public == '7' or settings.default_retention_conversation_public == 7 %}selected{% endif %}>7 days (1 week)</option>
+                                    <option value="10" {% if settings.default_retention_conversation_public == '10' or settings.default_retention_conversation_public == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="14" {% if settings.default_retention_conversation_public == '14' or settings.default_retention_conversation_public == 14 %}selected{% endif %}>14 days (2 weeks)</option>
+                                    <option value="21" {% if settings.default_retention_conversation_public == '21' or settings.default_retention_conversation_public == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_conversation_public == '30' or settings.default_retention_conversation_public == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_conversation_public == '60' or settings.default_retention_conversation_public == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_conversation_public == '90' or settings.default_retention_conversation_public == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_conversation_public == '180' or settings.default_retention_conversation_public == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_conversation_public == '365' or settings.default_retention_conversation_public == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_conversation_public == '730' or settings.default_retention_conversation_public == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="default_retention_document_public" class="form-label">Document Retention</label>
+                                <select class="form-select" id="default_retention_document_public" name="default_retention_document_public">
+                                    <option value="none" {% if settings.default_retention_document_public == 'none' %}selected{% endif %}>No automatic deletion</option>
+                                    <option value="1" {% if settings.default_retention_document_public == '1' or settings.default_retention_document_public == 1 %}selected{% endif %}>1 day</option>
+                                    <option value="2" {% if settings.default_retention_document_public == '2' or settings.default_retention_document_public == 2 %}selected{% endif %}>2 days</option>
+                                    <option value="3" {% if settings.default_retention_document_public == '3' or settings.default_retention_document_public == 3 %}selected{% endif %}>3 days</option>
+                                    <option value="4" {% if settings.default_retention_document_public == '4' or settings.default_retention_document_public == 4 %}selected{% endif %}>4 days</option>
+                                    <option value="5" {% if settings.default_retention_document_public == '5' or settings.default_retention_document_public == 5 %}selected{% endif %}>5 days</option>
+                                    <option value="6" {% if settings.default_retention_document_public == '6' or settings.default_retention_document_public == 6 %}selected{% endif %}>6 days</option>
+                                    <option value="7" {% if settings.default_retention_document_public == '7' or settings.default_retention_document_public == 7 %}selected{% endif %}>7 days (1 week)</option>
+                                    <option value="10" {% if settings.default_retention_document_public == '10' or settings.default_retention_document_public == 10 %}selected{% endif %}>10 days</option>
+                                    <option value="14" {% if settings.default_retention_document_public == '14' or settings.default_retention_document_public == 14 %}selected{% endif %}>14 days (2 weeks)</option>
+                                    <option value="21" {% if settings.default_retention_document_public == '21' or settings.default_retention_document_public == 21 %}selected{% endif %}>21 days (3 weeks)</option>
+                                    <option value="30" {% if settings.default_retention_document_public == '30' or settings.default_retention_document_public == 30 %}selected{% endif %}>30 days</option>
+                                    <option value="60" {% if settings.default_retention_document_public == '60' or settings.default_retention_document_public == 60 %}selected{% endif %}>60 days</option>
+                                    <option value="90" {% if settings.default_retention_document_public == '90' or settings.default_retention_document_public == 90 %}selected{% endif %}>90 days (3 months)</option>
+                                    <option value="180" {% if settings.default_retention_document_public == '180' or settings.default_retention_document_public == 180 %}selected{% endif %}>180 days (6 months)</option>
+                                    <option value="365" {% if settings.default_retention_document_public == '365' or settings.default_retention_document_public == 365 %}selected{% endif %}>365 days (1 year)</option>
+                                    <option value="730" {% if settings.default_retention_document_public == '730' or settings.default_retention_document_public == 730 %}selected{% endif %}>730 days (2 years)</option>
+                                </select>
+                            </div>
+                        </div>
+
+                        <!-- Force Push Button -->
+                        <div class="row g-3 mt-3">
+                            <div class="col-12">
+                                <div class="alert alert-warning mb-2">
+                                    <i class="bi bi-exclamation-triangle me-2"></i>
+                                    <strong>Force Push:</strong> Override all user/group/workspace custom retention policies with the organization defaults above. Users will then use the organization default until they set their own preference.
+                                </div>
+                                <button type="button" class="btn btn-warning" onclick="showForcePushModal()">
+                                    <i class="bi bi-arrow-repeat me-2"></i>Force Push Defaults to All
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Scheduled execution time -->
+                    <div class="mb-3">
+                        <label for="retention_policy_execution_hour" class="form-label">Scheduled Execution Time (Hour of Day)</label>
+                        <select class="form-select" id="retention_policy_execution_hour" name="retention_policy_execution_hour" style="max-width: 300px;">
+                            {% for hour in range(24) %}
+                            <option value="{{ hour }}" {% if settings.retention_policy_execution_hour == hour %}selected{% endif %}>
+                                {{ "%02d"|format(hour) }}:00 ({{ "Midnight" if hour == 0 else ("%d AM"|format(hour) if hour < 12 else ("Noon" if hour == 12 else "%d PM"|format(hour - 12))) }})
+                            </option>
+                            {% endfor %}
+                        </select>
+                        <small class="form-text text-muted">Retention policy will run once daily at this hour (UTC timezone).</small>
+                    </div>
+
+                    <!-- Status information -->
+                    <div class="row g-3 mb-3">
+                        <div class="col-md-6">
+                            <label class="form-label">Last Execution:</label>
+                            <div class="form-control-plaintext">
+                                {% if settings.retention_policy_last_run %}
+                                    <span class="text-success">{{ settings.retention_policy_last_run }}</span>
+                                {% else %}
+                                    <span class="text-muted">Never run</span>
+                                {% endif %}
+                            </div>
+                        </div>
+                        <div class="col-md-6">
+                            <label class="form-label">Next Scheduled Execution:</label>
+                            <div class="form-control-plaintext">
+                                {% if settings.retention_policy_next_run %}
+                                    <span class="text-info">{{ settings.retention_policy_next_run }}</span>
+                                {% else %}
+                                    <span class="text-muted">Not scheduled</span>
+                                {% endif %}
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Manual execution button -->
+                    <div class="mt-3">
+                        <button type="button" class="btn btn-warning" onclick="showManualExecutionModal()">
+                            <i class="bi bi-play-circle me-2"></i>Manual Execution
+                        </button>
+                        <small class="form-text text-muted d-block mt-2">
+                            Trigger retention policy execution immediately for selected workspace types, bypassing the scheduled time.
+                        </small>
+                    </div>
+
+                    <div class="alert alert-warning mt-3" role="alert">
+                        <i class="bi bi-exclamation-triangle me-2"></i>
+                        <strong>Important:</strong> Deleted items respect your archiving settings. If conversation archiving is enabled, items will be archived before deletion. Activity logs are created for all deletions.
+                    </div>
+                </div>
+            </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/search-index.html b/application/single_app/templates/admin/_panes/search-index.html
new file mode 100644
index 000000000..285f96da9
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/search-index.html
@@ -0,0 +1,119 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'search-index' %} show active{% endif %}" id="search-index" role="tabpanel" aria-labelledby="search-index-tab">
+                <div class="card p-3 mb-3" id="azure-ai-search-section">
+                    <h5><i class="bi bi-search me-2"></i>Azure AI Search</h5>
+                    <p class="text-muted">
+                        Configure Azure AI Search settings.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                        <input
+                            type="checkbox"
+                            class="form-check-input me-2"
+                            id="enable_ai_search_apim"
+                            name="enable_ai_search_apim"
+                            {% if settings.enable_ai_search_apim %}checked{% endif %}
+                        >
+                        <label class="form-check-label" for="enable_ai_search_apim">
+                            Use APIM instead of direct Azure AI Search
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route Azure AI Search requests through API Management for centralized monitoring and control instead of direct service access."></i>
+                    </div>
+
+                    <div>
+
+                        <div id="non_apim_ai_search_settings" {% if settings.enable_ai_search_apim %}style="display: none;"{% endif %}>
+                            <div class="mb-3">
+                                <label for="azure_ai_search_endpoint" class="form-label">Search Endpoint</label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_ai_search_endpoint"
+                                    name="azure_ai_search_endpoint"
+                                    value="{{ settings.azure_ai_search_endpoint or '' }}"
+                                >
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_ai_search_authentication_type" class="form-label">
+                                    Authentication Type
+                                </label>
+                                <select class="form-select" id="azure_ai_search_authentication_type" name="azure_ai_search_authentication_type">
+                                    <option value="key" {% if settings.azure_ai_search_authentication_type=='key' %}selected{% endif %}>
+                                        Key
+                                    </option>
+                                    <option value="managed_identity" {% if settings.azure_ai_search_authentication_type=='managed_identity' %}selected{% endif %}>
+                                        Managed Identity
+                                    </option>
+                                </select>
+                            </div>
+                            <div class="mb-3" id="azure_ai_search_key_container" {% if settings.azure_ai_search_authentication_type !='key' %}style="display: none;"{% endif %}>
+                                <label for="azure_ai_search_key" class="form-label">Search Key</label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_ai_search_key"
+                                        name="azure_ai_search_key"
+                                        value="{{ settings.azure_ai_search_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_search_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <div id="apim_ai_search_settings" {% if not settings.enable_ai_search_apim %}style="display: none;"{% endif %}>
+                            <div class="mb-3">
+                                <label for="azure_apim_ai_search_endpoint" class="form-label">
+                                    Azure APIM AI Search Endpoint
+                                </label>
+                                <input
+                                    type="text"
+                                    class="form-control"
+                                    id="azure_apim_ai_search_endpoint"
+                                    name="azure_apim_ai_search_endpoint"
+                                    value="{{ settings.azure_apim_ai_search_endpoint or '' }}"
+                                >
+                            </div>
+                            <div class="mb-3">
+                                <label for="azure_apim_ai_search_subscription_key" class="form-label">
+                                    Azure APIM AI Search Subscription Key
+                                </label>
+                                <div class="input-group">
+                                    <input
+                                        type="password"
+                                        class="form-control"
+                                        id="azure_apim_ai_search_subscription_key"
+                                        name="azure_apim_ai_search_subscription_key"
+                                        value="{{ settings.azure_apim_ai_search_subscription_key or '' }}"
+                                    >
+                                    <button
+                                        type="button"
+                                        class="btn btn-outline-secondary"
+                                        id="toggle_azure_apim_ai_search_subscription_key"
+                                    >
+                                        Show
+                                    </button>
+                                </div>
+                            </div>
+                        </div>
+
+
+                        <button
+                            type="button"
+                            class="btn btn-secondary mt-3"
+                            style="width: auto;"
+                            id="test_azure_ai_search_button"
+                        >
+                            Test Azure AI Search Connection
+                        </button>
+                        <div id="test_azure_ai_search_result" class="mt-2"></div>
+                    </div>
+                </div>
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/secrets.html b/application/single_app/templates/admin/_panes/secrets.html
new file mode 100644
index 000000000..dbf36ddc0
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/secrets.html
@@ -0,0 +1,230 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'secrets' %} show active{% endif %}" id="secrets" role="tabpanel" aria-labelledby="secrets-tab">
+                <p class="text-muted">
+                    Manage security settings for key vault and other security configurations.
+                </p>
+                <div class="card p-3 mb-3" id="keyvault-section">
+                    <div class="d-flex justify-content-between align-items-center mb-2">
+                        <h5>
+                            <i class="bi bi-safe me-2"></i>Key Vault
+                        </h5>
+                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#keyVaultInfoModal">
+                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
+                        </button>
+                    </div>
+
+                    <p class="text-muted">
+                        Configure Key Vault settings.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                        <input
+                            type="checkbox"
+                            class="form-check-input me-2"
+                            id="enable_key_vault_secret_storage"
+                            name="enable_key_vault_secret_storage"
+                            {% if settings.enable_key_vault_secret_storage %}checked{% endif %}
+                        >
+                        <label class="form-check-label" for="enable_key_vault_secret_storage">
+                            Enable Key Vault for Agent and Action Secrets
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Store agent and action sensitive information like API keys and secrets securely in Azure Key Vault."></i>
+                    </div>
+
+                    <div id="key_vault_settings" class="{% if not settings.enable_key_vault_secret_storage %}d-none{% endif %}">
+                        <div id="key-vault-warning" class="alert alert-warning mt-2 mb-3">
+                            <strong>⚠️ Warning:</strong> Once you enable Key Vault, you should <u>NOT</u> disable it. Disabling Key Vault after enabling <u>WILL</u> cause loss of access to secrets and break application functionality.
+                        </div>
+                        <div class="mb-3">
+                            <label for="key_vault_name" class="form-label">Key Vault Name</label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="The name of the key vault resource. Endpoint is determined by your AZURE_ENVIRONMENT app service configuration."></i>
+                            <input type="text" class="form-control" id="key_vault_name" name="key_vault_name" value="{{ settings.key_vault_name or '' }}" {% if settings.enable_key_vault_secret_storage %}required{% endif %}>
+                        </div>
+                        <div class="mb-3">
+                            <label for="key_vault_identity" class="form-label">Key Vault Managed Identity Client ID</label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="The Client ID of the User Assigned Managed Identity. Leave blank for system-assigned identity of the app service."></i>
+                            <input type="text" class="form-control" id="key_vault_identity" name="key_vault_identity" value="{{ settings.key_vault_identity or '' }}">
+                        </div>
+                        <button
+                            type="button"
+                            class="btn btn-secondary mt-3"
+                            style="width: auto;"
+                            id="test_key_vault_button"
+                        >
+                            Test Key Vault Connection
+                        </button>
+                        <div id="test_key_vault_result" class="mt-2">
+                        </div>
+
+                        <div class="border-top mt-4 pt-3">
+                            <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-3 mb-3">
+                                <div>
+                                    <h6 class="mb-1">
+                                        <i class="bi bi-bell me-2"></i>Secret Expiration Reminders
+                                    </h6>
+                                    <p class="text-muted small mb-0">
+                                        Track SimpleChat-owned Key Vault secrets with expiration dates, in-app reminders, and an admin inventory that maps opaque secret names back to their owner and source.
+                                    </p>
+                                </div>
+                                <button type="button" class="btn btn-outline-secondary btn-sm" id="key-vault-reminders-refresh">
+                                    <i class="bi bi-arrow-clockwise me-1"></i>Refresh Inventory
+                                </button>
+                            </div>
+
+                            <div class="alert alert-info small" role="alert">
+                                Azure email alerts should still be configured in Azure Monitor or Event Grid for the vault. SimpleChat stores per-secret context so an emailed Key Vault alert can be mapped back to the user, group, action, field, and rotation notes.
+                            </div>
+
+                            <div class="alert alert-light border small" id="key-vault-external-alert-guidance" role="note">
+                                <strong>External automation:</strong> SimpleChat emits a queryable Application Insights event named
+                                <code>key_vault_expiration_reminder_triggered</code> whenever a reminder notification is created.
+                                Use an Azure Monitor scheduled query alert with an action group, Logic App, Function, or webhook to send external notifications. Enable the routing email option below if downstream automation needs to send directly to the configured reminder contact.
+                                <pre class="mt-2 mb-1"><code>traces
+| where customDimensions.sc_event_name == 'key_vault_expiration_reminder_triggered'
+| project timestamp,
+          reminder_id = tostring(customDimensions.sc_event_reminder_id),
+          scope = tostring(customDimensions.sc_event_scope),
+          source_type = tostring(customDimensions.sc_event_source_type),
+          days_until_expiry = toint(customDimensions.sc_event_days_until_expiry),
+          expires_on = tostring(customDimensions.sc_event_expires_on),
+          contact_email = tostring(customDimensions.sc_event_contact_email)</code></pre>
+                                <span class="text-muted">The <code>contact_email</code> column is populated only when the opt-in below is enabled. For workspace-based Log Analytics queries, use the equivalent Application Insights traces table and dimensions/properties fields available in that workspace.</span>
+                            </div>
+
+                            <div class="form-check form-switch mb-3">
+                                <input
+                                    class="form-check-input"
+                                    type="checkbox"
+                                    id="enable_key_vault_secret_expiration_reminders"
+                                    name="enable_key_vault_secret_expiration_reminders"
+                                    {% if settings.enable_key_vault_secret_expiration_reminders %}checked{% endif %}
+                                >
+                                <label class="form-check-label" for="enable_key_vault_secret_expiration_reminders">
+                                    Enable SimpleChat expiration reminder tracking
+                                </label>
+                            </div>
+
+                            <div id="key_vault_expiration_reminder_settings" class="{% if not settings.enable_key_vault_secret_expiration_reminders %}d-none{% endif %}">
+                                <div class="row g-3">
+                                    <div class="col-md-3">
+                                        <label for="key_vault_secret_expiration_default_lead_days" class="form-label">Default lead days</label>
+                                        <input
+                                            type="number"
+                                            min="1"
+                                            max="3650"
+                                            class="form-control"
+                                            id="key_vault_secret_expiration_default_lead_days"
+                                            name="key_vault_secret_expiration_default_lead_days"
+                                            value="{{ settings.key_vault_secret_expiration_default_lead_days or 30 }}"
+                                        >
+                                    </div>
+                                    <div class="col-md-5">
+                                        <label for="key_vault_secret_expiration_default_contact_email" class="form-label">Default reminder email</label>
+                                        <input
+                                            type="email"
+                                            class="form-control"
+                                            id="key_vault_secret_expiration_default_contact_email"
+                                            name="key_vault_secret_expiration_default_contact_email"
+                                            value="{{ settings.key_vault_secret_expiration_default_contact_email or '' }}"
+                                            placeholder="owner@example.com"
+                                        >
+                                    </div>
+                                    <div class="col-md-4">
+                                        <label for="key_vault_secret_expiration_admin_roles" class="form-label">Admin notification roles</label>
+                                        <input
+                                            type="text"
+                                            class="form-control"
+                                            id="key_vault_secret_expiration_admin_roles"
+                                            name="key_vault_secret_expiration_admin_roles"
+                                            value="{{ (settings.key_vault_secret_expiration_admin_roles or ['Admin'])|join(', ') }}"
+                                            placeholder="Admin"
+                                        >
+                                        <div class="form-text">Comma-separated roles for global-scope reminder notifications.</div>
+                                    </div>
+                                    <div class="col-md-4">
+                                        <label for="key_vault_secret_expiration_scan_interval_seconds" class="form-label">Scan interval seconds</label>
+                                        <input
+                                            type="number"
+                                            min="900"
+                                            max="86400"
+                                            class="form-control"
+                                            id="key_vault_secret_expiration_scan_interval_seconds"
+                                            name="key_vault_secret_expiration_scan_interval_seconds"
+                                            value="{{ settings.key_vault_secret_expiration_scan_interval_seconds or 21600 }}"
+                                        >
+                                    </div>
+                                    <div class="col-md-8 d-flex align-items-end">
+                                        <div class="form-check">
+                                            <input
+                                                class="form-check-input"
+                                                type="checkbox"
+                                                id="key_vault_secret_expiration_require_expiration"
+                                                name="key_vault_secret_expiration_require_expiration"
+                                                {% if settings.key_vault_secret_expiration_require_expiration %}checked{% endif %}
+                                            >
+                                            <label class="form-check-label" for="key_vault_secret_expiration_require_expiration">
+                                                Require expiration dates when users enable tracking on new secrets
+                                            </label>
+                                        </div>
+                                    </div>
+                                    <div class="col-md-8">
+                                        <div class="form-check">
+                                            <input
+                                                class="form-check-input"
+                                                type="checkbox"
+                                                id="key_vault_secret_expiration_emit_contact_email_in_telemetry"
+                                                name="key_vault_secret_expiration_emit_contact_email_in_telemetry"
+                                                aria-describedby="key_vault_secret_expiration_emit_contact_email_in_telemetry_help"
+                                                {% if settings.key_vault_secret_expiration_emit_contact_email_in_telemetry %}checked{% endif %}
+                                            >
+                                            <label class="form-check-label" for="key_vault_secret_expiration_emit_contact_email_in_telemetry">
+                                                Include reminder contact email in external telemetry
+                                            </label>
+                                            <div class="form-text" id="key_vault_secret_expiration_emit_contact_email_in_telemetry_help">
+                                                Default off. Enable only when Azure Monitor, Logic Apps, Functions, or webhook automation needs the email address to route notifications directly.
+                                            </div>
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+
+                            <div class="mt-4">
+                                <div class="d-flex flex-column flex-lg-row gap-2 mb-3">
+                                    <input type="search" class="form-control" id="key-vault-reminders-search" placeholder="Search by owner, action, field, email, reminder ID, or secret name">
+                                    <select class="form-select" id="key-vault-reminders-status" aria-label="Reminder status filter">
+                                        <option value="">All statuses</option>
+                                        <option value="active">Active</option>
+                                        <option value="sync_failed">Sync failed</option>
+                                        <option value="disabled">Disabled</option>
+                                    </select>
+                                    <button type="button" class="btn btn-outline-primary" id="key-vault-reminders-run">
+                                        <i class="bi bi-play-circle me-1"></i>Run Sweep
+                                    </button>
+                                </div>
+
+                                <div id="key-vault-reminders-status-message" class="alert d-none" role="alert"></div>
+
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th>Expires</th>
+                                                <th>Scope</th>
+                                                <th>Source</th>
+                                                <th>Field</th>
+                                                <th>Contact</th>
+                                                <th>Status</th>
+                                                <th>Reminder ID</th>
+                                                <th>Secret</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="key-vault-reminders-table-body">
+                                            <tr>
+                                                <td colspan="8" class="text-muted">Refresh inventory to load tracked secrets.</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/send-feedback.html b/application/single_app/templates/admin/_panes/send-feedback.html
new file mode 100644
index 000000000..5acd28833
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/send-feedback.html
@@ -0,0 +1,72 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'send-feedback' %} show active{% endif %}" id="send-feedback" role="tabpanel" aria-labelledby="send-feedback-tab" data-app-version="{{ config['VERSION'] }}">
+                <p class="text-muted">
+                    Prepare a prefilled email draft for bug reports or feature requests. This utility is separate from saved settings and records each submission intent in the activity log before opening your local email client.
+                </p>
+                <div class="alert alert-warning" role="alert" id="send-feedback-overview-card">
+                    <strong>Email workflow:</strong> This opens a text-only email draft in your local mail client. If you need to share screenshots or files, add them manually after the draft opens.
+                </div>
+
+                <div class="row g-4">
+                    <div class="col-xl-6">
+                        <div class="card p-4 h-100" id="send-feedback-bug-card">
+                            <h5 class="mb-1">
+                                <i class="bi bi-bug me-2"></i>Report a Bug
+                            </h5>
+                            <p class="text-muted small mb-3">Something isn’t working as expected.</p>
+                            <div class="admin-send-feedback-form" data-feedback-type="bug_report" data-feedback-label="Bug Report">
+                                <div class="mb-3">
+                                    <label for="send_feedback_bug_name" class="form-label">Name</label>
+                                    <input type="text" class="form-control" id="send_feedback_bug_name" name="send_feedback_bug_name" autocomplete="name" value="{{ session.get('user', {}).get('name', '') }}" data-ignore-settings-change="true" required>
+                                </div>
+                                <div class="mb-3">
+                                    <label for="send_feedback_bug_email" class="form-label">Email</label>
+                                    <input type="email" class="form-control" id="send_feedback_bug_email" name="send_feedback_bug_email" autocomplete="email" value="{{ session.get('user', {}).get('preferred_username', session.get('user', {}).get('email', '')) }}" data-ignore-settings-change="true" required>
+                                </div>
+                                <div class="mb-3">
+                                    <label for="send_feedback_bug_org" class="form-label">Organization</label>
+                                    <input type="text" class="form-control" id="send_feedback_bug_org" name="send_feedback_bug_org" autocomplete="organization" data-ignore-settings-change="true" required>
+                                </div>
+                                <div class="mb-3">
+                                    <label for="send_feedback_bug_details" class="form-label">Bug Details</label>
+                                    <textarea class="form-control" id="send_feedback_bug_details" name="send_feedback_bug_details" autocomplete="off" rows="6" placeholder="Describe what happened, what you expected, and how to reproduce it." data-ignore-settings-change="true" required></textarea>
+                                </div>
+                                <div class="alert d-none admin-send-feedback-status" role="alert"></div>
+                                <button type="button" class="btn btn-primary admin-send-feedback-submit" data-ignore-settings-change="true">
+                                    <i class="bi bi-envelope me-1"></i>Open Bug Report Email
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="col-xl-6">
+                        <div class="card p-4 h-100" id="send-feedback-feature-card">
+                            <h5 class="mb-1">
+                                <i class="bi bi-lightbulb me-2"></i>Request a Feature
+                            </h5>
+                            <p class="text-muted small mb-3">Suggest an improvement or new capability.</p>
+                            <div class="admin-send-feedback-form" data-feedback-type="feature_request" data-feedback-label="Feature Request">
+                                <div class="mb-3">
+                                    <label for="send_feedback_feature_name" class="form-label">Name</label>
+                                    <input type="text" class="form-control" id="send_feedback_feature_name" name="send_feedback_feature_name" autocomplete="name" value="{{ session.get('user', {}).get('name', '') }}" data-ignore-settings-change="true" required>
+                                </div>
+                                <div class="mb-3">
+                                    <label for="send_feedback_feature_email" class="form-label">Email</label>
+                                    <input type="email" class="form-control" id="send_feedback_feature_email" name="send_feedback_feature_email" autocomplete="email" value="{{ session.get('user', {}).get('preferred_username', session.get('user', {}).get('email', '')) }}" data-ignore-settings-change="true" required>
+                                </div>
+                                <div class="mb-3">
+                                    <label for="send_feedback_feature_org" class="form-label">Organization</label>
+                                    <input type="text" class="form-control" id="send_feedback_feature_org" name="send_feedback_feature_org" autocomplete="organization" data-ignore-settings-change="true" required>
+                                </div>
+                                <div class="mb-3">
+                                    <label for="send_feedback_feature_details" class="form-label">Feature Request Details</label>
+                                    <textarea class="form-control" id="send_feedback_feature_details" name="send_feedback_feature_details" autocomplete="off" rows="6" placeholder="Describe the problem, the improvement you want, and the outcome you need." data-ignore-settings-change="true" required></textarea>
+                                </div>
+                                <div class="alert d-none admin-send-feedback-status" role="alert"></div>
+                                <button type="button" class="btn btn-primary admin-send-feedback-submit" data-ignore-settings-change="true">
+                                    <i class="bi bi-envelope me-1"></i>Open Feature Request Email
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/session.html b/application/single_app/templates/admin/_panes/session.html
new file mode 100644
index 000000000..d5bc9c36f
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/session.html
@@ -0,0 +1,63 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'session' %} show active{% endif %}" id="session" role="tabpanel" aria-labelledby="session-tab">
+                <div class="card p-3 mb-3" id="idle-timeout-section">
+                    <h5>
+                        <i class="bi bi-hourglass-split me-2"></i>Idle Session Timeout
+                    </h5>
+                    <p class="text-muted">
+                        Warn inactive users and sign them out after a period of inactivity.
+                    </p>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_idle_timeout"
+                            name="enable_idle_timeout"
+                            {% if settings.enable_idle_timeout %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_idle_timeout">
+                            Enable Idle Session Timeout and Warning
+                        </label>
+                        <button
+                             type="button"
+                             class="btn btn-link p-0 ms-2"
+                             data-bs-toggle="tooltip"
+                             title="When enabled, inactive users receive a warning and are automatically logged out after the configured timeout."
+                             aria-label="More information about idle timeout settings">
+                             <i class="bi bi-info-circle" aria-hidden="true"></i>
+                         </button>
+                    </div>
+                    <div id="idle_timeout_settings" class="{% if settings.enable_idle_timeout is not defined or not settings.enable_idle_timeout %}d-none{% endif %}">
+                        <div class="mb-3">
+                            <label for="idle_timeout_minutes" class="form-label">Idle Logout Timeout (Minutes)</label>
+                            <input
+                                type="number"
+                                class="form-control"
+                                id="idle_timeout_minutes"
+                                name="idle_timeout_minutes"
+                                min="10"
+                                value="{{ settings.idle_timeout_minutes | default(30) }}">
+                            <small class="form-text text-muted">Users are logged out locally after this many minutes of inactivity. Minimum value: 10 minutes.</small>
+                        </div>
+                        <div class="mb-3">
+                            <label for="idle_warning_minutes" class="form-label">Idle Warning Time (Minutes)</label>
+                            <input
+                                type="number"
+                                class="form-control"
+                                id="idle_warning_minutes"
+                                name="idle_warning_minutes"
+                                min="0"
+                                value="{{ settings.idle_warning_minutes | default(28) }}">
+                            <small class="form-text text-muted">Show the warning modal after this many minutes of inactivity. Set this equal to the logout timeout to disable the warning dialog window.</small>
+                        </div>
+                        <div class="mb-3">
+                            <label for="idle_warning_message" class="form-label">Idle Warning Message</label>
+                            <input
+                                type="text"
+                                class="form-control"
+                                id="idle_warning_message"
+                                name="idle_warning_message"
+                                value="{{ settings.idle_warning_message | default("You've been inactive for a while.") }}">
+                            <small class="form-text text-muted">Custom text shown at the top of the idle warning dialog.</small>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/support-menu.html b/application/single_app/templates/admin/_panes/support-menu.html
new file mode 100644
index 000000000..57c11877b
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/support-menu.html
@@ -0,0 +1,105 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'support-menu' %} show active{% endif %}" id="support-menu" role="tabpanel" aria-labelledby="support-menu-tab">
+                <div class="card p-3 mb-3" id="support-menu-section">
+                    <h5>
+                        <i class="bi bi-life-preserver me-2"></i>Support
+                    </h5>
+                    <div class="form-check form-switch mb-2">
+                        <input class="form-check-input" type="checkbox" id="enable_support_menu" name="enable_support_menu"
+                            {% if settings.enable_support_menu %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_support_menu">
+                            Enable Support Menu for End Users
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a Support menu in navigation for signed-in users with the User role."></i>
+                    </div>
+                    <p class="text-muted small">When enabled, users can access Support destinations like Send Feedback and Latest Features directly from navigation.</p>
+
+                    <div id="support_menu_settings" {% if not settings.enable_support_menu %}style="display: none;"{% endif %}>
+                        <div class="mb-3">
+                            <label for="support_menu_name" class="form-label">Menu Name</label>
+                            <input type="text" class="form-control" id="support_menu_name" name="support_menu_name"
+                                   value="{{ settings.support_menu_name or 'Support' }}" placeholder="Support">
+                            <small class="form-text text-muted">This name will appear in user navigation as the Support menu title.</small>
+                        </div>
+
+                        <div class="form-check form-switch mb-2">
+                            <input class="form-check-input" type="checkbox" id="enable_support_send_feedback" name="enable_support_send_feedback"
+                                {% if settings.enable_support_send_feedback %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="enable_support_send_feedback">
+                                Enable Send Feedback Destination
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to prepare support feedback emails that route to your internal recipient."></i>
+                        </div>
+
+                        <div class="mb-3" id="support_feedback_recipient_group" {% if not settings.enable_support_send_feedback %}style="display: none;"{% endif %}>
+                            <label for="support_feedback_recipient_email" class="form-label">Support Recipient Email</label>
+                            <input type="email" class="form-control" id="support_feedback_recipient_email" name="support_feedback_recipient_email"
+                                   value="{{ settings.support_feedback_recipient_email or '' }}" placeholder="support@contoso.com">
+                            <small class="form-text text-muted">User Send Feedback drafts will be addressed to this internal email address.</small>
+                        </div>
+
+                        <div class="form-check form-switch mb-2">
+                            <input class="form-check-input" type="checkbox" id="enable_support_latest_features" name="enable_support_latest_features"
+                                {% if settings.enable_support_latest_features %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="enable_support_latest_features">
+                                Enable Latest Features Destination
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show a user-facing Latest Features page from the Support menu."></i>
+                        </div>
+
+                        <div id="support_latest_features_settings" {% if not settings.enable_support_latest_features %}style="display: none;"{% endif %}>
+                            <h6 class="mt-3">User-Facing Latest Features</h6>
+                            <p class="text-muted small">Choose which recent features are shared on the user Latest Features page. Deployment and Redis start unchecked because they are mainly admin-facing rollout and infrastructure topics.</p>
+                            <div class="form-check form-switch mb-3">
+                                <input class="form-check-input" type="checkbox" id="enable_support_latest_feature_documentation_links" name="enable_support_latest_feature_documentation_links"
+                                    {% if settings.enable_support_latest_feature_documentation_links %}checked{% endif %}>
+                                <label class="form-check-label ms-2" for="enable_support_latest_feature_documentation_links">
+                                    Show Simple Chat Documentation Guide Links
+                                </label>
+                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show public documentation guide buttons alongside the in-app Latest Features shortcuts. This is disabled by default."></i>
+                                <small class="form-text text-muted d-block mt-1">When enabled, user-facing Latest Features cards can show public guide buttons in addition to the direct in-app shortcuts.</small>
+                            </div>
+                            {% for release_group in support_latest_feature_release_groups %}
+                            {% set checklist_collapse_id = release_group.collapse_id ~ 'Checklist' %}
+                            <div class="card border-0 bg-body-tertiary mb-3">
+                                <div class="card-body p-3">
+                                    <div class="d-flex flex-column flex-md-row align-items-md-center justify-content-between gap-3">
+                                        <div>
+                                            <h6 class="mb-1">{{ release_group.label }}{% if release_group.release_version %}<span class="badge bg-light text-dark ms-2">v{{ release_group.release_version }}</span>{% endif %}</h6>
+                                            <p class="text-muted small mb-0">{{ release_group.description }}</p>
+                                        </div>
+                                        {% if not release_group.default_expanded %}
+                                        <button
+                                            type="button"
+                                            class="btn btn-sm btn-outline-secondary"
+                                            data-bs-toggle="collapse"
+                                            data-bs-target="#{{ checklist_collapse_id }}"
+                                            aria-expanded="false"
+                                            aria-controls="{{ checklist_collapse_id }}"
+                                        >
+                                            Show {{ release_group.label }}
+                                        </button>
+                                        {% endif %}
+                                    </div>
+                                    <div {% if not release_group.default_expanded %}class="collapse mt-3" id="{{ checklist_collapse_id }}"{% else %}class="mt-3"{% endif %}>
+                                        <div class="row g-2">
+                                            {% for feature in release_group.features %}
+                                            <div class="col-md-6">
+                                                <div class="form-check border rounded p-3 h-100">
+                                                    <input class="form-check-input" type="checkbox" id="support_latest_feature_{{ feature.id }}" name="support_latest_feature_{{ feature.id }}"
+                                                        {% if settings.support_latest_features_visibility.get(feature.id, true) %}checked{% endif %}>
+                                                    <label class="form-check-label ms-2" for="support_latest_feature_{{ feature.id }}">
+                                                        <span class="fw-semibold d-block">{{ feature.title }}</span>
+                                                        <span class="text-muted small">{{ feature.summary }}</span>
+                                                    </label>
+                                                </div>
+                                            </div>
+                                            {% endfor %}
+                                        </div>
+                                    </div>
+                                </div>
+                            </div>
+                            {% endfor %}
+                        </div>
+                    </div>
+                </div>
+            </div>
\ No newline at end of file
diff --git a/application/single_app/templates/admin/_panes/web-research.html b/application/single_app/templates/admin/_panes/web-research.html
new file mode 100644
index 000000000..7ad547075
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/web-research.html
@@ -0,0 +1,519 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'web-research' %} show active{% endif %}" id="web-research" role="tabpanel" aria-labelledby="web-research-tab">
+
+                 <p class="text-muted">
+                    Configure Azure AI Search, Document Intelligence, and multimedia support settings.
+                </p>
+
+                <div class="card p-3 mb-3" id="web-search-foundry-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0"><i class="bi bi-globe me-2"></i>Web Search (Azure AI Foundry Agent)</h5>
+                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#webSearchFoundryInfoModal">
+                            <i class="bi bi-info-circle me-1"></i>Setup Guide
+                        </button>
+                    </div>
+                    <p class="text-muted mb-2">Enable web search by routing queries through an Azure AI Foundry agent configured by admins.</p>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_web_search"
+                            name="enable_web_search"
+                            {% if settings.enable_web_search %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_web_search">Enable Web Search via Foundry Agent</label>
+                    </div>
+                    <input
+                        type="hidden"
+                        id="web_search_consent_accepted"
+                        name="web_search_consent_accepted"
+                        value="{{ 'true' if settings.web_search_consent_accepted else 'false' }}"
+                    >
+
+                    <div id="web_search_foundry_settings" class="{% if not settings.enable_web_search %}d-none{% endif %}">
+                        <!-- User Notice Settings -->
+                        <div class="card p-3 mb-3 bg-light">
+                            <h6 class="mb-2"><i class="bi bi-bell me-2"></i>User Data Notice</h6>
+                            <p class="text-muted small mb-2">Optionally show users a one-time notice explaining that their message will be sent to Bing for web search.</p>
+                            <div class="form-check form-switch mb-3">
+                                <input
+                                    type="checkbox"
+                                    class="form-check-input mb-3"
+                                    id="enable_web_search_user_notice"
+                                    name="enable_web_search_user_notice"
+                                    {% if settings.enable_web_search_user_notice %}checked{% endif %}
+                                >
+                                <label class="form-check-label ms-2 mb-3" for="enable_web_search_user_notice">Show data notice to users when web search is used</label>
+                            </div>
+                            <div id="web_search_user_notice_settings" class="{% if not settings.enable_web_search_user_notice %}d-none{% endif %}">
+                                <label for="web_search_user_notice_text" class="form-label">Notice Text</label>
+                                <textarea class="form-control" id="web_search_user_notice_text" name="web_search_user_notice_text" rows="2" placeholder="Your current message will be sent to Microsoft Bing for web search...">{{ settings.web_search_user_notice_text or 'Your current message will be sent to Microsoft Bing for web search. Conversation history is not sent for web search, but any sensitive content you paste into this message may be sent.' }}</textarea>
+                                <div class="form-text">This message will be shown to users once per session when they first use web search.</div>
+                            </div>
+                        </div>
+                        <div class="row g-3">
+                            <div class="col-12" id="web_search_foundry_endpoint_container">
+                                <label for="web_search_foundry_endpoint" class="form-label">Foundry Project Endpoint</label>
+                                <input type="text" class="form-control" id="web_search_foundry_endpoint" name="web_search_foundry_endpoint" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.endpoint if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else settings.web_search_agent.azure_openai_gpt_endpoint or '' }}" placeholder="https://<resource>.services.ai.azure.com/api/projects/<project-name>">
+                                <div class="form-text">Project endpoint format: https://&lt;foundry-resource&gt;.services.ai.azure.com/api/projects/&lt;project-name&gt; (not the inference endpoint).</div>
+                            </div>
+                            <div class="col-md-6" id="web_search_foundry_api_version_container">
+                                <label for="web_search_foundry_api_version" class="form-label">Foundry API Version</label>
+                                <input type="text" class="form-control" id="web_search_foundry_api_version" name="web_search_foundry_api_version" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.api_version if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else settings.web_search_agent.azure_openai_gpt_api_version or '' }}" placeholder="2025-05-01">
+                                <a href="https://learn.microsoft.com/en-us/rest/api/aifoundry/aiprojects/?view=foundry#versioning" target="_blank" class="ms-2" rel="noopener noreferrer">
+                                    AI Foundry Versioning<i class="bi bi-box-arrow-up-right"></i>
+                                </a>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="web_search_foundry_agent_id" class="form-label">Foundry Agent ID</label>
+                                <input type="text" class="form-control" id="web_search_foundry_agent_id" name="web_search_foundry_agent_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.agent_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="ID from Azure AI Foundry. Typically starts with asst_">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="web_search_foundry_auth_type" class="form-label">Authentication Type</label>
+                                <select class="form-select" id="web_search_foundry_auth_type" name="web_search_foundry_auth_type">
+                                    {% set foundry_auth_type = settings.web_search_agent.other_settings.azure_ai_foundry.authentication_type if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else 'managed_identity' %}
+                                    <option value="managed_identity" {% if foundry_auth_type=='managed_identity' %}selected{% endif %}>Managed Identity</option>
+                                    <option value="service_principal" {% if foundry_auth_type=='service_principal' %}selected{% endif %}>Service Principal</option>
+                                </select>
+                                <div class="form-text text-muted">Identity must have Cognitive Services User and AI Developer roles on the Foundry project.</div>
+                            </div>
+                            <div class="col-md-4" id="web_search_foundry_cloud_container">
+                                <label for="web_search_foundry_cloud" class="form-label">Cloud</label>
+                                <select class="form-select" id="web_search_foundry_cloud" name="web_search_foundry_cloud">
+                                    {% set foundry_cloud = settings.web_search_agent.other_settings.azure_ai_foundry.cloud if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' %}
+                                    <option value="" {% if foundry_cloud=='' %}selected{% endif %}>Azure Public</option>
+                                    <option value="usgov" {% if foundry_cloud=='usgov' or foundry_cloud=='usgovernment' or foundry_cloud=='gcc' %}selected{% endif %}>Azure Government</option>
+                                    <option value="custom" {% if foundry_cloud=='custom' %}selected{% endif %}>Custom</option>
+                                </select>
+                            </div>
+                            <div class="col-md-4" id="web_search_foundry_managed_identity_type_container">
+                                <label for="web_search_foundry_managed_identity_type" class="form-label">Managed Identity Type</label>
+                                <select class="form-select" id="web_search_foundry_managed_identity_type" name="web_search_foundry_managed_identity_type">
+                                    {% set foundry_mi_type = settings.web_search_agent.other_settings.azure_ai_foundry.managed_identity_type if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else 'system_assigned' %}
+                                    <option value="system_assigned" {% if foundry_mi_type=='system_assigned' %}selected{% endif %}>System-assigned (SAMI)</option>
+                                    <option value="user_assigned" {% if foundry_mi_type=='user_assigned' %}selected{% endif %}>User-assigned (UAMI)</option>
+                                </select>
+                            </div>
+                            <div class="col-12" id="web_search_foundry_authority_container">
+                                <label for="web_search_foundry_authority" class="form-label">Authority Endpoint (Custom Cloud)</label>
+                                <input type="text" class="form-control" id="web_search_foundry_authority" name="web_search_foundry_authority" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.authority if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="https://login.microsoftonline.com/ or https://login.microsoftonline.us/">
+                            </div>
+                            <div class="col-md-6" id="web_search_foundry_managed_identity_client_id_container">
+                                <label for="web_search_foundry_managed_identity_client_id" class="form-label">Managed Identity Client ID (UAMI)</label>
+                                <input type="text" class="form-control" id="web_search_foundry_managed_identity_client_id" name="web_search_foundry_managed_identity_client_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.managed_identity_client_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Client ID for user-assigned managed identity">
+                            </div>
+                        </div>
+
+                        <div class="row g-3 mt-1" id="web_search_foundry_service_principal_fields">
+                            <div class="col-md-4">
+                                <label for="web_search_foundry_tenant_id" class="form-label">Tenant ID</label>
+                                <input type="text" class="form-control" id="web_search_foundry_tenant_id" name="web_search_foundry_tenant_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.tenant_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Entra tenant ID">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="web_search_foundry_client_id" class="form-label">Client ID</label>
+                                <input type="text" class="form-control" id="web_search_foundry_client_id" name="web_search_foundry_client_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.client_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="App registration client ID">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="web_search_foundry_client_secret" class="form-label">Client Secret</label>
+                                <div class="input-group">
+                                    <input type="password" class="form-control" id="web_search_foundry_client_secret" name="web_search_foundry_client_secret" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.client_secret if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Secret or Key Vault reference">
+                                    <button type="button" class="btn btn-outline-secondary" id="toggle_web_search_foundry_client_secret">Show</button>
+                                </div>
+                            </div>
+                        </div>
+
+                        <div class="border rounded p-3 mt-3">
+                            <div class="d-flex flex-column flex-lg-row align-items-lg-center justify-content-between gap-2">
+                                <div>
+                                    <h6 class="mb-1"><i class="bi bi-chat-square-dots me-2"></i>Web Search Test</h6>
+                                    <div class="text-muted small">Run the configured Foundry agent with the current unsaved settings.</div>
+                                </div>
+                                <button
+                                    type="button"
+                                    class="btn btn-outline-primary btn-sm"
+                                    id="test_web_search_button"
+                                    data-bs-toggle="modal"
+                                    data-bs-target="#webSearchTestModal"
+                                >
+                                    <i class="bi bi-play-circle me-1"></i>Test Web Search
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="url-access-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0"><i class="bi bi-link-45deg me-2"></i>URL Access</h5>
+                        <span class="badge text-bg-secondary">Shared Policy</span>
+                    </div>
+                    <p class="text-muted mb-2">Control direct URL content fetching for pasted chat links, workflow prompts, and Deep Research source review.</p>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_url_access"
+                            name="enable_url_access"
+                            {% if settings.enable_url_access %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_url_access">Enable URL Access for chat and workflows</label>
+                    </div>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_url_access_user"
+                            name="require_member_of_url_access_user"
+                            {% if settings.require_member_of_url_access_user %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="require_member_of_url_access_user">Require UrlAccessUser App Role</label>
+                        <div class="form-text">Required app role value: <code>UrlAccessUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use URL Access in chat or enable it for workflows.</div>
+                    </div>
+
+                    <div id="url_access_settings" class="{% if not settings.enable_url_access %}d-none{% endif %}">
+                        <div class="alert alert-info small mb-3">
+                            URL Access uses the same server-side URL protections as Deep Research: non-HTTP(S) URLs, credentialed URLs, literal IP targets, localhost, metadata hosts, unsafe redirects, unsupported content types, and oversized pages are blocked before fetch.
+                        </div>
+                        <div class="row g-3 mb-3">
+                            <div class="col-md-6">
+                                <label for="url_access_max_chat_urls_per_turn" class="form-label">Chat URL Limit</label>
+                                <input type="number" min="1" max="100" class="form-control" id="url_access_max_chat_urls_per_turn" name="url_access_max_chat_urls_per_turn" value="{{ settings.url_access_max_chat_urls_per_turn or 10 }}">
+                                <div class="form-text">Hard limit: 100 direct URLs per chat message.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="url_access_max_workflow_urls_per_run" class="form-label">Workflow URL Limit</label>
+                                <input type="number" min="1" max="500" class="form-control" id="url_access_max_workflow_urls_per_run" name="url_access_max_workflow_urls_per_run" value="{{ settings.url_access_max_workflow_urls_per_run or 50 }}">
+                                <div class="form-text">Hard limit: 500 direct URLs per workflow prompt.</div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <div class="row g-3 mt-1">
+                        <div class="col-md-6">
+                            <div class="url-access-policy-editor" data-url-access-policy="url_access_allowed_domains" data-policy-kind="domain">
+                                <label for="url_access_allowed_domains_new" class="form-label">Allowed Domains</label>
+                                <textarea class="d-none" id="url_access_allowed_domains" name="url_access_allowed_domains" aria-hidden="true">{{ settings.url_access_allowed_domains|join('\n') if settings.url_access_allowed_domains else settings.source_review_allowed_domains|join('\n') if settings.source_review_allowed_domains else '' }}</textarea>
+                                <div class="input-group input-group-sm">
+                                    <input type="text" class="form-control" id="url_access_allowed_domains_new" data-policy-new-input placeholder="example.com or *.contoso.com" />
+                                    <button type="button" class="btn btn-outline-primary" data-policy-add-button>
+                                        <i class="bi bi-plus-circle me-1"></i>Add
+                                    </button>
+                                </div>
+                                <div class="list-group mt-2" data-policy-list aria-live="polite"></div>
+                            </div>
+                            <div class="form-text">Leave blank to allow any public domain that passes safety checks. Deep Research uses this same allow list.</div>
+                        </div>
+                        <div class="col-md-6">
+                            <div class="url-access-policy-editor" data-url-access-policy="url_access_blocked_domains" data-policy-kind="domain">
+                                <label for="url_access_blocked_domains_new" class="form-label">Blocked Domains</label>
+                                <textarea class="d-none" id="url_access_blocked_domains" name="url_access_blocked_domains" aria-hidden="true">{{ settings.url_access_blocked_domains|join('\n') if settings.url_access_blocked_domains else settings.source_review_blocked_domains|join('\n') if settings.source_review_blocked_domains else '' }}</textarea>
+                                <div class="input-group input-group-sm">
+                                    <input type="text" class="form-control" id="url_access_blocked_domains_new" data-policy-new-input placeholder="example.org or *.contoso.net" />
+                                    <button type="button" class="btn btn-outline-primary" data-policy-add-button>
+                                        <i class="bi bi-plus-circle me-1"></i>Add
+                                    </button>
+                                </div>
+                                <div class="list-group mt-2" data-policy-list aria-live="polite"></div>
+                            </div>
+                            <div class="form-text">Blocked domains apply to URL Access and Deep Research source-page review.</div>
+                        </div>
+                    </div>
+
+                    <div class="border rounded p-3 mt-3">
+                        <div class="d-flex flex-column flex-lg-row align-items-lg-center justify-content-between gap-2">
+                            <div>
+                                <h6 class="mb-1"><i class="bi bi-shield-check me-2"></i>URL Policy Test</h6>
+                                <div class="text-muted small">Check a URL against the current allowed and blocked domain rules before saving.</div>
+                            </div>
+                            <button
+                                type="button"
+                                class="btn btn-outline-primary btn-sm"
+                                id="open_url_access_policy_test_modal_button"
+                                data-bs-toggle="modal"
+                                data-bs-target="#urlAccessPolicyTestModal"
+                            >
+                                <i class="bi bi-play-circle me-1"></i>Test URL Policy
+                            </button>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="card p-3 mb-3" id="source-review-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0"><i class="bi bi-binoculars me-2"></i>Deep Research</h5>
+                        <div class="d-flex align-items-center gap-2">
+                            <span class="badge text-bg-secondary">Optional</span>
+                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#deepResearchInfoModal">
+                                <i class="bi bi-info-circle me-1"></i>Setup Guide
+                            </button>
+                        </div>
+                    </div>
+                    <p class="text-muted mb-2">Plan bounded web searches, inspect source pages, and keep an internal research ledger for evidence coverage. Direct pasted URLs use the shared URL Access controls above.</p>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_source_review"
+                            name="enable_source_review"
+                            {% if settings.enable_source_review %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_source_review">Enable Deep Research for chat</label>
+                    </div>
+
+                    <div id="source_review_settings" class="{% if not settings.enable_source_review %}d-none{% endif %}">
+                        <div class="alert alert-info small mb-3">
+                            Server-side protections always block non-HTTP(S) URLs, literal IP URL targets, localhost, metadata hosts, credentialed URLs, excessive redirects, unsupported content types, oversized pages, and requests beyond the configured page budget. DNS hostnames that resolve to private/internal addresses require the internal-host opt-in below.
+                        </div>
+
+                        <div class="form-check form-switch mb-3">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="require_member_of_deep_research_user"
+                                name="require_member_of_deep_research_user"
+                                {% if settings.require_member_of_deep_research_user %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="require_member_of_deep_research_user">Require DeepResearchUser App Role</label>
+                            <div class="form-text">Required app role value: <code>DeepResearchUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use Deep Research.</div>
+                        </div>
+
+                        <div class="form-check form-switch mb-3">
+                            <input
+                                type="checkbox"
+                                class="form-check-input"
+                                id="source_review_allow_internal_hosts"
+                                name="source_review_allow_internal_hosts"
+                                {% if settings.source_review_allow_internal_hosts %}checked{% endif %}
+                            >
+                            <label class="form-check-label ms-2" for="source_review_allow_internal_hosts">Allow internal network hostnames</label>
+                            <div class="form-text">Allows DNS hostnames that resolve to private/internal addresses. Literal IP URL targets, localhost, metadata hosts, link-local addresses, and reserved addresses remain blocked.</div>
+                        </div>
+
+                        <div class="row g-3">
+                            <div class="col-md-4">
+                                <label for="source_review_default_mode" class="form-label">Activation Mode</label>
+                                <select class="form-select" id="source_review_default_mode" disabled>
+                                    <option value="manual" selected>User toggle only</option>
+                                </select>
+                                <input type="hidden" name="source_review_default_mode" value="manual" />
+                                <div class="form-text">Deep Research runs only when the user selects it for the message.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_max_pages_per_turn" class="form-label">Max Pages per Turn</label>
+                                <input type="number" min="1" max="10" class="form-control" id="source_review_max_pages_per_turn" name="source_review_max_pages_per_turn" value="{{ settings.source_review_max_pages_per_turn or 10 }}">
+                                <div class="form-text">Hard limit: 10 pages.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_max_seed_pages_per_turn" class="form-label">Max Seed Pages per Turn</label>
+                                <input type="number" min="1" max="10" class="form-control" id="source_review_max_seed_pages_per_turn" name="source_review_max_seed_pages_per_turn" value="{{ settings.source_review_max_seed_pages_per_turn or 10 }}">
+                                <div class="form-text">Limits initial search-result and direct URL pages so budget remains for child pages.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="deep_research_max_user_urls_per_turn" class="form-label">Max User URLs per Turn</label>
+                                <input type="number" min="1" max="100" class="form-control" id="deep_research_max_user_urls_per_turn" name="deep_research_max_user_urls_per_turn" value="{{ settings.deep_research_max_user_urls_per_turn or 100 }}">
+                                <div class="form-text">Direct URLs beyond this cap are recorded as omitted in the ledger.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="deep_research_max_search_queries_per_turn" class="form-label">Max Search Queries per Turn</label>
+                                <input type="number" min="1" max="8" class="form-control" id="deep_research_max_search_queries_per_turn" name="deep_research_max_search_queries_per_turn" value="{{ settings.deep_research_max_search_queries_per_turn or 8 }}">
+                                <div class="form-text">Includes the original current-message query.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_timeout_seconds" class="form-label">Timeout per Turn</label>
+                                <input type="number" min="3" max="30" class="form-control" id="source_review_timeout_seconds" name="source_review_timeout_seconds" value="{{ settings.source_review_timeout_seconds or 30 }}">
+                                <div class="form-text">Hard limit: 30 seconds.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_max_redirects" class="form-label">Max Redirects</label>
+                                <input type="number" min="0" max="5" class="form-control" id="source_review_max_redirects" name="source_review_max_redirects" value="{{ settings.source_review_max_redirects if settings.source_review_max_redirects is not none else 5 }}">
+                                <div class="form-text">Every redirect target is revalidated.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_max_bytes_per_page_mb" class="form-label">Max MB per Page</label>
+                                <input type="number" min="1" max="5" class="form-control" id="source_review_max_bytes_per_page_mb" name="source_review_max_bytes_per_page_mb" value="{{ (((settings.source_review_max_bytes_per_page|default(5000000, true)|int) / 1000000)|round(0, 'ceil'))|int }}">
+                                <div class="form-text">Hard limit: 5 MB.</div>
+                            </div>
+                            <div class="col-md-4">
+                                <label for="source_review_max_depth" class="form-label">Source Traversal Depth</label>
+                                <input type="number" min="0" max="2" class="form-control" id="source_review_max_depth" name="source_review_max_depth" value="{{ settings.source_review_max_depth if settings.source_review_max_depth is not none else 2 }}">
+                                <div class="form-text">Depth 2 follows selected links from seed and child pages.</div>
+                            </div>
+                        </div>
+
+                        <div class="row g-3 mt-1">
+                            <div class="col-md-6">
+                                {% set js_runtime = source_review_runtime_capabilities or {} %}
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="enable_deep_source_review"
+                                        name="enable_deep_source_review"
+                                        {% if settings.enable_deep_source_review %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="enable_deep_source_review">Inspect linked source pages</label>
+                                </div>
+                                <div id="source_review_deep_settings" class="form-text {% if not settings.enable_deep_source_review %}d-none{% endif %}">Deep Research follows only scored, policy-approved links within the page and depth budgets.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="deep_research_enable_query_planning"
+                                        name="deep_research_enable_query_planning"
+                                        {% if settings.deep_research_enable_query_planning %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="deep_research_enable_query_planning">Plan multiple web search queries</label>
+                                </div>
+                                <div class="form-text">The selected chat model can propose bounded current-message-only query variants before page review.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="deep_research_enable_ledger_artifact"
+                                        name="deep_research_enable_ledger_artifact"
+                                        {% if settings.deep_research_enable_ledger_artifact %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="deep_research_enable_ledger_artifact">Save research ledger artifacts</label>
+                                </div>
+                                <div class="form-text">Creates a Markdown chat artifact with search queries, reviewed sources, skipped URLs, and coverage.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="source_review_enable_llm_planning"
+                                        name="source_review_enable_llm_planning"
+                                        {% if settings.source_review_enable_llm_planning %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="source_review_enable_llm_planning">Use model-assisted source link planning</label>
+                                </div>
+                                <div class="form-text">When source pages expose candidate links, the selected chat model can rank those candidates before the server fetches them.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="source_review_allow_js_rendering"
+                                        name="source_review_allow_js_rendering"
+                                        {% if settings.source_review_allow_js_rendering and js_runtime.js_rendering_available %}checked{% endif %}
+                                        {% if not js_runtime.js_rendering_available %}disabled{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="source_review_allow_js_rendering">Allow JavaScript rendering fallback</label>
+                                </div>
+                                <div class="form-text">Requires verified Playwright browser runtime support on the app host.</div>
+                                <div class="small mt-1 {% if js_runtime.js_rendering_available %}text-success{% else %}text-warning{% endif %}" id="source_review_js_runtime_status">
+                                    <i class="bi {% if js_runtime.js_rendering_available %}bi-check-circle{% else %}bi-exclamation-triangle{% endif %} me-1"></i>{{ js_runtime.message or 'Runtime support has not been checked yet.' }}
+                                </div>
+                                {% if not js_runtime.js_rendering_available %}
+                                <div class="small text-muted mt-1">Install/enable the Playwright Chromium runtime, then reload Admin Settings to enable this option.</div>
+                                {% endif %}
+                                {% if js_runtime.sandbox_disabled %}
+                                <div class="small text-warning mt-1">Chromium sandbox is disabled by environment configuration.</div>
+                                {% endif %}
+                            </div>
+                            <div class="col-md-6">
+                                <label for="source_review_js_load_more_clicks" class="form-label">Rendered Load More Clicks</label>
+                                <input type="number" min="0" max="12" class="form-control" id="source_review_js_load_more_clicks" name="source_review_js_load_more_clicks" value="{{ settings.source_review_js_load_more_clicks if settings.source_review_js_load_more_clicks is not none else 12 }}">
+                                <div class="form-text">When JavaScript rendering is enabled, Deep Research can click visible Load More controls until this cap is reached.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="source_review_respect_robots_txt"
+                                        name="source_review_respect_robots_txt"
+                                        {% if settings.source_review_respect_robots_txt %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="source_review_respect_robots_txt">Respect robots.txt</label>
+                                </div>
+                            </div>
+                            <div class="col-md-6">
+                                <div class="form-check form-switch mb-2">
+                                    <input
+                                        type="checkbox"
+                                        class="form-check-input"
+                                        id="source_review_audit_logging"
+                                        name="source_review_audit_logging"
+                                        {% if settings.source_review_audit_logging %}checked{% endif %}
+                                    >
+                                    <label class="form-check-label ms-2" for="source_review_audit_logging">Log Deep Research activity</label>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="web-search-consent-modal" tabindex="-1" aria-labelledby="web-search-consent-title" aria-hidden="true">
+                    <div class="modal-dialog modal-dialog-centered modal-lg">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="web-search-consent-title">Web Search Consent Required</h5>
+                            </div>
+                            <div class="modal-body">
+                                <p>
+                                    When you use Grounding with Bing Search, your customer data is transferred outside of the Azure compliance boundary to the Grounding with Bing Search service. Grounding with Bing Search is not subject to the same data processing terms (including location of processing) and does not have the same compliance standards and certifications as the Azure AI Agent Service, as described in the <a href="https://www.microsoft.com/en-us/bing/apis/grounding-legal" target="_blank" rel="noopener noreferrer">Grounding with Bing Search TOU</a>. It is your responsibility to assess whether use of Grounding with Bing Search in your agent meets your needs and requirements.
+                                </p>
+                                <div class="alert alert-warning mb-0">
+                                    Only the user's current message is sent for web search. Users should avoid including sensitive content in any message that uses web search.
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" id="web-search-consent-decline">Disagree</button>
+                                <button type="button" class="btn btn-primary" id="web-search-consent-accept">Agree</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="webSearchTestModal" tabindex="-1" aria-labelledby="web-search-test-title" aria-hidden="true">
+                    <div class="modal-dialog modal-dialog-centered modal-lg">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="web-search-test-title">Web Search Test</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <label for="web_search_test_query" class="form-label">Test Prompt</label>
+                                <textarea class="form-control" id="web_search_test_query" rows="3">Use the Grounding with Bing Search tool to find the official Microsoft website. Reply with the page title and URL only.</textarea>
+                                <div id="test_web_search_result" class="mt-3" aria-live="polite"></div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
+                                <button type="button" class="btn btn-primary" id="rerun_web_search_test_button">
+                                    <i class="bi bi-arrow-clockwise me-1"></i>Run Again
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal fade" id="urlAccessPolicyTestModal" tabindex="-1" aria-labelledby="url-access-policy-test-title" aria-hidden="true">
+                    <div class="modal-dialog modal-dialog-centered modal-lg">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="url-access-policy-test-title">URL Policy Test</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <label for="url_access_policy_test_url" class="form-label">URL</label>
+                                <input type="url" class="form-control" id="url_access_policy_test_url" placeholder="https://www.example.com/page" />
+                                <div id="test_url_access_policy_result" class="mt-3" aria-live="polite"></div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
+                                <button type="button" class="btn btn-primary" id="test_url_access_policy_button">
+                                    <i class="bi bi-shield-check me-1"></i>Run Policy Test
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+
+            </div>
diff --git a/application/single_app/templates/admin/_panes/workflow.html b/application/single_app/templates/admin/_panes/workflow.html
new file mode 100644
index 000000000..242119643
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/workflow.html
@@ -0,0 +1,157 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'workflow' %} show active{% endif %}" id="workflow" role="tabpanel" aria-labelledby="workflow-tab">
+                <div class="card mb-3 p-3" id="workflow-settings-section">
+                    <h5>
+                        <i class="bi bi-diagram-3 me-2"></i>Workflow
+                    </h5>
+                    <p class="text-muted">
+                        Control personal and group workflow authoring and execution for users.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="allow_user_workflows"
+                            name="allow_user_workflows"
+                            {% if settings.allow_user_workflows %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="allow_user_workflows">
+                            Enable Personal Workflows
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create personal workflows that run a selected agent or model manually or on an interval schedule."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_member_of_workflow_user"
+                            name="require_member_of_workflow_user"
+                            {% if settings.require_member_of_workflow_user %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_member_of_workflow_user">
+                            Require WorkflowUser App Role
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Require the WorkflowUser Enterprise App role before users can open, create, edit, run, or inspect personal workflows."></i>
+                    </div>
+                    <p class="text-muted small mb-0">
+                        Required app role value: <code>WorkflowUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement.
+                    </p>
+
+                    <div class="form-group mt-3 mb-3">
+                        <label for="workflow_max_auto_invoke_attempts" class="form-label">
+                            Workflow Agent Action Limit
+                        </label>
+                        <input type="number"
+                            class="form-control"
+                            id="workflow_max_auto_invoke_attempts"
+                            name="workflow_max_auto_invoke_attempts"
+                            min="1"
+                            max="500"
+                            step="1"
+                            value="{{ settings.workflow_max_auto_invoke_attempts|default(60, true) }}">
+                        <div class="form-text">
+                            Maximum automatic tool or action calls an agent can make during one workflow run. Default is 60; increase for large document sets.
+                        </div>
+                        <div class="alert alert-warning small mb-0 mt-2" role="alert">
+                            Values above 100 are capacity-sensitive. Enable Cosmos DB Throughput automation in SimpleChat so the app can monitor RU pressure and scale up Cosmos when needed, and also monitor Azure OpenAI throttling, App Service CPU and memory, and downstream service latency.
+                        </div>
+                    </div>
+
+                    <div class="form-group mt-3 mb-3">
+                        <label for="workflow_max_tasks" class="form-label">
+                            Workflow Task Limit
+                        </label>
+                        <input type="number"
+                            class="form-control"
+                            id="workflow_max_tasks"
+                            name="workflow_max_tasks"
+                            min="1"
+                            max="100"
+                            step="1"
+                            value="{{ settings.workflow_max_tasks|default(50, true) }}">
+                        <div class="form-text">
+                            Maximum ordered instruction tasks users can add to one workflow. Default is 50; supported range is 1-100.
+                        </div>
+                    </div>
+
+                    <hr>
+
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="allow_group_workflows"
+                            name="allow_group_workflows"
+                            {% if settings.allow_group_workflows %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="allow_group_workflows">
+                            Enable Group Workflows
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow permitted group members to create, manage, and run workflows from group workspaces."></i>
+                    </div>
+                    <div class="form-group form-check form-switch mb-2">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="require_group_assignment_for_group_workflows"
+                            name="require_group_assignment_for_group_workflows"
+                            {% if settings.require_group_assignment_for_group_workflows %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="require_group_assignment_for_group_workflows">
+                            Require Group Assignment to Use Workflow
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only groups selected in Manage Groups can create, manage, or run group workflows."></i>
+                    </div>
+                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
+                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-group-workflow-groups-btn" data-bs-toggle="modal" data-bs-target="#groupWorkflowAssignmentModal">
+                            <i class="bi bi-people me-1"></i>Manage Groups
+                        </button>
+                        <span class="text-muted small" id="group-workflow-assignment-summary">No groups assigned.</span>
+                    </div>
+                    <textarea class="d-none" id="group_workflow_allowed_group_ids" name="group_workflow_allowed_group_ids">{{ settings.group_workflow_allowed_group_ids|default([], true)|tojson }}</textarea>
+                    <p class="text-muted small mb-0">
+                        Group workflow authoring is available to group Owners and Admins by default. Enable the owner-only setting below to limit group agent, action, and workflow management to Owners.
+                    </p>
+                </div>
+
+
+
+                <div class="modal fade" id="groupWorkflowAssignmentModal" tabindex="-1" aria-labelledby="groupWorkflowAssignmentModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <div>
+                                    <h5 class="modal-title mb-0" id="groupWorkflowAssignmentModalLabel">Group Workflow Assignments</h5>
+                                    <small class="text-muted">Choose which groups can use group workflows when assignment is required.</small>
+                                </div>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <div class="row g-2 align-items-end mb-3">
+                                    <div class="col">
+                                        <label for="group-workflow-group-search" class="form-label">Search Groups</label>
+                                        <input type="search" class="form-control" id="group-workflow-group-search" placeholder="Search by group name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
+                                    </div>
+                                    <div class="col-auto">
+                                        <button type="button" class="btn btn-outline-primary" id="group-workflow-group-search-btn">
+                                            <i class="bi bi-search me-1"></i>Search
+                                        </button>
+                                    </div>
+                                </div>
+                                <div class="alert alert-danger d-none" id="group-workflow-assignment-error"></div>
+                                <div class="small text-muted mb-2" id="group-workflow-assignment-status">No groups loaded.</div>
+                                <div class="table-responsive">
+                                    <table class="table table-sm align-middle">
+                                        <thead>
+                                            <tr>
+                                                <th scope="col">Group</th>
+                                                <th scope="col">Description</th>
+                                                <th scope="col" class="text-end">Assignment</th>
+                                            </tr>
+                                        </thead>
+                                        <tbody id="group-workflow-assignment-groups-body">
+                                            <tr>
+                                                <td colspan="3" class="text-center text-muted py-3">Search for groups to assign.</td>
+                                            </tr>
+                                        </tbody>
+                                    </table>
+                                </div>
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/workspace-identities.html b/application/single_app/templates/admin/_panes/workspace-identities.html
new file mode 100644
index 000000000..7c3569ebd
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/workspace-identities.html
@@ -0,0 +1,21 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'workspace-identities' %} show active{% endif %}" id="workspace-identities" role="tabpanel" aria-labelledby="workspace-identities-tab">
+                <p class="text-muted">
+                    Manage the global authentication profiles that File Sync sources and Actions reuse, so credentials stay scoped and are resolved server-side.
+                </p>
+                <div class="card mb-3 p-3" id="workspace-identities-section">
+                    <h5>
+                        <i class="bi bi-person-badge me-2"></i>Global Identities
+                    </h5>
+                    <p class="text-muted">
+                        Identities defined here are available across the deployment. Each one stores its secret in Key Vault when Key Vault is configured, and is referenced by name rather than by value wherever it is used.
+                    </p>
+                    <div
+                        id="global-workspace-identities-root"
+                        data-workspace-identity-root="true"
+                        data-identity-api-base="/api/admin/workspace-identities/global"
+                        data-default-capability="action"
+                        data-capability-options="file_sync,action"
+                        data-auth-type-options="username_password,api_key,bearer_token,client_secret,connection_string,managed_identity"
+                    ></div>
+                </div>
+            </div>
diff --git a/application/single_app/templates/admin/_panes/workspace-types.html b/application/single_app/templates/admin/_panes/workspace-types.html
new file mode 100644
index 000000000..83123fd7a
--- /dev/null
+++ b/application/single_app/templates/admin/_panes/workspace-types.html
@@ -0,0 +1,159 @@
+            <div class="tab-pane fade{% if admin_landing_tab == 'workspace-types' %} show active{% endif %}" id="workspace-types" role="tabpanel" aria-labelledby="workspace-types-tab">
+                <p class="text-muted">
+                    Configure workspace settings like personal/group access, multimedia support, metadata, and document classification.
+                </p>
+
+
+                <div class="card mb-3 p-3" id="personal-workspaces-section">
+                    <h5>
+                        <i class="bi bi-person me-2"></i>Personal Workspaces
+                    </h5>
+                    <p class="text-muted">
+                        Turn this on to allow access and management of your personal workspace.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_user_workspace"
+                            name="enable_user_workspace"
+                            {% if settings.enable_user_workspace %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_user_workspace">
+                            Enable Personal Workspaces
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage their own private workspaces for document storage, knowledge bases, and personal AI interactions."></i>
+                    </div>
+                </div>
+
+               <div class="card mb-3 p-3" id="group-workspaces-section">
+                    <h5>
+                        <i class="bi bi-people me-2"></i>Group Workspaces
+                    </h5>
+                    <p class="text-muted">
+                        Turn this on to allow access and management of group workspaces, as well as group collaboration features.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_group_workspaces"
+                            name="enable_group_workspaces"
+                            {% if settings.enable_group_workspaces %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_group_workspaces">
+                            Enable Group Workspaces
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and participate in shared group workspaces for team collaboration, document sharing, and collective knowledge building."></i>
+                    </div>
+
+
+                    <div id="create_group_permission_setting" {% if not settings.enable_group_workspaces %}style="display: none;"{% endif %}>
+                        <hr>
+
+                        <!-- Disable Group Creation Setting -->
+                        <div class="form-group form-check form-switch mb-3">
+                            <input type="checkbox"
+                                class="form-check-input"
+                                id="disable_group_creation"
+                                name="disable_group_creation"
+                                {% if not settings.enable_group_creation %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="disable_group_creation">
+                                Disable Group Creation
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Prevent all users from creating new groups system-wide, regardless of app role assignment."></i>
+                        </div>
+                        <p class="text-muted small mb-3">
+                            When enabled, no users will be able to create new groups, regardless of app role assignment. This global setting overrides the <strong>Require CreateGroups App Role</strong> setting below.
+                        </p>
+
+                        <div class="form-group form-check form-switch mb-2">
+                            <input type="checkbox"
+                                class="form-check-input"
+                                id="require_member_of_create_group"
+                                name="require_member_of_create_group"
+                                {% if settings.require_member_of_create_group %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="require_member_of_create_group">
+                                Require CreateGroups App Role
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the CreateGroups Enterprise App role can create new groups."></i>
+                        </div>
+                        <p class="text-muted small mb-0">
+                            Required app role value: <code>CreateGroups</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create groups while group workspaces and group creation are enabled.
+                        </p>
+
+                        <hr>
+
+                        <!-- Require Owner to Manage Group Agents, Actions and Workflows -->
+                        <div class="form-group form-check form-switch mb-2">
+                            <input type="checkbox"
+                                class="form-check-input"
+                                id="require_owner_for_group_agent_management"
+                                name="require_owner_for_group_agent_management"
+                                {% if settings.require_owner_for_group_agent_management %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="require_owner_for_group_agent_management">
+                                Require Owner to Manage Group Agents, Actions and Workflows
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only the group Owner can create, edit, and delete group agents, actions, and workflows. Group Admins will have read-only access."></i>
+                        </div>
+                        <p class="text-muted small mb-0">
+                            If enabled, only the group Owner can create, edit, and delete group agents, group actions, and group workflows. Admins and other roles will only be able to view them.
+                        </p>
+                    </div>
+
+                </div>
+
+                <div class="card mb-3 p-3" id="public-workspaces-section">
+                    <h5>
+                        <i class="bi bi-globe me-2"></i>Public Workspaces
+                    </h5>
+                    <p class="text-muted">
+                        Turn this on to enable public workspaces that are visible to everyone in the organization.
+                    </p>
+                    <div class="form-group form-check form-switch mb-3">
+                        <input type="checkbox"
+                            class="form-check-input"
+                            id="enable_public_workspaces"
+                            name="enable_public_workspaces"
+                            {% if settings.enable_public_workspaces %}checked{% endif %}>
+                        <label class="form-check-label ms-2" for="enable_public_workspaces">
+                            Enable Public Workspaces
+                        </label>
+                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow creation of public workspaces that are visible and accessible to all users in the organization for broad knowledge sharing."></i>
+                    </div>
+
+                    <div class="mb-3">
+                        <label class="form-label" for="public_workspace_display_name">End-user display name</label>
+                        <input
+                            type="text"
+                            class="form-control"
+                            id="public_workspace_display_name"
+                            name="public_workspace_display_name"
+                            maxlength="{{ settings.public_workspace_labels.max_length }}"
+                            value="{{ settings.public_workspace_display_name }}"
+                            placeholder="Public Workspace"
+                            aria-describedby="public-workspace-display-name-help"
+                        >
+                        <div class="form-text" id="public-workspace-display-name-help">
+                            Optional. End users will see this label instead of Public Workspace. Admin settings and internal references continue to use Public Workspace.
+                        </div>
+                    </div>
+
+                    <div id="create_public_workspace_permission_setting" {% if not settings.enable_public_workspaces %}style="display: none;"{% endif %}>
+                        <hr>
+                        <div class="form-group form-check form-switch mb-2">
+                            <input type="checkbox"
+                                class="form-check-input"
+                                id="require_member_of_create_public_workspace"
+                                name="require_member_of_create_public_workspace"
+                                {% if settings.require_member_of_create_public_workspace %}checked{% endif %}>
+                            <label class="form-check-label ms-2" for="require_member_of_create_public_workspace">
+                                Require CreatePublicWorkspaces App Role
+                            </label>
+                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the CreatePublicWorkspaces Enterprise App role can create public workspaces."></i>
+                        </div>
+                        <p class="text-muted small mb-0">
+                            Required app role value: <code>CreatePublicWorkspaces</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create public workspaces while public workspaces are enabled.
+                        </p>
+                    </div>
+
+                </div>
+
+
+            </div>
diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html
index 947f7f1ba..f2daba2bc 100644
--- a/application/single_app/templates/admin_settings.html
+++ b/application/single_app/templates/admin_settings.html
@@ -39,6 +39,14 @@
             vertical-align: middle;
         }
 
+        /* Brief highlight when a data-admin-link jumps to a card, so the
+           destination is obvious after the tab switch and scroll. */
+        .admin-card-link-target {
+            outline: 2px solid var(--bs-primary, #0d6efd);
+            outline-offset: 3px;
+            transition: outline-color 0.4s ease-out;
+        }
+
         /* Floating Save Button */
         .floating-save-btn {
             position: fixed;
@@ -928,12005 +936,694 @@ <h4>12. Enhanced Citations and Image Generation</h4>
         <!-- Hide tabs when left navigation is enabled -->
         {% set nav_layout = user_settings.get('settings', {}).get('navLayout') %}
         {% if not (nav_layout == 'sidebar' or (not nav_layout and app_settings.enable_left_nav_default)) %}
-        <ul class="nav nav-tabs" id="adminSettingsTab" role="tablist">
-            <!-- Core Settings -->
-            <li class="nav-item" role="presentation">
-                <button class="nav-link active" id="latest-features-tab" data-bs-toggle="tab" data-bs-target="#latest-features"
-                    type="button" role="tab" aria-controls="latest-features" aria-selected="true">
-                    Latest Features <span class="badge bg-warning text-dark text-uppercase ms-2 latest-feature-nav-badge">New</span>
-                </button>
-            </li>
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="general-tab" data-bs-toggle="tab" data-bs-target="#general"
-                    type="button" role="tab" aria-controls="general" aria-selected="false">
-                    General
-                </button>
-            </li>
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="custom-pages-tab" data-bs-toggle="tab" data-bs-target="#custom-pages"
-                    type="button" role="tab" aria-controls="custom-pages" aria-selected="false">
-                    Custom Pages
-                </button>
-            </li>
-
-            <!-- AI Models Group -->
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="ai-models-tab" data-bs-toggle="tab" data-bs-target="#ai-models"
-                    type="button" role="tab" aria-controls="ai-models" aria-selected="false">
-                    AI Models
-                </button>
-            </li>
-
-            <!-- Content Processing Group -->
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="search-extract-tab" data-bs-toggle="tab" data-bs-target="#search-extract"
-                    type="button" role="tab" aria-controls="search-extract" aria-selected="false">
-                    Search and Extract
-                </button>
-            </li>
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="workspaces-tab" data-bs-toggle="tab" data-bs-target="#workspaces" type="button"
-                    role="tab" aria-controls="workspaces" aria-selected="false">
-                    Workspaces
-                </button>
-            </li>
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="file-sync-tab" data-bs-toggle="tab" data-bs-target="#file-sync" type="button"
-                    role="tab" aria-controls="file-sync" aria-selected="false">
-                    File Sync
-                </button>
-            </li>
+        <ul class="nav nav-pills mb-2" id="adminSettingsGroups" role="tablist" aria-label="Admin settings groups">
+            {% for admin_group in admin_nav %}
             <li class="nav-item" role="presentation">
-                <button class="nav-link" id="workspace-identities-tab" data-bs-toggle="tab" data-bs-target="#workspace-identities" type="button"
-                    role="tab" aria-controls="workspace-identities" aria-selected="false">
-                    Global Identities
+                <button class="nav-link admin-group-pill{% if loop.first %} active{% endif %}"
+                    type="button"
+                    data-admin-group-pill="{{ admin_group.id }}"
+                    aria-selected="{{ 'true' if loop.first else 'false' }}">
+                    <i class="bi {{ admin_group.icon }} me-1" aria-hidden="true"></i>{{ admin_group.label }}
                 </button>
             </li>
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="citation-tab" data-bs-toggle="tab" data-bs-target="#citation"
-                    type="button" role="tab" aria-controls="citation" aria-selected="false">
-                    Citations
+            {% endfor %}
+        </ul>
+        <ul class="nav nav-tabs" id="adminSettingsTab" role="tablist">
+            {% for admin_group in admin_nav %}
+            {% set group_is_first = loop.first %}
+            {% for admin_tab in admin_group.tabs %}
+            {% set is_default_tab = group_is_first and loop.first %}
+            {% if not admin_tab.condition
+                  or (admin_tab.condition == 'enable_agent_template_gallery' and app_settings.enable_agent_template_gallery)
+                  or (admin_tab.condition == 'mcp_ui_enabled' and mcp_ui_enabled) %}
+            <li class="nav-item admin-tab-item"
+                role="presentation"
+                data-admin-group="{{ admin_group.id }}"
+                {% if not group_is_first %}hidden{% endif %}>
+                <button class="nav-link{% if is_default_tab %} active{% endif %}"
+                    id="{{ admin_tab.id }}-tab"
+                    data-bs-toggle="tab"
+                    data-bs-target="#{{ admin_tab.id }}"
+                    type="button"
+                    role="tab"
+                    aria-controls="{{ admin_tab.id }}"
+                    aria-selected="{{ 'true' if is_default_tab else 'false' }}">
+                    {{ admin_tab.label }}
+                    {% if admin_tab.render == 'latest_features' %}
+                    <span class="badge bg-warning text-dark text-uppercase ms-2 latest-feature-nav-badge">New</span>
+                    {% endif %}
                 </button>
             </li>
+            {% endif %}
+            {% endfor %}
+            {% endfor %}
+        </ul>
+        {% endif %}
 
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="safety-tab" data-bs-toggle="tab" data-bs-target="#safety"
-                    type="button" role="tab" aria-controls="safety" aria-selected="false">
-                    Safety
-                </button>
-            </li>
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="security-tab" data-bs-toggle="tab" data-bs-target="#security" type="button" role="tab" aria-controls="security" aria-selected="false">
-                    Security
-                </button>
-            </li>
+        {# Governance status is rendered outside the panes so a message stays
+           visible whichever governance tab is active. #}
+        <div id="governance-status" class="alert d-none" role="alert"></div>
+        {# Shared by every Backup & Recovery tab: one save button, one status
+           line and one operational warning serve all five tabs, so they sit
+           outside the panes and are shown only while that group is active. #}
+        <div data-admin-group-shared="backup-recovery" hidden>
+    <div class="d-flex align-items-center justify-content-between gap-3 mb-2">
+        <div>
+            <h3 class="mb-1">Backup, Migrate &amp; Restore</h3>
+            <p class="text-muted mb-0">Protect SimpleChat data, move selected workspaces to another environment, and stage restore decisions with guided checks.</p>
+        </div>
+        <button type="button" class="btn btn-secondary" id="data-management-save-settings-btn" disabled aria-disabled="true">
+            <i class="bi bi-save me-1"></i>Saved
+        </button>
+    </div>
 
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="agents-tab" data-bs-toggle="tab" data-bs-target="#agents"
-                    type="button" role="tab" aria-controls="agents" aria-selected="false">
-                    Agents
-                </button>
-            </li>
+    <div class="alert alert-warning" id="data-management-operational-warning" role="alert">
+        We suggest not running backups, restores, or migrations during your operational business hours. These jobs run inside the App Service environment and can affect application performance.
+    </div>
 
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="scale-tab" data-bs-toggle="tab" data-bs-target="#scale"
-                    type="button" role="tab" aria-controls="scale" aria-selected="false">
-                    Scale
-                </button>
-            </li>
+    <div class="alert d-none" id="data-management-status" role="status" aria-live="polite"></div>
+        </div>
 
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="control-center-config-tab" data-bs-toggle="tab" data-bs-target="#control-center-config"
-                    type="button" role="tab" aria-controls="control-center-config" aria-selected="false">
-                    Control Center
-                </button>
-            </li>
+        <div class="tab-content mt-3" id="adminSettingsTabContent">
+            {% include "admin/_panes/secrets.html" %}
+            {% include "admin/_panes/access-roles.html" %}
+            {% include "admin/_panes/content-safety.html" %}
+            {% include "admin/_panes/session.html" %}
 
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="data-management-tab" data-bs-toggle="tab" data-bs-target="#data-management"
-                    type="button" role="tab" aria-controls="data-management" aria-selected="false">
-                    Backup, Migrate &amp; Restore
-                </button>
-            </li>
 
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="governance-tab" data-bs-toggle="tab" data-bs-target="#governance"
-                    type="button" role="tab" aria-controls="governance" aria-selected="false">
-                    Governance
-                </button>
-            </li>
+            {% include "admin/_panes/agents.html" %}
+            {% include "admin/_panes/actions.html" %}
+            {% include "admin/_panes/inbound-mcp.html" %}
 
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="logging-tab" data-bs-toggle="tab" data-bs-target="#logging"
-                    type="button" role="tab" aria-controls="logging" aria-selected="false">
-                    Logging
-                </button>
-            </li>
-            <li class="nav-item" role="presentation">
-                <button class="nav-link" id="send-feedback-tab" data-bs-toggle="tab" data-bs-target="#send-feedback"
-                    type="button" role="tab" aria-controls="send-feedback" aria-selected="false">
-                    Send Feedback
-                </button>
-            </li>
-        </ul>
-        {% endif %}
 
-        <div class="tab-content mt-3" id="adminSettingsTabContent">
-            <div class="tab-pane fade" id="security" role="tabpanel" aria-labelledby="security-tab">
-                <p class="text-muted">
-                    Manage security settings for key vault and other security configurations.
-                </p>
-                <div class="card p-3 mb-3" id="keyvault-section">
-                    <div class="d-flex justify-content-between align-items-center mb-2">
-                        <h5>
-                            <i class="bi bi-safe me-2"></i>Key Vault
-                        </h5>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#keyVaultInfoModal">
-                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
-                        </button>
-                    </div>
+            <!-- Governance Tab Content -->
+            {% include "admin/_panes/feature-governance.html" %}
+            {% include "admin/_panes/governance-policies.html" %}
+            {% include "admin/_panes/mcp-governance.html" %}
 
-                    <p class="text-muted">
-                        Configure Key Vault settings.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                        <input
-                            type="checkbox"
-                            class="form-check-input me-2"
-                            id="enable_key_vault_secret_storage"
-                            name="enable_key_vault_secret_storage"
-                            {% if settings.enable_key_vault_secret_storage %}checked{% endif %}
-                        >
-                        <label class="form-check-label" for="enable_key_vault_secret_storage">
-                            Enable Key Vault for Agent and Action Secrets
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Store agent and action sensitive information like API keys and secrets securely in Azure Key Vault."></i>
-                    </div>
+            <!-- Logging Tab Content -->
+            {% include "admin/_panes/logging.html" %}
 
-                    <div id="key_vault_settings" class="{% if not settings.enable_key_vault_secret_storage %}d-none{% endif %}">
-                        <div id="key-vault-warning" class="alert alert-warning mt-2 mb-3">
-                            <strong>⚠️ Warning:</strong> Once you enable Key Vault, you should <u>NOT</u> disable it. Disabling Key Vault after enabling <u>WILL</u> cause loss of access to secrets and break application functionality.
-                        </div>
-                        <div class="mb-3">
-                            <label for="key_vault_name" class="form-label">Key Vault Name</label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="The name of the key vault resource. Endpoint is determined by your AZURE_ENVIRONMENT app service configuration."></i>
-                            <input type="text" class="form-control" id="key_vault_name" name="key_vault_name" value="{{ settings.key_vault_name or '' }}" {% if settings.enable_key_vault_secret_storage %}required{% endif %}>
-                        </div>
-                        <div class="mb-3">
-                            <label for="key_vault_identity" class="form-label">Key Vault Managed Identity Client ID</label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="The Client ID of the User Assigned Managed Identity. Leave blank for system-assigned identity of the app service."></i>
-                            <input type="text" class="form-control" id="key_vault_identity" name="key_vault_identity" value="{{ settings.key_vault_identity or '' }}">
-                        </div>
-                        <button
-                            type="button"
-                            class="btn btn-secondary mt-3"
-                            style="width: auto;"
-                            id="test_key_vault_button"
-                        >
-                            Test Key Vault Connection
-                        </button>
-                        <div id="test_key_vault_result" class="mt-2">
-                        </div>
+            {% include "admin/_panes/branding.html" %}
+            {% include "admin/_panes/notices.html" %}
 
-                        <div class="border-top mt-4 pt-3">
-                            <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-3 mb-3">
-                                <div>
-                                    <h6 class="mb-1">
-                                        <i class="bi bi-bell me-2"></i>Secret Expiration Reminders
-                                    </h6>
-                                    <p class="text-muted small mb-0">
-                                        Track SimpleChat-owned Key Vault secrets with expiration dates, in-app reminders, and an admin inventory that maps opaque secret names back to their owner and source.
-                                    </p>
-                                </div>
-                                <button type="button" class="btn btn-outline-secondary btn-sm" id="key-vault-reminders-refresh">
-                                    <i class="bi bi-arrow-clockwise me-1"></i>Refresh Inventory
-                                </button>
-                            </div>
+            {% include "admin/_panes/custom-pages.html" %}
 
-                            <div class="alert alert-info small" role="alert">
-                                Azure email alerts should still be configured in Azure Monitor or Event Grid for the vault. SimpleChat stores per-secret context so an emailed Key Vault alert can be mapped back to the user, group, action, field, and rotation notes.
-                            </div>
 
-                            <div class="alert alert-light border small" id="key-vault-external-alert-guidance" role="note">
-                                <strong>External automation:</strong> SimpleChat emits a queryable Application Insights event named
-                                <code>key_vault_expiration_reminder_triggered</code> whenever a reminder notification is created.
-                                Use an Azure Monitor scheduled query alert with an action group, Logic App, Function, or webhook to send external notifications. Enable the routing email option below if downstream automation needs to send directly to the configured reminder contact.
-                                <pre class="mt-2 mb-1"><code>traces
-| where customDimensions.sc_event_name == 'key_vault_expiration_reminder_triggered'
-| project timestamp,
-          reminder_id = tostring(customDimensions.sc_event_reminder_id),
-          scope = tostring(customDimensions.sc_event_scope),
-          source_type = tostring(customDimensions.sc_event_source_type),
-          days_until_expiry = toint(customDimensions.sc_event_days_until_expiry),
-          expires_on = tostring(customDimensions.sc_event_expires_on),
-          contact_email = tostring(customDimensions.sc_event_contact_email)</code></pre>
-                                <span class="text-muted">The <code>contact_email</code> column is populated only when the opt-in below is enabled. For workspace-based Log Analytics queries, use the equivalent Application Insights traces table and dimensions/properties fields available in that workspace.</span>
-                            </div>
+            {% include "admin/_panes/model-endpoints.html" %}
+            {% include "admin/_panes/embeddings.html" %}
+            {% include "admin/_panes/image-generation.html" %}
 
-                            <div class="form-check form-switch mb-3">
-                                <input
-                                    class="form-check-input"
-                                    type="checkbox"
-                                    id="enable_key_vault_secret_expiration_reminders"
-                                    name="enable_key_vault_secret_expiration_reminders"
-                                    {% if settings.enable_key_vault_secret_expiration_reminders %}checked{% endif %}
-                                >
-                                <label class="form-check-label" for="enable_key_vault_secret_expiration_reminders">
-                                    Enable SimpleChat expiration reminder tracking
-                                </label>
-                            </div>
+            <!-- Control Center Configuration Tab -->
+            {% include "admin/_panes/control-center-config.html" %}
 
-                            <div id="key_vault_expiration_reminder_settings" class="{% if not settings.enable_key_vault_secret_expiration_reminders %}d-none{% endif %}">
-                                <div class="row g-3">
-                                    <div class="col-md-3">
-                                        <label for="key_vault_secret_expiration_default_lead_days" class="form-label">Default lead days</label>
-                                        <input
-                                            type="number"
-                                            min="1"
-                                            max="3650"
-                                            class="form-control"
-                                            id="key_vault_secret_expiration_default_lead_days"
-                                            name="key_vault_secret_expiration_default_lead_days"
-                                            value="{{ settings.key_vault_secret_expiration_default_lead_days or 30 }}"
-                                        >
-                                    </div>
-                                    <div class="col-md-5">
-                                        <label for="key_vault_secret_expiration_default_contact_email" class="form-label">Default reminder email</label>
-                                        <input
-                                            type="email"
-                                            class="form-control"
-                                            id="key_vault_secret_expiration_default_contact_email"
-                                            name="key_vault_secret_expiration_default_contact_email"
-                                            value="{{ settings.key_vault_secret_expiration_default_contact_email or '' }}"
-                                            placeholder="owner@example.com"
-                                        >
-                                    </div>
-                                    <div class="col-md-4">
-                                        <label for="key_vault_secret_expiration_admin_roles" class="form-label">Admin notification roles</label>
-                                        <input
-                                            type="text"
-                                            class="form-control"
-                                            id="key_vault_secret_expiration_admin_roles"
-                                            name="key_vault_secret_expiration_admin_roles"
-                                            value="{{ (settings.key_vault_secret_expiration_admin_roles or ['Admin'])|join(', ') }}"
-                                            placeholder="Admin"
-                                        >
-                                        <div class="form-text">Comma-separated roles for global-scope reminder notifications.</div>
-                                    </div>
-                                    <div class="col-md-4">
-                                        <label for="key_vault_secret_expiration_scan_interval_seconds" class="form-label">Scan interval seconds</label>
-                                        <input
-                                            type="number"
-                                            min="900"
-                                            max="86400"
-                                            class="form-control"
-                                            id="key_vault_secret_expiration_scan_interval_seconds"
-                                            name="key_vault_secret_expiration_scan_interval_seconds"
-                                            value="{{ settings.key_vault_secret_expiration_scan_interval_seconds or 21600 }}"
-                                        >
-                                    </div>
-                                    <div class="col-md-8 d-flex align-items-end">
-                                        <div class="form-check">
-                                            <input
-                                                class="form-check-input"
-                                                type="checkbox"
-                                                id="key_vault_secret_expiration_require_expiration"
-                                                name="key_vault_secret_expiration_require_expiration"
-                                                {% if settings.key_vault_secret_expiration_require_expiration %}checked{% endif %}
-                                            >
-                                            <label class="form-check-label" for="key_vault_secret_expiration_require_expiration">
-                                                Require expiration dates when users enable tracking on new secrets
-                                            </label>
-                                        </div>
-                                    </div>
-                                    <div class="col-md-8">
-                                        <div class="form-check">
-                                            <input
-                                                class="form-check-input"
-                                                type="checkbox"
-                                                id="key_vault_secret_expiration_emit_contact_email_in_telemetry"
-                                                name="key_vault_secret_expiration_emit_contact_email_in_telemetry"
-                                                aria-describedby="key_vault_secret_expiration_emit_contact_email_in_telemetry_help"
-                                                {% if settings.key_vault_secret_expiration_emit_contact_email_in_telemetry %}checked{% endif %}
-                                            >
-                                            <label class="form-check-label" for="key_vault_secret_expiration_emit_contact_email_in_telemetry">
-                                                Include reminder contact email in external telemetry
-                                            </label>
-                                            <div class="form-text" id="key_vault_secret_expiration_emit_contact_email_in_telemetry_help">
-                                                Default off. Enable only when Azure Monitor, Logic Apps, Functions, or webhook automation needs the email address to route notifications directly.
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
+            {% include "admin/_panes/backup.html" %}
+            {% include "admin/_panes/migrate.html" %}
+            {% include "admin/_panes/restore.html" %}
+            {% include "admin/_panes/cosmos-editor.html" %}
+            {% include "admin/_panes/jobs.html" %}
 
-                            <div class="mt-4">
-                                <div class="d-flex flex-column flex-lg-row gap-2 mb-3">
-                                    <input type="search" class="form-control" id="key-vault-reminders-search" placeholder="Search by owner, action, field, email, reminder ID, or secret name">
-                                    <select class="form-select" id="key-vault-reminders-status" aria-label="Reminder status filter">
-                                        <option value="">All statuses</option>
-                                        <option value="active">Active</option>
-                                        <option value="sync_failed">Sync failed</option>
-                                        <option value="disabled">Disabled</option>
-                                    </select>
-                                    <button type="button" class="btn btn-outline-primary" id="key-vault-reminders-run">
-                                        <i class="bi bi-play-circle me-1"></i>Run Sweep
-                                    </button>
-                                </div>
+            {% include "admin/_panes/redis-caching.html" %}
+            {% include "admin/_panes/cosmos.html" %}
+            {% include "admin/_panes/network.html" %}
 
-                                <div id="key-vault-reminders-status-message" class="alert d-none" role="alert"></div>
-
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th>Expires</th>
-                                                <th>Scope</th>
-                                                <th>Source</th>
-                                                <th>Field</th>
-                                                <th>Contact</th>
-                                                <th>Status</th>
-                                                <th>Reminder ID</th>
-                                                <th>Secret</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="key-vault-reminders-table-body">
-                                            <tr>
-                                                <td colspan="8" class="text-muted">Refresh inventory to load tracked secrets.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </div>
 
+            {% include "admin/_panes/workspace-identities.html" %}
 
-            <div class="tab-pane fade" id="agents" role="tabpanel" aria-labelledby="agents-tab">
 
-                <p class="text-muted">
-                    Configure AI agents and actions for enhanced functionality. Agents provide AI-driven task automation while Actions extend functionality with custom tools and integrations.
-                </p>
+            {% include "admin/_panes/file-sync.html" %}
 
-                <div class="alert alert-info d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3" role="alert">
-                    <div>
-                        <strong>Agent model lifecycle review lives in AI Models.</strong>
+            {% include "admin/_panes/workspace-types.html" %}
+            {% include "admin/_panes/files-sharing.html" %}
+            {% include "admin/_panes/workflow.html" %}
 
-                        <div class="small mt-1">
-                            Use AI Models to review inherited agents, selectively override explicit agent model choices, and move agents to newer default models as costs or model releases change.
-                        </div>
-                    </div>
-                    <button type="button" class="btn btn-outline-primary btn-sm align-self-start" data-open-admin-tab="#ai-models">
-                        <i class="bi bi-box-arrow-up-right me-1"></i>Open AI Models
-                    </button>
-                </div>
+            {# Data Lifecycle: what happens to user data over time #}
+            {% include "admin/_panes/retention.html" %}
+            {% include "admin/_panes/classification.html" %}
+            {% include "admin/_panes/archiving.html" %}
 
-                <div class="alert alert-warning mb-3" role="alert">
-                    <strong>Note:</strong> All changes to global agents and actions require a restart of the web app to take effect.
-                </div>
 
-                {% set analyze_capability = settings.document_action_capabilities.analyze %}
-                {% set comparison_capability = settings.document_action_capabilities.comparison %}
-                <div class="card p-3 mb-4" id="document-action-capabilities-card">
-                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3 mb-3">
-                        <div>
-                            <h5 class="mb-1"><i class="bi bi-files me-2"></i>Document Action Capabilities</h5>
-                            <p class="text-muted small mb-0">Configure the document actions shown in the <strong>Action</strong> dropdown in Chat and Workflow. These controls live in the Agents and Actions tab, but remain separate from the global agent and custom action cards below.</p>
-                        </div>
-                        <span class="badge text-bg-light border align-self-start align-self-lg-center">Chat: 2-300 | Workflow: 2-1000</span>
-                    </div>
-                    <div class="alert alert-light border small mb-3" role="alert">
-                        Use these settings to explicitly allow Analyze and Document Comparison in the Chat and Workflow <strong>Action</strong> dropdowns without bundling them into the global agent or custom action configuration cards below.
-                    </div>
-                    <div class="row g-3">
-                        <div class="col-xl-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="form-check form-switch mb-3">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="document_action_analyze_enabled" name="document_action_analyze_enabled" {% if analyze_capability.enabled %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="document_action_analyze_enabled">Enable Analyze</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to run deterministic analysis across selected documents in chat and workflows."></i>
-                                </div>
-                                <div class="mb-3">
-                                    <div class="d-flex justify-content-between align-items-center mb-1">
-                                        <label for="document_action_analyze_chat_max_documents" class="form-label mb-0">Chat max documents</label>
-                                        <span id="document_action_analyze_chat_max_documents_value" class="small text-muted fw-semibold">{{ analyze_capability.chat_max_documents }}</span>
-                                    </div>
-                                    <div class="row g-2 align-items-center">
-                                        <div class="col-lg-8">
-                                            <input type="range" class="form-range document-action-capability-range" id="document_action_analyze_chat_max_documents_range" min="2" max="300" step="1" value="{{ analyze_capability.chat_max_documents }}" data-range-sync="document_action_analyze_chat_max_documents" data-range-display="document_action_analyze_chat_max_documents_value" />
-                                        </div>
-                                        <div class="col-lg-4">
-                                            <input type="number" class="form-control" id="document_action_analyze_chat_max_documents" name="document_action_analyze_chat_max_documents" min="2" max="300" value="{{ analyze_capability.chat_max_documents }}" />
-                                        </div>
-                                    </div>
-                                    <div class="d-flex justify-content-between small text-muted">
-                                        <span>2</span>
-                                        <span>300</span>
-                                    </div>
-                                </div>
-                                <div>
-                                    <div class="d-flex justify-content-between align-items-center mb-1">
-                                        <label for="document_action_analyze_workflow_max_documents" class="form-label mb-0">Workflow max documents</label>
-                                        <span id="document_action_analyze_workflow_max_documents_value" class="small text-muted fw-semibold">{{ analyze_capability.workflow_max_documents }}</span>
-                                    </div>
-                                    <div class="row g-2 align-items-center">
-                                        <div class="col-lg-8">
-                                            <input type="range" class="form-range document-action-capability-range" id="document_action_analyze_workflow_max_documents_range" min="2" max="1000" step="1" value="{{ analyze_capability.workflow_max_documents }}" data-range-sync="document_action_analyze_workflow_max_documents" data-range-display="document_action_analyze_workflow_max_documents_value" />
-                                        </div>
-                                        <div class="col-lg-4">
-                                            <input type="number" class="form-control" id="document_action_analyze_workflow_max_documents" name="document_action_analyze_workflow_max_documents" min="2" max="1000" value="{{ analyze_capability.workflow_max_documents }}" />
-                                        </div>
-                                    </div>
-                                    <div class="d-flex justify-content-between small text-muted">
-                                        <span>2</span>
-                                        <span>1000</span>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                        <div class="col-xl-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="form-check form-switch mb-3">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="document_action_comparison_enabled" name="document_action_comparison_enabled" {% if comparison_capability.enabled %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="document_action_comparison_enabled">Enable Document Comparison</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to compare one baseline document against one or more selected documents in chat and workflows."></i>
-                                </div>
-                                <div class="mb-3">
-                                    <div class="d-flex justify-content-between align-items-center mb-1">
-                                        <label for="document_action_comparison_chat_max_documents" class="form-label mb-0">Chat max documents</label>
-                                        <span id="document_action_comparison_chat_max_documents_value" class="small text-muted fw-semibold">{{ comparison_capability.chat_max_documents }}</span>
-                                    </div>
-                                    <div class="row g-2 align-items-center">
-                                        <div class="col-lg-8">
-                                            <input type="range" class="form-range document-action-capability-range" id="document_action_comparison_chat_max_documents_range" min="2" max="300" step="1" value="{{ comparison_capability.chat_max_documents }}" data-range-sync="document_action_comparison_chat_max_documents" data-range-display="document_action_comparison_chat_max_documents_value" />
-                                        </div>
-                                        <div class="col-lg-4">
-                                            <input type="number" class="form-control" id="document_action_comparison_chat_max_documents" name="document_action_comparison_chat_max_documents" min="2" max="300" value="{{ comparison_capability.chat_max_documents }}" />
-                                        </div>
-                                    </div>
-                                    <div class="d-flex justify-content-between small text-muted">
-                                        <span>2</span>
-                                        <span>300</span>
-                                    </div>
-                                </div>
-                                <div>
-                                    <div class="d-flex justify-content-between align-items-center mb-1">
-                                        <label for="document_action_comparison_workflow_max_documents" class="form-label mb-0">Workflow max documents</label>
-                                        <span id="document_action_comparison_workflow_max_documents_value" class="small text-muted fw-semibold">{{ comparison_capability.workflow_max_documents }}</span>
-                                    </div>
-                                    <div class="row g-2 align-items-center">
-                                        <div class="col-lg-8">
-                                            <input type="range" class="form-range document-action-capability-range" id="document_action_comparison_workflow_max_documents_range" min="2" max="1000" step="1" value="{{ comparison_capability.workflow_max_documents }}" data-range-sync="document_action_comparison_workflow_max_documents" data-range-display="document_action_comparison_workflow_max_documents_value" />
-                                        </div>
-                                        <div class="col-lg-4">
-                                            <input type="number" class="form-control" id="document_action_comparison_workflow_max_documents" name="document_action_comparison_workflow_max_documents" min="2" max="1000" value="{{ comparison_capability.workflow_max_documents }}" />
-                                        </div>
-                                    </div>
-                                    <div class="d-flex justify-content-between small text-muted">
-                                        <span>2</span>
-                                        <span>1000</span>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
+            {% include "admin/_panes/citation.html" %}
 
-                <!-- Agents Configuration Section -->
-                <div class="card p-3 mb-4" id="agents-configuration">
-                    <h5 class="card-title">
-                        <i class="bi bi-robot me-2"></i>Agents Configuration
-                    </h5>
-                    <p class="text-muted small">
-                        Configure AI agents powered by Semantic Kernel for task automation and orchestration.
-                    </p>
-                    <div class="card p-3 mb-3" id="agents-page-customization-card">
-                        <h6 class="mb-2">
-                            <i class="bi bi-palette me-2"></i>Agents Page Customization
-                        </h6>
-                        <p class="text-muted small">Customize the public Agents page hero, color treatment, and optional guidance message.</p>
-                        <div class="row g-3">
-                            <div class="col-lg-6">
-                                <label for="agents_page_title" class="form-label">Hero Title</label>
-                                <input type="text" class="form-control" id="agents_page_title" name="agents_page_title" maxlength="120" value="{{ settings.agents_page_title | default('Find your next AI partner') }}" />
-                            </div>
-                            <div class="col-lg-6">
-                                <label for="agents_page_subtitle" class="form-label">Hero Subtitle</label>
-                                <input type="text" class="form-control" id="agents_page_subtitle" name="agents_page_subtitle" maxlength="240" value="{{ settings.agents_page_subtitle | default('Explore specialized agents built to accelerate how you work.') }}" />
-                            </div>
-                            <div class="col-md-4">
-                                <label for="agents_page_hero_color_mode" class="form-label">Hero Color Mode</label>
-                                <select class="form-select" id="agents_page_hero_color_mode" name="agents_page_hero_color_mode">
-                                    <option value="single" {% if settings.agents_page_hero_color_mode != 'two_tone' %}selected{% endif %}>Single color</option>
-                                    <option value="two_tone" {% if settings.agents_page_hero_color_mode == 'two_tone' %}selected{% endif %}>Two tone gradient</option>
-                                </select>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="agents_page_hero_primary_color" class="form-label">Primary Color</label>
-                                <input type="color" class="form-control form-control-color" id="agents_page_hero_primary_color" name="agents_page_hero_primary_color" value="{{ settings.agents_page_hero_primary_color | default('#0f172a') }}" />
-                            </div>
-                            <div class="col-md-4">
-                                <label for="agents_page_hero_secondary_color" class="form-label">Secondary Color</label>
-                                <input type="color" class="form-control form-control-color" id="agents_page_hero_secondary_color" name="agents_page_hero_secondary_color" value="{{ settings.agents_page_hero_secondary_color | default('#1e293b') }}" />
-                                <div class="form-text">Used when two tone gradient is selected.</div>
-                            </div>
-                            <div class="col-12">
-                                <label for="agents_page_disclaimer_markdown" class="form-label">Disclaimer / Guidance Text <span class="text-muted fw-normal">(Markdown supported)</span></label>
-                                <textarea class="form-control" id="agents_page_disclaimer_markdown" name="agents_page_disclaimer_markdown" rows="4" maxlength="3000" placeholder="Need a new agent? Contact ai-support@example.com.">{{ settings.agents_page_disclaimer_markdown | default('') }}</textarea>
-                                <div class="form-text">Shown below the Agents page hero. Use this for contact details, request guidance, or governance reminders.</div>
-                            </div>
-                            <div class="col-12">
-                                <div class="form-check form-switch">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="agents_page_show_instructions_in_details" name="agents_page_show_instructions_in_details" {% if settings.agents_page_show_instructions_in_details | default(true) %}checked{% endif %} />
-                                    <label class="form-check-label" for="agents_page_show_instructions_in_details">Show agent instructions in Agents page details</label>
-                                </div>
-                                <div class="form-text">When disabled, the Agents tab details popup hides instructions and the catalog API response omits them.</div>
-                            </div>
-                            <div class="col-12">
-                                <hr class="my-2" />
-                                <h6 class="mb-2">Promoted Popular Agents</h6>
-                                <p class="text-muted small mb-3">Highlight selected agents in the Popular tab even before they have usage counts. Users only see promoted agents that are already visible to them.</p>
-                                <textarea class="d-none" id="agents_page_promoted_popular_agents_json" name="agents_page_promoted_popular_agents_json">{{ settings.agents_page_promoted_popular_agents | default([], true) | tojson }}</textarea>
-                                <div class="row g-3 mb-3">
-                                    <div class="col-lg-4">
-                                        <label for="agents_page_promoted_popular_order" class="form-label">Placement</label>
-                                        <select class="form-select" id="agents_page_promoted_popular_order" name="agents_page_promoted_popular_order">
-                                            <option value="before" {% if settings.agents_page_promoted_popular_order | default('before') == 'before' %}selected{% endif %}>Before actual popular agents</option>
-                                            <option value="after" {% if settings.agents_page_promoted_popular_order | default('before') == 'after' %}selected{% endif %}>After actual popular agents</option>
-                                            <option value="mixed" {% if settings.agents_page_promoted_popular_order | default('before') == 'mixed' %}selected{% endif %}>Mixed by usage</option>
-                                        </select>
-                                    </div>
-                                    <div class="col-lg-4">
-                                        <label for="agents_page_promoted_popular_tag_label" class="form-label">Promoted Tag Label</label>
-                                        <input type="text" class="form-control" id="agents_page_promoted_popular_tag_label" name="agents_page_promoted_popular_tag_label" maxlength="40" value="{{ settings.agents_page_promoted_popular_tag_label | default('Promoted') }}" />
-                                    </div>
-                                    <div class="col-lg-4 d-flex align-items-end">
-                                        <div>
-                                            <div class="form-check form-switch">
-                                                <input class="form-check-input" type="checkbox" role="switch" id="agents_page_promoted_popular_tag_enabled" name="agents_page_promoted_popular_tag_enabled" {% if settings.agents_page_promoted_popular_tag_enabled | default(true) %}checked{% endif %} />
-                                                <label class="form-check-label" for="agents_page_promoted_popular_tag_enabled">Show promoted tag</label>
-                                            </div>
-                                            <div class="form-text">When enabled, promoted agents show the configured tag in the Popular tab.</div>
-                                        </div>
-                                    </div>
-                                </div>
-                                <div class="row g-2 align-items-end mb-3">
-                                    <div class="col-lg-9">
-                                        <label for="agents-page-promoted-agent-select" class="form-label">Add Agent</label>
-                                        <select class="form-select" id="agents-page-promoted-agent-select">
-                                            <option value="">Loading available agents...</option>
-                                        </select>
-                                    </div>
-                                    <div class="col-lg-3">
-                                        <button type="button" class="btn btn-outline-primary w-100" id="agents-page-promoted-agent-add">
-                                            <i class="bi bi-plus-lg me-1" aria-hidden="true"></i>Add Agent
-                                        </button>
-                                    </div>
-                                </div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle mb-2">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Agent</th>
-                                                <th scope="col" class="text-nowrap">Show In</th>
-                                                <th scope="col" class="text-end">Actions</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="agents-page-promoted-popular-tbody"></tbody>
-                                    </table>
-                                </div>
-                                <div class="alert alert-info py-2 mb-0" id="agents-page-promoted-popular-empty">No agents are promoted yet.</div>
-                                <div class="alert alert-warning py-2 mt-2 mb-0 d-none" id="agents-page-promoted-popular-load-error" role="status"></div>
-                            </div>
-                        </div>
-                    </div>
-                <div class="mb-3">
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" role="switch" id="toggle-enable-agents-agents" name="enable_semantic_kernel" {% if settings.enable_semantic_kernel %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="toggle-enable-agents-agents">Enable Agents</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the agents system powered by Semantic Kernel for AI-driven task automation and orchestration."></i>
-                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_global_agents_usage">Govern Global Agents</button>
-                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_global_actions_usage">Govern Global Actions</button>
-                    </div>
-                    <div id="per-user-sk-restart-msg" class="text-muted small mb-2" style="display:none;">Requires a restart to take effect.</div>
-                </div>
-                {% if not settings.enable_semantic_kernel %}
-                    <div class="alert alert-info">
-                        <strong>Agents UI is not available while agents are disabled.</strong>
-                    </div>
-                {% else %}
-                    <div>
-                        <div class="form-check form-switch mb-2">
-                            <input class="form-check-input" type="checkbox" role="switch" id="toggle-per-user-sk" name="per_user_semantic_kernel" {% if settings.per_user_semantic_kernel %}checked{% endif %} {% if not settings.enable_semantic_kernel %}disabled{% endif %}>
-                            <label class="form-check-label ms-2" for="toggle-per-user-sk">Workspace Mode (workspace-specific agents/plugins and disables global configuration)</label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="If enabled, each user gets their own agent/plugin set. If disabled, all users share the same global set."></i>
-                        </div>
-                        {% if settings.per_user_semantic_kernel %}
-                            <!-- Agent Feature Flags -->
-                            <div class="card p-3 mb-3" id="agent-toggles-card">
-                                <h6 class="mb-2">Workspace Feature Toggles</h6>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-user-agents" name="allow_user_agents" {% if settings.allow_user_agents %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-allow-user-agents">Allow User Agents</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage their own workspace-level agents for personal use and customization."></i>
-                                    <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_user_agents">Govern</button>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-group-agents" name="allow_group_agents" {% if settings.allow_group_agents %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-allow-group-agents">Allow Group Agents</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage group-level agents that can be shared within workgroups and teams."></i>
-                                    <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_group_agents">Govern</button>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-user-custom-endpoints" name="allow_user_custom_endpoints" {% if settings.allow_user_custom_endpoints %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-allow-user-custom-endpoints">Allow User Custom Endpoints</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to configure custom endpoints for their personal workspace agents and model endpoints."></i>
-                                    <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_user_endpoints">Govern</button>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-group-custom-endpoints" name="allow_group_custom_endpoints" {% if settings.allow_group_custom_endpoints %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-allow-group-custom-endpoints">Allow Group Custom Endpoints</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to configure custom endpoints for group workspace agents and model endpoints."></i>
-                                    <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_group_endpoints">Govern</button>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-merge-global-sk" name="merge_global_semantic_kernel_with_workspace" {% if settings.merge_global_semantic_kernel_with_workspace %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-merge-global-sk">Merge Global Agents/Plugins into Workspace</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="If enabled, workspace agents/plugins will include global ones as well."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-enable-agent-template-gallery" name="enable_agent_template_gallery" {% if settings.enable_agent_template_gallery %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-enable-agent-template-gallery">Enable Agent Template Gallery</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow workspace users to browse approved templates and submit their own for review."></i>
-                                </div>
-                            </div>
-                            <!-- End Agent Feature Flags -->
+            {# Chat: the conversation surface itself #}
+            {% include "admin/_panes/chat-experience.html" %}
+            {% include "admin/_panes/feedback-alerts.html" %}
 
-                        {% endif %}
-                        <!-- Orchestration Settings Card -->
-                        <div class="d-flex justify-content-between align-items-center mb-3">
-                            <h4>Agent Orchestration Settings</h4>
-                        </div>
-                        <div class="card p-3 mb-3">
-                            <p class="text-muted mb-1">Configure how the chat system orchestrates agents (single or multi-agent group chat).</p>
-                            <div class="mb-3">
-                                <label for="orchestration_type" class="form-label">Orchestration Type</label>
-                                <select class="form-select" id="orchestration_type" name="orchestration_type"></select>
-                            </div>
-                            <div class="mb-3" id="max_rounds_per_agent_group" style="display:none;">
-                                <label for="max_rounds_per_agent" class="form-label">Max Rounds Per Agent (Group Chat)</label>
-                                <input type="number" class="form-control" id="max_rounds_per_agent" name="max_rounds_per_agent" min="1" value="1">
-                            </div>
-                            <button type="button" class="btn btn-primary" id="save-orchestration-settings-btn">Save Orchestration Settings</button>
-                        </div>
-                        <div class="d-flex justify-content-between align-items-center mb-3">
-                            <h4>Global  Agents</h4>
-                            <div class="d-flex align-items-center gap-2">
-                                <button type="button" class="btn btn-outline-info btn-sm agent-examples-trigger" data-bs-toggle="modal" data-bs-target="#agentExamplesModal" data-trigger-button="#add-agent-btn">
-                                    <i class="bi bi-magic"></i>
-                                    Agent Templates
-                                </button>
-                                <button type="button" class="btn btn-primary" id="add-agent-btn">Add Agent</button>
-                            </div>
-                        </div>
-                        <p class="text-muted small">Disable a global agent to keep it saved for admins while hiding it from runtime selection until it is re-enabled.</p>
-                        <div class="mb-3 d-flex align-items-center">
-                            {% if settings.orchestration_type == "default_agent" %}
-                                <label for="default-agent-select" class="form-label me-2 mb-0">Selected Agent:</label>
-                            {% else %}
-                                <label for="default-agent-select" class="form-label me-2 mb-0">Orchestrator Agent:</label>
-                            {% endif %}
-                            <select id="default-agent-select" class="form-select w-auto" style="min-width:200px;"></select>
-                            <span id="default-agent-select-msg" class="ms-2 text-muted small"></span>
-                        </div>
-                        <table class="table table-bordered" id="agents-table">
-                            <thead>
-                                <tr>
-                                    <th>Name</th>
-                                    <th>Display Name</th>
-                                    <th>Description</th>
-                                    {% if settings.orchestration_type == "default_agent" %}
-                                        <th>Selected Agent</th>
-                                    {% else %}
-                                        <th>Orchestrator Agent</th>
-                                    {% endif %}
-                                    <th>Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody id="agents-table-body"></tbody>
-                        </table>
-                    </div>
-                {% endif %}
-                </div>
 
-                {% if settings.enable_agent_template_gallery %}
-                <div class="card p-3 mb-4" id="agent-template-approvals-section">
-                    <div class="row g-3 mb-3">
-                        <div class="col-xl-6">
-                            <div class="form-check form-switch mb-0">
-                                <input class="form-check-input" type="checkbox" role="switch" id="toggle-agent-template-submissions" name="agent_templates_allow_user_submission" {% if settings.agent_templates_allow_user_submission %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="toggle-agent-template-submissions">Allow User Template Submissions</label>
-                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow workspace users to submit their custom agents for review."></i>
-                            </div>
-                        </div>
-                        <div class="col-xl-6">
-                            <div class="form-check form-switch mb-0">
-                                <input class="form-check-input" type="checkbox" role="switch" id="toggle-agent-template-approval" name="agent_templates_require_approval" {% if settings.agent_templates_require_approval %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="toggle-agent-template-approval">Require Admin Approval</label>
-                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Keep user submissions pending until an admin approves them."></i>
-                            </div>
-                        </div>
-                    </div>
-                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3">
-                        <div>
-                            <h5 class="mb-1">
-                                <i class="bi bi-layers me-2"></i>Agent Template Approvals
-                            </h5>
-                            <p class="text-muted small mb-0">Template submissions are now reviewed from the shared approvals page.</p>
-                        </div>
-                        <a class="btn btn-outline-primary align-self-start align-self-lg-center" href="/approvals#agent-template-approvals">
-                            <i class="bi bi-box-arrow-up-right me-1"></i>Open Approvals Queue
-                        </a>
-                    </div>
-                </div>
-                {% endif %}
-
-                <!-- Actions Configuration Section -->
-                <div class="card p-3 mb-4" id="actions-configuration">
-                    <h5 class="card-title">
-                        <i class="bi bi-plugin me-2"></i>Global Actions Configuration
-                    </h5>
-                    <p class="text-muted small">
-                        Configure custom actions and tools to extend functionality with integrations and specialized capabilities.
-                    </p>
 
-                    {% if not settings.enable_semantic_kernel %}
-                        <div class="alert alert-info">
-                            <strong>Actions are not available while agents are disabled.</strong> Enable agents above to configure actions.
-                        </div>
-                    {% else %}
-                        <div>
-                            <div class="d-flex justify-content-between align-items-center mb-3">
-                                <h6>Global Actions</h6>
-                                <button type="button" class="btn btn-primary btn-sm" id="add-plugin-btn">Add Action</button>
-                            </div>
-                            <p class="text-muted small">Disable a global action to keep the configuration without exposing it to runtime action loading until it is re-enabled.</p>
-                            {% if settings.per_user_semantic_kernel %}
-                            <!-- Action Feature Flags -->
-                                <div class="card p-3 mb-3" id="plugin-feature-toggles">
-                                    <h6 class="mb-2">Workspace Action Feature Toggles</h6>
-                                    <div class="form-check form-switch mb-2">
-                                        <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-user-plugins" name="allow_user_plugins" {% if settings.allow_user_plugins %}checked{% endif %}>
-                                        <label class="form-check-label ms-2" for="toggle-allow-user-plugins">Allow Personal Actions</label>
-                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage their own workspace-level actions/plugins for personal use."></i>
-                                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_user_actions">Govern</button>
-                                    </div>
-                                    <div class="form-check form-switch mb-2">
-                                        <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-group-plugins" name="allow_group_plugins" {% if settings.allow_group_plugins %}checked{% endif %}>
-                                        <label class="form-check-label ms-2" for="toggle-allow-group-plugins">Allow Group Actions</label>
-                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage group-level actions/plugins that can be shared within workgroups."></i>
-                                        <button type="button" class="btn btn-outline-info btn-sm ms-2 governance-primary-link" data-governance-target="governance_group_actions">Govern</button>
-                                    </div>
-                                </div>
-                            {% endif %}
-
-                            <!-- Core Plugin Toggles -->
-                            <div class="card p-3 mb-3" id="core-plugin-toggles">
-                                <h6 class="mb-2">Core Action Toggles</h6>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-time-plugin" name="enable_time_plugin" {% if settings.enable_time_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-time-plugin">Enable Time Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to get current date, time, and perform time-related calculations and conversions."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-http-plugin" name="enable_http_plugin" {% if settings.enable_http_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-http-plugin">Enable HTTP Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to make HTTP requests to websites for data retrieval and integration."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-wait-plugin" name="enable_wait_plugin" {% if settings.enable_wait_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-wait-plugin">Enable Wait Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to pause execution for specified time periods, useful for delays and timing control in workflows."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-math-plugin" name="enable_math_plugin" {% if settings.enable_math_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-math-plugin">Enable Math Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to perform mathematical calculations, solve equations, and handle complex mathematical operations."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-text-plugin" name="enable_text_plugin" {% if settings.enable_text_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-text-plugin">Enable Text Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to perform text processing operations like formatting, validation, and manipulation of strings and text content."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-default-embedding-model-plugin" name="enable_default_embedding_model_plugin" {% if settings.enable_default_embedding_model_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-default-embedding-model-plugin">Enable Default Embedding Model Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to access and use the default embedding model for text similarity and vector operations."></i>
-                                </div>
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-fact-memory-plugin" name="enable_fact_memory_plugin" {% if settings.enable_fact_memory_plugin %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-fact-memory-plugin">Enable Fact Memory Action</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enables agents to store and retrieve facts and information across conversations for improved memory and context retention."></i>
-                                </div>
-                                <div class="mb-2" id="tabular-processing-toggle-wrapper">
-                                    <div class="d-flex align-items-center">
-                                        <span class="fw-semibold">Tabular Processing Action</span>
-                                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Agents can analyze tabular data files (CSV, XLSX) using pandas for aggregations, filtering, and full dataset operations. This action is automatically enabled whenever Enhanced Citations is enabled."></i>
-                                    </div>
-                                    <small class="text-muted d-block ms-4" id="tabular-processing-dependency-note">Automatically enabled when Enhanced Citations is enabled</small>
-                                </div>
-                            </div>
-                            <table class="table table-bordered" id="plugins-table">
-                                <thead>
-                                    <tr>
-                                        <th>Display Name</th>
-                                        <th>Description</th>
-                                        <th>Actions</th>
-                                    </tr>
-                                </thead>
-                                <tbody id="admin-plugins-table-body"></tbody>
-                            </table>
-                        </div>
-                    {% endif %}
-                </div>
-                {% if mcp_ui_enabled %}
-                <div class="card p-3 mb-4" id="inbound-mcp-configuration" data-default-tenant-id="{{ inbound_mcp_easy_auth_script_context.tenant_id }}">
-                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-3 mb-3">
-                        <div>
-                            <h5 class="card-title mb-1">
-                                <i class="bi bi-diagram-3 me-2"></i>Inbound MCP Server
-                            </h5>
-                            <p class="text-muted small mb-0">
-                                Configure the governed SimpleChat MCP endpoint used by external MCP clients. Personal tools use delegated user tokens by default; tool access remains deny-by-default until authentication, source, client, and governance policy all allow the request.
-                            </p>
-                        </div>
-                        <div class="d-flex flex-column gap-2 align-items-lg-end">
-                            <span class="badge text-bg-warning align-self-start align-self-lg-end">Preview</span>
-                            <button type="button" class="btn btn-sm btn-outline-primary" data-bs-toggle="modal" data-bs-target="#inboundMcpInfoModal">
-                                <i class="bi bi-info-circle me-1"></i>About MCP &amp; Tools
-                            </button>
-                        </div>
-                    </div>
 
-                    <div class="alert alert-info small" role="alert">
-                        Enable only after the Microsoft Entra delegated scope, delegated user app role, client app allowlist, source allowlist, and SimpleChat governance item policies are configured. Personal MCP tools require delegated user context plus an assigned user role. The app-only role is reserved for future non-personal service/admin tools.
-                    </div>
+            {% include "admin/_panes/web-research.html" %}
+            {% include "admin/_panes/search-index.html" %}
+            {% include "admin/_panes/extraction.html" %}
+            {% include "admin/_panes/audio-video.html" %}
 
-                    <div class="row g-3">
-                        <div class="col-xl-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <h6 class="mb-3">Runtime Gate</h6>
-                                <div class="form-check form-switch mb-3">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="enable_inbound_mcp_server" name="enable_inbound_mcp_server" {% if settings.enable_inbound_mcp_server %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="enable_inbound_mcp_server">Enable inbound MCP server</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Controls whether authenticated requests to the SimpleChat inbound MCP endpoint are accepted."></i>
-                                </div>
-                                <div class="mb-3">
-                                    <label class="form-label" for="inbound_mcp_required_scope">Required delegated scope</label>
-                                    <input class="form-control" type="text" id="inbound_mcp_required_scope" name="inbound_mcp_required_scope" value="{{ settings.inbound_mcp_required_scope }}" autocomplete="off">
-                                    <div class="form-text">Default: <code>DelegatedMcpServerAccess</code>. VS Code and other user clients must present this delegated scope.</div>
-                                </div>
-                                <div class="mb-3">
-                                    <label class="form-label" for="inbound_mcp_required_user_role">Required delegated user role</label>
-                                    <input class="form-control" type="text" id="inbound_mcp_required_user_role" name="inbound_mcp_required_user_role" value="{{ settings.inbound_mcp_required_user_role }}" autocomplete="off">
-                                    <div class="form-text">Default: <code>InboundMCPUserAccess</code>. Governance determines which users/groups can use tools after this Entra role and delegated scope pass.</div>
-                                </div>
-                                <div class="mb-0">
-                                    <label class="form-label" for="inbound_mcp_required_app_role">Required app-only role</label>
-                                    <input class="form-control" type="text" id="inbound_mcp_required_app_role" name="inbound_mcp_required_app_role" value="{{ settings.inbound_mcp_required_app_role }}" autocomplete="off">
-                                    <div class="form-text">Default: <code>InboundMCPAppAccess</code>. Reserved for future app-only MCP tools and still governed separately.</div>
-                                </div>
-                            </div>
-                        </div>
+            {% include "admin/_panes/support-menu.html" %}
+            {% include "admin/_panes/send-feedback.html" %}
 
-                        <div class="col-xl-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <h6 class="mb-3">Endpoint Contract</h6>
-                                <dl class="row small mb-0">
-                                    <dt class="col-sm-5">MCP endpoint</dt>
-                                    <dd class="col-sm-7"><code>{{ inbound_mcp_resource_path }}</code></dd>
-                                    <dt class="col-sm-5">Protected resource metadata</dt>
-                                    <dd class="col-sm-7"><code>{{ inbound_mcp_prm_path }}</code></dd>
-                                    <dt class="col-sm-5">Transport</dt>
-                                    <dd class="col-sm-7">Streamable HTTP JSON-RPC</dd>
-                                    <dt class="col-sm-5">Current tool surface</dt>
-                                    <dd class="col-sm-7">Personal delegated tools only.</dd>
-                                    <dt class="col-sm-5">Tool identity</dt>
-                                    <dd class="col-sm-7">Delegated user token required for personal data.</dd>
-                                </dl>
-                                <div class="alert alert-light border small mt-3 mb-0" role="alert">
-                                    Endpoint paths are fixed in application routing for this initial UI slice. Change the app setting below for the source header only.
-                                </div>
-                            </div>
-                        </div>
+            {# Latest Features stays last so it never opens by default #}
+            {% include "admin/_panes/latest-features.html" %}
+        </div>
+        <!-- End of Admin tab content -->
+    </form>
 
-                        <div class="col-12">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-2 mb-3">
-                                    <div>
-                                        <h6 class="mb-1">Request Size &amp; Throttling</h6>
-                                        <div class="small text-muted">Protect the inbound MCP endpoint from oversized payloads and noisy clients. Rate limits are enforced per caller and tool category across app instances.</div>
-                                    </div>
-                                    <div class="form-check form-switch">
-                                        <input class="form-check-input" type="checkbox" role="switch" id="enable_inbound_mcp_rate_limits" name="enable_inbound_mcp_rate_limits" {% if settings.enable_inbound_mcp_rate_limits %}checked{% endif %}>
-                                        <label class="form-check-label ms-2" for="enable_inbound_mcp_rate_limits">Enable tool throttles</label>
-                                    </div>
-                                </div>
-                                <div class="row g-3">
-                                    <div class="col-md-6 col-xl-3">
-                                        <label class="form-label" for="inbound_mcp_max_request_bytes">Max request bytes</label>
-                                        <input class="form-control" type="number" id="inbound_mcp_max_request_bytes" name="inbound_mcp_max_request_bytes" min="1024" max="1048576" step="1" value="{{ settings.inbound_mcp_max_request_bytes }}">
-                                        <div class="form-text">Default: <code>65536</code>. Range: 1 KB to 1 MB.</div>
-                                    </div>
-                                    <div class="col-md-6 col-xl-3">
-                                        <label class="form-label" for="inbound_mcp_rate_limit_window_seconds">Rate window seconds</label>
-                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_window_seconds" name="inbound_mcp_rate_limit_window_seconds" min="10" max="3600" step="1" value="{{ settings.inbound_mcp_rate_limit_window_seconds }}">
-                                        <div class="form-text">Default: <code>60</code>. Applies to each throttle category.</div>
-                                    </div>
-                                    <div class="col-md-4 col-xl-2">
-                                        <label class="form-label" for="inbound_mcp_rate_limit_read_per_window">Read limit</label>
-                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_read_per_window" name="inbound_mcp_rate_limit_read_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_read_per_window }}">
-                                        <div class="form-text">Default: <code>120</code>.</div>
-                                    </div>
-                                    <div class="col-md-4 col-xl-2">
-                                        <label class="form-label" for="inbound_mcp_rate_limit_search_per_window">Search limit</label>
-                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_search_per_window" name="inbound_mcp_rate_limit_search_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_search_per_window }}">
-                                        <div class="form-text">Default: <code>30</code>.</div>
-                                    </div>
-                                    <div class="col-md-4 col-xl-2">
-                                        <label class="form-label" for="inbound_mcp_rate_limit_write_per_window">Write limit</label>
-                                        <input class="form-control" type="number" id="inbound_mcp_rate_limit_write_per_window" name="inbound_mcp_rate_limit_write_per_window" min="1" max="10000" step="1" value="{{ settings.inbound_mcp_rate_limit_write_per_window }}">
-                                        <div class="form-text">Default: <code>10</code>.</div>
-                                    </div>
-                                </div>
-                                <div class="alert alert-light border small mt-3 mb-0" role="alert">
-                                    Application Insights events include <code>mcp_request_id</code>, caller app, delegated user, source, tool, duration, result status, and rate-limit category without recording prompts, document content, bearer tokens, or secrets.
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="col-12">
-                            <input type="hidden" id="inbound_mcp_allowed_client_app_entries_json" name="inbound_mcp_allowed_client_app_entries_json" value='{{ settings.inbound_mcp_allowed_client_app_entries | default([], true) | tojson }}'>
-                            <input type="hidden" id="inbound_mcp_allowed_tenant_entries_json" name="inbound_mcp_allowed_tenant_entries_json" value='{{ settings.inbound_mcp_allowed_tenant_entries | default([], true) | tojson }}'>
-                            <input type="hidden" id="inbound_mcp_allowed_source_entries_json" name="inbound_mcp_allowed_source_entries_json" value='{{ settings.inbound_mcp_allowed_source_entries | default([], true) | tojson }}'>
-                        </div>
-
-                        <div class="col-12">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="d-flex justify-content-between align-items-start gap-2 mb-2">
-                                    <div>
-                                        <h6 class="mb-1">Allowed client app IDs</h6>
-                                        <div class="small text-muted">Required allowlist. Empty means no MCP clients can connect.</div>
-                                    </div>
-                                    <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="clients">Add</button>
-                                </div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle mb-2">
-                                        <thead>
-                                            <tr>
-                                                <th>Client app ID</th>
-                                                <th>Description</th>
-                                                <th class="text-end">Actions</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="inbound-mcp-client-app-entries-body"></tbody>
-                                    </table>
-                                </div>
-                                <div class="small text-muted" id="inbound-mcp-client-app-entries-summary"></div>
-                            </div>
-                        </div>
-
-                        <div class="col-12">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="inbound_mcp_allow_external_tenants" name="inbound_mcp_allow_external_tenants" {% if settings.inbound_mcp_allow_external_tenants %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="inbound_mcp_allow_external_tenants">Allow additional tenant IDs</label>
-                                </div>
-                                <div class="small text-muted mb-3">
-                                    Off allows only the configured SimpleChat tenant. Turning this on auto-includes the SimpleChat tenant and lets admins add more tenants.
-                                </div>
-                                <div id="inbound-mcp-tenant-list-container" class="{% if not settings.inbound_mcp_allow_external_tenants %}d-none{% endif %}">
-                                    <div class="d-flex justify-content-between align-items-center mb-2">
-                                        <h6 class="mb-0">Allowed tenant IDs</h6>
-                                        <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="tenants">Add</button>
-                                    </div>
-                                    <div class="table-responsive">
-                                        <table class="table table-sm align-middle mb-2">
-                                            <thead>
-                                                <tr>
-                                                    <th>Tenant ID</th>
-                                                    <th>Description</th>
-                                                    <th class="text-end">Actions</th>
-                                                </tr>
-                                            </thead>
-                                            <tbody id="inbound-mcp-tenant-entries-body"></tbody>
-                                        </table>
-                                    </div>
-                                    <div class="small text-muted" id="inbound-mcp-tenant-entries-summary"></div>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="col-12">
-                            <div class="border rounded-3 p-3 h-100">
-                                <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="inbound_mcp_allow_all_source_ids" name="inbound_mcp_allow_all_source_ids" {% if settings.inbound_mcp_allow_all_source_ids %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="inbound_mcp_allow_all_source_ids">Allow all source IDs</label>
-                                </div>
-                                <div class="small text-muted mb-3">
-                                    Default on accepts any source signal at the runtime allowlist layer. Turn off to require explicit source values here. In both modes, admins must still create an inbound MCP source governance policy before tools are returned.
-                                </div>
-                                <div class="mb-3">
-                                    <label class="form-label" for="inbound_mcp_source_header">Source header name</label>
-                                    <input class="form-control" type="text" id="inbound_mcp_source_header" name="inbound_mcp_source_header" value="{{ settings.inbound_mcp_source_header }}" autocomplete="off">
-                                    <div class="form-text">Default: <code>X-SimpleChat-MCP-Source</code>.</div>
-                                </div>
-                                <div class="alert alert-warning py-2 small" role="alert">
-                                    Source IDs are read from the configured header when present. This is a client-provided value and can be spoofed unless a trusted gateway, APIM policy, or similar control sets/enforces it.
-                                </div>
-                                <div id="inbound-mcp-all-source-governance-callout" class="alert alert-info py-2 small {% if not settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}" role="alert">
-                                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-2">
-                                        <div>
-                                            Create an <code>inbound_mcp_source</code> policy for <code>*</code> to choose which users or groups can use inbound MCP from any accepted source.
-                                        </div>
-                                        <button
-                                            type="button"
-                                            class="btn btn-sm btn-outline-primary governance-new-inbound-mcp-policy-btn"
-                                            data-governance-inbound-mcp-entity="inbound_mcp_source"
-                                            data-governance-inbound-mcp-item="*"
-                                            data-governance-inbound-mcp-policy-name="Inbound MCP all source access"
-                                            data-governance-inbound-mcp-resource-label="All accepted source IDs (*)"
-                                            data-governance-open-tab="true"
-                                        >
-                                            Create Wildcard Source Policy
-                                        </button>
-                                    </div>
-                                </div>
-                                <div id="inbound-mcp-controlled-source-governance-callout" class="alert alert-info py-2 small {% if settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}" role="alert">
-                                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-2">
-                                        <div>
-                                            After adding allowed source IDs, create an <code>inbound_mcp_source</code> policy for <code>*</code> or a specific source to choose which users or groups can use inbound MCP.
-                                        </div>
-                                        <button
-                                            type="button"
-                                            class="btn btn-sm btn-outline-primary governance-new-inbound-mcp-policy-btn"
-                                            data-governance-inbound-mcp-entity="inbound_mcp_source"
-                                            data-governance-inbound-mcp-policy-name="Inbound MCP source access"
-                                            data-governance-open-tab="true"
-                                        >
-                                            Create Source Policy
-                                        </button>
-                                    </div>
-                                </div>
-                                <div id="inbound-mcp-source-list-container" class="{% if settings.inbound_mcp_allow_all_source_ids %}d-none{% endif %}">
-                                    <div class="d-flex justify-content-between align-items-center mb-2">
-                                        <h6 class="mb-0">Allowed source IDs</h6>
-                                        <button type="button" class="btn btn-sm btn-outline-primary inbound-mcp-entry-add-btn" data-mcp-entry-list="sources">Add</button>
-                                    </div>
-                                    <div class="table-responsive">
-                                        <table class="table table-sm align-middle mb-2">
-                                            <thead>
-                                                <tr>
-                                                    <th>Source value</th>
-                                                    <th>Description</th>
-                                                    <th class="text-end">Actions</th>
-                                                </tr>
-                                            </thead>
-                                            <tbody id="inbound-mcp-source-entries-body"></tbody>
-                                        </table>
-                                    </div>
-                                    <div class="small text-muted" id="inbound-mcp-source-entries-summary"></div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                <div class="modal fade" id="inboundMcpEntryModal" tabindex="-1" aria-labelledby="inboundMcpEntryModalLabel" aria-hidden="true" data-ignore-settings-change="true">
-                    <div class="modal-dialog">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="inboundMcpEntryModalLabel">Add MCP Entry</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <input type="hidden" id="inbound-mcp-entry-list-key">
-                                <input type="hidden" id="inbound-mcp-entry-edit-index">
-                                <div class="mb-3">
-                                    <label class="form-label" for="inbound-mcp-entry-value" id="inbound-mcp-entry-value-label">Value</label>
-                                    <input class="form-control" type="text" id="inbound-mcp-entry-value" autocomplete="off">
-                                    <div class="invalid-feedback" id="inbound-mcp-entry-value-error">Value is required.</div>
-                                </div>
-                                <div class="mb-0">
-                                    <label class="form-label" for="inbound-mcp-entry-description">Description</label>
-                                    <input class="form-control" type="text" id="inbound-mcp-entry-description" autocomplete="off" maxlength="256">
-                                    <div class="form-text">Use descriptions to explain who owns this app, tenant, or source value without making the value easy to guess.</div>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                                <button type="button" class="btn btn-primary" id="inbound-mcp-entry-save-btn">Save Entry</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                <div class="modal fade" id="inboundMcpInfoModal" tabindex="-1" aria-labelledby="inboundMcpInfoModalLabel" aria-hidden="true" data-ignore-settings-change="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="inboundMcpInfoModalLabel">Inbound MCP overview</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-info small" role="alert">
-                                    SimpleChat exposes a governed Streamable HTTP MCP endpoint for approved external MCP clients. Authentication handles tenant, client, delegated scope, and Entra role checks; governance decides which users/groups and source IDs can use tools.
-                                </div>
-                                <div class="row g-3 mb-3">
-                                    <div class="col-lg-6">
-                                        <h6>Runtime checks</h6>
-                                        <ul class="small mb-0">
-                                            <li>Client app ID must be in the allowed client list.</li>
-                                            <li>Tenant must be the SimpleChat tenant unless additional tenants are enabled.</li>
-                                            <li>Delegated personal tools require the configured scope and user role.</li>
-                                            <li>Governance uses <code>inbound_mcp_source</code> policies to decide which users or groups can use each accepted source.</li>
-                                        </ul>
-                                    </div>
-                                    <div class="col-lg-6">
-                                        <h6>Source header guidance</h6>
-                                        <p class="small mb-0">
-                                            The configured source header is an advisory control-plane signal. Treat it like an APIM subscription-key label, not strong identity. For stronger assurance, set or overwrite it at a trusted gateway and avoid relying on client-provided values alone.
-                                        </p>
-                                    </div>
-                                </div>
-                                <h6>Available MCP tools</h6>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th>Tool</th>
-                                                <th>Scope</th>
-                                                <th>Operation</th>
-                                                <th>Description</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody>
-                                            {% for tool in inbound_mcp_tools %}
-                                            <tr>
-                                                <td>
-                                                    <div class="fw-semibold">{{ tool.display_name }}</div>
-                                                    <code>{{ tool.id }}</code>
-                                                </td>
-                                                <td>{{ tool.scope }}</td>
-                                                <td>{{ tool.resource_family }} / {{ tool.operation }}</td>
-                                                <td>{{ tool.description }}</td>
-                                            </tr>
-                                            {% endfor %}
-                                        </tbody>
-                                    </table>
-                                </div>
-                                <hr />
-                                <h6>Application Insights starter queries</h6>
-                                <p class="small text-muted">
-                                    Use these KQL queries in Application Insights Logs to validate inbound MCP traffic, denials, and tool latency. They rely on safe structured dimensions emitted by the inbound MCP route and do not require prompt, message, document, token, or secret values.
-                                </p>
-                                <div class="accordion" id="inbound-mcp-observability-accordion">
-                                    <div class="accordion-item">
-                                        <h2 class="accordion-header" id="inbound-mcp-kql-request-trends-heading">
-                                            <button class="accordion-button" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-request-trends-collapse" aria-expanded="true" aria-controls="inbound-mcp-kql-request-trends-collapse">
-                                                Request and failure trends
-                                            </button>
-                                        </h2>
-                                        <div id="inbound-mcp-kql-request-trends-collapse" class="accordion-collapse collapse show" aria-labelledby="inbound-mcp-kql-request-trends-heading" data-bs-parent="#inbound-mcp-observability-accordion">
-                                            <div class="accordion-body">
-                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-request-trends">
-                                                    <i class="bi bi-clipboard me-1"></i>Copy query
-                                                </button>
-                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-request-trends">traces
-| where timestamp > ago(24h)
-| where message has "[InboundMCP]"
-| summarize requests=count(), failures=countif(tostring(customDimensions.result_status) !in ("", "success", "accepted")) by bin(timestamp, 1h)
-| order by timestamp desc</code></pre>
-                                            </div>
-                                        </div>
-                                    </div>
-                                    <div class="accordion-item">
-                                        <h2 class="accordion-header" id="inbound-mcp-kql-error-categories-heading">
-                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-error-categories-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-error-categories-collapse">
-                                                Error categories by caller and source
-                                            </button>
-                                        </h2>
-                                        <div id="inbound-mcp-kql-error-categories-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-error-categories-heading" data-bs-parent="#inbound-mcp-observability-accordion">
-                                            <div class="accordion-body">
-                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-error-categories">
-                                                    <i class="bi bi-clipboard me-1"></i>Copy query
-                                                </button>
-                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-error-categories">traces
-| where timestamp > ago(24h)
-| where message has "[InboundMCP]"
-| where isnotempty(tostring(customDimensions.error_type))
-| summarize events=count() by tostring(customDimensions.error_type), tostring(customDimensions.caller_app_id), tostring(customDimensions.source_id)
-| order by events desc</code></pre>
-                                            </div>
-                                        </div>
-                                    </div>
-                                    <div class="accordion-item">
-                                        <h2 class="accordion-header" id="inbound-mcp-kql-tool-latency-heading">
-                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-tool-latency-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-tool-latency-collapse">
-                                                Tool latency and result status
-                                            </button>
-                                        </h2>
-                                        <div id="inbound-mcp-kql-tool-latency-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-tool-latency-heading" data-bs-parent="#inbound-mcp-observability-accordion">
-                                            <div class="accordion-body">
-                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-tool-latency">
-                                                    <i class="bi bi-clipboard me-1"></i>Copy query
-                                                </button>
-                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-tool-latency">traces
-| where timestamp > ago(24h)
-| where message has "Inbound MCP tool call"
-| where isnotempty(tostring(customDimensions.tool_id))
-| summarize calls=count(), avg_duration_ms=avg(todouble(customDimensions.duration_ms)), p95_duration_ms=percentile(todouble(customDimensions.duration_ms), 95) by tostring(customDimensions.tool_id), tostring(customDimensions.result_status)
-| order by calls desc</code></pre>
-                                            </div>
-                                        </div>
-                                    </div>
-                                    <div class="accordion-item">
-                                        <h2 class="accordion-header" id="inbound-mcp-kql-rate-limits-heading">
-                                            <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#inbound-mcp-kql-rate-limits-collapse" aria-expanded="false" aria-controls="inbound-mcp-kql-rate-limits-collapse">
-                                                Rate-limit denials
-                                            </button>
-                                        </h2>
-                                        <div id="inbound-mcp-kql-rate-limits-collapse" class="accordion-collapse collapse" aria-labelledby="inbound-mcp-kql-rate-limits-heading" data-bs-parent="#inbound-mcp-observability-accordion">
-                                            <div class="accordion-body">
-                                                <button type="button" class="btn btn-sm btn-outline-secondary mb-2 inbound-mcp-kql-copy-btn" data-kql-target="inbound-mcp-kql-rate-limits">
-                                                    <i class="bi bi-clipboard me-1"></i>Copy query
-                                                </button>
-                                                <pre class="bg-body-tertiary border rounded p-3 small mb-0"><code id="inbound-mcp-kql-rate-limits">traces
-| where timestamp > ago(24h)
-| where message has "Inbound MCP tool call denied by rate limit"
-| summarize denials=count() by tostring(customDimensions.rate_limit_category), tostring(customDimensions.tool_id), tostring(customDimensions.caller_app_id)
-| order by denials desc</code></pre>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                            </div>
-                        </div>
-                    </div>
+    <div
+        class="modal fade"
+        id="fileProcessingLogCleanupModal"
+        tabindex="-1"
+        aria-labelledby="fileProcessingLogCleanupModalLabel"
+        aria-describedby="file-processing-log-cleanup-confirmation"
+        aria-hidden="true"
+    >
+        <div class="modal-dialog modal-dialog-centered">
+            <div class="modal-content">
+                <div class="modal-header">
+                    <h5 class="modal-title" id="fileProcessingLogCleanupModalLabel">Confirm permanent log deletion</h5>
+                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
-                <div class="modal fade" id="inboundMcpEasyAuthModal" tabindex="-1" aria-labelledby="inboundMcpEasyAuthModalLabel" aria-hidden="true" data-ignore-settings-change="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="inboundMcpEasyAuthModalLabel">Verify App Service Authentication exclusions</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-warning">
-                                    <strong>Required before enabling inbound MCP:</strong>
-                                    If Azure App Service Authentication redirects unauthenticated requests, add excluded paths so MCP clients can discover protected resource metadata and so SimpleChat can enforce bearer-token MCP access itself.
-                                </div>
-                                <p>
-                                    Run the following PowerShell with Azure CLI from Azure Cloud Shell or any authenticated terminal. SimpleChat pre-fills the script from this App Service's environment when possible.
-                                </p>
-                                <div class="row g-2 small mb-3">
-                                    <div class="col-lg-6">
-                                        <div class="border rounded p-2 h-100">
-                                            <div class="fw-semibold">Derived deployment values</div>
-                                            <dl class="row mb-0">
-                                                <dt class="col-sm-5">Azure environment</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.azure_environment }}</code></dd>
-                                                <dt class="col-sm-5">Resource Manager</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.resource_manager_endpoint }}</code></dd>
-                                                <dt class="col-sm-5">Resource group</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.resource_group }}</code></dd>
-                                                <dt class="col-sm-5">App Service</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.app_name }}</code></dd>
-                                                <dt class="col-sm-5">Subscription</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.subscription_id or "Current Azure CLI account" }}</code></dd>
-                                                <dt class="col-sm-5">API client ID</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.simplechat_api_client_id }}</code></dd>
-                                                <dt class="col-sm-5">Delegated scope</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_delegated_scope }}</code></dd>
-                                                <dt class="col-sm-5">User role</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_user_roles | join(", ") }}</code></dd>
-                                                <dt class="col-sm-5">App-only role</dt>
-                                                <dd class="col-sm-7"><code>{{ inbound_mcp_easy_auth_script_context.required_app_roles | join(", ") }}</code></dd>
-                                            </dl>
-                                        </div>
-                                    </div>
-                                    <div class="col-lg-6">
-                                        <div class="border rounded p-2 h-100">
-                                            <div class="fw-semibold">Script behavior</div>
-                                            <ul class="mb-0">
-                                                <li>Sets the Azure CLI cloud before login.</li>
-                                                <li>Logs in with the configured SimpleChat tenant.</li>
-                                                <li>Attempts to verify that the SimpleChat API app exposes the required delegated scope and inbound MCP app roles.</li>
-                                                <li>Uses SimpleChat's Resource Manager endpoint for public, government, or custom clouds.</li>
-                                                <li>Creates a timestamped backup of current <code>authsettingsV2</code> before applying changes.</li>
-                                            </ul>
-                                        </div>
-                                    </div>
-                                </div>
-                                {% if inbound_mcp_easy_auth_script_context.missing_values %}
-                                <div class="alert alert-danger small">
-                                    SimpleChat could not derive every required value. Replace the placeholders in the script before running it:
-                                    <strong>{{ inbound_mcp_easy_auth_script_context.missing_values | join(", ") }}</strong>.
-                                </div>
-                                {% endif %}
-                                {% if inbound_mcp_easy_auth_script_context.scope_check_missing_values %}
-                                <div class="alert alert-warning small">
-                                    SimpleChat could not derive every value needed for the delegated-scope and role preflight. Replace these placeholders if you want the script to validate the app registration before changing Easy Auth:
-                                    <strong>{{ inbound_mcp_easy_auth_script_context.scope_check_missing_values | join(", ") }}</strong>.
-                                </div>
-                                {% endif %}
-                                {% if inbound_mcp_easy_auth_script_context.uses_custom_cloud_match %}
-                                <div class="alert alert-info small">
-                                    This deployment uses a custom Azure environment. The script searches your registered Azure CLI clouds for one with the same Resource Manager endpoint. If none is registered, register the custom cloud first and rerun the script.
-                                </div>
-                                {% endif %}
-                                <div class="position-relative mb-3">
-                                    <button type="button" class="btn btn-outline-secondary btn-sm position-absolute top-0 end-0 m-2" id="inbound-mcp-copy-script" aria-label="Copy PowerShell script">
-                                        <i class="bi bi-clipboard" aria-hidden="true"></i>
-                                    </button>
-                                    <pre class="bg-body-tertiary border rounded p-3 pe-5 small mb-0"><code id="inbound-mcp-easy-auth-script-code">{{ inbound_mcp_easy_auth_script }}</code></pre>
-                                </div>
-                                <div class="alert alert-info small">
-                                    The verification checks these public unauthenticated endpoints and expects SimpleChat JSON responses, not Microsoft sign-in HTML:
-                                    <ul class="mb-0">
-                                        <li><code>/.well-known/oauth-protected-resource</code></li>
-                                        <li><code>/.well-known/oauth-protected-resource/api/mcp</code></li>
-                                        <li><code>/.well-known/oauth-protected-resource/mcp</code></li>
-                                        <li><code>/.well-known/oauth-authorization-server</code></li>
-                                        <li><code>/api/mcp</code></li>
-                                        <li><code>/api/mcp/health</code></li>
-                                    </ul>
-                                </div>
-                                <div class="form-check mb-3">
-                                    <input class="form-check-input" type="checkbox" id="inbound-mcp-easy-auth-confirm">
-                                    <label class="form-check-label" for="inbound-mcp-easy-auth-confirm">
-                                        I have added the required App Service Authentication excluded paths for this SimpleChat App Service.
-                                    </label>
-                                </div>
-                                <div id="inbound-mcp-easy-auth-status" class="alert alert-info d-none" role="status"></div>
-                                <ul id="inbound-mcp-easy-auth-results" class="list-group small d-none"></ul>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Cancel</button>
-                                <button type="button" class="btn btn-primary" id="inbound-mcp-easy-auth-verify" disabled>
-                                    I accept, verify endpoints
-                                </button>
-                            </div>
-                        </div>
+                <div class="modal-body">
+                    <p id="file-processing-log-cleanup-confirmation"></p>
+                    <div class="alert alert-danger mb-0" role="alert">
+                        This action cannot be undone.
                     </div>
                 </div>
-                {% endif %}
-            </div>
-
-
-            <!-- Governance Tab Content -->
-            <div class="tab-pane fade" id="governance" role="tabpanel" aria-labelledby="governance-tab">
-                <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-start gap-2 mb-3">
-                    <p class="text-muted mb-0">
-                        Configure governance enforcement for endpoint, agent, and action creation or usage. Governance is disabled by default and only enforced when toggled on.
-                    </p>
-                    <button type="button" class="btn btn-outline-info btn-sm flex-shrink-0" id="governance-info-guide-btn" data-bs-toggle="modal" data-bs-target="#governanceInfoModal">
-                        <i class="bi bi-info-circle me-1"></i>Configuration Guide
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                    <button type="button" class="btn btn-danger" id="confirm-file-processing-log-cleanup-btn">
+                        Delete logs
                     </button>
                 </div>
-
-                <div class="card p-3 mb-3" id="governance-feature-toggles-section">
-                    <h5>
-                        <i class="bi bi-braces-asterisk me-2"></i>Governance Feature Toggles
-                    </h5>
-                    <p class="text-muted">Turn on governance checks for each feature area. Save with the main Settings button to persist these toggles.</p>
-
-                    <div class="row">
-                        <div class="col-md-4">
-                            <div class="fw-semibold mb-2">Personal Scope</div>
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="governance_user_endpoints" name="governance_user_endpoints" {% if settings.governance_user_endpoints %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="governance_user_endpoints">Govern Personal Endpoints</label>
-                            </div>
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="governance_user_agents" name="governance_user_agents" {% if settings.governance_user_agents %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="governance_user_agents">Govern Personal Agents</label>
-                            </div>
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="governance_user_actions" name="governance_user_actions" {% if settings.governance_user_actions %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="governance_user_actions">Govern Personal Actions</label>
-                            </div>
-                        </div>
-                        <div class="col-md-4">
-                            <div class="fw-semibold mb-2">Group Scope</div>
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="governance_group_endpoints" name="governance_group_endpoints" {% if settings.governance_group_endpoints %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="governance_group_endpoints">Govern Group Endpoints</label>
-                            </div>
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="governance_group_agents" name="governance_group_agents" {% if settings.governance_group_agents %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="governance_group_agents">Govern Group Agents</label>
-                            </div>
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="governance_group_actions" name="governance_group_actions" {% if settings.governance_group_actions %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="governance_group_actions">Govern Group Actions</label>
-                            </div>
-                        </div>
-                        <div class="col-md-4">
-                            <div class="fw-semibold mb-2">Global Scope</div>
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="governance_global_endpoints" name="governance_global_endpoints" checked disabled data-governance-locked="true">
-                                <label class="form-check-label ms-2" for="governance_global_endpoints">Govern Global Endpoints</label>
-                                <span class="badge bg-info text-dark ms-2">Always On</span>
-                            </div>
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="governance_global_agents_usage" name="governance_global_agents_usage" {% if settings.governance_global_agents_usage %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="governance_global_agents_usage">Govern Global Agents</label>
-                            </div>
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="governance_global_actions_usage" name="governance_global_actions_usage" {% if settings.governance_global_actions_usage %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="governance_global_actions_usage">Govern Global Actions</label>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="governance-mcp-destination-section">
-                    <h5>
-                        <i class="bi bi-diagram-3 me-2"></i>MCP Action Destination Governance
-                    </h5>
-                    <p class="text-muted mb-2">
-                        Restrict outbound remote MCP servers by destination pattern and scope. Destination policies reuse delegated item policies, so admins can allow all users, specific users, or workspace groups for each approved destination.
-                    </p>
-                    <div class="row g-3 align-items-start">
-                        <div class="col-lg-4">
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="enable_mcp_destination_governance" name="enable_mcp_destination_governance" {% if settings.enable_mcp_destination_governance %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="enable_mcp_destination_governance">Enforce MCP Destination Allowlist</label>
-                            </div>
-                            <div class="form-check form-switch mb-2">
-                                <input class="form-check-input" type="checkbox" role="switch" id="mcp_block_unsafe_destinations" name="mcp_block_unsafe_destinations" {% if settings.mcp_block_unsafe_destinations %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="mcp_block_unsafe_destinations">Block Private/Local Literal IP Destinations</label>
-                            </div>
-                            <div class="form-text">
-                                Save with the main Settings button. Unsafe literal-IP blocking can be enabled even before the allowlist is enforced.
-                            </div>
-                        </div>
-                        <div class="col-lg-5">
-                            <div class="small fw-semibold mb-1">Supported destination patterns</div>
-                            <ul class="small text-muted mb-0">
-                                <li><code>*</code> for any remote MCP destination after identity/auth checks.</li>
-                                <li><code>preconfiguration:microsoft_learn</code> or <code>preset:generic</code>.</li>
-                                <li><code>*.contoso.com</code>, <code>https://example.com/mcp*</code>, or <code>transport:streamable-http</code>.</li>
-                                <li><code>group:&lt;group-id&gt;::preconfiguration:github</code> for one group-specific override.</li>
-                            </ul>
-                        </div>
-                        <div class="col-lg-3">
-                            <div class="d-grid gap-2 governance-policy-action-list">
-                                <div class="input-group input-group-sm">
-                                    <button type="button" class="btn btn-outline-primary flex-grow-1 governance-new-mcp-destination-policy-btn" data-governance-mcp-destination-entity="mcp_personal_destination">New Personal Destination Policy</button>
-                                    <button type="button" class="btn btn-outline-info governance-policy-help-btn" data-governance-help-key="mcp_personal_destination" aria-label="About personal MCP destination policies" title="About personal MCP destination policies">
-                                        <i class="bi bi-info-circle" aria-hidden="true"></i>
-                                    </button>
-                                </div>
-                                <div class="input-group input-group-sm">
-                                    <button type="button" class="btn btn-outline-primary flex-grow-1 governance-new-mcp-destination-policy-btn" data-governance-mcp-destination-entity="mcp_group_destination">New Group Destination Policy</button>
-                                    <button type="button" class="btn btn-outline-info governance-policy-help-btn" data-governance-help-key="mcp_group_destination" aria-label="About group MCP destination policies" title="About group MCP destination policies">
-                                        <i class="bi bi-info-circle" aria-hidden="true"></i>
-                                    </button>
-                                </div>
-                                <div class="input-group input-group-sm">
-                                    <button type="button" class="btn btn-outline-primary flex-grow-1 governance-new-mcp-destination-policy-btn" data-governance-mcp-destination-entity="mcp_global_destination">New Global Destination Policy</button>
-                                    <button type="button" class="btn btn-outline-info governance-policy-help-btn" data-governance-help-key="mcp_global_destination" aria-label="About global MCP destination policies" title="About global MCP destination policies">
-                                        <i class="bi bi-info-circle" aria-hidden="true"></i>
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="governance-inbound-mcp-section">
-                    <h5>
-                        <i class="bi bi-box-arrow-in-down-right me-2"></i>Inbound MCP Source Governance
-                    </h5>
-                    <p class="text-muted mb-2">
-                        Control which delegated users and groups can use SimpleChat as an inbound MCP server through source-scoped policies.
-                    </p>
-                    <div class="alert alert-warning py-2 small" role="alert">
-                        Quick-create inbound MCP policies open in restricted user/group mode by default. Only use "Allow all users" when every delegated user with the required Entra role and delegated scope should be able to satisfy that policy.
-                    </div>
-                    <div class="row g-3 align-items-start">
-                        <div class="col-lg-7">
-                            <div class="small fw-semibold mb-1">Policy required for inbound MCP</div>
-                            <ul class="small text-muted mb-2">
-                                <li><code>inbound_mcp_source</code> with delegated item <code>*</code>: allows selected users or groups to use any accepted source ID.</li>
-                                <li><code>inbound_mcp_source</code> with a configured source ID: allows selected users or groups to use only requests with that source value.</li>
-                            </ul>
-                            <div class="small text-muted">
-                                Client, tenant, delegated scope, and Entra role checks remain in Inbound MCP configuration. The source ID comes from the configured header when present and is advisory unless a trusted gateway sets or validates it.
-                            </div>
-                        </div>
-                        <div class="col-lg-5">
-                            <div class="d-grid gap-2 governance-policy-action-list">
-                                <div class="input-group input-group-sm">
-                                    <button type="button" class="btn btn-outline-primary flex-grow-1 governance-new-inbound-mcp-policy-btn" data-governance-inbound-mcp-entity="inbound_mcp_source">New Inbound MCP Source Access Policy</button>
-                                    <button type="button" class="btn btn-outline-info governance-policy-help-btn" data-governance-help-key="inbound_mcp_source" aria-label="About inbound MCP source policies" title="About inbound MCP source policies">
-                                        <i class="bi bi-info-circle" aria-hidden="true"></i>
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="governance-feature-policies-section">
-                    <div class="d-flex justify-content-between align-items-center mb-2">
-                        <h5 class="mb-0"><i class="bi bi-sliders2 me-2"></i>Feature Policies</h5>
-                        <button type="button" class="btn btn-primary btn-sm" id="governance-save-feature-policies-btn">Save Feature Policies</button>
-                    </div>
-                    <p class="text-muted">Set allow-all, explicit allow lists, and block lists for each governed feature. Block lists override allow settings.</p>
-                    <div class="table-responsive">
-                        <table class="table table-bordered" id="governance-feature-policies-table">
-                            <thead>
-                                <tr>
-                                    <th>Feature</th>
-                                    <th>Allow All</th>
-                                    <th>Allow List</th>
-                                    <th>Block List</th>
-                                </tr>
-                            </thead>
-                            <tbody id="governance-feature-policies-body"></tbody>
-                        </table>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="governance-item-policies-section">
-                    <div class="d-flex justify-content-between align-items-center mb-2">
-                        <h5 class="mb-0"><i class="bi bi-list-check me-2"></i>Delegated Item Policies</h5>
-                        <div class="d-flex gap-2">
-                            <button type="button" class="btn btn-primary btn-sm" id="governance-new-item-policy-btn">New Policy</button>
-                            <button type="button" class="btn btn-outline-secondary btn-sm" id="governance-refresh-item-policies-btn">Refresh</button>
-                        </div>
-                    </div>
-                    <p class="text-muted mb-1">Manage delegated governance for configured global resources and action type entitlements that admins assign to specific users or groups.</p>
-                    <div class="alert alert-info py-2 small" role="alert">
-                        Delegated item policies are OR combined allow lists with optional block lists. Blocked users and groups are denied even when Allow All or another allow list would grant access.
-                    </div>
-
-                    <div class="row g-2 align-items-end mb-3" id="governance-item-policy-card-controls">
-                        <div class="col-lg-5 col-md-6">
-                            <label class="form-label" for="governance-item-review-search">Search</label>
-                            <input type="search" class="form-control" id="governance-item-review-search" placeholder="Search users, groups, endpoint IDs, or item IDs">
-                        </div>
-                        <div class="col-lg-3 col-md-6">
-                            <label class="form-label" for="governance-item-review-entity-type">Entity Type</label>
-                            <select class="form-select" id="governance-item-review-entity-type">
-                                <option value="">All</option>
-                                <option value="global_endpoint">Global Endpoint</option>
-                                <option value="global_agent">Global Agent</option>
-                                <option value="global_action">Global Action</option>
-                                <option value="personal_action_type">Personal Action Type</option>
-                                <option value="group_action_type">Group Action Type</option>
-                                <option value="global_action_type">Global Action Type</option>
-                                <option value="mcp_personal_destination">MCP Personal Destination</option>
-                                <option value="mcp_group_destination">MCP Group Destination</option>
-                                <option value="mcp_global_destination">MCP Global Destination</option>
-                                <option value="inbound_mcp_source">Inbound MCP Source</option>
-                            </select>
-                        </div>
-                        <div class="col-lg-2 col-md-4">
-                            <label class="form-label" for="governance-item-review-page-size">Page Size</label>
-                            <select class="form-select" id="governance-item-review-page-size">
-                                <option value="10">10</option>
-                                <option value="25" selected>25</option>
-                                <option value="50">50</option>
-                            </select>
-                        </div>
-                        <div class="col-lg-2 col-md-8 d-flex gap-2">
-                            <button type="button" class="btn btn-primary flex-fill" id="governance-item-review-search-btn">Search</button>
-                            <button type="button" class="btn btn-outline-secondary flex-fill" id="governance-item-review-reset-btn">Reset</button>
-                        </div>
-                    </div>
-
-                    <div class="table-responsive">
-                        <table class="table table-sm table-striped align-middle" id="governance-item-policies-table">
-                            <thead>
-                                <tr>
-                                    <th>Policy</th>
-                                    <th>Entity Type</th>
-                                    <th>Item</th>
-                                    <th>Allow All</th>
-                                    <th>Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody id="governance-item-policies-review-body"></tbody>
-                        </table>
-                    </div>
-
-                    <div class="d-flex align-items-center justify-content-between gap-2 mt-3">
-                        <div class="text-muted small" id="governance-item-review-summary"></div>
-                        <div class="btn-group" role="group" aria-label="Delegated item policy pagination">
-                            <button type="button" class="btn btn-outline-secondary btn-sm" id="governance-item-review-prev-btn">Previous</button>
-                            <button type="button" class="btn btn-outline-secondary btn-sm" id="governance-item-review-next-btn">Next</button>
-                        </div>
-                    </div>
-                </div>
-
-                <div id="governance-status" class="alert d-none" role="alert"></div>
             </div>
+        </div>
+    </div>
 
-            <!-- Logging Tab Content -->
-            <div class="tab-pane fade" id="logging" role="tabpanel" aria-labelledby="logging-tab">
-                <p class="text-muted">
-                    Configure logging settings for monitoring, debugging, and auditing purposes. These settings control various types of logging throughout the application including application insights, debug messages, and file processing events.
-                </p>
-
-                <div class="card p-3 mb-3" id="application-insights-section">
-                    <h5>
-                        <i class="bi bi-graph-up me-2"></i>Application Insights Logging
-                    </h5>
-                    <p class="text-muted">Enable global logging to Application Insights for all agents and orchestration events.</p>
-                    <div class="form-check form-switch mb-3">
-                        <input class="form-check-input" type="checkbox" role="switch" id="enable_appinsights_global_logging" name="enable_appinsights_global_logging" {% if settings.enable_appinsights_global_logging %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_appinsights_global_logging">
-                            Enable Application Insights Global Logging
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Toggle to enable or disable global logging to Application Insights for all agents and orchestration events."></i>
-                    </div>
-                    <div class="alert alert-warning mt-3" role="alert">
-                        <strong>Note:</strong> Changing this setting requires an application restart to take effect.
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="debug-logging-section">
-                    <h5>
-                        <i class="bi bi-bug me-2"></i>Debug Logging
-                    </h5>
-                    <p class="text-muted">Control debug print statements across the application for development and troubleshooting.</p>
-                    <div class="form-check form-switch mb-3">
-                        <input class="form-check-input" type="checkbox" role="switch" id="enable_debug_logging" name="enable_debug_logging" {% if settings.enable_debug_logging %}checked{% endif %} onchange="toggleTimeControls('debug')">
-                        <label class="form-check-label ms-2" for="enable_debug_logging">
-                            Enable Debug Logging
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Toggle to enable or disable debug print statements across the application for troubleshooting and development."></i>
-                    </div>
-
-                    <!-- Time-based turnoff controls for Debug Logging -->
-                    <div id="debug-time-controls" class="mt-3" style="{% if not settings.enable_debug_logging %}display: none;{% endif %}">
-                        <div class="form-check form-switch mb-3">
-                            <input class="form-check-input" type="checkbox" role="switch" id="enable_debug_logging_timer" name="enable_debug_logging_timer" {% if settings.debug_logging_timer_enabled %}checked{% endif %} onchange="toggleTimerInputs('debug')">
-                            <label class="form-check-label ms-2" for="enable_debug_logging_timer">
-                                Enable Time-based Auto Turnoff
-                            </label>
-                            <i class="bi bi-clock ms-2" data-bs-toggle="tooltip" title="Automatically disable debug logging after a specified time period to manage cost and risk."></i>
-                        </div>
-
-                        <div id="debug-timer-inputs" class="row g-3" style="{% if not settings.debug_logging_timer_enabled %}display: none;{% endif %}">
-                            <div class="col-md-4">
-                                <label for="debug_timer_value" class="form-label">Duration</label>
-                                <input type="number" class="form-control" id="debug_timer_value" name="debug_timer_value" min="1" max="120" value="{{ settings.debug_timer_value or 1 }}">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="debug_timer_unit" class="form-label">Time Unit</label>
-                                <select class="form-select" id="debug_timer_unit" name="debug_timer_unit">
-                                    <option value="minutes" {% if settings.debug_timer_unit == 'minutes' %}selected{% endif %}>Minutes (1-120)</option>
-                                    <option value="hours" {% if settings.debug_timer_unit == 'hours' %}selected{% endif %}>Hours (1-24)</option>
-                                    <option value="days" {% if settings.debug_timer_unit == 'days' %}selected{% endif %}>Days (1-7)</option>
-                                    <option value="weeks" {% if settings.debug_timer_unit == 'weeks' %}selected{% endif %}>Weeks (1-52)</option>
-                                </select>
-                            </div>
-                            <div class="col-md-4">
-                                <label class="form-label">Will turn off at:</label>
-                                <div id="debug-turnoff-time" class="form-control-plaintext text-info fw-bold">
-                                    {% if settings.debug_logging_turnoff_time %}
-                                        {% if settings.debug_logging_turnoff_time is string %}
-                                            {{ settings.debug_logging_turnoff_time }}
-                                        {% else %}
-                                            {{ settings.debug_logging_turnoff_time.strftime('%Y-%m-%d %H:%M:%S') }}
-                                        {% endif %}
-                                    {% else %}
-                                        Will be calculated when saved
-                                    {% endif %}
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="alert alert-info mt-2" role="alert">
-                        <strong>Info:</strong> This controls all DEBUG print statements throughout the application. Useful for development and troubleshooting. Tokens and keys will be collected during this process.
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="file-processing-logs-section">
-                    <h5>
-                        <i class="bi bi-file-earmark-text me-2"></i>File Process Logging
-                    </h5>
-                    <p class="text-muted">Enable logging of file processing events for debugging and auditing purposes. Logs are stored in the file_processing container in Cosmos DB.</p>
-                    <div class="form-check form-switch mb-3">
-                        <input class="form-check-input" type="checkbox" role="switch" id="enable_file_processing_logs" name="enable_file_processing_logs" {% if settings.enable_file_processing_logs %}checked{% endif %} onchange="toggleTimeControls('file')">
-                        <label class="form-check-label ms-2" for="enable_file_processing_logs">
-                            Enable File Processing Logs
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Toggle to enable or disable logging of file processing events for debugging and auditing purposes."></i>
-                    </div>
-
-                    <!-- Time-based turnoff controls for File Processing Logs -->
-                    <div id="file-time-controls" class="mt-3" style="{% if not settings.enable_file_processing_logs %}display: none;{% endif %}">
-                        <div class="form-check form-switch mb-3">
-                            <input class="form-check-input" type="checkbox" role="switch" id="enable_file_processing_logs_timer" name="enable_file_processing_logs_timer" {% if settings.file_processing_logs_timer_enabled %}checked{% endif %} onchange="toggleTimerInputs('file')">
-                            <label class="form-check-label ms-2" for="enable_file_processing_logs_timer">
-                                Enable Time-based Auto Turnoff
-                            </label>
-                            <i class="bi bi-clock ms-2" data-bs-toggle="tooltip" title="Automatically disable file processing logs after a specified time period to manage cost and risk."></i>
-                        </div>
+    <!-- Floating Save Button -->
+    <button type="submit" form="admin-settings-form" class="btn btn-secondary floating-save-btn" id="floating-save-btn" disabled>
+        <i class="bi bi-floppy"></i> Save Settings
+    </button>
 
-                        <div id="file-timer-inputs" class="row g-3" style="{% if not settings.file_processing_logs_timer_enabled %}display: none;{% endif %}">
-                            <div class="col-md-4">
-                                <label for="file_timer_value" class="form-label">Duration</label>
-                                <input type="number" class="form-control" id="file_timer_value" name="file_timer_value" min="1" max="120" value="{{ settings.file_timer_value or 1 }}">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="file_timer_unit" class="form-label">Time Unit</label>
-                                <select class="form-select" id="file_timer_unit" name="file_timer_unit">
-                                    <option value="minutes" {% if settings.file_timer_unit == 'minutes' %}selected{% endif %}>Minutes (1-120)</option>
-                                    <option value="hours" {% if settings.file_timer_unit == 'hours' %}selected{% endif %}>Hours (1-24)</option>
-                                    <option value="days" {% if settings.file_timer_unit == 'days' %}selected{% endif %}>Days (1-7)</option>
-                                    <option value="weeks" {% if settings.file_timer_unit == 'weeks' %}selected{% endif %}>Weeks (1-52)</option>
-                                </select>
-                            </div>
-                            <div class="col-md-4">
-                                <label class="form-label">Will turn off at:</label>
-                                <div id="file-turnoff-time" class="form-control-plaintext text-info fw-bold">
-                                    {% if settings.file_processing_logs_turnoff_time %}
-                                        {% if settings.file_processing_logs_turnoff_time is string %}
-                                            {{ settings.file_processing_logs_turnoff_time }}
-                                        {% else %}
-                                            {{ settings.file_processing_logs_turnoff_time.strftime('%Y-%m-%d %H:%M:%S') }}
-                                        {% endif %}
-                                    {% else %}
-                                        Will be calculated when saved
-                                    {% endif %}
-                                </div>
-                            </div>
-                        </div>
-                    </div>
+<!-- Shared by Model Endpoints, Embeddings and Image Generation, so it lives
+     outside the panes rather than inside any one of them. -->
+<div class="modal fade" id="legacyModelDiscoveryIdentityGuideModal" tabindex="-1" aria-labelledby="legacyModelDiscoveryIdentityGuideModalLabel" aria-hidden="true">
+    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title" id="legacyModelDiscoveryIdentityGuideModalLabel">Azure OpenAI Model Setup Guide</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <div class="alert alert-info" role="alert">
+                    <strong>Fetch Models</strong> lists deployments through the Azure management plane. <strong>Test Connection</strong>, chat generation, file uploads, embedding generation, and image generation call the Azure OpenAI data plane. These paths can use different credentials and require different roles.
+                </div>
+
+                <h6>Credential purpose</h6>
+                <div class="table-responsive mb-3">
+                    <table class="table table-sm table-bordered align-middle">
+                        <thead>
+                            <tr>
+                                <th>Action</th>
+                                <th>Plane</th>
+                                <th>Credential used</th>
+                                <th>Role or secret</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                            <tr>
+                                <td>Legacy GPT, embedding, or image <strong>Fetch Models</strong></td>
+                                <td>Management plane</td>
+                                <td>The SimpleChat app registration or service principal, such as the <code>-ar</code> Entra application created for the deployment.</td>
+                                <td><code>Cognitive Services User</code> on the Azure OpenAI resource, or an equivalent role that can read deployments.</td>
+                            </tr>
+                            <tr>
+                                <td>Global endpoint modal <strong>Fetch Models</strong></td>
+                                <td>Management plane</td>
+                                <td>The endpoint modal identity selected for discovery, such as managed identity or service principal.</td>
+                                <td><code>Cognitive Services User</code> on the Azure OpenAI resource, or an equivalent role that can read deployments.</td>
+                            </tr>
+                            <tr>
+                                <td>GPT, embedding, or image generation with Key authentication selected</td>
+                                <td>Data plane</td>
+                                <td>The Azure OpenAI key saved in this settings section.</td>
+                                <td>Azure OpenAI resource key from <strong>Keys and Endpoint</strong>.</td>
+                            </tr>
+                            <tr>
+                                <td>GPT, embedding, or image generation with Managed Identity selected</td>
+                                <td>Data plane</td>
+                                <td>The App Service managed identity, such as the <code>-app</code> managed identity.</td>
+                                <td><code>Cognitive Services OpenAI User</code> on the Azure OpenAI resource.</td>
+                            </tr>
+                        </tbody>
+                    </table>
+                </div>
+
+                <h6>Where to get values</h6>
+                <ol class="mb-3">
+                    <li>Open the Azure OpenAI resource in the Azure portal.</li>
+                    <li>Copy the endpoint from <strong>Resource Management</strong> &gt; <strong>Keys and Endpoint</strong>.</li>
+                    <li>If using Key authentication for runtime calls, copy <strong>Key 1</strong> or <strong>Key 2</strong> from the same page.</li>
+                    <li>Copy the subscription ID and resource group from the resource <strong>Overview</strong> page. These are required for <strong>Fetch Models</strong>.</li>
+                    <li>If using APIM, use the APIM endpoint, deployment path or name, API version, and APIM subscription key instead of the direct Azure OpenAI key.</li>
+                </ol>
+
+                <h6>Recommended setup</h6>
+                <ul class="mb-0">
+                    <li>For key-backed legacy GPT, embeddings, or image generation, grant the SimpleChat service principal the management-plane role so admins can fetch model deployments, then store the Azure OpenAI key for data-plane generation.</li>
+                    <li>For managed identity runtime, grant the App Service managed identity <code>Cognitive Services OpenAI User</code> for data-plane generation. If the same managed identity should also fetch deployments, grant it the management-plane discovery role too.</li>
+                    <li>Fetch only discovers deployment names and model metadata. It does not prove that embedding or image generation inference will succeed; use <strong>Test Embedding Connection</strong> or <strong>Test Image Connection</strong> after selecting a deployment.</li>
+                </ul>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+            </div>
+        </div>
+    </div>
+</div>
 
-                    <hr class="my-4" />
-                    <section aria-labelledby="file-processing-log-cleanup-heading" data-ignore-settings-change="true">
-                        <h6 id="file-processing-log-cleanup-heading">Delete stored logs</h6>
-                        <p class="text-muted small">
-                            Permanently remove file processing logs from Cosmos DB. One month is treated as 30 days.
-                        </p>
-                        <div class="row g-3 align-items-end">
-                            <div class="col-sm-4">
-                                <label for="file-processing-log-cleanup-age" class="form-label">Delete logs older than</label>
-                                <input
-                                    type="number"
-                                    class="form-control"
-                                    id="file-processing-log-cleanup-age"
-                                    min="1"
-                                    step="1"
-                                    value="30"
-                                    aria-describedby="file-processing-log-cleanup-age-feedback"
-                                />
-                                <div id="file-processing-log-cleanup-age-feedback" class="invalid-feedback">
-                                    Enter a whole number greater than zero.
-                                </div>
-                            </div>
-                            <div class="col-sm-3">
-                                <label for="file-processing-log-cleanup-unit" class="form-label">Age unit</label>
-                                <select class="form-select" id="file-processing-log-cleanup-unit">
-                                    <option value="days" selected>Days</option>
-                                    <option value="weeks">Weeks</option>
-                                    <option value="months">Months (30 days)</option>
-                                </select>
-                            </div>
-                            <div class="col-sm-5 d-flex flex-wrap gap-2">
-                                <button type="button" class="btn btn-outline-danger" id="delete-old-file-processing-logs-btn">
-                                    <i class="bi bi-trash me-1" aria-hidden="true"></i>Delete older logs
-                                </button>
-                                <button type="button" class="btn btn-danger" id="delete-all-file-processing-logs-btn">
-                                    <i class="bi bi-trash3 me-1" aria-hidden="true"></i>Delete all logs
-                                </button>
-                            </div>
-                        </div>
-                    </section>
+<!-- Data Management dialogs. The Backup & Recovery tabs share one JavaScript
+     module and several dialogs are opened from more than one tab, so they
+     live outside the panes. -->
+<div class="modal fade" id="data-management-restore-modal" tabindex="-1" aria-labelledby="data-management-restore-title" aria-hidden="true">
+    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <div>
+                    <h5 class="modal-title" id="data-management-restore-title">Restore Backup</h5>
+                    <p class="text-muted small mb-0">Review the target, policy, and backup manifest before queueing a restore job.</p>
                 </div>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
             </div>
-
-            <div class="tab-pane fade" id="general" role="tabpanel" aria-labelledby="general-tab">
-
-                 <p class="text-muted">
-                    Configure general application settings, including the application's title, logo, and landing page text.
-                </p>
-                <div class="card p-3 mb-3" id="branding-section">
-                    <h5>
-                        <i class="bi bi-palette me-2"></i>Branding
-                    </h5>
-                    <p class="text-muted small">
-                        Configure your application's title, logo, and branding elements.
-                    </p>
-                    <div class="mb-3">
-                        <label for="app_title" class="form-label">Application Title</label>
-                        <input type="text" class="form-control" id="app_title" name="app_title" value="{{ settings.app_title }}">
-                    </div>
-                    <h6 class="mt-3">Logo Settings</h6>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox" class="form-check-input" id="show_logo" name="show_logo"
-                            {% if settings.show_logo %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="show_logo">Show Logo</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display the application logo in the header and navigation areas of the interface."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox" class="form-check-input" id="hide_app_title" name="hide_app_title"
-                            {% if settings.hide_app_title %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="hide_app_title">Hide Application Title</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Hide the application title from the header and navigation, showing only the logo if enabled."></i>
+            <div class="modal-body">
+                <div class="alert alert-warning" role="alert">
+                    Restore writes data into the configured target Cosmos DB, AI Search, and Enhanced Citation Storage services. Create-only mode blocks existing destination collisions; overwrite mode requires a separate phrase.
+                </div>
+                <section class="border rounded p-3 mb-3" aria-labelledby="data-management-restore-backup-heading">
+                    <h6 class="mb-2" id="data-management-restore-backup-heading">Selected backup</h6>
+                    <div class="row g-2" id="data-management-restore-backup-summary">
+                        <div class="col-12 text-muted">Choose Restore from a backup row.</div>
                     </div>
-                    <div class="form-group mb-3">
-                        <div class="d-flex justify-content-between align-items-center">
-                            <label for="landing_page_logo_scale_percent" class="form-label mb-0">Main Page Logo Size</label>
-                            <span id="landing-page-logo-scale-value" class="small text-muted fw-semibold">{{ settings.landing_page_logo_scale_percent | default(100) }}%</span>
-                        </div>
-                        <input
-                            type="range"
-                            class="form-range"
-                            id="landing_page_logo_scale_percent"
-                            name="landing_page_logo_scale_percent"
-                            min="50"
-                            max="500"
-                            step="10"
-                            value="{{ settings.landing_page_logo_scale_percent | default(100) }}"
-                            aria-describedby="landing-page-logo-scale-help"
-                        />
-                        <div class="d-flex justify-content-between small text-muted">
-                            <span>50%</span>
-                            <span>500%</span>
-                        </div>
-                        <small id="landing-page-logo-scale-help" class="form-text text-muted">
-                            Adjust the logo size on the home page only. This does not change the logo size in the top or sidebar navigation.
-                        </small>
-                    </div>
-                    <div class="form-group mb-3">
-                        <label for="logo_file">Upload Custom Logo (Light Mode)</label>
-                        <input type="file" class="form-control" name="logo_file" id="logo_file" accept=".png,.jpg,.jpeg">
-                        <small class="form-text text-muted">This logo will be displayed in light mode and stored at up to 500px tall so the main page can render it sharply without keeping oversized assets in settings.</small>
-                    </div>
-                    <div class="form-group mb-3">
-                        <label for="logo_dark_file">Upload Custom Logo (Dark Mode)</label>
-                        <input type="file" class="form-control" name="logo_dark_file" id="logo_dark_file" accept=".png,.jpg,.jpeg">
-                        <small class="form-text text-muted">This logo will be displayed in dark mode. If not provided, the light mode logo will be used in both themes. Dark logos are also stored at up to 500px tall.</small>
-                    </div>
-                    <div class="form-group mb-3">
-                        <label for="favicon_file">Upload Custom Favicon</label>
-                        <input type="file" class="form-control" name="favicon_file" id="favicon_file" accept=".png,.jpg,.jpeg,.ico">
-                        <small class="form-text text-muted">Recommended: 16x16 or 32x32 pixel png or jpg or ico.</small>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="home-page-text-section">
-                    <h5>
-                        <i class="bi bi-house me-2"></i>Home Page Text
-                    </h5>
-                    <p class="text-muted small">Configure the text content displayed on your application's home page using Markdown formatting.</p>
-
-                    <div class="mb-3">
-                        <label for="landing_page_alignment" class="form-label">Markdown Alignment</label>
-                        <select class="form-select" id="landing_page_alignment" name="landing_page_alignment">
-                            <option value="left" {% if settings.landing_page_alignment == "left" or not settings.landing_page_alignment %}selected{% endif %}>Left</option>
-                            <option value="center" {% if settings.landing_page_alignment == "center" %}selected{% endif %}>Center</option>
-                            <option value="right" {% if settings.landing_page_alignment == "right" %}selected{% endif %}>Right</option>
-                        </select>
-                        <small class="form-text text-muted">Choose how the landing page markdown is aligned on the home page.</small>
-                    </div>
-
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="toggleLandingPageEditor"
-                            name="enable_landing_page_editor"
-                            {% if settings.enable_landing_page_editor %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="toggleLandingPageEditor">
-                            Enable Markdown Editor
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the markdown editor for editing landing page content, otherwise text will be displayed as read-only preview."></i>
-                    </div>
-
-                    <div id="landingPageEditorContainer" style="display: none;">
-                        <textarea
-                            class="form-control"
-                            id="landing_page_text_editor"
-                            name="landing_page_text"
-                            rows="5"
-                        >{{ settings.landing_page_text }}</textarea>
-                    </div>
-
-                    <div
-                        id="landingPageMarkdownPreview"
-                        class="p-2 border rounded"
-                        style="white-space: pre-wrap; display: none;"
-                    ></div>
-                </div>
-
-                <div class="card p-3 mb-3" id="appearance-section">
-                    <h5>
-                        <i class="bi bi-brush me-2"></i>Appearance
-                    </h5>
-                    <p class="text-muted small">Configure the app appearance and theme settings.</p>
-
-                    <div class="mb-3">
-                        <label class="form-label">Default Theme</label>
-                        <div class="form-group form-check form-switch mb-3">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="enable_dark_mode_default"
-                                name="enable_dark_mode_default"
-                                {% if settings.enable_dark_mode_default %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="enable_dark_mode_default">
-                                Enable Dark Mode by Default
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Set dark mode as the default theme for new users. Users can still toggle between themes individually."></i>
-                        </div>
-                        <p class="text-muted small">Users can still toggle dark mode individually from the navigation bar.</p>
-                    </div>
-
-                    <div class="mb-3">
-                        <label class="form-label">Default Navigation</label>
-                        <div class="form-group form-check form-switch mb-3">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="enable_left_nav_default"
-                                name="enable_left_nav_default"
-                                {% if settings.enable_left_nav_default %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="enable_left_nav_default">
-                                Enable Left Nav by Default
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show the left navigation sidebar by default for new users. Users can still toggle the sidebar visibility individually."></i>
-                        </div>
-                        <p class="text-muted small">Users can still toggle the left navigation sidebar individually from the header.</p>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="health-check-section">
-                    <div class="d-flex justify-content-between align-items-center mb-2">
-                        <h5 class="mb-0">
-                            <i class="bi bi-heart-pulse me-2"></i>Health Check
-                        </h5>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#healthCheckInfoModal">
-                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
-                        </button>
-                    </div>
-                    <p class="text-muted mb-3">Configure health check endpoint for external monitoring systems.</p>
-
-                    <div class="row g-3">
-                        <div class="col-lg-6">
-                            <div class="border rounded p-3 h-100 bg-body-tertiary-subtle">
-                                <div class="d-flex align-items-start justify-content-between gap-2">
-                                    <div>
-                                        <h6 class="mb-1">Authenticated Endpoint</h6>
-                                        <p class="text-muted small mb-0">Use when your monitoring system can reach a protected route and you want the endpoint governed by the normal app access boundary.</p>
-                                    </div>
-                                    <span class="badge text-bg-primary">Protected</span>
-                                </div>
-                                <div class="form-check form-switch mt-3 mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="enable_external_healthcheck"
-                                        name="enable_external_healthcheck"
-                                        {% if settings.enable_external_healthcheck %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="enable_external_healthcheck">
-                                        Enable /external/healthcheck
-                                    </label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the authenticated /external/healthcheck endpoint for external monitoring systems."></i>
-                                </div>
-                                <p class="text-muted small mb-0">Best for internal monitors or diagnostics tooling that already authenticates to the application.</p>
-                            </div>
-                        </div>
-                        <div class="col-lg-6">
-                            <div class="border rounded p-3 h-100 border-warning-subtle bg-warning-subtle">
-                                <div class="d-flex align-items-start justify-content-between gap-2">
-                                    <div>
-                                        <h6 class="mb-1">Unauthenticated Endpoint</h6>
-                                        <p class="text-muted small mb-0">Use when a platform health probe cannot sign in and only needs a lightweight availability response.</p>
-                                    </div>
-                                    <span class="badge text-bg-warning">No Auth</span>
-                                </div>
-                                <div class="form-check form-switch mt-3 mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="enable_no_auth_external_healthcheck"
-                                        name="enable_no_auth_external_healthcheck"
-                                        {% if settings.enable_no_auth_external_healthcheck %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="enable_no_auth_external_healthcheck">
-                                        Enable /external/healthcheckz
-                                    </label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable the unauthenticated /external/healthcheckz endpoint for probes that cannot authenticate."></i>
-                                </div>
-                                <div class="alert alert-warning small mb-0" role="alert">
-                                    <strong>Security note:</strong> This route is intentionally unauthenticated. Only enable it for trusted health probes or controlled network paths.
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="swagger-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0">
-                            <i class="bi bi-file-earmark-code me-2"></i>API Documentation
-                        </h5>
-                        <div class="btn-group" role="group">
-                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#swaggerInfoModal">
-                                <i class="bi bi-info-circle me-1"></i>Why Enable Swagger?
-                            </button>
-                            <a href="/swagger" class="btn btn-primary btn-sm" target="_blank">
-                                <i class="bi bi-box-arrow-up-right me-1"></i>Open Swagger UI
-                            </a>
-                        </div>
-                    </div>
-                    <p class="text-muted mb-3">Configure automatic OpenAPI/Swagger documentation for API endpoints.</p>
-
-                    <div class="form-check form-switch mb-2">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_swagger"
-                            name="enable_swagger"
-                            {% if settings.enable_swagger %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_swagger">
-                            Enable Swagger/OpenAPI Documentation (/swagger)
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable automatic API documentation with Swagger UI interface for testing and exploring endpoints."></i>
-                    </div>
-                    <p class="text-muted small mb-0">
-                        Provides interactive API documentation, endpoint testing, and schema validation.
-                        Useful for developers, API integration, and system troubleshooting.
-                    </p>
-                </div>
-
-                <div class="card p-3 mb-3" id="classification-banner-section">
-                    <h5>
-                        <i class="bi bi-shield-exclamation me-2"></i>Classification Banner
-                    </h5>
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" id="classification_banner_enabled" name="classification_banner_enabled"
-                            {% if settings.classification_banner_enabled %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="classification_banner_enabled">
-                            Enable Classification Banner
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a security classification banner at the top of every page to indicate data sensitivity level."></i>
-                    </div>
-                    <div class="mb-2">
-                        <label for="classification_banner_text" class="form-label">Banner Text</label>
-                        <input type="text" class="form-control" id="classification_banner_text" name="classification_banner_text"
-                            value="{{ settings.classification_banner_text }}">
-                    </div>
-                    <div class="mb-2">
-                        <label for="classification_banner_color" class="form-label">Banner Color</label>
-                        <input type="color" class="form-control form-control-color" id="classification_banner_color" name="classification_banner_color"
-                            value="{{ settings.classification_banner_color or '#ffc107' }}" style="width: 3rem; height: 2rem;">
-                    </div>
-                    <div class="mb-2">
-                        <label for="classification_banner_text_color" class="form-label">Banner Text Color</label>
-                        <input type="color" class="form-control form-control-color" id="classification_banner_text_color" name="classification_banner_text_color"
-                            value="{{ settings.classification_banner_text_color or '#ffffff' }}" style="width: 3rem; height: 2rem;">
-                    </div>
-                    <div class="mb-2">
-                        <span id="classification-banner-preview"
-                              style="display:inline-block; padding:0.5em 1em; border-radius:0.3em; font-weight:bold; color:{{ settings.classification_banner_text_color or '#ffffff' }}; background:{{ settings.classification_banner_color or '#ffc107' }};">
-                            {{ settings.classification_banner_text or 'Banner Preview' }}
-                        </span>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="ai-notice-section">
-                    <h5>
-                        <i class="bi bi-robot me-2"></i>Chat AI Notice
-                    </h5>
-                    <p class="text-muted small">
-                        Display an administrator-provided reminder directly below the chat input, such as guidance that responses are AI-generated and should be reviewed.
-                    </p>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="enable_ai_notice"
-                            name="enable_ai_notice"
-                            {% if settings.enable_ai_notice %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_ai_notice">
-                            Show a custom AI notice below the chat input
-                        </label>
-                    </div>
-                    <div id="ai_notice_settings" class="{% if not settings.enable_ai_notice %}d-none{% endif %}">
-                        <div class="mb-3">
-                            <label for="ai_notice_message" class="form-label">Notice Text</label>
-                            <textarea
-                                class="form-control"
-                                id="ai_notice_message"
-                                name="ai_notice_message"
-                                rows="3"
-                                maxlength="1000"
-                                placeholder="AI-generated responses may contain errors. Review important information before relying on it."
-                            >{{ settings.ai_notice_message or '' }}</textarea>
-                            <div class="form-text">Plain text only. Line breaks are preserved.</div>
-                        </div>
-                        <div>
-                            <label for="ai_notice_frequency" class="form-label">Display Behavior</label>
-                            <select class="form-select" id="ai_notice_frequency" name="ai_notice_frequency">
-                                <option value="non_dismissible" {% if settings.ai_notice_frequency == 'non_dismissible' %}selected{% endif %}>Always visible; users cannot dismiss it</option>
-                                <option value="every_session" {% if settings.ai_notice_frequency == 'every_session' %}selected{% endif %}>Dismissible once per session</option>
-                                <option value="daily" {% if settings.ai_notice_frequency == 'daily' %}selected{% endif %}>Dismissible once per day</option>
-                                <option value="once" {% if settings.ai_notice_frequency == 'once' %}selected{% endif %}>Dismissible once per message version</option>
-                            </select>
-                            <div class="form-text">Changing the notice text or display behavior creates a new message version and shows it again.</div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="terms-of-use-section">
-                    <h5>
-                        <i class="bi bi-door-open me-2"></i>Terms of Use
-                    </h5>
-                    <p class="text-muted small">
-                        Require users to accept the Terms of Use before using SimpleChat. Standard Microsoft sign-in users see it before authentication; Teams SSO and other passive sign-in flows are gated immediately after the app session is created.
-                    </p>
-
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="enable_terms_of_use"
-                            name="enable_terms_of_use"
-                            {% if settings.enable_terms_of_use %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_terms_of_use">
-                            Require terms of use
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the Terms of Use before accessing authenticated application pages or APIs."></i>
-                    </div>
-
-                    <div class="row g-3">
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_title" class="form-label">Popup Title</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="terms_of_use_title"
-                                name="terms_of_use_title"
-                                maxlength="160"
-                                value="{{ settings.terms_of_use_title or 'Terms of Use' }}"
-                            >
-                        </div>
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_frequency" class="form-label">Show Frequency</label>
-                            <select class="form-select" id="terms_of_use_frequency" name="terms_of_use_frequency">
-                                <option value="every_session" {% if settings.terms_of_use_frequency == 'every_session' %}selected{% endif %}>At the start of every session</option>
-                                <option value="daily" {% if settings.terms_of_use_frequency == 'daily' %}selected{% endif %}>Once per day</option>
-                                <option value="once" {% if settings.terms_of_use_frequency == 'once' %}selected{% endif %}>Just once per terms version</option>
-                            </select>
-                            <small class="form-text text-muted">Changing the title, message, or frequency creates a new terms version that users must accept again.</small>
-                        </div>
-                    </div>
-
-                    <div class="mb-3 mt-3">
-                        <label for="terms_of_use_message" class="form-label">Terms of Use Message</label>
-                        <textarea
-                            class="form-control"
-                            id="terms_of_use_message"
-                            name="terms_of_use_message"
-                            rows="7"
-                            maxlength="10000"
-                            placeholder="Enter the terms, notice, or rules of behavior users must accept before using the application."
-                        >{{ settings.terms_of_use_message or '' }}</textarea>
-                        <small class="form-text text-muted">Plain text is shown to users with line breaks preserved.</small>
-                    </div>
-
-                    <div class="mb-3">
-                        <label for="terms_of_use_decline_redirect_url" class="form-label">Cancel Redirect URL</label>
-                        <input
-                            type="text"
-                            class="form-control"
-                            id="terms_of_use_decline_redirect_url"
-                            name="terms_of_use_decline_redirect_url"
-                            value="{{ settings.terms_of_use_decline_redirect_url or '/' }}"
-                            placeholder="/"
-                        >
-                        <small class="form-text text-muted">Use a local path such as <code>/</code> or an admin-approved HTTP(S) URL. Signed-in users are locally logged out before this redirect.</small>
-                    </div>
-
-                    <div class="row g-3">
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_accept_button_text" class="form-label">Accept Button Text</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="terms_of_use_accept_button_text"
-                                name="terms_of_use_accept_button_text"
-                                maxlength="80"
-                                value="{{ settings.terms_of_use_accept_button_text or 'Accept and continue' }}"
-                            >
-                        </div>
-                        <div class="col-lg-6">
-                            <label for="terms_of_use_decline_button_text" class="form-label">Cancel Button Text</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="terms_of_use_decline_button_text"
-                                name="terms_of_use_decline_button_text"
-                                maxlength="80"
-                                value="{{ settings.terms_of_use_decline_button_text or 'Cancel' }}"
-                            >
-                        </div>
-                    </div>
-
-                    <div class="alert alert-info mt-3 mb-0" role="alert">
-                        <strong>Tracking:</strong> Every-session acceptance is stored in the Flask session. Daily and once-per-version acceptance are stored in user settings, and accepted or declined events are written to the activity log when the user identity is known.
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="support-menu-section">
-                    <h5>
-                        <i class="bi bi-life-preserver me-2"></i>Support
-                    </h5>
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" id="enable_support_menu" name="enable_support_menu"
-                            {% if settings.enable_support_menu %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_support_menu">
-                            Enable Support Menu for End Users
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a Support menu in navigation for signed-in users with the User role."></i>
-                    </div>
-                    <p class="text-muted small">When enabled, users can access Support destinations like Send Feedback and Latest Features directly from navigation.</p>
-
-                    <div id="support_menu_settings" {% if not settings.enable_support_menu %}style="display: none;"{% endif %}>
-                        <div class="mb-3">
-                            <label for="support_menu_name" class="form-label">Menu Name</label>
-                            <input type="text" class="form-control" id="support_menu_name" name="support_menu_name"
-                                   value="{{ settings.support_menu_name or 'Support' }}" placeholder="Support">
-                            <small class="form-text text-muted">This name will appear in user navigation as the Support menu title.</small>
-                        </div>
-
-                        <div class="form-check form-switch mb-2">
-                            <input class="form-check-input" type="checkbox" id="enable_support_send_feedback" name="enable_support_send_feedback"
-                                {% if settings.enable_support_send_feedback %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="enable_support_send_feedback">
-                                Enable Send Feedback Destination
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to prepare support feedback emails that route to your internal recipient."></i>
-                        </div>
-
-                        <div class="mb-3" id="support_feedback_recipient_group" {% if not settings.enable_support_send_feedback %}style="display: none;"{% endif %}>
-                            <label for="support_feedback_recipient_email" class="form-label">Support Recipient Email</label>
-                            <input type="email" class="form-control" id="support_feedback_recipient_email" name="support_feedback_recipient_email"
-                                   value="{{ settings.support_feedback_recipient_email or '' }}" placeholder="support@contoso.com">
-                            <small class="form-text text-muted">User Send Feedback drafts will be addressed to this internal email address.</small>
-                        </div>
-
-                        <div class="form-check form-switch mb-2">
-                            <input class="form-check-input" type="checkbox" id="enable_support_latest_features" name="enable_support_latest_features"
-                                {% if settings.enable_support_latest_features %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="enable_support_latest_features">
-                                Enable Latest Features Destination
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show a user-facing Latest Features page from the Support menu."></i>
-                        </div>
-
-                        <div id="support_latest_features_settings" {% if not settings.enable_support_latest_features %}style="display: none;"{% endif %}>
-                            <h6 class="mt-3">User-Facing Latest Features</h6>
-                            <p class="text-muted small">Choose which recent features are shared on the user Latest Features page. Deployment and Redis start unchecked because they are mainly admin-facing rollout and infrastructure topics.</p>
-                            <div class="form-check form-switch mb-3">
-                                <input class="form-check-input" type="checkbox" id="enable_support_latest_feature_documentation_links" name="enable_support_latest_feature_documentation_links"
-                                    {% if settings.enable_support_latest_feature_documentation_links %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="enable_support_latest_feature_documentation_links">
-                                    Show Simple Chat Documentation Guide Links
-                                </label>
-                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show public documentation guide buttons alongside the in-app Latest Features shortcuts. This is disabled by default."></i>
-                                <small class="form-text text-muted d-block mt-1">When enabled, user-facing Latest Features cards can show public guide buttons in addition to the direct in-app shortcuts.</small>
-                            </div>
-                            {% for release_group in support_latest_feature_release_groups %}
-                            {% set checklist_collapse_id = release_group.collapse_id ~ 'Checklist' %}
-                            <div class="card border-0 bg-body-tertiary mb-3">
-                                <div class="card-body p-3">
-                                    <div class="d-flex flex-column flex-md-row align-items-md-center justify-content-between gap-3">
-                                        <div>
-                                            <h6 class="mb-1">{{ release_group.label }}{% if release_group.release_version %}<span class="badge bg-light text-dark ms-2">v{{ release_group.release_version }}</span>{% endif %}</h6>
-                                            <p class="text-muted small mb-0">{{ release_group.description }}</p>
-                                        </div>
-                                        {% if not release_group.default_expanded %}
-                                        <button
-                                            type="button"
-                                            class="btn btn-sm btn-outline-secondary"
-                                            data-bs-toggle="collapse"
-                                            data-bs-target="#{{ checklist_collapse_id }}"
-                                            aria-expanded="false"
-                                            aria-controls="{{ checklist_collapse_id }}"
-                                        >
-                                            Show {{ release_group.label }}
-                                        </button>
-                                        {% endif %}
-                                    </div>
-                                    <div {% if not release_group.default_expanded %}class="collapse mt-3" id="{{ checklist_collapse_id }}"{% else %}class="mt-3"{% endif %}>
-                                        <div class="row g-2">
-                                            {% for feature in release_group.features %}
-                                            <div class="col-md-6">
-                                                <div class="form-check border rounded p-3 h-100">
-                                                    <input class="form-check-input" type="checkbox" id="support_latest_feature_{{ feature.id }}" name="support_latest_feature_{{ feature.id }}"
-                                                        {% if settings.support_latest_features_visibility.get(feature.id, true) %}checked{% endif %}>
-                                                    <label class="form-check-label ms-2" for="support_latest_feature_{{ feature.id }}">
-                                                        <span class="fw-semibold d-block">{{ feature.title }}</span>
-                                                        <span class="text-muted small">{{ feature.summary }}</span>
-                                                    </label>
-                                                </div>
-                                            </div>
-                                            {% endfor %}
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                            {% endfor %}
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="external-links-section">
-                    <h5>
-                        <i class="bi bi-box-arrow-up-right me-2"></i>External Links
-                    </h5>
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" id="enable_external_links" name="enable_external_links"
-                            {% if settings.enable_external_links %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_external_links">
-                            Enable External Links in Navigation
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Display a menu of external links in the navigation bar for quick access to external resources and websites."></i>
-                    </div>
-                    <p class="text-muted small">When enabled, external links will be displayed in the navigation bar for easy access to external resources.</p>
-
-                    <div id="external_links_settings" {% if not settings.enable_external_links %}style="display: none;"{% endif %}>
-                        <div class="mb-3">
-                            <label for="external_links_menu_name" class="form-label">Menu Name</label>
-                            <input type="text" class="form-control" id="external_links_menu_name" name="external_links_menu_name"
-                                   value="{{ settings.external_links_menu_name or 'External Links' }}" placeholder="External Links">
-                            <small class="form-text text-muted">This name will appear in the navigation bar as the menu title.</small>
-                        </div>
-
-                        <div class="form-check form-switch mb-3">
-                            <input class="form-check-input" type="checkbox" id="external_links_force_menu" name="external_links_force_menu"
-                                {% if settings.external_links_force_menu %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="external_links_force_menu">
-                                Force Menu Display
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Always show external links as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu."></i>
-                            <small class="form-text text-muted d-block">When enabled, external links will always display as a dropdown menu. When disabled, 1-2 links show as top-level nav items, 3+ links show as a dropdown menu.</small>
-                        </div>
-
-                        <h6>External Links</h6>
-                        <p class="text-muted small">Define custom links that will appear in the navigation bar for users to access external resources.</p>
-
-                        <table class="table table-sm table-bordered">
-                            <thead>
-                                <tr>
-                                    <th>Label</th>
-                                    <th>URL</th>
-                                    <th>Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody id="external-links-tbody">
-                                <!-- Populated by JavaScript -->
-                            </tbody>
-                        </table>
-
-                        <button type="button" class="btn btn-sm btn-outline-primary" id="add-external-link-btn">Add New Link</button>
-                        <input type="hidden" name="external_links_json" id="external_links_json">
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="system-settings-section">
-                    <h5>
-                        <i class="bi bi-gear-fill me-2"></i>System Settings
-                    </h5>
-                    <p class="text-muted">
-                        System-level settings that control application behavior, including file size limits, conversation history,
-                        and default prompts.
-                    </p>
-                    <div class="mb-3">
-                        <label for="max_file_size_mb" class="form-label">Maximum File Size (MB)</label>
-                        <input type="number" class="form-control" id="max_file_size_mb" name="max_file_size_mb"
-                            value="{{ settings.max_file_size_mb }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="conversation_history_limit" class="form-label">
-                            Conversation History Limit
-                        </label>
-                        <input type="number" class="form-control" id="conversation_history_limit"
-                            name="conversation_history_limit" value="{{ settings.conversation_history_limit }}">
-                    </div>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_idle_timeout"
-                            name="enable_idle_timeout"
-                            {% if settings.enable_idle_timeout %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_idle_timeout">
-                            Enable Idle Session Timeout and Warning
-                        </label>
-                        <button
-                             type="button"
-                             class="btn btn-link p-0 ms-2"
-                             data-bs-toggle="tooltip"
-                             title="When enabled, inactive users receive a warning and are automatically logged out after the configured timeout."
-                             aria-label="More information about idle timeout settings">
-                             <i class="bi bi-info-circle" aria-hidden="true"></i>
-                         </button>
-                    </div>
-                    <div id="idle_timeout_settings" class="{% if settings.enable_idle_timeout is not defined or not settings.enable_idle_timeout %}d-none{% endif %}">
-                        <div class="mb-3">
-                            <label for="idle_timeout_minutes" class="form-label">Idle Logout Timeout (Minutes)</label>
-                            <input
-                                type="number"
-                                class="form-control"
-                                id="idle_timeout_minutes"
-                                name="idle_timeout_minutes"
-                                min="10"
-                                value="{{ settings.idle_timeout_minutes | default(30) }}">
-                            <small class="form-text text-muted">Users are logged out locally after this many minutes of inactivity. Minimum value: 10 minutes.</small>
-                        </div>
-                        <div class="mb-3">
-                            <label for="idle_warning_minutes" class="form-label">Idle Warning Time (Minutes)</label>
-                            <input
-                                type="number"
-                                class="form-control"
-                                id="idle_warning_minutes"
-                                name="idle_warning_minutes"
-                                min="0"
-                                value="{{ settings.idle_warning_minutes | default(28) }}">
-                            <small class="form-text text-muted">Show the warning modal after this many minutes of inactivity. Set this equal to the logout timeout to disable the warning dialog window.</small>
-                        </div>
-                        <div class="mb-3">
-                            <label for="idle_warning_message" class="form-label">Idle Warning Message</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="idle_warning_message"
-                                name="idle_warning_message"
-                                value="{{ settings.idle_warning_message | default("You've been inactive for a while.") }}">
-                            <small class="form-text text-muted">Custom text shown at the top of the idle warning dialog.</small>
-                        </div>
-                    </div>
-                    <div class="mb-3">
-                        <label for="default_system_prompt" class="form-label">Default System Prompt</label>
-                        <textarea class="form-control" id="default_system_prompt" name="default_system_prompt"
-                            rows="5">{{ settings.default_system_prompt }}</textarea>
-                    </div>
-                    <div class="mb-3">
-                        <label for="access_denied_message" class="form-label">Access Denied Message</label>
-                        <small class="text-muted d-block mb-1">Shown to signed-in users who lack the required roles. Use Enter for line breaks.</small>
-                        <textarea class="form-control" id="access_denied_message" name="access_denied_message"
-                            rows="3">{{ settings.access_denied_message }}</textarea>
-                    </div>
-                </div>
-            </div>
-
-            <div class="tab-pane fade show active" id="latest-features" role="tabpanel" aria-labelledby="latest-features-tab">
-                <p class="text-muted mb-2">
-                    Review the main capabilities introduced in v{{ config['VERSION'] }} and use this page as an admin-facing overview for what to highlight with your teams.
-                </p>
-                <div class="alert alert-primary" role="alert">
-                    This tab is intentionally curated. It groups related improvements together and mirrors a small number of high-impact settings so admins can enable them from the same overview.
-                </div>
-
-                {% for release_group in admin_latest_feature_release_groups %}
-                {% if release_group.id == 'current_release' %}
-                <div class="d-flex flex-column flex-lg-row align-items-lg-center justify-content-between gap-2 mb-3">
-                    <div>
-                        <h5 class="mb-1">{{ release_group.label }}</h5>
-                        <p class="text-muted mb-0">{{ release_group.description }}</p>
-                    </div>
-                    {% if release_group.release_version %}
-                    <span class="badge bg-primary-subtle text-primary border border-primary-subtle">v{{ release_group.release_version }}</span>
-                    {% endif %}
-                </div>
-
-                {% for feature in release_group.features %}
-                {% set feature_card_id = 'latest-features-' ~ feature.id|replace('_', '-') ~ '-card' %}
-                {% set feature_collapse_id = feature_card_id ~ '-details' %}
-                <div class="card p-3 mb-3 latest-feature-card" id="{{ feature_card_id }}">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1"><i class="bi {{ feature.icon }} me-2"></i>{{ feature.title }}</h5>
-                            <p class="text-muted mb-0">{{ feature.summary }}</p>
-                        </div>
-                        <a href="#{{ feature_collapse_id }}" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="{{ feature_collapse_id }}">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="{{ feature_collapse_id }}">
-                        <div class="card card-body">
-                            {% if feature.details %}
-                            <p class="mb-2">{{ feature.details }}</p>
-                            {% endif %}
-                            {% if feature.why %}
-                            <div class="alert alert-secondary mb-3" role="alert">{{ feature.why }}</div>
-                            {% endif %}
-                            {% if feature.guidance %}
-                            <h6 class="mb-2">{% if feature.images %}Screenshot and rollout notes{% else %}Rollout notes{% endif %}</h6>
-                            <ul class="mb-3">
-                                {% for tip in feature.guidance %}
-                                <li>{{ tip }}</li>
-                                {% endfor %}
-                            </ul>
-                            {% endif %}
-                            {% if feature.images %}
-                            <div class="latest-feature-gallery mb-3">
-                                {% for image in feature.images %}
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename=image.path) }}"
-                                    data-latest-feature-image-title="{{ image.title }}"
-                                    data-latest-feature-image-caption="{{ image.caption }}"
-                                >
-                                    <div class="latest-feature-thumbnail-card h-100">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename=image.path) }}" alt="{{ image.alt }}">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">{{ image.label }}</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                {% endfor %}
-                            </div>
-                            {% endif %}
-                            {% if feature.actions %}
-                            <div class="d-flex flex-wrap gap-2">
-                                {% for action in feature.actions %}
-                                <a
-                                    class="btn btn-outline-primary btn-sm"
-                                    href="{% if action.href %}{{ action.href }}{% else %}{{ url_for(action.endpoint) }}{% if action.fragment %}#{{ action.fragment }}{% endif %}{% endif %}"
-                                    {% if action.is_external %}target="_blank" rel="noopener noreferrer"{% endif %}
-                                    {% if action.admin_tab %}data-open-admin-tab="{{ action.admin_tab }}"{% endif %}
-                                    {% if action.admin_section %}data-open-admin-section="{{ action.admin_section }}"{% endif %}
-                                >
-                                    <i class="bi {{ action.icon }} me-1"></i>{{ action.label }}
-                                </a>
-                                {% endfor %}
-                            </div>
-                            {% endif %}
-                        </div>
-                    </div>
-                </div>
-                {% endfor %}
-                {% else %}
-                {% set release_card_id = 'latest-features-' ~ release_group.id|replace('_', '-') ~ '-card' %}
-                {% set release_collapse_id = release_group.collapse_id %}
-                <div class="card p-3 mb-3 latest-feature-card" id="{{ release_card_id }}">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1"><i class="bi bi-clock-history me-2"></i>{{ release_group.label }}</h5>
-                            <p class="text-muted mb-0">{{ release_group.description }}</p>
-                        </div>
-                        <a href="#{{ release_collapse_id }}" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="{{ release_collapse_id }}">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="{{ release_collapse_id }}">
-                        <div class="card card-body">
-                            {% if release_group.release_version %}
-                            <div class="alert alert-secondary mb-3" role="alert">
-                                These were the headline admin-facing items in the earlier v{{ release_group.release_version }} release set.
-                            </div>
-                            {% endif %}
-                            <div class="row g-3">
-                                {% for feature in release_group.features %}
-                                <div class="col-xl-6">
-                                    <div class="border rounded p-3 h-100 bg-body-tertiary">
-                                        <div class="d-flex flex-column gap-3 h-100">
-                                            <div>
-                                                <h6 class="mb-1"><i class="bi {{ feature.icon }} me-2"></i>{{ feature.title }}</h6>
-                                                <p class="text-muted small mb-0">{{ feature.summary }}</p>
-                                            </div>
-                                            <p class="small mb-0">{{ feature.details }}</p>
-                                            {% if feature.guidance %}
-                                            <ul class="small mb-0">
-                                                {% for tip in feature.guidance %}
-                                                <li>{{ tip }}</li>
-                                                {% endfor %}
-                                            </ul>
-                                            {% endif %}
-                                            {% if feature.images %}
-                                            <div class="latest-feature-gallery">
-                                                {% for image in feature.images %}
-                                                <button
-                                                    type="button"
-                                                    class="latest-feature-thumbnail-trigger"
-                                                    data-latest-feature-image-src="{{ url_for('static', filename=image.path) }}"
-                                                    data-latest-feature-image-title="{{ image.title }}"
-                                                    data-latest-feature-image-caption="{{ image.caption }}"
-                                                >
-                                                    <div class="latest-feature-thumbnail-card h-100">
-                                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename=image.path) }}" alt="{{ image.alt }}">
-                                                        <div class="latest-feature-thumbnail-body">
-                                                            <div class="latest-feature-thumbnail-title">{{ image.label }}</div>
-                                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                                        </div>
-                                                    </div>
-                                                </button>
-                                                {% endfor %}
-                                            </div>
-                                            {% endif %}
-                                            {% if feature.actions %}
-                                            <div class="d-flex flex-wrap gap-2 mt-auto pt-2">
-                                                {% for action in feature.actions %}
-                                                <a
-                                                    class="btn btn-outline-primary btn-sm"
-                                                    href="{% if action.href %}{{ action.href }}{% else %}{{ url_for(action.endpoint) }}{% if action.fragment %}#{{ action.fragment }}{% endif %}{% endif %}"
-                                                    {% if action.is_external %}target="_blank" rel="noopener noreferrer"{% endif %}
-                                                    {% if action.admin_tab %}data-open-admin-tab="{{ action.admin_tab }}"{% endif %}
-                                                    {% if action.admin_section %}data-open-admin-section="{{ action.admin_section }}"{% endif %}
-                                                >
-                                                    <i class="bi {{ action.icon }} me-1"></i>{{ action.label }}
-                                                </a>
-                                                {% endfor %}
-                                            </div>
-                                            {% endif %}
-                                        </div>
-                                    </div>
-                                </div>
-                                {% endfor %}
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                {% endif %}
-                {% endfor %}
-
-                {% if false %}
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-release-notifications-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-megaphone me-2"></i>Registered / Unregistered Badge
-                            </h5>
-                            <p class="text-muted mb-0">The badge next to the Admin Settings version number shows whether this admin instance is registered for latest release and community call notifications.</p>
-                        </div>
-                        <a href="#latestFeaturesReleaseNotifications" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesReleaseNotifications">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesReleaseNotifications">
-                        <div class="card card-body">
-                            <div class="alert alert-secondary mb-3" role="alert">
-                                Admin-only explainer: this badge belongs to Admin Settings only and does not need to appear in the user-facing Latest Features pages.
-                            </div>
-                            <p class="mb-2">Use this badge as the quick status check for whether your environment is already registered to receive SimpleChat release updates.</p>
-                            <ul class="mb-0">
-                                <li><strong>Unregistered</strong> means this environment has not saved release notification registration details yet.</li>
-                                <li><strong>Registered</strong> means the environment already has saved contact details for release and community call notifications.</li>
-                                <li>Clicking the badge opens the registration modal where admins can add or edit the name, email, and organization for this instance.</li>
-                                <li>Submitting the form opens a prefilled email draft to <strong>simplechat@microsoft.com</strong> and stores the registration details back in Admin Settings.</li>
-                                <li>The badge lives beside the version number at the top of Admin Settings so admins can confirm status without hunting through tabs.</li>
-                            </ul>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-deployment-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-hdd-rack me-2"></i>Performance Improvements for Apps running Native Python (not containers)
-                            </h5>
-                            <p class="text-muted mb-0">Native Python App Service deployments should use Gunicorn as the startup command. Container deployments already do this for you.</p>
-                        </div>
-                        <a href="#latestFeaturesDeployment" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesDeployment">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesDeployment">
-                        <div class="card card-body">
-                            <p class="mb-2">If you run the native Python App Service deployment instead of the container deployment, set the App Service Startup command to the following:</p>
-                            <pre class="latest-feature-command">python -m gunicorn -c gunicorn.conf.py app:app</pre>
-                            <p class="mt-3 mb-2">Use container deployments when possible if you want the runtime defaults and startup behavior handled by the shipped image.</p>
-                            <div class="d-flex flex-wrap gap-2 mb-3">
-                                <a href="https://github.com/microsoft/simplechat/blob/main/docs/explanation/features/SIMPLECHAT_STARTUP.md" target="_blank" rel="noopener noreferrer" class="btn btn-outline-primary btn-sm">
-                                    <i class="bi bi-box-arrow-up-right me-1"></i>Startup Guidance
-                                </a>
-                                <a href="https://github.com/microsoft/simplechat/blob/main/README.md#deployment-runtime-notes" target="_blank" rel="noopener noreferrer" class="btn btn-outline-secondary btn-sm">
-                                    <i class="bi bi-box-arrow-up-right me-1"></i>Runtime Notes
-                                </a>
-                            </div>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/gunicorn_startup_guidance.png') }}"
-                                    data-latest-feature-image-title="Gunicorn Startup Guidance"
-                                    data-latest-feature-image-caption="Native Python App Service startup command guidance preview."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/gunicorn_startup_guidance.png') }}" alt="Gunicorn startup guidance screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Gunicorn Startup Guidance</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-guided-tutorials-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-signpost-split me-2"></i>Guided Tutorials
-                            </h5>
-                            <p class="text-muted mb-0">New guided walkthroughs help users learn the live chat and personal workspace interfaces without leaving the app.</p>
-                        </div>
-                        <a href="#latestFeaturesGuidedTutorials" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesGuidedTutorials">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesGuidedTutorials">
-                        <div class="card card-body">
-                            <p class="mb-2">Admins can use these walkthroughs to accelerate onboarding for new users and reduce orientation time across the primary product surfaces.</p>
-                            <ul class="mb-3">
-                                <li>Guided Chat Tutorial covers the active chat experience, message actions, search flows, citations, thoughts, and export-related actions.</li>
-                                <li>Personal Workspace Guided Tutorial walks through uploads, search, filters, list and grid views, prompts, agents, actions, and tags.</li>
-                            </ul>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/guided_tutorials_chat.png') }}"
-                                    data-latest-feature-image-title="Guided Chat Tutorial"
-                                    data-latest-feature-image-caption="Chat walkthrough preview for end users."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/guided_tutorials_chat.png') }}" alt="Guided chat tutorial screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Guided Chat Tutorial</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/guided_tutorials_workspace.png') }}"
-                                    data-latest-feature-image-title="Workspace Guided Tutorial"
-                                    data-latest-feature-image-caption="Personal workspace walkthrough preview."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/guided_tutorials_workspace.png') }}" alt="Workspace guided tutorial screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Workspace Guided Tutorial</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-background-chat-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-bell me-2"></i>Background Chat Completion
-                            </h5>
-                            <p class="text-muted mb-0">Personal chats can continue finishing after a user leaves the chat page, and completed responses surface as notifications with unread indicators.</p>
-                        </div>
-                        <a href="#latestFeaturesBackgroundChat" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesBackgroundChat">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesBackgroundChat">
-                        <div class="card card-body">
-                            <p class="mb-2">This makes long-running responses more reliable for users who navigate into other areas of the app before generation finishes.</p>
-                            <ul class="mb-3">
-                                <li>Completion notifications deep-link back into the finished conversation.</li>
-                                <li>Unread markers remain visible until the response is actually opened.</li>
-                                <li>Personal, workspace, and navigation flows now behave more consistently while chat completion continues in the background.</li>
-                            </ul>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/background_completion_notifications-01.png') }}"
-                                    data-latest-feature-image-title="Background Completion Notification"
-                                    data-latest-feature-image-caption="Unread completion notification state for background chat responses."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/background_completion_notifications-01.png') }}" alt="Background completion notification screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Notification State</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/background_completion_notifications-02.png') }}"
-                                    data-latest-feature-image-title="Background Completion Deep Link"
-                                    data-latest-feature-image-caption="Finished response entry point back into the completed chat."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/background_completion_notifications-02.png') }}" alt="Background completion deep link screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Deep Link Back to Chat</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-model-selection-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-cpu me-2"></i>Multi-Endpoint GPT Selection
-                            </h5>
-                            <p class="text-muted mb-0">Admins can expose multiple GPT choices across Azure OpenAI and Azure AI Foundry, set a saved default fallback model, and now review agent rebinding in a modal before applying changes.</p>
-                        </div>
-                        <a href="#latestFeaturesModelSelection" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesModelSelection">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesModelSelection">
-                        <div class="card card-body">
-                            <p class="mb-2">This is the high-value admin control for teams that want broader GPT choice without locking every workflow to a single deployment.</p>
-                            <ul class="mb-3">
-                                <li>Configure multiple model endpoints and choose which GPT deployments are available to users.</li>
-                                <li>Set a default fallback model so summarization, agent requests, and other background flows still resolve a usable GPT when an explicit selection is missing.</li>
-                                <li>Use the admin-only Agent Default Model Review modal to inspect inherited agents, search and filter large agent sets, and explicitly choose which review rows should be overridden to the saved default.</li>
-                            </ul>
-                            <div class="alert alert-info mb-3" role="alert">
-                                <strong>Admin-only workflow:</strong> The review modal is intended for administrators who need to standardize agents on a new default model, control cost, or intentionally replace older explicit bindings as new models are released.
-                            </div>
-                            <div class="alert alert-secondary mb-3" role="alert">
-                                Review endpoint and fallback configuration in the <a href="#ai-models" onclick="switchTab(event, 'ai-models-tab')">AI Models</a> tab.
-                            </div>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/model_selection_multi_endpoint_admin.png') }}"
-                                    data-latest-feature-image-title="Admin Multi-Endpoint Model Management"
-                                    data-latest-feature-image-caption="Admin endpoint table showing Azure OpenAI and Foundry model endpoints with configured GPT choices."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/model_selection_multi_endpoint_admin.png') }}" alt="Admin multi-endpoint model management screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Admin Endpoint Table</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/agent_default_model_review_summary.png') }}"
-                                    data-latest-feature-image-title="Agent Default Model Review Summary"
-                                    data-latest-feature-image-caption="AI Models summary card showing recommended agents, explicit override candidates, and the saved default model before opening the review modal."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/agent_default_model_review_summary.png') }}" alt="Agent default model review summary screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Review Summary Card</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/agent_default_model_review_action.png') }}"
-                                    data-latest-feature-image-title="Agent Default Model Review Modal"
-                                    data-latest-feature-image-caption="Admin modal for searching, filtering, and selecting the exact agents that should adopt the saved default model."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/agent_default_model_review_action.png') }}" alt="Agent default model review modal screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Review Modal Action</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-tabular-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-table me-2"></i>Tabular Data Analysis
-                            </h5>
-                            <p class="text-muted mb-0">Enhanced citations now unlock a more consistent tabular analysis experience for normal chat and workspace-backed files, not just dedicated agent scenarios.</p>
-                        </div>
-                        <a href="#latestFeaturesTabular" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesTabular">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesTabular">
-                        <div class="card card-body">
-                            <p class="mb-2">This is the highest-impact settings area to mirror here because it combines storage-backed citations, tabular previews, and consistent behavior across workspace and chat uploads.</p>
-                            <ul class="mb-3">
-                                <li>Tabular files can be analyzed with the same core approach whether they come from chat uploads or any workspace container.</li>
-                                <li>Enhanced citations provide the blob-backed dependency for richer tabular processing and citation transparency.</li>
-                                <li>Admins can right-size tabular preview limits based on the memory profile of their runtime.</li>
-                            </ul>
-                            <div class="alert alert-secondary mb-3" role="alert">
-                                These controls mirror the saved values in the <a href="#citation" onclick="switchTab(event, 'citation-tab')">Citations</a> tab.
-                            </div>
-                            <div class="form-check form-switch mb-3">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="latest_features_enable_enhanced_citations"
-                                    name="latest_features_enable_enhanced_citations_proxy"
-                                    autocomplete="off"
-                                    data-ignore-settings-change="true"
-                                    data-lpignore="true"
-                                    data-1p-ignore="true"
-                                    data-bwignore="true"
-                                    {% if settings.enable_enhanced_citations %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2" for="latest_features_enable_enhanced_citations">
-                                    Enable Enhanced Citations
-                                </label>
-                            </div>
-
-                            <div id="latest_features_enhanced_citation_settings" class="{% if not settings.enable_enhanced_citations %}d-none{% endif %}">
-                                <div class="card mb-3 p-3">
-                                    <h6><strong>All filetypes</strong></h6>
-                                    <div class="mb-3">
-                                        <label for="latest_features_office_docs_authentication_type" class="form-label">
-                                            Storage Account Authentication Type
-                                        </label>
-                                        <select class="form-select" id="latest_features_office_docs_authentication_type" name="latest_features_office_docs_authentication_type_proxy" autocomplete="off" data-ignore-settings-change="true" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
-                                            <option value="key" {% if settings.office_docs_authentication_type == "key" or not settings.office_docs_authentication_type %}selected{% endif %}>Connection String</option>
-                                            <option value="managed_identity" {% if settings.office_docs_authentication_type == "managed_identity" %}selected{% endif %}>Managed Identity</option>
-                                        </select>
-                                    </div>
-
-                                    <div class="mb-3 {% if settings.office_docs_authentication_type == 'managed_identity' %}d-none{% endif %}" id="latest_features_office_docs_storage_conn_str_group">
-                                        <label for="latest_features_office_docs_storage_account_url" class="form-label">
-                                            Storage Account Connection String
-                                        </label>
-                                        <div class="input-group">
-                                            <input
-                                                type="password"
-                                                class="form-control"
-                                                id="latest_features_office_docs_storage_account_url"
-                                                name="latest_features_office_docs_storage_account_url_proxy"
-                                                autocomplete="off"
-                                                data-ignore-settings-change="true"
-                                                data-lpignore="true"
-                                                data-1p-ignore="true"
-                                                data-bwignore="true"
-                                                value="{{ settings.office_docs_storage_account_url or '' }}"
-                                            >
-                                            <button type="button" class="btn btn-outline-secondary" id="toggle_latest_features_office_conn_str">Show</button>
-                                        </div>
-                                    </div>
-
-                                    <div class="mb-3 {% if settings.office_docs_authentication_type != 'managed_identity' %}d-none{% endif %}" id="latest_features_office_docs_storage_url_group">
-                                        <label for="latest_features_office_docs_storage_account_blob_endpoint" class="form-label">
-                                            Storage Account Blob Service Endpoint
-                                        </label>
-                                        <div class="input-group">
-                                            <input
-                                                type="password"
-                                                class="form-control"
-                                                id="latest_features_office_docs_storage_account_blob_endpoint"
-                                                name="latest_features_office_docs_storage_account_blob_endpoint_proxy"
-                                                autocomplete="off"
-                                                data-ignore-settings-change="true"
-                                                data-lpignore="true"
-                                                data-1p-ignore="true"
-                                                data-bwignore="true"
-                                                value="{{ settings.office_docs_storage_account_blob_endpoint or '' }}"
-                                            >
-                                            <button type="button" class="btn btn-outline-secondary" id="toggle_latest_features_office_url">Show</button>
-                                        </div>
-                                    </div>
-                                </div>
-
-                                <div class="card mb-3 p-3">
-                                    <h6><strong>Tabular Preview Limits</strong></h6>
-                                    <div class="mb-3">
-                                        <label for="latest_features_tabular_preview_max_blob_size_mb" class="form-label">
-                                            Maximum File Size for Tabular Preview (MB)
-                                        </label>
-                                        <input type="number" class="form-control" id="latest_features_tabular_preview_max_blob_size_mb" name="latest_features_tabular_preview_max_blob_size_mb_proxy" autocomplete="off" inputmode="numeric" data-ignore-settings-change="true" data-lpignore="true" data-1p-ignore="true" data-bwignore="true"
-                                            min="1" max="1024"
-                                            value="{{ settings.tabular_preview_max_blob_size_mb or 200 }}">
-                                        <small class="form-text text-muted">
-                                            Mirror of the Citations setting. Larger values support bigger previews but increase runtime memory pressure.
-                                        </small>
-                                    </div>
-                                </div>
-                            </div>
-
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/tabular_analysis_enhanced_citations.png') }}"
-                                    data-latest-feature-image-title="Tabular Analysis with Enhanced Citations"
-                                    data-latest-feature-image-caption="Enhanced citations and tabular analysis preview."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/tabular_analysis_enhanced_citations.png') }}" alt="Tabular analysis enhanced citations screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Tabular Analysis Preview</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-citation-improvements-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-journal-text me-2"></i>Citation Improvements
-                            </h5>
-                            <p class="text-muted mb-0">Conversation history citation replay and citation amplification keep more grounded evidence available across follow-up turns without making the chat history unwieldy.</p>
-                        </div>
-                        <a href="#latestFeaturesCitationImprovements" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesCitationImprovements">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesCitationImprovements">
-                        <div class="card card-body">
-                            <p class="mb-2">These improvements make follow-up questions more reliable because the system can reuse prior grounded evidence instead of relying only on the assistant's last prose response.</p>
-                            <ul class="mb-3">
-                                <li>Conversation history citations carry forward prior citation summaries so later prompts can reuse earlier grounded results.</li>
-                                <li>Citation amplification keeps richer supporting payloads available for inspection and export while keeping prompt history compact.</li>
-                                <li>This is especially useful for larger or tabular outputs where users often ask multiple follow-up questions against the same evidence chain.</li>
-                            </ul>
-                            <div class="alert alert-secondary mb-3" role="alert">
-                                These improvements complement the <a href="#citation" onclick="switchTab(event, 'citation-tab')">Citations</a> configuration and the enhanced-citation storage flow.
-                            </div>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/citation_improvements_history_replay.png') }}"
-                                    data-latest-feature-image-title="Conversation History Citation Replay"
-                                    data-latest-feature-image-caption="Follow-up chat where prior citation summaries are replayed into the next turn's reasoning context."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/citation_improvements_history_replay.png') }}" alt="Conversation history citation replay screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">History Citation Replay</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/citation_improvements_amplified_results.png') }}"
-                                    data-latest-feature-image-title="Citation Amplification Details"
-                                    data-latest-feature-image-caption="Expanded citation detail showing amplified supporting evidence and fuller artifact-backed results."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/citation_improvements_amplified_results.png') }}" alt="Citation amplification details screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Amplified Citation Detail</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-document-versioning-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-files me-2"></i>Document Revisioning and Management
-                            </h5>
-                            <p class="text-muted mb-0">Uploading a document with the same name now creates a new revision instead of overwriting the previous file, while older versions remain available for traceability and later analysis.</p>
-                        </div>
-                        <a href="#latestFeaturesDocumentVersioning" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesDocumentVersioning">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesDocumentVersioning">
-                        <div class="card card-body">
-                            <p class="mb-2">This improves both document management and citation integrity for long-lived conversations that span multiple document updates.</p>
-                            <ul class="mb-3">
-                                <li>Same-name uploads create a revision family with an incremented current version instead of destroying prior history.</li>
-                                <li>Previous versions are retained for analysis or comparison, while workspace and search views focus on the current revision by default.</li>
-                                <li>Older conversations can still resolve citations against the correct historical document version.</li>
-                                <li>Updated revisions inherit document classifications and tags so admins do not have to reapply metadata after every refresh.</li>
-                            </ul>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/document_revision_workspace.png') }}"
-                                    data-latest-feature-image-title="Current Revision in Workspace"
-                                    data-latest-feature-image-caption="Workspace document list showing the current revision state for same-name uploads."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/document_revision_workspace.png') }}" alt="Document revision workspace screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Current Revision View</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/document_revision_delete_compare.png') }}"
-                                    data-latest-feature-image-title="Revision Actions and Comparison"
-                                    data-latest-feature-image-caption="Version-aware actions such as comparison, analysis of previous revisions, or current-versus-all-versions deletion choices."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/document_revision_delete_compare.png') }}" alt="Document revision actions screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Revision Actions</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-export-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-file-earmark-arrow-down me-2"></i>Conversation Summaries and Export
-                            </h5>
-                            <p class="text-muted mb-0">Conversation export now includes persistent summaries, PDF output, and easier per-message reuse and sharing actions.</p>
-                        </div>
-                        <a href="#latestFeaturesExports" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesExports">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesExports">
-                        <div class="card card-body">
-                            <ul class="mb-3">
-                                <li>Conversation details now surface a summary card with generate and regenerate actions.</li>
-                                <li>Export supports PDF alongside existing export options.</li>
-                                <li>Per-message actions support Markdown export, Word export, open in email, and use as prompt.</li>
-                            </ul>
-                            <div class="row g-3">
-                                <div class="col-lg-6">
-                                    <button
-                                        type="button"
-                                        class="latest-feature-thumbnail-trigger"
-                                        data-latest-feature-image-src="{{ url_for('static', filename='images/features/conversation_summary_card.png') }}"
-                                        data-latest-feature-image-title="Conversation Summary Card"
-                                        data-latest-feature-image-caption="Conversation summary panel preview in the chat experience."
-                                    >
-                                        <div class="latest-feature-thumbnail-card h-100">
-                                            <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/conversation_summary_card.png') }}" alt="Conversation summary card screenshot">
-                                            <div class="latest-feature-thumbnail-body">
-                                                <div class="latest-feature-thumbnail-title">Conversation Summary Card</div>
-                                                <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                            </div>
-                                        </div>
-                                    </button>
-                                </div>
-                                <div class="col-lg-6">
-                                    <div class="latest-feature-gallery h-100">
-                                        <button
-                                            type="button"
-                                            class="latest-feature-thumbnail-trigger"
-                                            data-latest-feature-image-src="{{ url_for('static', filename='images/features/pdf_export_option.png') }}"
-                                            data-latest-feature-image-title="PDF Export Option"
-                                            data-latest-feature-image-caption="PDF export entry in the conversation export workflow."
-                                        >
-                                            <div class="latest-feature-thumbnail-card h-100">
-                                                <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/pdf_export_option.png') }}" alt="PDF export option screenshot">
-                                                <div class="latest-feature-thumbnail-body">
-                                                    <div class="latest-feature-thumbnail-title">PDF Export Option</div>
-                                                    <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                                </div>
-                                            </div>
-                                        </button>
-                                        <button
-                                            type="button"
-                                            class="latest-feature-thumbnail-trigger"
-                                            data-latest-feature-image-src="{{ url_for('static', filename='images/features/per_message_export_menu.png') }}"
-                                            data-latest-feature-image-title="Per-Message Export Menu"
-                                            data-latest-feature-image-caption="Expanded per-message export and reuse actions."
-                                        >
-                                            <div class="latest-feature-thumbnail-card h-100">
-                                                <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/per_message_export_menu.png') }}" alt="Per-message export menu screenshot">
-                                                <div class="latest-feature-thumbnail-body">
-                                                    <div class="latest-feature-thumbnail-title">Per-Message Export Menu</div>
-                                                    <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                                </div>
-                                            </div>
-                                        </button>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-agent-ops-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-grid me-2"></i>Agent and Action Operations
-                            </h5>
-                            <p class="text-muted mb-0">Recent updates improve manageability for agents and actions with richer views, easier SQL connectivity checks, and better operational tracking.</p>
-                        </div>
-                        <a href="#latestFeaturesAgentOps" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesAgentOps">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesAgentOps">
-                        <div class="card card-body">
-                            <ul class="mb-3">
-                                <li>List and grid view toggles give admins and users a better way to browse agents and actions.</li>
-                                <li>SQL actions now include an inline Test Connection button before save.</li>
-                                <li>User tracking and activity logging improve auditability for agent and action changes.</li>
-                            </ul>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/agent_action_grid_view.png') }}"
-                                    data-latest-feature-image-title="Agent and Action Grid View"
-                                    data-latest-feature-image-caption="Grid browsing experience for agents and actions."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/agent_action_grid_view.png') }}" alt="Agent and action grid view screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Grid View</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/sql_test_connection.png') }}"
-                                    data-latest-feature-image-title="SQL Test Connection"
-                                    data-latest-feature-image-caption="Inline SQL connection test preview before save."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/sql_test_connection.png') }}" alt="SQL test connection screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">SQL Test Connection</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-thoughts-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-stars me-2"></i>AI Transparency
-                            </h5>
-                            <p class="text-muted mb-0">Processing Thoughts provide a clearer view into model activity, duration, and execution flow while responses are being generated.</p>
-                        </div>
-                        <a href="#latestFeaturesThoughts" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesThoughts">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesThoughts">
-                        <div class="card card-body">
-                            <p class="mb-2">Admins can enable this once and let users see more of the model pipeline, including sending, generating, and responded states with clearer timing information.</p>
-                            <div class="alert alert-secondary mb-3" role="alert">
-                                This toggle mirrors the saved value in the <a href="#ai-models" onclick="switchTab(event, 'ai-models-tab')">AI Models</a> tab.
-                            </div>
-                            <div class="form-check form-switch mb-3">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="latest_features_enable_thoughts"
-                                    name="latest_features_enable_thoughts_proxy"
-                                    autocomplete="off"
-                                    data-ignore-settings-change="true"
-                                    data-lpignore="true"
-                                    data-1p-ignore="true"
-                                    data-bwignore="true"
-                                    {% if settings.enable_thoughts %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2" for="latest_features_enable_thoughts">
-                                    Enable Processing Thoughts
-                                </label>
-                            </div>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/thoughts_visibility.png') }}"
-                                    data-latest-feature-image-title="Processing Thoughts Visibility"
-                                    data-latest-feature-image-caption="Processing thoughts state and timing details preview."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/thoughts_visibility.png') }}" alt="Processing thoughts visibility screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Processing Thoughts</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-fact-memory-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-journal-bookmark me-2"></i>Fact Memory
-                            </h5>
-                            <p class="text-muted mb-0">Users can now save Instructions and Facts on their profile so the assistant can apply durable preferences every time and recall relevant personal context only when needed.</p>
-                        </div>
-                        <a href="#latestFeaturesFactMemory" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesFactMemory">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesFactMemory">
-                        <div class="card card-body">
-                            <p class="mb-2">Fact Memory gives users a compact profile experience for managing two distinct memory types: always-on Instructions and relevance-based Facts.</p>
-                            <ul class="mb-3">
-                                <li>Instructions act like stable user preferences and are applied on every prompt unless the current message overrides them.</li>
-                                <li>Facts are recalled only when relevant and now appear as dedicated thought and citation entries in chat.</li>
-                                <li>The profile page includes a compact add flow plus a popup manager for search, paging, edit, retag, and delete actions.</li>
-                                <li>Admins can choose whether this announcement is visible on the user-facing Latest Features page from <strong>General > User-Facing Latest Features</strong>.</li>
-                            </ul>
-                            <div class="alert alert-secondary mb-3" role="alert">
-                                Use the <a href="#general" onclick="switchTab(event, 'general-tab')">General</a> tab when you want to show or hide the Fact Memory announcement for end users.
-                            </div>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/facts_memory_view_profile.png') }}"
-                                    data-latest-feature-image-title="Fact Memory on Profile"
-                                    data-latest-feature-image-caption="Profile page section for adding saved instructions and facts and opening the manager modal."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/facts_memory_view_profile.png') }}" alt="Profile fact memory section screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Profile Entry Point</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/fact_memory_management.png') }}"
-                                    data-latest-feature-image-title="Manage Fact Memories"
-                                    data-latest-feature-image-caption="Compact popup manager showing saved instructions and facts with search, paging, edit, and type controls."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/fact_memory_management.png') }}" alt="Fact memory management modal screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Memory Manager</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/facts_citation_and_thoughts.png') }}"
-                                    data-latest-feature-image-title="Instruction Memory and Fact Recall in Chat"
-                                    data-latest-feature-image-caption="Chat response showing instruction memory and fact recall surfaced as dedicated thoughts and citations."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/facts_citation_and_thoughts.png') }}" alt="Chat fact memory thoughts and citations screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Chat Recall</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-redis-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-key me-2"></i>Redis and Key Vault
-                            </h5>
-                            <p class="text-muted mb-0">Redis configuration now supports using a Key Vault secret name instead of storing the access key directly in settings.</p>
-                        </div>
-                        <a href="#latestFeaturesRedis" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesRedis">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesRedis">
-                        <div class="card card-body">
-                            <p class="mb-2">This is useful for teams standardizing on Key Vault-backed secret storage while still using Redis for cache and session scenarios.</p>
-                            <ul class="mb-3">
-                                <li>Use Redis authentication type <strong>Key Vault</strong> when you want the stored value to represent a secret name instead of a raw Redis key.</li>
-                                <li>This works best when Key Vault is already configured for the app.</li>
-                            </ul>
-                            <div class="alert alert-secondary mb-3" role="alert">
-                                These controls mirror the saved values in the <a href="#scale" onclick="switchTab(event, 'scale-tab')">Scale</a> tab.
-                            </div>
-                            <div class="form-check form-switch mb-3">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="latest_features_enable_redis_cache"
-                                    name="latest_features_enable_redis_cache_proxy"
-                                    autocomplete="off"
-                                    data-ignore-settings-change="true"
-                                    data-lpignore="true"
-                                    data-1p-ignore="true"
-                                    data-bwignore="true"
-                                    {% if settings.enable_redis_cache %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2" for="latest_features_enable_redis_cache">
-                                    Enable Redis Cache
-                                </label>
-                            </div>
-
-                            <div id="latest_features_redis_settings" class="{% if not settings.enable_redis_cache %}d-none{% endif %}">
-                                <div class="card mb-3 p-3">
-                                    <h6><strong>Redis Cache Settings</strong></h6>
-                                    <div class="mb-3">
-                                        <label for="latest_features_redis_url" class="form-label">Redis Server Host Name</label>
-                                        <input
-                                            type="text"
-                                            class="form-control"
-                                            id="latest_features_redis_url"
-                                            name="latest_features_redis_url_proxy"
-                                            autocomplete="off"
-                                            data-ignore-settings-change="true"
-                                            data-lpignore="true"
-                                            data-1p-ignore="true"
-                                            data-bwignore="true"
-                                            value="{{ settings.redis_url or '' }}"
-                                        >
-                                    </div>
-                                    <div class="mb-3">
-                                        <label for="latest_features_redis_auth_type" class="form-label">Redis Authentication Type</label>
-                                        <select
-                                            class="form-select"
-                                            id="latest_features_redis_auth_type"
-                                            name="latest_features_redis_auth_type_proxy"
-                                            autocomplete="off"
-                                            data-ignore-settings-change="true"
-                                            data-lpignore="true"
-                                            data-1p-ignore="true"
-                                            data-bwignore="true"
-                                        >
-                                            <option value="key" {% if settings.redis_auth_type == 'key' or not settings.redis_auth_type %}selected{% endif %}>Key</option>
-                                            <option value="managed_identity" {% if settings.redis_auth_type == 'managed_identity' %}selected{% endif %}>Managed Identity</option>
-                                            <option value="key_vault" {% if settings.redis_auth_type == 'key_vault' %}selected{% endif %}>Key Vault</option>
-                                        </select>
-                                    </div>
-                                    <div class="mb-3 {% if settings.redis_auth_type == 'managed_identity' %}d-none{% endif %}" id="latest_features_redis_key_container">
-                                        <label for="latest_features_redis_key" class="form-label" id="latest_features_redis_key_label">
-                                            {%- if settings.redis_auth_type == 'key_vault' -%}
-                                                Key Vault Secret Name
-                                            {%- else -%}
-                                                Redis Access Key
-                                            {%- endif -%}
-                                        </label>
-                                        <div class="input-group">
-                                            <input
-                                                type="password"
-                                                class="form-control"
-                                                id="latest_features_redis_key"
-                                                name="latest_features_redis_key_proxy"
-                                                autocomplete="off"
-                                                data-ignore-settings-change="true"
-                                                data-lpignore="true"
-                                                data-1p-ignore="true"
-                                                data-bwignore="true"
-                                                value="{{ settings.redis_key or '' }}"
-                                            >
-                                            <button type="button" class="btn btn-outline-secondary" id="toggle_latest_features_redis_key">Show</button>
-                                        </div>
-                                        <div id="latest_features_redis_key_vault_hint" class="form-text text-muted {% if settings.redis_auth_type != 'key_vault' %}d-none{% endif %}">
-                                            When using Key Vault, store the secret name here instead of the raw Redis key.
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/redis_key_vault.png') }}"
-                                    data-latest-feature-image-title="Redis Key Vault Configuration"
-                                    data-latest-feature-image-caption="Redis authentication with Key Vault secret name preview."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/redis_key_vault.png') }}" alt="Redis Key Vault configuration screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Redis Key Vault</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-send-feedback-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-envelope-paper me-2"></i>Send Feedback to the SimpleChat Team
-                            </h5>
-                            <p class="text-muted mb-0">Admins now have a dedicated Send Feedback tab for bug reports and feature requests that opens a prefilled email draft and writes an audit record to the activity log.</p>
-                        </div>
-                        <a href="#latestFeaturesSendFeedback" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesSendFeedback">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesSendFeedback">
-                        <div class="card card-body">
-                            <p class="mb-3">Use the Send Feedback tab when you want to report a bug or suggest a feature directly from Admin Settings without leaving the page.</p>
-                            <ul class="mb-3">
-                                <li>Opens a prefilled email draft addressed to <strong>simplechat@microsoft.com</strong>.</li>
-                                <li>Logs the action to the activity log so admins can audit when feedback emails were prepared.</li>
-                                <li>Keeps the workflow simple by using text-only email content with no confusing pseudo-attachment step.</li>
-                            </ul>
-                            <a href="#send-feedback" onclick="switchTab(event, 'send-feedback-tab')" class="btn btn-outline-primary align-self-start">
-                                <i class="bi bi-envelope-paper me-1"></i>Open Send Feedback
-                            </a>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3 latest-feature-card" id="latest-features-support-menu-card">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-life-preserver me-2"></i>Support Menu
-                            </h5>
-                            <p class="text-muted mb-0">Support can now expose user-facing Latest Features and Send Feedback workflows directly in everyday navigation.</p>
-                        </div>
-                        <a href="#latestFeaturesSupportMenu" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="latestFeaturesSupportMenu">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="latestFeaturesSupportMenu">
-                        <div class="card card-body">
-                            <div class="alert alert-success mb-3" role="alert">
-                                Support is now configurable from the General tab so admins can choose exactly what users see.
-                            </div>
-                            <ul class="mb-3">
-                                <li>Admins can enable or disable the Support menu and rename it for user navigation.</li>
-                                <li>Send Feedback now routes users to an internal recipient email address defined by admins.</li>
-                                <li>The user-facing Latest Features page can be curated feature-by-feature so teams only share the items they want visible.</li>
-                                <li>The General tab now includes a dedicated User-Facing Latest Features checklist so admins can quickly confirm which announcements will be visible to end users.</li>
-                            </ul>
-                            <a href="#general" onclick="switchTab(event, 'general-tab')" class="btn btn-outline-primary align-self-start mb-3">
-                                <i class="bi bi-gear me-1"></i>Open General Settings
-                            </a>
-                            <div class="latest-feature-gallery">
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/support_menu_entry.png') }}"
-                                    data-latest-feature-image-title="User Support Menu Entry"
-                                    data-latest-feature-image-caption="User-facing Support menu entry exposing Latest Features and Send Feedback."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/support_menu_entry.png') }}" alt="Support menu entry screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">Support Menu Entry</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                                <button
-                                    type="button"
-                                    class="latest-feature-thumbnail-trigger"
-                                    data-latest-feature-image-src="{{ url_for('static', filename='images/features/enable_support_menu_for_end_users.png') }}"
-                                    data-latest-feature-image-title="User-Facing Latest Features in General Settings"
-                                    data-latest-feature-image-caption="General tab Support settings showing Enable Support Menu for End Users and the User-Facing Latest Features checklist that controls what gets shared."
-                                >
-                                    <div class="latest-feature-thumbnail-card">
-                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename='images/features/enable_support_menu_for_end_users.png') }}" alt="User-facing latest features checklist in general settings screenshot">
-                                        <div class="latest-feature-thumbnail-body">
-                                            <div class="latest-feature-thumbnail-title">General Tab Feature Sharing</div>
-                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                        </div>
-                                    </div>
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                {% endif %}
-
-                {% for release_group in support_latest_feature_release_groups_preview %}
-                {% if release_group.id != 'current_release' %}
-                {% set preview_card_id = 'latest-features-user-preview-' ~ release_group.id|replace('_', '-') ~ '-card' %}
-                {% set preview_collapse_id = 'latestFeaturesUserPreview' ~ release_group.id|replace('_', ' ')|title|replace(' ', '') %}
-                <div class="card p-3 mb-3 latest-feature-card" id="{{ preview_card_id }}">
-                    <div class="latest-feature-header">
-                        <div class="latest-feature-copy">
-                            <h5 class="mb-1">
-                                <i class="bi bi-clock-history me-2"></i>{{ release_group.label }}
-                            </h5>
-                            <p class="text-muted mb-0">{{ release_group.description }}</p>
-                        </div>
-                        <a href="#{{ preview_collapse_id }}" class="fw-bold latest-feature-toggle" data-bs-toggle="collapse" aria-expanded="false" aria-controls="{{ preview_collapse_id }}">
-                            Show Details
-                        </a>
-                    </div>
-                    <div class="collapse mt-3" id="{{ preview_collapse_id }}">
-                        <div class="card card-body">
-                            <div class="alert alert-secondary mb-3" role="alert">
-                                These were the headline user-facing items in the earlier v{{ release_group.release_version }} release set. Keeping them here gives admins a simple previous-and-archive release view without mixing older items into the current release list.
-                            </div>
-                            <div class="row g-3">
-                                {% for feature in release_group.features %}
-                                <div class="col-xl-6">
-                                    <div class="border rounded p-3 h-100 bg-body-tertiary">
-                                        <div class="d-flex flex-column gap-3 h-100">
-                                            <div class="d-flex align-items-start justify-content-between gap-3">
-                                                <div>
-                                                    <h6 class="mb-1"><i class="bi {{ feature.icon }} me-2"></i>{{ feature.title }}</h6>
-                                                    <p class="text-muted small mb-0">{{ feature.summary }}</p>
-                                                </div>
-                                                <span class="badge {% if settings.support_latest_features_visibility.get(feature.id, true) %}bg-success{% else %}bg-secondary{% endif %}">
-                                                    {% if settings.support_latest_features_visibility.get(feature.id, true) %}Shared with Users{% else %}Hidden from Users{% endif %}
-                                                </span>
-                                            </div>
-                                            <p class="small mb-0">{{ feature.details }}</p>
-                                            {% if feature.guidance %}
-                                            <ul class="small mb-0">
-                                                {% for tip in feature.guidance %}
-                                                <li>{{ tip }}</li>
-                                                {% endfor %}
-                                            </ul>
-                                            {% endif %}
-                                            {% if feature.images %}
-                                            <div class="latest-feature-gallery">
-                                                {% for image in feature.images %}
-                                                <button
-                                                    type="button"
-                                                    class="latest-feature-thumbnail-trigger"
-                                                    data-latest-feature-image-src="{{ url_for('static', filename=image.path) }}"
-                                                    data-latest-feature-image-title="{{ image.title }}"
-                                                    data-latest-feature-image-caption="{{ image.caption }}"
-                                                >
-                                                    <div class="latest-feature-thumbnail-card h-100">
-                                                        <img class="latest-feature-thumbnail-image" src="{{ url_for('static', filename=image.path) }}" alt="{{ image.alt }}">
-                                                        <div class="latest-feature-thumbnail-body">
-                                                            <div class="latest-feature-thumbnail-title">{{ image.label }}</div>
-                                                            <div class="latest-feature-thumbnail-meta">Click to enlarge</div>
-                                                        </div>
-                                                    </div>
-                                                </button>
-                                                {% endfor %}
-                                            </div>
-                                            {% endif %}
-                                            {% if feature.actions %}
-                                            <div class="d-flex flex-wrap gap-2 mt-auto pt-2">
-                                                {% for action in feature.actions %}
-                                                <a
-                                                    class="btn btn-outline-primary btn-sm"
-                                                    href="{% if action.href %}{{ action.href }}{% else %}{{ url_for(action.endpoint) }}{% if action.fragment %}#{{ action.fragment }}{% endif %}{% endif %}"
-                                                    {% if action.is_external %}target="_blank" rel="noopener noreferrer"{% endif %}
-                                                >
-                                                    <i class="bi {{ action.icon }} me-1"></i>{{ action.label }}
-                                                </a>
-                                                {% endfor %}
-                                            </div>
-                                            {% endif %}
-                                        </div>
-                                    </div>
-                                </div>
-                                {% endfor %}
-                            </div>
-                            <p class="text-muted small mb-0 mt-3">Visibility still comes from <strong>General &gt; User-Facing Latest Features</strong>, so admins can keep previous and archived release content available without promoting every item forever.</p>
-                        </div>
-                    </div>
-                </div>
-                {% endif %}
-                {% endfor %}
-            </div>
-
-            <div class="tab-pane fade" id="custom-pages" role="tabpanel" aria-labelledby="custom-pages-tab">
-                <p class="text-muted">
-                    Enable trusted deployment-time custom pages and manage metadata for simple static pages served from the application custom_pages folders.
-                </p>
-
-                <div class="card p-3 mb-3" id="custom-pages-section">
-                    <div class="d-flex flex-column flex-md-row align-items-md-center justify-content-between gap-2 mb-3">
-                        <h5 class="mb-0">
-                            <i class="bi bi-window-plus me-2"></i>Custom Pages
-                        </h5>
-                        <button type="button" class="btn btn-sm btn-outline-info" id="custom-pages-guide-btn">
-                            <i class="bi bi-book me-1"></i>Developer Guide
-                        </button>
-                    </div>
-                    <div class="form-check form-switch mb-2">
-                        <input class="form-check-input" type="checkbox" id="enable_custom_pages" name="enable_custom_pages"
-                            {% if settings.enable_custom_pages %}checked{% endif %}>
-                        <input type="hidden" id="custom_pages_restart_acknowledged" name="custom_pages_restart_acknowledged" value="">
-                        <label class="form-check-label ms-2" for="enable_custom_pages">
-                            Enable Custom Pages
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow trusted custom pages deployed under application/single_app/custom_pages to appear in navigation and be served under /custom."></i>
-                    </div>
-                    <p class="text-muted small">When disabled, /custom routes return Not Found before loading custom metadata, files, or Python extensions.</p>
-
-                    <div id="custom_pages_settings" class="{% if not settings.enable_custom_pages %}d-none{% endif %}">
-                        <div class="mb-3">
-                            <label for="custom_pages_menu_name" class="form-label">Menu Name</label>
-                            <input type="text" class="form-control" id="custom_pages_menu_name" name="custom_pages_menu_name"
-                                value="{{ settings.custom_pages_menu_name or 'Custom Pages' }}" placeholder="Custom Pages">
-                            <small class="form-text text-muted">This name appears when custom pages are grouped into a menu.</small>
-                        </div>
-
-                        <div class="form-check form-switch mb-3">
-                            <input class="form-check-input" type="checkbox" id="custom_pages_force_menu" name="custom_pages_force_menu"
-                                {% if settings.custom_pages_force_menu %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="custom_pages_force_menu">
-                                Force Menu Display
-                            </label>
-                            <small class="form-text text-muted d-block">When disabled, 1-2 custom pages show as top-level nav items and 3+ pages show as a menu.</small>
-                        </div>
-
-                        <div class="d-flex align-items-center justify-content-between mb-2">
-                            <div>
-                                <h6 class="mb-1">Static Page Metadata</h6>
-                                <p class="text-muted small mb-0">Create metadata contracts for simple pages that use files from custom_pages/html, css, js, assets, and json.</p>
-                            </div>
-                            <div class="d-flex flex-wrap gap-2 justify-content-end">
-                                <button type="button" class="btn btn-sm btn-outline-success" id="create-request-access-page-btn">
-                                    <i class="bi bi-person-plus me-1"></i>Add Request Access Page
-                                </button>
-                                <button type="button" class="btn btn-sm btn-outline-primary" id="add-custom-page-btn">
-                                    <i class="bi bi-plus-circle me-1"></i>New Static Page
-                                </button>
-                            </div>
-                        </div>
-
-                        <div class="table-responsive">
-                            <table class="table table-sm table-bordered align-middle">
-                                <thead>
-                                    <tr>
-                                        <th>Slug</th>
-                                        <th>Title</th>
-                                        <th>Type</th>
-                                        <th>Access</th>
-                                        <th>Roles</th>
-                                        <th>Status</th>
-                                        <th>Nav</th>
-                                        <th>Actions</th>
-                                    </tr>
-                                </thead>
-                                <tbody id="custom-pages-tbody">
-                                    <tr>
-                                        <td colspan="8" class="text-muted text-center">Loading custom pages...</td>
-                                    </tr>
-                                </tbody>
-                            </table>
-                        </div>
-                    </div>
-                </div>
-            </div>
-
-
-            <div class="tab-pane fade" id="ai-models" role="tabpanel" aria-labelledby="ai-models-tab">
-
-                <p class="text-muted">
-                    Configure all AI model settings including GPT for text generation, embeddings for semantic search, and image generation capabilities.
-                </p>
-
-                <div class="card p-3 mb-4" id="multi-endpoint-configuration">
-                    <h5 class="card-title">
-                        <i class="bi bi-hdd-network me-2"></i>Model Endpoints
-                    </h5>
-                    <p class="text-muted small">
-                        Manage multiple AI model endpoints (Azure OpenAI and Azure AI Foundry). When enabled, model selection in chat is driven by these endpoints.
-                    </p>
-
-                    {% if not settings.enable_multi_model_endpoints %}
-                    <div class="form-check form-switch mb-3 d-flex align-items-center">
-                        <input type="checkbox" class="form-check-input me-2" id="enable_multi_model_endpoints" name="enable_multi_model_endpoints" {% if settings.enable_multi_model_endpoints %}checked{% endif %}>
-                        <label class="form-check-label" for="enable_multi_model_endpoints">Enable multi-endpoint model management</label>
-                    </div>
-                    {% endif %}
-
-                    {% if settings.enable_semantic_kernel %}
-                    <div id="agent-default-model-migration-panel" class="border rounded p-3 mt-3">
-                        <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3">
-                            <div>
-                                <h6 class="mb-1"><i class="bi bi-arrow-repeat me-2"></i>Agent Default Model Review</h6>
-                                <p class="text-muted small mb-0">
-                                    Review local agents in a modal, bulk-bind inherited agents to the saved default model endpoint, and explicitly override selected agent model choices when you need to manage cost or move to newer models.
-                                </p>
-                            </div>
-                            <div class="d-flex flex-wrap gap-2">
-                                <button type="button" class="btn btn-outline-primary btn-sm" id="preview-agent-default-model-migration-btn">
-                                    <i class="bi bi-search me-1"></i>Review And Select Agents
-                                </button>
-                            </div>
-                        </div>
-                        <div id="agent-default-model-migration-status" class="form-text mt-2">
-                            {% if settings.enable_multi_model_endpoints %}
-                            Save your AI model settings before reviewing or migrating agents.
-                            {% else %}
-                            Enable multi-endpoint model management to review and rebind agents to a saved default model.
-                            {% endif %}
-                        </div>
-                        <div id="agent-default-model-migration-callout" class="alert alert-info d-none mt-3 mb-0" role="alert"></div>
-                    </div>
-
-                    <div id="agent-default-model-migration-results" class="d-none mt-3">
-                        <div class="d-flex flex-wrap gap-2 mb-3">
-                            <span class="badge text-bg-primary" id="agent-default-model-ready-count">Ready: 0</span>
-                            <span class="badge text-bg-warning" id="agent-default-model-needs-default-count">Needs Default: 0</span>
-                            <span class="badge text-bg-secondary" id="agent-default-model-manual-count">Manual Review: 0</span>
-                            <span class="badge text-bg-success" id="agent-default-model-migrated-count">Already Migrated: 0</span>
-                        </div>
-                        <div class="small text-muted mb-2" id="agent-default-model-current-label"></div>
-                        <div class="small text-muted">
-                            Open the review modal to search, filter, and selectively rebind agents to the saved default model.
-                        </div>
-                    </div>
-
-                    <div class="modal fade" id="agentDefaultModelMigrationModal" tabindex="-1" aria-labelledby="agentDefaultModelMigrationModalLabel" aria-hidden="true">
-                        <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                            <div class="modal-content">
-                                <div class="modal-header">
-                                    <div>
-                                        <h5 class="modal-title" id="agentDefaultModelMigrationModalLabel">Agent Default Model Review</h5>
-                                        <p class="text-muted small mb-0">
-                                            Search, filter, and explicitly choose which agents should adopt the saved default model. Manual review rows are never selected automatically.
-                                        </p>
-                                    </div>
-                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                                </div>
-                                <div class="modal-body">
-                                    <div class="row g-2 mb-3">
-                                        <div class="col-lg-5">
-                                            <label for="agent-default-model-migration-search" class="form-label small mb-1">Search Agents</label>
-                                            <input type="search" class="form-control form-control-sm" id="agent-default-model-migration-search" placeholder="Search by scope, agent name, binding, or reason" />
-                                        </div>
-                                        <div class="col-lg-3">
-                                            <label for="agent-default-model-migration-filter" class="form-label small mb-1">Filter</label>
-                                            <select class="form-select form-select-sm" id="agent-default-model-migration-filter">
-                                                <option value="all">All Agents</option>
-                                                <option value="selected">Selected</option>
-                                                <option value="ready_to_migrate">Ready</option>
-                                                <option value="manual_review">Manual Review</option>
-                                                <option value="needs_default_model">Needs Default</option>
-                                                <option value="already_migrated">Already On Default</option>
-                                            </select>
-                                        </div>
-                                        <div class="col-lg-4">
-                                            <label class="form-label small mb-1">Selection Tools</label>
-                                            <div class="d-flex flex-wrap gap-2">
-                                                <button type="button" class="btn btn-outline-primary btn-sm" id="select-ready-agent-default-model-migration-btn">Select Recommended</button>
-                                                <button type="button" class="btn btn-outline-secondary btn-sm" id="select-manual-agent-default-model-migration-btn">Add Review Overrides</button>
-                                                <button type="button" class="btn btn-outline-danger btn-sm" id="clear-agent-default-model-migration-selection-btn">Clear</button>
-                                            </div>
-                                        </div>
-                                    </div>
-                                    <div class="small text-muted mb-3" id="agent-default-model-migration-selection-summary">No agents selected.</div>
-                                    <div class="table-responsive">
-                                        <table class="table table-sm table-bordered align-middle">
-                                            <thead>
-                                                <tr>
-                                                    <th style="width: 80px;">Select</th>
-                                                    <th>Scope</th>
-                                                    <th>Agent</th>
-                                                    <th>Status</th>
-                                                    <th>Current Binding</th>
-                                                    <th>Reason</th>
-                                                </tr>
-                                            </thead>
-                                            <tbody id="agent-default-model-migration-tbody">
-                                                <tr>
-                                                    <td colspan="6" class="text-center text-muted py-3">Run a review to load migration candidates.</td>
-                                                </tr>
-                                            </tbody>
-                                        </table>
-                                    </div>
-                                </div>
-                                <div class="modal-footer d-flex flex-column flex-md-row justify-content-between align-items-md-center gap-2">
-                                    <div class="small text-muted">
-                                        Review overrides are for intentional changes when you want to replace an agent's explicit model or legacy custom connection with the saved default model.
-                                    </div>
-                                    <div class="d-flex gap-2">
-                                        <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
-                                        <button type="button" class="btn btn-primary" id="run-agent-default-model-migration-btn">Apply Saved Default To Selected</button>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                    {% else %}
-                    <div id="agent-default-model-migration-disabled-state" class="alert alert-info mt-3" role="alert">
-                        <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3">
-                            <div>
-                                <h6 class="mb-1"><i class="bi bi-info-circle me-2"></i>Agent Default Model Review</h6>
-                                <p class="small mb-0">
-                                    Enable Agents first to use default-model review in AI Models. Once enabled, admins can use it to move inherited agents to new defaults, selectively override explicit agent model choices, and manage costs as models evolve.
-                                </p>
-                            </div>
-                            <button type="button" class="btn btn-outline-primary btn-sm align-self-start" data-open-admin-tab="#agents">
-                                <i class="bi bi-box-arrow-up-right me-1"></i>Open Agents Settings
-                            </button>
-                        </div>
-                    </div>
-                    {% endif %}
-
-                    <div class="border rounded p-3 mt-3">
-                        <div class="d-flex flex-column flex-lg-row justify-content-between gap-2">
-                            <div>
-                                <h6 class="mb-1"><i class="bi bi-fingerprint me-2"></i>Model Endpoint Identity Header</h6>
-                                <p class="text-muted small mb-0">
-                                    Send a stable HMAC-hashed user key to model endpoint backends for APIM counters, quota policies, or routing policies.
-                                </p>
-                            </div>
-                            <div class="form-check form-switch">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="model_endpoint_identity_header_enabled"
-                                    name="model_endpoint_identity_header_enabled"
-                                    {% if settings.model_endpoint_identity_header_enabled %}checked{% endif %}
-                                />
-                                <label class="form-check-label" for="model_endpoint_identity_header_enabled">Enable header</label>
-                            </div>
-                        </div>
-                        <div class="row g-3 mt-1">
-                            <div class="col-md-6">
-                                <label for="model_endpoint_identity_header_name" class="form-label">Header Name</label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="model_endpoint_identity_header_name"
-                                    name="model_endpoint_identity_header_name"
-                                    value="{{ settings.model_endpoint_identity_header_name or 'x-simplechat-identity-key' }}"
-                                />
-                                <div class="form-text">Reserved auth/protocol headers cannot be used.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="model_endpoint_identity_header_value_type" class="form-label">Identity Value</label>
-                                <select class="form-select" id="model_endpoint_identity_header_value_type" name="model_endpoint_identity_header_value_type">
-                                    <option value="user_oid_tenant_id" {% if settings.model_endpoint_identity_header_value_type == 'user_oid_tenant_id' %}selected{% endif %}>User object ID + tenant ID</option>
-                                    <option value="user_oid" {% if settings.model_endpoint_identity_header_value_type == 'user_oid' %}selected{% endif %}>User object ID</option>
-                                    <option value="user_upn_tenant_id" {% if settings.model_endpoint_identity_header_value_type == 'user_upn_tenant_id' %}selected{% endif %}>User UPN + tenant ID</option>
-                                    <option value="user_upn" {% if settings.model_endpoint_identity_header_value_type == 'user_upn' %}selected{% endif %}>User UPN</option>
-                                </select>
-                                <div class="form-text">The selected identity is HMAC-hashed before leaving SimpleChat. Missing identity values omit the header.</div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div id="default-model-selection-wrapper" class="mt-3">
-                        <label for="default-model-selection" class="form-label">Default model for fallbacks</label>
-                        <select class="form-select" id="default-model-selection" aria-label="Default model for fallback selection"></select>
-                        <div class="form-text">
-                            Used for tasks such as conversation summarization, fallback, and other operations when an agent is selected.
-                        </div>
-                    </div>
-
-                    <input type="hidden" name="model_endpoints_json" id="model_endpoints_json" />
-                    <input type="hidden" name="default_model_selection_json" id="default_model_selection_json" />
-
-                    <div id="model-endpoints-wrapper" class="{% if not settings.enable_multi_model_endpoints %}d-none{% endif %}">
-                        <div class="d-flex justify-content-between align-items-center mb-2">
-                            <h6 class="mb-0">Global Endpoints</h6>
-                            <div class="d-flex flex-wrap gap-2">
-                                <button type="button" class="btn btn-sm btn-outline-secondary" data-bs-toggle="modal" data-bs-target="#modelEndpointIdentityGuideModal" data-testid="model-endpoint-identity-guide-open">
-                                    <i class="bi bi-question-circle me-1"></i>Setup Guide
-                                </button>
-                                <button type="button" class="btn btn-sm btn-outline-primary" id="add-model-endpoint-btn">
-                                    <i class="bi bi-plus-circle me-1"></i>Add Endpoint
-                                </button>
-                            </div>
-                        </div>
-                        <div class="table-responsive">
-                            <table class="table table-sm table-bordered">
-                                <thead>
-                                    <tr>
-                                        <th>Name</th>
-                                        <th>Provider</th>
-                                        <th>Selected Models</th>
-                                        <th>Status</th>
-                                        <th>Actions</th>
-                                    </tr>
-                                </thead>
-                                <tbody id="model-endpoints-tbody">
-                                    <!-- Populated by JavaScript -->
-                                </tbody>
-                            </table>
-                        </div>
-                    </div>
-                    {% if not settings.enable_multi_model_endpoints %}
-                        <button type="button" class="btn btn-outline-secondary" data-bs-toggle="modal" data-bs-target="#legacyModelSettingsModal">
-                            <i class="bi bi-sliders me-1"></i>Open Legacy Model Configuration
-                        </button>
-                    {% endif %}
-                </div>
-
-                <!-- Processing Thoughts Section -->
-                <div class="card p-3 mb-4" id="processing-thoughts-section">
-                    <h5>
-                        <i class="bi bi-stars me-2"></i>Processing Thoughts
-                    </h5>
-                    <p class="text-muted">When enabled, real-time processing steps are shown to users during chat responses and persisted for later review.</p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_thoughts"
-                            name="enable_thoughts"
-                            {% if settings.enable_thoughts %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_thoughts">
-                            Enable Processing Thoughts
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show real-time processing steps (searching documents, web search, agent calls, etc.) to users during chat. Steps are stored in Cosmos DB and can be reviewed per-message via a stars icon."></i>
-                    </div>
-                </div>
-
-                <!-- Shared Conversation File Approvals Section -->
-                <div class="card p-3 mb-4" id="shared-conversation-file-approvals-section">
-                    <h5>
-                        <i class="bi bi-file-earmark-lock me-2"></i>Shared Conversation File Approvals
-                    </h5>
-                    <p class="text-muted">Files generated by participants in a shared conversation are saved into the conversation owner's storage. When enabled, those files are held until an approver releases them.</p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="require_shared_conversation_file_approval"
-                            name="require_shared_conversation_file_approval"
-                            {% if settings.require_shared_conversation_file_approval %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="require_shared_conversation_file_approval">
-                            Require approval for participant-generated files
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When a participant who does not own a shared conversation generates a downloadable file (CSV, XLSX, DOCX, PDF, JSON, XML), the file is created but withheld until the conversation owner approves it. In group conversations, any group Owner, Admin, or Document Manager can approve. Unapproved files are automatically declined and deleted after 3 days. Generated images and charts are never gated."></i>
-                    </div>
-                </div>
-
-                <!-- Embeddings Configuration Section -->
-                <div class="card p-3 mb-4" id="embeddings-configuration">
-                    <h5 class="card-title">
-                        <i class="bi bi-vector-pen me-2"></i>Embeddings Configuration
-                    </h5>
-                    <p class="text-muted small">
-                        Configure your embeddings settings. These are used for semantic search, knowledge-base lookups, etc.
-                    </p>
-                    <button type="button" class="btn btn-sm btn-outline-secondary mb-3 align-self-start" data-bs-toggle="modal" data-bs-target="#legacyModelDiscoveryIdentityGuideModal">
-                        <i class="bi bi-question-circle me-1"></i>Setup Guide
-                    </button>
-
-                <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                    <input type="checkbox" class="form-check-input me-2" id="enable_embedding_apim"
-                        name="enable_embedding_apim" {% if settings.enable_embedding_apim %}checked{% endif %}>
-                    <label class="form-check-label" for="enable_embedding_apim">Use APIM instead of direct to Azure
-                        OpenAI endpoint</label>
-                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route embedding model requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
-                </div>
-
-                <div id="non_apim_embedding_settings" {% if settings.enable_embedding_apim %}style="display: none;" {%
-                    endif %}>
-                    <div class="card p-3 mb-3">
-                        <div class="mb-3">
-                            <label for="azure_openai_embedding_endpoint" class="form-label">
-                                Azure OpenAI Embedding Endpoint
-                            </label>
-                            <input type="text" class="form-control" id="azure_openai_embedding_endpoint"
-                                name="azure_openai_embedding_endpoint"
-                                value="{{ settings.azure_openai_embedding_endpoint or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_openai_embedding_authentication_type" class="form-label">
-                                Authentication Type
-                            </label>
-                            <select class="form-select" id="azure_openai_embedding_authentication_type"
-                                name="azure_openai_embedding_authentication_type">
-                                <option value="key" {% if settings.azure_openai_embedding_authentication_type=='key'
-                                    %}selected{% endif %}>
-                                    Key
-                                </option>
-                                <option value="managed_identity" {% if
-                                    settings.azure_openai_embedding_authentication_type=='managed_identity' %}selected{% endif %}>
-                                    Managed Identity
-                                </option>
-                            </select>
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_openai_embedding_subscription_id" class="form-label">Subscription
-                                ID</label>
-                            <input type="text" class="form-control" id="azure_openai_embedding_subscription_id"
-                                name="azure_openai_embedding_subscription_id"
-                                value="{{ settings.azure_openai_embedding_subscription_id or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_openai_embedding_resource_group" class="form-label">Resource Group</label>
-                            <input type="text" class="form-control" id="azure_openai_embedding_resource_group"
-                                name="azure_openai_embedding_resource_group"
-                                value="{{ settings.azure_openai_embedding_resource_group or '' }}">
-                        </div>
-                        <div class="mb-3" id="embedding_key_container" {% if
-                            settings.azure_openai_embedding_authentication_type !='key' %}style="display: none;" {%
-                            endif %}>
-                            <label for="azure_openai_embedding_key" class="form-label">Azure OpenAI Embedding
-                                Key</label>
-                            <div class="input-group">
-                                <input type="password" class="form-control" id="azure_openai_embedding_key"
-                                    name="azure_openai_embedding_key"
-                                    value="{{ settings.azure_openai_embedding_key or '' }}">
-                                <button type="button" class="btn btn-outline-secondary"
-                                    id="toggle_embedding_key">Show</button>
-                            </div>
-                        </div>
-                        <div class="mb-3">
-                            <div id="embedding_models_list" class="mt-2 mb-3">
-
-                            </div>
-                            <small>Save pending changes to settings before clicking Fetch Embedding Models</small><br>
-
-                            <input type="hidden" name="embedding_model_json" id="embedding_model_json" />
-
-
-                            <input type="hidden" id="embedding_model" value="{{ settings.embedding_model.selected[0].deploymentName if settings.embedding_model.selected else '' }}" />
-
-
-                            <button type="button" class="btn btn-secondary" id="fetch_embedding_models_btn">
-                                Fetch Embedding Models
-                            </button>
-                        </div>
-                        <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
-                            data-bs-target="#advancedEmbeddingsFields" aria-expanded="false"
-                            aria-controls="advancedEmbeddingsFields">
-                            Show Advanced
-                        </a>
-                        <div class="collapse" id="advancedEmbeddingsFields">
-                            <div class="card card-body mt-2">
-                                <div class="mb-3">
-                                    <label for="azure_openai_embedding_api_version" class="form-label">
-                                        Azure OpenAI Embedding API Version
-                                    </label>
-                                    <input type="text" class="form-control" id="azure_openai_embedding_api_version"
-                                        name="azure_openai_embedding_api_version"
-                                        value="{{ settings.azure_openai_embedding_api_version or '' }}">
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div id="apim_embedding_settings" class="card p-3 mb-3" {% if not settings.enable_embedding_apim
-                    %}style="display: none;" {% endif %}>
-                    <div class="mb-3">
-                        <label for="azure_apim_embedding_endpoint" class="form-label">Azure APIM Endpoint</label>
-                        <input type="text" class="form-control" id="azure_apim_embedding_endpoint"
-                            name="azure_apim_embedding_endpoint"
-                            value="{{ settings.azure_apim_embedding_endpoint or '' }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="azure_apim_embedding_api_version" class="form-label">Azure APIM API Version</label>
-                        <input type="text" class="form-control" id="azure_apim_embedding_api_version"
-                            name="azure_apim_embedding_api_version"
-                            value="{{ settings.azure_apim_embedding_api_version or '' }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="azure_apim_embedding_deployment" class="form-label">Azure APIM Deployment</label>
-                        <input type="text" class="form-control" id="azure_apim_embedding_deployment"
-                            name="azure_apim_embedding_deployment"
-                            value="{{ settings.azure_apim_embedding_deployment or '' }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="azure_apim_embedding_subscription_key" class="form-label">Azure APIM Subscription
-                            Key</label>
-                        <div class="input-group">
-                            <input type="password" class="form-control" id="azure_apim_embedding_subscription_key"
-                                name="azure_apim_embedding_subscription_key"
-                                value="{{ settings.azure_apim_embedding_subscription_key or '' }}">
-                            <button type="button" class="btn btn-outline-secondary"
-                                id="toggle_azure_apim_embedding_subscription_key">Show</button>
-                        </div>
-                    </div>
-                </div>
-
-                <button type="button" class="btn btn-secondary mt-3" id="test_embedding_button">
-                    Test Embedding Connection
-                </button>
-                <div id="test_embedding_result" class="mt-2"></div>
-                </div>
-
-                <!-- Image Generation Configuration Section -->
-                <div class="card p-3 mb-4" id="image-generation-configuration">
-                    <h5 class="card-title">
-                        <i class="bi bi-image me-2"></i>Image Generation Configuration
-                    </h5>
-                    <p class="text-muted small">
-                        Configure image generation settings. Enable/disable, set endpoints, and choose a model.
-                    </p>
-                    <button type="button" class="btn btn-sm btn-outline-secondary mb-3 align-self-start" data-bs-toggle="modal" data-bs-target="#legacyModelDiscoveryIdentityGuideModal">
-                        <i class="bi bi-question-circle me-1"></i>Setup Guide
-                    </button>
-
-                <div class="form-group form-check form-switch mb-3">
-                    <input type="checkbox" class="form-check-input" id="enable_image_generation"
-                        name="enable_image_generation" {% if settings.enable_image_generation %}checked{% endif %}>
-                    <label class="form-check-label ms-2" for="enable_image_generation">
-                        Enable Image Generation
-                    </label>
-                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable AI-powered image generation capabilities using DALL-E models for creating images from text descriptions."></i>
-                </div>
-                <div id="image_gen_settings" {% if not settings.enable_image_generation %}style="display: none;" {%
-                    endif %}>
-
-                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                        <input type="checkbox" class="form-check-input me-2" id="enable_image_gen_apim"
-                            name="enable_image_gen_apim" {% if settings.enable_image_gen_apim %}checked{% endif %}>
-                        <label class="form-check-label" for="enable_image_gen_apim">Use APIM instead of direct to Azure
-                            OpenAI endpoint.</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route image generation requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
-                    </div>
-
-                    <div id="non_apim_image_gen_settings" {% if settings.enable_image_gen_apim %}style="display: none;"
-                        {% endif %}>
-                        <div class="card p-3 mb-3">
-                            <div class="mb-3">
-                                <label for="azure_openai_image_gen_endpoint" class="form-label">
-                                    Azure OpenAI Image Generation Endpoint
-                                </label>
-                                <input type="text" class="form-control" id="azure_openai_image_gen_endpoint"
-                                    name="azure_openai_image_gen_endpoint"
-                                    value="{{ settings.azure_openai_image_gen_endpoint or '' }}">
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_openai_image_gen_authentication_type" class="form-label">
-                                    Authentication Type
-                                </label>
-                                <select class="form-select" id="azure_openai_image_gen_authentication_type"
-                                    name="azure_openai_image_gen_authentication_type">
-                                    <option value="key" {% if settings.azure_openai_image_gen_authentication_type=='key'
-                                        %}selected{% endif %}>
-                                        Key
-                                    </option>
-                                    <option value="managed_identity" {% if
-                                        settings.azure_openai_image_gen_authentication_type=='managed_identity'
-                                        %}selected{% endif %}>
-                                        Managed Identity
-                                    </option>
-                                </select>
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_openai_image_gen_subscription_id" class="form-label">Subscription
-                                    ID</label>
-                                <input type="text" class="form-control" id="azure_openai_image_gen_subscription_id"
-                                    name="azure_openai_image_gen_subscription_id"
-                                    value="{{ settings.azure_openai_image_gen_subscription_id or '' }}">
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_openai_image_gen_resource_group" class="form-label">Resource
-                                    Group</label>
-                                <input type="text" class="form-control" id="azure_openai_image_gen_resource_group"
-                                    name="azure_openai_image_gen_resource_group"
-                                    value="{{ settings.azure_openai_image_gen_resource_group or '' }}">
-                            </div>
-                            <div class="mb-3" id="image_gen_key_container" {% if
-                                settings.azure_openai_image_gen_authentication_type !='key' %}style="display: none;" {%
-                                endif %}>
-                                <label for="azure_openai_image_gen_key" class="form-label">Azure OpenAI Image Generation
-                                    Key</label>
-                                <div class="input-group">
-                                    <input type="password" class="form-control" id="azure_openai_image_gen_key"
-                                        name="azure_openai_image_gen_key"
-                                        value="{{ settings.azure_openai_image_gen_key or '' }}">
-                                    <button type="button" class="btn btn-outline-secondary"
-                                        id="toggle_image_gen_key">Show</button>
-                                </div>
-                            </div>
-                            <div class="mb-3">
-                                <div id="image_models_list" class="mt-2 mb-3">
-
-                                </div>
-
-                                <small>Save pending changes to settings before clicking Fetch Image Generation Models</small><br>
-
-                                <input type="hidden" name="image_gen_model_json" id="image_gen_model_json" />
-
-
-                                <input type="hidden" id="image_gen_model" value="{{ settings.image_gen_model.selected[0].deploymentName if settings.image_gen_model.selected else '' }}" />
-
-
-                                <button type="button" class="btn btn-secondary" id="fetch_image_models_btn">
-                                    Fetch Image Generation Models
-                                </button>
-                            </div>
-                            <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
-                                data-bs-target="#advancedImageGenFields" aria-expanded="false"
-                                aria-controls="advancedImageGenFields">
-                                Show Advanced
-                            </a>
-                            <div class="collapse" id="advancedImageGenFields">
-                                <div class="card card-body mt-2">
-                                    <div class="mb-3">
-                                        <label for="azure_openai_image_gen_api_version" class="form-label">
-                                            Azure OpenAI Image Gen API Version
-                                        </label>
-                                        <input type="text" class="form-control" id="azure_openai_image_gen_api_version"
-                                            name="azure_openai_image_gen_api_version"
-                                            value="{{ settings.azure_openai_image_gen_api_version or '' }}">
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div id="apim_image_gen_settings" class="card p-3 mb-3" {% if not settings.enable_image_gen_apim
-                        %}style="display: none;" {% endif %}>
-                        <div class="mb-3">
-                            <label for="azure_apim_image_gen_endpoint" class="form-label">Azure APIM Endpoint</label>
-                            <input type="text" class="form-control" id="azure_apim_image_gen_endpoint"
-                                name="azure_apim_image_gen_endpoint"
-                                value="{{ settings.azure_apim_image_gen_endpoint or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_apim_image_gen_api_version" class="form-label">Azure APIM API
-                                Version</label>
-                            <input type="text" class="form-control" id="azure_apim_image_gen_api_version"
-                                name="azure_apim_image_gen_api_version"
-                                value="{{ settings.azure_apim_image_gen_api_version or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_apim_image_gen_deployment" class="form-label">Azure APIM
-                                Deployment</label>
-                            <input type="text" class="form-control" id="azure_apim_image_gen_deployment"
-                                name="azure_apim_image_gen_deployment"
-                                value="{{ settings.azure_apim_image_gen_deployment or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_apim_image_gen_subscription_key" class="form-label">Azure APIM
-                                Subscription Key</label>
-                            <div class="input-group">
-                                <input type="password" class="form-control" id="azure_apim_image_gen_subscription_key"
-                                    name="azure_apim_image_gen_subscription_key"
-                                    value="{{ settings.azure_apim_image_gen_subscription_key or '' }}">
-                                <button type="button" class="btn btn-outline-secondary"
-                                    id="toggle_azure_apim_image_gen_subscription_key">Show</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <button type="button" class="btn btn-secondary mt-3" id="test_image_button">
-                    Test Image Connection
-                </button>
-                <div id="test_image_result" class="mt-2"></div>
-                </div>
-
-                <div class="modal fade" id="legacyModelDiscoveryIdentityGuideModal" tabindex="-1" aria-labelledby="legacyModelDiscoveryIdentityGuideModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="legacyModelDiscoveryIdentityGuideModalLabel">Azure OpenAI Model Setup Guide</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-info" role="alert">
-                                    <strong>Fetch Models</strong> lists deployments through the Azure management plane. <strong>Test Connection</strong>, chat generation, file uploads, embedding generation, and image generation call the Azure OpenAI data plane. These paths can use different credentials and require different roles.
-                                </div>
-
-                                <h6>Credential purpose</h6>
-                                <div class="table-responsive mb-3">
-                                    <table class="table table-sm table-bordered align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th>Action</th>
-                                                <th>Plane</th>
-                                                <th>Credential used</th>
-                                                <th>Role or secret</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody>
-                                            <tr>
-                                                <td>Legacy GPT, embedding, or image <strong>Fetch Models</strong></td>
-                                                <td>Management plane</td>
-                                                <td>The SimpleChat app registration or service principal, such as the <code>-ar</code> Entra application created for the deployment.</td>
-                                                <td><code>Cognitive Services User</code> on the Azure OpenAI resource, or an equivalent role that can read deployments.</td>
-                                            </tr>
-                                            <tr>
-                                                <td>Global endpoint modal <strong>Fetch Models</strong></td>
-                                                <td>Management plane</td>
-                                                <td>The endpoint modal identity selected for discovery, such as managed identity or service principal.</td>
-                                                <td><code>Cognitive Services User</code> on the Azure OpenAI resource, or an equivalent role that can read deployments.</td>
-                                            </tr>
-                                            <tr>
-                                                <td>GPT, embedding, or image generation with Key authentication selected</td>
-                                                <td>Data plane</td>
-                                                <td>The Azure OpenAI key saved in this settings section.</td>
-                                                <td>Azure OpenAI resource key from <strong>Keys and Endpoint</strong>.</td>
-                                            </tr>
-                                            <tr>
-                                                <td>GPT, embedding, or image generation with Managed Identity selected</td>
-                                                <td>Data plane</td>
-                                                <td>The App Service managed identity, such as the <code>-app</code> managed identity.</td>
-                                                <td><code>Cognitive Services OpenAI User</code> on the Azure OpenAI resource.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-
-                                <h6>Where to get values</h6>
-                                <ol class="mb-3">
-                                    <li>Open the Azure OpenAI resource in the Azure portal.</li>
-                                    <li>Copy the endpoint from <strong>Resource Management</strong> &gt; <strong>Keys and Endpoint</strong>.</li>
-                                    <li>If using Key authentication for runtime calls, copy <strong>Key 1</strong> or <strong>Key 2</strong> from the same page.</li>
-                                    <li>Copy the subscription ID and resource group from the resource <strong>Overview</strong> page. These are required for <strong>Fetch Models</strong>.</li>
-                                    <li>If using APIM, use the APIM endpoint, deployment path or name, API version, and APIM subscription key instead of the direct Azure OpenAI key.</li>
-                                </ol>
-
-                                <h6>Recommended setup</h6>
-                                <ul class="mb-0">
-                                    <li>For key-backed legacy GPT, embeddings, or image generation, grant the SimpleChat service principal the management-plane role so admins can fetch model deployments, then store the Azure OpenAI key for data-plane generation.</li>
-                                    <li>For managed identity runtime, grant the App Service managed identity <code>Cognitive Services OpenAI User</code> for data-plane generation. If the same managed identity should also fetch deployments, grant it the management-plane discovery role too.</li>
-                                    <li>Fetch only discovers deployment names and model metadata. It does not prove that embedding or image generation inference will succeed; use <strong>Test Embedding Connection</strong> or <strong>Test Image Connection</strong> after selecting a deployment.</li>
-                                </ul>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                {% include '_multiendpoint_modal.html' %}
-
-                <!-- Legacy AI Models Modal -->
-                <div class="modal fade" id="legacyModelSettingsModal" tabindex="-1" aria-labelledby="legacyModelSettingsModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="legacyModelSettingsModalLabel">Legacy AI Model Configuration</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <!-- Chat Model Section -->
-                                <div class="card p-3 mb-4" id="gpt-configuration">
-                                    <h5 class="card-title">
-                                        <i class="bi bi-chat-text me-2"></i>Chat Model
-                                    </h5>
-                                    <p class="text-muted small">
-                                        Configure your Chat Model settings. These are used for generating AI text responses.
-                                    </p>
-                                    <button type="button" class="btn btn-sm btn-outline-secondary mb-3 align-self-start" data-bs-toggle="modal" data-bs-target="#legacyModelDiscoveryIdentityGuideModal">
-                                        <i class="bi bi-question-circle me-1"></i>Setup Guide
-                                    </button>
-
-                                <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                                    <input type="checkbox" class="form-check-input me-2" id="enable_gpt_apim" name="enable_gpt_apim" {%
-                                        if settings.enable_gpt_apim %}checked{% endif %}>
-                                    <label class="form-check-label" for="enable_gpt_apim">Use APIM instead of direct to Azure OpenAI
-                                        endpoint</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route GPT model requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="APIM provides an additional layer for security, monitoring, and rate limiting. When using APIM, you'll need to manually specify your model names and will not be able to fetch models automatically."></i>
-                                </div>
-
-                                <div id="non_apim_gpt_settings" {% if settings.enable_gpt_apim %}style="display: none;" {% endif %}>
-                                    <div class="card p-3 mb-3">
-                                        <div class="mb-3">
-                                            <label for="azure_openai_gpt_endpoint" class="form-label">
-                                                Azure OpenAI Endpoint
-                                            </label>
-                                            <input type="text" class="form-control" id="azure_openai_gpt_endpoint"
-                                                name="azure_openai_gpt_endpoint" value="{{ settings.azure_openai_gpt_endpoint or '' }}">
-                                        </div>
-                                        <div class="mb-3">
-                                            <label for="azure_openai_gpt_authentication_type" class="form-label">
-                                                Authentication Type
-                                            </label>
-                                            <select class="form-select" id="azure_openai_gpt_authentication_type"
-                                                name="azure_openai_gpt_authentication_type">
-                                                <option value="key" {% if settings.azure_openai_gpt_authentication_type=='key'
-                                                    %}selected{% endif %}>
-                                                    Key
-                                                </option>
-                                                <option value="managed_identity" {% if
-                                                    settings.azure_openai_gpt_authentication_type=='managed_identity' %}selected{% endif
-                                                    %}>
-                                                    Managed Identity
-                                                </option>
-                                            </select>
-                                        </div>
-                                        <div class="mb-3">
-                                            <label for="azure_openai_gpt_subscription_id" class="form-label">Subscription ID</label>
-                                            <input type="text" class="form-control" id="azure_openai_gpt_subscription_id"
-                                                name="azure_openai_gpt_subscription_id"
-                                                value="{{ settings.azure_openai_gpt_subscription_id or '' }}">
-                                        </div>
-                                        <div class="mb-3">
-                                            <label for="azure_openai_gpt_resource_group" class="form-label">Resource Group</label>
-                                            <input type="text" class="form-control" id="azure_openai_gpt_resource_group"
-                                                name="azure_openai_gpt_resource_group"
-                                                value="{{ settings.azure_openai_gpt_resource_group or '' }}">
-                                        </div>
-                                        <div class="mb-3" id="gpt_key_container" {% if settings.azure_openai_gpt_authentication_type
-                                            !='key' %}style="display: none;" {% endif %}>
-                                            <label for="azure_openai_gpt_key" class="form-label">Azure OpenAI GPT Key</label>
-                                            <div class="input-group">
-                                                <input type="password" class="form-control" id="azure_openai_gpt_key"
-                                                    name="azure_openai_gpt_key" value="{{ settings.azure_openai_gpt_key or '' }}">
-                                                <button type="button" class="btn btn-outline-secondary"
-                                                    id="toggle_gpt_key">Show</button>
-                                            </div>
-                                        </div>
-                                        <div class="mb-3">
-                                            <label for="gpt_model" class="form-label">Azure OpenAI Model Selection</label>
-                                            <br><small>Each selected model will be available in the Chat UI as an option for the User. You can select multiple models.</small>
-                                            <br><small>Save Pending Changes to settings before clicking Fetch Models</small>
-                                            <div id="gpt_models_list" class="mt-2 mb-3">
-
-                                            </div>
-
-                                            <small>Save pending changes to settings before clicking Fetch Models</small><br>
-
-                                            <input type="hidden" name="gpt_model_json" id="gpt_model_json" />
-
-
-                                            <input type="hidden" id="gpt_model" value="{{ settings.gpt_model.selected[0].deploymentName if settings.gpt_model.selected else '' }}" />
-
-                                            <button type="button" class="btn btn-secondary" id="fetch_gpt_models_btn">
-                                                Fetch Models
-                                            </button>
-                                        </div>
-                                        <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
-                                            data-bs-target="#advancedGptFields" aria-expanded="false" aria-controls="advancedGptFields">
-                                            Show Advanced
-                                        </a>
-                                        <div class="collapse" id="advancedGptFields">
-                                            <div class="card card-body mt-2">
-                                                <div class="mb-3">
-                                                    <label for="azure_openai_gpt_api_version" class="form-label">
-                                                        Azure OpenAI API Version
-                                                    </label>
-                                                    <input type="text" class="form-control" id="azure_openai_gpt_api_version"
-                                                        name="azure_openai_gpt_api_version"
-                                                        value="{{ settings.azure_openai_gpt_api_version or '' }}">
-                                                </div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-
-                                <div id="apim_gpt_settings" class="card p-3 mb-3" {% if not settings.enable_gpt_apim
-                                    %}style="display: none;" {% endif %}>
-                                    <div class="mb-3">
-                                        <label for="azure_apim_gpt_endpoint" class="form-label">Azure APIM Endpoint</label>
-                                        <input type="text" class="form-control" id="azure_apim_gpt_endpoint"
-                                            name="azure_apim_gpt_endpoint" value="{{ settings.azure_apim_gpt_endpoint or '' }}">
-                                    </div>
-                                    <div class="mb-3">
-                                        <label for="azure_apim_gpt_api_version" class="form-label">Azure APIM API Version</label>
-                                        <input type="text" class="form-control" id="azure_apim_gpt_api_version"
-                                            name="azure_apim_gpt_api_version" value="{{ settings.azure_apim_gpt_api_version or '' }}">
-                                    </div>
-                                    <div class="mb-3">
-                                        <label for="azure_apim_gpt_deployment" class="form-label">Azure APIM Deployment</label>
-                                        <br><small class="text-muted">Each model defined here will be available in the Chat UI as an option for the User. You can include multiple models seperated by a comma (example: gpt-4o, o-1, o-3).</small>
-                                        <br><small class="text-muted">NOTE: The APIM GPT Test is against the first model in the list.</small>
-                                        <input type="text" class="form-control" id="azure_apim_gpt_deployment"
-                                            name="azure_apim_gpt_deployment" value="{{ settings.azure_apim_gpt_deployment or '' }}">
-                                    </div>
-                                    <div class="mb-3">
-                                        <label for="azure_apim_gpt_subscription_key" class="form-label">Azure APIM Subscription
-                                            Key</label>
-                                        <div class="input-group">
-                                            <input type="password" class="form-control" id="azure_apim_gpt_subscription_key"
-                                                name="azure_apim_gpt_subscription_key"
-                                                value="{{ settings.azure_apim_gpt_subscription_key or '' }}">
-                                            <button type="button" class="btn btn-outline-secondary"
-                                                id="toggle_azure_apim_gpt_subscription_key">Show</button>
-                                        </div>
-                                    </div>
-                                </div>
-
-                                <button type="button" class="btn btn-secondary mt-3" id="test_gpt_button">
-                                    Test Connection
-                                </button>
-                                <div id="test_gpt_result" class="mt-2"></div>
-                                </div>
-
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </div>
-
-            <!-- Control Center Configuration Tab -->
-            <div class="tab-pane fade" id="control-center-config" role="tabpanel" aria-labelledby="control-center-config-tab">
-                <p class="text-muted">
-                    Configure Control Center access and permissions for administrators.
-                </p>
-
-                <div class="card p-4 mb-4 border-primary shadow-sm" id="control-center-auto-refresh-section">
-                    <div class="d-flex align-items-center justify-content-between mb-3">
-                        <div class="d-flex align-items-center">
-                            <div class="bg-primary text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
-                                <i class="bi bi-arrow-repeat fs-4"></i>
-                            </div>
-                            <div>
-                                <h4 class="mb-1">
-                                    <i class="bi bi-calendar-check me-2"></i>Automatic Data Refresh
-                                </h4>
-                                <p class="text-muted mb-0 small">Run the Control Center metrics refresh overnight on a daily timezone-aware schedule</p>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            role="switch"
-                            id="control_center_auto_refresh_enabled"
-                            name="control_center_auto_refresh_enabled"
-                            {% if settings.control_center_auto_refresh_enabled %}checked{% endif %}
-                        />
-                        <label class="form-check-label ms-2 fw-bold" for="control_center_auto_refresh_enabled">
-                            Enable Daily Control Center Refresh
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Automatically refresh cached Control Center metrics once per day. Execution timestamps are stored in UTC."></i>
-                    </div>
-
-                    <div id="control-center-auto-refresh-inputs" class="row g-3 {% if not settings.control_center_auto_refresh_enabled %}d-none{% endif %}">
-                        <div class="col-md-4">
-                            <label for="control_center_auto_refresh_time" class="form-label">
-                                Refresh Time ({{ settings.control_center_auto_refresh_timezone or 'America/New_York' }})
-                            </label>
-                            <input
-                                type="time"
-                                class="form-control"
-                                id="control_center_auto_refresh_time"
-                                name="control_center_auto_refresh_time"
-                                value="{{ settings.control_center_auto_refresh_time or '02:00' }}"
-                            />
-                            <input
-                                type="hidden"
-                                id="control_center_auto_refresh_timezone"
-                                name="control_center_auto_refresh_timezone"
-                                value="{{ settings.control_center_auto_refresh_timezone or 'America/New_York' }}"
-                            />
-                            <div class="form-text">
-                                Your browser timezone is <span id="control-center-auto-refresh-viewer-timezone">local time</span>.
-                            </div>
-                        </div>
-                        <div class="col-md-8">
-                            <label class="form-label">Next scheduled refresh:</label>
-                            <div
-                                id="control-center-auto-refresh-next-run"
-                                class="form-control-plaintext text-info fw-bold"
-                                data-next-run-utc="{{ settings.control_center_auto_refresh_next_run or '' }}"
-                            >
-                                {% if settings.control_center_auto_refresh_next_run %}
-                                    Loading local time...
-                                {% else %}
-                                    Will be calculated when saved
-                                {% endif %}
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <!-- Control Center Overview Card -->
-                <div class="card p-4 mb-4 border-success shadow-sm" id="control-center-overview-section">
-                    <div class="d-flex align-items-center justify-content-between mb-3">
-                        <div class="d-flex align-items-center">
-                            <div class="bg-success text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
-                                <i class="bi bi-speedometer2 fs-4"></i>
-                            </div>
-                            <div>
-                                <h4 class="mb-1">
-                                    <i class="bi bi-gear-wide-connected me-2"></i>Control Center Access
-                                </h4>
-                                <p class="text-muted mb-0 small">Manage who can access Control Center features and administrative tools</p>
-                            </div>
-                        </div>
-                        <button type="button" class="btn btn-outline-success btn-sm" data-bs-toggle="modal" data-bs-target="#controlCenterRolesInfoModal">
-                            <i class="bi bi-question-circle me-1"></i>Role Setup Guide
-                        </button>
-                    </div>
-
-                    <div class="alert alert-info mb-4">
-                        <i class="bi bi-info-circle-fill me-2"></i>
-                        <strong>About Control Center:</strong> The Control Center is a powerful administrative dashboard that provides user management, group oversight, public workspace control, and detailed activity monitoring. Use role-based access controls below to delegate administrative responsibilities.
-                    </div>
-
-                    <!-- ControlCenterAdmin Role -->
-                    <div class="mb-4">
-                        <div class="form-check form-switch mb-2">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="require_member_of_control_center_admin"
-                                name="require_member_of_control_center_admin"
-                                {% if settings.require_member_of_control_center_admin %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2 fw-bold" for="require_member_of_control_center_admin">
-                                <i class="bi bi-shield-fill-check me-1"></i> Require ControlCenterAdmin App Role
-                            </label>
-                        </div>
-                        <p class="text-muted small ms-4 ps-3 mb-2">
-                            Required app role value: <code>ControlCenterAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only users assigned this role can access the Control Center and all management features. Regular Admins will lose access.
-                        </p>
-                        <div class="ms-4 ps-3">
-                            <span class="badge bg-success-subtle text-success-emphasis me-2">
-                                <i class="bi bi-people-fill me-1"></i> User Management
-                            </span>
-                            <span class="badge bg-success-subtle text-success-emphasis me-2">
-                                <i class="bi bi-collection me-1"></i> Group Management
-                            </span>
-                            <span class="badge bg-success-subtle text-success-emphasis me-2">
-                                <i class="bi bi-folder2-open me-1"></i> Public Workspaces
-                            </span>
-                            <span class="badge bg-success-subtle text-success-emphasis">
-                                <i class="bi bi-clock-history me-1"></i> Activity Logs
-                            </span>
-                        </div>
-                    </div>
-
-                    <!-- ControlCenterDashboardReader Role -->
-                    <div class="mb-4">
-                        <div class="form-check form-switch mb-2">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="require_member_of_control_center_dashboard_reader"
-                                name="require_member_of_control_center_dashboard_reader"
-                                {% if settings.require_member_of_control_center_dashboard_reader %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2 fw-bold" for="require_member_of_control_center_dashboard_reader">
-                                <i class="bi bi-eye me-1"></i> Allow ControlCenterDashboardReader App Role
-                            </label>
-                        </div>
-                        <p class="text-muted small ms-4 ps-3 mb-2">
-                            Dashboard-only app role value: <code>ControlCenterDashboardReader</code>. Assign this role to users or groups in the Enterprise App before enabling dashboard-only access. Users assigned <code>ControlCenterAdmin</code> can also access the dashboard when Control Center app-role enforcement is enabled.
-                        </p>
-                        <div class="ms-4 ps-3">
-                            <span class="badge bg-info-subtle text-info-emphasis me-2">
-                                <i class="bi bi-speedometer2 me-1"></i> Dashboard Statistics
-                            </span>
-                            <span class="badge bg-info-subtle text-info-emphasis me-2">
-                                <i class="bi bi-graph-up me-1"></i> Activity Trends
-                            </span>
-                            <span class="badge bg-info-subtle text-info-emphasis">
-                                <i class="bi bi-bar-chart-line me-1"></i> Usage Metrics
-                            </span>
-                        </div>
-                    </div>
-
-                    <div class="alert alert-warning-subtle border-warning mb-3">
-                        <i class="bi bi-exclamation-triangle-fill me-2"></i>
-                        <strong>Important:</strong> Configure these roles in your identity provider (Entra ID). When role requirements are enabled, standard Admins without the specific roles will be denied access to Control Center features.
-                    </div>
-
-                    <!-- Best Practices -->
-                    <div class="border-top pt-3">
-                        <h5 class="mb-3">
-                            <i class="bi bi-lightbulb-fill me-2"></i>Best Practices
-                        </h5>
-                        <ul class="text-muted small">
-                            <li><code>ControlCenterAdmin</code>: Grant to IT administrators who need full control over users, groups, and workspaces</li>
-                            <li><code>ControlCenterDashboardReader</code>: Grant to managers, compliance officers, or stakeholders who need visibility into platform usage without administrative powers</li>
-                            <li><strong>Separation of Duties:</strong> Enable role requirements if you need to restrict Control Center access from general application admins</li>
-                            <li><strong>Audit Trail:</strong> All Control Center actions are logged in Activity Logs for compliance and security auditing</li>
-                        </ul>
-                    </div>
-                </div>
-            </div>
-
-            <div class="tab-pane fade" id="data-management" role="tabpanel" aria-labelledby="data-management-tab" data-testid="data-management-tab-pane" data-ignore-settings-change="true">
-                <div class="d-flex align-items-center justify-content-between gap-3 mb-2">
-                    <div>
-                        <h3 class="mb-1">Backup, Migrate &amp; Restore</h3>
-                        <p class="text-muted mb-0">Protect SimpleChat data, move selected workspaces to another environment, and stage restore decisions with guided checks.</p>
-                    </div>
-                    <button type="button" class="btn btn-secondary" id="data-management-save-settings-btn" disabled aria-disabled="true">
-                        <i class="bi bi-save me-1"></i>Saved
-                    </button>
-                </div>
-
-                <div class="alert alert-warning" id="data-management-operational-warning" role="alert">
-                    We suggest not running backups, restores, or migrations during your operational business hours. These jobs run inside the App Service environment and can affect application performance.
-                </div>
-
-                <div class="alert d-none" id="data-management-status" role="status" aria-live="polite"></div>
-
-                <div class="card p-4 mb-4 border-info shadow-sm" id="data-management-readiness-section">
-                    <div class="d-flex flex-column flex-xl-row justify-content-between gap-3 mb-3">
-                        <div>
-                            <h4 class="mb-1"><i class="bi bi-compass me-2"></i>Start Here</h4>
-                            <p class="text-muted mb-0 small">Use these checkpoints before running backup, migration, restore, or advanced repair actions.</p>
-                        </div>
-                        <button type="button" class="btn btn-outline-info align-self-start" data-bs-toggle="modal" data-bs-target="#data-management-setup-guide-modal">
-                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
-                        </button>
-                    </div>
-                    <div class="row g-3">
-                        <div class="col-xl-3 col-md-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <h5 class="h6 mb-2"><i class="bi bi-archive me-1"></i>Back up</h5>
-                                <p class="small text-muted mb-2">Configure dedicated storage, encryption, schedule, and backup scope before queueing jobs.</p>
-                                <button type="button" class="btn btn-link btn-sm p-0" data-bs-toggle="modal" data-bs-target="#data-management-backup-guide-modal">Backup setup details</button>
-                            </div>
-                        </div>
-                        <div class="col-xl-3 col-md-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <h5 class="h6 mb-2"><i class="bi bi-arrow-left-right me-1"></i>Migrate</h5>
-                                <p class="small text-muted mb-2">Connect a destination, choose who moves, run preflight, then execute a recoverable transfer.</p>
-                                <button type="button" class="btn btn-link btn-sm p-0" data-bs-toggle="modal" data-bs-target="#data-management-migration-guide-modal">Migration guide</button>
-                            </div>
-                        </div>
-                        <div class="col-xl-3 col-md-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <h5 class="h6 mb-2"><i class="bi bi-arrow-counterclockwise me-1"></i>Restore</h5>
-                                <p class="small text-muted mb-2">Review backup readiness and stage restore decisions from Backup Inventory.</p>
-                                <button type="button" class="btn btn-link btn-sm p-0" data-bs-toggle="modal" data-bs-target="#data-management-restore-guide-modal">Restore guide</button>
-                            </div>
-                        </div>
-                        <div class="col-xl-3 col-md-6">
-                            <div class="border rounded-3 p-3 h-100">
-                                <h5 class="h6 mb-2"><i class="bi bi-speedometer me-1"></i>RU Boost</h5>
-                                <p class="small text-muted mb-2">Temporarily raise eligible Cosmos capacity during approved backup or migration windows.</p>
-                                <button type="button" class="btn btn-link btn-sm p-0" data-bs-toggle="modal" data-bs-target="#data-management-ru-boost-guide-modal">RU Boost permissions</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-4 mb-4 border-primary shadow-sm" id="data-management-backup-section">
-                    <div class="d-flex align-items-center mb-3">
-                        <div class="bg-primary text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
-                            <i class="bi bi-archive fs-4"></i>
-                        </div>
-                        <div>
-                            <h4 class="mb-1">Backup</h4>
-                            <p class="text-muted mb-0 small">Configure when backups run, where artifacts are stored, and how backup files are encrypted.</p>
-                        </div>
-                    </div>
-
-                    <div class="card p-3 mb-3 border-primary-subtle" id="data-management-schedule-section">
-                        <div class="d-flex align-items-center justify-content-between mb-3">
-                            <div>
-                                <h5 class="mb-1">Schedule</h5>
-                                <p class="text-muted mb-0 small">Full backups run on the selected cadence; partial backups run daily only.</p>
-                            </div>
-                        </div>
-                        <div class="form-check form-switch mb-3">
-                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_enabled">
-                            <label class="form-check-label ms-2 fw-bold" for="data_management_enabled">Enable scheduled backups</label>
-                        </div>
-                        <div class="row g-3">
-                            <div class="col-md-4">
-                                <label class="form-label" for="data_management_full_frequency">Full backup frequency</label>
-                                <select class="form-select" id="data_management_full_frequency">
-                                    <option value="daily">Daily</option>
-                                    <option value="weekly">Weekly</option>
-                                    <option value="14_days">Every 14 days</option>
-                                    <option value="30_days">Every 30 days</option>
-                                </select>
-                            </div>
-                            <div class="col-md-4">
-                                <label class="form-label" for="data_management_scheduled_time_utc">Scheduled time (UTC)</label>
-                                <input class="form-control" type="time" id="data_management_scheduled_time_utc" value="03:00">
-                                <div class="form-text">Default is 03:00 UTC.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label class="form-label" for="data_management_retention_value">Delete backups after</label>
-                                <div class="input-group">
-                                    <input class="form-control" type="number" id="data_management_retention_value" min="1" max="3650" value="30" aria-describedby="data-management-retention-help">
-                                    <label class="visually-hidden" for="data_management_retention_unit">Retention unit</label>
-                                    <select class="form-select" id="data_management_retention_unit" aria-label="Retention unit">
-                                        <option value="days">Days</option>
-                                        <option value="weeks">Weeks</option>
-                                        <option value="months">Months</option>
-                                        <option value="years">Years</option>
-                                    </select>
-                                </div>
-                                <input type="hidden" id="data_management_retention_days" value="30">
-                                <div class="form-text" id="data-management-retention-help">Automatic cleanup keeps the newest successful full backup as a safety baseline.</div>
-                            </div>
-                        </div>
-                        <div class="row g-3 mt-1">
-                            <div class="col-md-6">
-                                <div class="form-check form-switch">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_partial_enabled" checked>
-                                    <label class="form-check-label" for="data_management_partial_enabled">Run partial backups daily between full backups</label>
-                                </div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_low_impact_mode" checked>
-                                    <label class="form-check-label" for="data_management_low_impact_mode">Use low impact mode for scheduled jobs</label>
-                                </div>
-                            </div>
-                        </div>
-                        <div class="mt-3">
-                            <button class="btn btn-outline-secondary btn-sm" type="button" data-bs-toggle="collapse" data-bs-target="#data-management-advanced-scope-drawer" aria-expanded="false" aria-controls="data-management-advanced-scope-drawer">
-                                <i class="bi bi-sliders me-1"></i>Advanced backup scope
-                            </button>
-                        </div>
-                        <div class="collapse mt-3" id="data-management-advanced-scope-drawer">
-                            <div class="card card-body border-warning-subtle bg-warning-subtle">
-                                <div class="alert alert-warning mb-3" role="alert">
-                                    <i class="bi bi-exclamation-triangle-fill me-2"></i>
-                                    These backup scope controls are advanced. Modify them at your own risk because excluding a surface can create backups that are incomplete for restore or migration scenarios.
-                                </div>
-                                <div class="row g-3">
-                                    <div class="col-md-4">
-                                        <div class="form-check form-switch">
-                                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_include_cosmos" checked aria-describedby="data-management-include-cosmos-help">
-                                            <label class="form-check-label" for="data_management_include_cosmos">
-                                                Include Cosmos DB data
-                                                <i class="bi bi-info-circle ms-1" data-bs-toggle="tooltip" title="Exports SimpleChat application records such as settings, users, workspaces, conversations, documents, agents, actions, prompts, and identities."></i>
-                                            </label>
-                                            <div class="form-text" id="data-management-include-cosmos-help">Core application records required for meaningful restore and migration.</div>
-                                        </div>
-                                    </div>
-                                    <div class="col-md-4">
-                                        <div class="form-check form-switch">
-                                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_include_ai_search" checked aria-describedby="data-management-include-ai-search-help">
-                                            <label class="form-check-label" for="data_management_include_ai_search">
-                                                Include AI Search indexes
-                                                <i class="bi bi-info-circle ms-1" data-bs-toggle="tooltip" title="Exports AI Search index schemas and retrievable documents for personal, group, and public search indexes."></i>
-                                            </label>
-                                            <div class="form-text" id="data-management-include-ai-search-help">Search index schemas and retrievable indexed documents.</div>
-                                        </div>
-                                    </div>
-                                    <div class="col-md-4">
-                                        <div class="form-check form-switch">
-                                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_include_source_blobs" aria-describedby="data-management-include-source-blobs-help data-management-source-blobs-lock-message">
-                                            <label class="form-check-label" for="data_management_include_source_blobs">
-                                                Include source document blobs
-                                                <i class="bi bi-info-circle ms-1" data-bs-toggle="tooltip" title="Copies original source files stored by Enhanced Citations. This is only available when Enhanced Citations is enabled."></i>
-                                            </label>
-                                            <div class="form-text" id="data-management-include-source-blobs-help">Original source files used by Enhanced Citations.</div>
-                                            <div class="form-text text-muted" id="data-management-source-blobs-lock-message"></div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="card p-3 mb-3 border-secondary-subtle" id="data-management-storage-section">
-                        <div class="d-flex align-items-center justify-content-between mb-3">
-                            <div>
-                                <h5 class="mb-1">Storage</h5>
-                                <p class="text-muted mb-0 small">Store backup artifacts in Azure Blob Storage.</p>
-                            </div>
-                            <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-test-storage-btn">
-                                <i class="bi bi-plug me-1"></i>Test Storage
-                            </button>
-                        </div>
-                        <div class="alert alert-info py-2 mb-3" id="data-management-storage-isolation-notice" role="note">
-                            <i class="bi bi-info-circle me-2"></i>
-                            Use a dedicated backup storage account. Data Management will reject storage that matches the Enhanced Citations connection string or Blob endpoint.
-                        </div>
-                        <div class="row g-3">
-                            <div class="col-md-4">
-                                <label class="form-label" for="data_management_storage_auth">Authentication</label>
-                                <select class="form-select" id="data_management_storage_auth">
-                                    <option value="managed_identity">Managed identity</option>
-                                    <option value="connection_string">Connection string</option>
-                                </select>
-                            </div>
-                            <div class="col-md-4" id="data-management-blob-endpoint-field">
-                                <label class="form-label" for="data_management_blob_endpoint">Blob endpoint</label>
-                                <input class="form-control" type="url" id="data_management_blob_endpoint" placeholder="https://account.blob.core.windows.net">
-                            </div>
-                            <div class="col-md-4">
-                                <label class="form-label" for="data_management_container_name">Container</label>
-                                <input class="form-control" type="text" id="data_management_container_name" value="simplechat-backups">
-                            </div>
-                        </div>
-                        <div class="row g-3 mt-1">
-                            <div class="col-md-8" id="data-management-connection-string-field">
-                                <label class="form-label" for="data_management_connection_string">Connection string</label>
-                                <input class="form-control" type="password" id="data_management_connection_string" autocomplete="off" placeholder="Paste a connection string to save or replace it" aria-describedby="data-management-connection-string-status">
-                                <div class="form-text" id="data-management-connection-string-status">No connection string saved yet.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label class="form-label" for="data_management_path_prefix">Blob prefix</label>
-                                <input class="form-control" type="text" id="data_management_path_prefix" value="simplechat-backups">
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="card p-3 border-info-subtle" id="data-management-encryption-section">
-                        <div class="d-flex align-items-center justify-content-between mb-3">
-                            <div>
-                                <h5 class="mb-1">Encryption</h5>
-                                <p class="text-muted mb-0 small">Generate a 256-bit backup encryption key.</p>
-                            </div>
-                            <button type="button" class="btn btn-outline-primary btn-sm" id="data-management-generate-key-btn">
-                                <i class="bi bi-key me-1"></i>Generate Key
-                            </button>
-                        </div>
-                        <div class="form-check form-switch mb-3">
-                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_encryption_enabled" checked>
-                            <label class="form-check-label" for="data_management_encryption_enabled">Encrypt backup artifacts</label>
-                        </div>
-                        <dl class="row mb-0">
-                            <dt class="col-sm-3">Key storage</dt>
-                            <dd class="col-sm-9" id="data-management-key-storage">Not configured</dd>
-                            <dt class="col-sm-3">Key reference</dt>
-                            <dd class="col-sm-9" id="data-management-key-reference">Not configured</dd>
-                        </dl>
-                        <div class="alert alert-warning d-flex align-items-start gap-2 mt-3 mb-0" id="data-management-key-storage-alert" role="status" aria-live="polite">
-                            <i class="bi bi-exclamation-triangle-fill mt-1" id="data-management-key-storage-alert-icon"></i>
-                            <div>
-                                <div class="fw-semibold" id="data-management-key-storage-alert-title">Key Vault is strongly recommended</div>
-                                <div class="small" id="data-management-key-storage-alert-message">Generated backup encryption keys are stored in the Data Management settings document when Key Vault is not enabled.</div>
-                                <a href="#security" id="data-management-key-vault-link">Open Key Vault settings</a>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="card p-3 mt-3 border-success-subtle" id="data-management-backup-performance-section">
-                        <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
-                            <div>
-                                <h5 class="mb-1">Cosmos Backup Performance</h5>
-                                <p class="text-muted mb-0 small">Backups stream deterministic checkpoint batches and commit only verified work. Higher concurrency can increase source Cosmos cost and pressure.</p>
-                            </div>
-                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#data-management-ru-boost-guide-modal">
-                                <i class="bi bi-info-circle me-1"></i>RU Boost Guide
-                            </button>
-                        </div>
-
-                        <div class="card p-3 mt-3 border-info-subtle" id="data-management-blob-backup-performance-section">
-                            <div class="mb-3">
-                                <h5 class="mb-1">Source Blob Backup Performance</h5>
-                                <p class="text-muted mb-0 small">Source files stream through bounded chunks and durable per-file checkpoints. Peak transfer buffering is bounded by concurrent transfers multiplied by chunk size.</p>
-                            </div>
-                            <div class="row g-3">
-                                <div class="col-md-4">
-                                    <label class="form-label" for="data_management_backup_blob_max_parallel_operations">Concurrent blob transfers</label>
-                                    <input class="form-control" type="number" id="data_management_backup_blob_max_parallel_operations" min="1" max="8" value="4" aria-describedby="data-management-backup-blob-memory-help">
-                                </div>
-                                <div class="col-md-4">
-                                    <label class="form-label" for="data_management_backup_blob_chunk_size_mib">Transfer chunk size (MiB)</label>
-                                    <input class="form-control" type="number" id="data_management_backup_blob_chunk_size_mib" min="1" max="16" value="8" aria-describedby="data-management-backup-blob-memory-help">
-                                </div>
-                                <div class="col-md-4">
-                                    <label class="form-label" for="data_management_backup_blob_retry_count">Blob retry attempts</label>
-                                    <input class="form-control" type="number" id="data_management_backup_blob_retry_count" min="1" max="10" value="5">
-                                </div>
-                            </div>
-                            <div class="form-text mt-2" id="data-management-backup-blob-memory-help">Defaults bound application transfer buffering to approximately 32 MiB, excluding Azure SDK overhead. Throttling temporarily reduces active transfers.</div>
-                        </div>
-                        <div class="row g-3">
-                            <div class="col-md-4">
-                                <label class="form-label" for="data_management_backup_max_parallel_operations">Concurrent batch staging</label>
-                                <input class="form-control" type="number" id="data_management_backup_max_parallel_operations" min="1" max="16" value="4">
-                            </div>
-                            <div class="col-md-4">
-                                <label class="form-label" for="data_management_backup_retry_count">Retry attempts</label>
-                                <input class="form-control" type="number" id="data_management_backup_retry_count" min="1" max="10" value="5">
-                            </div>
-                            <div class="col-md-4">
-                                <label class="form-label" for="data_management_backup_capacity_failure_policy">If source RU Boost is unavailable</label>
-                                <select class="form-select" id="data_management_backup_capacity_failure_policy">
-                                    <option value="continue_without_boost">Continue without boost</option>
-                                    <option value="fail">Fail before export</option>
-                                </select>
-                            </div>
-                        </div>
-                        <div class="form-check form-switch mt-3">
-                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_backup_temporary_source_ru_enabled">
-                            <label class="form-check-label" for="data_management_backup_temporary_source_ru_enabled">Enable source RU Boost for backups</label>
-                        </div>
-                        <div class="row g-3 mt-1" id="data-management-backup-temporary-ru-field">
-                            <div class="col-md-4">
-                                <label class="form-label" for="data_management_backup_temporary_source_ru">Source RU Boost target</label>
-                                <input class="form-control" type="number" id="data_management_backup_temporary_source_ru" min="1000" max="10000" step="1000" value="10000">
-                            </div>
-                            <div class="col-md-8 d-flex align-items-end">
-                                <div class="form-text mb-2">The backup records the current source capacity, raises only eligible targets up to 10,000 RU/s, and restores the original setting after completion, cancellation, failure, or recovery. This can increase Cosmos charges and requires source ARM throughput permission.</div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="card p-3 mt-3 border-success-subtle" id="data-management-backup-operations-section">
-                        <div class="d-flex flex-wrap justify-content-between align-items-start gap-3">
-                            <div>
-                                <h5 class="mb-1">Backup Operations</h5>
-                                <p class="text-muted mb-0 small">Queue immediate full or partial backup jobs using the settings above.</p>
-                            </div>
-                            <div class="d-flex flex-wrap gap-2">
-                                <button type="button" class="btn btn-primary" id="data-management-run-full-backup-btn">
-                                    <i class="bi bi-archive me-1"></i>Queue Full Backup
-                                </button>
-                                <button type="button" class="btn btn-outline-primary" id="data-management-run-partial-backup-btn">
-                                    <i class="bi bi-archive-fill me-1"></i>Queue Partial Backup
-                                </button>
-                            </div>
-                        </div>
-                        <p class="text-muted mb-0 mt-2">Jobs use Cosmos-backed leases so scaled-out App Service workers do not run the same backup twice.</p>
-                    </div>
-                </div>
-
-                <!--
-                    THESIS: Migration is an evidence-gated operation, not a long settings form; this flow refuses the three-column picker wall.
-                    OWN-WORLD: Restrained Bootstrap admin surfaces, slate neutrals, one blue action accent, and semantic amber/red/green states.
-                    STORY: Configure a destination, define exhaustive scope, choose transfer behavior, prove readiness, confirm risk, then operate the durable job.
-                    FIRST VIEWPORT: A compact six-step rail sits above one focused work area with the current task, evidence, and one next action.
-                    FORM: Established-world extension, ranked first as a control-room checkpoint flow; staging is one focused panel at a time.
-                -->
-                <section class="card p-0 mb-4 shadow-sm migration-workflow" id="data-management-migration-section" aria-labelledby="data-management-migration-title">
-                    <header class="migration-workflow-header">
-                        <div>
-                            <h4 class="mb-1" id="data-management-migration-title">
-                                <i class="bi bi-arrow-left-right me-2" aria-hidden="true"></i>Migration
-                            </h4>
-                            <p class="mb-0">Move SimpleChat data through a reviewed, recoverable environment transfer.</p>
-                        </div>
-                        <div class="migration-workflow-readiness" id="data-management-migration-readiness" role="status" aria-live="polite">
-                            <span class="migration-readiness-dot" aria-hidden="true"></span>
-                            <span>Not reviewed</span>
-                        </div>
-                    </header>
-
-                    <div class="migration-workflow-body" id="data-management-migration-workflow-section">
-                        <nav class="migration-stepper" aria-label="Migration workflow">
-                            <button type="button" class="migration-step is-active" data-migration-step-button="target" aria-current="step">
-                                <span class="migration-step-marker">1</span>
-                                <span class="migration-step-copy">
-                                    <span class="migration-step-label">Target</span>
-                                    <span class="migration-step-state">Configure services</span>
-                                </span>
-                            </button>
-                            <button type="button" class="migration-step" data-migration-step-button="scope">
-                                <span class="migration-step-marker">2</span>
-                                <span class="migration-step-copy">
-                                    <span class="migration-step-label">Scope</span>
-                                    <span class="migration-step-state">Choose principals</span>
-                                </span>
-                            </button>
-                            <button type="button" class="migration-step" data-migration-step-button="options">
-                                <span class="migration-step-marker">3</span>
-                                <span class="migration-step-copy">
-                                    <span class="migration-step-label">What Moves</span>
-                                    <span class="migration-step-state">Choose behavior</span>
-                                </span>
-                            </button>
-                            <button type="button" class="migration-step" data-migration-step-button="review">
-                                <span class="migration-step-marker">4</span>
-                                <span class="migration-step-copy">
-                                    <span class="migration-step-label">Review</span>
-                                    <span class="migration-step-state">Run preflight</span>
-                                </span>
-                            </button>
-                            <button type="button" class="migration-step" data-migration-step-button="confirm">
-                                <span class="migration-step-marker">5</span>
-                                <span class="migration-step-copy">
-                                    <span class="migration-step-label">Confirm</span>
-                                    <span class="migration-step-state">Authorize execution</span>
-                                </span>
-                            </button>
-                            <button type="button" class="migration-step" data-migration-step-button="progress">
-                                <span class="migration-step-marker">6</span>
-                                <span class="migration-step-copy">
-                                    <span class="migration-step-label">Progress</span>
-                                    <span class="migration-step-state">Operate the job</span>
-                                </span>
-                            </button>
-                        </nav>
-
-                        <div class="alert alert-danger d-none mt-3 mb-0" id="data-management-migration-step-error" role="alert" tabindex="-1"></div>
-
-                        <!-- Target Step -->
-                        <section class="migration-stage" data-migration-step-panel="target" aria-labelledby="data-management-migration-target-heading">
-                            <div class="migration-stage-heading">
-                                <div>
-                                    <h5 id="data-management-migration-target-heading">Connect the destination</h5>
-                                    <p>Configure the services this migration will write to. Stored credentials remain redacted.</p>
-                                </div>
-                                <span class="badge text-bg-light border">Destination database: SimpleChat</span>
-                            </div>
-
-                            <div class="migration-target-grid">
-                                <section class="migration-service-panel" id="data-management-target-cosmos-section" aria-labelledby="data-management-target-cosmos-heading">
-                                    <div class="migration-service-heading">
-                                        <div>
-                                            <h6 id="data-management-target-cosmos-heading"><i class="bi bi-database me-2" aria-hidden="true"></i>Target Cosmos Database</h6>
-                                            <p>Required for every migration.</p>
-                                        </div>
-                                        <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-test-target-cosmos-btn">
-                                            <i class="bi bi-plug me-1" aria-hidden="true"></i>Test Cosmos
-                                        </button>
-                                    </div>
-                                    <div class="alert alert-info small" role="note">
-                                        Managed identity requires Cosmos DB Data Contributor and target network access.
-                                    </div>
-                                    <div class="row g-3">
-                                        <div class="col-md-4">
-                                            <label class="form-label" for="data_management_target_cosmos_auth">Authentication</label>
-                                            <select class="form-select" id="data_management_target_cosmos_auth">
-                                                <option value="managed_identity">Managed identity</option>
-                                                <option value="key">Account key</option>
-                                            </select>
-                                        </div>
-                                        <div class="col-md-5">
-                                            <label class="form-label" for="data_management_target_cosmos_endpoint">Endpoint</label>
-                                            <input class="form-control" type="url" id="data_management_target_cosmos_endpoint" placeholder="https://account.documents.azure.com:443/" autocomplete="off">
-                                        </div>
-                                        <div class="col-md-3">
-                                            <label class="form-label" for="data_management_target_cosmos_database">Database</label>
-                                            <input class="form-control" type="text" id="data_management_target_cosmos_database" value="SimpleChat" readonly aria-readonly="true" aria-describedby="data-management-target-cosmos-database-help">
-                                            <div class="form-text" id="data-management-target-cosmos-database-help">Fixed app contract.</div>
-                                        </div>
-                                    </div>
-                                    <div class="mt-3" id="data-management-target-cosmos-key-field">
-                                        <label class="form-label" for="data_management_target_cosmos_key">Account key</label>
-                                        <input class="form-control" type="password" id="data_management_target_cosmos_key" autocomplete="off" placeholder="Stored keys stay redacted after save">
-                                    </div>
-                                </section>
-
-                                <section class="migration-service-panel" id="data-management-target-ai-search-section" aria-labelledby="data-management-target-search-heading">
-                                    <div class="migration-service-heading">
-                                        <div>
-                                            <h6 id="data-management-target-search-heading"><i class="bi bi-search me-2" aria-hidden="true"></i>Target Search</h6>
-                                            <p>Required when AI Search documents are included.</p>
-                                        </div>
-                                        <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-test-target-search-btn">
-                                            <i class="bi bi-plug me-1" aria-hidden="true"></i>Test Search
-                                        </button>
-                                    </div>
-                                    <div class="row g-3">
-                                        <div class="col-md-4">
-                                            <label class="form-label" for="data_management_target_ai_search_auth">Authentication</label>
-                                            <select class="form-select" id="data_management_target_ai_search_auth">
-                                                <option value="managed_identity">Managed identity</option>
-                                                <option value="key">Admin key</option>
-                                            </select>
-                                        </div>
-                                        <div class="col-md-5">
-                                            <label class="form-label" for="data_management_target_ai_search_endpoint">Endpoint</label>
-                                            <input class="form-control" type="url" id="data_management_target_ai_search_endpoint" placeholder="https://search-service.search.windows.net" autocomplete="off">
-                                        </div>
-                                        <div class="col-md-3" id="data-management-target-ai-search-key-field">
-                                            <label class="form-label" for="data_management_target_ai_search_key">Admin key</label>
-                                            <input class="form-control" type="password" id="data_management_target_ai_search_key" autocomplete="off" placeholder="Stored keys stay redacted after save">
-                                        </div>
-                                    </div>
-                                </section>
-
-                                <section class="migration-service-panel" id="data-management-target-enhanced-citations-section" aria-labelledby="data-management-target-storage-heading">
-                                    <div class="migration-service-heading">
-                                        <div>
-                                            <h6 id="data-management-target-storage-heading"><i class="bi bi-file-earmark-lock me-2" aria-hidden="true"></i>Target Enhanced Citation Storage</h6>
-                                            <p>Required only when source document blobs are included.</p>
-                                        </div>
-                                        <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-test-target-ec-storage-btn">
-                                            <i class="bi bi-plug me-1" aria-hidden="true"></i>Test Storage
-                                        </button>
-                                    </div>
-                                    <div class="row g-3">
-                                        <div class="col-md-4">
-                                            <label class="form-label" for="data_management_target_ec_storage_auth">Authentication</label>
-                                            <select class="form-select" id="data_management_target_ec_storage_auth">
-                                                <option value="managed_identity">Managed identity</option>
-                                                <option value="connection_string">Connection string</option>
-                                            </select>
-                                        </div>
-                                        <div class="col-md-5" id="data-management-target-ec-blob-endpoint-field">
-                                            <label class="form-label" for="data_management_target_ec_blob_endpoint">Blob endpoint</label>
-                                            <input class="form-control" type="url" id="data_management_target_ec_blob_endpoint" placeholder="https://account.blob.core.windows.net" autocomplete="off">
-                                        </div>
-                                        <div class="col-md-8" id="data-management-target-ec-connection-string-field">
-                                            <label class="form-label" for="data_management_target_ec_connection_string">Connection string</label>
-                                            <input class="form-control" type="password" id="data_management_target_ec_connection_string" autocomplete="off" placeholder="Paste a connection string to save or replace it">
-                                        </div>
-                                    </div>
-                                </section>
-                            </div>
-                        </section>
-
-                        <!-- Scope Step -->
-                        <section class="migration-stage d-none" data-migration-step-panel="scope" aria-labelledby="data-management-migration-scope-heading">
-                            <div class="migration-stage-heading">
-                                <div>
-                                    <h5 id="data-management-migration-scope-heading">Choose who and what moves</h5>
-                                    <p>Selections persist while you search and page. “All” always uses the exhaustive server count.</p>
-                                </div>
-                                <div class="migration-scope-total" id="data-management-migration-scope-total" aria-live="polite">0 principal scopes selected</div>
-                            </div>
-
-                            <div class="migration-scope-tabs" role="tablist" aria-label="Migration scope type">
-                                <button type="button" class="btn btn-outline-primary active" data-migration-scope-tab="users" role="tab" aria-selected="true">Users <span class="badge text-bg-light ms-1" data-migration-scope-count="users">0</span></button>
-                                <button type="button" class="btn btn-outline-primary" data-migration-scope-tab="groups" role="tab" aria-selected="false">Groups <span class="badge text-bg-light ms-1" data-migration-scope-count="groups">0</span></button>
-                                <button type="button" class="btn btn-outline-primary" data-migration-scope-tab="public_workspaces" role="tab" aria-selected="false">Public workspaces <span class="badge text-bg-light ms-1" data-migration-scope-count="public_workspaces">0</span></button>
-                            </div>
-
-                            <section class="migration-scope-pane" data-migration-scope-pane="users" role="tabpanel" aria-label="Users">
-                                <input type="hidden" id="data_management_migration_users_mode" value="none">
-                                <fieldset>
-                                    <legend class="h6">Migration mode</legend>
-                                    <div class="migration-mode-options">
-                                        <label class="migration-mode-option">
-                                            <input type="radio" name="data_management_migration_users_mode_choice" value="none" data-migration-mode-option="users" checked>
-                                            <span><strong>None</strong><small>Skip users</small></span>
-                                        </label>
-                                        <label class="migration-mode-option">
-                                            <input type="radio" name="data_management_migration_users_mode_choice" value="selected" data-migration-mode-option="users">
-                                            <span><strong>Selected</strong><small>Choose across pages</small></span>
-                                        </label>
-                                        <label class="migration-mode-option">
-                                            <input type="radio" name="data_management_migration_users_mode_choice" value="all" data-migration-mode-option="users">
-                                            <span><strong>All</strong><small>Use exhaustive count</small></span>
-                                        </label>
-                                    </div>
-                                </fieldset>
-
-                                <div class="migration-catalog-workspace d-none" data-migration-catalog-workspace="users">
-                                    <div class="migration-catalog-column">
-                                        <div class="d-flex flex-wrap justify-content-between align-items-end gap-2 mb-2">
-                                            <div>
-                                                <h6 class="mb-1">Available users</h6>
-                                                <p class="small text-muted mb-0" data-migration-catalog-status="users">Search the server catalog.</p>
-                                            </div>
-                                            <div class="input-group input-group-sm migration-catalog-search">
-                                                <label class="visually-hidden" for="data_management_migration_users_search">Search users</label>
-                                                <input type="search" class="form-control" id="data_management_migration_users_search" placeholder="Search users" autocomplete="off">
-                                                <button type="button" class="btn btn-outline-secondary" id="data-management-search-users-btn">Search</button>
-                                            </div>
-                                        </div>
-                                        <div class="migration-catalog-list list-group" id="data-management-migration-users-available" aria-live="polite"></div>
-                                        <div class="migration-catalog-pagination">
-                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-previous="users" disabled>
-                                                <i class="bi bi-chevron-left me-1" aria-hidden="true"></i>Previous
-                                            </button>
-                                            <span class="small text-muted" data-migration-page-status="users">Page 1</span>
-                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-next="users" disabled>
-                                                Next<i class="bi bi-chevron-right ms-1" aria-hidden="true"></i>
-                                            </button>
-                                        </div>
-                                    </div>
-                                    <aside class="migration-selection-column" aria-label="Selected users">
-                                        <div class="d-flex justify-content-between align-items-center mb-2">
-                                            <h6 class="mb-0">Selected</h6>
-                                            <span class="badge text-bg-primary" data-migration-selected-count="users">0</span>
-                                        </div>
-                                        <div class="migration-selected-list list-group" id="data-management-migration-users-selected"></div>
-                                    </aside>
-                                </div>
-
-                                <div class="migration-all-summary d-none" data-migration-all-summary="users" role="status">
-                                    <i class="bi bi-collection-fill" aria-hidden="true"></i>
-                                    <div>
-                                        <strong data-migration-all-count="users">Loading exhaustive count…</strong>
-                                        <span>Every current user record will be resolved by the server when the job starts.</span>
-                                    </div>
-                                </div>
-
-                                <div class="form-check form-switch mt-3">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_users_documents" disabled>
-                                    <label class="form-check-label" for="data_management_migration_users_documents">Include users' documents</label>
-                                </div>
-                            </section>
-
-                            <section class="migration-scope-pane d-none" data-migration-scope-pane="groups" role="tabpanel" aria-label="Groups">
-                                <input type="hidden" id="data_management_migration_groups_mode" value="none">
-                                <fieldset>
-                                    <legend class="h6">Migration mode</legend>
-                                    <div class="migration-mode-options">
-                                        <label class="migration-mode-option">
-                                            <input type="radio" name="data_management_migration_groups_mode_choice" value="none" data-migration-mode-option="groups" checked>
-                                            <span><strong>None</strong><small>Skip groups</small></span>
-                                        </label>
-                                        <label class="migration-mode-option">
-                                            <input type="radio" name="data_management_migration_groups_mode_choice" value="selected" data-migration-mode-option="groups">
-                                            <span><strong>Selected</strong><small>Choose across pages</small></span>
-                                        </label>
-                                        <label class="migration-mode-option">
-                                            <input type="radio" name="data_management_migration_groups_mode_choice" value="all" data-migration-mode-option="groups">
-                                            <span><strong>All</strong><small>Use exhaustive count</small></span>
-                                        </label>
-                                    </div>
-                                </fieldset>
-                                <div class="migration-catalog-workspace d-none" data-migration-catalog-workspace="groups">
-                                    <div class="migration-catalog-column">
-                                        <div class="d-flex flex-wrap justify-content-between align-items-end gap-2 mb-2">
-                                            <div>
-                                                <h6 class="mb-1">Available groups</h6>
-                                                <p class="small text-muted mb-0" data-migration-catalog-status="groups">Search the server catalog.</p>
-                                            </div>
-                                            <div class="input-group input-group-sm migration-catalog-search">
-                                                <label class="visually-hidden" for="data_management_migration_groups_search">Search groups</label>
-                                                <input type="search" class="form-control" id="data_management_migration_groups_search" placeholder="Search groups" autocomplete="off">
-                                                <button type="button" class="btn btn-outline-secondary" id="data-management-search-groups-btn">Search</button>
-                                            </div>
-                                        </div>
-                                        <div class="migration-catalog-list list-group" id="data-management-migration-groups-available" aria-live="polite"></div>
-                                        <div class="migration-catalog-pagination">
-                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-previous="groups" disabled><i class="bi bi-chevron-left me-1" aria-hidden="true"></i>Previous</button>
-                                            <span class="small text-muted" data-migration-page-status="groups">Page 1</span>
-                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-next="groups" disabled>Next<i class="bi bi-chevron-right ms-1" aria-hidden="true"></i></button>
-                                        </div>
-                                    </div>
-                                    <aside class="migration-selection-column" aria-label="Selected groups">
-                                        <div class="d-flex justify-content-between align-items-center mb-2">
-                                            <h6 class="mb-0">Selected</h6>
-                                            <span class="badge text-bg-primary" data-migration-selected-count="groups">0</span>
-                                        </div>
-                                        <div class="migration-selected-list list-group" id="data-management-migration-groups-selected"></div>
-                                    </aside>
-                                </div>
-                                <div class="migration-all-summary d-none" data-migration-all-summary="groups" role="status">
-                                    <i class="bi bi-collection-fill" aria-hidden="true"></i>
-                                    <div>
-                                        <strong data-migration-all-count="groups">Loading exhaustive count…</strong>
-                                        <span>Every current group record will be resolved by the server when the job starts.</span>
-                                    </div>
-                                </div>
-                                <div class="form-check form-switch mt-3">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_groups_documents" disabled>
-                                    <label class="form-check-label" for="data_management_migration_groups_documents">Include group documents</label>
-                                </div>
-                            </section>
-
-                            <section class="migration-scope-pane d-none" data-migration-scope-pane="public_workspaces" role="tabpanel" aria-label="Public Workspaces">
-                                <input type="hidden" id="data_management_migration_public_workspaces_mode" value="none">
-                                <fieldset>
-                                    <legend class="h6">Migration mode</legend>
-                                    <div class="migration-mode-options">
-                                        <label class="migration-mode-option">
-                                            <input type="radio" name="data_management_migration_public_workspaces_mode_choice" value="none" data-migration-mode-option="public_workspaces" checked>
-                                            <span><strong>None</strong><small>Skip public workspaces</small></span>
-                                        </label>
-                                        <label class="migration-mode-option">
-                                            <input type="radio" name="data_management_migration_public_workspaces_mode_choice" value="selected" data-migration-mode-option="public_workspaces">
-                                            <span><strong>Selected</strong><small>Choose across pages</small></span>
-                                        </label>
-                                        <label class="migration-mode-option">
-                                            <input type="radio" name="data_management_migration_public_workspaces_mode_choice" value="all" data-migration-mode-option="public_workspaces">
-                                            <span><strong>All</strong><small>Use exhaustive count</small></span>
-                                        </label>
-                                    </div>
-                                </fieldset>
-                                <div class="migration-catalog-workspace d-none" data-migration-catalog-workspace="public_workspaces">
-                                    <div class="migration-catalog-column">
-                                        <div class="d-flex flex-wrap justify-content-between align-items-end gap-2 mb-2">
-                                            <div>
-                                                <h6 class="mb-1">Available public workspaces</h6>
-                                                <p class="small text-muted mb-0" data-migration-catalog-status="public_workspaces">Search the server catalog.</p>
-                                            </div>
-                                            <div class="input-group input-group-sm migration-catalog-search">
-                                                <label class="visually-hidden" for="data_management_migration_public_workspaces_search">Search public workspaces</label>
-                                                <input type="search" class="form-control" id="data_management_migration_public_workspaces_search" placeholder="Search public workspaces" autocomplete="off">
-                                                <button type="button" class="btn btn-outline-secondary" id="data-management-search-public-workspaces-btn">Search</button>
-                                            </div>
-                                        </div>
-                                        <div class="migration-catalog-list list-group" id="data-management-migration-public-workspaces-available" aria-live="polite"></div>
-                                        <div class="migration-catalog-pagination">
-                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-previous="public_workspaces" disabled><i class="bi bi-chevron-left me-1" aria-hidden="true"></i>Previous</button>
-                                            <span class="small text-muted" data-migration-page-status="public_workspaces">Page 1</span>
-                                            <button type="button" class="btn btn-outline-secondary btn-sm" data-migration-page-next="public_workspaces" disabled>Next<i class="bi bi-chevron-right ms-1" aria-hidden="true"></i></button>
-                                        </div>
-                                    </div>
-                                    <aside class="migration-selection-column" aria-label="Selected public workspaces">
-                                        <div class="d-flex justify-content-between align-items-center mb-2">
-                                            <h6 class="mb-0">Selected</h6>
-                                            <span class="badge text-bg-primary" data-migration-selected-count="public_workspaces">0</span>
-                                        </div>
-                                        <div class="migration-selected-list list-group" id="data-management-migration-public-workspaces-selected"></div>
-                                    </aside>
-                                </div>
-                                <div class="migration-all-summary d-none" data-migration-all-summary="public_workspaces" role="status">
-                                    <i class="bi bi-collection-fill" aria-hidden="true"></i>
-                                    <div>
-                                        <strong data-migration-all-count="public_workspaces">Loading exhaustive count…</strong>
-                                        <span>Every current public workspace record will be resolved by the server when the job starts.</span>
-                                    </div>
-                                </div>
-                                <div class="form-check form-switch mt-3">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_public_workspaces_documents" disabled>
-                                    <label class="form-check-label" for="data_management_migration_public_workspaces_documents">Include public workspace documents</label>
-                                </div>
-                            </section>
-                        </section>
-
-                        <!-- Content and Options Step -->
-                        <section class="migration-stage d-none" data-migration-step-panel="options" aria-labelledby="data-management-migration-options-heading">
-                            <div class="migration-stage-heading">
-                                <div>
-                                    <h5 id="data-management-migration-options-heading">Choose what happens at the destination</h5>
-                                    <p>Choose whether to copy only missing items, catch up changes, or make migrated destination data match the source.</p>
-                                </div>
-                            </div>
-
-                            <fieldset class="migration-option-section" id="data-management-migration-mode-section">
-                                <legend>Destination behavior</legend>
-                                <div class="btn-group flex-wrap" role="radiogroup" aria-label="Migration destination behavior">
-                                    <input class="btn-check" type="radio" name="data_management_migration_mode" id="data_management_migration_mode_new_only" value="new_only" checked>
-                                    <label class="btn btn-outline-primary" for="data_management_migration_mode_new_only">Copy missing items only</label>
-                                    <input class="btn-check" type="radio" name="data_management_migration_mode" id="data_management_migration_mode_delta_upsert" value="delta_upsert">
-                                    <label class="btn btn-outline-primary" for="data_management_migration_mode_delta_upsert">Catch up changed items</label>
-                                    <input class="btn-check" type="radio" name="data_management_migration_mode" id="data_management_migration_mode_mirror_with_deletions" value="mirror_with_deletions">
-                                    <label class="btn btn-outline-danger" for="data_management_migration_mode_mirror_with_deletions">Make destination match source</label>
-                                </div>
-                                <p class="text-muted small mt-2 mb-0" id="data-management-migration-mode-description" aria-live="polite">
-                                    Copies source items that are absent from the destination. Existing destination data is never updated or deleted.
-                                </p>
-                                <div class="row g-3 mt-1 d-none" id="data-management-migration-baseline-field">
-                                    <div class="col-lg-7">
-                                        <label class="form-label" for="data_management_migration_baseline_job_id">Previous completed migration job ID</label>
-                                        <input class="form-control" type="text" id="data_management_migration_baseline_job_id" autocomplete="off" placeholder="Leave blank to use the latest compatible completed migration">
-                                        <div class="form-text">Leave blank to let SimpleChat choose the latest compatible completed migration as the starting point for this catch-up run.</div>
-                                    </div>
-                                </div>
-                            </fieldset>
-
-                            <fieldset class="migration-option-section">
-                                <legend>Data surfaces</legend>
-                                <div class="row g-3">
-                                    <div class="col-lg-6">
-                                        <div class="form-check form-switch">
-                                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_include_ai_search" checked>
-                                            <label class="form-check-label" for="data_management_migration_include_ai_search">Migrate matching AI Search documents</label>
-                                        </div>
-                                        <div class="form-check mt-3" id="data-management-migration-search-write-freeze">
-                                            <input class="form-check-input" type="checkbox" id="data_management_migration_target_search_writes_frozen">
-                                            <label class="form-check-label" for="data_management_migration_target_search_writes_frozen">I confirm external destination AI Search writers are frozen</label>
-                                            <div class="form-text">SimpleChat pauses its own target indexing. Freeze other writers before review.</div>
-                                        </div>
-                                    </div>
-                                    <div class="col-lg-6">
-                                        <div class="form-check form-switch">
-                                            <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_include_source_blobs">
-                                            <label class="form-check-label" for="data_management_migration_include_source_blobs">Migrate selected source document blobs</label>
-                                            <div class="form-text">Requires Enhanced Citation storage at both source and destination.</div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </fieldset>
-
-                            <fieldset class="migration-option-section" id="data-management-migration-performance-section">
-                                <legend>Performance and resume</legend>
-                                <p class="text-muted small">Migration uses durable resource checkpoints and retains the same migration ID after Retry or Resume.</p>
-                                <div class="row g-3">
-                                    <div class="col-md-4">
-                                        <label class="form-label" for="data_management_migration_max_parallel_operations">Concurrent operations</label>
-                                        <input class="form-control" type="number" id="data_management_migration_max_parallel_operations" min="1" max="32" value="8">
-                                    </div>
-                                    <div class="col-md-4">
-                                        <label class="form-label" for="data_management_migration_retry_count">Retry attempts</label>
-                                        <input class="form-control" type="number" id="data_management_migration_retry_count" min="1" max="10" value="5">
-                                    </div>
-                                    <div class="col-md-4">
-                                        <label class="form-label" for="data_management_migration_skip_recent_within_hours">Skip prior successes within hours</label>
-                                        <input class="form-control" type="number" id="data_management_migration_skip_recent_within_hours" min="0" max="8760" value="0">
-                                    </div>
-                                </div>
-                                <div class="form-check form-switch mt-3">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="data_management_migration_temporary_destination_ru_enabled">
-                                    <label class="form-check-label" for="data_management_migration_temporary_destination_ru_enabled">Enable destination RU Boost for this migration</label>
-                                    <button type="button" class="btn btn-outline-info btn-sm ms-2" data-bs-toggle="modal" data-bs-target="#data-management-ru-boost-guide-modal">
-                                        <i class="bi bi-info-circle me-1"></i>What permissions are needed?
-                                    </button>
-                                </div>
-                                <div class="row g-3 mt-1" id="data-management-migration-temporary-ru-field">
-                                    <div class="col-md-3">
-                                        <label class="form-label" for="data_management_migration_temporary_destination_ru">Destination RU Boost target</label>
-                                        <input class="form-control" type="number" id="data_management_migration_temporary_destination_ru" min="1000" max="10000" step="1000" value="10000">
-                                    </div>
-                                    <div class="col-md-3">
-                                        <label class="form-label" for="data_management_target_cosmos_subscription_id">Subscription ID</label>
-                                        <input class="form-control" type="text" id="data_management_target_cosmos_subscription_id" autocomplete="off" placeholder="Required for RU Boost">
-                                    </div>
-                                    <div class="col-md-3">
-                                        <label class="form-label" for="data_management_target_cosmos_resource_group">Resource group</label>
-                                        <input class="form-control" type="text" id="data_management_target_cosmos_resource_group" autocomplete="off" placeholder="Required for RU Boost">
-                                    </div>
-                                    <div class="col-md-3 d-flex align-items-end">
-                                        <button type="button" class="btn btn-outline-secondary w-100" id="data-management-test-target-cosmos-ru-boost-btn">
-                                            <i class="bi bi-speedometer me-1" aria-hidden="true"></i>Test RU Boost
-                                        </button>
-                                    </div>
-                                    <div class="col-12">
-                                        <div class="form-text">RU Boost validates Azure management-plane throughput permissions separately from Cosmos data-copy access. Eligible capacity is raised only up to 10,000 RU/s during execution and restored after completion or failure.</div>
-                                    </div>
-                                </div>
-                            </fieldset>
-                        </section>
-
-                        <!-- Review Step -->
-                        <section class="migration-stage d-none" data-migration-step-panel="review" aria-labelledby="data-management-migration-review-heading">
-                            <div class="migration-stage-heading">
-                                <div>
-                                    <h5 id="data-management-migration-review-heading">Prove the plan is ready</h5>
-                                    <p>Preflight runs server-owned access probes and inventory. Any earlier change makes this review stale.</p>
-                                </div>
-                                <div class="d-flex flex-wrap gap-2">
-                                    <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-test-migration-access-btn">
-                                        <i class="bi bi-shield-check me-1" aria-hidden="true"></i>Validate Cosmos Access
-                                    </button>
-                                    <button type="button" class="btn btn-primary" id="data-management-migration-preview-btn">
-                                        <i class="bi bi-clipboard2-check me-1" aria-hidden="true"></i>Run Preflight Review
-                                    </button>
-                                </div>
-                            </div>
-                            <div class="migration-review-empty" id="data-management-migration-review-empty">
-                                <i class="bi bi-clipboard2-pulse" aria-hidden="true"></i>
-                                <div>
-                                    <strong>Review has not run.</strong>
-                                    <span>Run preflight to verify target access, counts, collisions, locks, and capacity policy.</span>
-                                </div>
-                            </div>
-                            <div class="d-none" id="data-management-migration-summary" aria-live="polite"></div>
-                            <div class="d-none" id="data-management-migration-review-checks"></div>
-                            <button type="button" class="btn btn-link btn-sm px-0 mt-3 d-none" id="data-management-refresh-migration-summary-btn">
-                                <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh review
-                            </button>
-                        </section>
-
-                        <!-- Confirm Step -->
-                        <section class="migration-stage d-none" data-migration-step-panel="confirm" aria-labelledby="data-management-migration-confirm-heading">
-                            <div class="migration-stage-heading">
-                                <div>
-                                    <h5 id="data-management-migration-confirm-heading">Confirm execution</h5>
-                                    <p>Review the final server-normalized plan. Submission is guarded against duplicate requests.</p>
-                                </div>
-                            </div>
-                            <div class="migration-confirm-summary" id="data-management-migration-confirm-summary">
-                                <p class="text-muted mb-0">Complete preflight review before confirmation.</p>
-                            </div>
-                            <div class="alert alert-danger mt-3 mb-0 d-none" id="data-management-migration-mirror-confirmation" role="alert">
-                                <strong>Destructive destination cleanup.</strong> Only destination items previously created by SimpleChat migration may be deleted. Unowned destination data is retained and reported as a conflict.
-                                <label class="form-label mt-3" for="data_management_migration_mirror_confirmation_phrase">Type <code>MAKE DESTINATION MATCH SOURCE</code> to authorize this run</label>
-                                <input class="form-control" type="text" id="data_management_migration_mirror_confirmation_phrase" autocomplete="off">
-                            </div>
-                            <div class="form-check mt-3">
-                                <input class="form-check-input" type="checkbox" id="data_management_migration_final_confirmation">
-                                <label class="form-check-label" for="data_management_migration_final_confirmation">I reviewed the normalized plan, destination checks, warnings, and operational impact.</label>
-                            </div>
-                            <button type="button" class="btn btn-warning mt-3" id="data-management-execute-migration-btn" disabled aria-disabled="true">
-                                <i class="bi bi-arrow-left-right me-1" aria-hidden="true"></i>Execute Migration
-                            </button>
-                        </section>
-
-                        <!-- Progress Step -->
-                        <section class="migration-stage d-none" data-migration-step-panel="progress" aria-labelledby="data-management-migration-progress-heading">
-                            <div class="migration-stage-heading">
-                                <div>
-                                    <h5 id="data-management-migration-progress-heading">Operate the migration</h5>
-                                    <p>Progress comes from the durable job record. Cancel, Retry, and Resume retain verified checkpoints.</p>
-                                </div>
-                                <div class="d-flex flex-wrap gap-2">
-                                    <button type="button" class="btn btn-outline-primary btn-sm d-none" id="data-management-migration-start-new-btn">
-                                        <i class="bi bi-plus-circle me-1" aria-hidden="true"></i>Start new migration
-                                    </button>
-                                    <button type="button" class="btn btn-outline-secondary btn-sm d-none" id="data-management-migration-view-job-btn">
-                                        <i class="bi bi-list-check me-1" aria-hidden="true"></i>View full job log
-                                    </button>
-                                </div>
-                            </div>
-                            <div class="migration-progress-empty" id="data-management-migration-progress-empty">
-                                <i class="bi bi-hourglass-split" aria-hidden="true"></i>
-                                <div>
-                                    <strong>No migration is attached to this workflow yet.</strong>
-                                    <span>After execution, this stage follows the queued job and exposes its recovery actions.</span>
-                                </div>
-                            </div>
-                            <div class="d-none" id="data-management-migration-workflow-progress">
-                                <div id="data-management-migration-workflow-progress-summary"></div>
-                                <div id="data-management-migration-workflow-progress-state"></div>
-                                <div class="d-flex flex-wrap gap-2 mt-3" id="data-management-migration-workflow-progress-actions"></div>
-                            </div>
-                        </section>
-
-                        <footer class="migration-workflow-footer">
-                            <div>
-                                <button type="button" class="btn btn-outline-secondary" id="data-management-migration-back-btn" disabled>
-                                    <i class="bi bi-arrow-left me-1" aria-hidden="true"></i>Back
-                                </button>
-                                <button type="button" class="btn btn-primary" id="data-management-migration-next-btn">
-                                    Continue to Scope<i class="bi bi-arrow-right ms-1" aria-hidden="true"></i>
-                                </button>
-                            </div>
-                            <span class="small text-muted" id="data-management-migration-step-position">Step 1 of 6</span>
-                        </footer>
-                    </div>
-                </section>
-
-                <div class="card p-4 mb-4 border-danger shadow-sm" id="data-management-cosmos-editor-section" data-ignore-data-management-change="true">
-                    <div class="d-flex flex-wrap align-items-start justify-content-between gap-3 mb-3">
-                        <div>
-                            <h4 class="mb-1"><i class="bi bi-database-exclamation me-2"></i>Cosmos DB JSON Editor</h4>
-                            <p class="text-muted mb-0 small">Query SimpleChat Cosmos DB containers, inspect one document, and save JSON changes with ETag protection.</p>
-                        </div>
-                        <button type="button" class="btn btn-danger" id="data-management-cosmos-editor-open-danger-btn">
-                            <i class="bi bi-unlock me-1"></i>Unlock Editor
-                        </button>
-                    </div>
-                    <div class="alert alert-danger mb-3" role="alert">
-                        This tool can modify production Cosmos DB documents directly. Use it only for targeted admin repair or investigation after you understand the impact.
-                    </div>
-                    <div class="alert alert-warning mb-3" id="data-management-cosmos-editor-locked-message" role="status">
-                        The Cosmos DB JSON editor is locked. Acknowledge the danger prompt before querying or editing data.
-                    </div>
-                    <div class="d-none" id="data-management-cosmos-editor-workspace">
-                        <div class="row g-3">
-                            <div class="col-lg-4">
-                                <label class="form-label" for="data_management_cosmos_editor_container">Container</label>
-                                <select class="form-select" id="data_management_cosmos_editor_container">
-                                    <option value="">Loading containers...</option>
-                                </select>
-                                <div class="form-text" id="data-management-cosmos-editor-container-help">Choose a known SimpleChat Cosmos DB container.</div>
-                            </div>
-                            <div class="col-lg-2">
-                                <label class="form-label" for="data_management_cosmos_editor_page_size">Page size</label>
-                                <input class="form-control" type="number" id="data_management_cosmos_editor_page_size" min="1" max="100" value="100">
-                                <div class="form-text">Max 100 per request.</div>
-                            </div>
-                            <div class="col-lg-6">
-                                <label class="form-label" for="data_management_cosmos_editor_query">SELECT query</label>
-                                <textarea class="form-control font-monospace" id="data_management_cosmos_editor_query" rows="4" placeholder="Leave empty to browse the first 100 documents. Custom queries must start with SELECT."></textarea>
-                                <div class="form-text">Empty query returns only the first 100 documents. Custom SELECT queries can page beyond 100 with Next Page.</div>
-                            </div>
-                        </div>
-                        <div class="d-flex flex-wrap align-items-center gap-2 mt-3">
-                            <button type="button" class="btn btn-primary" id="data-management-cosmos-editor-run-query-btn">
-                                <i class="bi bi-search me-1"></i>Run Query
-                            </button>
-                            <span class="small text-muted" id="data-management-cosmos-editor-query-status">No query has run yet.</span>
-                        </div>
-                        <div class="form-text mt-2">
-                            Query results and the JSON editor open in a modal so the Data Management page stays compact.
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-4 mb-4 border-primary shadow-sm" id="data-management-backup-inventory-section">
-                    <div class="d-flex flex-wrap align-items-start justify-content-between gap-3 mb-3">
-                        <div>
-                            <h4 class="mb-1">Backup Inventory</h4>
-                            <p class="text-muted mb-0 small">Track completed full and partial backups created by Data Management jobs.</p>
-                        </div>
-                        <div class="d-flex flex-wrap align-items-center gap-2">
-                            <button type="button" class="btn btn-outline-danger btn-sm" id="data-management-run-retention-cleanup-btn"
-                                    data-bs-toggle="tooltip" data-bs-placement="bottom"
-                                    title="Permanently deletes backups older than the configured retention period, along with their stored artifacts. Backups still inside the retention window are never touched.">
-                                <i class="bi bi-trash3 me-1"></i>Run Retention Cleanup
-                            </button>
-                            <button type="button" class="btn btn-link btn-sm p-0 text-decoration-none" id="data-management-retention-cleanup-info-btn"
-                                    data-bs-toggle="collapse" data-bs-target="#data-management-retention-cleanup-help"
-                                    aria-expanded="false" aria-controls="data-management-retention-cleanup-help"
-                                    aria-label="What does Run Retention Cleanup do?">
-                                <i class="bi bi-info-circle" aria-hidden="true"></i>
-                            </button>
-                            <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-refresh-backups-btn">
-                                <i class="bi bi-arrow-clockwise me-1"></i>Refresh
-                            </button>
-                        </div>
-                    </div>
-                    <div class="collapse mb-3" id="data-management-retention-cleanup-help">
-                        <div class="alert alert-info small mb-0" role="note">
-                            <div class="fw-semibold mb-1"><i class="bi bi-info-circle me-1" aria-hidden="true"></i>What does Run Retention Cleanup do?</div>
-                            <p class="mb-2">
-                                It permanently deletes backups whose age exceeds the retention period configured in Data Management settings,
-                                and removes their stored artifacts from the backup container. Backups newer than the retention cutoff are left alone.
-                            </p>
-                            <ul class="mb-2 ps-3">
-                                <li>Only backups in a finished state are eligible; running or queued jobs are skipped.</li>
-                                <li>When <em>Keep latest full backup</em> is enabled, the most recent successful full backup is protected even if it is past the cutoff.</li>
-                                <li>Each run deletes at most 25 backups, so very large cleanups may need several runs.</li>
-                                <li>Cleanup also runs automatically on the configured schedule; this button just runs it now.</li>
-                            </ul>
-                            <p class="mb-0 text-muted">
-                                Seeing &ldquo;found no expired backups to delete&rdquo; means every backup is still inside the retention window. That is expected, not an error.
-                            </p>
-                        </div>
-                    </div>
-                    <div class="row g-3 mb-3" role="group" aria-label="Backup inventory filters">
-                        <div class="col-lg-4">
-                            <button type="button" class="btn btn-primary w-100 h-100 text-start" id="data-management-view-all-backups-btn" data-backup-filter="all" aria-pressed="true">
-                                <span class="d-flex align-items-center gap-2 small text-white-50">
-                                    <i class="bi bi-check-circle"></i>
-                                    <span>Available backups</span>
-                                </span>
-                                <span class="d-block fs-3 fw-semibold" id="data-management-available-backup-count">0</span>
-                                <span class="d-block small text-white-50">Completed backups ready to inspect or restore later.</span>
-                            </button>
-                        </div>
-                        <div class="col-lg-4">
-                            <button type="button" class="btn btn-outline-primary w-100 h-100 text-start" id="data-management-view-full-backups-btn" data-backup-filter="full" aria-pressed="false">
-                                <span class="d-flex align-items-center gap-2 small text-muted">
-                                    <i class="bi bi-archive"></i>
-                                    <span>Full backups</span>
-                                </span>
-                                <span class="d-block fs-3 fw-semibold" id="data-management-full-backup-count">0</span>
-                                <span class="d-block small text-muted">Complete snapshots across the selected backup surfaces.</span>
-                            </button>
-                        </div>
-                        <div class="col-lg-4">
-                            <button type="button" class="btn btn-outline-primary w-100 h-100 text-start" id="data-management-view-partial-backups-btn" data-backup-filter="partial" aria-pressed="false">
-                                <span class="d-flex align-items-center gap-2 small text-muted">
-                                    <i class="bi bi-archive-fill"></i>
-                                    <span>Partial backups</span>
-                                </span>
-                                <span class="d-block fs-3 fw-semibold" id="data-management-partial-backup-count">0</span>
-                                <span class="d-block small text-muted">Daily change captures between full backup windows.</span>
-                            </button>
-                        </div>
-                    </div>
-                    <div class="row g-2 align-items-end mb-3" aria-label="Backup inventory query filters">
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_backup_status_filter">Status</label>
-                            <select class="form-select form-select-sm" id="data_management_backup_status_filter">
-                                <option value="available" selected>Available</option>
-                                <option value="">All statuses</option>
-                                <option value="completed">Completed</option>
-                                <option value="completed_with_warnings">Completed with warnings</option>
-                                <option value="queued">Queued</option>
-                                <option value="running">Running</option>
-                                <option value="failed">Failed</option>
-                                <option value="canceled">Canceled</option>
-                            </select>
-                        </div>
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_backup_scheduled_filter">Run type</label>
-                            <select class="form-select form-select-sm" id="data_management_backup_scheduled_filter">
-                                <option value="all" selected>Scheduled and manual</option>
-                                <option value="scheduled">Scheduled</option>
-                                <option value="manual">Manual</option>
-                            </select>
-                        </div>
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_backup_created_from">Created from</label>
-                            <input class="form-control form-control-sm" type="date" id="data_management_backup_created_from" />
-                        </div>
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_backup_created_to">Created through</label>
-                            <input class="form-control form-control-sm" type="date" id="data_management_backup_created_to" />
-                        </div>
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_backup_page_size">Rows per page</label>
-                            <select class="form-select form-select-sm" id="data_management_backup_page_size">
-                                <option value="10">10</option>
-                                <option value="25" selected>25</option>
-                                <option value="50">50</option>
-                                <option value="100">100</option>
-                            </select>
-                        </div>
-                    </div>
-                    <div class="table-responsive">
-                        <table class="table table-sm align-middle">
-                            <thead>
-                                <tr>
-                                    <th scope="col">Backup</th>
-                                    <th scope="col">Completed</th>
-                                    <th scope="col">Contents</th>
-                                    <th scope="col">Storage</th>
-                                    <th scope="col">Protection</th>
-                                    <th scope="col">Warnings</th>
-                                    <th scope="col">Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody id="data-management-backups-tbody">
-                                <tr>
-                                    <td colspan="7" class="text-muted">Backup inventory has not loaded yet.</td>
-                                </tr>
-                            </tbody>
-                        </table>
-                    </div>
-                    <nav class="d-flex flex-wrap align-items-center justify-content-between gap-2" aria-label="Backup inventory pagination">
-                        <span class="small text-muted" id="data-management-backup-pagination-status" role="status" aria-live="polite">Page 1 has not loaded yet.</span>
-                        <div class="btn-group btn-group-sm" role="group" aria-label="Backup inventory pages">
-                            <button type="button" class="btn btn-outline-secondary" id="data-management-backup-previous-page-btn" disabled aria-disabled="true">
-                                <i class="bi bi-chevron-left me-1"></i>Previous
-                            </button>
-                            <button type="button" class="btn btn-outline-secondary" id="data-management-backup-next-page-btn" disabled aria-disabled="true">
-                                Next<i class="bi bi-chevron-right ms-1"></i>
-                            </button>
-                        </div>
-                    </nav>
-                </div>
-
-                <div class="modal fade" id="data-management-restore-modal" tabindex="-1" aria-labelledby="data-management-restore-title" aria-hidden="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title" id="data-management-restore-title">Restore Backup</h5>
-                                    <p class="text-muted small mb-0">Review the target, policy, and backup manifest before queueing a restore job.</p>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-warning" role="alert">
-                                    Restore writes data into the configured target Cosmos DB, AI Search, and Enhanced Citation Storage services. Create-only mode blocks existing destination collisions; overwrite mode requires a separate phrase.
-                                </div>
-                                <section class="border rounded p-3 mb-3" aria-labelledby="data-management-restore-backup-heading">
-                                    <h6 class="mb-2" id="data-management-restore-backup-heading">Selected backup</h6>
-                                    <div class="row g-2" id="data-management-restore-backup-summary">
-                                        <div class="col-12 text-muted">Choose Restore from a backup row.</div>
-                                    </div>
-                                </section>
-                                <section class="border rounded p-3 mb-3" aria-labelledby="data-management-restore-policy-heading">
-                                    <h6 class="mb-3" id="data-management-restore-policy-heading">Restore policy and surfaces</h6>
-                                    <div class="row g-3">
-                                        <div class="col-md-4">
-                                            <label class="form-label" for="data_management_restore_policy">Collision policy</label>
-                                            <select class="form-select" id="data_management_restore_policy">
-                                                <option value="create_only" selected>Create only (block collisions)</option>
-                                                <option value="overwrite_existing">Overwrite existing target records</option>
-                                            </select>
-                                            <div class="form-text">Create-only is non-destructive and recommended for first restore attempts.</div>
-                                        </div>
-                                        <div class="col-md-8">
-                                            <fieldset>
-                                                <legend class="form-label">Restore surfaces</legend>
-                                                <div class="d-flex flex-wrap gap-3">
-                                                    <div class="form-check form-switch">
-                                                        <input class="form-check-input" type="checkbox" role="switch" id="data_management_restore_include_cosmos" checked>
-                                                        <label class="form-check-label" for="data_management_restore_include_cosmos">Cosmos DB</label>
-                                                    </div>
-                                                    <div class="form-check form-switch">
-                                                        <input class="form-check-input" type="checkbox" role="switch" id="data_management_restore_include_ai_search" checked>
-                                                        <label class="form-check-label" for="data_management_restore_include_ai_search">AI Search</label>
-                                                    </div>
-                                                    <div class="form-check form-switch">
-                                                        <input class="form-check-input" type="checkbox" role="switch" id="data_management_restore_include_source_blobs" checked>
-                                                        <label class="form-check-label" for="data_management_restore_include_source_blobs">Enhanced Citation blobs</label>
-                                                    </div>
-                                                </div>
-                                            </fieldset>
-                                        </div>
-                                    </div>
-                                    <div class="mt-3 d-none" id="data-management-restore-confirmation-section">
-                                        <label class="form-label" for="data_management_restore_overwrite_confirmation_phrase">Type the overwrite confirmation phrase</label>
-                                        <input class="form-control" type="text" id="data_management_restore_overwrite_confirmation_phrase" autocomplete="off" aria-describedby="data-management-restore-confirmation-help">
-                                        <div class="form-text" id="data-management-restore-confirmation-help">
-                                            Required phrase: <code>RESTORE WITH OVERWRITE</code>
-                                        </div>
-                                    </div>
-                                </section>
-                                <section class="border rounded p-3" aria-labelledby="data-management-restore-review-heading">
-                                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
-                                        <div>
-                                            <h6 class="mb-1" id="data-management-restore-review-heading">Preflight review</h6>
-                                            <p class="text-muted small mb-0" id="data-management-restore-review-status">Run review to validate the manifest, target access, and restore policy.</p>
-                                        </div>
-                                        <button type="button" class="btn btn-outline-primary btn-sm" id="data-management-restore-review-btn">
-                                            <i class="bi bi-shield-check me-1"></i>Run Restore Review
-                                        </button>
-                                    </div>
-                                    <div class="list-group" id="data-management-restore-review-checks" aria-live="polite">
-                                        <div class="list-group-item text-muted">No restore review has run yet.</div>
-                                    </div>
-                                </section>
-                                <div class="form-check mt-3">
-                                    <input class="form-check-input" type="checkbox" id="data_management_restore_final_confirmation">
-                                    <label class="form-check-label fw-semibold" for="data_management_restore_final_confirmation">
-                                        I reviewed the restore target, policy, and preflight result.
-                                    </label>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                                <button type="button" class="btn btn-danger" id="data-management-restore-queue-btn" disabled aria-disabled="true">
-                                    Queue Restore Job
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-4 mb-4 border-dark shadow-sm" id="data-management-jobs-section">
-                    <div class="d-flex align-items-center justify-content-between mb-3">
-                        <h4 class="mb-0">Job History</h4>
-                        <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-refresh-jobs-btn">
-                            <i class="bi bi-arrow-clockwise me-1"></i>Refresh
-                        </button>
-                    </div>
-                    <div class="row g-2 align-items-end mb-3" aria-label="Job history filters">
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_job_operation_filter">Operation</label>
-                            <select class="form-select form-select-sm" id="data_management_job_operation_filter">
-                                <option value="" selected>All operations</option>
-                                <option value="backup">Backup</option>
-                                <option value="migration">Migration</option>
-                                <option value="restore">Restore</option>
-                                <option value="dry_run">Dry run</option>
-                            </select>
-                        </div>
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_job_status_filter">Status</label>
-                            <select class="form-select form-select-sm" id="data_management_job_status_filter">
-                                <option value="" selected>All statuses</option>
-                                <option value="queued">Queued</option>
-                                <option value="running">Running</option>
-                                <option value="completed">Completed</option>
-                                <option value="completed_with_warnings">Completed with warnings</option>
-                                <option value="failed">Failed</option>
-                                <option value="canceled">Canceled</option>
-                            </select>
-                        </div>
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_job_scheduled_filter">Run type</label>
-                            <select class="form-select form-select-sm" id="data_management_job_scheduled_filter">
-                                <option value="all" selected>Scheduled and manual</option>
-                                <option value="scheduled">Scheduled</option>
-                                <option value="manual">Manual</option>
-                            </select>
-                        </div>
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_job_created_from">Created from</label>
-                            <input class="form-control form-control-sm" type="date" id="data_management_job_created_from" />
-                        </div>
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_job_created_to">Created through</label>
-                            <input class="form-control form-control-sm" type="date" id="data_management_job_created_to" />
-                        </div>
-                        <div class="col-sm-6 col-lg-2">
-                            <label class="form-label small" for="data_management_job_page_size">Rows per page</label>
-                            <select class="form-select form-select-sm" id="data_management_job_page_size">
-                                <option value="10">10</option>
-                                <option value="25" selected>25</option>
-                                <option value="50">50</option>
-                                <option value="100">100</option>
-                            </select>
-                        </div>
-                    </div>
-                    <div class="table-responsive">
-                        <table class="table table-sm align-middle">
-                            <thead>
-                                <tr>
-                                    <th scope="col">Created</th>
-                                    <th scope="col">Operation</th>
-                                    <th scope="col">Status</th>
-                                    <th scope="col">Progress</th>
-                                    <th scope="col">Message</th>
-                                    <th scope="col">Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody id="data-management-jobs-tbody">
-                                <tr>
-                                    <td colspan="6" class="text-muted">Job history has not loaded yet.</td>
-                                </tr>
-                            </tbody>
-                        </table>
-                    </div>
-                    <nav class="d-flex flex-wrap align-items-center justify-content-between gap-2" aria-label="Job history pagination">
-                        <span class="small text-muted" id="data-management-job-pagination-status" role="status" aria-live="polite">Page 1 has not loaded yet.</span>
-                        <div class="btn-group btn-group-sm" role="group" aria-label="Job history pages">
-                            <button type="button" class="btn btn-outline-secondary" id="data-management-job-previous-page-btn" disabled aria-disabled="true">
-                                <i class="bi bi-chevron-left me-1"></i>Previous
-                            </button>
-                            <button type="button" class="btn btn-outline-secondary" id="data-management-job-next-page-btn" disabled aria-disabled="true">
-                                Next<i class="bi bi-chevron-right ms-1"></i>
-                            </button>
-                        </div>
-                    </nav>
-                </div>
-
-                <div class="modal fade" id="data-management-cosmos-editor-danger-modal" tabindex="-1" aria-labelledby="data-management-cosmos-editor-danger-title" aria-hidden="true">
-                    <div class="modal-dialog modal-lg">
-                        <div class="modal-content border-danger">
-                            <div class="modal-header bg-danger text-white">
-                                <div>
-                                    <h5 class="modal-title" id="data-management-cosmos-editor-danger-title">Cosmos DB JSON Editor Warning</h5>
-                                    <p class="mb-0 small text-white-50">This interface can change live application data.</p>
-                                </div>
-                                <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-danger" role="alert">
-                                    Incorrect edits can break authentication, workspaces, chat history, documents, automations, or activity log integrity. Use this editor only when safer admin tools cannot solve the problem.
-                                </div>
-                                <ul class="mb-3">
-                                    <li>Run targeted SELECT queries and page results instead of loading large containers at once.</li>
-                                    <li>Do not change <code>id</code> or the container partition key value.</li>
-                                    <li>Review JSON carefully before saving. Saves are audited in Activity Logs.</li>
-                                </ul>
-                                <div class="form-check">
-                                    <input class="form-check-input" type="checkbox" id="data_management_cosmos_editor_danger_accept">
-                                    <label class="form-check-label fw-semibold" for="data_management_cosmos_editor_danger_accept">
-                                        I understand this editor can damage overall system health.
-                                    </label>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                                <button type="button" class="btn btn-danger" id="data-management-cosmos-editor-accept-danger-btn" disabled aria-disabled="true">
-                                    I Understand, Unlock Editor
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="data-management-cosmos-editor-results-modal" tabindex="-1" aria-labelledby="data-management-cosmos-editor-modal-title" aria-hidden="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title" id="data-management-cosmos-editor-modal-title">Cosmos DB Query Results</h5>
-                                    <p class="text-muted small mb-0" id="data-management-cosmos-editor-modal-subtitle">Run a query to load document summaries.</p>
-                                    <p class="text-muted small mb-0" id="data-management-cosmos-editor-modal-status">No query has run yet.</p>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body cosmos-editor-results-modal-body">
-                                <div class="row g-3">
-                                    <div class="col-lg-4">
-                                        <div class="border rounded h-100">
-                                            <div class="border-bottom px-3 py-2 bg-light">
-                                                <h6 class="mb-0">Results</h6>
-                                            </div>
-                                            <div class="list-group list-group-flush cosmos-editor-results-list" id="data-management-cosmos-editor-results-list" aria-label="Cosmos DB query results">
-                                                <div class="list-group-item text-muted">Run a query to list documents.</div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                    <div class="col-lg-8">
-                                        <div class="border rounded h-100">
-                                            <div class="border-bottom px-3 py-2 bg-light">
-                                                <div class="d-flex flex-wrap align-items-center justify-content-between gap-2">
-                                                    <div>
-                                                        <h6 class="mb-0">Document JSON</h6>
-                                                        <div class="small text-muted" id="data-management-cosmos-editor-document-meta">Select a result to load JSON.</div>
-                                                    </div>
-                                                    <div class="d-flex flex-wrap gap-2">
-                                                        <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-cosmos-editor-refresh-document-btn" disabled aria-disabled="true">
-                                                            <i class="bi bi-arrow-clockwise me-1"></i>Refresh Document
-                                                        </button>
-                                                        <button type="button" class="btn btn-danger btn-sm" id="data-management-cosmos-editor-save-btn" disabled aria-disabled="true">
-                                                            <i class="bi bi-save me-1"></i>Save JSON
-                                                        </button>
-                                                    </div>
-                                                </div>
-                                            </div>
-                                            <div class="p-3">
-                                                <textarea class="form-control font-monospace" id="data_management_cosmos_editor_document_json" rows="20" spellcheck="false" disabled aria-disabled="true" placeholder="Selected document JSON appears here." style="min-height: 58vh;"></textarea>
-                                                <div class="form-text" id="data-management-cosmos-editor-document-help">The editor blocks id and partition key changes. Saves use the ETag from the loaded document.</div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                            <div class="modal-footer d-flex flex-wrap justify-content-between gap-2">
-                                <div class="small text-muted">Custom SELECT queries can page beyond the first request when Cosmos returns a continuation token.</div>
-                                <div class="d-flex flex-wrap gap-2">
-                                    <button type="button" class="btn btn-outline-primary" id="data-management-cosmos-editor-next-page-btn" disabled aria-disabled="true">
-                                        <i class="bi bi-arrow-right-circle me-1"></i>Next Page
-                                    </button>
-                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="data-management-cosmos-editor-save-modal" tabindex="-1" aria-labelledby="data-management-cosmos-editor-save-title" aria-hidden="true">
-                    <div class="modal-dialog modal-lg">
-                        <div class="modal-content border-danger">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title" id="data-management-cosmos-editor-save-title">Confirm Cosmos DB Document Save</h5>
-                                    <p class="text-muted small mb-0" id="data-management-cosmos-editor-save-subtitle">Review the change summary before saving.</p>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-danger" role="alert">
-                                    Saving replaces the selected Cosmos DB document with the JSON currently in the editor. This action is audited and cannot be undone from this screen.
-                                </div>
-                                <div class="border rounded p-3 mb-3" id="data-management-cosmos-editor-save-summary">
-                                    No changes summarized yet.
-                                </div>
-                                <label class="form-label" for="data_management_cosmos_editor_confirmation_phrase">Type the confirmation phrase to enable saving</label>
-                                <input class="form-control" type="text" id="data_management_cosmos_editor_confirmation_phrase" autocomplete="off" aria-describedby="data-management-cosmos-editor-confirmation-help">
-                                <div class="form-text" id="data-management-cosmos-editor-confirmation-help">
-                                    Required phrase: <code>I understand this can damage system data</code>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                                <button type="button" class="btn btn-danger" id="data-management-cosmos-editor-confirm-save-btn" disabled aria-disabled="true">
-                                    Save Cosmos Document
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="data-management-job-detail-modal" tabindex="-1" aria-labelledby="data-management-job-detail-title" aria-hidden="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div class="me-3">
-                                    <h5 class="modal-title" id="data-management-job-detail-title">Job Details</h5>
-                                    <p class="text-muted small mb-0" id="data-management-job-detail-subtitle"></p>
-                                    <p class="text-muted small mb-0" id="data-management-job-detail-refresh-state"></p>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="row g-3 mb-4" id="data-management-job-detail-summary"></div>
-                                <div class="d-flex flex-wrap gap-2 mb-4 d-none" id="data-management-job-detail-actions" aria-label="Migration job actions"></div>
-                                <div id="data-management-job-detail-progress" class="mb-4"></div>
-                                <div class="row g-3">
-                                    <div class="col-lg-5">
-                                        <div class="card h-100">
-                                            <div class="card-header bg-primary text-white">
-                                                <h6 class="mb-0"><i class="bi bi-list-check me-2"></i>Timeline</h6>
-                                            </div>
-                                            <div class="card-body p-0">
-                                                <div class="list-group list-group-flush" id="data-management-job-items-tbody">
-                                                    <div class="list-group-item text-muted">No timeline events loaded.</div>
-                                                </div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                    <div class="col-lg-7">
-                                        <div class="card h-100">
-                                            <div class="card-header bg-success text-white">
-                                                <h6 class="mb-0"><i class="bi bi-box-seam me-2"></i>Backup Contents</h6>
-                                            </div>
-                                            <div class="card-body">
-                                                <div class="vstack gap-3" id="data-management-job-artifacts-tbody">
-                                                    <div class="text-muted">No backup artifacts recorded for this job.</div>
-                                                </div>
-                                            </div>
-                                        </div>
-                                    </div>
-                                    <div class="col-lg-7">
-                                        <div class="card h-100">
-                                            <div class="card-header bg-info text-dark">
-                                                <h6 class="mb-0"><i class="bi bi-database-check me-2"></i>Storage and Manifest</h6>
-                                            </div>
-                                            <div class="card-body" id="data-management-job-manifest-detail"></div>
-                                        </div>
-                                    </div>
-                                    <div class="col-lg-5">
-                                        <div class="card h-100">
-                                            <div class="card-header bg-warning text-dark">
-                                                <h6 class="mb-0"><i class="bi bi-exclamation-triangle me-2"></i>Warnings</h6>
-                                            </div>
-                                            <div class="card-body" id="data-management-job-warnings"></div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="data-management-migration-cancel-modal" tabindex="-1" aria-labelledby="data-management-migration-cancel-title" aria-hidden="true">
-                    <div class="modal-dialog modal-dialog-centered">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="data-management-migration-cancel-title">Request Data Management Job Cancellation</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <p class="mb-2" id="data-management-migration-cancel-message"></p>
-                                <p class="text-muted small mb-0">The worker stops at its next durable checkpoint. Completed items remain available for Retry or Resume.</p>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Keep Running</button>
-                                <button type="button" class="btn btn-danger" id="data-management-confirm-migration-cancel-btn">Request Cancellation</button>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="modal fade" id="data-management-backup-delete-modal" tabindex="-1" aria-labelledby="data-management-backup-delete-title" aria-hidden="true">
-                        <div class="modal-dialog modal-dialog-centered">
-                            <div class="modal-content border-danger">
-                                <div class="modal-header">
-                                    <h5 class="modal-title" id="data-management-backup-delete-title">Delete Data Management Backup</h5>
-                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                                </div>
-                                <div class="modal-body">
-                                    <p class="mb-2" id="data-management-backup-delete-message"></p>
-                                    <div class="alert alert-warning small mb-0" role="alert">
-                                        Backup deletion removes stored artifacts, job timeline records, and differential sidecar state for this job. Future partial backups will re-export affected unchanged items.
-                                    </div>
-                                </div>
-                                <div class="modal-footer">
-                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Keep Backup</button>
-                                    <button type="button" class="btn btn-danger" id="data-management-confirm-backup-delete-btn">Delete Backup</button>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="data-management-setup-guide-modal" tabindex="-1" aria-labelledby="data-management-setup-guide-title" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="data-management-setup-guide-title">Backup, Migrate &amp; Restore Configuration Guide</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <p>Configure backup, migration, and restore readiness before an incident or cutover window. The safest path is to first prove backups, then rehearse migration or restore decisions from completed backup records.</p>
-                                <ol>
-                                    <li>Use dedicated backup storage that is separate from Enhanced Citation source files.</li>
-                                    <li>Generate and protect the backup encryption key, preferably in Key Vault.</li>
-                                    <li>Run a manual full backup and inspect the Backup Inventory entry.</li>
-                                    <li>For migration, connect destination Cosmos, Search, and storage services before selecting scope.</li>
-                                    <li>For restore, open Backup Inventory and stage the selected backup through the Restore workflow.</li>
-                                </ol>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="data-management-backup-guide-modal" tabindex="-1" aria-labelledby="data-management-backup-guide-title" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="data-management-backup-guide-title">Backup Setup Guide</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <p>Backups create durable artifacts and job records that later migration or restore workflows can inspect. Full backups capture a complete selected snapshot. Partial backups capture daily changes between full backups.</p>
-                                <ul>
-                                    <li><strong>Storage:</strong> Use a dedicated backup account/container so restore and migration artifacts never overwrite source documents.</li>
-                                    <li><strong>Encryption:</strong> Keep backup encryption enabled and store generated keys in Key Vault for production.</li>
-                                    <li><strong>Scope:</strong> Leave Cosmos DB and AI Search enabled unless you are intentionally creating a limited backup.</li>
-                                    <li><strong>Timing:</strong> Queue large backup jobs outside business hours because App Service workers perform the work.</li>
-                                </ul>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="data-management-migration-guide-modal" tabindex="-1" aria-labelledby="data-management-migration-guide-title" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="data-management-migration-guide-title">Migration Guide</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <p>Migration moves selected SimpleChat users, groups, public workspaces, and their optional documents to another SimpleChat environment.</p>
-                                <ul>
-                                    <li><strong>Copy missing items only:</strong> safest first run; existing destination records are not changed.</li>
-                                    <li><strong>Catch up changed items:</strong> use after a previous completed migration to copy new items and update migration-owned changes.</li>
-                                    <li><strong>Make destination match source:</strong> use only during cutover when migrated destination-only items should be removed.</li>
-                                    <li><strong>AI Search freeze:</strong> freeze external destination writers before moving Search documents because SimpleChat cannot coordinate external writers.</li>
-                                </ul>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="data-management-ru-boost-guide-modal" tabindex="-1" aria-labelledby="data-management-ru-boost-guide-title" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="data-management-ru-boost-guide-title">RU Boost Permission Guide</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <p>RU Boost temporarily raises eligible Cosmos DB throughput up to 10,000 RU/s and then restores the original setting. It can increase Azure charges and requires Azure management-plane permissions.</p>
-                                <ul>
-                                    <li><strong>Data copy permissions</strong> prove the identity can create, read, and delete probe records in destination Cosmos containers.</li>
-                                    <li><strong>RU Boost permissions</strong> prove the identity can read and write Cosmos throughput settings through Azure Resource Manager.</li>
-                                    <li>Destination RU Boost also needs the destination subscription ID and resource group because those values are not part of the data-plane endpoint.</li>
-                                    <li>Use Test RU Boost before a cutover window; it validates capacity permissions separately from migration data access.</li>
-                                </ul>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="data-management-restore-guide-modal" tabindex="-1" aria-labelledby="data-management-restore-guide-title" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="data-management-restore-guide-title">Restore Guide</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <p>Restore starts from Backup Inventory. The workflow helps admins confirm what is in the backup, what surfaces are safe to restore, and whether backend restore execution is available for the selected backup.</p>
-                                <ul>
-                                    <li>Prefer full backups for restore decisions because partial backups depend on earlier backup history.</li>
-                                    <li>Confirm the encryption key is still available before relying on encrypted artifacts.</li>
-                                    <li>Review warnings and missing surfaces before restoring AI Search or source document blobs.</li>
-                                    <li>Run restore only in a maintenance window because restored records can affect live users and search results.</li>
-                                </ul>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </div>
-
-            <div class="tab-pane fade" id="scale" role="tabpanel" aria-labelledby="scale-tab">
-                {% set enable_dai_debug = settings.enable_dai_debug | default(false) %}
-                <p class="text-muted">
-                    Configure Redis cache to improve enterprise scale and performance by caching session data. Enabling Redis allows you to horizontally scale your application across multiple instances without losing session data.
-                </p>
-                <div class="card p-3 mb-3" id="redis-cache-section">
-                    <h5>
-                        <i class="bi bi-database me-2"></i>Redis Cache
-                    </h5>
-                    <p class="text-muted">
-                        Enable Redis Cache to store session data in a distributed cache. This is recommended for production and multi-instance deployments.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_redis_cache"
-                            name="enable_redis_cache"
-                            {% if settings.enable_redis_cache %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_redis_cache">
-                            Enable Redis Cache
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable Redis Cache for distributed session storage, improving performance and enabling horizontal scaling across multiple application instances."></i>
-                    </div>
-                    <div id="redis_cache_settings" class="{% if not settings.enable_redis_cache %}d-none{% endif %}">
-                        <div class="mb-3">
-                            <label for="redis_url" class="form-label">Redis Server Host Name</label>
-                            <p class="text-muted">(example: simple-chat.redis.cache.windows.net)</p>
-                            <input type="text" class="form-control" id="redis_url" name="redis_url" value="{{ settings.redis_url or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="redis_auth_type" class="form-label">Redis Authentication Type</label>
-                            <select class="form-select" id="redis_auth_type" name="redis_auth_type">
-                                <option value="key" {% if settings.redis_auth_type == 'key' or not settings.redis_auth_type %}selected{% endif %}>Key</option>
-                                <option value="managed_identity" {% if settings.redis_auth_type == 'managed_identity' %}selected{% endif %}>Managed Identity</option>
-                                <option value="key_vault" {% if settings.redis_auth_type == 'key_vault' %}selected{% endif %}>Key Vault</option>
-                            </select>
-                        </div>
-                        <div class="mb-3 {% if settings.redis_auth_type == 'managed_identity' %}d-none{% endif %}" id="redis_key_container">
-                            <label for="redis_key" class="form-label" id="redis_key_label">
-                                {%- if settings.redis_auth_type == 'key_vault' -%}
-                                    Key Vault Secret Name
-                                {%- else -%}
-                                    Redis Access Key
-                                {%- endif -%}
-                            </label>
-                            <div class="input-group">
-                                <input type="password" class="form-control" id="redis_key" name="redis_key" value="{{ settings.redis_key or '' }}">
-                                <button type="button" class="btn btn-outline-secondary" id="toggle_redis_key">Show</button>
-                            </div>
-                            <div id="redis_key_vault_hint" class="form-text text-muted {% if settings.redis_auth_type != 'key_vault' %}d-none{% endif %}">
-                                Enter the full Key Vault secret name. <a href="#security" onclick="switchTab(event, 'security-tab')">
-                                Enable Key Vault for Agent and Action Secrets
-                            </a> must be enabled and configured.
-                            </div>
-                        </div>
-                        <button type="button" class="btn btn-secondary mt-3" id="test_redis_button">
-                            Test Redis Connection
-                        </button>
-                        <div id="test_redis_result" class="mt-2"></div>
-                    </div>
-                    <div class="border rounded p-3 mt-4" id="redis-monitoring-section" data-testid="redis-monitoring-section">
-                        <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
-                            <div>
-                                <h6 class="mb-1">
-                                    <i class="bi bi-activity me-2" aria-hidden="true"></i>Redis Monitoring
-                                </h6>
-                                <p class="text-muted small mb-0">
-                                    Monitor Redis availability, memory pressure, hit rate, evictions, and runtime cache usage before Redis-backed document list caching is enabled.
-                                </p>
-                            </div>
-                            <div class="d-flex flex-wrap gap-2" role="group" aria-label="Redis monitoring actions">
-                                <button type="button" class="btn btn-outline-secondary btn-sm" id="redis-monitoring-refresh-btn">
-                                    <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh Redis Status
-                                </button>
-                                <button type="button" class="btn btn-outline-primary btn-sm" id="redis-explorer-open-btn" data-bs-toggle="modal" data-bs-target="#redisExplorerModal">
-                                    <i class="bi bi-search me-1" aria-hidden="true"></i>Redis Explorer
-                                </button>
-                            </div>
-                        </div>
-                        <div class="alert alert-info small mb-3 d-none" id="redis-monitoring-message" role="status" aria-live="polite"></div>
-                        <div class="row g-3 mb-3">
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Configuration</div>
-                                    <span class="badge text-bg-secondary" id="redis-monitoring-config-status">Not loaded</span>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Health</div>
-                                    <span class="badge text-bg-secondary" id="redis-monitoring-health-status">Not loaded</span>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">App Cache Runtime</div>
-                                    <span class="badge text-bg-secondary" id="redis-monitoring-app-cache-status">Not loaded</span>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Session Runtime</div>
-                                    <span class="badge text-bg-secondary" id="redis-monitoring-session-status">Not loaded</span>
-                                </div>
-                            </div>
-                        </div>
-                        <div class="row g-3">
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Ping Latency</div>
-                                    <div class="fw-semibold" id="redis-monitoring-ping-latency">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Memory Usage</div>
-                                    <div class="fw-semibold" id="redis-monitoring-memory-usage">Not loaded</div>
-                                    <div class="text-muted small" id="redis-monitoring-memory-policy">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Connected Clients</div>
-                                    <div class="fw-semibold" id="redis-monitoring-connected-clients">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Ops/sec</div>
-                                    <div class="fw-semibold" id="redis-monitoring-ops-per-sec">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Keyspace Hit Rate</div>
-                                    <div class="fw-semibold" id="redis-monitoring-hit-rate">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Tracked Keys</div>
-                                    <div class="fw-semibold" id="redis-monitoring-key-count">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">DAI Version Markers</div>
-                                    <div class="fw-semibold" id="redis-monitoring-dai-version-markers">Not loaded</div>
-                                    <div class="text-muted small" id="redis-monitoring-dai-version-marker-expiry">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">DAI Cache Payloads</div>
-                                    <div class="fw-semibold" id="redis-monitoring-dai-payload-keys">Not loaded</div>
-                                    <div class="text-muted small" id="redis-monitoring-dai-version-ttl-policy">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Expired / Evicted Keys</div>
-                                    <div class="fw-semibold">
-                                        <span id="redis-monitoring-expired-keys">Not loaded</span>
-                                        /
-                                        <span id="redis-monitoring-evicted-keys">Not loaded</span>
-                                    </div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Fragmentation Ratio</div>
-                                    <div class="fw-semibold" id="redis-monitoring-fragmentation">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Error Replies</div>
-                                    <div class="fw-semibold" id="redis-monitoring-errors">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Rejected Connections</div>
-                                    <div class="fw-semibold" id="redis-monitoring-rejected-connections">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Redis Version</div>
-                                    <div class="fw-semibold" id="redis-monitoring-version">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-3">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Monitoring Source</div>
-                                    <div class="fw-semibold" id="redis-monitoring-source">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Last Checked</div>
-                                    <div class="fw-semibold" id="redis-monitoring-checked-at">Not loaded</div>
-                                </div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="border rounded p-3 h-100">
-                                    <div class="text-muted small">Last Error</div>
-                                    <div class="fw-semibold" id="redis-monitoring-last-error">Not loaded</div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="redisExplorerModal" tabindex="-1" aria-labelledby="redisExplorerModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable redis-explorer-dialog">
-                        <div class="modal-content redis-explorer-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title" id="redisExplorerModalLabel">
-                                        <i class="bi bi-search me-2"></i>Redis Explorer
-                                    </h5>
-                                    <div class="small text-muted">
-                                        Read-only key browser with cursor pagination and sanitized value previews.
-                                    </div>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body redis-explorer-body d-flex flex-column">
-                                <div class="redis-explorer-alerts">
-                                    <div class="alert alert-warning small mb-2">
-                                        <i class="bi bi-shield-lock me-2" aria-hidden="true"></i>
-                                        Value previews are sanitized and restricted for session, token, cookie, credential, password, and secret-like keys. Use this for troubleshooting cache behavior, not for exporting Redis data.
-                                    </div>
-                                    <div class="alert alert-info small mb-3">
-                                        <i class="bi bi-info-circle me-2" aria-hidden="true"></i>
-                                        Leave the filter blank and select <span class="fw-semibold">Browse All</span> to page through Redis keys. Cache keys may use uppercase names, prefixes, or internal identifiers; for example, app settings cache entries are stored as <span class="font-monospace">APP_SETTINGS_CACHE</span> and <span class="font-monospace">APP_SETTINGS_CACHE_VERSION</span>.
-                                    </div>
-                                    <div id="redis-explorer-message" class="alert alert-info d-none" role="status" aria-live="polite"></div>
-                                </div>
-                                <div class="row g-3 align-items-end mb-3 redis-explorer-toolbar">
-                                    <div class="col-md-7">
-                                        <label for="redis-explorer-filter" class="form-label">Key Filter</label>
-                                        <input
-                                            type="search"
-                                            class="form-control"
-                                            id="redis-explorer-filter"
-                                            placeholder="Leave blank to browse all keys, or type a substring"
-                                            autocomplete="off"
-                                            data-ignore-settings-change="true"
-                                        >
-                                        <div class="form-text">
-                                            Blank filter browses all keys. Filters are case sensitive. Redis SCAN order is server-defined, so use Next Page to keep browsing.
-                                        </div>
-                                    </div>
-                                    <div class="col-md-2">
-                                        <label for="redis-explorer-page-size" class="form-label">Page Size</label>
-                                        <select class="form-select" id="redis-explorer-page-size" data-ignore-settings-change="true">
-                                            <option value="10">10</option>
-                                            <option value="25" selected>25</option>
-                                            <option value="50">50</option>
-                                            <option value="100">100</option>
-                                        </select>
-                                    </div>
-                                    <div class="col-md-3 d-flex flex-wrap gap-2">
-                                        <button type="button" class="btn btn-primary flex-fill" id="redis-explorer-browse-all-btn">
-                                            Browse All
-                                        </button>
-                                        <button type="button" class="btn btn-primary flex-fill" id="redis-explorer-search-btn">
-                                            Apply Filter
-                                        </button>
-                                        <button type="button" class="btn btn-outline-secondary flex-fill" id="redis-explorer-refresh-btn">
-                                            Refresh
-                                        </button>
-                                    </div>
-                                </div>
-                                <div class="row g-3 redis-explorer-browser">
-                                    <div class="col-lg-5 redis-explorer-column d-flex flex-column">
-                                        <div class="d-flex justify-content-between align-items-center mb-2">
-                                            <div class="fw-semibold">Keys</div>
-                                            <div class="small text-muted" id="redis-explorer-key-count">Not loaded</div>
-                                        </div>
-                                        <div class="list-group redis-explorer-key-list border rounded" id="redis-explorer-key-list" role="listbox" aria-label="Redis keys"></div>
-                                        <div class="d-flex justify-content-between align-items-center mt-2 redis-explorer-pagination">
-                                            <button type="button" class="btn btn-outline-secondary btn-sm" id="redis-explorer-prev-btn" disabled>
-                                                Previous Page
-                                            </button>
-                                            <button type="button" class="btn btn-outline-secondary btn-sm" id="redis-explorer-next-btn" disabled>
-                                                Next Page
-                                            </button>
-                                        </div>
-                                    </div>
-                                    <div class="col-lg-7 redis-explorer-column d-flex flex-column">
-                                        <div class="border rounded p-3 h-100 redis-explorer-preview-card d-flex flex-column">
-                                            <div id="redis-explorer-preview-empty" class="text-muted">
-                                                Select a key to view sanitized metadata and preview content.
-                                            </div>
-                                            <div id="redis-explorer-preview-panel" class="d-none">
-                                                <div class="row g-2 mb-3">
-                                                    <div class="col-md-12">
-                                                        <div class="small text-muted">Key</div>
-                                                        <div class="fw-semibold text-break" id="redis-explorer-preview-key">Not loaded</div>
-                                                    </div>
-                                                    <div class="col-md-3">
-                                                        <div class="small text-muted">Type</div>
-                                                        <div class="fw-semibold" id="redis-explorer-preview-type">Not loaded</div>
-                                                    </div>
-                                                    <div class="col-md-3">
-                                                        <div class="small text-muted">TTL</div>
-                                                        <div class="fw-semibold" id="redis-explorer-preview-ttl">Not loaded</div>
-                                                    </div>
-                                                    <div class="col-md-3">
-                                                        <div class="small text-muted">Memory</div>
-                                                        <div class="fw-semibold" id="redis-explorer-preview-memory">Not loaded</div>
-                                                    </div>
-                                                    <div class="col-md-3">
-                                                        <div class="small text-muted">Sanitization</div>
-                                                        <div class="fw-semibold" id="redis-explorer-preview-redacted">Not loaded</div>
-                                                    </div>
-                                                </div>
-                                                <div class="border rounded bg-body-tertiary p-3 mb-3 d-none" id="redis-explorer-resolution-card">
-                                                    <div class="small text-muted mb-1">SimpleChat Resolution</div>
-                                                    <div class="fw-semibold" id="redis-explorer-resolution-kind">Not resolved</div>
-                                                    <div class="small text-muted" id="redis-explorer-resolution-entity">Not resolved</div>
-                                                    <div class="small text-muted text-break" id="redis-explorer-resolution-scope">Not resolved</div>
-                                                    <div class="small text-muted" id="redis-explorer-resolution-note">Not resolved</div>
-                                                </div>
-                                                <label for="redis-explorer-preview-content" class="form-label">Sanitized Preview</label>
-                                                <pre class="border rounded bg-body-tertiary p-3 small text-break mb-0 redis-explorer-preview-content" id="redis-explorer-preview-content" tabindex="0">Not loaded</pre>
-                                            </div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="conversation-cache-section" data-testid="conversation-cache-section">
-                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
-                        <div>
-                            <h5 class="mb-1">
-                                <i class="bi bi-chat-square-text me-2"></i>Conversation Cache
-                            </h5>
-                            <p class="text-muted mb-0">
-                                Cache conversation list, feed, and advanced-search results per user. Redis is optional; cache misses and disabled cache paths continue using source Cosmos queries.
-                            </p>
-                        </div>
-                        <button type="button" class="btn btn-outline-secondary btn-sm" id="conversation-cache-refresh-btn">
-                            <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh Metrics
-                        </button>
-                    </div>
-                    <div class="row g-3 align-items-start">
-                        <div class="col-md-6">
-                            <div class="form-check form-switch">
-                                <input
-                                    class="form-check-input"
-                                    type="checkbox"
-                                    role="switch"
-                                    id="enable_conversation_cache"
-                                    name="enable_conversation_cache"
-                                    {% if settings.enable_conversation_cache | default(true) %}checked{% endif %}
-                                    aria-describedby="conversation-cache-help"
-                                >
-                                <label class="form-check-label" for="enable_conversation_cache">
-                                    Enable conversation cache
-                                </label>
-                            </div>
-                            <div class="form-text" id="conversation-cache-help">When enabled, list/feed/search payloads are cached by user and version. Disabling this bypasses cache reads and writes without requiring Redis.</div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <label for="conversation_cache_ttl_seconds" class="form-label">Cache TTL Seconds</label>
-                            <input
-                                type="number"
-                                class="form-control"
-                                id="conversation_cache_ttl_seconds"
-                                name="conversation_cache_ttl_seconds"
-                                min="0"
-                                value="{{ settings.conversation_cache_ttl_seconds | default(120) }}"
-                                aria-describedby="conversation-cache-ttl-help"
-                            >
-                            <div class="form-text" id="conversation-cache-ttl-help">Default 120 seconds. User-scoped version invalidation refreshes changed conversations; set to 0 to skip writing new entries.</div>
-                        </div>
-                    </div>
-                    <div class="row g-3 mt-1">
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Runtime Status</div>
-                                <span class="badge text-bg-secondary" id="conversation-cache-runtime-status">Not loaded</span>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Cache Hit Rate</div>
-                                <div class="fw-semibold" id="conversation-cache-15m-hit-rate">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Cache Hits / Misses</div>
-                                <div class="fw-semibold" id="conversation-cache-15m-hits-misses">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Cache Bypasses / Errors</div>
-                                <div class="fw-semibold" id="conversation-cache-15m-bypasses-errors">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Writes / Invalidations</div>
-                                <div class="fw-semibold" id="conversation-cache-15m-writes-invalidations">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Operation Mix</div>
-                                <div class="fw-semibold text-break" id="conversation-cache-15m-operation-counts">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last Cache Event</div>
-                                <div class="fw-semibold text-break" id="conversation-cache-last-event">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last Invalidation</div>
-                                <div class="fw-semibold text-break" id="conversation-cache-last-invalidation">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-12">
-                            <div class="alert alert-secondary small mb-0">
-                                <i class="bi bi-speedometer2 me-2" aria-hidden="true"></i>
-                                Conversation cache metrics are lightweight in-process counters for the current app worker. Application Insights logs remain the durable fleet-wide source for cache warnings and fallback behavior.
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="document-access-index-section" data-testid="document-access-index-section">
-                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
-                        <div>
-                            <h5 class="mb-1">
-                                <i class="bi bi-diagram-3 me-2"></i>Cosmos Document Access Index
-                            </h5>
-                            <p class="text-muted mb-0">
-                                Monitor the document access projection used to remove expensive cross-partition document access queries.
-                            </p>
-                        </div>
-                        <div class="d-flex flex-wrap gap-2" role="group" aria-label="Document access index actions">
-                            <button type="button" class="btn btn-outline-secondary btn-sm" id="document-access-index-refresh-btn">
-                                <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh Status
-                            </button>
-                            {% if enable_dai_debug %}
-                            <button type="button" class="btn btn-outline-primary btn-sm" id="document-access-index-run-batch-btn">
-                                <i class="bi bi-play-circle me-1" aria-hidden="true"></i>Run One Backfill Batch
-                            </button>
-                            <button type="button" class="btn btn-outline-danger btn-sm" id="document-access-index-reset-btn" data-bs-toggle="modal" data-bs-target="#documentAccessIndexResetModal">
-                                <i class="bi bi-arrow-counterclockwise me-1" aria-hidden="true"></i>Reset Checkpoint
-                            </button>
-                            {% endif %}
-                        </div>
-                    </div>
-
-                    <div class="alert alert-info small mb-3">
-                        <i class="bi bi-info-circle me-2" aria-hidden="true"></i>
-                        Document access projection maintenance is automatic. The background scheduler repairs fail-open projection records first, then runs bounded backfill batches repeatedly while work remains. Production read metrics below show DAI-served reads, Redis cache hits, source fallbacks, RU, and latency without requiring shadow validation.
-                        {% if enable_dai_debug %}Debug controls and shadow validation diagnostics are visible because <code>enable_dai_debug</code> is enabled in app settings.{% endif %}
-                    </div>
-
-                    <div id="document-access-index-message" class="alert alert-info d-none" role="status" aria-live="polite"></div>
-
-                    <div class="row g-3 mb-3">
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Container</div>
-                                <span class="badge text-bg-secondary" id="document-access-index-container-status">Not loaded</span>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Write-through</div>
-                                <span class="badge text-bg-secondary" id="document-access-index-write-through-status">Not loaded</span>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Read Path</div>
-                                <span class="badge text-bg-secondary" id="document-access-index-read-status">Not loaded</span>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Redis List Cache</div>
-                                <span class="badge text-bg-secondary" id="document-access-index-cache-status">Not loaded</span>
-                            </div>
-                        </div>
-                        {% if enable_dai_debug %}
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Shadow Validation</div>
-                                <span class="badge text-bg-secondary" id="document-access-index-shadow-status">Not loaded</span>
-                            </div>
-                        </div>
-                        {% endif %}
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Auto Maintenance</div>
-                                <span class="badge text-bg-secondary" id="document-access-index-maintenance-mode">Not loaded</span>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Next Maintenance Action</div>
-                                <div class="fw-semibold" id="document-access-index-maintenance-next-action">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">More Work Pending</div>
-                                <div class="fw-semibold" id="document-access-index-maintenance-more-work">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Active Loop Interval</div>
-                                <div class="fw-semibold" id="document-access-index-maintenance-active-interval">Not loaded</div>
-                            </div>
-                        </div>
-                    </div>
-
-                    {% if enable_dai_debug %}
-                    <div class="border rounded p-3 mb-3" data-testid="document-access-index-debug-controls">
-                        <h6 class="mb-3">Automatic Maintenance and Diagnostics</h6>
-                        <div class="row g-3 align-items-start">
-                            <div class="col-md-6 col-xl-3">
-                                <div class="form-check form-switch">
-                                    <input
-                                        class="form-check-input"
-                                        type="checkbox"
-                                        id="enable_document_access_index_write_through"
-                                        name="enable_document_access_index_write_through"
-                                        checked
-                                        disabled
-                                        aria-describedby="document-access-index-write-through-help"
-                                    >
-                                    <label class="form-check-label" for="enable_document_access_index_write_through">
-                                        Write-through projection
-                                    </label>
-                                </div>
-                                <div class="form-text" id="document-access-index-write-through-help">Always on. New and changed documents synchronize into the access index and fail open to repair records if projection updates fail.</div>
-                            </div>
-                            <div class="col-md-6 col-xl-3">
-                                <div class="form-check form-switch">
-                                    <input
-                                        class="form-check-input"
-                                        type="checkbox"
-                                        id="enable_startup_document_access_index_backfill"
-                                        name="enable_startup_document_access_index_backfill"
-                                        checked
-                                        disabled
-                                        aria-describedby="document-access-index-backfill-help"
-                                    >
-                                    <label class="form-check-label" for="enable_startup_document_access_index_backfill">
-                                        Automatic repair/backfill
-                                    </label>
-                                </div>
-                                <div class="form-text" id="document-access-index-backfill-help">Always on. Maintenance keeps running bounded repair and backfill batches until DAI is healthy.</div>
-                            </div>
-                            <div class="col-md-6 col-xl-3">
-                                <div class="form-check form-switch">
-                                    <input
-                                        class="form-check-input"
-                                        type="checkbox"
-                                        id="enable_document_access_index_shadow_validation"
-                                        name="enable_document_access_index_shadow_validation"
-                                        {% if settings.enable_document_access_index_shadow_validation %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label" for="enable_document_access_index_shadow_validation">
-                                        Enable shadow validation
-                                    </label>
-                                </div>
-                                <div class="form-text">Compares source list results to projection rows and logs mismatches without changing reads.</div>
-                            </div>
-                            <div class="col-md-6 col-xl-3">
-                                <label for="document_access_index_backfill_batch_size" class="form-label">Backfill Batch Size</label>
-                                <input
-                                    type="number"
-                                    class="form-control"
-                                    id="document_access_index_backfill_batch_size"
-                                    name="document_access_index_backfill_batch_size"
-                                    min="1"
-                                    max="1000"
-                                    value="{{ settings.document_access_index_backfill_batch_size or 200 }}"
-                                >
-                                <div class="form-text">Documents processed per manual or scheduled batch.</div>
-                            </div>
-                            <div class="col-md-6 col-xl-3">
-                                <label for="document_access_index_repair_batch_size" class="form-label">Repair Batch Size</label>
-                                <input
-                                    type="number"
-                                    class="form-control"
-                                    id="document_access_index_repair_batch_size"
-                                    name="document_access_index_repair_batch_size"
-                                    min="1"
-                                    max="500"
-                                    value="{{ settings.document_access_index_repair_batch_size or 100 }}"
-                                >
-                                <div class="form-text">Fail-open repair records reconciled before each backfill batch.</div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="border rounded p-3 mb-3" data-testid="document-access-index-debug-read-controls">
-                        <h6 class="mb-3">Default Read Path</h6>
-                        <div class="row g-3">
-                            <div class="col-md-6">
-                                <div class="form-check form-switch">
-                                    <input
-                                        class="form-check-input"
-                                        type="checkbox"
-                                        id="enable_document_access_index_reads"
-                                        name="enable_document_access_index_reads"
-                                        checked
-                                        disabled
-                                        aria-describedby="document-access-index-reads-help"
-                                    >
-                                    <label class="form-check-label" for="enable_document_access_index_reads">
-                                        Document access index reads
-                                        <span class="badge text-bg-success ms-1">Wave 5B default</span>
-                                    </label>
-                                </div>
-                                <div class="form-text" id="document-access-index-reads-help">Always on. DAI-backed document and tag list reads are the normal path; source-container fallback remains automatic when backfill is not ready, repairs are pending, or a DAI query fails.</div>
-                            </div>
-                            <div class="col-md-6 col-xl-3">
-                                <div class="form-check form-switch">
-                                    <input
-                                        class="form-check-input"
-                                        type="checkbox"
-                                        role="switch"
-                                        id="enable_document_access_index_cache"
-                                        name="enable_document_access_index_cache"
-                                        {% if settings.enable_document_access_index_cache %}checked{% endif %}
-                                        aria-describedby="document-access-index-cache-help"
-                                    >
-                                    <label class="form-check-label" for="enable_document_access_index_cache">
-                                        Redis document list cache
-                                        <span class="badge text-bg-info ms-1">Wave 6</span>
-                                    </label>
-                                </div>
-                                <div class="form-text" id="document-access-index-cache-help">Uses Redis read-through caching for DAI document, tag, and legacy-count reads. If Redis is unavailable, reads bypass cache and use DAI directly.</div>
-                            </div>
-                            <div class="col-md-6 col-xl-3">
-                                <label for="document_access_index_cache_ttl_seconds" class="form-label">Cache TTL Seconds</label>
-                                <input
-                                    type="number"
-                                    class="form-control"
-                                    id="document_access_index_cache_ttl_seconds"
-                                    name="document_access_index_cache_ttl_seconds"
-                                    min="60"
-                                    max="900"
-                                    value="{{ settings.document_access_index_cache_ttl_seconds or 900 }}"
-                                    aria-describedby="document-access-index-cache-ttl-help"
-                                >
-                                <div class="form-text" id="document-access-index-cache-ttl-help">Default 900 seconds. Scope-version invalidation makes document changes visible immediately; TTL clears unreachable old entries.</div>
-                            </div>
-                        </div>
-                    </div>
-                    {% endif %}
-
-                    <div class="row g-3">
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Backfill State</div>
-                                <span class="badge text-bg-secondary" id="document-access-index-backfill-status">Not loaded</span>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Repair Backlog</div>
-                                <div class="fw-semibold" id="document-access-index-repair-count">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m DAI Read Attempts</div>
-                                <div class="fw-semibold" id="document-access-index-read-15m-attempts">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Redis Cache Hit Rate</div>
-                                <div class="fw-semibold" id="document-access-index-cache-15m-hit-rate">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Cache Hits / Misses</div>
-                                <div class="fw-semibold" id="document-access-index-cache-15m-hits-misses">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Cache Bypasses / Errors</div>
-                                <div class="fw-semibold" id="document-access-index-cache-15m-bypasses-errors">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Cache Invalidations</div>
-                                <div class="fw-semibold" id="document-access-index-cache-15m-invalidations">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Served from DAI</div>
-                                <div class="fw-semibold" id="document-access-index-read-15m-served">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Source Fallbacks</div>
-                                <div class="fw-semibold" id="document-access-index-read-15m-fallbacks">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Fallback Rate</div>
-                                <div class="fw-semibold" id="document-access-index-read-15m-fallback-rate">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m DAI Read RU</div>
-                                <div class="fw-semibold" id="document-access-index-read-15m-ru">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Avg / P95 Latency</div>
-                                <div class="fw-semibold" id="document-access-index-read-15m-latency">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last Fallback Reason</div>
-                                <div class="fw-semibold text-break" id="document-access-index-read-last-fallback">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last DAI Read Metric</div>
-                                <div class="fw-semibold text-break" id="document-access-index-read-last-sample">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last Cache Event</div>
-                                <div class="fw-semibold text-break" id="document-access-index-cache-last-event">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-12">
-                            <div class="alert alert-secondary small mb-0">
-                                <i class="bi bi-speedometer2 me-2" aria-hidden="true"></i>
-                                Production read metrics are lightweight in-process counters for the current app worker. Application Insights logs remain the durable fleet-wide source for fallback warnings and query failures.
-                            </div>
-                        </div>
-                        {% if enable_dai_debug %}
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last Shadow Result</div>
-                                <span class="badge text-bg-secondary" id="document-access-index-shadow-last-status">Not run</span>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Shadow Mismatches</div>
-                                <div class="fw-semibold" id="document-access-index-shadow-mismatches">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Source / Validation RU</div>
-                                <div class="fw-semibold" id="document-access-index-shadow-ru-comparison">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Validation Index RU</div>
-                                <div class="fw-semibold" id="document-access-index-shadow-validation-ru">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Candidate Read RU</div>
-                                <div class="fw-semibold" id="document-access-index-shadow-candidate-ru">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Estimated Wave 5 Savings</div>
-                                <div class="fw-semibold" id="document-access-index-shadow-wave5-ru-savings">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Source / Candidate Latency</div>
-                                <div class="fw-semibold" id="document-access-index-shadow-ms-comparison">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Estimated Wave 5 Latency</div>
-                                <div class="fw-semibold" id="document-access-index-shadow-ms-savings">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-12">
-                            <div class="alert alert-secondary small mb-0">
-                                <i class="bi bi-graph-up-arrow me-2" aria-hidden="true"></i>
-                                Rolling decision metrics aggregate shadow-validation samples over recent windows. Use these totals to compare source container RU with candidate access-index RU before enabling the future read path or Redis document access cache.
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">5m Source / Candidate RU</div>
-                                <div class="fw-semibold" id="document-access-index-rolling-5m-ru-comparison">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">5m Estimated Wave 5 Savings</div>
-                                <div class="fw-semibold" id="document-access-index-rolling-5m-wave5-ru-savings">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Source / Candidate RU</div>
-                                <div class="fw-semibold" id="document-access-index-rolling-15m-ru-comparison">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Estimated Wave 5 Savings</div>
-                                <div class="fw-semibold" id="document-access-index-rolling-15m-wave5-ru-savings">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Validation Overhead</div>
-                                <div class="fw-semibold" id="document-access-index-rolling-15m-validation-overhead">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">15m Shadow Samples</div>
-                                <div class="fw-semibold" id="document-access-index-rolling-15m-samples">Not loaded</div>
-                            </div>
-                        </div>
-                        {% endif %}
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Current Scope</div>
-                                <div class="fw-semibold" id="document-access-index-current-scope">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Completed Scopes</div>
-                                <div class="fw-semibold" id="document-access-index-completed-scopes">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Total Documents Processed</div>
-                                <div class="fw-semibold" id="document-access-index-total-processed">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Total Documents Failed</div>
-                                <div class="fw-semibold" id="document-access-index-total-failed">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Rows Upserted</div>
-                                <div class="fw-semibold" id="document-access-index-total-upserted">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Rows Deleted</div>
-                                <div class="fw-semibold" id="document-access-index-total-deleted">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last Batch Completed</div>
-                                <div class="fw-semibold text-break" id="document-access-index-last-completed">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last Error</div>
-                                <div class="fw-semibold text-break" id="document-access-index-last-error">Not loaded</div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="cosmos-maintenance-section" data-testid="cosmos-maintenance-section">
-                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
-                        <div>
-                            <h5 class="mb-1">
-                                <i class="bi bi-tools me-2"></i>Cosmos Maintenance
-                            </h5>
-                            <p class="text-muted mb-0">
-                                Review expected indexing policies and clean up stale operational cache documents without touching source configuration or user data.
-                            </p>
-                        </div>
-                        <div class="d-flex flex-wrap gap-2" role="group" aria-label="Cosmos maintenance actions">
-                            <button type="button" class="btn btn-outline-secondary btn-sm" id="cosmos-maintenance-refresh-btn">
-                                <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh Status
-                            </button>
-                            <button type="button" class="btn btn-outline-warning btn-sm" id="cosmos-indexing-policy-apply-btn" data-bs-toggle="modal" data-bs-target="#cosmosIndexingPolicyApplyModal">
-                                <i class="bi bi-lightning-charge me-1" aria-hidden="true"></i>Apply Missing Indexes
-                            </button>
-                            <button type="button" class="btn btn-outline-primary btn-sm" id="stale-cache-cleanup-dry-run-btn">
-                                <i class="bi bi-search me-1" aria-hidden="true"></i>Dry Run Cleanup
-                            </button>
-                            <button type="button" class="btn btn-outline-danger btn-sm" id="stale-cache-cleanup-apply-btn" data-bs-toggle="modal" data-bs-target="#staleCacheCleanupApplyModal">
-                                <i class="bi bi-trash3 me-1" aria-hidden="true"></i>Delete Stale Cache Docs
-                            </button>
-                        </div>
-                    </div>
-
-                    <div class="alert alert-info small mb-3">
-                        <i class="bi bi-info-circle me-2" aria-hidden="true"></i>
-                        Indexing maintenance only adds missing expected composite indexes and preserves existing policy paths. Composite indexes can increase write-index overhead while improving supported lookup and ordered-query speed. Stale cleanup is allowlisted to obsolete cache artifacts, supports dry-run review, and deletes at most one bounded batch per run.
-                    </div>
-                    <div id="cosmos-maintenance-message" class="alert alert-info d-none" role="status" aria-live="polite"></div>
-
-                    <div class="row g-3">
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Indexing Policy Status</div>
-                                <span class="badge text-bg-secondary" id="cosmos-indexing-policy-status">Not loaded</span>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Indexing Mode</div>
-                                <div class="fw-semibold" id="cosmos-indexing-policy-mode">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Containers Checked</div>
-                                <div class="fw-semibold" id="cosmos-indexing-policy-container-count">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Missing Expected Indexes</div>
-                                <div class="fw-semibold" id="cosmos-indexing-policy-missing-count">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Updated Containers</div>
-                                <div class="fw-semibold" id="cosmos-indexing-policy-updated-count">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Indexing Failures</div>
-                                <div class="fw-semibold" id="cosmos-indexing-policy-failed-count">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last Indexing Evaluation</div>
-                                <div class="fw-semibold text-break" id="cosmos-indexing-policy-last-evaluated">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Stale Cleanup Status</div>
-                                <span class="badge text-bg-secondary" id="stale-cache-cleanup-status">Not loaded</span>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Cleanup Mode</div>
-                                <div class="fw-semibold" id="stale-cache-cleanup-mode">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Cleanup Candidates</div>
-                                <div class="fw-semibold" id="stale-cache-cleanup-candidates">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Deleted Docs</div>
-                                <div class="fw-semibold" id="stale-cache-cleanup-deleted">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Cleanup Failures</div>
-                                <div class="fw-semibold" id="stale-cache-cleanup-failed">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6 col-xl-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">More Candidates</div>
-                                <div class="fw-semibold" id="stale-cache-cleanup-more-candidates">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Cleanup Categories</div>
-                                <div class="fw-semibold text-break" id="stale-cache-cleanup-categories">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-6">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last Cleanup Evaluation</div>
-                                <div class="fw-semibold text-break" id="stale-cache-cleanup-last-evaluated">Not loaded</div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="cosmosIndexingPolicyApplyModal" tabindex="-1" aria-labelledby="cosmosIndexingPolicyApplyModalLabel" aria-hidden="true">
-                    <div class="modal-dialog">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="cosmosIndexingPolicyApplyModalLabel">
-                                    <i class="bi bi-exclamation-triangle me-2"></i>Apply Missing Cosmos Indexes
-                                </h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <p>
-                                    This adds any missing expected composite indexes to the configured hot Cosmos containers. Existing included paths, excluded paths, default indexes, TTL settings, and full-text policies are preserved.
-                                </p>
-                                <p>
-                                    Composite indexes can improve lookup and ordered-query performance, but Cosmos will maintain those indexes on future writes and may temporarily run index transformation after the policy update.
-                                </p>
-                                <p class="mb-0 text-muted small">
-                                    Choose Apply only when you accept the additional write-index overhead for the faster supported query patterns shown in the maintenance status.
-                                </p>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Decline</button>
-                                <button type="button" class="btn btn-warning" id="cosmos-indexing-policy-apply-confirm-btn">
-                                    Apply Indexes
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="staleCacheCleanupApplyModal" tabindex="-1" aria-labelledby="staleCacheCleanupApplyModalLabel" aria-hidden="true">
-                    <div class="modal-dialog">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="staleCacheCleanupApplyModalLabel">
-                                    <i class="bi bi-exclamation-triangle me-2"></i>Delete Stale Cache Documents
-                                </h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <p>
-                                    This deletes only allowlisted stale cache artifacts from the settings container, such as retired conversation cache version documents and obsolete volatile cache payloads.
-                                </p>
-                                <p class="mb-0 text-muted small">
-                                    It does not delete app settings, active cache-version documents, DAI state, maintenance state, source documents, or user data. Run a dry run first if you want to review the candidate count.
-                                </p>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Cancel</button>
-                                <button type="button" class="btn btn-danger" id="stale-cache-cleanup-apply-confirm-btn">
-                                    Delete Stale Cache Docs
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                {% if enable_dai_debug %}
-                <div class="modal fade" id="documentAccessIndexResetModal" tabindex="-1" aria-labelledby="documentAccessIndexResetModalLabel" aria-hidden="true">
-                    <div class="modal-dialog">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="documentAccessIndexResetModalLabel">
-                                    <i class="bi bi-exclamation-triangle me-2"></i>Reset Document Access Backfill
-                                </h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <p>
-                                    Resetting the checkpoint makes the next batch start from the first source scope again. The operation is idempotent, but it may reprocess documents that already have projection rows.
-                                </p>
-                                <p class="mb-0 text-muted small">
-                                    This does not delete source documents or projection rows. It only resets backfill progress and immediately runs one saved-size backfill batch.
-                                </p>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Cancel</button>
-                                <button type="button" class="btn btn-danger" id="document-access-index-reset-confirm-btn">
-                                    Reset and Run Batch
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-                {% endif %}
-
-                <div class="card p-3 mb-3" id="cosmos-throughput-section" data-testid="cosmos-throughput-section">
-                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
-                        <div>
-                            <h5 class="mb-1">
-                                <i class="bi bi-speedometer2 me-2"></i>Cosmos DB Throughput
-                            </h5>
-                            <p class="text-muted mb-0">
-                                Monitor RU utilization and automatically adjust shared database or dedicated container throughput.
-                            </p>
-                        </div>
-                        <button type="button" class="btn btn-outline-info btn-sm" id="cosmos-throughput-setup-guide-btn" data-bs-toggle="modal" data-bs-target="#cosmosThroughputSetupModal">
-                            <i class="bi bi-journal-text me-1"></i>Setup Guide
-                        </button>
-                    </div>
-
-                    <div class="d-flex flex-wrap gap-2 mb-3" role="group" aria-label="Cosmos throughput actions">
-                        <button type="button" class="btn btn-outline-secondary btn-sm" id="cosmos-throughput-refresh-btn">
-                            <i class="bi bi-arrow-clockwise me-1"></i>Refresh
-                        </button>
-                        <button type="button" class="btn btn-outline-success btn-sm" id="cosmos-throughput-validate-access-btn">
-                            <i class="bi bi-shield-check me-1"></i>Validate Access
-                        </button>
-                        <button type="button" class="btn btn-outline-secondary btn-sm" id="cosmos-throughput-container-policies-btn" data-bs-toggle="modal" data-bs-target="#cosmosThroughputContainerModal">
-                            <i class="bi bi-sliders me-1"></i>Containers
-                        </button>
-                        <button type="button" class="btn btn-outline-primary btn-sm" id="cosmos-throughput-convert-autoscale-btn" title="Convert database manual throughput to Cosmos autoscale">
-                            <i class="bi bi-lightning-charge me-1"></i>Convert
-                        </button>
-                        <button type="button" class="btn btn-outline-primary btn-sm" id="cosmos-throughput-scale-up-btn">
-                            <i class="bi bi-arrow-up-circle me-1"></i>Scale Up
-                        </button>
-                        <button type="button" class="btn btn-outline-secondary btn-sm" id="cosmos-throughput-scale-down-btn">
-                            <i class="bi bi-arrow-down-circle me-1"></i>Scale Down
-                        </button>
-                    </div>
-
-                    <div class="alert alert-info small mb-3">
-                        <i class="bi bi-info-circle me-2"></i>
-                        Automation checks Cosmos throughput on the Metrics Window cadence while enabled and saves the last observed database or container view. SimpleChat can scale throughput up or down at 10,000 RU/s or lower. Above 10,000 RU/s, SimpleChat monitors utilization only; use the Azure portal for capacity changes, which can take 4 to 6 hours. Native Cosmos autoscale conversion is separate from SimpleChat scale-up and scale-down automation.
-                    </div>
-
-                    <textarea class="d-none" id="cosmos_throughput_container_policies_json" name="cosmos_throughput_container_policies_json">{{ settings.cosmos_throughput_container_policies | tojson }}</textarea>
-
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="cosmos_throughput_autoscale_enabled"
-                            name="cosmos_throughput_autoscale_enabled"
-                            {% if settings.cosmos_throughput_autoscale_enabled %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="cosmos_throughput_autoscale_enabled">
-                            Enable Cosmos throughput automation
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, a background task checks recent Cosmos DB RU utilization and scales the configured database up or down within the saved guardrails."></i>
-                    </div>
-
-                    <div id="cosmos-throughput-automation-settings" class="{% if not settings.cosmos_throughput_autoscale_enabled %}d-none{% endif %}">
-                        <div class="row g-3 mb-3">
-                            <div class="col-md-6 col-xl-3">
-                                <label for="cosmos_throughput_subscription_id" class="form-label">Subscription ID</label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="cosmos_throughput_subscription_id"
-                                    name="cosmos_throughput_subscription_id"
-                                    value="{{ settings.cosmos_throughput_subscription_id or settings.cosmos_throughput_resolved_subscription_id or '' }}"
-                                    autocomplete="off"
-                                >
-                            </div>
-                            <div class="col-md-6 col-xl-3">
-                                <label for="cosmos_throughput_resource_group" class="form-label">Resource Group</label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="cosmos_throughput_resource_group"
-                                    name="cosmos_throughput_resource_group"
-                                    value="{{ settings.cosmos_throughput_resource_group or settings.cosmos_throughput_resolved_resource_group or '' }}"
-                                    autocomplete="off"
-                                >
-                            </div>
-                            <div class="col-md-6 col-xl-3">
-                                <label for="cosmos_throughput_account_name" class="form-label">Cosmos Account</label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="cosmos_throughput_account_name"
-                                    name="cosmos_throughput_account_name"
-                                    value="{{ settings.cosmos_throughput_account_name or settings.cosmos_throughput_resolved_account_name or '' }}"
-                                    autocomplete="off"
-                                >
-                            </div>
-                            <div class="col-md-6 col-xl-3">
-                                <label for="cosmos_throughput_database_name" class="form-label">Database</label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="cosmos_throughput_database_name"
-                                    name="cosmos_throughput_database_name"
-                                    value="{{ settings.cosmos_throughput_database_name or settings.cosmos_throughput_resolved_database_name or 'SimpleChat' }}"
-                                    autocomplete="off"
-                                >
-                            </div>
-                        </div>
-
-                        <div class="border rounded p-3 mb-3">
-                            <h6 class="mb-3">Metrics Window</h6>
-                            <div class="row g-3">
-                                <div class="col-md-6 col-xl-3">
-                                    <label for="cosmos_throughput_metrics_window_minutes" class="form-label">Metrics Window</label>
-                                    <div class="input-group">
-                                        <input type="number" class="form-control" id="cosmos_throughput_metrics_window_minutes" name="cosmos_throughput_metrics_window_minutes" min="1" max="60" value="{{ settings.cosmos_throughput_metrics_window_minutes }}">
-                                        <span class="input-group-text">min</span>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="border rounded p-3 mb-3" id="cosmos-throughput-scale-up-policy">
-                            <h6 class="mb-3">Scale Up Policy</h6>
-                            <div class="row g-3 align-items-start">
-                                <div class="col-md-6 col-xl-3">
-                                    <div class="form-check form-switch mt-4 pt-2">
-                                        <input class="form-check-input" type="checkbox" id="cosmos_throughput_auto_scale_up_enabled" name="cosmos_throughput_auto_scale_up_enabled" {% if settings.cosmos_throughput_auto_scale_up_enabled %}checked{% endif %}>
-                                        <label class="form-check-label" for="cosmos_throughput_auto_scale_up_enabled">Auto scale up</label>
-                                    </div>
-                                </div>
-                                <div class="col-md-6 col-xl-3">
-                                    <label for="cosmos_throughput_scale_up_threshold_percent" class="form-label">Scale Up At</label>
-                                    <div class="input-group">
-                                        <input type="number" class="form-control" id="cosmos_throughput_scale_up_threshold_percent" name="cosmos_throughput_scale_up_threshold_percent" min="1" max="100" value="{{ settings.cosmos_throughput_scale_up_threshold_percent }}">
-                                        <span class="input-group-text">%</span>
-                                    </div>
-                                </div>
-                                <div class="col-md-6 col-xl-3">
-                                    <label for="cosmos_throughput_scale_up_step_ru" class="form-label">Scale Up Step</label>
-                                    <div class="input-group">
-                                        <input type="number" class="form-control" id="cosmos_throughput_scale_up_step_ru" name="cosmos_throughput_scale_up_step_ru" min="1000" step="1000" value="{{ settings.cosmos_throughput_scale_up_step_ru }}">
-                                        <span class="input-group-text">RU/s</span>
-                                    </div>
-                                </div>
-                                <div class="col-md-6 col-xl-3">
-                                    <label for="cosmos_throughput_scale_up_cooldown_minutes" class="form-label">Scale Up Interval</label>
-                                    <div class="input-group">
-                                        <input type="number" class="form-control" id="cosmos_throughput_scale_up_cooldown_minutes" name="cosmos_throughput_scale_up_cooldown_minutes" min="1" max="1440" value="{{ settings.cosmos_throughput_scale_up_cooldown_minutes }}">
-                                        <span class="input-group-text">min</span>
-                                    </div>
-                                </div>
-                                <div class="col-md-6 col-xl-3">
-                                    <label for="cosmos_throughput_max_ru" class="form-label">Maximum RU/s</label>
-                                    <input type="number" class="form-control" id="cosmos_throughput_max_ru" name="cosmos_throughput_max_ru" min="1000" max="10000" step="1000" value="{{ settings.cosmos_throughput_max_ru }}">
-                                    <div class="form-text">SimpleChat-managed scaling stops at 10,000 RU/s. Use the Azure portal above this limit.</div>
-                                </div>
-                                <div class="col-md-6 col-xl-3">
-                                    <div class="form-check mt-4 pt-2">
-                                        <input class="form-check-input" type="checkbox" id="cosmos_throughput_ignore_max_limit" name="cosmos_throughput_ignore_max_limit" {% if settings.cosmos_throughput_ignore_max_limit %}checked{% endif %}>
-                                        <label class="form-check-label" for="cosmos_throughput_ignore_max_limit">Ignore maximum guardrail</label>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="border rounded p-3 mb-3" id="cosmos-throughput-scale-down-policy">
-                            <h6 class="mb-3">Scale Down Policy</h6>
-                            <div class="row g-3 align-items-start">
-                                <div class="col-md-6 col-xl-3">
-                                    <div class="form-check form-switch mt-4 pt-2">
-                                        <input class="form-check-input" type="checkbox" id="cosmos_throughput_auto_scale_down_enabled" name="cosmos_throughput_auto_scale_down_enabled" {% if settings.cosmos_throughput_auto_scale_down_enabled %}checked{% endif %}>
-                                        <label class="form-check-label" for="cosmos_throughput_auto_scale_down_enabled">Auto scale down</label>
-                                    </div>
-                                </div>
-                                <div class="col-md-6 col-xl-3">
-                                    <label for="cosmos_throughput_scale_down_threshold_percent" class="form-label">Scale Down At</label>
-                                    <div class="input-group">
-                                        <input type="number" class="form-control" id="cosmos_throughput_scale_down_threshold_percent" name="cosmos_throughput_scale_down_threshold_percent" min="0" max="99" value="{{ settings.cosmos_throughput_scale_down_threshold_percent }}">
-                                        <span class="input-group-text">%</span>
-                                    </div>
-                                </div>
-                                <div class="col-md-6 col-xl-3">
-                                    <label for="cosmos_throughput_scale_down_step_ru" class="form-label">Scale Down Step</label>
-                                    <div class="input-group">
-                                        <input type="number" class="form-control" id="cosmos_throughput_scale_down_step_ru" name="cosmos_throughput_scale_down_step_ru" min="1000" step="1000" value="{{ settings.cosmos_throughput_scale_down_step_ru }}">
-                                        <span class="input-group-text">RU/s</span>
-                                    </div>
-                                </div>
-                                <div class="col-md-6 col-xl-3">
-                                    <label for="cosmos_throughput_scale_down_cooldown_minutes" class="form-label">Scale Down Interval</label>
-                                    <div class="input-group">
-                                        <input type="number" class="form-control" id="cosmos_throughput_scale_down_cooldown_minutes" name="cosmos_throughput_scale_down_cooldown_minutes" min="1" max="1440" value="{{ settings.cosmos_throughput_scale_down_cooldown_minutes }}">
-                                        <span class="input-group-text">min</span>
-                                    </div>
-                                </div>
-                                <div class="col-md-6 col-xl-3">
-                                    <label for="cosmos_throughput_min_ru" class="form-label">Minimum RU/s</label>
-                                    <input type="number" class="form-control" id="cosmos_throughput_min_ru" name="cosmos_throughput_min_ru" min="1000" step="1000" value="{{ settings.cosmos_throughput_min_ru }}">
-                                </div>
-                                <div class="col-md-6 col-xl-3">
-                                    <div class="form-check mt-4 pt-2">
-                                        <input class="form-check-input" type="checkbox" id="cosmos_throughput_ignore_min_limit" name="cosmos_throughput_ignore_min_limit" {% if settings.cosmos_throughput_ignore_min_limit %}checked{% endif %}>
-                                        <label class="form-check-label" for="cosmos_throughput_ignore_min_limit">Ignore minimum guardrail</label>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div id="cosmos-throughput-validation-message" class="alert alert-danger d-none" role="alert" aria-live="polite"></div>
-
-                        <div class="border rounded p-3 mb-3">
-                            <div class="form-check form-switch mb-3">
-                                <input
-                                    class="form-check-input"
-                                    type="checkbox"
-                                    id="cosmos_throughput_convert_manual_to_autoscale_enabled"
-                                    name="cosmos_throughput_convert_manual_to_autoscale_enabled"
-                                    {% if settings.cosmos_throughput_convert_manual_to_autoscale_enabled %}checked{% endif %}
-                                >
-                                <label class="form-check-label fw-semibold" for="cosmos_throughput_convert_manual_to_autoscale_enabled">
-                                    Convert manual throughput to Cosmos autoscale
-                                </label>
-                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, background automation converts manual database or dedicated container throughput to native Cosmos autoscale before applying RU guardrails. The autoscale max preserves the current manual RU/s rounded up to Cosmos autoscale increments."></i>
-                            </div>
-                            <div class="form-check form-switch">
-                                <input
-                                    class="form-check-input"
-                                    type="checkbox"
-                                    id="cosmos_throughput_enforce_container_defaults"
-                                    name="cosmos_throughput_enforce_container_defaults"
-                                    {% if settings.cosmos_throughput_enforce_container_defaults %}checked{% endif %}
-                                >
-                                <label class="form-check-label fw-semibold" for="cosmos_throughput_enforce_container_defaults">
-                                    Enforce global policy for all containers
-                                </label>
-                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, every dedicated-throughput container uses the global thresholds, intervals, step sizes, and guardrails above. New containers discovered later inherit the same policy automatically."></i>
-                            </div>
-                            <div class="small text-muted mt-1">
-                                Use this when container throughput should follow one standard automation policy instead of per-container overrides. Global policy also applies the Cosmos autoscale conversion setting above to current and future dedicated-throughput containers.
-                            </div>
-                        </div>
-                    </div>
-
-                    <div id="cosmos-throughput-message" class="alert d-none mt-3" role="status"></div>
-
-                    <div class="row g-3 mt-1" id="cosmos-throughput-status-panel">
-                        <div class="col-md-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Mode</div>
-                                <div class="fw-semibold" id="cosmos-throughput-mode">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Current RU/s</div>
-                                <div class="fw-semibold" id="cosmos-throughput-current-ru">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">RU Utilization</div>
-                                <div class="fw-semibold" id="cosmos-throughput-utilization">Not loaded</div>
-                            </div>
-                        </div>
-                        <div class="col-md-3">
-                            <div class="border rounded p-2 h-100">
-                                <div class="small text-muted">Last Checked</div>
-                                <div class="fw-semibold" id="cosmos-throughput-last-checked">Not loaded</div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="d-flex flex-wrap justify-content-between align-items-end gap-2 mt-3">
-                        <div class="flex-grow-1">
-                            <label for="cosmos-throughput-container-filter" class="form-label mb-1">Filter Containers</label>
-                            <div class="input-group input-group-sm">
-                                <span class="input-group-text">
-                                    <i class="bi bi-search" aria-hidden="true"></i>
-                                </span>
-                                <input
-                                    type="search"
-                                    class="form-control"
-                                    id="cosmos-throughput-container-filter"
-                                    placeholder="Filter by container name"
-                                    aria-describedby="cosmos-throughput-container-filter-count"
-                                    autocomplete="off"
-                                    data-ignore-settings-change="true"
-                                >
-                            </div>
-                        </div>
-                        <div class="d-flex flex-wrap align-items-center gap-2 mb-1">
-                            <div id="cosmos-throughput-container-filter-count" class="small text-muted" aria-live="polite"></div>
-                            <button type="button" class="btn btn-outline-secondary btn-sm" id="cosmos-throughput-refresh-table-btn">
-                                <i class="bi bi-arrow-clockwise me-1" aria-hidden="true"></i>Refresh Table
-                            </button>
-                        </div>
-                    </div>
-
-                    <div class="table-responsive mt-2" id="cosmos-throughput-metrics-table-section">
-                        <table class="table table-sm align-middle mb-0">
-                            <thead>
-                                <tr>
-                                    <th scope="col" aria-sort="ascending">
-                                        <button type="button" class="btn btn-link btn-sm p-0 text-body text-decoration-none cosmos-throughput-container-sort" data-sort-field="container_name" aria-label="Sort containers by container name">
-                                            Container <i class="bi bi-arrow-up-short ms-1" aria-hidden="true"></i>
-                                        </button>
-                                    </th>
-                                    <th scope="col">Mode</th>
-                                    <th scope="col" aria-sort="none">
-                                        <button type="button" class="btn btn-link btn-sm p-0 text-body text-decoration-none cosmos-throughput-container-sort" data-sort-field="current_ru" aria-label="Sort containers by current RU/s">
-                                            Current RU/s <i class="bi bi-arrow-down-up ms-1" aria-hidden="true"></i>
-                                        </button>
-                                    </th>
-                                    <th scope="col" aria-sort="none">
-                                        <button type="button" class="btn btn-link btn-sm p-0 text-body text-decoration-none cosmos-throughput-container-sort" data-sort-field="ru_utilization" aria-label="Sort containers by RU utilization">
-                                            RU Utilization <i class="bi bi-arrow-down-up ms-1" aria-hidden="true"></i>
-                                        </button>
-                                        <i class="bi bi-info-circle ms-1" data-bs-toggle="tooltip" title="Highest normalized RU percentage Azure Monitor reported for the selected window. If that metric is not available, SimpleChat estimates average utilization from request units divided by current RU/s."></i>
-                                    </th>
-                                    <th scope="col" aria-sort="none">
-                                        <button type="button" class="btn btn-link btn-sm p-0 text-body text-decoration-none cosmos-throughput-container-sort" data-sort-field="request_units" aria-label="Sort containers by request units">
-                                            Request Units <i class="bi bi-arrow-down-up ms-1" aria-hidden="true"></i>
-                                        </button>
-                                        <i class="bi bi-info-circle ms-1" data-bs-toggle="tooltip" title="Total request units consumed during the selected metrics window. This is consumption volume, not a percentage."></i>
-                                    </th>
-                                    <th scope="col" aria-sort="none">
-                                        <button type="button" class="btn btn-link btn-sm p-0 text-body text-decoration-none cosmos-throughput-container-sort" data-sort-field="policy" aria-label="Sort containers by policy">
-                                            Policy <i class="bi bi-arrow-down-up ms-1" aria-hidden="true"></i>
-                                        </button>
-                                    </th>
-                                    <th scope="col">Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody id="cosmos-throughput-containers-body">
-                                <tr>
-                                    <td colspan="7" class="text-muted">Refresh to load Cosmos metrics.</td>
-                                </tr>
-                            </tbody>
-                        </table>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="cosmosThroughputSetupModal" tabindex="-1" aria-labelledby="cosmosThroughputSetupModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="cosmosThroughputSetupModalLabel">
-                                    <i class="bi bi-journal-text me-2"></i>Cosmos Throughput Setup Guide
-                                </h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-info small mb-3">
-                                    Validate Access runs the same read checks automation depends on using the current form values: resource identity, Azure Resource Manager throughput reads, container discovery, and Azure Monitor metrics.
-                                </div>
-                                <div class="mb-3">
-                                    <h6>Required Azure Access</h6>
-                                    <ul class="mb-0">
-                                        <li>Assign roles to the Azure App Service managed identity service principal, not the Microsoft Entra sign-in app registration. In the Azure portal, open the Web App, select Identity, copy the Object (principal) ID, then find the matching Enterprise Application if you need to inspect it in Microsoft Entra ID.</li>
-                                        <li>For SimpleChat deployments, assign the custom <code>SimpleChat Cosmos Throughput Operator</code> role to that web app identity at the resource group scope that contains the Cosmos DB account, or directly at the Cosmos account scope.</li>
-                                        <li>The custom role must include management-plane actions to read the Cosmos account, database, and containers; read and write SQL database and container <code>throughputSettings</code>; run <code>migrateToAutoscale</code>; read throughput operation results; and read <code>Microsoft.Insights/metrics</code>.</li>
-                                        <li>If the custom role is not available, assign equivalent custom RBAC permissions. Broad built-in roles such as Contributor can validate access, but are not the preferred least-privilege configuration.</li>
-                                    </ul>
-                                </div>
-                                <div class="mb-3">
-                                    <h6>Capacity Scope</h6>
-                                    <ul class="mb-0">
-                                        <li>Database mode scales the shared <code>SimpleChat</code> database throughput.</li>
-                                        <li>Container-targeted mode scales only containers with dedicated throughput.</li>
-                                        <li>Containers that inherit shared database throughput are visible but not individually scalable.</li>
-                                        <li>Manual throughput can be converted to native Cosmos autoscale only when the admin enables conversion globally or for the container policy.</li>
-                                    </ul>
-                                </div>
-                                <div>
-                                    <h6>Metrics</h6>
-                                    <ul class="mb-0">
-                                        <li>RU Utilization is a percentage of available throughput for the selected metrics window.</li>
-                                        <li>Request Units is the total RU volume consumed during the selected metrics window.</li>
-                                        <li>Azure Monitor metrics can lag by a few minutes after traffic changes.</li>
-                                    </ul>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
-                                <button type="button" class="btn btn-primary" id="cosmos-throughput-run-setup-test-btn" data-bs-dismiss="modal">
-                                    <i class="bi bi-shield-check me-1"></i>Validate Access
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="cosmosThroughputContainerModal" tabindex="-1" aria-labelledby="cosmosThroughputContainerModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="cosmosThroughputContainerModalLabel">
-                                    <i class="bi bi-sliders me-2"></i>Container Throughput Policies
-                                </h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="alert alert-info small mb-3">
-                                    Dedicated container throughput is controlled per row unless global policy enforcement is enabled. Containers using shared database throughput are shown for visibility, but cannot be scaled or converted individually until they have dedicated throughput. Containers above 10,000 RU/s are monitor-only in SimpleChat; change their capacity in the Azure portal and plan for a 4 to 6 hour provisioning window.
-                                </div>
-                                <div class="d-flex flex-wrap justify-content-between align-items-end gap-2 mb-3">
-                                    <div class="flex-grow-1">
-                                        <label for="cosmos-throughput-container-policy-filter" class="form-label mb-1">Filter Container Policies</label>
-                                        <div class="input-group input-group-sm">
-                                            <span class="input-group-text">
-                                                <i class="bi bi-search" aria-hidden="true"></i>
-                                            </span>
-                                            <input
-                                                type="search"
-                                                class="form-control"
-                                                id="cosmos-throughput-container-policy-filter"
-                                                placeholder="Filter by container name"
-                                                aria-describedby="cosmos-throughput-container-policy-filter-count"
-                                                autocomplete="off"
-                                                data-ignore-settings-change="true"
-                                            >
-                                        </div>
-                                    </div>
-                                    <div id="cosmos-throughput-container-policy-filter-count" class="small text-muted mb-1" aria-live="polite"></div>
-                                </div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Container</th>
-                                                <th scope="col">Enabled</th>
-                                                <th scope="col">Scale Up</th>
-                                                <th scope="col">Scale Down</th>
-                                                <th scope="col">Cosmos Autoscale</th>
-                                                <th scope="col">Min RU/s</th>
-                                                <th scope="col">Max RU/s</th>
-                                                <th scope="col">Manual</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="cosmos-throughput-container-policies-body">
-                                            <tr>
-                                                <td colspan="8" class="text-muted">Refresh Cosmos throughput status to load containers.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-primary" id="cosmos-throughput-apply-global-policy-btn">
-                                    <i class="bi bi-arrow-repeat me-1"></i>Apply Global Policy
-                                </button>
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
-                                <button type="button" class="btn btn-primary" id="cosmos-throughput-save-container-policies-btn" data-bs-dismiss="modal">
-                                    Save Container Policies
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <!-- Front Door Configuration Card -->
-                <div class="card p-3 mb-3" id="front-door-section">
-                    <div class="d-flex justify-content-between align-items-center mb-2">
-                        <h5 class="mb-0">
-                            <i class="bi bi-globe me-2"></i>Front Door
-                        </h5>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#frontDoorInfoModal">
-                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
-                        </button>
-                    </div>
-                    <p class="text-muted mb-1">Configure Front Door URL for authentication and redirect flows.</p>
-
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            class="form-check-input"
-                            type="checkbox"
-                            id="enable_front_door"
-                            name="enable_front_door"
-                            {% if settings.enable_front_door %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_front_door">
-                            Enable Front Door Support
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable Azure Front Door integration for global load balancing, SSL termination, and improved performance with custom domain support."></i>
-                    </div>
-
-                    <div class="mb-3" id="front-door-url-settings">
-                        <label for="front_door_url" class="form-label">Front Door URL</label>
-                        <input type="url" class="form-control" id="front_door_url" name="front_door_url"
-                               value="{{ settings.front_door_url or '' }}"
-                               placeholder="https://your-frontdoor.azurefd.net">
-                        <small class="form-text text-muted">
-                            The base URL of your Front Door or load balancer. The system will automatically generate:
-                            <ul class="mb-0 mt-1">
-                                <li><strong>Home redirect:</strong> <code id="home-url-preview">https://your-frontdoor.azurefd.net</code></li>
-                                <li><strong>OAuth2 redirect:</strong> <code id="oauth-url-preview">https://your-frontdoor.azurefd.net/getAToken</code></li>
-                            </ul>
-                        </small>
-                    </div>
-                </div>
-            </div>
-
-
-            <div class="tab-pane fade" id="workspace-identities" role="tabpanel" aria-labelledby="workspace-identities-tab">
-                <div class="card mb-3 p-3" id="workspace-identities-section">
-                    <div
-                        id="global-workspace-identities-root"
-                        data-workspace-identity-root="true"
-                        data-identity-api-base="/api/admin/workspace-identities/global"
-                        data-default-capability="action"
-                        data-capability-options="file_sync,action"
-                        data-auth-type-options="username_password,api_key,bearer_token,client_secret,connection_string,managed_identity"
-                    ></div>
-                </div>
-            </div>
-
-
-            <div class="tab-pane fade" id="file-sync" role="tabpanel" aria-labelledby="file-sync-tab">
-                <p class="text-muted">
-                    Configure file synchronization for personal, group, and public workspaces.
-                </p>
-
-                <div class="card mb-3 p-3" id="file-sync-section">
-                    <div class="d-flex flex-wrap justify-content-between align-items-center gap-2 mb-2">
-                        <h5 class="mb-0">
-                            <i class="bi bi-arrow-repeat me-2"></i>File Sync
-                        </h5>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#file-sync-app-role-setup-modal">
-                            <i class="bi bi-info-circle me-1"></i>App Role Setup
-                        </button>
-                    </div>
-                    <p class="text-muted">
-                        Enable File Sync globally, set conservative run limits, and choose whether workspace managers or SimpleChat admins manage sync sources.
-                    </p>
-
-                    <div class="alert alert-warning" role="alert">
-                        File Sync can scan large remote shares and create many document versions. Start with narrow filters, conservative schedules, and low per-run limits before enabling broad workspace access.
-                    </div>
-
-                    {% if not settings.file_sync_redis_ready %}
-                    <div class="alert alert-danger" role="alert">
-                        Redis Cache must be enabled and configured before File Sync can run. Saved File Sync settings remain inactive until Redis is ready.
-                    </div>
-                    {% elif settings.requested_enable_file_sync and not settings.file_sync_effective_enabled %}
-                    <div class="alert alert-warning" role="alert">
-                        File Sync is saved as requested but is not currently active. Check Redis configuration and scope controls.
-                    </div>
-                    {% endif %}
-
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_file_sync"
-                            name="enable_file_sync"
-                            {% if settings.requested_enable_file_sync %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_file_sync">
-                            Enable File Sync
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Enable File Sync source management and sync runs for allowed workspaces. Redis Cache is required before sync is active."></i>
-                    </div>
-
-                    <div id="file_sync_settings" class="{% if not settings.requested_enable_file_sync %}d-none{% endif %}">
-                        <div class="row g-3 mb-3">
-                            <div class="col-md-3">
-                                <label for="file_sync_max_sources_per_scope" class="form-label">Max Sources</label>
-                                <input type="number" class="form-control" id="file_sync_max_sources_per_scope" name="file_sync_max_sources_per_scope" min="1" max="100" value="{{ settings.file_sync_max_sources_per_scope }}">
-                            </div>
-                            <div class="col-md-3">
-                                <label for="file_sync_min_schedule_interval_minutes" class="form-label">Min Schedule Minutes</label>
-                                <input type="number" class="form-control" id="file_sync_min_schedule_interval_minutes" name="file_sync_min_schedule_interval_minutes" min="5" max="1440" value="{{ settings.file_sync_min_schedule_interval_minutes }}">
-                            </div>
-                            <div class="col-md-3">
-                                <label for="file_sync_max_files_per_run" class="form-label">Max Files Per Run</label>
-                                <input type="number" class="form-control" id="file_sync_max_files_per_run" name="file_sync_max_files_per_run" min="1" max="100000" value="{{ settings.file_sync_max_files_per_run }}">
-                            </div>
-                            <div class="col-md-3">
-                                <label for="file_sync_max_gb_per_run" class="form-label">Max GB Per Run</label>
-                                <input type="number" class="form-control" id="file_sync_max_gb_per_run" name="file_sync_max_gb_per_run" min="1" value="{{ settings.file_sync_max_gb_per_run }}">
-                            </div>
-                        </div>
-
-                        <div class="row g-3 mb-4">
-                            <div class="col-md-4">
-                                <label for="file_sync_max_concurrent_runs" class="form-label">Max Concurrent Runs</label>
-                                <input type="number" class="form-control" id="file_sync_max_concurrent_runs" name="file_sync_max_concurrent_runs" min="1" max="25" value="{{ settings.file_sync_max_concurrent_runs }}">
-                            </div>
-                            <div class="col-md-4 d-flex align-items-end">
-                                <div class="form-check form-switch mb-2">
-                                    <input type="checkbox" class="form-check-input" id="file_sync_allow_recursive_sources" name="file_sync_allow_recursive_sources" {% if settings.file_sync_allow_recursive_sources %}checked{% endif %}>
-                                    <label class="form-check-label" for="file_sync_allow_recursive_sources">Allow Recursive Sources</label>
-                                </div>
-                            </div>
-                        </div>
-
-                        {% set file_sync_visible_source_types = settings.file_sync_visible_source_types|default(['smb', 'azure_files']) %}
-                        <div class="border rounded p-3 mb-4">
-                            <h6 class="mb-2"><i class="bi bi-sliders me-2"></i>Visible Source Types</h6>
-                            <p class="text-muted small mb-3">
-                                Choose which source types appear in the Add Source workflow. OneDrive, SharePoint, and Google Workspace connectors are coming soon while validation continues.
-                            </p>
-                            <div class="row g-3">
-                                <div class="col-md-4">
-                                    <div class="form-check">
-                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_smb" name="file_sync_visible_source_types" value="smb" {% if 'smb' in file_sync_visible_source_types %}checked{% endif %}>
-                                        <label class="form-check-label" for="file_sync_visible_source_type_smb">SMB Share</label>
-                                        <div class="form-text">Available now.</div>
-                                    </div>
-                                </div>
-                                <div class="col-md-4">
-                                    <div class="form-check">
-                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_azure_files" name="file_sync_visible_source_types" value="azure_files" {% if 'azure_files' in file_sync_visible_source_types %}checked{% endif %}>
-                                        <label class="form-check-label" for="file_sync_visible_source_type_azure_files">Azure Files</label>
-                                        <div class="form-text">Available now.</div>
-                                    </div>
-                                </div>
-                                <div class="col-md-4">
-                                    <div class="form-check">
-                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_azure_blob" name="file_sync_visible_source_types" value="azure_blob" {% if 'azure_blob' in file_sync_visible_source_types %}checked{% endif %}>
-                                        <label class="form-check-label" for="file_sync_visible_source_type_azure_blob">Azure Blob Storage</label>
-                                        <div class="form-text">Available now.</div>
-                                    </div>
-                                </div>
-                                <div class="col-md-4">
-                                    <div class="form-check">
-                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_onedrive" value="onedrive" disabled>
-                                        <label class="form-check-label" for="file_sync_visible_source_type_onedrive">OneDrive</label>
-                                        <div class="form-text">Coming Soon.</div>
-                                    </div>
-                                </div>
-                                <div class="col-md-4">
-                                    <div class="form-check">
-                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_sharepoint_on_prem" value="sharepoint_on_prem" disabled>
-                                        <label class="form-check-label" for="file_sync_visible_source_type_sharepoint_on_prem">On-prem SharePoint</label>
-                                        <div class="form-text">Coming Soon.</div>
-                                    </div>
-                                </div>
-                                <div class="col-md-4">
-                                    <div class="form-check">
-                                        <input type="checkbox" class="form-check-input" id="file_sync_visible_source_type_google_workspace" value="google_workspace" disabled>
-                                        <label class="form-check-label" for="file_sync_visible_source_type_google_workspace">Google Workspace</label>
-                                        <div class="form-text">Coming Soon.</div>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="alert alert-info mb-4" role="alert">
-                            <div class="fw-semibold mb-1">Cloud drive connector identities</div>
-                            <div class="small">
-                                OneDrive, SharePoint, and Google Workspace File Sync connectors are coming soon. Any existing global connector identities can remain configured for future use.
-                            </div>
-                        </div>
-
-                        <div class="row g-3">
-                            <div class="col-12">
-                                <div class="border rounded h-100 p-3" data-testid="file-sync-personal-card">
-                                    <h6 class="mb-3"><i class="bi bi-person me-2"></i>Personal Workspace Sync</h6>
-                                    <div class="form-check form-switch mb-3">
-                                        <input type="checkbox" class="form-check-input" id="enable_file_sync_personal" name="enable_file_sync_personal" {% if settings.enable_file_sync_personal %}checked{% endif %}>
-                                        <label class="form-check-label" for="enable_file_sync_personal">Enable personal sync</label>
-                                    </div>
-                                    <div class="form-check form-switch mb-3">
-                                        <input type="checkbox" class="form-check-input" id="file_sync_personal_admin_only" name="file_sync_personal_admin_only" {% if settings.file_sync_personal_admin_only %}checked{% endif %}>
-                                        <label class="form-check-label" for="file_sync_personal_admin_only">Admins manage sources only</label>
-                                    </div>
-                                    <div class="form-check form-switch mb-2">
-                                        <input type="checkbox" class="form-check-input" id="file_sync_personal_require_app_role" name="file_sync_personal_require_app_role" {% if settings.file_sync_personal_require_app_role %}checked{% endif %}>
-                                        <label class="form-check-label" for="file_sync_personal_require_app_role">Require PersonalFileSyncUser App Role</label>
-                                    </div>
-                                    <div class="form-text mb-3">Required app role value: <code>PersonalFileSyncUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement for personal sync.</div>
-                                    <hr />
-                                    <div data-file-sync-admin-target data-scope="personal" data-search-endpoint="/api/admin/file-sync/users/search" data-results-key="users" data-value-field="id" data-title-field="displayName" data-subtitle-field="email">
-                                        <label class="form-label" for="file-sync-admin-personal-target-query">Manage User Sources</label>
-                                        <div class="input-group mb-2">
-                                            <input type="search" class="form-control" id="file-sync-admin-personal-target-query" data-file-sync-admin-target-query placeholder="Search user" aria-label="Search user to manage" />
-                                            <button class="btn btn-outline-secondary" type="button" data-file-sync-admin-target-search>Search</button>
-                                        </div>
-                                        <div class="list-group small mb-2 d-none" data-file-sync-admin-target-results></div>
-                                        <div class="input-group">
-                                            <input type="text" class="form-control" data-file-sync-admin-target-id placeholder="User ID" aria-label="Target user ID" />
-                                            <button class="btn btn-primary" type="button" data-file-sync-admin-target-manage disabled>Manage Sources</button>
-                                        </div>
-                                        <div class="form-text" data-file-sync-admin-target-label>No user selected.</div>
-                                    </div>
-                                </div>
-                            </div>
-
-                            <div class="col-12">
-                                <div class="border rounded h-100 p-3" data-testid="file-sync-group-card">
-                                    <h6 class="mb-3"><i class="bi bi-people me-2"></i>Group Workspace Sync</h6>
-                                    <div class="form-check form-switch mb-3">
-                                        <input type="checkbox" class="form-check-input" id="enable_file_sync_group" name="enable_file_sync_group" {% if settings.enable_file_sync_group %}checked{% endif %}>
-                                        <label class="form-check-label" for="enable_file_sync_group">Enable group sync</label>
-                                    </div>
-                                    <div class="form-check form-switch mb-3">
-                                        <input type="checkbox" class="form-check-input" id="file_sync_group_admin_only" name="file_sync_group_admin_only" {% if settings.file_sync_group_admin_only %}checked{% endif %}>
-                                        <label class="form-check-label" for="file_sync_group_admin_only">Admins manage sources only</label>
-                                    </div>
-                                    <div class="form-check form-switch mb-2">
-                                        <input type="checkbox" class="form-check-input" id="require_group_assignment_for_file_sync" name="require_group_assignment_for_file_sync" {% if settings.require_group_assignment_for_file_sync %}checked{% endif %}>
-                                        <label class="form-check-label" for="require_group_assignment_for_file_sync">Require Group Assignment to Use File Sync</label>
-                                    </div>
-                                    <div class="d-flex flex-wrap align-items-center gap-2 mb-3">
-                                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-sync-groups-btn" data-bs-toggle="modal" data-bs-target="#fileSyncGroupAssignmentModal">
-                                            <i class="bi bi-people me-1"></i>Manage Groups
-                                        </button>
-                                        <span class="text-muted small" id="file-sync-group-assignment-summary">No groups assigned.</span>
-                                    </div>
-                                    <textarea class="d-none" id="file_sync_allowed_group_ids" name="file_sync_allowed_group_ids">{{ settings.file_sync_allowed_group_ids|default([], true)|tojson }}</textarea>
-                                    <hr />
-                                    <div data-file-sync-admin-target data-scope="group" data-search-endpoint="/api/admin/file-sync/groups/search" data-results-key="groups" data-value-field="id" data-title-field="name" data-subtitle-field="description">
-                                        <label class="form-label" for="file-sync-admin-group-target-query">Manage Group Sources</label>
-                                        <div class="input-group mb-2">
-                                            <input type="search" class="form-control" id="file-sync-admin-group-target-query" data-file-sync-admin-target-query placeholder="Search group" aria-label="Search group to manage" />
-                                            <button class="btn btn-outline-secondary" type="button" data-file-sync-admin-target-search>Search</button>
-                                        </div>
-                                        <div class="list-group small mb-2 d-none" data-file-sync-admin-target-results></div>
-                                        <div class="input-group">
-                                            <input type="text" class="form-control" data-file-sync-admin-target-id placeholder="Group ID" aria-label="Target group ID" />
-                                            <button class="btn btn-primary" type="button" data-file-sync-admin-target-manage disabled>Manage Sources</button>
-                                        </div>
-                                        <div class="form-text" data-file-sync-admin-target-label>No group selected.</div>
-                                    </div>
-                                </div>
-                            </div>
-
-                            <div class="col-12">
-                                <div class="border rounded h-100 p-3" data-testid="file-sync-public-card">
-                                    <h6 class="mb-3"><i class="bi bi-globe me-2"></i>Public Workspace Sync</h6>
-                                    <div class="form-check form-switch mb-3">
-                                        <input type="checkbox" class="form-check-input" id="enable_file_sync_public" name="enable_file_sync_public" {% if settings.enable_file_sync_public %}checked{% endif %}>
-                                        <label class="form-check-label" for="enable_file_sync_public">Enable public sync</label>
-                                    </div>
-                                    <div class="form-check form-switch mb-3">
-                                        <input type="checkbox" class="form-check-input" id="file_sync_public_admin_only" name="file_sync_public_admin_only" {% if settings.file_sync_public_admin_only %}checked{% endif %}>
-                                        <label class="form-check-label" for="file_sync_public_admin_only">Admins manage sources only</label>
-                                    </div>
-                                    <div class="form-check form-switch mb-2">
-                                        <input type="checkbox" class="form-check-input" id="require_public_workspace_assignment_for_file_sync" name="require_public_workspace_assignment_for_file_sync" {% if settings.require_public_workspace_assignment_for_file_sync %}checked{% endif %}>
-                                        <label class="form-check-label" for="require_public_workspace_assignment_for_file_sync">Require Public Workspace Assignment to Use File Sync</label>
-                                    </div>
-                                    <div class="d-flex flex-wrap align-items-center gap-2 mb-3">
-                                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-sync-public-workspaces-btn" data-bs-toggle="modal" data-bs-target="#fileSyncPublicWorkspaceAssignmentModal">
-                                            <i class="bi bi-globe me-1"></i>Manage Public Workspaces
-                                        </button>
-                                        <span class="text-muted small" id="file-sync-public-workspace-assignment-summary">No public workspaces assigned.</span>
-                                    </div>
-                                    <textarea class="d-none" id="file_sync_allowed_public_workspace_ids" name="file_sync_allowed_public_workspace_ids">{{ settings.file_sync_allowed_public_workspace_ids|default([], true)|tojson }}</textarea>
-                                    <hr />
-                                    <div data-file-sync-admin-target data-scope="public" data-search-endpoint="/api/admin/file-sync/public-workspaces/search" data-results-key="workspaces" data-value-field="id" data-title-field="name" data-subtitle-field="description">
-                                        <label class="form-label" for="file-sync-admin-public-target-query">Manage Public Workspace Sources</label>
-                                        <div class="input-group mb-2">
-                                            <input type="search" class="form-control" id="file-sync-admin-public-target-query" data-file-sync-admin-target-query placeholder="Search public workspace" aria-label="Search public workspace to manage" />
-                                            <button class="btn btn-outline-secondary" type="button" data-file-sync-admin-target-search>Search</button>
-                                        </div>
-                                        <div class="list-group small mb-2 d-none" data-file-sync-admin-target-results></div>
-                                        <div class="input-group">
-                                            <input type="text" class="form-control" data-file-sync-admin-target-id placeholder="Public workspace ID" aria-label="Target public workspace ID" />
-                                            <button class="btn btn-primary" type="button" data-file-sync-admin-target-manage disabled>Manage Sources</button>
-                                        </div>
-                                        <div class="form-text" data-file-sync-admin-target-label>No public workspace selected.</div>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="form-text mt-3">
-                            SMB source credentials are stored in Azure Key Vault when Key Vault secret storage is enabled; otherwise they use the app's existing encrypted settings path.
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="file-sync-admin-manager-modal" tabindex="-1" aria-labelledby="file-sync-admin-manager-title" aria-hidden="true">
-                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title" id="file-sync-admin-manager-title">Manage File Sync Sources</h5>
-                                    <div class="text-muted small" id="file-sync-admin-manager-context"></div>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div id="file-sync-admin-manager-container"></div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="fileSyncGroupAssignmentModal" tabindex="-1" aria-labelledby="fileSyncGroupAssignmentModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title mb-0" id="fileSyncGroupAssignmentModalLabel">File Sync Group Assignments</h5>
-                                    <small class="text-muted">Choose which groups can use File Sync when group assignment is required.</small>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="row g-2 align-items-end mb-3">
-                                    <div class="col">
-                                        <label for="file-sync-group-assignment-search" class="form-label">Search Groups</label>
-                                        <input type="search" class="form-control" id="file-sync-group-assignment-search" placeholder="Search by group name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
-                                    </div>
-                                    <div class="col-auto">
-                                        <button type="button" class="btn btn-outline-primary" id="file-sync-group-assignment-search-btn">
-                                            <i class="bi bi-search me-1"></i>Search
-                                        </button>
-                                    </div>
-                                </div>
-                                <div class="alert alert-danger d-none" id="file-sync-group-assignment-error"></div>
-                                <div class="small text-muted mb-2" id="file-sync-group-assignment-status">No groups loaded.</div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Group</th>
-                                                <th scope="col">Description</th>
-                                                <th scope="col" class="text-end">Assignment</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="file-sync-group-assignment-body">
-                                            <tr>
-                                                <td colspan="3" class="text-center text-muted py-3">Search for groups to assign.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="fileSyncPublicWorkspaceAssignmentModal" tabindex="-1" aria-labelledby="fileSyncPublicWorkspaceAssignmentModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title mb-0" id="fileSyncPublicWorkspaceAssignmentModalLabel">File Sync Public Workspace Assignments</h5>
-                                    <small class="text-muted">Choose which public workspaces can use File Sync when public workspace assignment is required.</small>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="row g-2 align-items-end mb-3">
-                                    <div class="col">
-                                        <label for="file-sync-public-workspace-assignment-search" class="form-label">Search Public Workspaces</label>
-                                        <input type="search" class="form-control" id="file-sync-public-workspace-assignment-search" placeholder="Search by public workspace name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
-                                    </div>
-                                    <div class="col-auto">
-                                        <button type="button" class="btn btn-outline-primary" id="file-sync-public-workspace-assignment-search-btn">
-                                            <i class="bi bi-search me-1"></i>Search
-                                        </button>
-                                    </div>
-                                </div>
-                                <div class="alert alert-danger d-none" id="file-sync-public-workspace-assignment-error"></div>
-                                <div class="small text-muted mb-2" id="file-sync-public-workspace-assignment-status">Enter at least 2 characters to search.</div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Public Workspace</th>
-                                                <th scope="col">Description</th>
-                                                <th scope="col" class="text-end">Assignment</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="file-sync-public-workspace-assignment-body">
-                                            <tr>
-                                                <td colspan="3" class="text-center text-muted py-3">Search for public workspaces to assign.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="file-sync-app-role-setup-modal" tabindex="-1" aria-labelledby="file-sync-app-role-setup-title" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="file-sync-app-role-setup-title">Personal File Sync App Role Setup</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <p class="text-muted">
-                                    Create the personal File Sync app role on the SimpleChat app registration, then assign users or groups to the role in the Enterprise App before enabling the personal require-role toggle.
-                                </p>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Capability</th>
-                                                <th scope="col">App role value</th>
-                                                <th scope="col">Typical assignment</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody>
-                                            <tr>
-                                                <td>Personal File Sync</td>
-                                                <td><code>PersonalFileSyncUser</code></td>
-                                                <td>Users allowed to manage personal sync sources</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                                <ol class="mb-0">
-                                    <li>Open Microsoft Entra admin center and edit the SimpleChat app registration.</li>
-                                    <li>Add the app role with allowed member type <strong>Users/Groups</strong> and value exactly matching the table.</li>
-                                    <li>Open the Enterprise App for SimpleChat and assign users or groups to the app role.</li>
-                                    <li>Have affected users sign out and sign back in so their role claims refresh.</li>
-                                </ol>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-            </div>
-
-            <div class="tab-pane fade" id="workspaces" role="tabpanel" aria-labelledby="workspaces-tab">
-                <p class="text-muted">
-                    Configure workspace settings like personal/group access, multimedia support, metadata, and document classification.
-                </p>
-
-
-                <div class="card mb-3 p-3" id="personal-workspaces-section">
-                    <h5>
-                        <i class="bi bi-person me-2"></i>Personal Workspaces
-                    </h5>
-                    <p class="text-muted">
-                        Turn this on to allow access and management of your personal workspace.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_user_workspace"
-                            name="enable_user_workspace"
-                            {% if settings.enable_user_workspace %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_user_workspace">
-                            Enable Personal Workspaces
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage their own private workspaces for document storage, knowledge bases, and personal AI interactions."></i>
-                    </div>
-                </div>
-
-                <div class="card mb-3 p-3" id="workflow-settings-section">
-                    <h5>
-                        <i class="bi bi-diagram-3 me-2"></i>Workflow
-                    </h5>
-                    <p class="text-muted">
-                        Control personal and group workflow authoring and execution for users.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="allow_user_workflows"
-                            name="allow_user_workflows"
-                            {% if settings.allow_user_workflows %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="allow_user_workflows">
-                            Enable Personal Workflows
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create personal workflows that run a selected agent or model manually or on an interval schedule."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_workflow_user"
-                            name="require_member_of_workflow_user"
-                            {% if settings.require_member_of_workflow_user %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_member_of_workflow_user">
-                            Require WorkflowUser App Role
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Require the WorkflowUser Enterprise App role before users can open, create, edit, run, or inspect personal workflows."></i>
-                    </div>
-                    <p class="text-muted small mb-0">
-                        Required app role value: <code>WorkflowUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement.
-                    </p>
-
-                    <div class="form-group mt-3 mb-3">
-                        <label for="workflow_max_auto_invoke_attempts" class="form-label">
-                            Workflow Agent Action Limit
-                        </label>
-                        <input type="number"
-                            class="form-control"
-                            id="workflow_max_auto_invoke_attempts"
-                            name="workflow_max_auto_invoke_attempts"
-                            min="1"
-                            max="500"
-                            step="1"
-                            value="{{ settings.workflow_max_auto_invoke_attempts|default(60, true) }}">
-                        <div class="form-text">
-                            Maximum automatic tool or action calls an agent can make during one workflow run. Default is 60; increase for large document sets.
-                        </div>
-                        <div class="alert alert-warning small mb-0 mt-2" role="alert">
-                            Values above 100 are capacity-sensitive. Enable Cosmos DB Throughput automation in SimpleChat so the app can monitor RU pressure and scale up Cosmos when needed, and also monitor Azure OpenAI throttling, App Service CPU and memory, and downstream service latency.
-                        </div>
-                    </div>
-
-                    <div class="form-group mt-3 mb-3">
-                        <label for="workflow_max_tasks" class="form-label">
-                            Workflow Task Limit
-                        </label>
-                        <input type="number"
-                            class="form-control"
-                            id="workflow_max_tasks"
-                            name="workflow_max_tasks"
-                            min="1"
-                            max="100"
-                            step="1"
-                            value="{{ settings.workflow_max_tasks|default(50, true) }}">
-                        <div class="form-text">
-                            Maximum ordered instruction tasks users can add to one workflow. Default is 50; supported range is 1-100.
-                        </div>
-                    </div>
-
-                    <hr>
-
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="allow_group_workflows"
-                            name="allow_group_workflows"
-                            {% if settings.allow_group_workflows %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="allow_group_workflows">
-                            Enable Group Workflows
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow permitted group members to create, manage, and run workflows from group workspaces."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_group_assignment_for_group_workflows"
-                            name="require_group_assignment_for_group_workflows"
-                            {% if settings.require_group_assignment_for_group_workflows %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_group_assignment_for_group_workflows">
-                            Require Group Assignment to Use Workflow
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only groups selected in Manage Groups can create, manage, or run group workflows."></i>
-                    </div>
-                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
-                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-group-workflow-groups-btn" data-bs-toggle="modal" data-bs-target="#groupWorkflowAssignmentModal">
-                            <i class="bi bi-people me-1"></i>Manage Groups
-                        </button>
-                        <span class="text-muted small" id="group-workflow-assignment-summary">No groups assigned.</span>
-                    </div>
-                    <textarea class="d-none" id="group_workflow_allowed_group_ids" name="group_workflow_allowed_group_ids">{{ settings.group_workflow_allowed_group_ids|default([], true)|tojson }}</textarea>
-                    <p class="text-muted small mb-0">
-                        Group workflow authoring is available to group Owners and Admins by default. Enable the owner-only setting below to limit group agent, action, and workflow management to Owners.
-                    </p>
-                </div>
-
-                <div class="card mb-3 p-3" id="file-download-settings-section">
-                    <h5>
-                        <i class="bi bi-download me-2"></i>File Downloads
-                    </h5>
-                    <p class="text-muted">
-                        Control when users can download original workspace document files from personal, group, and public workspaces.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="allow_personal_workspace_file_downloads"
-                            name="allow_personal_workspace_file_downloads"
-                            {% if settings.allow_personal_workspace_file_downloads %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="allow_personal_workspace_file_downloads">
-                            Enable Personal Workspace Downloads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to download original files from their personal workspace document menus and bulk selection bar."></i>
-                    </div>
-                    <hr>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="allow_group_workspace_file_downloads"
-                            name="allow_group_workspace_file_downloads"
-                            {% if settings.allow_group_workspace_file_downloads %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="allow_group_workspace_file_downloads">
-                            Enable Group Workspace Downloads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow group workspace document downloads when global policy and each group's local setting allow it."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_group_assignment_for_file_downloads"
-                            name="require_group_assignment_for_file_downloads"
-                            {% if settings.require_group_assignment_for_file_downloads %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_group_assignment_for_file_downloads">
-                            Require Group Assignment for Downloads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only groups selected in Manage Groups can offer document downloads, unless a group owner or admin disables downloads locally."></i>
-                    </div>
-                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
-                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-download-groups-btn" data-bs-toggle="modal" data-bs-target="#fileDownloadGroupAssignmentModal">
-                            <i class="bi bi-people me-1"></i>Manage Groups
-                        </button>
-                        <span class="text-muted small" id="file-download-group-assignment-summary">No groups assigned.</span>
-                    </div>
-                    <textarea class="d-none" id="file_download_allowed_group_ids" name="file_download_allowed_group_ids">{{ settings.file_download_allowed_group_ids|default([], true)|tojson }}</textarea>
-                    <hr>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="allow_public_workspace_file_downloads"
-                            name="allow_public_workspace_file_downloads"
-                            {% if settings.allow_public_workspace_file_downloads %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="allow_public_workspace_file_downloads">
-                            Enable Public Workspace Downloads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow public workspace document downloads when global policy and each workspace's local setting allow it."></i>
-                    </div>
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_public_workspace_assignment_for_file_downloads"
-                            name="require_public_workspace_assignment_for_file_downloads"
-                            {% if settings.require_public_workspace_assignment_for_file_downloads %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_public_workspace_assignment_for_file_downloads">
-                            Require Public Workspace Assignment for Downloads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only selected public workspaces can offer document downloads, unless a workspace owner or admin disables downloads locally."></i>
-                    </div>
-                    <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
-                        <button type="button" class="btn btn-sm btn-outline-primary" id="manage-file-download-public-workspaces-btn" data-bs-toggle="modal" data-bs-target="#fileDownloadPublicWorkspaceAssignmentModal">
-                            <i class="bi bi-globe me-1"></i>Manage Public Workspaces
-                        </button>
-                        <span class="text-muted small" id="file-download-public-workspace-assignment-summary">No public workspaces assigned.</span>
-                    </div>
-                    <textarea class="d-none" id="file_download_allowed_public_workspace_ids" name="file_download_allowed_public_workspace_ids">{{ settings.file_download_allowed_public_workspace_ids|default([], true)|tojson }}</textarea>
-                </div>
-
-                <div class="modal fade" id="groupWorkflowAssignmentModal" tabindex="-1" aria-labelledby="groupWorkflowAssignmentModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title mb-0" id="groupWorkflowAssignmentModalLabel">Group Workflow Assignments</h5>
-                                    <small class="text-muted">Choose which groups can use group workflows when assignment is required.</small>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="row g-2 align-items-end mb-3">
-                                    <div class="col">
-                                        <label for="group-workflow-group-search" class="form-label">Search Groups</label>
-                                        <input type="search" class="form-control" id="group-workflow-group-search" placeholder="Search by group name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
-                                    </div>
-                                    <div class="col-auto">
-                                        <button type="button" class="btn btn-outline-primary" id="group-workflow-group-search-btn">
-                                            <i class="bi bi-search me-1"></i>Search
-                                        </button>
-                                    </div>
-                                </div>
-                                <div class="alert alert-danger d-none" id="group-workflow-assignment-error"></div>
-                                <div class="small text-muted mb-2" id="group-workflow-assignment-status">No groups loaded.</div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Group</th>
-                                                <th scope="col">Description</th>
-                                                <th scope="col" class="text-end">Assignment</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="group-workflow-assignment-groups-body">
-                                            <tr>
-                                                <td colspan="3" class="text-center text-muted py-3">Search for groups to assign.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="fileDownloadGroupAssignmentModal" tabindex="-1" aria-labelledby="fileDownloadGroupAssignmentModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title mb-0" id="fileDownloadGroupAssignmentModalLabel">File Download Group Assignments</h5>
-                                    <small class="text-muted">Choose which groups can download files when group assignment is required.</small>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="row g-2 align-items-end mb-3">
-                                    <div class="col">
-                                        <label for="file-download-group-assignment-search" class="form-label">Search Groups</label>
-                                        <input type="search" class="form-control" id="file-download-group-assignment-search" placeholder="Search by group name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
-                                    </div>
-                                    <div class="col-auto">
-                                        <button type="button" class="btn btn-outline-primary" id="file-download-group-assignment-search-btn">
-                                            <i class="bi bi-search me-1"></i>Search
-                                        </button>
-                                    </div>
-                                </div>
-                                <div class="alert alert-danger d-none" id="file-download-group-assignment-error"></div>
-                                <div class="small text-muted mb-2" id="file-download-group-assignment-status">No groups loaded.</div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Group</th>
-                                                <th scope="col">Description</th>
-                                                <th scope="col" class="text-end">Assignment</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="file-download-group-assignment-body">
-                                            <tr>
-                                                <td colspan="3" class="text-center text-muted py-3">Search for groups to assign.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="fileDownloadPublicWorkspaceAssignmentModal" tabindex="-1" aria-labelledby="fileDownloadPublicWorkspaceAssignmentModalLabel" aria-hidden="true">
-                    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <div>
-                                    <h5 class="modal-title mb-0" id="fileDownloadPublicWorkspaceAssignmentModalLabel">File Download Public Workspace Assignments</h5>
-                                    <small class="text-muted">Choose which public workspaces can download files when public workspace assignment is required.</small>
-                                </div>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <div class="row g-2 align-items-end mb-3">
-                                    <div class="col">
-                                        <label for="file-download-public-workspace-assignment-search" class="form-label">Search Public Workspaces</label>
-                                        <input type="search" class="form-control" id="file-download-public-workspace-assignment-search" placeholder="Search by public workspace name or description" autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true">
-                                    </div>
-                                    <div class="col-auto">
-                                        <button type="button" class="btn btn-outline-primary" id="file-download-public-workspace-assignment-search-btn">
-                                            <i class="bi bi-search me-1"></i>Search
-                                        </button>
-                                    </div>
-                                </div>
-                                <div class="alert alert-danger d-none" id="file-download-public-workspace-assignment-error"></div>
-                                <div class="small text-muted mb-2" id="file-download-public-workspace-assignment-status">Enter at least 2 characters to search.</div>
-                                <div class="table-responsive">
-                                    <table class="table table-sm align-middle">
-                                        <thead>
-                                            <tr>
-                                                <th scope="col">Public Workspace</th>
-                                                <th scope="col">Description</th>
-                                                <th scope="col" class="text-end">Assignment</th>
-                                            </tr>
-                                        </thead>
-                                        <tbody id="file-download-public-workspace-assignment-body">
-                                            <tr>
-                                                <td colspan="3" class="text-center text-muted py-3">Search for public workspaces to assign.</td>
-                                            </tr>
-                                        </tbody>
-                                    </table>
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Done</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-
-               <div class="card mb-3 p-3" id="group-workspaces-section">
-                    <h5>
-                        <i class="bi bi-people me-2"></i>Group Workspaces
-                    </h5>
-                    <p class="text-muted">
-                        Turn this on to allow access and management of group workspaces, as well as group collaboration features.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_group_workspaces"
-                            name="enable_group_workspaces"
-                            {% if settings.enable_group_workspaces %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_group_workspaces">
-                            Enable Group Workspaces
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and participate in shared group workspaces for team collaboration, document sharing, and collective knowledge building."></i>
-                    </div>
-
-
-                    <div id="create_group_permission_setting" {% if not settings.enable_group_workspaces %}style="display: none;"{% endif %}>
-                        <hr>
-
-                        <!-- Disable Group Creation Setting -->
-                        <div class="form-group form-check form-switch mb-3">
-                            <input type="checkbox"
-                                class="form-check-input"
-                                id="disable_group_creation"
-                                name="disable_group_creation"
-                                {% if not settings.enable_group_creation %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="disable_group_creation">
-                                Disable Group Creation
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Prevent all users from creating new groups system-wide, regardless of app role assignment."></i>
-                        </div>
-                        <p class="text-muted small mb-3">
-                            When enabled, no users will be able to create new groups, regardless of app role assignment. This global setting overrides the <strong>Require CreateGroups App Role</strong> setting below.
-                        </p>
-
-                        <div class="form-group form-check form-switch mb-2">
-                            <input type="checkbox"
-                                class="form-check-input"
-                                id="require_member_of_create_group"
-                                name="require_member_of_create_group"
-                                {% if settings.require_member_of_create_group %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="require_member_of_create_group">
-                                Require CreateGroups App Role
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the CreateGroups Enterprise App role can create new groups."></i>
-                        </div>
-                        <p class="text-muted small mb-0">
-                            Required app role value: <code>CreateGroups</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create groups while group workspaces and group creation are enabled.
-                        </p>
-
-                        <hr>
-
-                        <!-- Require Owner to Manage Group Agents, Actions and Workflows -->
-                        <div class="form-group form-check form-switch mb-2">
-                            <input type="checkbox"
-                                class="form-check-input"
-                                id="require_owner_for_group_agent_management"
-                                name="require_owner_for_group_agent_management"
-                                {% if settings.require_owner_for_group_agent_management %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="require_owner_for_group_agent_management">
-                                Require Owner to Manage Group Agents, Actions and Workflows
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only the group Owner can create, edit, and delete group agents, actions, and workflows. Group Admins will have read-only access."></i>
-                        </div>
-                        <p class="text-muted small mb-0">
-                            If enabled, only the group Owner can create, edit, and delete group agents, group actions, and group workflows. Admins and other roles will only be able to view them.
-                        </p>
-                    </div>
-
-                </div>
-
-                <div class="card mb-3 p-3" id="public-workspaces-section">
-                    <h5>
-                        <i class="bi bi-globe me-2"></i>Public Workspaces
-                    </h5>
-                    <p class="text-muted">
-                        Turn this on to enable public workspaces that are visible to everyone in the organization.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_public_workspaces"
-                            name="enable_public_workspaces"
-                            {% if settings.enable_public_workspaces %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_public_workspaces">
-                            Enable Public Workspaces
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow creation of public workspaces that are visible and accessible to all users in the organization for broad knowledge sharing."></i>
-                    </div>
-
-                    <div class="mb-3">
-                        <label class="form-label" for="public_workspace_display_name">End-user display name</label>
-                        <input
-                            type="text"
-                            class="form-control"
-                            id="public_workspace_display_name"
-                            name="public_workspace_display_name"
-                            maxlength="{{ settings.public_workspace_labels.max_length }}"
-                            value="{{ settings.public_workspace_display_name }}"
-                            placeholder="Public Workspace"
-                            aria-describedby="public-workspace-display-name-help"
-                        >
-                        <div class="form-text" id="public-workspace-display-name-help">
-                            Optional. End users will see this label instead of Public Workspace. Admin settings and internal references continue to use Public Workspace.
-                        </div>
-                    </div>
-
-                    <div id="create_public_workspace_permission_setting" {% if not settings.enable_public_workspaces %}style="display: none;"{% endif %}>
-                        <hr>
-                        <div class="form-group form-check form-switch mb-2">
-                            <input type="checkbox"
-                                class="form-check-input"
-                                id="require_member_of_create_public_workspace"
-                                name="require_member_of_create_public_workspace"
-                                {% if settings.require_member_of_create_public_workspace %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="require_member_of_create_public_workspace">
-                                Require CreatePublicWorkspaces App Role
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the CreatePublicWorkspaces Enterprise App role can create public workspaces."></i>
-                        </div>
-                        <p class="text-muted small mb-0">
-                            Required app role value: <code>CreatePublicWorkspaces</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any authenticated user can create public workspaces while public workspaces are enabled.
-                        </p>
-                    </div>
-
-                </div>
-
-                <div class="card mb-3 p-3" id="file-sharing-section">
-                    <h5>
-                        <i class="bi bi-share me-2"></i>File Sharing
-                    </h5>
-                    <p class="text-muted">
-                        Turn this on to enable file sharing capabilities between users and workspaces.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_file_sharing"
-                            name="enable_file_sharing"
-                            {% if settings.enable_file_sharing %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_file_sharing">
-                            Enable File Sharing
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to upload, share, and manage files within workspaces for document-based AI interactions and collaboration."></i>
-                    </div>
-                </div>
-
-                <div class="card mb-3 p-3" id="chat-file-uploads-section">
-                    <h5>
-                        <i class="bi bi-paperclip me-2"></i>Chat File Uploads
-                    </h5>
-                    <p class="text-muted">
-                        Control whether users can upload files directly into chat conversations.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_chat_file_uploads"
-                            name="enable_chat_file_uploads"
-                            {% if settings.enable_chat_file_uploads %}checked{% endif %} />
-                        <label class="form-check-label ms-2" for="enable_chat_file_uploads">
-                            Enable Chat File Uploads
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to upload files directly into personal, group, and multi-user chat conversations."></i>
-                    </div>
-
-                    <div class="card mb-3 p-3" id="conversation-contents-drawer-section">
-                        <h5>
-                            <i class="bi bi-list-nested me-2"></i>Conversation Contents Drawer
-                        </h5>
-                        <p class="text-muted">
-                            Let users navigate long conversations from a list of their prompts.
-                        </p>
-                        <div class="form-group form-check form-switch mb-2">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="enable_conversation_contents_drawer"
-                                name="enable_conversation_contents_drawer"
-                                {% if settings.enable_conversation_contents_drawer %}checked{% endif %}
-                            />
-                            <label class="form-check-label ms-2" for="enable_conversation_contents_drawer">
-                                Enable Conversation Contents Drawer
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to open a responsive contents drawer that lists persisted user messages and jumps to them."></i>
-                        </div>
-                        <p class="text-muted small mb-0">
-                            When enabled, users can turn the drawer off for their own account from Profile settings.
-                        </p>
-                    </div>
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_chat_file_upload_user"
-                            name="require_member_of_chat_file_upload_user"
-                            {% if settings.require_member_of_chat_file_upload_user %}checked{% endif %} />
-                        <label class="form-check-label ms-2" for="require_member_of_chat_file_upload_user">
-                            Require ChatFileUploadUser App Role
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the ChatFileUploadUser Enterprise App role can upload files into chat."></i>
-                    </div>
-                    <p class="text-muted small mb-0">
-                        Required app role value: <code>ChatFileUploadUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. Existing chat attachments remain visible; this only controls new uploads.
-                    </p>
-                </div>
-
-                <div class="card mb-3 p-3" id="metadata-extraction-section">
-                    <h5>
-                        <i class="bi bi-file-earmark-code me-2"></i>Metadata Extraction
-                    </h5>
-                    <p class="text-muted">
-                      Enable this to automatically parse and store file metadata for advanced indexing and search.
-                    </p>
-                    <div class="form-check form-switch mb-3">
-                      <input
-                        type="checkbox"
-                        class="form-check-input"
-                        id="enable_extract_meta_data"
-                        name="enable_extract_meta_data"
-                        {% if settings.enable_extract_meta_data %}checked{% endif %}>
-                      <label class="form-check-label ms-2" for="enable_extract_meta_data">
-                        Enable Extract Meta Data
-                      </label>
-                      <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Automatically extract and index metadata from uploaded files for enhanced search capabilities and content organization."></i>
-                    </div>
-
-                    <div id="metadata_extraction_model_settings" class="mb-3"
-                         {% if not settings.enable_extract_meta_data %}style="display: none;"{% endif %}>
-                                            <label for="metadata_extraction_model" class="form-label">Extraction Model</label>
-                                            <select class="form-select" id="metadata_extraction_model" name="metadata_extraction_model">
-                                                <option value="">No metadata extraction model selected</option>
-                                            </select>
-                                            <input type="hidden" name="metadata_extraction_model_selection_json" id="metadata_extraction_model_selection_json" />
-                                            <div class="form-text">
-                                                Uses Global Endpoints when multi-endpoint model management is enabled; otherwise uses the legacy GPT/APIM deployment settings.
-                                            </div>
-                    </div>
-                </div>
-
-                <!-- Multi-Modal Vision Analysis Section -->
-                <div class="card mb-3 p-3" id="multimodal-vision-section">
-                    <h5>
-                        <i class="bi bi-eye me-2"></i>Multi-Modal Vision Analysis
-                    </h5>
-                    <p class="text-muted">
-                        Enable AI-powered vision analysis for images uploaded to chat or workspace. When enabled alongside Document Intelligence OCR, images will receive both text extraction (OCR) and semantic understanding (vision AI).
-                    </p>
-
-                    <div class="alert alert-info mb-3">
-                        <strong><i class="bi bi-info-circle"></i> How it works:</strong>
-                        <ul class="mb-0 mt-2">
-                            <li><strong>Document Intelligence</strong>: Extracts text from images (OCR)</li>
-                            <li><strong>Vision Model</strong>: Provides semantic analysis, object detection, and contextual understanding</li>
-                            <li>Both analyses are combined and available in citations when Enhanced Citations is enabled</li>
-                        </ul>
-                    </div>
-
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_multimodal_vision"
-                            name="enable_multimodal_vision"
-                            {% if settings.enable_multimodal_vision %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_multimodal_vision">
-                            Enable Multi-Modal Vision Analysis
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Use GPT-4 Vision or similar models to analyze images for semantic content, objects, and contextual information beyond OCR."></i>
-                    </div>
-
-                    <div id="multimodal_vision_model_settings" class="mb-3"
-                         {% if not settings.enable_multimodal_vision %}style="display: none;"{% endif %}>
-                        <label for="multimodal_vision_model" class="form-label">
-                            Vision Model <span class="text-danger">*</span>
-                        </label>
-                        <select class="form-select" id="multimodal_vision_model" name="multimodal_vision_model"
-                                data-prev="{{ settings.multimodal_vision_model or '' }}">
-                            <option value="">Select a vision-capable model...</option>
-
-                            {#
-                                Multi-endpoint aware vision model selection.
-                                Preference order:
-                                1. When multi-endpoint is enabled and model_endpoints has entries, use those.
-                                2. Otherwise, fall back to legacy gpt_model.selected / APIM settings.
-                            #}
-
-                            {% set has_multi_endpoints = settings.enable_multi_model_endpoints and settings.model_endpoints %}
-
-                            {% if has_multi_endpoints %}
-                                {# Iterate all enabled endpoints and models, filter to vision-capable #}
-                                {% for endpoint in settings.model_endpoints if endpoint.enabled %}
-                                    {% for m in endpoint.models if m.enabled %}
-                                        {% if is_vision_capable_model is defined and is_vision_capable_model(m) %}
-                                            {% set option_value = m.deploymentName %}
-                                            <option value="{{ option_value }}"
-                                                data-endpoint-id="{{ endpoint.id or '' }}"
-                                                data-model-id="{{ m.id or '' }}"
-                                                data-provider="{{ endpoint.provider or '' }}"
-                                                data-model-name="{{ m.modelName or '' }}"
-                                                {% if settings.multimodal_vision_model == option_value %}selected{% endif %}>
-                                                {{ m.displayName or m.deploymentName }}{% if m.modelName %} ({{ m.modelName }}){% endif %}
-                                            </option>
-                                        {% endif %}
-                                    {% endfor %}
-                                {% endfor %}
-                            {% elif settings.enable_gpt_apim %}
-                                {# Legacy APIM-based GPT configuration #}
-                                {% for d in (settings.azure_apim_gpt_deployment or '').split(',') if d %}
-                                    {% set d_trim = d.strip() %}
-                                    {% if is_vision_capable_model is defined and is_vision_capable_model(d_trim) %}
-                                        <option value="{{ d_trim }}"
-                                            {% if settings.multimodal_vision_model == d_trim %}selected{% endif %}>
-                                            {{ d_trim }}
-                                        </option>
-                                    {% endif %}
-                                {% endfor %}
-                            {% else %}
-                                {# Legacy single-endpoint GPT configuration #}
-                                {% for m in settings.gpt_model.selected %}
-                                    {% if is_vision_capable_model is defined and is_vision_capable_model(m) %}
-                                        <option value="{{ m.deploymentName }}"
-                                            {% if settings.multimodal_vision_model == m.deploymentName %}selected{% endif %}>
-                                            {{ m.deploymentName }}{% if m.modelName %} ({{ m.modelName }}){% endif %}
-                                        </option>
-                                    {% endif %}
-                                {% endfor %}
-                            {% endif %}
-                        </select>
-                        <div class="form-text">Select a GPT model with vision capabilities (for example, gpt-4o or supported GPT 5 and later models). Only vision-capable models are shown.</div>
-
-                        <button type="button" class="btn btn-secondary mt-3" id="test_multimodal_vision_button">
-                            <i class="bi bi-clipboard-check me-1"></i>Test Vision Analysis
-                        </button>
-                        <div id="test_multimodal_vision_result" class="mt-2"></div>
-                    </div>
-                </div>
-
-
-
-                <div class="card mb-3 p-3" id="document-classification-section">
-                    <h5>
-                        <i class="bi bi-tags me-2"></i>Document Classification
-                    </h5>
-                    <p class="text-muted">
-                        Enable this feature to allow users to classify documents uploaded to their workspaces using predefined categories.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_document_classification"
-                            name="enable_document_classification"
-                            {% if settings.enable_document_classification %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_document_classification">
-                            Enable Document Classification
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to classify uploaded documents with predefined categories for better organization and search filtering."></i>
-                    </div>
-
-
-                    <div id="document_classification_settings" {% if not settings.enable_document_classification %}style="display: none;"{% endif %}>
-                        <h6>Classification Categories</h6>
-                        <p class="text-muted small">Define the labels and corresponding colors for document classification.</p>
-                        <table class="table table-sm table-bordered">
-                            <thead class="table-light">
-                                <tr>
-                                    <th style="width: 50%;">Label</th>
-                                    <th style="width: 30%;">Color</th>
-                                    <th style="width: 20%;">Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody id="classification-categories-tbody">
-
-                            </tbody>
-                        </table>
-                        <button type="button" id="add-classification-btn" class="btn btn-success btn-sm mt-2">
-                            <i class="bi bi-plus-circle"></i> Add New Category
-                        </button>
-
-                        <input type="hidden" name="document_classification_categories_json" id="document_classification_categories_json">
-                    </div>
-                </div>
-
-                <!-- Retention Policy Section -->
-                <div class="card p-3 mb-3" id="retention-policy-section">
-                    <h5>
-                        <i class="bi bi-hourglass-split me-2"></i>Retention Policy
-                    </h5>
-                    <p class="text-muted">Automatically delete aged conversations and documents based on configurable retention periods. Users, group owners, and public workspace admins can set their own retention policies.</p>
-
-                    <div class="alert alert-info mb-3" role="alert">
-                        <i class="bi bi-info-circle me-2"></i>
-                        <strong>How it works:</strong> Enable retention policy for workspace types below. Users/owners can then configure how many days to retain conversations and documents. Items older than the configured period are automatically deleted. Default is "none" (no deletion) until explicitly set by each user/owner.
-                    </div>
-
-                    <!-- Enable toggles for different workspace types -->
-                    <div class="row g-3 mb-3">
-                        <div class="col-md-4">
-                            <div class="form-check form-switch">
-                                <input class="form-check-input" type="checkbox" role="switch" id="enable_retention_policy_personal" name="enable_retention_policy_personal" {% if settings.enable_retention_policy_personal %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="enable_retention_policy_personal">
-                                    Enable for Personal Workspaces
-                                </label>
-                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to configure retention policies for their personal conversations and documents."></i>
-                            </div>
-                        </div>
-                        <div class="col-md-4">
-                            <div class="form-check form-switch">
-                                <input class="form-check-input" type="checkbox" role="switch" id="enable_retention_policy_group" name="enable_retention_policy_group" {% if settings.enable_retention_policy_group %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="enable_retention_policy_group">
-                                    Enable for Group Workspaces
-                                </label>
-                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow group owners and admins to configure retention policies for group conversations and documents."></i>
-                            </div>
-                        </div>
-                        <div class="col-md-4">
-                            <div class="form-check form-switch">
-                                <input class="form-check-input" type="checkbox" role="switch" id="enable_retention_policy_public" name="enable_retention_policy_public" {% if settings.enable_retention_policy_public %}checked{% endif %}>
-                                <label class="form-check-label ms-2" for="enable_retention_policy_public">
-                                    Enable for Public Workspaces
-                                </label>
-                                <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow public workspace owners and admins to configure retention policies for workspace conversations and documents."></i>
-                            </div>
-                        </div>
-                    </div>
-
-                    <!-- Default Retention Policy Settings -->
-                    <div class="card bg-light p-3 mb-3">
-                        <h6 class="mb-3"><i class="bi bi-sliders me-2"></i>Default Retention Policies</h6>
-                        <p class="text-muted small mb-3">Set organization-wide default retention periods for each workspace type. Users can override these defaults with their own preferences. Setting a default here means new users/workspaces will start with this retention period.</p>
-
-                        <!-- Personal Workspace Defaults -->
-                        <div class="row g-3 mb-3" id="retention_defaults_personal" style="{% if not settings.enable_retention_policy_personal %}display: none;{% endif %}">
-                            <div class="col-12">
-                                <label class="form-label fw-bold"><i class="bi bi-person me-1"></i>Personal Workspace Defaults</label>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="default_retention_conversation_personal" class="form-label">Conversation Retention</label>
-                                <select class="form-select" id="default_retention_conversation_personal" name="default_retention_conversation_personal">
-                                    <option value="none" {% if settings.default_retention_conversation_personal == 'none' %}selected{% endif %}>No automatic deletion</option>
-                                    <option value="1" {% if settings.default_retention_conversation_personal == '1' or settings.default_retention_conversation_personal == 1 %}selected{% endif %}>1 day</option>
-                                    <option value="2" {% if settings.default_retention_conversation_personal == '2' or settings.default_retention_conversation_personal == 2 %}selected{% endif %}>2 days</option>
-                                    <option value="3" {% if settings.default_retention_conversation_personal == '3' or settings.default_retention_conversation_personal == 3 %}selected{% endif %}>3 days</option>
-                                    <option value="4" {% if settings.default_retention_conversation_personal == '4' or settings.default_retention_conversation_personal == 4 %}selected{% endif %}>4 days</option>
-                                    <option value="5" {% if settings.default_retention_conversation_personal == '5' or settings.default_retention_conversation_personal == 5 %}selected{% endif %}>5 days</option>
-                                    <option value="6" {% if settings.default_retention_conversation_personal == '6' or settings.default_retention_conversation_personal == 6 %}selected{% endif %}>6 days</option>
-                                    <option value="7" {% if settings.default_retention_conversation_personal == '7' or settings.default_retention_conversation_personal == 7 %}selected{% endif %}>7 days (1 week)</option>
-                                    <option value="10" {% if settings.default_retention_conversation_personal == '10' or settings.default_retention_conversation_personal == 10 %}selected{% endif %}>10 days</option>
-                                    <option value="14" {% if settings.default_retention_conversation_personal == '14' or settings.default_retention_conversation_personal == 14 %}selected{% endif %}>14 days (2 weeks)</option>
-                                    <option value="21" {% if settings.default_retention_conversation_personal == '21' or settings.default_retention_conversation_personal == 21 %}selected{% endif %}>21 days (3 weeks)</option>
-                                    <option value="30" {% if settings.default_retention_conversation_personal == '30' or settings.default_retention_conversation_personal == 30 %}selected{% endif %}>30 days</option>
-                                    <option value="60" {% if settings.default_retention_conversation_personal == '60' or settings.default_retention_conversation_personal == 60 %}selected{% endif %}>60 days</option>
-                                    <option value="90" {% if settings.default_retention_conversation_personal == '90' or settings.default_retention_conversation_personal == 90 %}selected{% endif %}>90 days (3 months)</option>
-                                    <option value="180" {% if settings.default_retention_conversation_personal == '180' or settings.default_retention_conversation_personal == 180 %}selected{% endif %}>180 days (6 months)</option>
-                                    <option value="365" {% if settings.default_retention_conversation_personal == '365' or settings.default_retention_conversation_personal == 365 %}selected{% endif %}>365 days (1 year)</option>
-                                    <option value="730" {% if settings.default_retention_conversation_personal == '730' or settings.default_retention_conversation_personal == 730 %}selected{% endif %}>730 days (2 years)</option>
-                                </select>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="default_retention_document_personal" class="form-label">Document Retention</label>
-                                <select class="form-select" id="default_retention_document_personal" name="default_retention_document_personal">
-                                    <option value="none" {% if settings.default_retention_document_personal == 'none' %}selected{% endif %}>No automatic deletion</option>
-                                    <option value="1" {% if settings.default_retention_document_personal == '1' or settings.default_retention_document_personal == 1 %}selected{% endif %}>1 day</option>
-                                    <option value="2" {% if settings.default_retention_document_personal == '2' or settings.default_retention_document_personal == 2 %}selected{% endif %}>2 days</option>
-                                    <option value="3" {% if settings.default_retention_document_personal == '3' or settings.default_retention_document_personal == 3 %}selected{% endif %}>3 days</option>
-                                    <option value="4" {% if settings.default_retention_document_personal == '4' or settings.default_retention_document_personal == 4 %}selected{% endif %}>4 days</option>
-                                    <option value="5" {% if settings.default_retention_document_personal == '5' or settings.default_retention_document_personal == 5 %}selected{% endif %}>5 days</option>
-                                    <option value="6" {% if settings.default_retention_document_personal == '6' or settings.default_retention_document_personal == 6 %}selected{% endif %}>6 days</option>
-                                    <option value="7" {% if settings.default_retention_document_personal == '7' or settings.default_retention_document_personal == 7 %}selected{% endif %}>7 days (1 week)</option>
-                                    <option value="10" {% if settings.default_retention_document_personal == '10' or settings.default_retention_document_personal == 10 %}selected{% endif %}>10 days</option>
-                                    <option value="14" {% if settings.default_retention_document_personal == '14' or settings.default_retention_document_personal == 14 %}selected{% endif %}>14 days (2 weeks)</option>
-                                    <option value="21" {% if settings.default_retention_document_personal == '21' or settings.default_retention_document_personal == 21 %}selected{% endif %}>21 days (3 weeks)</option>
-                                    <option value="30" {% if settings.default_retention_document_personal == '30' or settings.default_retention_document_personal == 30 %}selected{% endif %}>30 days</option>
-                                    <option value="60" {% if settings.default_retention_document_personal == '60' or settings.default_retention_document_personal == 60 %}selected{% endif %}>60 days</option>
-                                    <option value="90" {% if settings.default_retention_document_personal == '90' or settings.default_retention_document_personal == 90 %}selected{% endif %}>90 days (3 months)</option>
-                                    <option value="180" {% if settings.default_retention_document_personal == '180' or settings.default_retention_document_personal == 180 %}selected{% endif %}>180 days (6 months)</option>
-                                    <option value="365" {% if settings.default_retention_document_personal == '365' or settings.default_retention_document_personal == 365 %}selected{% endif %}>365 days (1 year)</option>
-                                    <option value="730" {% if settings.default_retention_document_personal == '730' or settings.default_retention_document_personal == 730 %}selected{% endif %}>730 days (2 years)</option>
-                                </select>
-                            </div>
-                        </div>
-
-                        <!-- Group Workspace Defaults -->
-                        <div class="row g-3 mb-3" id="retention_defaults_group" style="{% if not settings.enable_retention_policy_group %}display: none;{% endif %}">
-                            <div class="col-12">
-                                <label class="form-label fw-bold"><i class="bi bi-people me-1"></i>Group Workspace Defaults</label>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="default_retention_conversation_group" class="form-label">Conversation Retention</label>
-                                <select class="form-select" id="default_retention_conversation_group" name="default_retention_conversation_group">
-                                    <option value="none" {% if settings.default_retention_conversation_group == 'none' %}selected{% endif %}>No automatic deletion</option>
-                                    <option value="1" {% if settings.default_retention_conversation_group == '1' or settings.default_retention_conversation_group == 1 %}selected{% endif %}>1 day</option>
-                                    <option value="2" {% if settings.default_retention_conversation_group == '2' or settings.default_retention_conversation_group == 2 %}selected{% endif %}>2 days</option>
-                                    <option value="3" {% if settings.default_retention_conversation_group == '3' or settings.default_retention_conversation_group == 3 %}selected{% endif %}>3 days</option>
-                                    <option value="4" {% if settings.default_retention_conversation_group == '4' or settings.default_retention_conversation_group == 4 %}selected{% endif %}>4 days</option>
-                                    <option value="5" {% if settings.default_retention_conversation_group == '5' or settings.default_retention_conversation_group == 5 %}selected{% endif %}>5 days</option>
-                                    <option value="6" {% if settings.default_retention_conversation_group == '6' or settings.default_retention_conversation_group == 6 %}selected{% endif %}>6 days</option>
-                                    <option value="7" {% if settings.default_retention_conversation_group == '7' or settings.default_retention_conversation_group == 7 %}selected{% endif %}>7 days (1 week)</option>
-                                    <option value="10" {% if settings.default_retention_conversation_group == '10' or settings.default_retention_conversation_group == 10 %}selected{% endif %}>10 days</option>
-                                    <option value="14" {% if settings.default_retention_conversation_group == '14' or settings.default_retention_conversation_group == 14 %}selected{% endif %}>14 days (2 weeks)</option>
-                                    <option value="21" {% if settings.default_retention_conversation_group == '21' or settings.default_retention_conversation_group == 21 %}selected{% endif %}>21 days (3 weeks)</option>
-                                    <option value="30" {% if settings.default_retention_conversation_group == '30' or settings.default_retention_conversation_group == 30 %}selected{% endif %}>30 days</option>
-                                    <option value="60" {% if settings.default_retention_conversation_group == '60' or settings.default_retention_conversation_group == 60 %}selected{% endif %}>60 days</option>
-                                    <option value="90" {% if settings.default_retention_conversation_group == '90' or settings.default_retention_conversation_group == 90 %}selected{% endif %}>90 days (3 months)</option>
-                                    <option value="180" {% if settings.default_retention_conversation_group == '180' or settings.default_retention_conversation_group == 180 %}selected{% endif %}>180 days (6 months)</option>
-                                    <option value="365" {% if settings.default_retention_conversation_group == '365' or settings.default_retention_conversation_group == 365 %}selected{% endif %}>365 days (1 year)</option>
-                                    <option value="730" {% if settings.default_retention_conversation_group == '730' or settings.default_retention_conversation_group == 730 %}selected{% endif %}>730 days (2 years)</option>
-                                </select>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="default_retention_document_group" class="form-label">Document Retention</label>
-                                <select class="form-select" id="default_retention_document_group" name="default_retention_document_group">
-                                    <option value="none" {% if settings.default_retention_document_group == 'none' %}selected{% endif %}>No automatic deletion</option>
-                                    <option value="1" {% if settings.default_retention_document_group == '1' or settings.default_retention_document_group == 1 %}selected{% endif %}>1 day</option>
-                                    <option value="2" {% if settings.default_retention_document_group == '2' or settings.default_retention_document_group == 2 %}selected{% endif %}>2 days</option>
-                                    <option value="3" {% if settings.default_retention_document_group == '3' or settings.default_retention_document_group == 3 %}selected{% endif %}>3 days</option>
-                                    <option value="4" {% if settings.default_retention_document_group == '4' or settings.default_retention_document_group == 4 %}selected{% endif %}>4 days</option>
-                                    <option value="5" {% if settings.default_retention_document_group == '5' or settings.default_retention_document_group == 5 %}selected{% endif %}>5 days</option>
-                                    <option value="6" {% if settings.default_retention_document_group == '6' or settings.default_retention_document_group == 6 %}selected{% endif %}>6 days</option>
-                                    <option value="7" {% if settings.default_retention_document_group == '7' or settings.default_retention_document_group == 7 %}selected{% endif %}>7 days (1 week)</option>
-                                    <option value="10" {% if settings.default_retention_document_group == '10' or settings.default_retention_document_group == 10 %}selected{% endif %}>10 days</option>
-                                    <option value="14" {% if settings.default_retention_document_group == '14' or settings.default_retention_document_group == 14 %}selected{% endif %}>14 days (2 weeks)</option>
-                                    <option value="21" {% if settings.default_retention_document_group == '21' or settings.default_retention_document_group == 21 %}selected{% endif %}>21 days (3 weeks)</option>
-                                    <option value="30" {% if settings.default_retention_document_group == '30' or settings.default_retention_document_group == 30 %}selected{% endif %}>30 days</option>
-                                    <option value="60" {% if settings.default_retention_document_group == '60' or settings.default_retention_document_group == 60 %}selected{% endif %}>60 days</option>
-                                    <option value="90" {% if settings.default_retention_document_group == '90' or settings.default_retention_document_group == 90 %}selected{% endif %}>90 days (3 months)</option>
-                                    <option value="180" {% if settings.default_retention_document_group == '180' or settings.default_retention_document_group == 180 %}selected{% endif %}>180 days (6 months)</option>
-                                    <option value="365" {% if settings.default_retention_document_group == '365' or settings.default_retention_document_group == 365 %}selected{% endif %}>365 days (1 year)</option>
-                                    <option value="730" {% if settings.default_retention_document_group == '730' or settings.default_retention_document_group == 730 %}selected{% endif %}>730 days (2 years)</option>
-                                </select>
-                            </div>
-                        </div>
-
-                        <!-- Public Workspace Defaults -->
-                        <div class="row g-3" id="retention_defaults_public" style="{% if not settings.enable_retention_policy_public %}display: none;{% endif %}">
-                            <div class="col-12">
-                                <label class="form-label fw-bold"><i class="bi bi-globe me-1"></i>Public Workspace Defaults</label>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="default_retention_conversation_public" class="form-label">Conversation Retention</label>
-                                <select class="form-select" id="default_retention_conversation_public" name="default_retention_conversation_public">
-                                    <option value="none" {% if settings.default_retention_conversation_public == 'none' %}selected{% endif %}>No automatic deletion</option>
-                                    <option value="1" {% if settings.default_retention_conversation_public == '1' or settings.default_retention_conversation_public == 1 %}selected{% endif %}>1 day</option>
-                                    <option value="2" {% if settings.default_retention_conversation_public == '2' or settings.default_retention_conversation_public == 2 %}selected{% endif %}>2 days</option>
-                                    <option value="3" {% if settings.default_retention_conversation_public == '3' or settings.default_retention_conversation_public == 3 %}selected{% endif %}>3 days</option>
-                                    <option value="4" {% if settings.default_retention_conversation_public == '4' or settings.default_retention_conversation_public == 4 %}selected{% endif %}>4 days</option>
-                                    <option value="5" {% if settings.default_retention_conversation_public == '5' or settings.default_retention_conversation_public == 5 %}selected{% endif %}>5 days</option>
-                                    <option value="6" {% if settings.default_retention_conversation_public == '6' or settings.default_retention_conversation_public == 6 %}selected{% endif %}>6 days</option>
-                                    <option value="7" {% if settings.default_retention_conversation_public == '7' or settings.default_retention_conversation_public == 7 %}selected{% endif %}>7 days (1 week)</option>
-                                    <option value="10" {% if settings.default_retention_conversation_public == '10' or settings.default_retention_conversation_public == 10 %}selected{% endif %}>10 days</option>
-                                    <option value="14" {% if settings.default_retention_conversation_public == '14' or settings.default_retention_conversation_public == 14 %}selected{% endif %}>14 days (2 weeks)</option>
-                                    <option value="21" {% if settings.default_retention_conversation_public == '21' or settings.default_retention_conversation_public == 21 %}selected{% endif %}>21 days (3 weeks)</option>
-                                    <option value="30" {% if settings.default_retention_conversation_public == '30' or settings.default_retention_conversation_public == 30 %}selected{% endif %}>30 days</option>
-                                    <option value="60" {% if settings.default_retention_conversation_public == '60' or settings.default_retention_conversation_public == 60 %}selected{% endif %}>60 days</option>
-                                    <option value="90" {% if settings.default_retention_conversation_public == '90' or settings.default_retention_conversation_public == 90 %}selected{% endif %}>90 days (3 months)</option>
-                                    <option value="180" {% if settings.default_retention_conversation_public == '180' or settings.default_retention_conversation_public == 180 %}selected{% endif %}>180 days (6 months)</option>
-                                    <option value="365" {% if settings.default_retention_conversation_public == '365' or settings.default_retention_conversation_public == 365 %}selected{% endif %}>365 days (1 year)</option>
-                                    <option value="730" {% if settings.default_retention_conversation_public == '730' or settings.default_retention_conversation_public == 730 %}selected{% endif %}>730 days (2 years)</option>
-                                </select>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="default_retention_document_public" class="form-label">Document Retention</label>
-                                <select class="form-select" id="default_retention_document_public" name="default_retention_document_public">
-                                    <option value="none" {% if settings.default_retention_document_public == 'none' %}selected{% endif %}>No automatic deletion</option>
-                                    <option value="1" {% if settings.default_retention_document_public == '1' or settings.default_retention_document_public == 1 %}selected{% endif %}>1 day</option>
-                                    <option value="2" {% if settings.default_retention_document_public == '2' or settings.default_retention_document_public == 2 %}selected{% endif %}>2 days</option>
-                                    <option value="3" {% if settings.default_retention_document_public == '3' or settings.default_retention_document_public == 3 %}selected{% endif %}>3 days</option>
-                                    <option value="4" {% if settings.default_retention_document_public == '4' or settings.default_retention_document_public == 4 %}selected{% endif %}>4 days</option>
-                                    <option value="5" {% if settings.default_retention_document_public == '5' or settings.default_retention_document_public == 5 %}selected{% endif %}>5 days</option>
-                                    <option value="6" {% if settings.default_retention_document_public == '6' or settings.default_retention_document_public == 6 %}selected{% endif %}>6 days</option>
-                                    <option value="7" {% if settings.default_retention_document_public == '7' or settings.default_retention_document_public == 7 %}selected{% endif %}>7 days (1 week)</option>
-                                    <option value="10" {% if settings.default_retention_document_public == '10' or settings.default_retention_document_public == 10 %}selected{% endif %}>10 days</option>
-                                    <option value="14" {% if settings.default_retention_document_public == '14' or settings.default_retention_document_public == 14 %}selected{% endif %}>14 days (2 weeks)</option>
-                                    <option value="21" {% if settings.default_retention_document_public == '21' or settings.default_retention_document_public == 21 %}selected{% endif %}>21 days (3 weeks)</option>
-                                    <option value="30" {% if settings.default_retention_document_public == '30' or settings.default_retention_document_public == 30 %}selected{% endif %}>30 days</option>
-                                    <option value="60" {% if settings.default_retention_document_public == '60' or settings.default_retention_document_public == 60 %}selected{% endif %}>60 days</option>
-                                    <option value="90" {% if settings.default_retention_document_public == '90' or settings.default_retention_document_public == 90 %}selected{% endif %}>90 days (3 months)</option>
-                                    <option value="180" {% if settings.default_retention_document_public == '180' or settings.default_retention_document_public == 180 %}selected{% endif %}>180 days (6 months)</option>
-                                    <option value="365" {% if settings.default_retention_document_public == '365' or settings.default_retention_document_public == 365 %}selected{% endif %}>365 days (1 year)</option>
-                                    <option value="730" {% if settings.default_retention_document_public == '730' or settings.default_retention_document_public == 730 %}selected{% endif %}>730 days (2 years)</option>
-                                </select>
-                            </div>
-                        </div>
-
-                        <!-- Force Push Button -->
-                        <div class="row g-3 mt-3">
-                            <div class="col-12">
-                                <div class="alert alert-warning mb-2">
-                                    <i class="bi bi-exclamation-triangle me-2"></i>
-                                    <strong>Force Push:</strong> Override all user/group/workspace custom retention policies with the organization defaults above. Users will then use the organization default until they set their own preference.
-                                </div>
-                                <button type="button" class="btn btn-warning" onclick="showForcePushModal()">
-                                    <i class="bi bi-arrow-repeat me-2"></i>Force Push Defaults to All
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-
-                    <!-- Scheduled execution time -->
-                    <div class="mb-3">
-                        <label for="retention_policy_execution_hour" class="form-label">Scheduled Execution Time (Hour of Day)</label>
-                        <select class="form-select" id="retention_policy_execution_hour" name="retention_policy_execution_hour" style="max-width: 300px;">
-                            {% for hour in range(24) %}
-                            <option value="{{ hour }}" {% if settings.retention_policy_execution_hour == hour %}selected{% endif %}>
-                                {{ "%02d"|format(hour) }}:00 ({{ "Midnight" if hour == 0 else ("%d AM"|format(hour) if hour < 12 else ("Noon" if hour == 12 else "%d PM"|format(hour - 12))) }})
-                            </option>
-                            {% endfor %}
-                        </select>
-                        <small class="form-text text-muted">Retention policy will run once daily at this hour (UTC timezone).</small>
-                    </div>
-
-                    <!-- Status information -->
-                    <div class="row g-3 mb-3">
-                        <div class="col-md-6">
-                            <label class="form-label">Last Execution:</label>
-                            <div class="form-control-plaintext">
-                                {% if settings.retention_policy_last_run %}
-                                    <span class="text-success">{{ settings.retention_policy_last_run }}</span>
-                                {% else %}
-                                    <span class="text-muted">Never run</span>
-                                {% endif %}
-                            </div>
-                        </div>
-                        <div class="col-md-6">
-                            <label class="form-label">Next Scheduled Execution:</label>
-                            <div class="form-control-plaintext">
-                                {% if settings.retention_policy_next_run %}
-                                    <span class="text-info">{{ settings.retention_policy_next_run }}</span>
-                                {% else %}
-                                    <span class="text-muted">Not scheduled</span>
-                                {% endif %}
-                            </div>
-                        </div>
-                    </div>
-
-                    <!-- Manual execution button -->
-                    <div class="mt-3">
-                        <button type="button" class="btn btn-warning" onclick="showManualExecutionModal()">
-                            <i class="bi bi-play-circle me-2"></i>Manual Execution
-                        </button>
-                        <small class="form-text text-muted d-block mt-2">
-                            Trigger retention policy execution immediately for selected workspace types, bypassing the scheduled time.
-                        </small>
-                    </div>
-
-                    <div class="alert alert-warning mt-3" role="alert">
-                        <i class="bi bi-exclamation-triangle me-2"></i>
-                        <strong>Important:</strong> Deleted items respect your archiving settings. If conversation archiving is enabled, items will be archived before deletion. Activity logs are created for all deletions.
-                    </div>
-                </div>
-
-                <!-- Workspace Scope Lock Section -->
-                <div class="card mb-3 p-3" id="workspace-scope-lock-section">
-                    <h5>
-                        <i class="bi bi-lock me-2"></i>Workspace Scope Lock
-                    </h5>
-                    <p class="text-muted">
-                        Control whether users can unlock workspace scope in chat conversations. When scope is locked, conversations are restricted to the workspaces that produced search results, preventing accidental cross-contamination with other data sources.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enforce_workspace_scope_lock"
-                            name="enforce_workspace_scope_lock"
-                            {% if settings.enforce_workspace_scope_lock %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enforce_workspace_scope_lock">
-                            Enforce Workspace Scope Lock
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users cannot unlock the workspace scope on conversations. Scope automatically locks after the first AI search and remains locked. Disable this to allow users to manually unlock scope."></i>
-                    </div>
-                </div>
-
-                <!-- User Agreement Section -->
-                <div class="card mb-3 p-3" id="user-agreement-section">
-                    <h5>
-                        <i class="bi bi-file-earmark-check me-2"></i>User Agreement
-                    </h5>
-                    <p class="text-muted">
-                        Configure a user agreement that users must accept before uploading files.
-                        Supports Markdown formatting.
-                    </p>
-
-                    <!-- Enable Toggle -->
-                    <div class="form-group form-check form-switch mb-3">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="enable_user_agreement"
-                            name="enable_user_agreement"
-                            {% if settings.enable_user_agreement %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="enable_user_agreement">
-                            Enable User Agreement
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users must accept the agreement before uploading files in the selected workspace types."></i>
-                    </div>
-
-                    <!-- User Agreement Settings (shown when enabled) -->
-                    <div id="user_agreement_settings" {% if not settings.enable_user_agreement %}style="display: none;"{% endif %}>
-                        <hr>
-
-                        <!-- Apply To Checkboxes -->
-                        <div class="mb-3">
-                            <label class="form-label fw-bold">Apply to <span class="text-danger">*</span></label>
-                            <p class="text-muted small mb-2">Select where the user agreement should be shown (at least one required):</p>
-                            <div class="row">
-                                <div class="col-md-6">
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_personal" name="user_agreement_apply_personal"
-                                            {% if settings.user_agreement_apply_to and 'personal' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_personal">
-                                            <i class="bi bi-person me-1"></i>Personal Workspaces
-                                        </label>
-                                    </div>
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_group" name="user_agreement_apply_group"
-                                            {% if settings.user_agreement_apply_to and 'group' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_group">
-                                            <i class="bi bi-people me-1"></i>Group Workspaces
-                                        </label>
-                                    </div>
-                                </div>
-                                <div class="col-md-6">
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_public" name="user_agreement_apply_public"
-                                            {% if settings.user_agreement_apply_to and 'public' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_public">
-                                            <i class="bi bi-globe me-1"></i>Public Workspaces
-                                        </label>
-                                    </div>
-                                    <div class="form-check mb-2">
-                                        <input type="checkbox" class="form-check-input" id="user_agreement_apply_chat" name="user_agreement_apply_chat"
-                                            {% if settings.user_agreement_apply_to and 'chat' in settings.user_agreement_apply_to %}checked{% endif %}>
-                                        <label class="form-check-label" for="user_agreement_apply_chat">
-                                            <i class="bi bi-chat-dots me-1"></i>Chat
-                                        </label>
-                                    </div>
-                                </div>
-                            </div>
-                            <div id="user_agreement_apply_to_validation" class="text-danger small" style="display: none;">
-                                <i class="bi bi-exclamation-circle me-1"></i>At least one location must be selected
-                            </div>
-                        </div>
-
-                        <!-- Agreement Text -->
-                        <div class="mb-3">
-                            <label for="user_agreement_text" class="form-label fw-bold">
-                                Agreement Text <span class="text-danger">*</span>
-                                <span class="text-muted fw-normal ms-2">(Markdown supported)</span>
-                            </label>
-                            <textarea class="form-control" id="user_agreement_text" name="user_agreement_text" rows="6"
-                                placeholder="Enter the agreement text that users must accept before uploading files...&#10;&#10;Example:&#10;**I confirm that:**&#10;- The documents I am uploading do not contain PII&#10;- I have permission to share these documents">{{ settings.user_agreement_text or '' }}</textarea>
-                            <div class="d-flex justify-content-between mt-1">
-                                <small id="user_agreement_word_count" class="text-muted">0 / 200 words</small>
-                                <small id="user_agreement_word_warning" class="text-danger" style="display: none;">
-                                    <i class="bi bi-exclamation-circle me-1"></i>Exceeds 200 word limit
-                                </small>
-                            </div>
-                        </div>
-
-                        <!-- Daily Acceptance Option -->
-                        <div class="form-group form-check form-switch mb-3">
-                            <input type="checkbox" class="form-check-input" id="enable_user_agreement_daily" name="enable_user_agreement_daily"
-                                {% if settings.enable_user_agreement_daily %}checked{% endif %}>
-                            <label class="form-check-label ms-2" for="enable_user_agreement_daily">
-                                Allow users to accept once per day
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, users only need to accept the agreement once per day instead of every time they upload files."></i>
-                        </div>
-
-                        <!-- Test Preview Button -->
-                        <div class="d-flex gap-2 flex-wrap">
-                            <button type="button" class="btn btn-outline-secondary" id="test_user_agreement_btn">
-                                <i class="bi bi-eye me-1"></i>Test Preview
-                            </button>
-                        </div>
-                    </div>
-                </div>
-            </div>
-
-
-            <div class="tab-pane fade" id="citation" role="tabpanel" aria-labelledby="citation-tab">
-
-                 <p class="text-muted">
-                    Configure standard and enhanced citations features for your and group workspaces.
-                </p>
-
-
-                <div class="card p-3 mb-3" id="standard-citations-section">
-                    <h5>
-                        <i class="bi bi-quote me-2"></i>Standard Citations
-                    </h5>
-                    <p class="text-muted">
-                        Standard citations is always enabled for both Your Workspace and Group Workspace.
-                    </p>
-                    <p class="mb-0">
-                        Users can see text content of the source/citation for documents.
-                    </p>
-                </div>
-
-
-                <div class="card p-3" id="enhanced-citations-section">
-                    <h5>
-                        <i class="bi bi-star me-2"></i>Enhanced Citations
-                    </h5>
-                    <p class="text-muted mb-2">
-                        Enable Enhanced Citation to store files in a Storage Account,
-                        and show direct references (Preview feature, files are saved to storage, presentation
-                        layer will be available in a future release).
-                    </p>
-
-                    {% set ec_storage_status = settings.enhanced_citations_storage_status or {} %}
-                    {% set ec_storage_state = ec_storage_status.state or 'not_initialized' %}
-                    {% if settings.enable_enhanced_citations %}
-                    <div
-                        class="alert {% if ec_storage_state in ['initialization_failed', 'not_initialized'] %}alert-warning{% else %}alert-info{% endif %} mb-3"
-                        id="enhanced-citations-storage-startup-status"
-                    >
-                        <div class="fw-semibold">Enhanced Citations storage startup status</div>
-                        <div>{{ ec_storage_status.message or 'Enhanced Citations storage status is not available for this process.' }}</div>
-                        <div class="small mt-1">
-                            Startup skips live storage container checks so storage outages do not block application boot.
-                            Use the connection test to validate current storage reachability and container access.
-                        </div>
-                        <button
-                            type="button"
-                            class="btn btn-outline-secondary btn-sm mt-2"
-                            id="test_enhanced_citations_storage_button"
-                        >
-                            Test Enhanced Citations Storage
-                        </button>
-                        <div class="mt-2" id="test_enhanced_citations_storage_result"></div>
-                    </div>
-                    {% endif %}
-
-
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_enhanced_citations"
-                            name="enable_enhanced_citations"
-                            {% if settings.enable_enhanced_citations %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_enhanced_citations">
-                            Enable Enhanced Citations
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Store original files in Azure Storage and provide direct file references and previews in citations for improved source tracking."></i>
-                    </div>
-
-
-                    <div id="enhanced_citation_settings" style="display: none;">
-
-                        <div class="card mb-3 p-3">
-                            <h6><strong>All filetypes</strong></h6>
-                            <div class="mb-3">
-                                <label for="office_docs_authentication_type" class="form-label">
-                                    Storage Account Authentication Type
-                                </label>
-                                <select class="form-select" id="office_docs_authentication_type" name="office_docs_authentication_type">
-                                    <option value="key" {% if settings.office_docs_authentication_type == "key" or not settings.office_docs_authentication_type %}selected{% endif %}>Connection String</option>
-                                    <option value="managed_identity" {% if settings.office_docs_authentication_type == "managed_identity" %}selected{% endif %}>Managed Identity</option>
-                                </select>
-                            </div>
-
-                            <div class="mb-3" id="office_docs_storage_conn_str_group" {% if settings.office_docs_authentication_type == "managed_identity" %}style="display:none;"{% endif %}>
-                                <label for="office_docs_storage_account_url" class="form-label">
-                                    Storage Account Connection String
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="office_docs_storage_account_url"
-                                        name="office_docs_storage_account_url"
-                                        value="{{ settings.office_docs_storage_account_url or '' }}"
-                                    >
-                                    <button type="button" class="btn btn-outline-secondary" id="toggle_office_conn_str">Show</button>
-                                </div>
-                            </div>
-
-                            <div class="mb-3" id="office_docs_storage_url_group" {% if settings.office_docs_authentication_type != "managed_identity" %}style="display:none;"{% endif %}>
-                                <label for="office_docs_storage_account_blob_endpoint" class="form-label">
-                                    Storage Account Blob Service Endpoint
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="office_docs_storage_account_blob_endpoint"
-                                        name="office_docs_storage_account_blob_endpoint"
-                                        value="{{ settings.office_docs_storage_account_blob_endpoint or '' }}"
-                                    >
-                                    <button type="button" class="btn btn-outline-secondary" id="toggle_office_url">Show</button>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="card mb-3 p-3">
-                            <h6><strong>Tabular Preview Limits</strong></h6>
-                            <div class="mb-3">
-                                <label for="tabular_preview_max_blob_size_mb" class="form-label">
-                                    Maximum File Size for Tabular Preview (MB)
-                                </label>
-                                <input type="number" class="form-control" id="tabular_preview_max_blob_size_mb"
-                                    name="tabular_preview_max_blob_size_mb"
-                                    min="1" max="1024"
-                                    value="{{ settings.tabular_preview_max_blob_size_mb or 200 }}">
-                                <small class="form-text text-muted">
-                                    Maximum blob size (in MB) allowed for tabular file previews (CSV, XLSX). Files larger than this will not be previewed.
-                                    Increase for larger files if your compute has sufficient memory, or decrease to protect smaller instances. Default: 200 MB.
-                                </small>
-                            </div>
-                            <hr>
-                            <h6><strong>Large Tabular Run Controls</strong></h6>
-                            <div class="form-check form-switch mb-3">
-                                <input class="form-check-input" type="checkbox" role="switch" id="enable_tabular_durable_run_confirmation" name="enable_tabular_durable_run_confirmation" {% if settings.enable_tabular_durable_run_confirmation | default(true) %}checked{% endif %}>
-                                <label class="form-check-label" for="enable_tabular_durable_run_confirmation">Confirm very large row-level runs before starting</label>
-                                <div class="form-text">When a prompt includes an explicit large row count, users are asked to continue or narrow scope before the run starts.</div>
-                            </div>
-                            <div class="row g-3 mb-3">
-                                <div class="col-md-6">
-                                    <label for="tabular_durable_run_confirmation_threshold_rows" class="form-label">Confirmation Row Threshold</label>
-                                    <input type="number" class="form-control" id="tabular_durable_run_confirmation_threshold_rows" name="tabular_durable_run_confirmation_threshold_rows" min="1" max="1000000" value="{{ settings.tabular_durable_run_confirmation_threshold_rows | default(500, true) }}">
-                                </div>
-                                <div class="col-md-6">
-                                    <label for="tabular_durable_run_confirmation_threshold_batches" class="form-label">Confirmation Batch Threshold</label>
-                                    <input type="number" class="form-control" id="tabular_durable_run_confirmation_threshold_batches" name="tabular_durable_run_confirmation_threshold_batches" min="1" max="100000" value="{{ settings.tabular_durable_run_confirmation_threshold_batches | default(75, true) }}">
-                                </div>
-                            </div>
-                            <div class="row g-3">
-                                <div class="col-md-6">
-                                    <label for="tabular_generated_output_chunk_model_mode" class="form-label">Chunk Processing Model</label>
-                                    <select class="form-select" id="tabular_generated_output_chunk_model_mode" name="tabular_generated_output_chunk_model_mode">
-                                        <option value="current" {% if settings.tabular_generated_output_chunk_model_mode | default('current', true) != 'configured' %}selected{% endif %}>Use the user's selected model</option>
-                                        <option value="configured" {% if settings.tabular_generated_output_chunk_model_mode | default('current', true) == 'configured' %}selected{% endif %}>Use a configured deployment for chunk work</option>
-                                    </select>
-                                </div>
-                                <div class="col-md-6">
-                                    <label for="tabular_generated_output_chunk_model_deployment" class="form-label">Configured Chunk Model Deployment</label>
-                                    <input type="text" class="form-control" id="tabular_generated_output_chunk_model_deployment" name="tabular_generated_output_chunk_model_deployment" maxlength="120" value="{{ settings.tabular_generated_output_chunk_model_deployment | default('', true) }}" autocomplete="off">
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <!-- <div class="card mb-3 p-3">
-                            <h6><strong>Video Files</strong></h6>
-                            {% if settings.enable_video_file_support %}
-
-                                <div class="mb-3">
-                                    <label for="video_files_storage_account_url" class="form-label">
-                                        Storage Account Connection String
-                                    </label>
-
-                                    <div class="input-group">
-                                        <input
-                                            type="password"
-                                            class="form-control"
-                                            id="video_files_storage_account_url"
-                                            name="video_files_storage_account_url"
-                                            value="{{ settings.video_files_storage_account_url or '' }}"
-                                        >
-                                        <button type="button" class="btn btn-outline-secondary" id="toggle_video_conn_str">Show</button>
-                                    </div>
-
-                                </div>
-                            {% else %}
-
-                                <p class="text-danger mb-1">
-                                    Video support is currently disabled in the Workspaces tab.
-                                </p>
-                                <p class="mt-2 mb-0">
-                                    <small class="text-muted">
-                                        Reference:
-                                        <a href="#workspaces" onclick="switchTab(event, 'workspaces-tab')">
-                                            Enable Video File Support
-                                        </a>
-                                        (see the Workspaces tab)
-                                    </small>
-                                </p>
-                            {% endif %}
-                        </div>
-
-
-                        <div class="card mb-3 p-3">
-                            <h6><strong>Audio Files</strong></h6>
-                            {% if settings.enable_audio_file_support %}
-
-                                <div class="mb-3">
-                                    <label for="audio_files_storage_account_url" class="form-label">
-                                        Storage Account Connection String
-                                    </label>
-
-                                    <div class="input-group">
-                                        <input
-                                            type="password"
-                                            class="form-control"
-                                            id="audio_files_storage_account_url"
-                                            name="audio_files_storage_account_url"
-                                            value="{{ settings.audio_files_storage_account_url or '' }}"
-                                        >
-                                        <button type="button" class="btn btn-outline-secondary" id="toggle_audio_conn_str">Show</button>
-                                    </div>
-
-                                </div>
-                            {% else %}
-
-                                <p class="text-danger mb-1">
-                                    Audio support is currently disabled in the Workspaces tab.
-                                </p>
-                                <p class="mt-2 mb-0">
-                                    <small class="text-muted">
-                                        Reference:
-                                        <a href="#workspaces" onclick="switchTab(event, 'workspaces-tab')">
-                                            Enable Audio File Support
-                                        </a>
-                                        (see the Workspaces tab)
-                                    </small>
-                                </p>
-                            {% endif %}
-                        </div> -->
-                    </div>
-                </div>
-            </div>
-
-
-            <div class="tab-pane fade" id="safety" role="tabpanel" aria-labelledby="safety-tab">
-
-                 <p class="text-muted">
-                    Configure content safety, archiving, and user feedback settings. If Content Safety is enabled, user
-                    messages will be sent to the safety endpoint for analysis. If User Feedback is enabled, users will see
-                    thumbs up/down to provide feedback on AI responses.
-                </p>
-                <div class="card p-3 mb-3" id="content-safety-section">
-                    <h5>
-                        <i class="bi bi-shield-exclamation me-2"></i>Content Safety
-                    </h5>
-                    <p class="text-muted">Enable content safety to filter out inappropriate content.</p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_content_safety"
-                            name="enable_content_safety"
-                            {% if settings.enable_content_safety %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_content_safety">
-                            Enable Content Safety
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Filter user messages and AI responses through Azure Content Safety service to detect and block inappropriate content."></i>
-                    </div>
-
-
-                    <div id="content_safety_settings"
-                         {% if not settings.enable_content_safety %}style="display: none;"{% endif %}>
-
-
-                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                            <input
-                                type="checkbox"
-                                class="form-check-input me-2"
-                                id="enable_content_safety_apim"
-                                name="enable_content_safety_apim"
-                                {% if settings.enable_content_safety_apim %}checked{% endif %}
-                            >
-                            <label class="form-check-label" for="enable_content_safety_apim">
-                                Use APIM instead of direct Content Safety endpoint
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route content safety requests through Azure API Management instead of directly to the Content Safety service for centralized monitoring and control."></i>
-                        </div>
-
-
-                        <div id="non_apim_content_safety_settings"
-                             {% if settings.enable_content_safety_apim %}style="display: none;"{% endif %}>
-                            <div class="mb-3">
-                                <label for="content_safety_endpoint" class="form-label">
-                                    Content Safety Endpoint
-                                </label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="content_safety_endpoint"
-                                    name="content_safety_endpoint"
-                                    value="{{ settings.content_safety_endpoint or '' }}"
-                                >
-                            </div>
-                            <div class="mb-3">
-                                <label for="content_safety_authentication_type" class="form-label">
-                                    Authentication Type
-                                </label>
-                                <select class="form-select" id="content_safety_authentication_type" name="content_safety_authentication_type">
-                                    <option value="key" {% if settings.content_safety_authentication_type=='key' %}selected{% endif %}>
-                                        Key
-                                    </option>
-                                    <option value="managed_identity" {% if settings.content_safety_authentication_type=='managed_identity' %}selected{% endif %}>
-                                        Managed Identity
-                                    </option>
-                                </select>
-                            </div>
-                            <div class="mb-3" id="content_safety_key_container" {% if settings.content_safety_authentication_type !='key' %}style="display: none;"{% endif %}>
-                                <label for="content_safety_key" class="form-label">
-                                    Content Safety Key
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="content_safety_key"
-                                        name="content_safety_key"
-                                        value="{{ settings.content_safety_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_content_safety_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <div id="apim_content_safety_settings"
-                             {% if not settings.enable_content_safety_apim %}style="display: none;"{% endif %}>
-                            <div class="mb-3">
-                                <label for="azure_apim_content_safety_endpoint" class="form-label">
-                                    Azure APIM Content Safety Endpoint
-                                </label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_apim_content_safety_endpoint"
-                                    name="azure_apim_content_safety_endpoint"
-                                    value="{{ settings.azure_apim_content_safety_endpoint or '' }}"
-                                >
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_apim_content_safety_subscription_key" class="form-label">
-                                    Azure APIM Content Safety Subscription Key
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_apim_content_safety_subscription_key"
-                                        name="azure_apim_content_safety_subscription_key"
-                                        value="{{ settings.azure_apim_content_safety_subscription_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_azure_apim_content_safety_subscription_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <div class="mb-3">
-                            <label for="content_safety_violation_message" class="form-label">
-                                Safety Violation Message <span class="text-muted fw-normal">(Markdown supported)</span>
-                            </label>
-                            <textarea
-                                class="form-control"
-                                id="content_safety_violation_message"
-                                name="content_safety_violation_message"
-                                rows="4"
-                                maxlength="3000"
-                                placeholder="Your message was blocked by Content Safety."
-                            >{{ settings.content_safety_violation_message or '' }}</textarea>
-                            <div class="form-text">Displayed when Content Safety blocks a chat message.</div>
-                        </div>
-
-                        <div class="form-group form-check form-switch mb-2">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="content_safety_include_trigger_information"
-                                name="content_safety_include_trigger_information"
-                                {% if settings.content_safety_include_trigger_information %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="content_safety_include_trigger_information">
-                                Include Trigger Information
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Show the reason, detected categories and severities, and blocklist matches below the safety message."></i>
-                        </div>
-                        <p class="form-text text-muted mb-3">Disable this option to show only the configured message.</p>
-
-                        <button type="button" class="btn btn-secondary mt-3" id="test_safety_button">
-                            Test Safety Connection
-                        </button>
-                        <div id="test_safety_result" class="mt-2"></div>
-                    </div>
-                </div>
-
-
-                <div class="card p-3 mb-3" id="user-feedback-section">
-                    <h5>
-                        <i class="bi bi-chat-square-heart me-2"></i>User Feedback
-                    </h5>
-                    <p class="text-muted">Enable user feedback (thumbs up/down) for AI responses.</p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_user_feedback"
-                            name="enable_user_feedback"
-                            {% if settings.enable_user_feedback %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_user_feedback">
-                            Enable User Feedback (Thumbs Up/Down)
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to provide thumbs up/down feedback on AI responses for quality monitoring and improvement."></i>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="desktop-notifications-section">
-                    <h5>
-                        <i class="bi bi-bell me-2"></i>Desktop Conversation Notifications
-                    </h5>
-                    <p class="text-muted">
-                        Allow users to receive an operating system notification when an AI response finishes while SimpleChat is open in a hidden or unfocused browser tab.
-                    </p>
-                    <div class="form-group form-check form-switch mb-2">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_desktop_notifications"
-                            name="enable_desktop_notifications"
-                            {% if settings.enable_desktop_notifications %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_desktop_notifications">
-                            Enable Desktop Conversation Notifications
-                        </label>
-                    </div>
-                    <p class="form-text text-muted mb-0">
-                        Users can turn notifications off from Profile. Browser permission is required, and notifications stop when the SimpleChat tab is closed.
-                    </p>
-                </div>
-
-
-                <div class="card p-3 mb-3" id="permissions-section">
-                    <h5>
-                        <i class="bi bi-person-check me-2"></i>Permissions
-                    </h5>
-                    <p class="text-muted">Control which users can access specific administrative views related to safety and feedback.</p>
-
-
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_safety_violation_admin"
-                            name="require_member_of_safety_violation_admin"
-                            {% if settings.require_member_of_safety_violation_admin %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_member_of_safety_violation_admin">
-                            Require SafetyViolationAdmin App Role
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the SafetyViolationAdmin Enterprise App role can access safety violation reports."></i>
-                    </div>
-                     <p class="text-muted small mb-3">
-                        Required app role value: <code>SafetyViolationAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the Safety Violations admin page.
-                    </p>
-
-
-                    <div class="form-group form-check form-switch mb-2">
-                        <input type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_feedback_admin"
-                            name="require_member_of_feedback_admin"
-                            {% if settings.require_member_of_feedback_admin %}checked{% endif %}>
-                        <label class="form-check-label ms-2" for="require_member_of_feedback_admin">
-                            Require FeedbackAdmin App Role
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="When enabled, only users assigned the FeedbackAdmin Enterprise App role can access user feedback reports."></i>
-                    </div>
-                     <p class="text-muted small mb-0">
-                        Required app role value: <code>FeedbackAdmin</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. If disabled, any user with the general <code>Admin</code> app role can access the User Feedback admin page. Requires <strong>Enable User Feedback</strong> to be active.
-                    </p>
-                </div>
-
-
-
-                <div class="card p-3 mb-3" id="conversation-archiving-section">
-                    <h5>
-                        <i class="bi bi-archive me-2"></i>Conversation Archiving
-                    </h5>
-                    <p class="text-muted">When enabled, conversation deletions will be archived instead of permanently deleted.</p>
-                    <div class="form-group form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_conversation_archiving"
-                            name="enable_conversation_archiving"
-                            {% if settings.enable_conversation_archiving %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_conversation_archiving">
-                            Enable Conversation Archiving
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Archive conversations instead of permanently deleting them, allowing for recovery and compliance with data retention policies."></i>
-                    </div>
-                </div>
-
-            </div>
-
-
-            <div class="tab-pane fade" id="search-extract" role="tabpanel" aria-labelledby="search-extract-tab">
-
-                 <p class="text-muted">
-                    Configure Azure AI Search, Document Intelligence, and multimedia support settings.
-                </p>
-
-                <div class="card p-3 mb-3" id="web-search-foundry-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0"><i class="bi bi-globe me-2"></i>Web Search (Azure AI Foundry Agent)</h5>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#webSearchFoundryInfoModal">
-                            <i class="bi bi-info-circle me-1"></i>Setup Guide
-                        </button>
-                    </div>
-                    <p class="text-muted mb-2">Enable web search by routing queries through an Azure AI Foundry agent configured by admins.</p>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_web_search"
-                            name="enable_web_search"
-                            {% if settings.enable_web_search %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_web_search">Enable Web Search via Foundry Agent</label>
-                    </div>
-                    <input
-                        type="hidden"
-                        id="web_search_consent_accepted"
-                        name="web_search_consent_accepted"
-                        value="{{ 'true' if settings.web_search_consent_accepted else 'false' }}"
-                    >
-
-                    <div id="web_search_foundry_settings" class="{% if not settings.enable_web_search %}d-none{% endif %}">
-                        <!-- User Notice Settings -->
-                        <div class="card p-3 mb-3 bg-light">
-                            <h6 class="mb-2"><i class="bi bi-bell me-2"></i>User Data Notice</h6>
-                            <p class="text-muted small mb-2">Optionally show users a one-time notice explaining that their message will be sent to Bing for web search.</p>
-                            <div class="form-check form-switch mb-3">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input mb-3"
-                                    id="enable_web_search_user_notice"
-                                    name="enable_web_search_user_notice"
-                                    {% if settings.enable_web_search_user_notice %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2 mb-3" for="enable_web_search_user_notice">Show data notice to users when web search is used</label>
-                            </div>
-                            <div id="web_search_user_notice_settings" class="{% if not settings.enable_web_search_user_notice %}d-none{% endif %}">
-                                <label for="web_search_user_notice_text" class="form-label">Notice Text</label>
-                                <textarea class="form-control" id="web_search_user_notice_text" name="web_search_user_notice_text" rows="2" placeholder="Your current message will be sent to Microsoft Bing for web search...">{{ settings.web_search_user_notice_text or 'Your current message will be sent to Microsoft Bing for web search. Conversation history is not sent for web search, but any sensitive content you paste into this message may be sent.' }}</textarea>
-                                <div class="form-text">This message will be shown to users once per session when they first use web search.</div>
-                            </div>
-                        </div>
-                        <div class="row g-3">
-                            <div class="col-12" id="web_search_foundry_endpoint_container">
-                                <label for="web_search_foundry_endpoint" class="form-label">Foundry Project Endpoint</label>
-                                <input type="text" class="form-control" id="web_search_foundry_endpoint" name="web_search_foundry_endpoint" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.endpoint if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else settings.web_search_agent.azure_openai_gpt_endpoint or '' }}" placeholder="https://<resource>.services.ai.azure.com/api/projects/<project-name>">
-                                <div class="form-text">Project endpoint format: https://&lt;foundry-resource&gt;.services.ai.azure.com/api/projects/&lt;project-name&gt; (not the inference endpoint).</div>
-                            </div>
-                            <div class="col-md-6" id="web_search_foundry_api_version_container">
-                                <label for="web_search_foundry_api_version" class="form-label">Foundry API Version</label>
-                                <input type="text" class="form-control" id="web_search_foundry_api_version" name="web_search_foundry_api_version" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.api_version if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else settings.web_search_agent.azure_openai_gpt_api_version or '' }}" placeholder="2025-05-01">
-                                <a href="https://learn.microsoft.com/en-us/rest/api/aifoundry/aiprojects/?view=foundry#versioning" target="_blank" class="ms-2" rel="noopener noreferrer">
-                                    AI Foundry Versioning<i class="bi bi-box-arrow-up-right"></i>
-                                </a>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="web_search_foundry_agent_id" class="form-label">Foundry Agent ID</label>
-                                <input type="text" class="form-control" id="web_search_foundry_agent_id" name="web_search_foundry_agent_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.agent_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="ID from Azure AI Foundry. Typically starts with asst_">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="web_search_foundry_auth_type" class="form-label">Authentication Type</label>
-                                <select class="form-select" id="web_search_foundry_auth_type" name="web_search_foundry_auth_type">
-                                    {% set foundry_auth_type = settings.web_search_agent.other_settings.azure_ai_foundry.authentication_type if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else 'managed_identity' %}
-                                    <option value="managed_identity" {% if foundry_auth_type=='managed_identity' %}selected{% endif %}>Managed Identity</option>
-                                    <option value="service_principal" {% if foundry_auth_type=='service_principal' %}selected{% endif %}>Service Principal</option>
-                                </select>
-                                <div class="form-text text-muted">Identity must have Cognitive Services User and AI Developer roles on the Foundry project.</div>
-                            </div>
-                            <div class="col-md-4" id="web_search_foundry_cloud_container">
-                                <label for="web_search_foundry_cloud" class="form-label">Cloud</label>
-                                <select class="form-select" id="web_search_foundry_cloud" name="web_search_foundry_cloud">
-                                    {% set foundry_cloud = settings.web_search_agent.other_settings.azure_ai_foundry.cloud if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' %}
-                                    <option value="" {% if foundry_cloud=='' %}selected{% endif %}>Azure Public</option>
-                                    <option value="usgov" {% if foundry_cloud=='usgov' or foundry_cloud=='usgovernment' or foundry_cloud=='gcc' %}selected{% endif %}>Azure Government</option>
-                                    <option value="custom" {% if foundry_cloud=='custom' %}selected{% endif %}>Custom</option>
-                                </select>
-                            </div>
-                            <div class="col-md-4" id="web_search_foundry_managed_identity_type_container">
-                                <label for="web_search_foundry_managed_identity_type" class="form-label">Managed Identity Type</label>
-                                <select class="form-select" id="web_search_foundry_managed_identity_type" name="web_search_foundry_managed_identity_type">
-                                    {% set foundry_mi_type = settings.web_search_agent.other_settings.azure_ai_foundry.managed_identity_type if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else 'system_assigned' %}
-                                    <option value="system_assigned" {% if foundry_mi_type=='system_assigned' %}selected{% endif %}>System-assigned (SAMI)</option>
-                                    <option value="user_assigned" {% if foundry_mi_type=='user_assigned' %}selected{% endif %}>User-assigned (UAMI)</option>
-                                </select>
-                            </div>
-                            <div class="col-12" id="web_search_foundry_authority_container">
-                                <label for="web_search_foundry_authority" class="form-label">Authority Endpoint (Custom Cloud)</label>
-                                <input type="text" class="form-control" id="web_search_foundry_authority" name="web_search_foundry_authority" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.authority if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="https://login.microsoftonline.com/ or https://login.microsoftonline.us/">
-                            </div>
-                            <div class="col-md-6" id="web_search_foundry_managed_identity_client_id_container">
-                                <label for="web_search_foundry_managed_identity_client_id" class="form-label">Managed Identity Client ID (UAMI)</label>
-                                <input type="text" class="form-control" id="web_search_foundry_managed_identity_client_id" name="web_search_foundry_managed_identity_client_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.managed_identity_client_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Client ID for user-assigned managed identity">
-                            </div>
-                        </div>
-
-                        <div class="row g-3 mt-1" id="web_search_foundry_service_principal_fields">
-                            <div class="col-md-4">
-                                <label for="web_search_foundry_tenant_id" class="form-label">Tenant ID</label>
-                                <input type="text" class="form-control" id="web_search_foundry_tenant_id" name="web_search_foundry_tenant_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.tenant_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Entra tenant ID">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="web_search_foundry_client_id" class="form-label">Client ID</label>
-                                <input type="text" class="form-control" id="web_search_foundry_client_id" name="web_search_foundry_client_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.client_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="App registration client ID">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="web_search_foundry_client_secret" class="form-label">Client Secret</label>
-                                <div class="input-group">
-                                    <input type="password" class="form-control" id="web_search_foundry_client_secret" name="web_search_foundry_client_secret" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.client_secret if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="Secret or Key Vault reference">
-                                    <button type="button" class="btn btn-outline-secondary" id="toggle_web_search_foundry_client_secret">Show</button>
-                                </div>
-                            </div>
-                        </div>
-
-                        <div class="border rounded p-3 mt-3">
-                            <div class="d-flex flex-column flex-lg-row align-items-lg-center justify-content-between gap-2">
-                                <div>
-                                    <h6 class="mb-1"><i class="bi bi-chat-square-dots me-2"></i>Web Search Test</h6>
-                                    <div class="text-muted small">Run the configured Foundry agent with the current unsaved settings.</div>
-                                </div>
-                                <button
-                                    type="button"
-                                    class="btn btn-outline-primary btn-sm"
-                                    id="test_web_search_button"
-                                    data-bs-toggle="modal"
-                                    data-bs-target="#webSearchTestModal"
-                                >
-                                    <i class="bi bi-play-circle me-1"></i>Test Web Search
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="url-access-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0"><i class="bi bi-link-45deg me-2"></i>URL Access</h5>
-                        <span class="badge text-bg-secondary">Shared Policy</span>
-                    </div>
-                    <p class="text-muted mb-2">Control direct URL content fetching for pasted chat links, workflow prompts, and Deep Research source review.</p>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_url_access"
-                            name="enable_url_access"
-                            {% if settings.enable_url_access %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_url_access">Enable URL Access for chat and workflows</label>
-                    </div>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="require_member_of_url_access_user"
-                            name="require_member_of_url_access_user"
-                            {% if settings.require_member_of_url_access_user %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="require_member_of_url_access_user">Require UrlAccessUser App Role</label>
-                        <div class="form-text">Required app role value: <code>UrlAccessUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use URL Access in chat or enable it for workflows.</div>
-                    </div>
-
-                    <div id="url_access_settings" class="{% if not settings.enable_url_access %}d-none{% endif %}">
-                        <div class="alert alert-info small mb-3">
-                            URL Access uses the same server-side URL protections as Deep Research: non-HTTP(S) URLs, credentialed URLs, literal IP targets, localhost, metadata hosts, unsafe redirects, unsupported content types, and oversized pages are blocked before fetch.
-                        </div>
-                        <div class="row g-3 mb-3">
-                            <div class="col-md-6">
-                                <label for="url_access_max_chat_urls_per_turn" class="form-label">Chat URL Limit</label>
-                                <input type="number" min="1" max="100" class="form-control" id="url_access_max_chat_urls_per_turn" name="url_access_max_chat_urls_per_turn" value="{{ settings.url_access_max_chat_urls_per_turn or 10 }}">
-                                <div class="form-text">Hard limit: 100 direct URLs per chat message.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="url_access_max_workflow_urls_per_run" class="form-label">Workflow URL Limit</label>
-                                <input type="number" min="1" max="500" class="form-control" id="url_access_max_workflow_urls_per_run" name="url_access_max_workflow_urls_per_run" value="{{ settings.url_access_max_workflow_urls_per_run or 50 }}">
-                                <div class="form-text">Hard limit: 500 direct URLs per workflow prompt.</div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="row g-3 mt-1">
-                        <div class="col-md-6">
-                            <div class="url-access-policy-editor" data-url-access-policy="url_access_allowed_domains" data-policy-kind="domain">
-                                <label for="url_access_allowed_domains_new" class="form-label">Allowed Domains</label>
-                                <textarea class="d-none" id="url_access_allowed_domains" name="url_access_allowed_domains" aria-hidden="true">{{ settings.url_access_allowed_domains|join('\n') if settings.url_access_allowed_domains else settings.source_review_allowed_domains|join('\n') if settings.source_review_allowed_domains else '' }}</textarea>
-                                <div class="input-group input-group-sm">
-                                    <input type="text" class="form-control" id="url_access_allowed_domains_new" data-policy-new-input placeholder="example.com or *.contoso.com" />
-                                    <button type="button" class="btn btn-outline-primary" data-policy-add-button>
-                                        <i class="bi bi-plus-circle me-1"></i>Add
-                                    </button>
-                                </div>
-                                <div class="list-group mt-2" data-policy-list aria-live="polite"></div>
-                            </div>
-                            <div class="form-text">Leave blank to allow any public domain that passes safety checks. Deep Research uses this same allow list.</div>
-                        </div>
-                        <div class="col-md-6">
-                            <div class="url-access-policy-editor" data-url-access-policy="url_access_blocked_domains" data-policy-kind="domain">
-                                <label for="url_access_blocked_domains_new" class="form-label">Blocked Domains</label>
-                                <textarea class="d-none" id="url_access_blocked_domains" name="url_access_blocked_domains" aria-hidden="true">{{ settings.url_access_blocked_domains|join('\n') if settings.url_access_blocked_domains else settings.source_review_blocked_domains|join('\n') if settings.source_review_blocked_domains else '' }}</textarea>
-                                <div class="input-group input-group-sm">
-                                    <input type="text" class="form-control" id="url_access_blocked_domains_new" data-policy-new-input placeholder="example.org or *.contoso.net" />
-                                    <button type="button" class="btn btn-outline-primary" data-policy-add-button>
-                                        <i class="bi bi-plus-circle me-1"></i>Add
-                                    </button>
-                                </div>
-                                <div class="list-group mt-2" data-policy-list aria-live="polite"></div>
-                            </div>
-                            <div class="form-text">Blocked domains apply to URL Access and Deep Research source-page review.</div>
-                        </div>
-                    </div>
-
-                    <div class="border rounded p-3 mt-3">
-                        <div class="d-flex flex-column flex-lg-row align-items-lg-center justify-content-between gap-2">
-                            <div>
-                                <h6 class="mb-1"><i class="bi bi-shield-check me-2"></i>URL Policy Test</h6>
-                                <div class="text-muted small">Check a URL against the current allowed and blocked domain rules before saving.</div>
-                            </div>
-                            <button
-                                type="button"
-                                class="btn btn-outline-primary btn-sm"
-                                id="open_url_access_policy_test_modal_button"
-                                data-bs-toggle="modal"
-                                data-bs-target="#urlAccessPolicyTestModal"
-                            >
-                                <i class="bi bi-play-circle me-1"></i>Test URL Policy
-                            </button>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="source-review-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0"><i class="bi bi-binoculars me-2"></i>Deep Research</h5>
-                        <div class="d-flex align-items-center gap-2">
-                            <span class="badge text-bg-secondary">Optional</span>
-                            <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#deepResearchInfoModal">
-                                <i class="bi bi-info-circle me-1"></i>Setup Guide
-                            </button>
-                        </div>
-                    </div>
-                    <p class="text-muted mb-2">Plan bounded web searches, inspect source pages, and keep an internal research ledger for evidence coverage. Direct pasted URLs use the shared URL Access controls above.</p>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_source_review"
-                            name="enable_source_review"
-                            {% if settings.enable_source_review %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_source_review">Enable Deep Research for chat</label>
-                    </div>
-
-                    <div id="source_review_settings" class="{% if not settings.enable_source_review %}d-none{% endif %}">
-                        <div class="alert alert-info small mb-3">
-                            Server-side protections always block non-HTTP(S) URLs, literal IP URL targets, localhost, metadata hosts, credentialed URLs, excessive redirects, unsupported content types, oversized pages, and requests beyond the configured page budget. DNS hostnames that resolve to private/internal addresses require the internal-host opt-in below.
-                        </div>
-
-                        <div class="form-check form-switch mb-3">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="require_member_of_deep_research_user"
-                                name="require_member_of_deep_research_user"
-                                {% if settings.require_member_of_deep_research_user %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="require_member_of_deep_research_user">Require DeepResearchUser App Role</label>
-                            <div class="form-text">Required app role value: <code>DeepResearchUser</code>. Assign this role to users or groups in the Enterprise App before enabling the requirement. When enabled, only assigned users can use Deep Research.</div>
-                        </div>
-
-                        <div class="form-check form-switch mb-3">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="source_review_allow_internal_hosts"
-                                name="source_review_allow_internal_hosts"
-                                {% if settings.source_review_allow_internal_hosts %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2" for="source_review_allow_internal_hosts">Allow internal network hostnames</label>
-                            <div class="form-text">Allows DNS hostnames that resolve to private/internal addresses. Literal IP URL targets, localhost, metadata hosts, link-local addresses, and reserved addresses remain blocked.</div>
-                        </div>
-
-                        <div class="row g-3">
-                            <div class="col-md-4">
-                                <label for="source_review_default_mode" class="form-label">Activation Mode</label>
-                                <select class="form-select" id="source_review_default_mode" disabled>
-                                    <option value="manual" selected>User toggle only</option>
-                                </select>
-                                <input type="hidden" name="source_review_default_mode" value="manual" />
-                                <div class="form-text">Deep Research runs only when the user selects it for the message.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_max_pages_per_turn" class="form-label">Max Pages per Turn</label>
-                                <input type="number" min="1" max="10" class="form-control" id="source_review_max_pages_per_turn" name="source_review_max_pages_per_turn" value="{{ settings.source_review_max_pages_per_turn or 10 }}">
-                                <div class="form-text">Hard limit: 10 pages.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_max_seed_pages_per_turn" class="form-label">Max Seed Pages per Turn</label>
-                                <input type="number" min="1" max="10" class="form-control" id="source_review_max_seed_pages_per_turn" name="source_review_max_seed_pages_per_turn" value="{{ settings.source_review_max_seed_pages_per_turn or 10 }}">
-                                <div class="form-text">Limits initial search-result and direct URL pages so budget remains for child pages.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="deep_research_max_user_urls_per_turn" class="form-label">Max User URLs per Turn</label>
-                                <input type="number" min="1" max="100" class="form-control" id="deep_research_max_user_urls_per_turn" name="deep_research_max_user_urls_per_turn" value="{{ settings.deep_research_max_user_urls_per_turn or 100 }}">
-                                <div class="form-text">Direct URLs beyond this cap are recorded as omitted in the ledger.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="deep_research_max_search_queries_per_turn" class="form-label">Max Search Queries per Turn</label>
-                                <input type="number" min="1" max="8" class="form-control" id="deep_research_max_search_queries_per_turn" name="deep_research_max_search_queries_per_turn" value="{{ settings.deep_research_max_search_queries_per_turn or 8 }}">
-                                <div class="form-text">Includes the original current-message query.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_timeout_seconds" class="form-label">Timeout per Turn</label>
-                                <input type="number" min="3" max="30" class="form-control" id="source_review_timeout_seconds" name="source_review_timeout_seconds" value="{{ settings.source_review_timeout_seconds or 30 }}">
-                                <div class="form-text">Hard limit: 30 seconds.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_max_redirects" class="form-label">Max Redirects</label>
-                                <input type="number" min="0" max="5" class="form-control" id="source_review_max_redirects" name="source_review_max_redirects" value="{{ settings.source_review_max_redirects if settings.source_review_max_redirects is not none else 5 }}">
-                                <div class="form-text">Every redirect target is revalidated.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_max_bytes_per_page_mb" class="form-label">Max MB per Page</label>
-                                <input type="number" min="1" max="5" class="form-control" id="source_review_max_bytes_per_page_mb" name="source_review_max_bytes_per_page_mb" value="{{ (((settings.source_review_max_bytes_per_page|default(5000000, true)|int) / 1000000)|round(0, 'ceil'))|int }}">
-                                <div class="form-text">Hard limit: 5 MB.</div>
-                            </div>
-                            <div class="col-md-4">
-                                <label for="source_review_max_depth" class="form-label">Source Traversal Depth</label>
-                                <input type="number" min="0" max="2" class="form-control" id="source_review_max_depth" name="source_review_max_depth" value="{{ settings.source_review_max_depth if settings.source_review_max_depth is not none else 2 }}">
-                                <div class="form-text">Depth 2 follows selected links from seed and child pages.</div>
-                            </div>
-                        </div>
-
-                        <div class="row g-3 mt-1">
-                            <div class="col-md-6">
-                                {% set js_runtime = source_review_runtime_capabilities or {} %}
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="enable_deep_source_review"
-                                        name="enable_deep_source_review"
-                                        {% if settings.enable_deep_source_review %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="enable_deep_source_review">Inspect linked source pages</label>
-                                </div>
-                                <div id="source_review_deep_settings" class="form-text {% if not settings.enable_deep_source_review %}d-none{% endif %}">Deep Research follows only scored, policy-approved links within the page and depth budgets.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="deep_research_enable_query_planning"
-                                        name="deep_research_enable_query_planning"
-                                        {% if settings.deep_research_enable_query_planning %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="deep_research_enable_query_planning">Plan multiple web search queries</label>
-                                </div>
-                                <div class="form-text">The selected chat model can propose bounded current-message-only query variants before page review.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="deep_research_enable_ledger_artifact"
-                                        name="deep_research_enable_ledger_artifact"
-                                        {% if settings.deep_research_enable_ledger_artifact %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="deep_research_enable_ledger_artifact">Save research ledger artifacts</label>
-                                </div>
-                                <div class="form-text">Creates a Markdown chat artifact with search queries, reviewed sources, skipped URLs, and coverage.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="source_review_enable_llm_planning"
-                                        name="source_review_enable_llm_planning"
-                                        {% if settings.source_review_enable_llm_planning %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="source_review_enable_llm_planning">Use model-assisted source link planning</label>
-                                </div>
-                                <div class="form-text">When source pages expose candidate links, the selected chat model can rank those candidates before the server fetches them.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="source_review_allow_js_rendering"
-                                        name="source_review_allow_js_rendering"
-                                        {% if settings.source_review_allow_js_rendering and js_runtime.js_rendering_available %}checked{% endif %}
-                                        {% if not js_runtime.js_rendering_available %}disabled{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="source_review_allow_js_rendering">Allow JavaScript rendering fallback</label>
-                                </div>
-                                <div class="form-text">Requires verified Playwright browser runtime support on the app host.</div>
-                                <div class="small mt-1 {% if js_runtime.js_rendering_available %}text-success{% else %}text-warning{% endif %}" id="source_review_js_runtime_status">
-                                    <i class="bi {% if js_runtime.js_rendering_available %}bi-check-circle{% else %}bi-exclamation-triangle{% endif %} me-1"></i>{{ js_runtime.message or 'Runtime support has not been checked yet.' }}
-                                </div>
-                                {% if not js_runtime.js_rendering_available %}
-                                <div class="small text-muted mt-1">Install/enable the Playwright Chromium runtime, then reload Admin Settings to enable this option.</div>
-                                {% endif %}
-                                {% if js_runtime.sandbox_disabled %}
-                                <div class="small text-warning mt-1">Chromium sandbox is disabled by environment configuration.</div>
-                                {% endif %}
-                            </div>
-                            <div class="col-md-6">
-                                <label for="source_review_js_load_more_clicks" class="form-label">Rendered Load More Clicks</label>
-                                <input type="number" min="0" max="12" class="form-control" id="source_review_js_load_more_clicks" name="source_review_js_load_more_clicks" value="{{ settings.source_review_js_load_more_clicks if settings.source_review_js_load_more_clicks is not none else 12 }}">
-                                <div class="form-text">When JavaScript rendering is enabled, Deep Research can click visible Load More controls until this cap is reached.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="source_review_respect_robots_txt"
-                                        name="source_review_respect_robots_txt"
-                                        {% if settings.source_review_respect_robots_txt %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="source_review_respect_robots_txt">Respect robots.txt</label>
-                                </div>
-                            </div>
-                            <div class="col-md-6">
-                                <div class="form-check form-switch mb-2">
-                                    <input
-                                        type="checkbox"
-                                        class="form-check-input"
-                                        id="source_review_audit_logging"
-                                        name="source_review_audit_logging"
-                                        {% if settings.source_review_audit_logging %}checked{% endif %}
-                                    >
-                                    <label class="form-check-label ms-2" for="source_review_audit_logging">Log Deep Research activity</label>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="web-search-consent-modal" tabindex="-1" aria-labelledby="web-search-consent-title" aria-hidden="true">
-                    <div class="modal-dialog modal-dialog-centered modal-lg">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="web-search-consent-title">Web Search Consent Required</h5>
-                            </div>
-                            <div class="modal-body">
-                                <p>
-                                    When you use Grounding with Bing Search, your customer data is transferred outside of the Azure compliance boundary to the Grounding with Bing Search service. Grounding with Bing Search is not subject to the same data processing terms (including location of processing) and does not have the same compliance standards and certifications as the Azure AI Agent Service, as described in the <a href="https://www.microsoft.com/en-us/bing/apis/grounding-legal" target="_blank" rel="noopener noreferrer">Grounding with Bing Search TOU</a>. It is your responsibility to assess whether use of Grounding with Bing Search in your agent meets your needs and requirements.
-                                </p>
-                                <div class="alert alert-warning mb-0">
-                                    Only the user's current message is sent for web search. Users should avoid including sensitive content in any message that uses web search.
-                                </div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" id="web-search-consent-decline">Disagree</button>
-                                <button type="button" class="btn btn-primary" id="web-search-consent-accept">Agree</button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="webSearchTestModal" tabindex="-1" aria-labelledby="web-search-test-title" aria-hidden="true">
-                    <div class="modal-dialog modal-dialog-centered modal-lg">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="web-search-test-title">Web Search Test</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <label for="web_search_test_query" class="form-label">Test Prompt</label>
-                                <textarea class="form-control" id="web_search_test_query" rows="3">Use the Grounding with Bing Search tool to find the official Microsoft website. Reply with the page title and URL only.</textarea>
-                                <div id="test_web_search_result" class="mt-3" aria-live="polite"></div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
-                                <button type="button" class="btn btn-primary" id="rerun_web_search_test_button">
-                                    <i class="bi bi-arrow-clockwise me-1"></i>Run Again
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <div class="modal fade" id="urlAccessPolicyTestModal" tabindex="-1" aria-labelledby="url-access-policy-test-title" aria-hidden="true">
-                    <div class="modal-dialog modal-dialog-centered modal-lg">
-                        <div class="modal-content">
-                            <div class="modal-header">
-                                <h5 class="modal-title" id="url-access-policy-test-title">URL Policy Test</h5>
-                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                            </div>
-                            <div class="modal-body">
-                                <label for="url_access_policy_test_url" class="form-label">URL</label>
-                                <input type="url" class="form-control" id="url_access_policy_test_url" placeholder="https://www.example.com/page" />
-                                <div id="test_url_access_policy_result" class="mt-3" aria-live="polite"></div>
-                            </div>
-                            <div class="modal-footer">
-                                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
-                                <button type="button" class="btn btn-primary" id="test_url_access_policy_button">
-                                    <i class="bi bi-shield-check me-1"></i>Run Policy Test
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-
-                <div class="card p-3 mb-3" id="azure-ai-search-section">
-                    <h5><i class="bi bi-search me-2"></i>Azure AI Search</h5>
-                    <p class="text-muted">
-                        Configure Azure AI Search settings.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                        <input
-                            type="checkbox"
-                            class="form-check-input me-2"
-                            id="enable_ai_search_apim"
-                            name="enable_ai_search_apim"
-                            {% if settings.enable_ai_search_apim %}checked{% endif %}
-                        >
-                        <label class="form-check-label" for="enable_ai_search_apim">
-                            Use APIM instead of direct Azure AI Search
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route Azure AI Search requests through API Management for centralized monitoring and control instead of direct service access."></i>
-                    </div>
-
-                    <div>
-
-                        <div id="non_apim_ai_search_settings" {% if settings.enable_ai_search_apim %}style="display: none;"{% endif %}>
-                            <div class="mb-3">
-                                <label for="azure_ai_search_endpoint" class="form-label">Search Endpoint</label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_ai_search_endpoint"
-                                    name="azure_ai_search_endpoint"
-                                    value="{{ settings.azure_ai_search_endpoint or '' }}"
-                                >
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_ai_search_authentication_type" class="form-label">
-                                    Authentication Type
-                                </label>
-                                <select class="form-select" id="azure_ai_search_authentication_type" name="azure_ai_search_authentication_type">
-                                    <option value="key" {% if settings.azure_ai_search_authentication_type=='key' %}selected{% endif %}>
-                                        Key
-                                    </option>
-                                    <option value="managed_identity" {% if settings.azure_ai_search_authentication_type=='managed_identity' %}selected{% endif %}>
-                                        Managed Identity
-                                    </option>
-                                </select>
-                            </div>
-                            <div class="mb-3" id="azure_ai_search_key_container" {% if settings.azure_ai_search_authentication_type !='key' %}style="display: none;"{% endif %}>
-                                <label for="azure_ai_search_key" class="form-label">Search Key</label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_ai_search_key"
-                                        name="azure_ai_search_key"
-                                        value="{{ settings.azure_ai_search_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_search_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <div id="apim_ai_search_settings" {% if not settings.enable_ai_search_apim %}style="display: none;"{% endif %}>
-                            <div class="mb-3">
-                                <label for="azure_apim_ai_search_endpoint" class="form-label">
-                                    Azure APIM AI Search Endpoint
-                                </label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_apim_ai_search_endpoint"
-                                    name="azure_apim_ai_search_endpoint"
-                                    value="{{ settings.azure_apim_ai_search_endpoint or '' }}"
-                                >
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_apim_ai_search_subscription_key" class="form-label">
-                                    Azure APIM AI Search Subscription Key
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_apim_ai_search_subscription_key"
-                                        name="azure_apim_ai_search_subscription_key"
-                                        value="{{ settings.azure_apim_ai_search_subscription_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_azure_apim_ai_search_subscription_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <button
-                            type="button"
-                            class="btn btn-secondary mt-3"
-                            style="width: auto;"
-                            id="test_azure_ai_search_button"
-                        >
-                            Test Azure AI Search Connection
-                        </button>
-                        <div id="test_azure_ai_search_result" class="mt-2"></div>
-                    </div>
-                </div>
-
-
-                <div class="card p-3 mb-3" id="document-intelligence-section">
-                    <h5><i class="bi bi-file-earmark-text me-2"></i>Document Intelligence</h5>
-                    <p class="text-muted">
-                        Configure Azure Document Intelligence settings. Document Intelligence always powers
-                        <strong>Standard</strong> extraction and is required for workspaces and chat file uploads.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                        <input
-                            type="checkbox"
-                            class="form-check-input me-2"
-                            id="enable_enhanced_extraction"
-                            name="enable_enhanced_extraction"
-                            {% if settings.enable_enhanced_extraction %}checked{% endif %}
-                        >
-                        <label class="form-check-label" for="enable_enhanced_extraction">
-                            Enable Enhanced extraction
-                        </label>
-                        <button
-                            type="button"
-                            class="btn btn-sm btn-outline-secondary rounded-circle ms-2"
-                            data-bs-toggle="modal"
-                            data-bs-target="#documentIntelligenceExtractionHelpModal"
-                            aria-label="Enhanced extraction guidance"
-                            title="Enhanced extraction guidance"
-                        >
-                            <i class="bi bi-question-lg" aria-hidden="true"></i>
-                        </button>
-                    </div>
-
-                    <div id="enhanced_extraction_settings" class="{% if not settings.enable_enhanced_extraction %}d-none{% endif %}">
-                        {% if content_understanding_supported %}
-                        <div class="alert alert-info small" role="note">
-                            Enhanced extraction uses <strong>Azure AI Content Understanding</strong>, which returns tables,
-                            page structure, checkbox states, and AI-generated descriptions of figures, charts, and images.
-                            Configure the connection below.
-                        </div>
-                        {% else %}
-                        <div class="alert alert-secondary small" id="enhanced_extraction_fallback_notice" role="note">
-                            Azure AI Content Understanding is not available in the
-                            <strong>{{ azure_environment }}</strong> cloud, so Enhanced extraction uses
-                            <strong>Document Intelligence Layout</strong> here. There is nothing more to configure —
-                            Enhanced still captures tables, page structure, forms, and checkbox states.
-                        </div>
-                        {% endif %}
-
-                        <div class="mb-3">
-                            <label for="document_intelligence_pdf_image_extraction_mode" class="form-label mb-0">
-                                PDF and Image Extraction Mode
-                            </label>
-                            <select
-                                class="form-select"
-                                id="document_intelligence_pdf_image_extraction_mode"
-                                name="document_intelligence_pdf_image_extraction_mode"
-                            >
-                                <option value="read" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'read' %}selected{% endif %}>
-                                    Standard - faster text extraction
-                                </option>
-                                <option value="layout" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'layout' %}selected{% endif %}>
-                                    Enhanced - richer structure, tables, and checkbox states
-                                </option>
-                                <option value="auto" {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') == 'auto' %}selected{% endif %}>
-                                    Auto - sample first pages, then choose Standard or Enhanced
-                                </option>
-                            </select>
-                            <div class="form-text">
-                                Enhanced captures more document detail for PDFs and images, including tables, page structure, and checked or unchecked marks. It adds latency and has a 6X increase for every 1000 pages when selected.
-                            </div>
-                            <div
-                                class="mt-3 {% if settings.document_intelligence_pdf_image_extraction_mode|default('read') != 'auto' %}d-none{% endif %}"
-                                id="document_intelligence_auto_sample_pages_group"
-                            >
-                                <label for="document_intelligence_auto_sample_pages" class="form-label">
-                                    Auto Sample Pages
-                                </label>
-                                <input
-                                    type="number"
-                                    class="form-control"
-                                    id="document_intelligence_auto_sample_pages"
-                                    name="document_intelligence_auto_sample_pages"
-                                    min="1"
-                                    max="20"
-                                    value="{{ settings.document_intelligence_auto_sample_pages|default(3) }}"
-                                >
-                                <div class="form-text">
-                                    Auto samples this many first PDF pages with Document Intelligence Layout. If it detects tables, selection marks, or figures, the full PDF uses Enhanced; otherwise it finishes with Standard. Images use Enhanced in Auto mode.
-                                </div>
-                            </div>
-                            <div class="alert alert-light border mt-3 mb-0 small" role="note">
-                                <div><strong>Standard:</strong> Document Intelligence Read. Fastest and lowest-cost path for plain text PDFs and images.</div>
-                                <div><strong>Enhanced:</strong> best for tables, section structure, page layout, forms, checkbox states, and figure descriptions. Expect more latency and higher cost.</div>
-                                <div><strong>Auto:</strong> samples the first pages with Document Intelligence Layout, then uses Enhanced only when the sample shows tables, selection marks, or figures.</div>
-                            </div>
-                        </div>
-
-                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                            <input
-                                type="checkbox"
-                                class="form-check-input me-2"
-                                id="enable_document_intelligence_formula_extraction"
-                                name="enable_document_intelligence_formula_extraction"
-                                {% if settings.enable_document_intelligence_formula_extraction %}checked{% endif %}
-                            >
-                            <label class="form-check-label" for="enable_document_intelligence_formula_extraction">
-                                Extract mathematical formulas
-                            </label>
-                            <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Requests the Document Intelligence formulas add-on so equations are captured as LaTeX instead of approximated as OCR text."></i>
-                        </div>
-                        <div class="form-text mb-3">
-                            Captures equations in PDFs and images as LaTeX rather than approximate OCR text. This is a
-                            <strong>billed Document Intelligence add-on</strong> that adds per-page cost to every Enhanced
-                            extraction, so it is off by default. It applies to the Layout model only, so it has no effect
-                            while extraction is set to Standard.
-                        </div>
-
-                        {% if content_understanding_supported %}
-                        <div class="card p-3 mb-3 bg-body-tertiary" id="content-understanding-section">
-                            <div class="d-flex align-items-center gap-2 flex-wrap mb-2">
-                                <h6 class="mb-0"><i class="bi bi-stars me-2"></i>Azure AI Content Understanding</h6>
-                                <button
-                                    type="button"
-                                    class="btn btn-sm btn-outline-secondary rounded-circle"
-                                    data-bs-toggle="modal"
-                                    data-bs-target="#contentUnderstandingSetupHelpModal"
-                                    aria-label="Content Understanding setup guide"
-                                    title="Content Understanding setup guide"
-                                >
-                                    <i class="bi bi-question-lg" aria-hidden="true"></i>
-                                </button>
-                            </div>
-                            <p class="text-muted small">
-                                Required for Enhanced extraction. Deployed from a Microsoft Foundry resource.
-                                If this is left blank, Enhanced falls back to Document Intelligence Layout.
-                            </p>
-
-                            <div class="mb-3">
-                                <label for="azure_content_understanding_endpoint" class="form-label">
-                                    Foundry Endpoint
-                                </label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_content_understanding_endpoint"
-                                    name="azure_content_understanding_endpoint"
-                                    placeholder="https://your-resource.services.ai.azure.com"
-                                    value="{{ settings.azure_content_understanding_endpoint or '' }}"
-                                >
-                                <div class="form-text">
-                                    Your Microsoft Foundry resource endpoint, without a trailing path.
-                                </div>
-                            </div>
-
-                            <div class="mb-3">
-                                <label for="azure_content_understanding_authentication_type" class="form-label">
-                                    Authentication Type
-                                </label>
-                                <select class="form-select" id="azure_content_understanding_authentication_type" name="azure_content_understanding_authentication_type">
-                                    <option value="key" {% if settings.azure_content_understanding_authentication_type != 'managed_identity' %}selected{% endif %}>
-                                        Key
-                                    </option>
-                                    <option value="managed_identity" {% if settings.azure_content_understanding_authentication_type == 'managed_identity' %}selected{% endif %}>
-                                        Managed Identity
-                                    </option>
-                                </select>
-                                <div class="form-text">
-                                    Managed identity requires the <strong>Cognitive Services User</strong> role on the Foundry resource.
-                                </div>
-                            </div>
-
-                            <div class="mb-3 {% if settings.azure_content_understanding_authentication_type == 'managed_identity' %}d-none{% endif %}" id="azure_content_understanding_key_container">
-                                <label for="azure_content_understanding_key" class="form-label">
-                                    Content Understanding Key
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_content_understanding_key"
-                                        name="azure_content_understanding_key"
-                                        value="{{ settings.azure_content_understanding_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_content_understanding_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-
-                            <div class="row g-3 mb-3">
-                                <div class="col-md-4">
-                                    <label for="azure_content_understanding_api_version" class="form-label">API Version</label>
-                                    <input
-                                        type="text"
-                                        class="form-control"
-                                        id="azure_content_understanding_api_version"
-                                        name="azure_content_understanding_api_version"
-                                        value="{{ settings.azure_content_understanding_api_version or content_understanding_api_version_default }}"
-                                    >
-                                    <div class="form-text">Default: {{ content_understanding_api_version_default }}</div>
-                                </div>
-                                <div class="col-md-4">
-                                    <label for="azure_content_understanding_analyzer_id" class="form-label">Document Analyzer</label>
-                                    <input
-                                        type="text"
-                                        class="form-control"
-                                        id="azure_content_understanding_analyzer_id"
-                                        name="azure_content_understanding_analyzer_id"
-                                        value="{{ settings.azure_content_understanding_analyzer_id or content_understanding_document_analyzer_default }}"
-                                    >
-                                    <div class="form-text">Default: {{ content_understanding_document_analyzer_default }}</div>
-                                </div>
-                                <div class="col-md-4">
-                                    <label for="azure_content_understanding_image_analyzer_id" class="form-label">Image Analyzer</label>
-                                    <input
-                                        type="text"
-                                        class="form-control"
-                                        id="azure_content_understanding_image_analyzer_id"
-                                        name="azure_content_understanding_image_analyzer_id"
-                                        value="{{ settings.azure_content_understanding_image_analyzer_id or content_understanding_image_analyzer_default }}"
-                                    >
-                                    <div class="form-text">Default: {{ content_understanding_image_analyzer_default }}</div>
-                                </div>
-                            </div>
-
-                            <button
-                                type="button"
-                                class="btn btn-secondary"
-                                style="width: auto;"
-                                id="test_content_understanding_button"
-                            >
-                                Test Content Understanding Connection
-                            </button>
-                            <div id="test_content_understanding_result" class="mt-2"></div>
-                        </div>
-                        {% endif %}
-                    </div>
-
-                    <div class="card p-3 mb-3 bg-body-tertiary" id="office-embedded-image-section">
-                        <h6 class="mb-2"><i class="bi bi-images me-2"></i>Images Inside Office Files</h6>
-                        <p class="text-muted small">
-                            Neither extraction engine describes figures inside Word and PowerPoint files. When this is on,
-                            embedded images are pulled out of the file, analyzed with whichever engine backs the selected
-                            extraction mode, and indexed as their own citable chunks. This works with Standard extraction
-                            too, using Document Intelligence.
-                        </p>
-                        <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                            <input
-                                type="checkbox"
-                                class="form-check-input me-2"
-                                id="enable_office_embedded_image_analysis"
-                                name="enable_office_embedded_image_analysis"
-                                {% if settings.enable_office_embedded_image_analysis %}checked{% endif %}
-                            >
-                            <label class="form-check-label" for="enable_office_embedded_image_analysis">
-                                Analyze images embedded in DOCX and PPTX files
-                            </label>
-                        </div>
-                        <div class="row g-3 {% if not settings.enable_office_embedded_image_analysis %}d-none{% endif %}" id="office_embedded_image_options">
-                            <div class="col-md-6">
-                                <label for="office_embedded_image_min_pixels" class="form-label">Minimum Image Size (pixels)</label>
-                                <input
-                                    type="number"
-                                    class="form-control"
-                                    id="office_embedded_image_min_pixels"
-                                    name="office_embedded_image_min_pixels"
-                                    min="1"
-                                    max="2000"
-                                    value="{{ settings.office_embedded_image_min_pixels|default(150) }}"
-                                >
-                                <div class="form-text">Images narrower or shorter than this are skipped as icons or spacers.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="office_embedded_image_max_per_document" class="form-label">Maximum Images Per Document</label>
-                                <input
-                                    type="number"
-                                    class="form-control"
-                                    id="office_embedded_image_max_per_document"
-                                    name="office_embedded_image_max_per_document"
-                                    min="0"
-                                    max="200"
-                                    value="{{ settings.office_embedded_image_max_per_document|default(25) }}"
-                                >
-                                <div class="form-text">Caps per-document cost. Duplicate images are analyzed once.</div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="modal fade" id="documentIntelligenceExtractionHelpModal" tabindex="-1" aria-labelledby="documentIntelligenceExtractionHelpModalLabel" aria-hidden="true">
-                        <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                            <div class="modal-content">
-                                <div class="modal-header">
-                                    <h5 class="modal-title" id="documentIntelligenceExtractionHelpModalLabel">Standard, Enhanced, and Auto</h5>
-                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                                </div>
-                                <div class="modal-body">
-                                    <p><strong>Standard</strong> always uses Azure Document Intelligence Read. It is the fastest and lowest-cost path for mostly text-based PDFs and images, and it is what runs when Enhanced extraction is turned off.</p>
-                                    <p><strong>Enhanced</strong> is for documents where structure matters: tables, page layout, headings, forms, checked or unchecked boxes, and figures.</p>
-                                    <ul>
-                                        <li>In Azure commercial clouds, Enhanced uses <strong>Azure AI Content Understanding</strong>, which additionally generates natural-language descriptions of figures, charts, and diagrams.</li>
-                                        <li>In Azure Government and custom clouds, Content Understanding is unavailable, so Enhanced automatically uses <strong>Document Intelligence Layout</strong> instead. Tables and checkbox states still work; figure descriptions do not.</li>
-                                        <li>If Content Understanding is enabled but unreachable, the document falls back to Document Intelligence Layout and the reason is recorded on the document.</li>
-                                    </ul>
-                                    <p><strong>Auto</strong> lets the platform decide per document. It samples the configured number of first PDF pages with Document Intelligence Layout, which is the cheaper detector. If those pages contain tables, selection marks, or figures, the full document is extracted with Enhanced; otherwise it is extracted with Standard. Images always use Enhanced in Auto mode because they are single-page inputs that benefit from figure and spatial analysis.</p>
-                                    <p class="mb-0"><strong>Cost:</strong> Enhanced adds latency and cost on every document. Content Understanding also invokes a language model per document, so it is more expensive than Document Intelligence Layout. Auto is usually the best value.</p>
-                                </div>
-                                <div class="modal-footer">
-                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-
-                    <div class="modal fade" id="contentUnderstandingSetupHelpModal" tabindex="-1" aria-labelledby="contentUnderstandingSetupHelpModalLabel" aria-hidden="true">
-                        <div class="modal-dialog modal-lg modal-dialog-scrollable">
-                            <div class="modal-content">
-                                <div class="modal-header">
-                                    <h5 class="modal-title" id="contentUnderstandingSetupHelpModalLabel">Set Up Azure AI Content Understanding</h5>
-                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                                </div>
-                                <div class="modal-body">
-                                    <p>Content Understanding is part of Microsoft Foundry. Follow these steps, then paste the endpoint and key below.</p>
-                                    <h6>1. Create a Microsoft Foundry resource</h6>
-                                    <p>
-                                        In the Azure portal, create a <strong>Microsoft Foundry</strong> resource in one of the supported regions:
-                                        East US, East US 2, West US, West US 3, South Central US, North Europe, West Europe, Sweden Central,
-                                        UK South, Australia East, Japan East, or Southeast Asia. You need Contributor or higher on the subscription
-                                        or resource group.
-                                    </p>
-                                    <div class="alert alert-warning small">
-                                        Content Understanding is not offered in Azure Government or other sovereign clouds. In those clouds
-                                        SimpleChat automatically uses Document Intelligence Layout for Enhanced extraction.
-                                    </div>
-                                    <h6>2. Deploy the models Content Understanding needs</h6>
-                                    <p>
-                                        Analyzers that describe figures require a completion model and an embedding model to be deployed and set
-                                        as resource defaults. In the
-                                        <a href="https://contentunderstanding.ai.azure.com/settings" target="_blank" rel="noopener noreferrer">Content Understanding settings page</a>,
-                                        add your Foundry resource and leave
-                                        <em>Enable autodeployment for required models if no defaults are available</em> checked. Without this step,
-                                        analysis requests fail with a missing model deployment error.
-                                    </p>
-                                    <h6>3. Copy the endpoint and key</h6>
-                                    <p>
-                                        In the Azure portal, open the Foundry resource and go to
-                                        <strong>Resource Management &rarr; Keys and Endpoint</strong>. The endpoint looks like
-                                        <code>https://your-resource.services.ai.azure.com</code>. Paste it into
-                                        <strong>Content Understanding Endpoint</strong>, and paste either key into
-                                        <strong>Content Understanding Key</strong>.
-                                    </p>
-                                    <h6>4. Or use managed identity instead of a key</h6>
-                                    <p>
-                                        Set <strong>Authentication Type</strong> to Managed Identity and assign this application's identity the
-                                        <strong>Cognitive Services User</strong> role on the Foundry resource. That role assignment is required even
-                                        for resource owners.
-                                    </p>
-                                    <h6>5. Test the connection</h6>
-                                    <p class="mb-0">
-                                        Use <strong>Test Content Understanding Connection</strong> to confirm the endpoint, credentials, and analyzer
-                                        are reachable before saving.
-                                        See the
-                                        <a href="https://learn.microsoft.com/azure/ai-services/content-understanding/quickstart/use-rest-api" target="_blank" rel="noopener noreferrer">Content Understanding quickstart</a>
-                                        for more detail.
-                                    </p>
-                                </div>
-                                <div class="modal-footer">
-                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                        <input
-                            type="checkbox"
-                            class="form-check-input me-2"
-                            id="enable_document_intelligence_apim"
-                            name="enable_document_intelligence_apim"
-                            {% if settings.enable_document_intelligence_apim %}checked{% endif %}
-                        >
-                        <label class="form-check-label" for="enable_document_intelligence_apim">
-                            Use APIM instead of direct Document Intelligence endpoint
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route Document Intelligence requests through API Management for centralized monitoring and control instead of direct service access."></i>
-                    </div>
-
-                    <div>
-
-                        <div id="non_apim_document_intelligence_settings" {% if settings.enable_document_intelligence_apim %}style="display: none;"{% endif %}>
-                            <div class="mb-3">
-                                <label for="azure_document_intelligence_endpoint" class="form-label">
-                                    Document Intelligence Endpoint
-                                </label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_document_intelligence_endpoint"
-                                    name="azure_document_intelligence_endpoint"
-                                    value="{{ settings.azure_document_intelligence_endpoint or '' }}"
-                                >
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_document_intelligence_authentication_type" class="form-label">
-                                    Authentication Type
-                                </label>
-                                <select class="form-select" id="azure_document_intelligence_authentication_type" name="azure_document_intelligence_authentication_type">
-                                    <option value="key" {% if settings.azure_document_intelligence_authentication_type=='key' %}selected{% endif %}>
-                                        Key
-                                    </option>
-                                    <option value="managed_identity" {% if settings.azure_document_intelligence_authentication_type=='managed_identity' %}selected{% endif %}>
-                                        Managed Identity
-                                    </option>
-                                </select>
-                            </div>
-                            <div class="mb-3" id="azure_document_intelligence_key_container" {% if settings.azure_document_intelligence_authentication_type !='key' %}style="display: none;"{% endif %}>
-                                <label for="azure_document_intelligence_key" class="form-label">
-                                    Document Intelligence Key
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_document_intelligence_key"
-                                        name="azure_document_intelligence_key"
-                                        value="{{ settings.azure_document_intelligence_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_docintel_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <div id="apim_document_intelligence_settings" {% if not settings.enable_document_intelligence_apim %}style="display: none;"{% endif %}>
-                            <div class="mb-3">
-                                <label for="azure_apim_document_intelligence_endpoint" class="form-label">
-                                    Azure APIM Document Intelligence Endpoint
-                                </label>
-                                <input
-                                    type="text"
-                                    class="form-control"
-                                    id="azure_apim_document_intelligence_endpoint"
-                                    name="azure_apim_document_intelligence_endpoint"
-                                    value="{{ settings.azure_apim_document_intelligence_endpoint or '' }}"
-                                >
-                            </div>
-                            <div class="mb-3">
-                                <label for="azure_apim_document_intelligence_subscription_key" class="form-label">
-                                    Azure APIM Document Intelligence Subscription Key
-                                </label>
-                                <div class="input-group">
-                                    <input
-                                        type="password"
-                                        class="form-control"
-                                        id="azure_apim_document_intelligence_subscription_key"
-                                        name="azure_apim_document_intelligence_subscription_key"
-                                        value="{{ settings.azure_apim_document_intelligence_subscription_key or '' }}"
-                                    >
-                                    <button
-                                        type="button"
-                                        class="btn btn-outline-secondary"
-                                        id="toggle_azure_apim_document_intelligence_subscription_key"
-                                    >
-                                        Show
-                                    </button>
-                                </div>
-                            </div>
-                        </div>
-
-
-                        <button
-                            type="button"
-                            class="btn btn-secondary mt-3"
-                            style="width: auto;"
-                            id="test_azure_doc_intelligence_button"
-                        >
-                            Test Document Intelligence Connection
-                        </button>
-                        <div id="test_azure_doc_intelligence_result" class="mt-2"></div>
-                    </div>
-                </div>
-
-                <div class="card p-3 mb-3" id="chunk-size-section">
-                    <div class="d-flex align-items-center justify-content-between mb-2">
-                        <h5 class="mb-0"><i class="bi bi-collection me-2"></i>Chunk Sizes</h5>
-                        <span class="badge bg-primary-subtle text-primary-emphasis">Cap: {{ chunk_size_cap }}</span>
-                    </div>
-                    <p class="text-muted mb-2 small">Custom chunk sizes apply to new uploads only. Existing documents keep their current chunks.</p>
-                    <div class="alert alert-warning small mb-3">
-                        <strong>Heads up:</strong> Overrides are capped at {{ chunk_size_cap }} (2x embedding context window, fallback 16,384).
-                    </div>
-                    <div class="form-check form-switch mb-3">
-                        <input
-                            type="checkbox"
-                            class="form-check-input"
-                            id="enable_chunk_size_override"
-                            name="enable_chunk_size_override"
-                            {% if settings.enable_chunk_size_override %}checked{% endif %}
-                        >
-                        <label class="form-check-label ms-2" for="enable_chunk_size_override">
-                            Enable custom chunk sizes by file type
-                        </label>
-                    </div>
-
-                    <div id="chunk-size-fields" class="{% if not settings.enable_chunk_size_override %}d-none{% endif %}">
-                        <div id="chunk-size-cap-warning" class="alert alert-warning d-none" role="alert">
-                            <span id="chunk-size-cap-warning-text">Chunk sizes above the cap will be reduced automatically.</span>
-                        </div>
-                        <input type="hidden" id="chunk_size_cap" value="{{ chunk_size_cap }}" />
-                        {% set chunk_settings = chunk_size_settings or {} %}
-                        {% set chunk_defaults = chunk_size_defaults or {} %}
-                        <div class="row g-3">
-                            <div class="col-md-6">
-                                <label for="chunk_size_txt" class="form-label">TXT (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="TXT" id="chunk_size_txt" name="chunk_size_txt" value="{{ chunk_settings.get('txt', {}).get('value', chunk_defaults.get('txt', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_log" class="form-label">LOG (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="LOG" id="chunk_size_log" name="chunk_size_log" value="{{ chunk_settings.get('log', {}).get('value', chunk_defaults.get('log', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="chunk_size_doc" class="form-label">DOC (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOC" id="chunk_size_doc" name="chunk_size_doc" value="{{ chunk_settings.get('doc', {}).get('value', chunk_defaults.get('doc', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="chunk_size_docm" class="form-label">DOCM (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOCM" id="chunk_size_docm" name="chunk_size_docm" value="{{ chunk_settings.get('docm', {}).get('value', chunk_defaults.get('docm', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-4">
-                                <label for="chunk_size_docx" class="form-label">DOCX (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOCX" id="chunk_size_docx" name="chunk_size_docx" value="{{ chunk_settings.get('docx', {}).get('value', chunk_defaults.get('docx', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_html" class="form-label">HTML (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="HTML" id="chunk_size_html" name="chunk_size_html" value="{{ chunk_settings.get('html', {}).get('value', chunk_defaults.get('html', {}).get('value')) }}">
-                                <div class="form-text">Minimum enforced at 50% of target on merge.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_md" class="form-label">Markdown (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="MD" id="chunk_size_md" name="chunk_size_md" value="{{ chunk_settings.get('md', {}).get('value', chunk_defaults.get('md', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_xml" class="form-label">XML (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="XML" id="chunk_size_xml" name="chunk_size_xml" value="{{ chunk_settings.get('xml', {}).get('value', chunk_defaults.get('xml', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_yaml" class="form-label">YAML (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="YAML" id="chunk_size_yaml" name="chunk_size_yaml" value="{{ chunk_settings.get('yaml', {}).get('value', chunk_defaults.get('yaml', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_yml" class="form-label">YML (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="YML" id="chunk_size_yml" name="chunk_size_yml" value="{{ chunk_settings.get('yml', {}).get('value', chunk_defaults.get('yml', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_json" class="form-label">JSON (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="JSON" id="chunk_size_json" name="chunk_size_json" value="{{ chunk_settings.get('json', {}).get('value', chunk_defaults.get('json', {}).get('value')) }}">
-                            </div>
-                            <!--
-                            <div class="col-md-6">
-                                <label for="chunk_size_csv" class="form-label">CSV (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="CSV" id="chunk_size_csv" name="chunk_size_csv" value="{{ chunk_settings.get('csv', {}).get('value', chunk_defaults.get('csv', {}).get('value')) }}">
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_excel" class="form-label">Excel (characters)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="EXCEL" id="chunk_size_excel" name="chunk_size_excel" value="{{ chunk_settings.get('excel', {}).get('value', chunk_defaults.get('excel', {}).get('value')) }}">
-                            </div>
-                            -->
-                            <div class="col-md-6">
-                                <label for="chunk_size_transcript" class="form-label">Transcripts (words)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="TRANSCRIPT" id="chunk_size_transcript" name="chunk_size_transcript" value="{{ chunk_settings.get('transcript', {}).get('value', chunk_defaults.get('transcript', {}).get('value')) }}">
-                                <div class="form-text">Applies to new audio transcripts.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_pdf" class="form-label">PDF (pages)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="PDF" id="chunk_size_pdf" name="chunk_size_pdf" value="{{ chunk_settings.get('pdf', {}).get('value', chunk_defaults.get('pdf', {}).get('value')) }}">
-                                <div class="form-text">Pages per chunk after extraction.</div>
-                            </div>
-                            <div class="col-md-6">
-                                <label for="chunk_size_pptx" class="form-label">PPT/PPTX (slides)</label>
-                                <input type="number" min="1" class="form-control chunk-size-input" data-label="PPT/PPTX" id="chunk_size_pptx" name="chunk_size_pptx" value="{{ chunk_settings.get('pptx', {}).get('value', chunk_defaults.get('pptx', {}).get('value')) }}">
-                                <div class="form-text">Slides per chunk after extraction.</div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
-                <!-- AI Video Intelligence Card -->
-                <div class="card p-4 mb-4 border-info shadow-sm" id="video-intelligence-section">
-                    <div class="d-flex align-items-center justify-content-between mb-3">
-                        <div class="d-flex align-items-center">
-                            <div class="bg-info text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
-                                <i class="bi bi-camera-video-fill fs-4"></i>
-                            </div>
-                            <div>
-                                <h4 class="mb-1">
-                                    <i class="bi bi-play-circle me-2"></i>AI Video Intelligence
-                                </h4>
-                                <p class="text-muted mb-0 small">Extract insights and make video content searchable and interactive</p>
-                            </div>
-                        </div>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#videoIndexerInfoModal">
-                            <i class="bi bi-info-circle me-1"></i>Setup Guide
-                        </button>
-                    </div>
-
-                    <div class="alert alert-info mb-4">
-                        <i class="bi bi-lightbulb-fill me-2"></i>
-                        <strong>Make Video Content Fully Searchable:</strong> Upload videos to your workspace and automatically extract transcripts, identify speakers, detect topics, and generate searchable timestamps. Your AI can then answer questions about video content, cite specific moments, and provide deep insights.
-                    </div>
-
-                    <!-- Video File Support Toggle -->
-                    <div class="mb-4">
-                        <div class="form-check form-switch mb-2">
-                            <input
-                                type="checkbox"
-                                class="form-check-input"
-                                id="enable_video_file_support"
-                                name="enable_video_file_support"
-                                {% if settings.enable_video_file_support %}checked{% endif %}
-                            >
-                            <label class="form-check-label ms-2 fw-bold" for="enable_video_file_support">
-                                <i class="bi bi-camera-video me-1"></i> Enable Video File Upload & Processing
-                            </label>
-                        </div>
-                        <p class="text-muted small ms-4 ps-3 mb-2">
-                            Upload video files (MP4, AVI, MOV, etc.) to workspaces where Azure Video Indexer automatically processes them.
-                            Extract spoken content, identify speakers, detect faces, recognize brands, and generate searchable metadata—perfect for meetings, presentations, training videos, and recorded content.
-                        </p>
-                        <div class="ms-4 ps-3">
-                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
-                                <i class="bi bi-search me-1"></i> Full-Text Search
-                            </span>
-                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
-                                <i class="bi bi-person-badge me-1"></i> Speaker ID
-                            </span>
-                            <span class="badge bg-primary-subtle text-primary-emphasis me-2">
-                                <i class="bi bi-clock-history me-1"></i> Timestamped Citations
-                            </span>
-                            <span class="badge bg-primary-subtle text-primary-emphasis">
-                                <i class="bi bi-translate me-1"></i> Multi-Language
-                            </span>
-                        </div>
-                    </div>
-
-                    {% set public_video_indexer_endpoint = "https://api.videoindexer.ai" %}
-                    {% set government_video_indexer_endpoint = "https://api.videoindexer.ai.azure.us" %}
-                    {% set configured_video_indexer_endpoint = settings.video_indexer_endpoint or default_video_indexer_endpoint %}
-                    {% if configured_video_indexer_endpoint == government_video_indexer_endpoint %}
-                        {% set video_indexer_cloud = "usgovernment" %}
-                    {% elif configured_video_indexer_endpoint == public_video_indexer_endpoint %}
-                        {% set video_indexer_cloud = "public" %}
-                    {% else %}
-                        {% set video_indexer_cloud = "custom" %}
-                    {% endif %}
-                    {% if azure_environment == "usgovernment" %}
-                        {% set azure_environment_label = "Azure Government" %}
-                    {% elif azure_environment == "custom" %}
-                        {% set azure_environment_label = "Custom Cloud" %}
-                    {% else %}
-                        {% set azure_environment_label = "Azure Public / Commercial" %}
-                    {% endif %}
-
-                    <!-- Video Indexer Configuration (collapsible) -->
-                    <div id="video_indexer_settings" class="border-top pt-3{% if not settings.enable_video_file_support %} d-none{% endif %}">
-                        <h5 class="mb-3">
-                            <i class="bi bi-gear-fill me-2"></i>Azure Video Indexer Configuration
-                        </h5>
-                        <p class="text-muted small mb-3">Connect to your Azure Video Indexer resource for advanced video processing and content extraction.</p>
-
-                        <div class="alert alert-info">
-                            <strong><i class="bi bi-info-circle"></i> Identity overview:</strong>
-                            <ul class="mb-0 mt-2">
-                                <li>Video Indexer can use its own managed identity to reach the linked Storage account during account creation.</li>
-                                <li>SimpleChat authenticates to Video Indexer with the <strong>App Service system-assigned managed identity</strong>.</li>
-                                <li>The App Service managed identity must have <strong>Contributor</strong> on the Video Indexer resource.</li>
-                                <li>See <a href="https://learn.microsoft.com/azure/azure-video-indexer/connect-to-azure" target="_blank">Azure Video Indexer documentation</a> for setup details</li>
-                            </ul>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_cloud" class="form-label">Cloud / Endpoint Mode</label>
-                            <select
-                                class="form-select"
-                                id="video_indexer_cloud"
-                                data-public-endpoint="{{ public_video_indexer_endpoint }}"
-                                data-government-endpoint="{{ government_video_indexer_endpoint }}"
-                                data-runtime-cloud="{{ azure_environment }}"
-                            >
-                                <option value="public" {% if video_indexer_cloud == 'public' %}selected{% endif %}>Azure Public / Commercial</option>
-                                <option value="usgovernment" {% if video_indexer_cloud == 'usgovernment' %}selected{% endif %}>Azure Government</option>
-                                <option value="custom" {% if video_indexer_cloud == 'custom' %}selected{% endif %}>Custom Endpoint</option>
-                            </select>
-                            <div class="form-text">Choose the endpoint family that matches your deployed cloud. Use Custom only when you need a non-standard Video Indexer endpoint.</div>
-                        </div>
-
-                        <div class="alert alert-secondary py-2">
-                            <strong>Current App Service environment:</strong> {{ azure_environment_label }}. This selector saves the Video Indexer API endpoint. If you are switching between Azure Public, Azure Government, or a custom cloud, update <code>AZURE_ENVIRONMENT</code> in your App Service configuration as well.
-                        </div>
-
-                        <div class="alert alert-warning py-2 mb-3 d-none" id="video_indexer_cloud_mismatch_alert">
-                            The selected Video Indexer cloud does not match this app's current <code>AZURE_ENVIRONMENT</code>. Update the App Service configuration if you are moving to a different cloud.
-                        </div>
-
-                        <input type="hidden" id="video_indexer_endpoint" name="video_indexer_endpoint" value="{{ configured_video_indexer_endpoint }}" />
-
-                        <div class="mb-3{% if video_indexer_cloud != 'custom' %} d-none{% endif %}" id="video_indexer_custom_endpoint_group">
-                            <label for="video_indexer_custom_endpoint" class="form-label">Custom API Endpoint</label>
-                            <input
-                                type="text"
-                                class="form-control"
-                                id="video_indexer_custom_endpoint"
-                                value="{% if video_indexer_cloud == 'custom' %}{{ configured_video_indexer_endpoint }}{% endif %}"
-                                placeholder="https://your-video-indexer-endpoint.example.com"
-                            />
-                            <div class="form-text">Only required when using a custom cloud or non-standard Video Indexer endpoint.</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_endpoint_display" class="form-label">Effective API Endpoint</label>
-                            <input type="text" class="form-control" id="video_indexer_endpoint_display" value="{{ configured_video_indexer_endpoint }}" readonly />
-                            <div class="form-text">Saved endpoint value used for Video Indexer API calls.</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_resource_group" class="form-label">Resource Group <span class="text-danger">*</span></label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_resource_group" name="video_indexer_resource_group"
-                                value="{{ settings.video_indexer_resource_group or '' }}"
-                                placeholder="e.g., rg-videoindexer-prod">
-                            <div class="form-text">The Azure resource group containing your Video Indexer account</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_subscription_id" class="form-label">Subscription ID <span class="text-danger">*</span></label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_subscription_id" name="video_indexer_subscription_id"
-                                value="{{ settings.video_indexer_subscription_id or '' }}"
-                                placeholder="e.g., 12345678-1234-1234-1234-123456789abc">
-                            <div class="form-text">Your Azure subscription ID</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_account_name" class="form-label">Account Name <span class="text-danger">*</span></label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_account_name" name="video_indexer_account_name"
-                                value="{{ settings.video_indexer_account_name or '' }}"
-                                placeholder="e.g., my-video-indexer">
-                            <div class="form-text">The name of your Video Indexer account resource</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_location" class="form-label">Location <span class="text-danger">*</span></label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_location" name="video_indexer_location"
-                                value="{{ settings.video_indexer_location or '' }}"
-                                placeholder="e.g., eastus">
-                            <div class="form-text">Azure region where your Video Indexer account is deployed (e.g., eastus, westus2, northeurope)</div>
+                </section>
+                <section class="border rounded p-3 mb-3" aria-labelledby="data-management-restore-policy-heading">
+                    <h6 class="mb-3" id="data-management-restore-policy-heading">Restore policy and surfaces</h6>
+                    <div class="row g-3">
+                        <div class="col-md-4">
+                            <label class="form-label" for="data_management_restore_policy">Collision policy</label>
+                            <select class="form-select" id="data_management_restore_policy">
+                                <option value="create_only" selected>Create only (block collisions)</option>
+                                <option value="overwrite_existing">Overwrite existing target records</option>
+                            </select>
+                            <div class="form-text">Create-only is non-destructive and recommended for first restore attempts.</div>
                         </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_account_id" class="form-label">Account ID <span class="text-danger">*</span></label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_account_id" name="video_indexer_account_id"
-                                value="{{ settings.video_indexer_account_id or '' }}"
-                                placeholder="e.g., 12345678-abcd-1234-abcd-123456789abc">
-                            <div class="form-text">Found in the Video Indexer account Overview page in Azure Portal</div>
+                        <div class="col-md-8">
+                            <fieldset>
+                                <legend class="form-label">Restore surfaces</legend>
+                                <div class="d-flex flex-wrap gap-3">
+                                    <div class="form-check form-switch">
+                                        <input class="form-check-input" type="checkbox" role="switch" id="data_management_restore_include_cosmos" checked>
+                                        <label class="form-check-label" for="data_management_restore_include_cosmos">Cosmos DB</label>
+                                    </div>
+                                    <div class="form-check form-switch">
+                                        <input class="form-check-input" type="checkbox" role="switch" id="data_management_restore_include_ai_search" checked>
+                                        <label class="form-check-label" for="data_management_restore_include_ai_search">AI Search</label>
+                                    </div>
+                                    <div class="form-check form-switch">
+                                        <input class="form-check-input" type="checkbox" role="switch" id="data_management_restore_include_source_blobs" checked>
+                                        <label class="form-check-label" for="data_management_restore_include_source_blobs">Enhanced Citation blobs</label>
+                                    </div>
+                                </div>
+                            </fieldset>
                         </div>
-
-                        <div class="mb-3">
-                            <label for="video_indexer_arm_api_version" class="form-label">ARM API Version</label>
-                            <input type="text" class="form-control"
-                                id="video_indexer_arm_api_version" name="video_indexer_arm_api_version"
-                                value="{{ settings.video_indexer_arm_api_version or default_video_indexer_arm_api_version }}">
-                            <div class="form-text">Default for {{ azure_environment_label }}: {{ default_video_indexer_arm_api_version }}</div>
+                    </div>
+                    <div class="mt-3 d-none" id="data-management-restore-confirmation-section">
+                        <label class="form-label" for="data_management_restore_overwrite_confirmation_phrase">Type the overwrite confirmation phrase</label>
+                        <input class="form-control" type="text" id="data_management_restore_overwrite_confirmation_phrase" autocomplete="off" aria-describedby="data-management-restore-confirmation-help">
+                        <div class="form-text" id="data-management-restore-confirmation-help">
+                            Required phrase: <code>RESTORE WITH OVERWRITE</code>
                         </div>
-
-                        <div class="mb-3">
-                            <label for="video_index_timeout" class="form-label">Timeout (seconds)</label>
-                            <input type="number" class="form-control"
-                                id="video_index_timeout" name="video_index_timeout"
-                                value="{{ settings.video_index_timeout or 600 }}">
+                    </div>
+                </section>
+                <section class="border rounded p-3" aria-labelledby="data-management-restore-review-heading">
+                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-2 mb-3">
+                        <div>
+                            <h6 class="mb-1" id="data-management-restore-review-heading">Preflight review</h6>
+                            <p class="text-muted small mb-0" id="data-management-restore-review-status">Run review to validate the manifest, target access, and restore policy.</p>
                         </div>
+                        <button type="button" class="btn btn-outline-primary btn-sm" id="data-management-restore-review-btn">
+                            <i class="bi bi-shield-check me-1"></i>Run Restore Review
+                        </button>
+                    </div>
+                    <div class="list-group" id="data-management-restore-review-checks" aria-live="polite">
+                        <div class="list-group-item text-muted">No restore review has run yet.</div>
                     </div>
+                </section>
+                <div class="form-check mt-3">
+                    <input class="form-check-input" type="checkbox" id="data_management_restore_final_confirmation">
+                    <label class="form-check-label fw-semibold" for="data_management_restore_final_confirmation">
+                        I reviewed the restore target, policy, and preflight result.
+                    </label>
                 </div>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                <button type="button" class="btn btn-danger" id="data-management-restore-queue-btn" disabled aria-disabled="true">
+                    Queue Restore Job
+                </button>
+            </div>
+        </div>
+    </div>
+</div>
 
-                    <!-- AI Voice Chat Card -->
-                    <div class="card p-4 mb-4 border-primary shadow-sm" id="ai-voice-chat-section">
-                        <div class="d-flex align-items-center justify-content-between mb-3">
-                            <div class="d-flex align-items-center">
-                                <div class="bg-primary text-white rounded-circle p-3 me-3" style="width: 50px; height: 50px; display: flex; align-items: center; justify-content: center;">
-                                    <i class="bi bi-mic-fill fs-4"></i>
-                                </div>
-                                <div>
-                                    <h4 class="mb-1">
-                                        <i class="bi bi-soundwave me-2"></i>AI Voice Conversations
-                                    </h4>
-                                    <p class="text-muted mb-0 small">Transform your AI experience with natural voice interactions</p>
-                                </div>
-                            </div>
-                            <button type="button" class="btn btn-outline-primary btn-sm" data-bs-toggle="modal" data-bs-target="#speechServiceInfoModal">
-                                <i class="bi bi-info-circle me-1"></i>Setup Guide
-                            </button>
-                        </div>
-
-                        <!-- AI Response Completion Audio -->
-                        <div class="mb-4">
-                            <div class="form-check form-switch mb-2">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="enable_chat_completion_audio_cues"
-                                    name="enable_chat_completion_audio_cues"
-                                    {% if settings.enable_chat_completion_audio_cues %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2 fw-bold" for="enable_chat_completion_audio_cues">
-                                    <i class="bi bi-bell-fill me-1"></i> Enable AI Response Completion Audio Cues
-                                </label>
-                            </div>
-                            <p class="text-muted small ms-4 ps-3 mb-0">
-                                Let users opt in to a bundled sound when an AI response finishes outside their active view.
-                                These local cues do not require Azure Speech Service.
-                            </p>
-                        </div>
-
-                        <div class="alert alert-info mb-4" id="speech_service_shared_alert">
-                            <i class="bi bi-lightbulb-fill me-2"></i>
-                            <strong>One Speech resource, three features:</strong> Audio file uploads, Voice Input, and Voice Responses all use the same Azure Speech Service section below. Configure the Speech resource once, then turn on whichever speech features you need.
-                        </div>
-
-                        <!-- Audio File Support -->
-                        <div class="mb-4">
-                            {% set audio_runtime = audio_runtime_capabilities or {} %}
-                            {% set audio_supported_extensions = audio_runtime.supported_extensions or [] %}
-                            {% set audio_direct_extensions = audio_runtime.direct_transcription_extensions or [] %}
-                            <div class="form-check form-switch mb-2">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="enable_audio_file_support"
-                                    name="enable_audio_file_support"
-                                    {% if settings.enable_audio_file_support %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2 fw-bold" for="enable_audio_file_support">
-                                    <i class="bi bi-file-earmark-music me-1"></i> Enable Audio File Upload & Processing
-                                </label>
-                            </div>
-                            <p class="text-muted small ms-4 ps-3 mb-0">
-                                Upload audio files (MP3, WAV, M4A, etc.) to workspaces where they're automatically transcribed and indexed.
-                                The AI can then search, analyze, and answer questions about audio content—perfect for meetings, interviews, lectures, and podcasts.
-                            </p>
-                            <div class="ms-4 ps-3 mt-2">
-                                <div class="small {% if audio_runtime.broad_transcoding_available %}text-success{% else %}text-warning{% endif %}" id="audio_runtime_status">
-                                    <i class="bi {% if audio_runtime.broad_transcoding_available %}bi-check-circle{% else %}bi-exclamation-triangle{% endif %} me-1"></i>{{ audio_runtime.message or 'Audio runtime support has not been checked yet.' }}
-                                </div>
-                                <div class="small text-muted mt-1" id="audio_supported_extensions">
-                                    Supported audio upload extensions: {{ audio_supported_extensions|join(', ') }}
-                                </div>
-                                {% if audio_direct_extensions %}
-                                <div class="small text-muted mt-1">
-                                    Without FFmpeg, source-file fallback is best for: {{ audio_direct_extensions|join(', ') }}. Container builds can include FFmpeg for broader codec support.
-                                </div>
-                                {% endif %}
-                            </div>
-                        </div>
-
-                        <!-- Speech-to-Text -->
-                        <div class="mb-4">
-                            <div class="form-check form-switch mb-2">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="enable_speech_to_text_input"
-                                    name="enable_speech_to_text_input"
-                                    {% if settings.enable_speech_to_text_input %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2 fw-bold" for="enable_speech_to_text_input">
-                                    <i class="bi bi-mic me-1"></i> Enable Voice Input (Speech-to-Text)
-                                </label>
-                            </div>
-                            <p class="text-muted small ms-4 ps-3 mb-2">
-                                Talk to your AI instead of typing. Record voice messages up to 90 seconds directly in the chat interface.
-                                Azure Speech Service instantly transcribes your speech with high accuracy, supporting multiple languages and accents.
-                            </p>
-                            <div class="ms-4 ps-3">
-                                <span class="badge bg-success-subtle text-success-emphasis me-2">
-                                    <i class="bi bi-hand-thumbs-up-fill me-1"></i> Hands-Free
-                                </span>
-                                <span class="badge bg-success-subtle text-success-emphasis me-2">
-                                    <i class="bi bi-universal-access me-1"></i> Accessible
-                                </span>
-                                <span class="badge bg-success-subtle text-success-emphasis">
-                                    <i class="bi bi-lightning-fill me-1"></i> Fast Input
-                                </span>
-                            </div>
-                        </div>
+<div class="modal fade" id="data-management-cosmos-editor-danger-modal" tabindex="-1" aria-labelledby="data-management-cosmos-editor-danger-title" aria-hidden="true">
+    <div class="modal-dialog modal-lg">
+        <div class="modal-content border-danger">
+            <div class="modal-header bg-danger text-white">
+                <div>
+                    <h5 class="modal-title" id="data-management-cosmos-editor-danger-title">Cosmos DB JSON Editor Warning</h5>
+                    <p class="mb-0 small text-white-50">This interface can change live application data.</p>
+                </div>
+                <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <div class="alert alert-danger" role="alert">
+                    Incorrect edits can break authentication, workspaces, chat history, documents, automations, or activity log integrity. Use this editor only when safer admin tools cannot solve the problem.
+                </div>
+                <ul class="mb-3">
+                    <li>Run targeted SELECT queries and page results instead of loading large containers at once.</li>
+                    <li>Do not change <code>id</code> or the container partition key value.</li>
+                    <li>Review JSON carefully before saving. Saves are audited in Activity Logs.</li>
+                </ul>
+                <div class="form-check">
+                    <input class="form-check-input" type="checkbox" id="data_management_cosmos_editor_danger_accept">
+                    <label class="form-check-label fw-semibold" for="data_management_cosmos_editor_danger_accept">
+                        I understand this editor can damage overall system health.
+                    </label>
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                <button type="button" class="btn btn-danger" id="data-management-cosmos-editor-accept-danger-btn" disabled aria-disabled="true">
+                    I Understand, Unlock Editor
+                </button>
+            </div>
+        </div>
+    </div>
+</div>
 
-                        <!-- Text-to-Speech -->
-                        <div class="mb-4">
-                            <div class="form-check form-switch mb-2">
-                                <input
-                                    type="checkbox"
-                                    class="form-check-input"
-                                    id="enable_text_to_speech"
-                                    name="enable_text_to_speech"
-                                    {% if settings.enable_text_to_speech %}checked{% endif %}
-                                >
-                                <label class="form-check-label ms-2 fw-bold" for="enable_text_to_speech">
-                                    <i class="bi bi-volume-up me-1"></i> Enable Voice Responses (Text-to-Speech)
-                                </label>
+<div class="modal fade" id="data-management-cosmos-editor-results-modal" tabindex="-1" aria-labelledby="data-management-cosmos-editor-modal-title" aria-hidden="true">
+    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <div>
+                    <h5 class="modal-title" id="data-management-cosmos-editor-modal-title">Cosmos DB Query Results</h5>
+                    <p class="text-muted small mb-0" id="data-management-cosmos-editor-modal-subtitle">Run a query to load document summaries.</p>
+                    <p class="text-muted small mb-0" id="data-management-cosmos-editor-modal-status">No query has run yet.</p>
+                </div>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body cosmos-editor-results-modal-body">
+                <div class="row g-3">
+                    <div class="col-lg-4">
+                        <div class="border rounded h-100">
+                            <div class="border-bottom px-3 py-2 bg-light">
+                                <h6 class="mb-0">Results</h6>
                             </div>
-                            <p class="text-muted small ms-4 ps-3 mb-2">
-                                Hear AI responses read aloud in natural, human-like voices powered by Azure's advanced neural Text-to-Speech.
-                                Each message includes a speaker button—click to listen while multitasking, commuting, or whenever reading isn't convenient.
-                            </p>
-                            <div class="ms-4 ps-3">
-                                <span class="badge bg-info-subtle text-info-emphasis me-2">
-                                    <i class="bi bi-ear-fill me-1"></i> Natural Voices
-                                </span>
-                                <span class="badge bg-info-subtle text-info-emphasis me-2">
-                                    <i class="bi bi-arrows-fullscreen me-1"></i> Multitask-Friendly
-                                </span>
-                                <span class="badge bg-info-subtle text-info-emphasis">
-                                    <i class="bi bi-globe me-1"></i> Multi-Language
-                                </span>
+                            <div class="list-group list-group-flush cosmos-editor-results-list" id="data-management-cosmos-editor-results-list" aria-label="Cosmos DB query results">
+                                <div class="list-group-item text-muted">Run a query to list documents.</div>
                             </div>
                         </div>
-
-                        <!-- Speech Service Configuration (collapsible) -->
-                        <div id="audio_service_settings" class="border-top pt-3{% if not (settings.enable_audio_file_support or settings.enable_speech_to_text_input or settings.enable_text_to_speech) %} d-none{% endif %}">
-                            <h5 class="mb-3">
-                                <i class="bi bi-gear-fill me-2"></i>Azure Speech Service Configuration
-                            </h5>
-                            <p class="text-muted small mb-3">Configure the shared Azure Speech resource used by audio transcription, voice input, and text-to-speech.</p>
-
-                        <div class="alert alert-info py-2">
-                            <strong>Shared configuration:</strong> These settings apply to all enabled speech features. If you use managed identity and also enable Voice Responses, fill in the Speech Resource ID field so the Speech SDK can authenticate synthesis requests.
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="speech_service_endpoint" class="form-label">Endpoint</label>
-                            <input type="text" class="form-control"
-                                id="speech_service_endpoint" name="speech_service_endpoint"
-                                value="{{ settings.speech_service_endpoint or '' }}"
-                                placeholder="https://<location or custom domain>.cognitiveservices.azure.<com or us>/">
-                            <div class="form-text">Use the resource-specific custom-domain endpoint when selecting Managed Identity.</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="speech_service_location" class="form-label">Location</label>
-                            <input type="text" class="form-control"
-                                id="speech_service_location" name="speech_service_location"
-                                value="{{ settings.speech_service_location or '' }}">
-                            <div class="form-text">Required for speech recognition locale defaults and for text-to-speech when using Managed Identity.</div>
-                        </div>
-
-                        <div class="mb-3{% if settings.speech_service_authentication_type != 'managed_identity' %} d-none{% endif %}" id="speech_service_resource_id_container">
-                            <div class="alert alert-secondary py-2 mb-3">
-                                <strong>Resource ID builder:</strong> If the full ARM resource ID is hard to find in the portal, enter the subscription ID, resource group, and Speech resource name below. Simple Chat can build the resource ID for you.
-                            </div>
-
-                            <div class="row g-3 mb-3">
-                                <div class="col-md-6">
-                                    <label for="speech_service_subscription_id" class="form-label">Speech Subscription ID</label>
-                                    <input type="text" class="form-control"
-                                        id="speech_service_subscription_id" name="speech_service_subscription_id"
-                                        value="{{ settings.speech_service_subscription_id or '' }}"
-                                        placeholder="12345678-1234-1234-1234-123456789abc">
-                                </div>
-                                <div class="col-md-6">
-                                    <label for="speech_service_resource_group" class="form-label">Speech Resource Group</label>
-                                    <input type="text" class="form-control"
-                                        id="speech_service_resource_group" name="speech_service_resource_group"
-                                        value="{{ settings.speech_service_resource_group or '' }}"
-                                        placeholder="rg-speech-prod">
-                                </div>
-                                <div class="col-md-6">
-                                    <label for="speech_service_resource_name" class="form-label">Speech Resource Name</label>
-                                    <input type="text" class="form-control"
-                                        id="speech_service_resource_name" name="speech_service_resource_name"
-                                        value="{{ settings.speech_service_resource_name or '' }}"
-                                        placeholder="my-speech-resource">
-                                    <div class="form-text">If you use a custom-domain Speech endpoint, this is usually the first part of that hostname.</div>
-                                </div>
-                                <div class="col-md-6 d-flex align-items-end">
-                                    <button type="button" class="btn btn-outline-secondary w-100" id="build_speech_resource_id_btn">
-                                        Build Resource ID
-                                    </button>
+                    </div>
+                    <div class="col-lg-8">
+                        <div class="border rounded h-100">
+                            <div class="border-bottom px-3 py-2 bg-light">
+                                <div class="d-flex flex-wrap align-items-center justify-content-between gap-2">
+                                    <div>
+                                        <h6 class="mb-0">Document JSON</h6>
+                                        <div class="small text-muted" id="data-management-cosmos-editor-document-meta">Select a result to load JSON.</div>
+                                    </div>
+                                    <div class="d-flex flex-wrap gap-2">
+                                        <button type="button" class="btn btn-outline-secondary btn-sm" id="data-management-cosmos-editor-refresh-document-btn" disabled aria-disabled="true">
+                                            <i class="bi bi-arrow-clockwise me-1"></i>Refresh Document
+                                        </button>
+                                        <button type="button" class="btn btn-danger btn-sm" id="data-management-cosmos-editor-save-btn" disabled aria-disabled="true">
+                                            <i class="bi bi-save me-1"></i>Save JSON
+                                        </button>
+                                    </div>
                                 </div>
                             </div>
-
-                            <div class="form-text mb-2" id="speech_resource_id_builder_status">Provide Subscription ID, Resource Group, and Speech Resource Name to auto-build the ARM resource ID.</div>
-
-                            <label for="speech_service_resource_id" class="form-label">Speech Resource ID</label>
-                            <input type="text" class="form-control"
-                                id="speech_service_resource_id" name="speech_service_resource_id"
-                                value="{{ settings.speech_service_resource_id or '' }}"
-                                placeholder="/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.CognitiveServices/accounts/<speech-resource>">
-                            <div class="form-text">Required for Voice Responses when using Managed Identity. You can paste the full value manually, or let the fields above build it for you.</div>
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="speech_service_locale" class="form-label">Locale</label>
-                            <input type="text" class="form-control"
-                                id="speech_service_locale" name="speech_service_locale"
-                                value="{{ settings.speech_service_locale or '' }}">
-                        </div>
-
-                        <div class="mb-3">
-                            <label for="speech_service_authentication_type" class="form-label">
-                                Authentication Type
-                            </label>
-                            <select class="form-select" id="speech_service_authentication_type" name="speech_service_authentication_type">
-                                <option value="key" {% if settings.speech_service_authentication_type == 'key' or not settings.speech_service_authentication_type %}selected{% endif %}>
-                                    Key
-                                </option>
-                                <option value="managed_identity" {% if settings.speech_service_authentication_type == 'managed_identity' %}selected{% endif %}>
-                                    Managed Identity
-                                </option>
-                            </select>
-                        </div>
-                        <div class="mb-3{% if settings.speech_service_authentication_type == 'managed_identity' %} d-none{% endif %}" id="speech_service_key_container">
-                            <label for="speech_service_key" class="form-label">
-                                API Key
-                            </label>
-                            <div class="input-group">
-                                <input
-                                    type="password"
-                                    class="form-control"
-                                    id="speech_service_key"
-                                    name="speech_service_key"
-                                    value="{{ settings.speech_service_key or '' }}"
-                                >
-                                <button
-                                    type="button"
-                                    class="btn btn-outline-secondary"
-                                    id="toggle_speech_service_key"
-                                >
-                                    Show
-                                </button>
+                            <div class="p-3">
+                                <textarea class="form-control font-monospace" id="data_management_cosmos_editor_document_json" rows="20" spellcheck="false" disabled aria-disabled="true" placeholder="Selected document JSON appears here." style="min-height: 58vh;"></textarea>
+                                <div class="form-text" id="data-management-cosmos-editor-document-help">The editor blocks id and partition key changes. Saves use the ETag from the loaded document.</div>
                             </div>
-                            <div class="form-text">Required only when Authentication Type is set to Key.</div>
-                        </div>
-
-                        <div class="alert alert-secondary mt-3 mb-0">
-                            <strong>Managed identity roles:</strong> Start with <strong>Cognitive Services Speech User</strong>. If fast transcription or other write-style speech operations still return authorization errors, add <strong>Cognitive Services Speech Contributor</strong>. Managed identity also requires a custom-domain endpoint.
                         </div>
-
                     </div>
-                    <p class="mt-2 mb-0">
-                        <small class="text-muted">
-                            <a href="#citation" onclick="switchTab(event, 'citation-tab')">
-                                Enhanced Citations
-                            </a>
-                             will dramatically improve the citation experience for video and audio files.
-                        </small>
-                    </p>
                 </div>
             </div>
+            <div class="modal-footer d-flex flex-wrap justify-content-between gap-2">
+                <div class="small text-muted">Custom SELECT queries can page beyond the first request when Cosmos returns a continuation token.</div>
+                <div class="d-flex flex-wrap gap-2">
+                    <button type="button" class="btn btn-outline-primary" id="data-management-cosmos-editor-next-page-btn" disabled aria-disabled="true">
+                        <i class="bi bi-arrow-right-circle me-1"></i>Next Page
+                    </button>
+                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
 
-            <div class="tab-pane fade" id="send-feedback" role="tabpanel" aria-labelledby="send-feedback-tab" data-app-version="{{ config['VERSION'] }}">
-                <p class="text-muted">
-                    Prepare a prefilled email draft for bug reports or feature requests. This utility is separate from saved settings and records each submission intent in the activity log before opening your local email client.
-                </p>
-                <div class="alert alert-warning" role="alert" id="send-feedback-overview-card">
-                    <strong>Email workflow:</strong> This opens a text-only email draft in your local mail client. If you need to share screenshots or files, add them manually after the draft opens.
+<div class="modal fade" id="data-management-cosmos-editor-save-modal" tabindex="-1" aria-labelledby="data-management-cosmos-editor-save-title" aria-hidden="true">
+    <div class="modal-dialog modal-lg">
+        <div class="modal-content border-danger">
+            <div class="modal-header">
+                <div>
+                    <h5 class="modal-title" id="data-management-cosmos-editor-save-title">Confirm Cosmos DB Document Save</h5>
+                    <p class="text-muted small mb-0" id="data-management-cosmos-editor-save-subtitle">Review the change summary before saving.</p>
+                </div>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <div class="alert alert-danger" role="alert">
+                    Saving replaces the selected Cosmos DB document with the JSON currently in the editor. This action is audited and cannot be undone from this screen.
+                </div>
+                <div class="border rounded p-3 mb-3" id="data-management-cosmos-editor-save-summary">
+                    No changes summarized yet.
                 </div>
+                <label class="form-label" for="data_management_cosmos_editor_confirmation_phrase">Type the confirmation phrase to enable saving</label>
+                <input class="form-control" type="text" id="data_management_cosmos_editor_confirmation_phrase" autocomplete="off" aria-describedby="data-management-cosmos-editor-confirmation-help">
+                <div class="form-text" id="data-management-cosmos-editor-confirmation-help">
+                    Required phrase: <code>I understand this can damage system data</code>
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                <button type="button" class="btn btn-danger" id="data-management-cosmos-editor-confirm-save-btn" disabled aria-disabled="true">
+                    Save Cosmos Document
+                </button>
+            </div>
+        </div>
+    </div>
+</div>
 
-                <div class="row g-4">
-                    <div class="col-xl-6">
-                        <div class="card p-4 h-100" id="send-feedback-bug-card">
-                            <h5 class="mb-1">
-                                <i class="bi bi-bug me-2"></i>Report a Bug
-                            </h5>
-                            <p class="text-muted small mb-3">Something isn’t working as expected.</p>
-                            <div class="admin-send-feedback-form" data-feedback-type="bug_report" data-feedback-label="Bug Report">
-                                <div class="mb-3">
-                                    <label for="send_feedback_bug_name" class="form-label">Name</label>
-                                    <input type="text" class="form-control" id="send_feedback_bug_name" name="send_feedback_bug_name" autocomplete="name" value="{{ session.get('user', {}).get('name', '') }}" data-ignore-settings-change="true" required>
-                                </div>
-                                <div class="mb-3">
-                                    <label for="send_feedback_bug_email" class="form-label">Email</label>
-                                    <input type="email" class="form-control" id="send_feedback_bug_email" name="send_feedback_bug_email" autocomplete="email" value="{{ session.get('user', {}).get('preferred_username', session.get('user', {}).get('email', '')) }}" data-ignore-settings-change="true" required>
-                                </div>
-                                <div class="mb-3">
-                                    <label for="send_feedback_bug_org" class="form-label">Organization</label>
-                                    <input type="text" class="form-control" id="send_feedback_bug_org" name="send_feedback_bug_org" autocomplete="organization" data-ignore-settings-change="true" required>
-                                </div>
-                                <div class="mb-3">
-                                    <label for="send_feedback_bug_details" class="form-label">Bug Details</label>
-                                    <textarea class="form-control" id="send_feedback_bug_details" name="send_feedback_bug_details" autocomplete="off" rows="6" placeholder="Describe what happened, what you expected, and how to reproduce it." data-ignore-settings-change="true" required></textarea>
+<div class="modal fade" id="data-management-job-detail-modal" tabindex="-1" aria-labelledby="data-management-job-detail-title" aria-hidden="true">
+    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <div class="me-3">
+                    <h5 class="modal-title" id="data-management-job-detail-title">Job Details</h5>
+                    <p class="text-muted small mb-0" id="data-management-job-detail-subtitle"></p>
+                    <p class="text-muted small mb-0" id="data-management-job-detail-refresh-state"></p>
+                </div>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <div class="row g-3 mb-4" id="data-management-job-detail-summary"></div>
+                <div class="d-flex flex-wrap gap-2 mb-4 d-none" id="data-management-job-detail-actions" aria-label="Migration job actions"></div>
+                <div id="data-management-job-detail-progress" class="mb-4"></div>
+                <div class="row g-3">
+                    <div class="col-lg-5">
+                        <div class="card h-100">
+                            <div class="card-header bg-primary text-white">
+                                <h6 class="mb-0"><i class="bi bi-list-check me-2"></i>Timeline</h6>
+                            </div>
+                            <div class="card-body p-0">
+                                <div class="list-group list-group-flush" id="data-management-job-items-tbody">
+                                    <div class="list-group-item text-muted">No timeline events loaded.</div>
                                 </div>
-                                <div class="alert d-none admin-send-feedback-status" role="alert"></div>
-                                <button type="button" class="btn btn-primary admin-send-feedback-submit" data-ignore-settings-change="true">
-                                    <i class="bi bi-envelope me-1"></i>Open Bug Report Email
-                                </button>
                             </div>
                         </div>
                     </div>
-
-                    <div class="col-xl-6">
-                        <div class="card p-4 h-100" id="send-feedback-feature-card">
-                            <h5 class="mb-1">
-                                <i class="bi bi-lightbulb me-2"></i>Request a Feature
-                            </h5>
-                            <p class="text-muted small mb-3">Suggest an improvement or new capability.</p>
-                            <div class="admin-send-feedback-form" data-feedback-type="feature_request" data-feedback-label="Feature Request">
-                                <div class="mb-3">
-                                    <label for="send_feedback_feature_name" class="form-label">Name</label>
-                                    <input type="text" class="form-control" id="send_feedback_feature_name" name="send_feedback_feature_name" autocomplete="name" value="{{ session.get('user', {}).get('name', '') }}" data-ignore-settings-change="true" required>
-                                </div>
-                                <div class="mb-3">
-                                    <label for="send_feedback_feature_email" class="form-label">Email</label>
-                                    <input type="email" class="form-control" id="send_feedback_feature_email" name="send_feedback_feature_email" autocomplete="email" value="{{ session.get('user', {}).get('preferred_username', session.get('user', {}).get('email', '')) }}" data-ignore-settings-change="true" required>
-                                </div>
-                                <div class="mb-3">
-                                    <label for="send_feedback_feature_org" class="form-label">Organization</label>
-                                    <input type="text" class="form-control" id="send_feedback_feature_org" name="send_feedback_feature_org" autocomplete="organization" data-ignore-settings-change="true" required>
-                                </div>
-                                <div class="mb-3">
-                                    <label for="send_feedback_feature_details" class="form-label">Feature Request Details</label>
-                                    <textarea class="form-control" id="send_feedback_feature_details" name="send_feedback_feature_details" autocomplete="off" rows="6" placeholder="Describe the problem, the improvement you want, and the outcome you need." data-ignore-settings-change="true" required></textarea>
+                    <div class="col-lg-7">
+                        <div class="card h-100">
+                            <div class="card-header bg-success text-white">
+                                <h6 class="mb-0"><i class="bi bi-box-seam me-2"></i>Backup Contents</h6>
+                            </div>
+                            <div class="card-body">
+                                <div class="vstack gap-3" id="data-management-job-artifacts-tbody">
+                                    <div class="text-muted">No backup artifacts recorded for this job.</div>
                                 </div>
-                                <div class="alert d-none admin-send-feedback-status" role="alert"></div>
-                                <button type="button" class="btn btn-primary admin-send-feedback-submit" data-ignore-settings-change="true">
-                                    <i class="bi bi-envelope me-1"></i>Open Feature Request Email
-                                </button>
                             </div>
                         </div>
                     </div>
+                    <div class="col-lg-7">
+                        <div class="card h-100">
+                            <div class="card-header bg-info text-dark">
+                                <h6 class="mb-0"><i class="bi bi-database-check me-2"></i>Storage and Manifest</h6>
+                            </div>
+                            <div class="card-body" id="data-management-job-manifest-detail"></div>
+                        </div>
+                    </div>
+                    <div class="col-lg-5">
+                        <div class="card h-100">
+                            <div class="card-header bg-warning text-dark">
+                                <h6 class="mb-0"><i class="bi bi-exclamation-triangle me-2"></i>Warnings</h6>
+                            </div>
+                            <div class="card-body" id="data-management-job-warnings"></div>
+                        </div>
+                    </div>
                 </div>
             </div>
         </div>
-        <!-- End of Admin tab content -->
-    </form>
+    </div>
+</div>
 
-    <div
-        class="modal fade"
-        id="fileProcessingLogCleanupModal"
-        tabindex="-1"
-        aria-labelledby="fileProcessingLogCleanupModalLabel"
-        aria-describedby="file-processing-log-cleanup-confirmation"
-        aria-hidden="true"
-    >
+<div class="modal fade" id="data-management-migration-cancel-modal" tabindex="-1" aria-labelledby="data-management-migration-cancel-title" aria-hidden="true">
+    <div class="modal-dialog modal-dialog-centered">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title" id="data-management-migration-cancel-title">Request Data Management Job Cancellation</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <p class="mb-2" id="data-management-migration-cancel-message"></p>
+                <p class="text-muted small mb-0">The worker stops at its next durable checkpoint. Completed items remain available for Retry or Resume.</p>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Keep Running</button>
+                <button type="button" class="btn btn-danger" id="data-management-confirm-migration-cancel-btn">Request Cancellation</button>
+            </div>
+        </div>
+    </div>
+
+    <div class="modal fade" id="data-management-backup-delete-modal" tabindex="-1" aria-labelledby="data-management-backup-delete-title" aria-hidden="true">
         <div class="modal-dialog modal-dialog-centered">
-            <div class="modal-content">
+            <div class="modal-content border-danger">
                 <div class="modal-header">
-                    <h5 class="modal-title" id="fileProcessingLogCleanupModalLabel">Confirm permanent log deletion</h5>
+                    <h5 class="modal-title" id="data-management-backup-delete-title">Delete Data Management Backup</h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
                 <div class="modal-body">
-                    <p id="file-processing-log-cleanup-confirmation"></p>
-                    <div class="alert alert-danger mb-0" role="alert">
-                        This action cannot be undone.
+                    <p class="mb-2" id="data-management-backup-delete-message"></p>
+                    <div class="alert alert-warning small mb-0" role="alert">
+                        Backup deletion removes stored artifacts, job timeline records, and differential sidecar state for this job. Future partial backups will re-export affected unchanged items.
                     </div>
                 </div>
                 <div class="modal-footer">
-                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
-                    <button type="button" class="btn btn-danger" id="confirm-file-processing-log-cleanup-btn">
-                        Delete logs
-                    </button>
+                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Keep Backup</button>
+                    <button type="button" class="btn btn-danger" id="data-management-confirm-backup-delete-btn">Delete Backup</button>
                 </div>
             </div>
         </div>
     </div>
+</div>
+
+<div class="modal fade" id="data-management-setup-guide-modal" tabindex="-1" aria-labelledby="data-management-setup-guide-title" aria-hidden="true">
+    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title" id="data-management-setup-guide-title">Backup, Migrate &amp; Restore Configuration Guide</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <p>Configure backup, migration, and restore readiness before an incident or cutover window. The safest path is to first prove backups, then rehearse migration or restore decisions from completed backup records.</p>
+                <ol>
+                    <li>Use dedicated backup storage that is separate from Enhanced Citation source files.</li>
+                    <li>Generate and protect the backup encryption key, preferably in Key Vault.</li>
+                    <li>Run a manual full backup and inspect the Backup Inventory entry.</li>
+                    <li>For migration, connect destination Cosmos, Search, and storage services before selecting scope.</li>
+                    <li>For restore, open Backup Inventory and stage the selected backup through the Restore workflow.</li>
+                </ol>
+            </div>
+        </div>
+    </div>
+</div>
 
-    <!-- Floating Save Button -->
-    <button type="submit" form="admin-settings-form" class="btn btn-secondary floating-save-btn" id="floating-save-btn" disabled>
-        <i class="bi bi-floppy"></i> Save Settings
-    </button>
+<div class="modal fade" id="data-management-backup-guide-modal" tabindex="-1" aria-labelledby="data-management-backup-guide-title" aria-hidden="true">
+    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title" id="data-management-backup-guide-title">Backup Setup Guide</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <p>Backups create durable artifacts and job records that later migration or restore workflows can inspect. Full backups capture a complete selected snapshot. Partial backups capture daily changes between full backups.</p>
+                <ul>
+                    <li><strong>Storage:</strong> Use a dedicated backup account/container so restore and migration artifacts never overwrite source documents.</li>
+                    <li><strong>Encryption:</strong> Keep backup encryption enabled and store generated keys in Key Vault for production.</li>
+                    <li><strong>Scope:</strong> Leave Cosmos DB and AI Search enabled unless you are intentionally creating a limited backup.</li>
+                    <li><strong>Timing:</strong> Queue large backup jobs outside business hours because App Service workers perform the work.</li>
+                </ul>
+            </div>
+        </div>
+    </div>
+</div>
+
+<div class="modal fade" id="data-management-migration-guide-modal" tabindex="-1" aria-labelledby="data-management-migration-guide-title" aria-hidden="true">
+    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title" id="data-management-migration-guide-title">Migration Guide</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <p>Migration moves selected SimpleChat users, groups, public workspaces, and their optional documents to another SimpleChat environment.</p>
+                <ul>
+                    <li><strong>Copy missing items only:</strong> safest first run; existing destination records are not changed.</li>
+                    <li><strong>Catch up changed items:</strong> use after a previous completed migration to copy new items and update migration-owned changes.</li>
+                    <li><strong>Make destination match source:</strong> use only during cutover when migrated destination-only items should be removed.</li>
+                    <li><strong>AI Search freeze:</strong> freeze external destination writers before moving Search documents because SimpleChat cannot coordinate external writers.</li>
+                </ul>
+            </div>
+        </div>
+    </div>
+</div>
+
+<div class="modal fade" id="data-management-ru-boost-guide-modal" tabindex="-1" aria-labelledby="data-management-ru-boost-guide-title" aria-hidden="true">
+    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title" id="data-management-ru-boost-guide-title">RU Boost Permission Guide</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <p>RU Boost temporarily raises eligible Cosmos DB throughput up to 10,000 RU/s and then restores the original setting. It can increase Azure charges and requires Azure management-plane permissions.</p>
+                <ul>
+                    <li><strong>Data copy permissions</strong> prove the identity can create, read, and delete probe records in destination Cosmos containers.</li>
+                    <li><strong>RU Boost permissions</strong> prove the identity can read and write Cosmos throughput settings through Azure Resource Manager.</li>
+                    <li>Destination RU Boost also needs the destination subscription ID and resource group because those values are not part of the data-plane endpoint.</li>
+                    <li>Use Test RU Boost before a cutover window; it validates capacity permissions separately from migration data access.</li>
+                </ul>
+            </div>
+        </div>
+    </div>
+</div>
+
+<div class="modal fade" id="data-management-restore-guide-modal" tabindex="-1" aria-labelledby="data-management-restore-guide-title" aria-hidden="true">
+    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title" id="data-management-restore-guide-title">Restore Guide</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <p>Restore starts from Backup Inventory. The workflow helps admins confirm what is in the backup, what surfaces are safe to restore, and whether backend restore execution is available for the selected backup.</p>
+                <ul>
+                    <li>Prefer full backups for restore decisions because partial backups depend on earlier backup history.</li>
+                    <li>Confirm the encryption key is still available before relying on encrypted artifacts.</li>
+                    <li>Review warnings and missing surfaces before restoring AI Search or source document blobs.</li>
+                    <li>Run restore only in a maintenance window because restored records can affect live users and search results.</li>
+                </ul>
+            </div>
+        </div>
+    </div>
+</div>
 
     <div class="modal fade" id="customPagesRestartModal" tabindex="-1" aria-labelledby="customPagesRestartModalLabel" aria-hidden="true" data-bs-backdrop="static" data-bs-keyboard="false">
         <div class="modal-dialog">
@@ -13403,8 +2100,13 @@ <h5 class="modal-title" id="userAgreementPreviewModalLabel">
     </div>
 </div>
 {% endblock %}
+
+{% block scripts %}
+
 <script>
-    // Live preview for banner in admin
+    // Live preview for the classification banner in admin.
+    // This previously sat between blocks in a child template, where Jinja
+    // discards it, so the preview never updated.
     document.addEventListener('DOMContentLoaded', function() {
         const textInput = document.getElementById('classification_banner_text');
         const colorInput = document.getElementById('classification_banner_color');
@@ -13423,8 +2125,6 @@ <h5 class="modal-title" id="userAgreementPreviewModalLabel">
     });
 </script>
 
-{% block scripts %}
-
  <script src="/static/js/simplemde/simplemde.min.js"></script>
 
 <script>
@@ -13464,11 +2164,14 @@ <h5 class="modal-title" id="userAgreementPreviewModalLabel">
 
         // Render the markdown inside the preview container
         if (simplemde) {
-            landingPageMarkdownPreview.innerHTML = simplemde.markdown(simplemde.value());
+            // DOMPurify is loaded globally from base.html, so sanitize inline
+            // rather than assigning rendered HTML straight to the sink.
+            landingPageMarkdownPreview.innerHTML = DOMPurify.sanitize(simplemde.markdown(simplemde.value()));
         } else {
             // If for some reason simplemde is null (e.g., user never toggled on?),
-            // just show raw text
-            landingPageMarkdownPreview.innerHTML = document.getElementById("landing_page_text_editor").value;
+            // just show raw text. textContent keeps it as text rather than
+            // reinterpreting the editor contents as HTML.
+            landingPageMarkdownPreview.textContent = document.getElementById("landing_page_text_editor").value;
         }
     }
 
@@ -13630,6 +2333,9 @@ <h5 class="modal-title" id="userAgreementPreviewModalLabel">
 <script type="module" src="{{ url_for('static', filename='js/admin/admin_model_endpoints.js') }}"></script>
 <script type="module" src="{{ url_for('static', filename='js/admin/admin_governance.js') }}"></script>
 <script type="module" src="{{ url_for('static', filename='js/admin/admin_sidebar_nav.js') }}"></script>
+<script type="module" src="{{ url_for('static', filename='js/admin/admin_card_links.js') }}?v={{ config['VERSION'] }}"></script>
+<script type="module" src="{{ url_for('static', filename='js/admin/admin_settings_dependencies.js') }}?v={{ config['VERSION'] }}"></script>
+<script type="module" src="{{ url_for('static', filename='js/admin/admin_access_roles_roster.js') }}?v={{ config['VERSION'] }}"></script>
 <script type="module" src="{{ url_for('static', filename='js/admin/admin_custom_pages.js') }}"></script>
 <script type="module" src="{{ url_for('static', filename='js/plugin_modal_stepper.js') }}"></script>
 {% if settings.enable_semantic_kernel %}
@@ -14315,14 +3021,11 @@ <h6>Summary:</h6>
             // Render markdown to HTML
             const previewContent = document.getElementById('userAgreementPreviewContent');
             if (previewContent) {
-                // Use marked if available, otherwise show raw text
+                // marked and DOMPurify are both loaded globally from base.html,
+                // so sanitize inline at the sink rather than through a guarded
+                // reassignment, which reads as unsanitized to static analysis.
                 if (typeof marked !== 'undefined') {
-                    let html = marked.parse(agreementText);
-                    // Sanitize if DOMPurify is available
-                    if (typeof DOMPurify !== 'undefined') {
-                        html = DOMPurify.sanitize(html);
-                    }
-                    previewContent.innerHTML = html;
+                    previewContent.innerHTML = DOMPurify.sanitize(marked.parse(agreementText));
                 } else {
                     previewContent.textContent = agreementText;
                 }
diff --git a/docs/explanation/features/ADMIN_SETTINGS_DEPENDENCY_ANNOUNCEMENTS.md b/docs/explanation/features/ADMIN_SETTINGS_DEPENDENCY_ANNOUNCEMENTS.md
new file mode 100644
index 000000000..776b1b886
--- /dev/null
+++ b/docs/explanation/features/ADMIN_SETTINGS_DEPENDENCY_ANNOUNCEMENTS.md
@@ -0,0 +1,160 @@
+# Admin Settings Dependency Announcements
+
+**Implemented in version:** 0.260.008
+**Area:** Admin Settings information architecture, stage B
+**Related:** `ADMIN_SETTINGS_CARD_TARGETED_LINKS_FIX.md`
+
+## Overview
+
+Several Admin Settings options only take effect when a different option is
+enabled. Those relationships were previously communicated inconsistently, and
+in the weakest cases not until after saving. This adds a declarative way for a
+card to state what it needs, with an inline notice that lets an admin satisfy
+the prerequisite without hunting for it.
+
+This matters more after the information architecture rework, because settings
+that are currently one tab apart end up in different top-level groups.
+
+## Problem
+
+Dependencies were expressed in four different ways, none of them actionable:
+
+| Dependency | How it was communicated |
+|---|---|
+| File Sync needs Redis Cache | Server-rendered alert, plus a `flash()` after saving |
+| FeedbackAdmin role needs User Feedback | One sentence of prose |
+| Backup source blobs need Enhanced Citations | Tooltip text |
+| Web Search needs consent | `flash()` after saving |
+
+The File Sync alert was accurate but static: it reflected saved state, so
+toggling Redis in another tab did not update it. The prose and tooltip cases
+offered no way to act, and no indication of where the prerequisite lived.
+
+## Design
+
+A dependent card declares its prerequisite in markup:
+
+```html
+<div class="card" id="file-sync-section"
+     data-requires="enable_redis_cache"
+     data-requires-label="Redis Cache"
+     data-requires-target="redis-cache-section"
+     data-requires-mode="warn"
+     data-requires-description="File Sync settings can be saved now, but sync runs stay inactive until Redis Cache is enabled and configured.">
+```
+
+| Attribute | Purpose |
+|---|---|
+| `data-requires` | Element id of the prerequisite control |
+| `data-requires-label` | Human name used in the notice |
+| `data-requires-target` | Card id to link to, resolved via `data-admin-link` |
+| `data-requires-mode` | `block` disables the dependent controls, `warn` only announces |
+| `data-requires-scope` | Optional selector limiting which controls are gated |
+| `data-requires-description` | Optional custom explanation |
+
+`static/js/admin/admin_settings_dependencies.js` evaluates each declaration on
+load and whenever the prerequisite changes, then renders a notice containing:
+
+1. **An inline mirror** of the prerequisite switch, so it can be satisfied
+   without leaving the tab.
+2. **A link to the prerequisite's card**, using the stage A resolver, so the
+   full configuration is one click away.
+
+### Why the mirror cannot corrupt a save
+
+Admin Settings posts one form, and the backend reads values by field name. A
+second control sharing a name would submit the value twice. The mirror is
+therefore created with **no `name` attribute**; it carries
+`data-dependency-proxy-for` instead and drives the canonical input directly.
+Exactly one named control per setting is ever submitted. This mirrors the
+convention the Latest Features tab already uses, where proxies are named with a
+`_proxy` suffix that the backend never reads.
+
+### Why some dependencies warn instead of block
+
+File Sync is deliberately `warn`. The backend already accepts File Sync as
+*requested* and reconciles it once Redis is ready, tracked as
+`requested_enable_file_sync` versus `file_sync_effective_enabled`. Hard
+disabling the toggle would remove a behaviour the backend supports on purpose:
+configure now, satisfy the infrastructure dependency after. Everything else
+blocks, because there is no equivalent deferred-intent path.
+
+### Field-level scoping
+
+`permissions-section` holds both the SafetyViolationAdmin and FeedbackAdmin
+role toggles, and only the latter depends on User Feedback. Blanket-disabling
+the card would switch off an unrelated control, so that dependency declares
+`data-requires-scope="#require_member_of_feedback_admin"`. A test asserts this
+specific scoping, because getting it wrong is silent and user-visible.
+
+### The backend remains authoritative
+
+Client-side gating is a usability layer. A disabled input is a courtesy, never
+a control. `route_frontend_admin_settings.py` still validates the File Sync
+Redis prerequisite and still flashes when it is unmet, and a test asserts that
+validation is still present so the client-side notice cannot be mistaken for
+enforcement.
+
+## Dependencies wired
+
+| Card | Requires | Mode | Notes |
+|---|---|---|---|
+| `file-sync-section` | `enable_redis_cache` | warn | Preserves save-then-reconcile |
+| `permissions-section` | `enable_user_feedback` | block, scoped | Only the FeedbackAdmin toggle |
+
+Deliberately **not** wired:
+
+- **Backup source blobs → Enhanced Citations.** Already handled in
+  `admin_data_management.js`, which drives the control from
+  `settings.enhanced_citations_enabled` and shows a lock message. Adding a
+  second mechanism would risk the two disagreeing.
+- **Multi-modal vision → multi-endpoint management.** This is a fallback, not a
+  requirement: vision uses Global Endpoints when multi-endpoint is on and the
+  legacy GPT deployment otherwise. Gating it would misrepresent the behaviour.
+- **Redis Key Vault auth → Key Vault storage.** Conditional on a select value
+  rather than a boolean, and the existing inline hint already links correctly
+  after the stage A conversion.
+
+## Related change
+
+The File Sync server-rendered alert previously fired whenever Redis was not
+"ready", which now overlaps with the live notice. It is narrowed to the case it
+uniquely covers — Redis enabled but not fully configured, which the client
+cannot detect because readiness also depends on the URL and credentials being
+present. The two messages no longer double up.
+
+## Files modified
+
+| File | Change |
+|---|---|
+| `application/single_app/static/js/admin/admin_settings_dependencies.js` | New module |
+| `application/single_app/templates/admin_settings.html` | Loads the module |
+| `application/single_app/templates/admin/_panes/file-sync.html` | Declares the Redis dependency; narrows the server alert |
+| `application/single_app/templates/admin/_panes/safety.html` | Declares the scoped User Feedback dependency |
+| `functional_tests/test_admin_settings_dependencies.py` | New contract test |
+| `application/single_app/config.py` | Version to 0.260.008 |
+
+## Validation
+
+`test_admin_settings_dependencies.py` pins five properties:
+
+1. Every declared prerequisite control exists in the composed template.
+2. Every declared link target is a real card.
+3. The mirror control is never given a `name`, so it cannot double-post.
+4. The Permissions dependency is scoped to the FeedbackAdmin toggle.
+5. The module is loaded, and the backend prerequisite validation still exists.
+
+Regression evidence:
+
+- Form field names and card ids unchanged: **462 names, 110 card ids identical**.
+- 75 functional test files covering `admin_settings.html`: **33 pre-existing
+  failures before and after, identical sets**.
+- All 20 admin templates parse under Jinja.
+- `scripts/check_xss_sinks.py` passes a full-file scan of every touched file.
+  The notice is built with DOM APIs and `textContent`, never string HTML.
+
+## Follow-up
+
+Stage C adds the group navigation level. The 10 hand-written Latest Features
+mirrors can then migrate onto this module's proxy handling, replacing roughly
+120 lines of per-field `addEventListener` pairs with one declarative attribute.
diff --git a/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md b/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
new file mode 100644
index 000000000..20ec4bf7a
--- /dev/null
+++ b/docs/explanation/features/ADMIN_SETTINGS_IA_REWORK_STATUS.md
@@ -0,0 +1,354 @@
+# Admin Settings IA rework — handoff
+
+Everything a new conversation needs to continue this work. The session-local
+scratch scripts do **not** survive, so the parts that mattered were moved into
+the repository.
+
+---
+
+## Where things stand
+
+Staging branch `feature/admin-settings-ia` on `microsoft/simplechat`, cut from
+`Development`. Nothing reaches `Development` until the whole rework is tested
+and merged in one final reviewed PR.
+
+```
+Development ─── feature/admin-settings-ia ──┬── #1297 stage 1    MERGED
+                                            ├── #1304 stage A+B  MERGED
+                                            ├── #1306 guardrail   MERGED
+                                            ├── stage C          in review
+                                            ├── stage D
+                                            └── stage E
+                                                      └──► final PR ──► Development
+```
+
+Current version: **0.260.017**. Fingerprint: **462 field names / 116 card ids**.
+Navigation: **14 groups / 44 tabs / 93 sections**. Stages D and E are complete.
+
+### Shipped
+
+| Stage | Content |
+|---|---|
+| 1 | Template split into 18 per-tab partials under `templates/admin/_panes/`; Latest Features moved last and General made the landing tab; Global Identities heading; File Sync sidebar submenu; `sectionMap` pruned 72 → 6; classification banner preview fixed; CodeQL XSS sink fixed |
+| A | 12 cross-tab links converted from tab-coupled `switchTab` to `data-admin-link` card targets; two were already broken; `switchTab` removed |
+| B | `data-requires` dependency announcements with inline mirror and link; File Sync and Permissions wired |
+| — | Form field contract enforced in CI |
+| C | Navigation moved into `admin_settings_nav.py` as groups → tabs → sections; both navigations render from it; group level with persisted collapse state and group pills; three-level search |
+| D (part 1) | Governance split into three tabs; Scale split into two; Front Door moved to Security; legacy tab redirects added |
+
+---
+
+## Guardrails — these now live in the repo
+
+The single most important rule: **never rename a `name=` attribute.** Admin
+Settings posts one form and the backend reads by field name, so a rename
+silently stops a setting from saving with no error anywhere.
+
+| Check | How to run |
+|---|---|
+| **Field contract** | `python -m pytest functional_tests/test_admin_settings_field_contract.py` |
+| Regenerate baseline *(only for a deliberate removal)* | `python functional_tests/test_admin_settings_field_contract.py --update-baseline` |
+| **Navigation map** | `python -m pytest functional_tests/test_admin_settings_nav_map.py` |
+| Composition contract | `python -m pytest functional_tests/test_admin_settings_template_composition.py` |
+| Card links | `python -m pytest functional_tests/test_admin_card_links.py` |
+| Dependencies | `python -m pytest functional_tests/test_admin_settings_dependencies.py` |
+| Sidebar parity | `python -m pytest functional_tests/test_admin_settings_sidebar_card_parity.py` |
+| XSS | `python scripts/check_xss_sinks.py --full-file <changed files>` |
+
+**Regression baseline:** the 75 functional test files that reference
+`admin_settings.html` now sit at **32 pre-existing failures**, down from 33
+after stage C fixed a missing navigation entry. That number must not increase. To reproduce the list:
+
+```
+cd functional_tests
+python -m pytest $(grep -rl admin_settings.html test_*.py) -q -p no:randomly
+```
+
+Exclude `test_enhanced_pii_analysis_standalone.py`, which needs live Azure
+credentials.
+
+### Reading templates in tests
+
+`admin_settings.html` is only a shell now. Tests must compose it:
+
+```python
+from test_support.templates import read_admin_settings_template
+markup = read_admin_settings_template()
+```
+
+`test_admin_settings_template_composition.py` fails any test that reads the
+template uncomposed while referencing a partial-backed card or field.
+
+---
+
+## Stage D — re-homing the cards — complete
+
+Cards were re-homed into the target groups, one group per pull request, running
+the field contract test and the full regression set on each.
+
+### Proven pattern
+
+1. Split the source pane with the split tool. It works line by line and
+   **refuses to write unless every source line lands in exactly one output**.
+2. Update `admin_settings_nav.py`: the tab entries and their sections.
+3. Update the `{% include %}` list in `admin_settings.html`.
+4. Add the old tab id to `LEGACY_TAB_REDIRECTS` in `admin_sidebar_nav.js`.
+5. Verify: field contract, nav map test, parity test, Jinja compile, full
+   regression set.
+
+**Moving a whole tab between groups needs no markup change** — panes are
+independent files and groups are entries in the map, so it is a one-line map
+edit. Only moving a *card* between tabs requires markup surgery. Front Door
+moved from Scale to Security that way.
+
+### Done
+
+| Group | Result |
+|---|---|
+| Governance | → Feature Governance, Policies, MCP Governance |
+| Scale | → Redis & Caching, Cosmos; Front Door moved to Security as Network |
+| Data Lifecycle | **New group.** Retention + Classification pulled from Workspaces, Archiving pulled from Safety |
+| Chat | **New group.** Chat Experience (thoughts from AI Models, file uploads + contents drawer and scope lock from Workspaces), Feedback & Alerts (feedback + desktop notifications from Safety) |
+| Appearance | **General dismantled.** → Branding, Notices & Agreements (+ user agreement from Workspaces), Pages & Links (+ external links) |
+| Security | **Safety dismantled.** → Access & Roles, Secrets, Content Safety, Session, Network |
+| Operations | Logging is now Logging & Health, gaining health check and API documentation from General |
+| Help | Gains Support Menu from General |
+| Knowledge | **Search & Extract dismantled.** → Web & Research, Search Index, Document Extraction (+ metadata extraction and multi-modal vision from Workspaces), Audio & Video |
+| Workspaces | → Workspace Types, Files & Sharing (+ shared conversation file approvals from AI Models), Global Identities |
+| Workflow | **New group**, split out of Workspaces |
+| AI Models | → Model Endpoints (carries the legacy modal and its nested Chat Model card), Embeddings, Image Generation |
+| Agents & Actions | → Agents, Actions, Inbound MCP (whole tab behind `mcp_ui_enabled`) |
+| Backup & Recovery | → Backup, Migrate, Restore, Cosmos Editor, Jobs |
+
+**Stage D is complete.** 14 groups, 44 tabs, from 17 flat tabs.
+
+### Backup & Recovery: complication I4, resolved
+
+The pane was 1,622 lines and needed three things the tools could not do:
+
+- **The migration card is a `<section>`, not a `<div>`**, so every div-balancing
+  helper walked straight past it. Its boundaries had to be found by balancing
+  `<section>` instead. This is why the tools reported 5 top-level cards when
+  there were 6.
+- **Eleven dialogs**, six of them opened from JavaScript rather than a button,
+  serving what became five different tabs. All were lifted to the shell.
+  Checked first that none carried a `name=` attribute: the pane's twelve form
+  fields are all radio groups inside the migration card, which stayed put.
+- **Shared controls.** One save button, one status line and one operational
+  warning serve all five tabs.
+
+### Stage E: the mixed card and the role roster
+
+**`system-settings-section` is gone.** It mixed five unrelated concerns under
+one heading. Each moved to the tab that owns it, wrapped in a new card, with the
+field markup carried across byte-for-byte:
+
+| Field | New home |
+|---|---|
+| `max_file_size_mb` | Workspaces → Files & Sharing |
+| `conversation_history_limit` | Chat → Chat Experience |
+| `default_system_prompt` | Chat → Chat Experience |
+| `access_denied_message` | Security → Access & Roles |
+| idle timeout (4 fields) | stays in Security → Session, card renamed `idle-timeout-section` |
+
+Splitting a card changes card ids but not field names, which is why the field
+contract passed unchanged. Card ids are structural; **field names are the
+breaking surface** and the contract test tracks only those, deliberately.
+
+**The Access & Roles roster** gathers all ten `require_member_of_*` switches,
+which are spread over seven tabs. It is built at runtime by
+`admin_access_roles_roster.js` from `input[name^="require_member_of_"]`, not
+from a list, so a new role requirement appears automatically.
+
+Each row is a mirror carrying **no name attribute**, following the existing
+proxy convention, so the setting is still posted exactly once. Sync is two-way:
+the mirror drives the canonical input and dispatches a `change` event, and the
+canonical input updates the mirror when changed on its own tab.
+
+### Stage F: the last hardcoded tab ids
+
+Two places still navigated by naming a tab, and both were broken by the rework:
+
+- **The setup walkthrough** mapped each of twelve steps to a tab id. Eleven
+  named tabs that no longer existed, so those steps would have moved nowhere.
+  Each step already knew which card it was about, so the tab id was a duplicate
+  copy of that knowledge. Steps now name the card and `openAdminCard()` finds
+  the tab. `scrollToRelevantSection()` became redundant and was deleted.
+- **Cosmos throughput validation** clicked `scale-tab` to reveal an invalid
+  field. It now walks up from the invalid field to its own card, so it goes to
+  wherever that field actually lives.
+
+`test_admin_settings_walkthrough_targets.py` asserts every step points at an
+element that exists, that no tab id is hardcoded, and that step numbering has no
+gaps. A scan confirms **no stale `-tab` literal remains in executable admin
+JavaScript**.
+
+The general rule this rework converged on: **never name a tab; name the setting
+and resolve the tab from the page.**
+
+### A structural guard worth keeping
+`test_every_pane_partial_is_balanced` checks `<div>` and `<section>` balance in
+every pane. An unbalanced pane does not fail to render — it silently nests the
+panes that follow it, so the failure surfaces somewhere unrelated and confusing.
+This was found the hard way: a stray `</div>` in `access-roles.html` made a
+Send Feedback test fail. Verified against a deliberately broken pane.
+
+### Nav order must match markup order
+
+`test_admin_settings_sidebar_card_parity` requires the nav map to list sections
+in the same order the cards appear in the pane. Adding a card to a pane means
+inserting it at the matching position in the map, not appending.
+
+
+
+### Group-shared regions
+
+Shared controls cannot be copied into each pane (duplicate element ids, and the
+JavaScript module would bind to the wrong one) and cannot live in one pane (an
+inactive pane is hidden, so the other four tabs lose the save button). They now
+sit outside the panes in a region marked `data-admin-group-shared="<group>"`,
+revealed only while that group is active.
+
+`syncAdminGroupSharedRegions()` resolves the owning group from **either**
+navigation. Reading only the top tab strip was a real bug: that strip is not
+rendered at all in the sidebar layout, so the Backup & Recovery save button
+would have been hidden permanently. Verified against a simulated DOM in both
+layouts.
+
+
+### Card container ids are not the nav section ids
+
+Several cards are wrapped in a container whose id differs from the nav map's
+section id, which is an inner anchor:
+
+| Nav section id | Card container id |
+|---|---|
+| `web-search-section` | `web-search-foundry-section` |
+| `embeddings-config` | `embeddings-configuration` |
+| `image-config` | `image-generation-configuration` |
+| `gpt-config` | `gpt-configuration` |
+| `agents-config` | `agents-configuration` |
+| `actions-config` | `actions-configuration` |
+
+**The move and split tools take container ids**; the nav map keeps its own.
+Run `list_pane_cards.py` for the real container id rather than assuming.
+
+### Trap: gpt-configuration is inside a modal
+
+`gpt-configuration` is **not** a top-level card. It lives inside
+`legacyModelSettingsModal` in the AI Models pane.
+
+**How this was resolved.** The modal was relocated to sit directly after
+`multi-endpoint-configuration`, the card holding its trigger. The split then
+assigned `multi-endpoint-configuration, gpt-configuration` to the same tab, so
+the modal's opening lines, the nested card and the closing lines all landed in
+`model-endpoints.html` in order and the modal reassembled intact.
+
+### Three more splitting rules learned
+
+- **A modal shared by cards that end up in different tabs must go to the
+  shell.** `legacyModelDiscoveryIdentityGuideModal` is opened from endpoints,
+  embeddings and image generation. Check for form fields first: a modal with a
+  `name=` attribute cannot move outside the `<form>` without changing the save
+  payload. That one had none.
+- **The split tool cannot write a target with the same name as its source.**
+  Rename the source (`agents.html` → `agents-src.html`) and split that.
+- **A Jinja conditional wrapping a card and its modals must be lifted out
+  whole.** The inbound MCP block is `{% if mcp_ui_enabled %}` … `{% endif %}`
+  spanning the card and three modals; it was extracted as one unit into its own
+  pane rather than split.
+
+### Tab-level conditions
+
+The nav map now supports `condition` on a **tab**, not just a section, so a tab
+whose entire pane is behind a feature flag disappears rather than rendering
+empty. Both renderers honour it. Verified: 40 tabs with `mcp_ui_enabled`, 39
+without.
+
+
+### Two hardcoded-id traps found and closed
+
+Both were latent breakage that only surfaced because a tab id changed:
+
+- **`openKeyVaultSettings`** in `admin_data_management.js` switched tabs by the
+  literal id `security-tab`. It was dead weight anyway — the link now carries
+  `data-admin-link` and `admin_card_links.js` resolves the tab from the DOM.
+- **The landing pane** was `show active` hardcoded in one pane's markup and
+  `showAdminTab('general')` hardcoded in the sidebar script. Splitting that
+  pane left Admin Settings with **no active pane at all**. Every pane now
+  renders `{% if admin_landing_tab == '<id>' %} show active{% endif %}`, fed by
+  `get_landing_tab_id()`, and the sidebar reads the first rendered tab.
+
+**Assert durable properties, not current ids.** Four test files hardcoded
+`general` or `security` and had to be rewritten to assert what actually matters
+— Latest Features is last, exactly one pane is active, every tab renders one
+pane. Any new test that names a tab id will need the same treatment next time.
+
+
+### The cross-pane move tool
+
+`move_card.py` moves a top-level card from one pane to another with the same
+every-line-accounted-for guarantee as the split tool. Two behaviours matter:
+
+- **Nested cards travel with their parent automatically**, because the card
+  scanner skips over card bodies. `conversation-contents-drawer-section` moved
+  inside `chat-file-uploads-section` without being named.
+- **The gap after a card travels with it**, which is what correctly routes an
+  interleaved modal to the tab that owns its trigger.
+
+### Complications, all now resolved
+
+- **I1** Modals are interleaved *between* cards, not collected at the end. Each
+  modal moves with the tab that owns its trigger. Where a modal is shared by
+  cards that end up in different tabs, it goes to the shell instead.
+- **I2** Some cards are nested inside other cards and move with their parents:
+  `conversation-contents-drawer-section` (inside chat file uploads),
+  `content-understanding-section` and `office-embedded-image-section` (inside
+  document intelligence). The card scanner skips card bodies, so this is
+  automatic.
+- **I4** The Data Management migration workflow is one `<section>` of non-card
+  markup. It was split last and on its own, driven from explicit line ranges.
+
+## Stage E — complete
+
+- `system-settings-section` split to four destinations, no renames.
+- Access & Roles roster mirroring the ten `require_member_of_*` toggles, built
+  from the page rather than a list. Mirrors carry **no `name` attribute**.
+
+---
+
+## Decisions already locked
+
+| | Decision |
+|---|---|
+| D1 | Split `system-settings-section` across Chat / Security / Workspaces |
+| D2 | Workflow becomes its own group |
+| D3 | Mirror role toggles rather than move them |
+| D4 | Legacy hash redirect map |
+| D5 | Per-tab partials |
+| Q2 | File Sync warns rather than blocks; hard-disable elsewhere |
+| — | Land each stage as its own PR into the staging branch |
+
+## Target structure — 14 groups
+
+`Appearance · Chat · AI Models · Agents & Actions · Workspaces · Workflow ·
+Knowledge · Security · Governance · Data Lifecycle · Backup & Recovery · Scale ·
+Operations · Help`
+
+Full card-by-card placement is in the PR description of #1304 and in the
+stage 2 plan. Key rationale: grouping follows *capability weight*, not card
+titles — Governance has 196 KB of backing JS so it cannot be a Security
+sub-tab; Video and audio are extraction pipelines, not chat features; Retention
+is data lifecycle, not a workspace toggle.
+
+---
+
+## Before the final merge to Development
+
+Revert the CI branch filters added in #1297. Six workflows list
+`feature/admin-settings-ia` in their `pull_request` branch filters so staged
+PRs are gated; `Development` should end up with its original configuration.
+
+Files: `codeql.yml`, `xss-sink-check.yml`, `broken-access-control-check.yml`,
+`malicious-pr-security-review.yml`, `python-syntax-check.yml`,
+`swagger-route-check.yml`.
diff --git a/docs/explanation/fixes/ADMIN_SETTINGS_CARD_TARGETED_LINKS_FIX.md b/docs/explanation/fixes/ADMIN_SETTINGS_CARD_TARGETED_LINKS_FIX.md
new file mode 100644
index 000000000..ced456655
--- /dev/null
+++ b/docs/explanation/fixes/ADMIN_SETTINGS_CARD_TARGETED_LINKS_FIX.md
@@ -0,0 +1,144 @@
+# Admin Settings Card-Targeted Navigation Links
+
+**Implemented in version:** 0.260.008
+**Area:** Admin Settings information architecture, stage A
+**Related:** `ADMIN_SETTINGS_NAVIGATION_AND_TEMPLATE_STRUCTURE_FIX.md`
+
+## Issue
+
+Admin Settings contains cross-references between related settings, for example
+Citations pointing at the video and audio file-support toggles, or the Redis
+Key Vault hint pointing at the Key Vault card. Each of those links named a tab
+button directly:
+
+```html
+<a href="#workspaces" onclick="switchTab(event, 'workspaces-tab')">
+```
+
+`switchTab` looked up `document.getElementById('workspaces-tab')`. That couples
+every link to a tab id, with two consequences.
+
+### 1. Links break silently on any tab change
+
+If the tab id changes, the lookup returns `null`, `switchTab` falls through to
+`showAdminTab('workspaces')`, no pane matches, and the only symptom is a console
+warning plus a URL hash pointing at nothing. Nothing fails loudly, so the
+breakage survives review.
+
+This was about to happen at scale: the information architecture rework renames
+and regroups most tabs.
+
+### 2. Two links were already wrong
+
+The Citations tab referenced **Enable Video File Support** and **Enable Audio
+File Support** with `#workspaces`, and the surrounding prose said "see the
+Workspaces tab". Both settings actually live in **Search and Extract**:
+
+| Setting | Card | Pane |
+|---|---|---|
+| `enable_video_file_support` | `video-intelligence-section` | `search-extract` |
+| `enable_audio_file_support` | `ai-voice-chat-section` | `search-extract` |
+
+So an admin following either link landed on the wrong tab with no indication
+why.
+
+## Root cause
+
+The link contract pointed at *navigation structure* (a tab button id) rather
+than at *content* (the setting being referenced). Navigation structure changes;
+the identity of a settings card does not.
+
+## Fix
+
+Links now declare the card they want:
+
+```html
+<a href="#video-intelligence-section" data-admin-link="video-intelligence-section">
+    Enable Video File Support
+</a>
+```
+
+`static/js/admin/admin_card_links.js` resolves the owning tab from the DOM at
+click time:
+
+```js
+const card = document.getElementById(cardId);
+const pane = card.closest('.tab-pane');
+window.showAdminTab(pane.id);
+```
+
+Because the tab is derived rather than declared, cards can move between tabs and
+tabs can be renamed or regrouped without touching a single link. Card ids are
+the only contract, and they are already stable — the template split preserved
+all 110 of them byte-identically.
+
+Behaviour on click:
+
+1. Resolve the card and activate its tab, in either the top-tab or sidebar layout.
+2. Mirror the active state in the sidebar when that layout is in use.
+3. Scroll the card into view.
+4. Highlight it for 1.6 seconds so the destination is obvious after the jump.
+
+Clicks are handled by delegation, so links rendered later still work.
+
+`switchTab` had no remaining callers and was removed, which makes the old
+coupling impossible to reintroduce by copy-paste.
+
+## Files modified
+
+| File | Change |
+|---|---|
+| `application/single_app/static/js/admin/admin_card_links.js` | New resolver module |
+| `application/single_app/static/js/admin/admin_settings.js` | Removed the dead `switchTab` helper |
+| `application/single_app/templates/admin_settings.html` | Loads the resolver; adds the highlight style; sanitizes the User Agreement preview at the sink |
+| `application/single_app/templates/admin/_panes/citation.html` | Two corrected links plus corrected prose |
+| `application/single_app/templates/admin/_panes/latest-features.html` | Eight links converted |
+| `application/single_app/templates/admin/_panes/scale.html` | Key Vault link converted |
+| `application/single_app/templates/admin/_panes/search-extract.html` | Enhanced Citations link converted |
+| `functional_tests/test_admin_card_links.py` | New contract test |
+| `application/single_app/config.py` | Version to 0.260.008 |
+
+## Link inventory
+
+| Source | Target card |
+|---|---|
+| Citations → video support | `video-intelligence-section` *(was wrong)* |
+| Citations → audio support | `ai-voice-chat-section` *(was wrong)* |
+| Latest Features → model endpoints | `multi-endpoint-configuration` |
+| Latest Features → citations ×2 | `enhanced-citations-section` |
+| Latest Features → processing thoughts | `processing-thoughts-section` |
+| Latest Features → support menu ×2 | `support-menu-section` |
+| Latest Features → Redis | `redis-cache-section` |
+| Latest Features → send feedback | `send-feedback-overview-card` |
+| Scale → Key Vault | `keyvault-section` |
+| Search and Extract → enhanced citations | `enhanced-citations-section` |
+
+## Validation
+
+`functional_tests/test_admin_card_links.py` pins four properties:
+
+1. Every `data-admin-link` target is a real element id in the composed template.
+2. Every such link carries a matching `href="#<target>"`, so it degrades
+   sensibly without JavaScript and stays copy-pasteable.
+3. No link reintroduces the tab-coupled `switchTab` pattern.
+4. The resolver module exists, is loaded by the page, and derives the tab from
+   the DOM rather than from a hardcoded map.
+
+Property 1 is the one that matters: it fails the build if a card is renamed or
+removed without updating the links that point at it, which is precisely the
+failure mode that went unnoticed before.
+
+Regression evidence:
+
+- Form field names and card ids unchanged: **462 names, 110 card ids identical**.
+- 75 functional test files covering `admin_settings.html`: **33 pre-existing
+  failures before and after, identical sets**.
+- All 20 admin templates parse under Jinja.
+- `scripts/check_xss_sinks.py` passes a full-file scan of every touched file,
+  which it did not before the User Agreement preview change.
+
+## Follow-up
+
+Stage B introduces declarative dependency gating, where a setting that requires
+another one announces it inline with a mirror control and a link to the
+prerequisite. That link uses the resolver added here.
diff --git a/docs/explanation/fixes/ADMIN_SETTINGS_NAVIGATION_AND_TEMPLATE_STRUCTURE_FIX.md b/docs/explanation/fixes/ADMIN_SETTINGS_NAVIGATION_AND_TEMPLATE_STRUCTURE_FIX.md
new file mode 100644
index 000000000..816ceac96
--- /dev/null
+++ b/docs/explanation/fixes/ADMIN_SETTINGS_NAVIGATION_AND_TEMPLATE_STRUCTURE_FIX.md
@@ -0,0 +1,199 @@
+# Admin Settings Navigation and Template Structure Fix
+
+**Fixed in version:** 0.260.004
+**Area:** Admin Settings information architecture
+**Related plan:** Admin Settings IA redesign (14 groups / 42 tabs), first delivery stage
+
+## Issues
+
+### 1. Latest Features opened on every visit to Admin Settings
+
+Latest Features is a curated release-notes tab, but it behaved like the landing
+page. Three separate places forced this:
+
+| Location | Behaviour |
+|---|---|
+| `templates/admin_settings.html` top-tab strip | First `<li>`, with `class="nav-link active"` |
+| Latest Features tab pane | `class="tab-pane fade show active"` |
+| `static/js/admin/admin_sidebar_nav.js` | Bootstrapped to `showAdminTab('latest-features')` |
+
+Admins had to click away from it on every visit.
+
+### 2. `admin_settings.html` was a 13,526-line, 1 MB single template
+
+Every one of the 18 tab panes lived in one file. Editing a single card meant
+navigating a file large enough to be slow to open and effectively impossible to
+review in a diff.
+
+### 3. Global Identities rendered as an unlabelled widget
+
+The `workspace-identities` pane contained only a bare JavaScript mount point:
+no heading, no description, and no intro copy, unlike every other tab.
+
+### 4. File Sync had no sidebar submenu
+
+File Sync is roughly 400 lines with 32 inputs and 17 toggles, but it was the
+only tab with no sidebar destinations, so its sub-areas could not be reached or
+found through the sidebar search.
+
+### 5. The classification banner live preview never ran
+
+The preview script sat between `{% endblock %}` and `{% block scripts %}` in a
+child template. Jinja discards content outside blocks in a child template, so
+the script was never rendered and the banner preview never updated as an admin
+typed.
+
+### 6. The sidebar `sectionMap` had rotted
+
+`scrollToSection` resolves a sidebar target with
+`sectionMap[sectionId] || sectionId`, so any entry mapping a key to itself is a
+no-op. The map had grown to 72 entries:
+
+- 66 were self-referencing no-ops
+- 1 (`control-center-admin-section`) pointed at an element that does not exist
+  anywhere in the template
+- 2 were never referenced by any sidebar link
+
+Every new section had been added twice, once in the sidebar and once in a map
+that did not need it.
+
+### 7. Home Page Text preview reinterpreted editor text as HTML
+
+`showPreview` fell back to assigning the raw editor contents to `innerHTML`
+when the Markdown editor had not initialized, despite the comment stating the
+intent was to "just show raw text". CodeQL reported this as `js/xss-through-dom`
+at high severity: DOM text read from a textarea and written back as HTML.
+
+The Markdown branch also wrote rendered HTML to `innerHTML` without
+sanitization, even though the same template already sanitizes the User
+Agreement preview with DOMPurify.
+
+## Root causes
+
+Issues 1, 3, and 4 come from incremental growth: tabs were added over time
+without a consistent structural contract, so newer surfaces skipped the heading
+and sidebar conventions the older ones follow. Issue 2 is the accumulation of
+that same growth in one file. Issue 5 is a Jinja block-scoping mistake that is
+silent by design, since Jinja drops stray child-template content rather than
+raising.
+
+## Changes
+
+### Template split
+
+Each tab pane moved verbatim to `templates/admin/_panes/<pane>.html` and is
+pulled back in with `{% include %}`. The parent template keeps:
+
+- the single wrapping `<form id="admin-settings-form">`
+- all modals
+- the `{% block head %}` and `{% block scripts %}` blocks
+
+Because the form boundary and every `name=` attribute are unchanged, the
+submitted payload is identical and `route_frontend_admin_settings.py` needed no
+changes. The parent dropped from 13,526 lines to about 2,200.
+
+### Navigation
+
+- Latest Features is last in the top-tab strip and in the sidebar, after Send
+  Feedback, and is no longer the default active pane.
+- General is the default landing tab in both the markup and the sidebar
+  bootstrap.
+- File Sync gained a sidebar submenu covering its source-type and
+  per-workspace-type areas, which required adding `id` attributes to those
+  areas. Existing `data-testid` hooks were left untouched.
+- Global Identities gained a heading and description.
+- The sidebar `sectionMap` was reduced from 72 entries to the 6 that are real
+  aliases, removing the dead `control-center-admin-section` target. A new test
+  fails if a no-op, dangling, or unreferenced entry is added back.
+- The Home Page Text preview raw fallback now uses `textContent`, and its
+  Markdown branch is sanitized inline with `DOMPurify.sanitize(...)` at the
+  sink, following the pattern used elsewhere in the app. DOMPurify is loaded
+  globally from the local `static/js/chat/purify.min.js` bundle in `base.html`,
+  before the page's script block, so no external asset is introduced and no
+  availability guard is needed.
+
+### Test support
+
+Functional tests that read `admin_settings.html` from disk would now see only
+the parent shell. A shared helper, `functional_tests/test_support/templates.py`,
+inlines Admin Settings partials and leaves every other repository file alone:
+
+```python
+from test_support.templates import read_admin_settings_template
+
+template = read_admin_settings_template()
+```
+
+The helper deliberately expands only `admin/`-prefixed includes. Expanding
+unrelated includes, such as the governance info modal, would pull in their own
+tab markup and silently widen assertions that are meant to describe the Admin
+Settings panes.
+
+## Files modified
+
+| File | Change |
+|---|---|
+| `application/single_app/config.py` | Version to 0.260.004 |
+| `application/single_app/templates/admin_settings.html` | Split into partials, nav reordered, banner script moved into `{% block scripts %}` |
+| `application/single_app/templates/admin/_panes/*.html` | 18 new pane partials |
+| `application/single_app/templates/_sidebar_nav.html` | Latest Features moved last, File Sync submenu added |
+| `application/single_app/static/js/admin/admin_sidebar_nav.js` | Default tab is General, not Latest Features; `sectionMap` pruned to real aliases |
+| `functional_tests/test_support/templates.py` | New composed-template helpers |
+| `functional_tests/test_admin_settings_template_composition.py` | New contract test |
+| 40 functional test files | Read the composed template through the shared helper |
+
+## Validation
+
+**Non-breaking-change proof.** A fingerprint of every form field name and card
+id was captured before the work and compared after each stage:
+
+```
+OK   field_names: 461 identical
+OK   card_ids: 109 identical
+OK   field_name_counts: 451 unique names, counts unchanged
+```
+
+The five names that appear more than once are legitimate radio and checkbox
+groups (migration mode choices and `file_sync_visible_source_types`).
+
+**Regression proof.** All 75 functional test files that reference
+`admin_settings.html` were run against the pre-change baseline and after the
+work:
+
+| Stage | Failures |
+|---|---|
+| Baseline (`origin/Development`) | 32 |
+| After template split | 32, identical set |
+| After navigation change | 32, identical set |
+| After Global Identities and File Sync fixes | 32, identical set |
+
+The 32 failures are pre-existing and unrelated, covering workflow route
+registration, Cosmos document-access wiring, and Send Feedback documentation.
+
+**Template validation.** All 20 admin templates parse under Jinja.
+
+## New contract test
+
+`test_admin_settings_template_composition.py` pins the structure:
+
+1. The parent delegates its panes to partials that exist on disk.
+2. No partial is orphaned, which would silently drop settings from the page.
+3. Composition restores the full card inventory.
+4. No functional test references a partial-only card or form field while
+   reading `admin_settings.html` uncomposed.
+
+Check 4 is the important one. It caught ten tests that would otherwise have
+asserted against an incomplete template, including three that were passing only
+because the assertion happened to be satisfied by the parent shell.
+
+## Follow-up
+
+This is the first stage of the wider Admin Settings information architecture
+work. Still outstanding:
+
+- the group navigation level above tabs, and re-homing cards into 14 groups
+- splitting `system-settings-section`, which mixes upload, chat, session, and
+  access-control settings in one card
+- a consolidated Security → Access and Roles view mirroring the ten
+  `require_member_of_*` toggles that are currently spread across six tabs
+- a legacy hash redirect map so old deep links resolve to their new tabs
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index d95b7aaf2..ca1ac6fe9 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,8 +2,193 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](/explanation/features/) and [Fixes by Version](/explanation/fixes/).
 
+### **(v0.260.018)**
+
+#### Bug Fixes
+
+*   **Setup Walkthrough Lands On The Right Settings Again**
+    *   The guided setup walkthrough sent each step to a named tab. After the Admin Settings restructure, eleven of its twelve steps named tabs that no longer existed, so those steps would have moved nowhere and left the admin looking at whatever was already on screen.
+    *   Each step now names the setting it is about and the tab is worked out from the page, so the walkthrough follows settings wherever they live.
+    *   (Ref: setup walkthrough, `admin_settings.js`, `admin_card_links.js`)
+
+*   **Cosmos Throughput Validation Reveals The Invalid Field**
+    *   When Cosmos throughput values failed validation, the page tried to switch to a tab that no longer exists, so the field needing attention could be left on a hidden tab with no indication of where to look.
+    *   Validation now jumps to wherever the invalid field actually is.
+    *   (Ref: Cosmos throughput validation, `admin_settings.js`)
+
+#### User Interface Enhancements
+
+*   **Admin Settings Restructure Merged With Current Development**
+    *   Version bump covering the merge of the Admin Settings information architecture work with the generated file output fixes developed in parallel. Both reached v0.260.011 independently, so their release notes are combined under that version.
+    *   (Ref: Admin Settings navigation, generated file exports)
+
+### **(v0.260.017)**
+
+#### New Features
+
+*   **All App Role Requirements In One Place**
+    *   Ten settings across seven tabs can each require an Entra app role, which made the overall access policy impossible to read without hunting through the whole of Admin Settings.
+    *   **Security → Access & Roles** now lists every one of them with a switch and a link to the setting in its own tab. Changing a switch here changes the setting itself.
+    *   The list is built from the page, so a new role requirement added anywhere appears here automatically.
+    *   (Ref: `app-role-requirements-section`, `admin_access_roles_roster.js`)
+
+#### User Interface Enhancements
+
+*   **System Settings Card Split To Where Each Setting Belongs**
+    *   One card mixed maximum file size, conversation history, idle timeout, the default system prompt and the access denied message — five unrelated concerns under one heading.
+    *   Maximum File Size is now in **Workspaces → Files & Sharing**, Conversation History and Default System Prompt in **Chat → Chat Experience**, and Access Denied Message in **Security → Access & Roles**.
+    *   What remains in **Security → Session** is the idle timeout, and the card is now named for it.
+    *   Every setting keeps its saved value; nothing needs re-entering.
+    *   (Ref: `idle-timeout-section`, `file-size-limit-section`, `conversation-history-section`, `default-system-prompt-section`, `access-denied-message-section`)
+
+### **(v0.260.016)**
+
+#### User Interface Enhancements
+
+*   **Backup, Migrate & Restore Split Into Five Tabs**
+    *   One tab carried the entire backup, migration, restore, Cosmos editing and job history surface — over 1,600 lines in a single scroll.
+    *   Backup & Recovery now has **Backup** (readiness, backup, schedule, storage, encryption), **Migrate**, **Restore**, **Cosmos Editor** and **Jobs**.
+    *   The save button, status line and operational-hours warning are shared by all five tabs, so they sit above the tabs and stay available wherever you are in the group.
+    *   This completes the Admin Settings restructure: **14 groups and 44 tabs**, from an original 17 flat tabs.
+    *   (Ref: `backup`, `migrate`, `restore`, `cosmos-editor`, `jobs`)
+
+#### Bug Fixes
+
+*   **Backup Dialogs Remain Available From Every Tab**
+    *   The eleven Backup & Recovery dialogs are opened from more than one place and several are opened from code rather than a button. Left inside a tab, a dialog cannot appear while a different tab is showing.
+    *   They now sit outside the tabs, so restore, migration cancel, job detail, the Cosmos editor dialogs and the five setup guides all open wherever they are triggered from.
+    *   (Ref: Backup & Recovery dialogs, `admin_data_management.js`)
+
+*   **Shared Controls Work In Both Navigation Layouts**
+    *   Shared group controls resolve their group from whichever navigation is on screen, so the Backup & Recovery save button is present in the sidebar layout as well as the tab layout.
+    *   (Ref: `data-admin-group-shared`, `admin_sidebar_nav.js`)
+
+### **(v0.260.015)**
+
+#### User Interface Enhancements
+
+*   **AI Models Split By Model Purpose**
+    *   AI Models presented every model setting on one tab. It is now **Model Endpoints** (endpoint and fallback configuration, plus the Chat Model dialog opened from it), **Embeddings** and **Image Generation**.
+    *   (Ref: `model-endpoints`, `embeddings`, `image-generation`)
+
+*   **Agents And Actions Are Now Separate Tabs**
+    *   A single "Agents and Actions" tab carried agent configuration, template approvals, document action capabilities, action configuration and the whole inbound MCP surface.
+    *   It is now **Agents**, **Actions** and **Inbound MCP**.
+    *   Inbound MCP is a large area with its own dialogs and diagnostics, and the whole tab is hidden when the inbound MCP interface is turned off rather than showing an empty tab.
+    *   (Ref: `agents`, `actions`, `inbound-mcp`)
+
+#### Bug Fixes
+
+*   **Model Setup Guide Available From Every Model Tab**
+    *   The Azure OpenAI Model Setup Guide dialog is opened from the endpoints, embeddings and image generation cards. Once those moved to separate tabs it could only have opened from one of them.
+    *   The dialog now sits outside the tabs, so it opens from all three.
+    *   (Ref: `legacyModelDiscoveryIdentityGuideModal`)
+
+*   **Dangling Section Comments Removed**
+    *   Seven tabs ended with a comment labelling a card that had since moved to another tab.
+    *   (Ref: admin settings tab panes)
+
+### **(v0.260.014)**
+
+#### User Interface Enhancements
+
+*   **Knowledge Settings Split By What They Actually Do**
+    *   Search & Extract held eight cards spanning four unrelated jobs, from Bing consent to voice transcription.
+    *   Knowledge now has **Web & Research** (web search, URL access, deep research), **Search Index** (Azure AI Search), **Document Extraction** (document intelligence, chunk sizes, plus metadata extraction and multi-modal vision brought over from Workspaces) and **Audio & Video** (video intelligence, voice conversations), alongside the existing File Sync.
+    *   Voice and video sit under Knowledge rather than Chat because they are extraction pipelines that turn recordings into searchable content.
+    *   (Ref: `web-research`, `search-index`, `extraction`, `audio-video`)
+
+*   **Workspaces Focused On Workspaces**
+    *   Workspaces mixed workspace types with file rules, workflow and extraction settings.
+    *   It is now **Workspace Types** (personal, group, public), **Files & Sharing** (downloads, sharing, and shared conversation file approvals brought over from AI Models) and the existing Global Identities.
+    *   (Ref: `workspace-types`, `files-sharing`)
+
+*   **Workflow Is Its Own Area**
+    *   Workflow drives approvals and assignment across every workspace type and was too large to sit as one card inside Workspaces. It now has its own group.
+    *   (Ref: `workflow`, `workflow-settings-section`)
+
+#### Bug Fixes
+
+*   **Group Workflow Assignment Dialog Could Not Open**
+    *   The Group Workflow Assignment dialog ended up in a different tab from the button that opens it. Because an inactive tab is hidden, the dialog would not have appeared at all.
+    *   The dialog now sits with its button, and a new check verifies this for every dialog in Admin Settings so it cannot happen again.
+    *   (Ref: `groupWorkflowAssignmentModal`, `test_admin_settings_modal_placement.py`)
+
+*   **Misplaced Section Comments In AI Models**
+    *   Two section comments had drifted onto the wrong cards while settings were being regrouped, labelling the embeddings card as processing thoughts.
+    *   (Ref: `ai-models` pane)
+
+### **(v0.260.013)**
+
+#### User Interface Enhancements
+
+*   **General Tab Broken Up Into Focused Tabs**
+    *   General had grown into a catch-all of eleven unrelated cards: branding sat next to health checks, API documentation, terms of use and system settings.
+    *   Appearance now has **Branding** (branding, home page text, appearance), **Notices & Agreements** (classification banner, chat AI notice, terms of use and the user agreement pulled across from Workspaces) and **Pages & Links** (static pages plus external links).
+    *   Health Check and API Documentation moved to Operations, which is now **Logging & Health** — they report on how the app is running rather than how it looks.
+    *   Support moved to Help as its own **Support Menu** tab, next to Send Feedback.
+    *   (Ref: `branding`, `notices`, `custom-pages`, `logging`, `support-menu`)
+
+*   **Security Split Into Five Purposeful Tabs**
+    *   Security held a single Key Vault card while an unrelated Safety tab mixed content filtering with role permissions, which are different jobs.
+    *   Security is now **Access & Roles** (who gets in and with what role), **Secrets** (Key Vault), **Content Safety** (what may be said once you are in), **Session** (idle timeout and related system settings) and **Network** (Azure Front Door).
+    *   (Ref: `access-roles`, `secrets`, `content-safety`, `session`, `network`)
+
+#### Bug Fixes
+
+*   **"Open Key Vault Settings" Link No Longer Depends On A Hardcoded Tab**
+    *   The link from Data Management to Key Vault switched tabs by a hardcoded id, so it silently stopped working whenever that tab was renamed.
+    *   It now uses the standard card link, which finds the owning tab from the page itself and stays correct however the settings are grouped.
+    *   (Ref: `data-management-key-vault-link`, `admin_card_links.js`, `admin_data_management.js`)
+
+*   **Admin Settings Always Opens On A Real Tab**
+    *   The tab shown on arrival was pinned to a specific id in both the markup and the sidebar script. Regrouping settings could leave Admin Settings opening with no tab selected at all.
+    *   The landing tab is now taken from the navigation map, so it follows the settings and can never be Latest Features.
+    *   (Ref: `admin_landing_tab`, `get_landing_tab_id`, `admin_sidebar_nav.js`)
+
+*   **Stale Tab Names In Latest Features**
+    *   Several Latest Features entries pointed readers at tabs by their old names after the settings moved.
+    *   (Ref: `latest-features` pane)
+
+### **(v0.260.012)**
+
+#### User Interface Enhancements
+
+*   **New Data Lifecycle Group For Retention, Classification And Archiving**
+    *   Retention policy, document classification and conversation archiving all decide how long content lives and how it is labelled, but they were split across Workspaces and Safety. They now sit together in a **Data Lifecycle** group with a tab each: **Retention**, **Classification** and **Archiving**.
+    *   Conversation archiving in particular was buried under Safety, which described what it protects against rather than what it does.
+    *   (Ref: navigation map, `retention-policy-section`, `document-classification-section`, `conversation-archiving-section`)
+
+*   **Chat Group Gathers The Settings That Shape A Conversation**
+    *   Settings that change what a conversation looks and behaves like were spread across AI Models, Workspaces and Safety. The **Chat** group now holds them in two tabs.
+    *   **Chat Experience** collects model thought display, chat file uploads (with the conversation contents drawer) and workspace scope lock.
+    *   **Feedback & Alerts** collects user feedback and desktop notifications, which are both about how the app talks back to the user rather than about safety enforcement.
+    *   (Ref: `chat-experience`, `feedback-alerts`, `processing-thoughts-section`, `chat-file-uploads-section`, `workspace-scope-lock-section`, `user-feedback-section`, `desktop-notifications-section`)
+
+*   **Settings Keep Their Values Through The Move**
+    *   Cards were relocated between tabs without renaming a single field, so every saved value is preserved and the form submits exactly the payload it did before.
+    *   Sidebar search still finds a setting by group, tab or card name, so you can reach anything without knowing where it now lives.
+    *   (Ref: admin settings field contract, `admin_settings_nav.py`)
+
 ### **(v0.260.011)**
 
+#### User Interface Enhancements
+
+*   **Governance And Scale Split Into Focused Tabs**
+    *   Governance held five cards covering three different jobs. It is now **Feature Governance** (which features are governed), **Policies** (the policies themselves), and **MCP Governance**.
+    *   Scale mixed cache configuration with Cosmos capacity, and is now **Redis & Caching** and **Cosmos**.
+    *   **Azure Front Door** moved out of Scale into Security, under a new **Network** tab. It configures authentication and redirect flows rather than throughput, so it never belonged with capacity settings.
+    *   Existing links and bookmarks to `#governance` and `#scale` still work and land on the first tab of each group.
+    *   No settings changed. Every option keeps its name and its saved value.
+    *   (Ref: navigation map, `feature-governance`, `governance-policies`, `mcp-governance`, `redis-caching`, `cosmos`, `network`)
+
+#### Bug Fixes
+
+*   **Governance Status Messages No Longer Get Stuck On One Tab**
+    *   The inline governance status message lived inside the Governance pane, so a message raised while working in one area could end up rendered on a tab you were not looking at.
+    *   It now sits outside the tabs and is visible wherever you are in Governance.
+    *   (Ref: `governance-status`, `admin_governance.js`)
+
 #### Bug Fixes
 
 *   **Reliable File Generation From Agent Action Results**
@@ -20,6 +205,109 @@ For feature-focused and fix-focused drill-downs by version, see [Features by Ver
     *   **CSV, DOCX, PDF, JSON, and XML now behave identically.** All five formats resolve rows the same way, reach back to earlier turns, decline to publish on a clarification turn, and report truncation.
     *   (Ref: `functions_generated_file_exports.py`, `functions_tabular_generated_exports.py`, `route_backend_chats.py`, `chat-messages.js`, [Generated Artifact Paging, Truncation, and Guidance Carry-Forward Fix](fixes/GENERATED_ARTIFACT_PAGING_AND_GUIDANCE_FIX.md), Refs #1071)
 
+### **(v0.260.010)**
+
+#### New Features
+
+*   **Admin Settings Navigation Is Now Grouped**
+    *   Admin Settings presented 18 tabs in one flat list. Related tabs are now collected under 12 groups such as Appearance, Knowledge, Security and Operations, so the list is scannable and has room to grow.
+    *   In the sidebar, groups are collapsible and remember whether you left them open. In the tab layout, a row of group pills filters the tab strip to one group at a time.
+    *   Opening a tab always reveals its group first, so a deep link or a cross-reference can never land you on a pane whose tab is hidden.
+    *   Sidebar search now matches group names as well as tab and setting names, and expands whatever it needs to show a result.
+    *   No settings moved in this release. Every tab keeps its contents; only the navigation around them changed.
+    *   (Ref: `admin_settings_nav.py`, `_sidebar_nav.html`, `admin_settings.html`, `admin_sidebar_nav.js`)
+
+#### Bug Fixes
+
+*   **Shared Conversation File Approvals Is Reachable From The Sidebar**
+    *   The Shared Conversation File Approvals card had no navigation entry, so it could only be found by scrolling the AI Models tab. It is now listed like every other setting.
+    *   (Ref: `shared-conversation-file-approvals-section`, navigation map)
+
+*   **Navigation Labels And Order Can No Longer Drift**
+    *   The tab strip and the sidebar each maintained the same structure by hand and had diverged: tab order differed between them, and Agents, Custom Pages and Search and Extract each showed a different name depending on which navigation you used.
+    *   Both now render from one definition, so a change is made once and appears in both.
+    *   (Ref: `admin_settings_nav.py`, `test_admin_settings_nav_map.py`)
+
+### **(v0.260.009)**
+
+#### New Features
+
+*   **Admin Settings Form Field Contract Is Now Enforced**
+    *   Admin Settings submits one form and the backend reads every value by field name, so the set of `name` attributes is the real contract between the template and the settings backend. Renaming or dropping one silently stops that setting from saving, with no error anywhere.
+    *   A new test pins every field name against a committed baseline, and fails the build if one disappears. Adding settings is unaffected; removing one now requires regenerating the baseline in the same commit, which makes it a visible, reviewed decision.
+    *   The same test rejects duplicate field names, which is what prevents a mirrored control from submitting a value twice.
+    *   (Ref: `test_admin_settings_field_contract.py`, `admin_settings_field_baseline.json`)
+
+### **(v0.260.008)**
+
+#### New Features
+
+*   **Settings That Need Another Setting Now Say So**
+    *   Some Admin Settings options only work when a different option is enabled, and the two often live in different tabs. That was previously explained only in prose, in a tooltip, or in a warning after saving, so you could switch something on and have nothing happen with no visible reason.
+    *   Affected cards now show an inline notice naming what they need, with a switch to enable the prerequisite without leaving the tab and a link straight to its full configuration.
+    *   **File Sync** announces its **Redis Cache** requirement live, and keeps its save-your-intent behaviour: settings can still be saved and activate once Redis is ready.
+    *   The **FeedbackAdmin** role control is disabled until **User Feedback** is enabled, since the role only governs access to the User Feedback report. The unrelated SafetyViolationAdmin control in the same card stays usable.
+    *   These notices are guidance only. The server still validates every prerequisite.
+    *   (Ref: `admin_settings_dependencies.js`, `data-requires`, File Sync, Permissions)
+
+#### Bug Fixes
+
+*   **Cross-Tab Links In Admin Settings Now Point At The Right Place**
+    *   Links that send you from one Admin Settings tab to a related setting used to name a tab button directly, so they broke silently whenever a tab was renamed or reorganised: no tab opened, and the address bar was left pointing at nothing.
+    *   Two were already wrong. The **Video File Support** and **Audio File Support** references in Citations sent you to the **Workspaces** tab, but those settings live under **Search and Extract**. Both now open the correct card.
+    *   All twelve cross-tab links now name the card they want, and the owning tab is worked out when you click. The destination card is briefly highlighted so it is obvious where you landed.
+    *   (Ref: `admin_card_links.js`, `data-admin-link`, `openAdminCard`, `test_admin_card_links.py`)
+
+*   **User Agreement Preview Sanitized At The Sink**
+    *   The User Agreement preview rendered Markdown through a guarded reassignment, which reads as unsanitized to static analysis and matched the pattern already corrected for the Home Page Text preview.
+    *   Now sanitized inline with `DOMPurify.sanitize(...)` at the point of rendering. `marked` and DOMPurify are both loaded globally, so the availability guards were redundant.
+    *   (Ref: User Agreement, `admin_settings.html` preview handler, DOMPurify)
+
+### **(v0.260.007)**
+
+#### User Interface Enhancements
+
+*   **Latest Features No Longer Opens Every Time You Visit Admin Settings**
+    *   Latest Features was pinned first in both the top tabs and the admin sidebar, and its pane was hard-coded as the default active tab, so a curated release-notes page behaved like the Admin Settings landing page.
+    *   It now sits last in both navigations, after **Send Feedback**, and **General** is the landing tab instead.
+    *   The Latest Features content is unchanged, including its **New** badge and the hide/unhide option.
+    *   (Ref: `admin_settings.html` top-tab strip, `_sidebar_nav.html`, `admin_sidebar_nav.js` default tab)
+
+*   **Global Identities Is No Longer An Unlabelled Widget**
+    *   The Global Identities tab rendered a bare control with no heading or description, unlike every other Admin Settings tab.
+    *   It now has a heading and explains that identities are deployment-wide and that secrets are stored in Key Vault when Key Vault storage is configured.
+    *   (Ref: Global Identities, `workspace-identities-section`, `functions_workspace_identities.py`)
+
+*   **File Sync Is Now Reachable From The Sidebar**
+    *   File Sync is one of the larger settings surfaces but was the only tab with no sidebar submenu, so its sub-areas could not be jumped to or found with sidebar search.
+    *   **Visible Source Types**, **Personal Workspace Sync**, **Group Workspace Sync**, and **Public Workspace Sync** are now sidebar destinations.
+    *   (Ref: File Sync, `_sidebar_nav.html`, `file-sync-submenu`)
+
+#### Bug Fixes
+
+*   **Classification Banner Preview Now Updates As You Type**
+    *   The live preview in Admin Settings never updated, because its script sat between template blocks where Jinja discards it, so the code was never rendered to the page.
+    *   The preview now responds to banner text, background colour, and text colour changes.
+    *   (Ref: Classification Banner, `admin_settings.html` `{% block scripts %}`)
+
+*   **Admin Sidebar Section Map Cleaned Up**
+    *   The sidebar's `sectionMap` had grown to 72 entries, but 66 of them mapped a key to itself, which the existing fallback already handled, and one pointed at an element that no longer exists.
+    *   Reduced to the 6 entries that are genuine aliases. A new test now fails if a redundant, dangling, or unreferenced entry is reintroduced.
+    *   (Ref: `admin_sidebar_nav.js`, `scrollToSection`, `test_admin_settings_sidebar_card_parity.py`)
+
+*   **Home Page Text Preview No Longer Reinterprets Editor Text As HTML**
+    *   The Home Page Text preview in Admin Settings assigned the raw editor contents to `innerHTML` when the Markdown editor had not initialized, so text typed into the editor was reinterpreted as HTML. CodeQL flagged this as `js/xss-through-dom` (high severity).
+    *   The raw fallback now uses `textContent`, which is what the code intended by "just show raw text", and the Markdown path is sanitized inline with `DOMPurify.sanitize(...)` at the sink. DOMPurify is loaded globally from the local vendored bundle, so no external asset is introduced.
+    *   (Ref: Home Page Text, `admin_settings.html` `showPreview`, DOMPurify)
+
+#### Breaking Changes
+
+*   **Admin Settings Template Split Into Per-Tab Partials**
+    *   `admin_settings.html` had grown to 13,526 lines in a single 1 MB file. Each tab pane now lives in `templates/admin/_panes/` and is included by the parent, which keeps the global form, the modals, and the script blocks.
+    *   No settings behaviour changes: every form field name and all 110 configuration card ids are byte-identical, so the submitted payload and the settings backend are untouched.
+    *   **Migration**: code or tests that read `templates/admin_settings.html` directly now see only the parent shell. Use `test_support.templates.read_admin_settings_template()` in functional tests, or `compose_if_admin_settings()` inside a shared file-reading helper. A new contract test fails if a test asserts on a partial-backed card or field without composing the template first.
+    *   (Ref: `templates/admin/_panes/`, `functional_tests/test_support/templates.py`, `test_admin_settings_template_composition.py`)
+
 ### **(v0.260.006)**
 
 #### New Features
diff --git a/functional_tests/test_access_denied_message_feature.py b/functional_tests/test_access_denied_message_feature.py
index 4a0a21945..69d85df96 100644
--- a/functional_tests/test_access_denied_message_feature.py
+++ b/functional_tests/test_access_denied_message_feature.py
@@ -20,6 +20,7 @@
 import sys
 import os
 import re
+from test_support.templates import compose_if_admin_settings
 
 # Resolve paths relative to repo root
 REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -40,7 +41,7 @@ def test_admin_template_has_field():
     errors = []
 
     with open(ADMIN_TEMPLATE, encoding="utf-8") as f:
-        content = f.read()
+        content = compose_if_admin_settings(ADMIN_TEMPLATE, f.read())
 
     # textarea with correct name attribute
     if 'name="access_denied_message"' not in content:
diff --git a/functional_tests/test_admin_access_roles_roster.py b/functional_tests/test_admin_access_roles_roster.py
new file mode 100644
index 000000000..268ae0fb5
--- /dev/null
+++ b/functional_tests/test_admin_access_roles_roster.py
@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""
+Functional test for the Access & Roles app role roster.
+Version: 0.260.017
+Implemented in: 0.260.017
+
+Settings that can require an Entra app role are spread across seven tabs, which
+makes the overall access policy impossible to read in one go. Access & Roles now
+gathers them into one roster.
+
+The switches themselves stay on their own tabs, so the roster shows mirrors. A
+mirror must never carry a name attribute: the Admin Settings form posts once and
+the backend reads by field name, so a named duplicate would submit the setting
+twice.
+
+This test ensures the roster stays a mirror rather than becoming a second copy.
+"""
+
+import os
+import re
+import sys
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+from test_support.templates import read_admin_settings_template  # noqa: E402
+from test_support.nav import iter_tabs  # noqa: E402
+
+APP_ROOT = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "application",
+    "single_app",
+)
+ROSTER_JS = os.path.join(APP_ROOT, "static", "js", "admin", "admin_access_roles_roster.js")
+
+ROLE_FIELD_PATTERN = re.compile(r'name="(require_member_of_[a-z_]+)"')
+
+
+def _read(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def test_role_fields_are_declared_exactly_once():
+    """A duplicated role field would post the setting twice."""
+    print("Testing app role fields are not duplicated by the roster...")
+
+    markup = read_admin_settings_template()
+    names = ROLE_FIELD_PATTERN.findall(markup)
+    assert names, "Expected app role requirement fields in Admin Settings"
+
+    duplicates = sorted({name for name in names if names.count(name) > 1})
+    assert not duplicates, (
+        "App role fields declared more than once, which would submit them "
+        f"twice: {duplicates}"
+    )
+
+    print(f"All {len(names)} app role fields are declared exactly once.")
+    return True
+
+
+def test_roster_is_rendered_from_the_page():
+    """A hand-written roster would drift as settings move between tabs."""
+    print("Testing the roster builds itself from the page...")
+
+    markup = read_admin_settings_template()
+    assert 'id="app-role-requirements-list"' in markup, (
+        "Expected the roster container in Access & Roles"
+    )
+    assert 'id="app-role-requirements-section"' in markup, (
+        "Expected the roster card in Access & Roles"
+    )
+
+    source = _read(ROSTER_JS)
+    assert 'input[type="checkbox"][name^="require_member_of_"]' in source, (
+        "The roster should discover role switches from the page rather than "
+        "from a hard-coded list, so it cannot fall out of step"
+    )
+
+    print("The roster is built from the page.")
+    return True
+
+
+def test_roster_mirrors_carry_no_name():
+    """The whole point of a mirror is that it is not submitted."""
+    print("Testing roster mirrors are not submitted with the form...")
+
+    source = _read(ROSTER_JS)
+    mirror_block = source[source.index("function buildRow("):source.index("export function")]
+
+    assert "mirror.name" not in mirror_block, (
+        "A roster mirror must not be given a name attribute, or its setting "
+        "would be posted twice"
+    )
+    assert "data-ignore-settings-change" in mirror_block, (
+        "A roster mirror should be excluded from unsaved-change tracking"
+    )
+    assert "data-role-mirror-for" in mirror_block, (
+        "A roster mirror should record which control it drives"
+    )
+
+    print("Roster mirrors carry no name and are excluded from change tracking.")
+    return True
+
+
+def test_roster_lives_in_access_and_roles():
+    """The roster is only useful where access policy is being read."""
+    print("Testing the roster is listed under Access & Roles...")
+
+    section_ids = {
+        section["id"]
+        for _, tab in iter_tabs()
+        if tab["id"] == "access-roles"
+        for section in tab["sections"]
+    }
+    assert "app-role-requirements-section" in section_ids, (
+        "The app role roster should be a section of the Access & Roles tab"
+    )
+
+    print("The roster is listed under Access & Roles.")
+    return True
+
+
+if __name__ == "__main__":
+    tests = [
+        test_role_fields_are_declared_exactly_once,
+        test_roster_is_rendered_from_the_page,
+        test_roster_mirrors_carry_no_name,
+        test_roster_lives_in_access_and_roles,
+    ]
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        try:
+            results.append(bool(test()))
+        except Exception as error:  # noqa: BLE001 - report and continue
+            print(f"Test failed: {error}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} tests passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_admin_agent_default_model_migration.py b/functional_tests/test_admin_agent_default_model_migration.py
index 99e99afc8..ead0a33fd 100644
--- a/functional_tests/test_admin_agent_default_model_migration.py
+++ b/functional_tests/test_admin_agent_default_model_migration.py
@@ -11,6 +11,7 @@
 """
 
 import os
+from test_support.templates import compose_if_admin_settings
 
 
 def parse_version(version_text):
@@ -25,7 +26,7 @@ def parse_version(version_text):
 
 def read_file_text(file_path):
     with open(file_path, "r", encoding="utf-8") as file:
-        return file.read()
+        return compose_if_admin_settings(file_path, file.read())
 
 
 def test_admin_agent_default_model_migration_wiring():
diff --git a/functional_tests/test_admin_app_role_settings_consistency.py b/functional_tests/test_admin_app_role_settings_consistency.py
index 698b3b79a..07d611b8f 100644
--- a/functional_tests/test_admin_app_role_settings_consistency.py
+++ b/functional_tests/test_admin_app_role_settings_consistency.py
@@ -17,6 +17,7 @@
 import sys
 import traceback
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -92,7 +93,7 @@
 def read_file(path):
     """Read a UTF-8 text file from the repo."""
     with open(path, "r", encoding="utf-8") as file_handle:
-        return file_handle.read()
+        return compose_if_admin_settings(path, file_handle.read())
 
 
 def read_current_version():
diff --git a/functional_tests/test_admin_card_links.py b/functional_tests/test_admin_card_links.py
new file mode 100644
index 000000000..740c2e731
--- /dev/null
+++ b/functional_tests/test_admin_card_links.py
@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+# test_admin_card_links.py
+"""
+Functional test for Admin Settings card-targeted navigation links.
+Version: 0.260.008
+Implemented in: 0.260.008
+
+Cross-tab links used to name a tab button directly, for example
+switchTab(event, 'workspaces-tab'). That couples every link to a tab id, so an
+information-architecture change silently breaks it: the button no longer
+exists, no pane is activated, and the URL hash points at nothing. Two links
+were already wrong this way, pointing at the Workspaces tab for video and audio
+settings that live under Search and Extract.
+
+Links now name the card they want with data-admin-link, and the owning tab is
+resolved from the DOM at click time. This test pins that contract:
+
+  1. Every data-admin-link target is a real element id in the composed template.
+  2. Every such link carries a matching href fragment, so it degrades sensibly
+     without JavaScript and remains copy-pasteable.
+  3. No link reintroduces the tab-coupled switchTab pattern.
+  4. The resolver module is wired into the page.
+"""
+
+import re
+import sys
+from pathlib import Path
+
+from test_support.templates import (
+    ADMIN_SETTINGS_TEMPLATE,
+    read_admin_settings_template,
+)
+from test_support.versioning import assert_app_version_at_least
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+CARD_LINKS_JS = (
+    REPO_ROOT
+    / "application"
+    / "single_app"
+    / "static"
+    / "js"
+    / "admin"
+    / "admin_card_links.js"
+)
+
+LINK_RE = re.compile(r'<a\b[^>]*\bdata-admin-link="(?P<target>[^"]+)"[^>]*>')
+HREF_RE = re.compile(r'\bhref="#(?P<fragment>[^"]+)"')
+
+
+def _links(markup):
+    """Return every anchor tag that declares a card target."""
+    return [(m.group("target"), m.group(0)) for m in LINK_RE.finditer(markup)]
+
+
+def test_every_card_link_target_exists():
+    """A link that resolves to nothing is a dead end for the admin."""
+    print("Testing Admin Settings card link targets...")
+
+    assert_app_version_at_least("0.260.008")
+    composed = read_admin_settings_template()
+    element_ids = set(re.findall(r'\sid="([^"]+)"', composed))
+
+    links = _links(composed)
+    assert links, "Expected Admin Settings to declare card-targeted links"
+
+    missing = sorted({target for target, _ in links if target not in element_ids})
+    assert not missing, (
+        "data-admin-link targets do not exist in the composed template: "
+        f"{missing}"
+    )
+
+    print(f"All {len(links)} card link(s) resolve to real elements.")
+
+
+def test_card_links_keep_a_matching_href():
+    """The href is the no-JavaScript fallback and should match the target."""
+    print("Testing Admin Settings card link href fallbacks...")
+
+    composed = read_admin_settings_template()
+    mismatched = []
+
+    for target, tag in _links(composed):
+        href = HREF_RE.search(tag)
+        if href is None:
+            mismatched.append(f"{target} (no href)")
+        elif href.group("fragment") != target:
+            mismatched.append(f"{target} (href points at {href.group('fragment')})")
+
+    assert not mismatched, (
+        "Card links should carry href=\"#<same-target>\": " f"{mismatched}"
+    )
+
+    print("Every card link href matches its data-admin-link target.")
+
+
+def test_no_tab_coupled_links_remain():
+    """switchTab links break silently whenever a tab is renamed or regrouped."""
+    print("Testing that no tab-coupled admin links remain...")
+
+    composed = read_admin_settings_template()
+    offenders = re.findall(r'onclick="switchTab\(event,\s*\'([^\']+)\'\)"', composed)
+
+    assert not offenders, (
+        "These links still name a tab button, so they break when the tab id "
+        "changes. Use data-admin-link with a card id instead: "
+        f"{sorted(set(offenders))}"
+    )
+
+    print("No tab-coupled links remain.")
+
+
+def test_card_link_resolver_is_wired_in():
+    """The markup contract is useless if the resolver never loads."""
+    print("Testing Admin Settings card link resolver wiring...")
+
+    assert CARD_LINKS_JS.is_file(), f"Missing resolver module at {CARD_LINKS_JS}"
+
+    parent = ADMIN_SETTINGS_TEMPLATE.read_text(encoding="utf-8")
+    assert "js/admin/admin_card_links.js" in parent, (
+        "admin_card_links.js is not loaded by admin_settings.html"
+    )
+
+    source = CARD_LINKS_JS.read_text(encoding="utf-8")
+    for marker in (
+        "export function openAdminCard",
+        "data-admin-link",
+        "closest('.tab-pane')",
+    ):
+        assert marker in source, f"Resolver is missing expected logic: {marker}"
+
+    # The resolver must derive the tab from the DOM rather than hardcode a map,
+    # which is the whole reason the links survive an IA change. Comments are
+    # stripped first so the explanation of the old pattern does not trip this.
+    code = re.sub(r"^\s*//.*$", "", source, flags=re.MULTILINE)
+    assert "switchTab(" not in code, (
+        "Resolver should not depend on the tab-coupled switchTab helper"
+    )
+
+    print("Card link resolver is present and wired into the page.")
+
+
+if __name__ == "__main__":
+    tests = [
+        test_every_card_link_target_exists,
+        test_card_links_keep_a_matching_href,
+        test_no_tab_coupled_links_remain,
+        test_card_link_resolver_is_wired_in,
+    ]
+
+    results = []
+    for test in tests:
+        try:
+            test()
+            results.append(True)
+        except Exception as exc:
+            print(f"FAILED {test.__name__}: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_admin_document_action_capabilities_location.py b/functional_tests/test_admin_document_action_capabilities_location.py
index 91d09914f..c055e2e1b 100644
--- a/functional_tests/test_admin_document_action_capabilities_location.py
+++ b/functional_tests/test_admin_document_action_capabilities_location.py
@@ -12,6 +12,7 @@
 
 from pathlib import Path
 import traceback
+from test_support.templates import resolve_template_includes
 from test_support.versioning import assert_app_version_at_least
 
 
@@ -19,7 +20,14 @@
 
 
 def read_text(relative_path: str) -> str:
-    return (ROOT / relative_path).read_text(encoding="utf-8")
+    path = ROOT / relative_path
+    content = path.read_text(encoding="utf-8")
+
+    # Admin Settings is composed from per-tab partials, so structural
+    # assertions have to see the fully composed markup.
+    if path.name == "admin_settings.html":
+        return resolve_template_includes(content, path.parent)
+    return content
 
 
 def test_admin_document_action_capabilities_card_location() -> None:
@@ -34,20 +42,22 @@ def test_admin_document_action_capabilities_card_location() -> None:
     )
 
     card_index = template_content.find('id="document-action-capabilities-card"')
-    agents_tab_index = template_content.find('id="agents" role="tabpanel"')
-    agents_config_index = template_content.find('id="agents-configuration"')
+    actions_tab_index = template_content.find('id="actions" role="tabpanel"')
+    actions_config_index = template_content.find('id="actions-configuration"')
 
     assert card_index != -1, "Expected the admin settings template to render the document action capabilities card."
-    assert agents_tab_index != -1, "Expected the admin settings template to render the Agents and Actions tab pane."
-    assert agents_config_index != -1, "Expected the admin settings template to render the agents configuration card."
-    assert agents_tab_index < card_index < agents_config_index, (
-        "Expected the document action capabilities card to appear at the top of the Agents and Actions tab before the existing configuration cards."
+    assert actions_tab_index != -1, "Expected the admin settings template to render the Actions tab pane."
+    assert actions_config_index != -1, "Expected the admin settings template to render the actions configuration card."
+    # The card now leads the Actions tab. Agents configuration moved to its own
+    # tab, so ordering is asserted against the tab this card actually lives in.
+    assert actions_tab_index < card_index < actions_config_index, (
+        "Expected the document action capabilities card to appear at the top of the Actions tab before the actions configuration card."
     )
     assert 'Action</strong> dropdown in Chat and Workflow' in template_content, (
         "Expected the card copy to explain that these settings control the Action dropdown in Chat and Workflow."
     )
     assert 'global agent and custom action cards below' in template_content, (
-        "Expected the card copy to explain that the capability settings remain separate from the cards below in the Agents and Actions tab."
+        "Expected the card copy to explain that the capability settings remain separate from the cards below in the Actions tab."
     )
 
     print("✅ Admin document action capabilities card placement verified")
diff --git a/functional_tests/test_admin_global_item_enabled_state.py b/functional_tests/test_admin_global_item_enabled_state.py
index 88fad4e7f..a6195d5a7 100644
--- a/functional_tests/test_admin_global_item_enabled_state.py
+++ b/functional_tests/test_admin_global_item_enabled_state.py
@@ -11,6 +11,7 @@
 """
 
 from pathlib import Path
+from test_support.templates import read_admin_settings_template
 from test_support.versioning import assert_app_version_at_least
 
 
@@ -38,7 +39,7 @@ def test_admin_global_item_enabled_state():
     admin_plugins_js = ADMIN_PLUGINS_JS.read_text(encoding="utf-8")
     admin_agents_js = ADMIN_AGENTS_JS.read_text(encoding="utf-8")
     plugin_common_js = PLUGIN_COMMON_JS.read_text(encoding="utf-8")
-    admin_settings_template = ADMIN_SETTINGS_TEMPLATE.read_text(encoding="utf-8")
+    admin_settings_template = read_admin_settings_template()
     agent_schema = AGENT_SCHEMA_FILE.read_text(encoding="utf-8")
     plugin_schema = PLUGIN_SCHEMA_FILE.read_text(encoding="utf-8")
 
diff --git a/functional_tests/test_admin_latest_features_tab.py b/functional_tests/test_admin_latest_features_tab.py
index f3e311c69..31d96dfc4 100644
--- a/functional_tests/test_admin_latest_features_tab.py
+++ b/functional_tests/test_admin_latest_features_tab.py
@@ -10,10 +10,16 @@
 focused on features users can see and control.
 """
 
+import re
 import importlib.util
 import os
 import sys
 
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+from test_support.templates import resolve_template_includes
+from test_support.nav import get_group_for_tab, get_tab_ids
+
 
 CURRENT_DIR = os.path.dirname(os.path.abspath(__file__))
 REPO_ROOT = os.path.abspath(os.path.join(CURRENT_DIR, '..'))
@@ -131,7 +137,13 @@
 
 def read_text(path):
     with open(path, 'r', encoding='utf-8') as file_handle:
-        return file_handle.read()
+        content = file_handle.read()
+
+    # Admin Settings is composed from per-tab partials, so structural
+    # assertions have to see the fully composed markup.
+    if os.path.basename(str(path)) == 'admin_settings.html':
+        return resolve_template_includes(content, os.path.dirname(str(path)))
+    return content
 
 
 def load_module(path, module_name):
@@ -238,8 +250,6 @@ def test_latest_features_template_structure():
     template_content = read_text(ADMIN_TEMPLATE)
 
     required_markers = [
-        'id="latest-features-tab"',
-        'data-bs-target="#latest-features"',
         'id="latest-features"',
         'admin_latest_feature_release_groups',
         '{% for release_group in admin_latest_feature_release_groups %}',
@@ -326,44 +336,92 @@ def test_latest_features_sidebar_navigation():
         raise AssertionError(f'Missing Latest Features sidebar markers: {missing_markers}')
 
     latest_features_index = sidebar_content.index('data-tab="latest-features"')
-    general_index = sidebar_content.index('data-tab="general"')
-    assert latest_features_index < general_index, 'Latest Features should appear before General in the admin sidebar'
     assert '<span class="badge bg-warning text-dark text-uppercase ms-2">New</span>' in sidebar_content, 'Sidebar Latest Features item should include a New badge'
 
+    # Tab order is defined once in the nav map, which the sidebar renders from,
+    # so ordering is asserted there rather than against the rendered markup.
+    tab_ids = get_tab_ids()
+    assert tab_ids[-1] == 'latest-features', 'Latest Features should be the last destination of all'
+    assert tab_ids.index('latest-features') > tab_ids.index('send-feedback'), 'Latest Features should be the last destination, after Send Feedback'
+
     print('Latest Features sidebar navigation is present')
     return True
 
 
 def test_latest_features_top_nav_priority():
-    """Latest Features should be the first top-nav tab and default active pane."""
-    print('Testing Latest Features top-nav priority...')
+    """Latest Features should be the last tab and never default active."""
+    print('Testing Latest Features navigation placement...')
 
     template_content = read_text(ADMIN_TEMPLATE)
-
-    latest_features_tab_index = template_content.index('id="latest-features-tab"')
-    general_tab_index = template_content.index('id="general-tab"')
-    assert latest_features_tab_index < general_tab_index, 'Latest Features tab should appear before General in top nav'
-
-    assert 'id="latest-features-tab" data-bs-toggle="tab" data-bs-target="#latest-features"' in template_content, 'Latest Features top-nav tab missing'
-    assert 'Latest Features <span class="badge bg-warning text-dark text-uppercase ms-2 latest-feature-nav-badge">New</span>' in template_content, 'Latest Features top-nav tab should include a New badge'
-    assert 'class="tab-pane fade show active" id="latest-features" role="tabpanel" aria-labelledby="latest-features-tab"' in template_content, 'Latest Features pane should be the default active tab'
-
-    print('Latest Features is prioritized in top navigation')
+    tab_ids = get_tab_ids()
+
+    # Navigation order now comes from the nav map, which both the top tab strip
+    # and the sidebar render from, so order is asserted there rather than
+    # against either rendering.
+    assert tab_ids[-1] == 'latest-features', (
+        'Latest Features should be the last tab in the navigation map, '
+        f'got {tab_ids[-1]}'
+    )
+    assert tab_ids.index('latest-features') > tab_ids.index('send-feedback'), (
+        'Latest Features should come after Send Feedback'
+    )
+
+    group = get_group_for_tab('latest-features')
+    assert group is not None and group['id'] == 'help', (
+        f"Latest Features should sit in the Help group, got {group}"
+    )
+
+    # Latest Features opened on every visit to Admin Settings, which is why it
+    # is pinned last. The landing pane is not hardcoded: every pane derives its
+    # active state from admin_landing_tab, which is the first tab of the first
+    # group, so regrouping cards can never leave Admin Settings with no pane
+    # showing or with Latest Features showing.
+    assert '<div class="tab-pane fade{% if admin_landing_tab == \'latest-features\' %} show active{% endif %}" id="latest-features"' in template_content, (
+        'Latest Features pane should derive its active state from the nav map like every other pane'
+    )
+    landing_tab = tab_ids[0]
+    assert landing_tab != 'latest-features', 'Latest Features must never be the landing tab'
+    assert f'<div class="tab-pane fade{{% if admin_landing_tab == \'{landing_tab}\' %}} show active{{% endif %}}" id="{landing_tab}"' in template_content, (
+        f"The first tab in the navigation map ('{landing_tab}') should render the landing pane conditional"
+    )
+
+    print('Latest Features is last in navigation and not default active')
     return True
 
 
 def test_admin_settings_tab_uniqueness():
-    """Admin settings template should not contain duplicate Security tab controls or extra active panes."""
+    """Every tab must appear exactly once, with exactly one default pane."""
     print('Testing admin settings tab uniqueness...')
 
     template_content = read_text(ADMIN_TEMPLATE)
     normalized_template = ''.join(template_content.split())
-
-    assert template_content.count('id="security-tab"') == 1, 'Security tab button should appear exactly once'
-    assert template_content.count('id="security" role="tabpanel"') == 1, 'Security tab pane should appear exactly once'
-    assert template_content.count('tab-pane fade show active') == 1, 'Only one tab pane should be marked show active in top-nav markup'
+    tab_ids = get_tab_ids()
+
+    duplicates = sorted({t for t in tab_ids if tab_ids.count(t) > 1})
+    assert not duplicates, f'Tabs listed more than once in the nav map: {duplicates}'
+
+    # Every tab in the map must render exactly one pane. Checking all of them
+    # is stronger than naming one tab, and cannot go stale as tabs are renamed.
+    for tab_id in tab_ids:
+        pane_count = template_content.count(f'id="{tab_id}" role="tabpanel"')
+        assert pane_count == 1, f"Tab pane '{tab_id}' should appear exactly once, found {pane_count}"
+    # No pane may hardcode the active state; exactly one resolves it at render
+    # time from the nav map.
+    assert template_content.count('tab-pane fade show active') == 0, (
+        'No pane should hardcode "show active"; it is derived from admin_landing_tab'
+    )
+    landing_conditionals = template_content.count("{% if admin_landing_tab == '")
+    assert landing_conditionals == len(tab_ids), (
+        f'Every one of the {len(tab_ids)} panes should derive its active state '
+        f'from admin_landing_tab, found {landing_conditionals}'
+    )
     assert 'Managesecuritysettingsforkeyvaultandothersecurityconfigurations.</p>' in normalized_template, 'Security intro paragraph should be properly closed'
 
+    # Every tab in the map must have a pane to activate.
+    panes = set(re.findall(r'<div class="tab-pane[^"]*" id="([^"]+)"', template_content))
+    missing = sorted(set(tab_ids) - panes)
+    assert not missing, f'Nav map lists tabs with no matching pane: {missing}'
+
     print('Admin settings tab structure is unique and well-formed')
     return True
 
diff --git a/functional_tests/test_admin_send_feedback_tab.py b/functional_tests/test_admin_send_feedback_tab.py
index fafbd6290..f034b1fee 100644
--- a/functional_tests/test_admin_send_feedback_tab.py
+++ b/functional_tests/test_admin_send_feedback_tab.py
@@ -15,6 +15,10 @@
 
 from bs4 import BeautifulSoup
 
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+from test_support.templates import resolve_template_includes
+
 
 CURRENT_DIR = os.path.dirname(os.path.abspath(__file__))
 REPO_ROOT = os.path.abspath(os.path.join(CURRENT_DIR, '..'))
@@ -29,7 +33,13 @@
 
 def read_text(path):
     with open(path, 'r', encoding='utf-8') as file_handle:
-        return file_handle.read()
+        content = file_handle.read()
+
+    # Admin Settings is composed from per-tab partials, so structural
+    # assertions have to see the fully composed markup.
+    if os.path.basename(str(path)) == 'admin_settings.html':
+        return resolve_template_includes(content, os.path.dirname(str(path)))
+    return content
 
 
 def test_send_feedback_template_structure():
@@ -40,8 +50,6 @@ def test_send_feedback_template_structure():
 
     required_markers = [
         'id="admin-settings-form" style="padding-bottom:80px;" novalidate autocomplete="off" data-lpignore="true" data-1p-ignore="true" data-bwignore="true"',
-        'id="send-feedback-tab"',
-        'data-bs-target="#send-feedback"',
         'id="send-feedback" role="tabpanel"',
         'id="send-feedback-overview-card"',
         'id="send-feedback-bug-card"',
@@ -97,7 +105,9 @@ def test_send_feedback_navigation_order():
 
     send_feedback_sidebar_index = sidebar_content.index('data-tab="send-feedback"')
     search_extract_sidebar_index = sidebar_content.index('data-tab="search-extract"')
-    assert send_feedback_sidebar_index > search_extract_sidebar_index, 'Send Feedback should be the last admin sidebar item'
+    latest_features_sidebar_index = sidebar_content.index('data-tab="latest-features"')
+    assert send_feedback_sidebar_index > search_extract_sidebar_index, 'Send Feedback should come after Search and Extract in the admin sidebar'
+    assert send_feedback_sidebar_index < latest_features_sidebar_index, 'Send Feedback should come before Latest Features, which is pinned last'
 
     assert 'data-section="latest-features-send-feedback-card"' in sidebar_content, 'Latest Features submenu should expose the Send Feedback callout'
 
diff --git a/functional_tests/test_admin_settings_dependencies.py b/functional_tests/test_admin_settings_dependencies.py
new file mode 100644
index 000000000..bab51de22
--- /dev/null
+++ b/functional_tests/test_admin_settings_dependencies.py
@@ -0,0 +1,182 @@
+#!/usr/bin/env python3
+# test_admin_settings_dependencies.py
+"""
+Functional test for Admin Settings dependency announcements.
+Version: 0.260.008
+Implemented in: 0.260.008
+
+Some Admin Settings options only work when a different option is enabled, and
+those two options often live in different tabs. That relationship used to be
+communicated only in prose, in a tooltip, or in a flash message after saving,
+so an admin could switch something on and have nothing happen with no visible
+reason.
+
+A dependent card now declares its prerequisite, and a shared module renders an
+inline notice containing a mirror of the prerequisite control plus a link to
+its card. This test pins the contract:
+
+  1. Every declared prerequisite control exists.
+  2. Every declared link target is a real card.
+  3. The mirror control cannot double-post the prerequisite's value.
+  4. Field-level dependencies declare a scope so unrelated controls in the same
+     card are not disabled.
+  5. The module is wired into the page and the backend stays authoritative.
+"""
+
+import re
+import sys
+from pathlib import Path
+
+from test_support.templates import (
+    ADMIN_SETTINGS_TEMPLATE,
+    read_admin_settings_template,
+)
+from test_support.versioning import assert_app_version_at_least
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+APP_ROOT = REPO_ROOT / "application" / "single_app"
+DEPENDENCIES_JS = APP_ROOT / "static" / "js" / "admin" / "admin_settings_dependencies.js"
+ADMIN_ROUTE = APP_ROOT / "route_frontend_admin_settings.py"
+
+CARD_RE = re.compile(r'<div[^>]*\bid="(?P<card>[^"]+)"[^>]*\bdata-requires="(?P<req>[^"]+)"[^>]*>')
+ATTR_RE = re.compile(r'(?P<name>data-requires-[\w-]+)="(?P<value>[^"]*)"')
+
+
+def _declared_dependencies(markup):
+    """Return every card that declares a prerequisite, with its attributes."""
+    found = []
+    for match in re.finditer(r"<div\b[^>]*data-requires=[^>]*>", markup):
+        tag = match.group(0)
+        card_id = re.search(r'\bid="([^"]+)"', tag)
+        prerequisite = re.search(r'\bdata-requires="([^"]+)"', tag)
+        if not card_id or not prerequisite:
+            continue
+        attrs = {m.group("name"): m.group("value") for m in ATTR_RE.finditer(tag)}
+        found.append(
+            {
+                "card": card_id.group(1),
+                "requires": prerequisite.group(1),
+                "attrs": attrs,
+            }
+        )
+    return found
+
+
+def test_declared_dependencies_resolve():
+    """A dependency pointing at a missing control or card is dead weight."""
+    print("Testing Admin Settings dependency declarations...")
+
+    assert_app_version_at_least("0.260.008")
+    composed = read_admin_settings_template()
+    element_ids = set(re.findall(r'\sid="([^"]+)"', composed))
+
+    dependencies = _declared_dependencies(composed)
+    assert dependencies, "Expected Admin Settings to declare dependencies"
+
+    problems = []
+    for dep in dependencies:
+        if dep["requires"] not in element_ids:
+            problems.append(
+                f"{dep['card']} requires missing control '{dep['requires']}'"
+            )
+
+        target = dep["attrs"].get("data-requires-target", "")
+        if target and target not in element_ids:
+            problems.append(f"{dep['card']} links to missing card '{target}'")
+
+        if not dep["attrs"].get("data-requires-label"):
+            problems.append(f"{dep['card']} has no data-requires-label")
+
+    assert not problems, "\n  ".join(["Dependency declaration problems:"] + problems)
+
+    print(f"All {len(dependencies)} dependency declaration(s) resolve.")
+
+
+def test_dependency_mirror_cannot_double_post():
+    """The inline mirror must never carry a name, or settings post twice."""
+    print("Testing Admin Settings dependency mirror safety...")
+
+    source = DEPENDENCIES_JS.read_text(encoding="utf-8")
+
+    # The proxy is built in JavaScript, so assert on how it is constructed.
+    assert "proxy.setAttribute('data-dependency-proxy-for'" in source, (
+        "Mirror control should record which input it proxies"
+    )
+    assert "proxy.name" not in source and 'proxy.setAttribute("name"' not in source, (
+        "Mirror control must not be given a name attribute, otherwise the "
+        "prerequisite would be submitted twice"
+    )
+    assert "data-ignore-settings-change" in source, (
+        "Mirror control should be excluded from unsaved-change tracking"
+    )
+
+    print("Mirror control is name-less and cannot double-post.")
+
+
+def test_field_level_dependencies_declare_scope():
+    """Blanket-disabling a mixed card would switch off unrelated settings."""
+    print("Testing Admin Settings dependency scoping...")
+
+    composed = read_admin_settings_template()
+
+    for dep in _declared_dependencies(composed):
+        mode = dep["attrs"].get("data-requires-mode", "block")
+        scope = dep["attrs"].get("data-requires-scope", "")
+
+        if dep["card"] != "permissions-section":
+            continue
+
+        # Permissions holds both the SafetyViolationAdmin and FeedbackAdmin
+        # toggles, and only the latter depends on User Feedback.
+        assert mode == "block", "Permissions dependency should gate its control"
+        assert scope == "#require_member_of_feedback_admin", (
+            "Permissions dependency must scope to the FeedbackAdmin toggle so "
+            f"the SafetyViolationAdmin toggle stays usable, got '{scope}'"
+        )
+
+    print("Field-level dependencies are correctly scoped.")
+
+
+def test_dependency_module_is_wired_and_advisory_only():
+    """Client-side gating is a courtesy; the backend must still enforce."""
+    print("Testing Admin Settings dependency wiring...")
+
+    assert DEPENDENCIES_JS.is_file(), f"Missing module at {DEPENDENCIES_JS}"
+
+    parent = ADMIN_SETTINGS_TEMPLATE.read_text(encoding="utf-8")
+    assert "js/admin/admin_settings_dependencies.js" in parent, (
+        "Dependency module is not loaded by admin_settings.html"
+    )
+
+    # File Sync remains save-then-reconcile, so the backend keeps warning.
+    route = ADMIN_ROUTE.read_text(encoding="utf-8")
+    assert "file_sync_settings['redis_ready']" in route, (
+        "Backend must still validate the File Sync Redis prerequisite; the "
+        "client-side notice is advisory only"
+    )
+
+    print("Dependency module is wired and the backend still enforces.")
+
+
+if __name__ == "__main__":
+    tests = [
+        test_declared_dependencies_resolve,
+        test_dependency_mirror_cannot_double_post,
+        test_field_level_dependencies_declare_scope,
+        test_dependency_module_is_wired_and_advisory_only,
+    ]
+
+    results = []
+    for test in tests:
+        try:
+            test()
+            results.append(True)
+        except Exception as exc:
+            print(f"FAILED {test.__name__}: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_admin_settings_field_contract.py b/functional_tests/test_admin_settings_field_contract.py
new file mode 100644
index 000000000..9f450f545
--- /dev/null
+++ b/functional_tests/test_admin_settings_field_contract.py
@@ -0,0 +1,169 @@
+#!/usr/bin/env python3
+# test_admin_settings_field_contract.py
+"""
+Functional test pinning the Admin Settings form field contract.
+Version: 0.260.009
+Implemented in: 0.260.009
+
+Admin Settings submits a single form, and the backend reads every value by
+field name. That makes the set of `name` attributes the real contract between
+the template and `route_frontend_admin_settings.py`. Moving a card between tabs
+does not change it; renaming or dropping a `name` silently stops a setting from
+saving, with no error anywhere.
+
+The information architecture rework moves most cards between tabs, so this test
+holds that contract still:
+
+  1. Every field name recorded in the baseline still exists.
+  2. No field name is duplicated except the known radio and checkbox groups,
+     which is what stops a mirrored control from submitting a value twice.
+
+New field names are allowed and reported, because adding settings is ordinary
+work. Removing or renaming one requires regenerating the baseline in the same
+commit:
+
+    python functional_tests/test_admin_settings_field_contract.py --update-baseline
+
+That makes losing a setting a visible, reviewed decision rather than an
+accident.
+"""
+
+import json
+import re
+import sys
+from collections import Counter
+from pathlib import Path
+
+from test_support.templates import read_admin_settings_template
+from test_support.versioning import assert_app_version_at_least
+
+
+BASELINE_PATH = (
+    Path(__file__).resolve().parent
+    / "test_support"
+    / "admin_settings_field_baseline.json"
+)
+
+FIELD_RE = re.compile(r'\sname="([^"]+)"')
+
+# Jinja-templated names cannot be compared literally.
+TEMPLATED = re.compile(r"\{\{|\{%")
+
+
+def collect_field_names(markup):
+    """Return a Counter of literal form field names in the composed template."""
+    return Counter(
+        name for name in FIELD_RE.findall(markup) if not TEMPLATED.search(name)
+    )
+
+
+def load_baseline():
+    """Read the committed field-name contract."""
+    assert BASELINE_PATH.is_file(), (
+        f"Missing baseline at {BASELINE_PATH}. Generate it with "
+        "--update-baseline."
+    )
+    return json.loads(BASELINE_PATH.read_text(encoding="utf-8"))
+
+
+def test_no_admin_settings_field_is_lost():
+    """A dropped or renamed field name silently stops a setting from saving."""
+    print("Testing Admin Settings field name contract...")
+
+    assert_app_version_at_least("0.260.009")
+    baseline = load_baseline()
+    current = collect_field_names(read_admin_settings_template())
+
+    required = set(baseline["field_names"])
+    present = set(current)
+
+    missing = sorted(required - present)
+    assert not missing, (
+        "These form fields disappeared from Admin Settings, so the settings "
+        "they carry can no longer be saved. If a removal is intended, "
+        "regenerate the baseline in the same commit with --update-baseline:\n  "
+        + "\n  ".join(missing)
+    )
+
+    added = sorted(present - required)
+    if added:
+        print(f"  {len(added)} new field(s) since the baseline: {added[:5]}")
+
+    print(f"All {len(required)} baseline field(s) still present.")
+
+
+def test_no_unexpected_duplicate_field_names():
+    """Two controls sharing a name submit the value twice."""
+    print("Testing Admin Settings duplicate field names...")
+
+    baseline = load_baseline()
+    current = collect_field_names(read_admin_settings_template())
+
+    allowed = baseline["allowed_duplicates"]
+    unexpected = {
+        name: count
+        for name, count in current.items()
+        if count > 1 and name not in allowed
+    }
+
+    assert not unexpected, (
+        "These field names appear more than once, so the form would submit "
+        "each of them multiple times. Mirrored controls must omit the name "
+        "attribute rather than repeat it:\n  "
+        + "\n  ".join(f"{name} x{count}" for name, count in sorted(unexpected.items()))
+    )
+
+    # A group that stops being a group is also a contract change worth noticing.
+    shrunk = sorted(
+        name for name, count in allowed.items() if current.get(name, 0) < count
+    )
+    if shrunk:
+        print(f"  note: known group(s) now smaller than baseline: {shrunk}")
+
+    print(f"No unexpected duplicates; {len(allowed)} known group(s) intact.")
+
+
+def update_baseline():
+    """Rewrite the baseline from the current template, deliberately."""
+    current = collect_field_names(read_admin_settings_template())
+    payload = {
+        "_comment": (
+            "Contract for Admin Settings form field names. Regenerate with "
+            "test_admin_settings_field_contract.py --update-baseline only when "
+            "a field is intentionally removed or renamed."
+        ),
+        "field_names": sorted(current),
+        "allowed_duplicates": {
+            name: count for name, count in sorted(current.items()) if count > 1
+        },
+    }
+    BASELINE_PATH.write_text(
+        json.dumps(payload, indent=2) + "\n", encoding="utf-8"
+    )
+    print(f"Baseline written: {len(payload['field_names'])} field(s), "
+          f"{len(payload['allowed_duplicates'])} known group(s)")
+
+
+if __name__ == "__main__":
+    if "--update-baseline" in sys.argv:
+        update_baseline()
+        sys.exit(0)
+
+    tests = [
+        test_no_admin_settings_field_is_lost,
+        test_no_unexpected_duplicate_field_names,
+    ]
+
+    results = []
+    for test in tests:
+        try:
+            test()
+            results.append(True)
+        except Exception as exc:
+            print(f"FAILED {test.__name__}: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_admin_settings_group_shared_regions.py b/functional_tests/test_admin_settings_group_shared_regions.py
new file mode 100644
index 000000000..00a50fd65
--- /dev/null
+++ b/functional_tests/test_admin_settings_group_shared_regions.py
@@ -0,0 +1,166 @@
+#!/usr/bin/env python3
+"""
+Functional test for Admin Settings group-shared control regions.
+Version: 0.260.016
+Implemented in: 0.260.016
+
+Some groups share one set of controls across all of their tabs. Backup &
+Recovery is the case that forced this: five tabs share a single save button,
+one status line and one operational warning, all driven by one JavaScript
+module.
+
+Those controls cannot be copied into each pane, because that repeats element
+ids and the module would bind to the wrong one. They cannot live in a single
+pane either, because an inactive tab pane is hidden, so the other four tabs
+would lose the save button. So they sit outside the panes and are revealed
+only while their group is active.
+
+This test ensures that arrangement holds.
+"""
+
+import os
+import re
+import sys
+import collections
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+from test_support.templates import read_admin_settings_template  # noqa: E402
+from test_support.nav import iter_tabs  # noqa: E402
+
+APP_ROOT = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "application",
+    "single_app",
+)
+SIDEBAR_JS = os.path.join(APP_ROOT, "static", "js", "admin", "admin_sidebar_nav.js")
+
+SHARED_REGION_PATTERN = re.compile(r'data-admin-group-shared="([a-z0-9-]+)"')
+
+
+def _read(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def test_shared_regions_name_a_real_group():
+    """A shared region must belong to a group that exists in the nav map."""
+    print("Testing group-shared regions reference real groups...")
+
+    markup = read_admin_settings_template()
+    owners = SHARED_REGION_PATTERN.findall(markup)
+    assert owners, "Expected at least one group-shared region"
+
+    known_groups = {group["id"] for group, _ in iter_tabs()}
+    unknown = sorted(set(owners) - known_groups)
+    assert not unknown, f"Shared regions reference groups that do not exist: {unknown}"
+
+    print(f"All {len(owners)} shared region(s) reference a real group.")
+    return True
+
+
+def test_shared_regions_sit_outside_every_pane():
+    """A shared region inside a pane would be hidden with that pane."""
+    print("Testing group-shared regions sit outside the tab panes...")
+
+    markup = read_admin_settings_template()
+    for match in SHARED_REGION_PATTERN.finditer(markup):
+        before = markup[: match.start()]
+        # Every pane opens with a tab-pane div and the tab content container
+        # comes after all shared regions, so a shared region declared after the
+        # container has been opened would be inside it.
+        assert 'id="adminSettingsTabContent"' not in before, (
+            f"Shared region '{match.group(1)}' is declared inside the tab content "
+            "container, where it would be hidden along with the active pane"
+        )
+
+    print("Shared regions are declared before the tab content container.")
+    return True
+
+
+def test_shared_controls_are_not_duplicated():
+    """The whole point is one control serving many tabs, not one per tab."""
+    print("Testing shared controls appear exactly once...")
+
+    markup = read_admin_settings_template()
+    ids = collections.Counter(re.findall(r'\sid="([A-Za-z0-9_-]+)"', markup))
+    duplicates = sorted(element_id for element_id, count in ids.items() if count > 1)
+    assert not duplicates, (
+        "Element ids declared more than once in the composed Admin Settings "
+        f"template: {duplicates}"
+    )
+
+    print(f"All {len(ids)} element ids in Admin Settings are unique.")
+    return True
+
+
+def test_shared_regions_are_synced_on_tab_change():
+    """A region that is never toggled would stay hidden forever."""
+    print("Testing shared regions are synced when the tab changes...")
+
+    source = _read(SIDEBAR_JS)
+    assert "function syncAdminGroupSharedRegions(" in source, (
+        "Expected a helper that reveals the shared region for the active group"
+    )
+    # Called from the programmatic path, the initial-load path, and Bootstrap's
+    # own tab event, so no route into a tab leaves the region stale.
+    call_count = source.count("syncAdminGroupSharedRegions(")
+    assert call_count >= 4, (
+        f"Expected the sync helper to be defined and called from every path "
+        f"that activates a tab, found {call_count} references"
+    )
+    assert "shown.bs.tab" in source, (
+        "Clicking a tab button directly does not go through showAdminTab, so "
+        "Bootstrap's shown.bs.tab event must also sync the shared regions"
+    )
+
+    print("Shared regions are synced from every path that activates a tab.")
+    return True
+
+
+def test_shared_region_lookup_handles_both_navigations():
+    """Only one navigation renders at a time, so both must resolve the group."""
+    print("Testing group lookup works in the tab and sidebar layouts...")
+
+    source = _read(SIDEBAR_JS)
+    match = re.search(r"function syncAdminGroupSharedRegions\(tabId\) \{.*?\n\}", source, re.S)
+    assert match, "Expected the shared region sync helper"
+    body = match.group(0)
+
+    # The top tab strip is skipped entirely in the sidebar layout, so a lookup
+    # that only reads `.admin-tab-item` would leave the region hidden for good
+    # and Backup & Recovery would lose its only save button.
+    assert ".admin-tab-item[data-admin-group]" in body, (
+        "Expected the tab layout lookup"
+    )
+    assert ".admin-nav-tab[data-tab=" in body, (
+        "Expected a sidebar layout fallback so the region resolves when the top "
+        "tab strip is not rendered"
+    )
+
+    print("Both navigation layouts can resolve the owning group.")
+    return True
+
+
+if __name__ == "__main__":
+    tests = [
+        test_shared_regions_name_a_real_group,
+        test_shared_regions_sit_outside_every_pane,
+        test_shared_controls_are_not_duplicated,
+        test_shared_regions_are_synced_on_tab_change,
+        test_shared_region_lookup_handles_both_navigations,
+    ]
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        try:
+            results.append(bool(test()))
+        except Exception as error:  # noqa: BLE001 - report and continue
+            print(f"Test failed: {error}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} tests passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_admin_settings_modal_placement.py b/functional_tests/test_admin_settings_modal_placement.py
new file mode 100644
index 000000000..483f0ec02
--- /dev/null
+++ b/functional_tests/test_admin_settings_modal_placement.py
@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""
+Functional test for Admin Settings modal placement across tab panes.
+Version: 0.260.014
+Implemented in: 0.260.014
+
+Admin Settings modals are interleaved between cards rather than collected at the
+end of the template, so splitting a tab pane can silently strand a modal in a
+pane that never opens it. A modal inside an inactive tab pane cannot be shown,
+because the pane itself is hidden, so the failure is invisible until a user
+clicks the button.
+
+This test ensures every modal lives in a pane that can actually open it.
+"""
+
+import os
+import re
+import sys
+import collections
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+PANES_DIR = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "application",
+    "single_app",
+    "templates",
+    "admin",
+    "_panes",
+)
+SHELL = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "application",
+    "single_app",
+    "templates",
+    "admin_settings.html",
+)
+
+MODAL_PATTERN = re.compile(r'class="modal fade[^"]*"\s+id="([^"]+)"')
+TRIGGER_PATTERN = re.compile(r'data-bs-target="#([^"]+)"')
+
+# The shell sits outside every pane, so a modal there is reachable from anywhere
+# and a trigger there is not owned by any one pane.
+SHELL_KEY = "__shell__"
+
+
+def _read(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def _collect():
+    """Map each modal id to its pane, and each modal id to the panes opening it."""
+    modal_home = {}
+    trigger_homes = collections.defaultdict(set)
+
+    sources = [(SHELL_KEY, SHELL)]
+    for name in sorted(os.listdir(PANES_DIR)):
+        if name.endswith(".html"):
+            sources.append((name[: -len(".html")], os.path.join(PANES_DIR, name)))
+
+    for pane, path in sources:
+        markup = _read(path)
+        for match in MODAL_PATTERN.finditer(markup):
+            modal_home[match.group(1)] = pane
+        for match in TRIGGER_PATTERN.finditer(markup):
+            trigger_homes[match.group(1)].add(pane)
+
+    return modal_home, trigger_homes
+
+
+def test_modals_live_where_they_are_opened():
+    """Every modal must sit in a pane that can open it, or in the shell."""
+    print("Testing Admin Settings modal placement...")
+
+    modal_home, trigger_homes = _collect()
+    assert modal_home, "No modals found; the collector is probably looking in the wrong place"
+
+    stranded = []
+    for modal_id, home in sorted(modal_home.items()):
+        if home == SHELL_KEY:
+            continue
+        openers = trigger_homes.get(modal_id)
+        if not openers:
+            # Opened from JavaScript rather than markup, which this test cannot
+            # attribute to a pane. Those are covered by the card link tests.
+            continue
+        foreign = {pane for pane in openers if pane not in (home, SHELL_KEY)}
+        if foreign and home not in openers:
+            stranded.append((modal_id, home, sorted(foreign)))
+
+    assert not stranded, "Modals stranded in a pane that never opens them:\n" + "\n".join(
+        f"  '{modal_id}' lives in '{home}' but is only opened from {openers}"
+        for modal_id, home, openers in stranded
+    )
+
+    print(f"All {len(modal_home)} modals sit in a pane that can open them.")
+    return True
+
+
+def test_modal_ids_are_unique():
+    """A duplicated modal id would make the wrong dialog open."""
+    print("Testing Admin Settings modal id uniqueness...")
+
+    counts = collections.Counter()
+    paths = [SHELL] + [
+        os.path.join(PANES_DIR, name)
+        for name in sorted(os.listdir(PANES_DIR))
+        if name.endswith(".html")
+    ]
+    for path in paths:
+        for match in MODAL_PATTERN.finditer(_read(path)):
+            counts[match.group(1)] += 1
+
+    duplicates = sorted(modal_id for modal_id, count in counts.items() if count > 1)
+    assert not duplicates, f"Modal ids declared more than once: {duplicates}"
+
+    print(f"All {len(counts)} modal ids are unique.")
+    return True
+
+
+if __name__ == "__main__":
+    tests = [
+        test_modals_live_where_they_are_opened,
+        test_modal_ids_are_unique,
+    ]
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        try:
+            results.append(bool(test()))
+        except Exception as error:  # noqa: BLE001 - report and continue
+            print(f"Test failed: {error}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} tests passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_admin_settings_nav_map.py b/functional_tests/test_admin_settings_nav_map.py
new file mode 100644
index 000000000..0754dddf9
--- /dev/null
+++ b/functional_tests/test_admin_settings_nav_map.py
@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+# test_admin_settings_nav_map.py
+"""
+Functional test for the Admin Settings navigation map.
+Version: 0.260.010
+Implemented in: 0.260.010
+
+The top tab strip and the sidebar used to declare the same navigation twice, by
+hand, and had already drifted: tab order differed between them, and three tabs
+carried different labels in each. Both now render from
+``admin_settings_nav.ADMIN_NAV``, which adds a group level above tabs.
+
+This test pins the map itself, since it is now the contract both renderings
+depend on:
+
+  1. Structure is well formed and free of duplicates.
+  2. Every tab has a matching pane, and every section a matching card.
+  3. Both navigations render from the map rather than listing tabs by hand.
+  4. Latest Features stays last so it never opens by default.
+"""
+
+import re
+import sys
+from pathlib import Path
+
+from test_support.nav import ADMIN_NAV, get_section_ids, get_tab_ids, iter_tabs
+from test_support.templates import (
+    ADMIN_SETTINGS_TEMPLATE,
+    read_admin_settings_template,
+)
+from test_support.versioning import assert_app_version_at_least
+
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+SIDEBAR_TEMPLATE = (
+    REPO_ROOT / "application" / "single_app" / "templates" / "_sidebar_nav.html"
+)
+
+
+def test_nav_map_is_well_formed():
+    """A malformed map would break both navigations at once."""
+    print("Testing Admin Settings nav map structure...")
+
+    assert_app_version_at_least("0.260.010")
+    assert ADMIN_NAV, "Navigation map is empty"
+
+    group_ids = [group["id"] for group in ADMIN_NAV]
+    assert len(group_ids) == len(set(group_ids)), (
+        f"Duplicate group ids: {sorted({g for g in group_ids if group_ids.count(g) > 1})}"
+    )
+
+    for group in ADMIN_NAV:
+        for key in ("id", "label", "icon", "tabs"):
+            assert key in group, f"Group {group.get('id')} is missing '{key}'"
+        assert group["tabs"], f"Group {group['id']} has no tabs"
+
+    tab_ids = get_tab_ids()
+    duplicate_tabs = sorted({t for t in tab_ids if tab_ids.count(t) > 1})
+    assert not duplicate_tabs, f"Tabs listed in more than one group: {duplicate_tabs}"
+
+    section_ids = get_section_ids()
+    duplicate_sections = sorted({s for s in section_ids if section_ids.count(s) > 1})
+    assert not duplicate_sections, (
+        f"Sections listed under more than one tab: {duplicate_sections}"
+    )
+
+    for _, tab in iter_tabs():
+        for key in ("id", "label", "icon", "sections"):
+            assert key in tab, f"Tab {tab.get('id')} is missing '{key}'"
+
+    print(
+        f"Map is well formed: {len(ADMIN_NAV)} groups, "
+        f"{len(tab_ids)} tabs, {len(section_ids)} sections."
+    )
+
+
+def test_every_nav_destination_exists():
+    """A destination with nothing behind it is a dead end for the admin."""
+    print("Testing Admin Settings nav destinations...")
+
+    composed = read_admin_settings_template()
+    panes = set(re.findall(r'<div class="tab-pane[^"]*" id="([^"]+)"', composed))
+    element_ids = set(re.findall(r'\sid="([^"]+)"', composed))
+
+    missing_panes = sorted(set(get_tab_ids()) - panes)
+    assert not missing_panes, f"Tabs with no matching pane: {missing_panes}"
+
+    # Sections may use an alias resolved by the sidebar script, so accept
+    # either the declared id or its resolved target.
+    script = (
+        REPO_ROOT
+        / "application"
+        / "single_app"
+        / "static"
+        / "js"
+        / "admin"
+        / "admin_sidebar_nav.js"
+    ).read_text(encoding="utf-8")
+    alias_body = re.search(
+        r"const sectionMap = \{(.*?)^\s*\};", script, re.MULTILINE | re.DOTALL
+    )
+    aliases = dict(re.findall(r"'([^']+)'\s*:\s*'([^']+)'", alias_body.group(1)))
+
+    missing_sections = sorted(
+        section_id
+        for section_id in get_section_ids()
+        if aliases.get(section_id, section_id) not in element_ids
+    )
+    assert not missing_sections, (
+        f"Sections pointing at elements that do not exist: {missing_sections}"
+    )
+
+    print("Every tab and section destination resolves.")
+
+
+def test_both_navigations_render_from_the_map():
+    """Two hand-maintained copies of one structure will drift, and did."""
+    print("Testing Admin Settings navigation rendering...")
+
+    parent = ADMIN_SETTINGS_TEMPLATE.read_text(encoding="utf-8")
+    sidebar = SIDEBAR_TEMPLATE.read_text(encoding="utf-8")
+
+    for name, source in (("top tab strip", parent), ("sidebar", sidebar)):
+        assert "admin_nav" in source, (
+            f"The {name} does not render from the navigation map"
+        )
+
+    # Hardcoded tab buttons would reintroduce the drift this replaced.
+    hardcoded = re.findall(r'id="([a-z-]+)-tab"\s+data-bs-toggle="tab"', parent)
+    assert not hardcoded, (
+        "These tabs are hardcoded in the top strip instead of coming from the "
+        f"navigation map: {sorted(set(hardcoded))}"
+    )
+
+    print("Both navigations render from the map.")
+
+
+def test_latest_features_stays_last():
+    """Latest Features opened on every visit; it is pinned last deliberately."""
+    print("Testing Latest Features placement in the nav map...")
+
+    tab_ids = get_tab_ids()
+    assert tab_ids[-1] == "latest-features", (
+        f"Latest Features must be the last tab, got '{tab_ids[-1]}'"
+    )
+    assert ADMIN_NAV[-1]["id"] == "help", (
+        "Latest Features should sit in the last group"
+    )
+
+    # The landing tab is whatever the map lists first, so it moves freely as the
+    # information architecture changes. What must never drift is that the admin
+    # does not land on Latest Features, which is the whole point of the move.
+    assert tab_ids[0] != "latest-features", (
+        "Latest Features must never be the landing tab"
+    )
+    assert ADMIN_NAV[0]["tabs"], "The first group must expose at least one tab"
+    assert tab_ids[0] == ADMIN_NAV[0]["tabs"][0]["id"], (
+        "The landing tab must be the first tab of the first group, so the "
+        "sidebar and the tab strip agree on where an admin lands"
+    )
+
+    print(f"Latest Features is last; '{tab_ids[0]}' leads.")
+
+
+if __name__ == "__main__":
+    tests = [
+        test_nav_map_is_well_formed,
+        test_every_nav_destination_exists,
+        test_both_navigations_render_from_the_map,
+        test_latest_features_stays_last,
+    ]
+
+    results = []
+    for test in tests:
+        try:
+            test()
+            results.append(True)
+        except Exception as exc:
+            print(f"FAILED {test.__name__}: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_admin_settings_sidebar_card_parity.py b/functional_tests/test_admin_settings_sidebar_card_parity.py
index d051c67cf..23abe81cb 100644
--- a/functional_tests/test_admin_settings_sidebar_card_parity.py
+++ b/functional_tests/test_admin_settings_sidebar_card_parity.py
@@ -15,6 +15,11 @@
 
 from bs4 import BeautifulSoup
 
+from test_support.templates import (
+    read_admin_settings_template,
+    resolve_template_includes,
+)
+from test_support.nav import get_section_ids, get_tab_ids, iter_tabs
 from test_support.versioning import assert_app_version_at_least
 
 
@@ -87,26 +92,29 @@ def _card_title(card):
 
 
 def _navigation_contract():
-    """Parse the admin template, sidebar template, and section alias map."""
-    admin_source = _read(ADMIN_TEMPLATE)
+    """Read the admin template and the navigation map.
+
+    Navigation structure now comes from ``admin_settings_nav.ADMIN_NAV`` rather
+    than from literal sidebar markup, because both the sidebar and the top tab
+    strip render from that one definition. Asserting against the map checks the
+    contract itself instead of one of its two renderings.
+    """
+    admin_source = resolve_template_includes(
+        _read(ADMIN_TEMPLATE), ADMIN_TEMPLATE.parent
+    )
     sidebar_source = _read(SIDEBAR_TEMPLATE)
     script_source = _read(SIDEBAR_SCRIPT)
     admin_soup = BeautifulSoup(admin_source, "html.parser")
     sidebar_soup = BeautifulSoup(sidebar_source, "html.parser")
     section_map = _parse_section_map(script_source)
 
-    tab_targets = {
-        link["data-tab"]
-        for link in sidebar_soup.select(".admin-nav-tab[data-tab]")
-    }
+    tab_targets = set(get_tab_ids())
     section_targets = defaultdict(list)
-    for link in sidebar_soup.select(
-        ".admin-nav-section[data-tab][data-section]"
-    ):
-        raw_target = link["data-section"]
-        section_targets[link["data-tab"]].append(
-            section_map.get(raw_target, raw_target)
-        )
+    for _, tab in iter_tabs():
+        for section in tab["sections"]:
+            section_targets[tab["id"]].append(
+                section_map.get(section["id"], section["id"])
+            )
 
     return {
         "admin_source": admin_source,
@@ -194,11 +202,58 @@ def test_every_static_sidebar_section_target_resolves():
     assert not errors, "\n".join(errors)
 
 
+def test_sidebar_section_map_contains_only_real_aliases():
+    """Keep the sidebar sectionMap free of dead and redundant entries.
+
+    scrollToSection resolves a target with `sectionMap[sectionId] || sectionId`,
+    so an entry that maps a key to itself is a no-op that still has to be
+    maintained. The map had grown to 72 entries, 66 of them no-ops, and one
+    pointing at an element that does not exist anywhere in the template.
+    """
+    print("Testing admin sidebar sectionMap hygiene...")
+
+    script = SIDEBAR_SCRIPT.read_text(encoding="utf-8")
+    composed = read_admin_settings_template()
+
+    section_map = _parse_section_map(script)
+    template_ids = set(re.findall(r'\sid="([^"]+)"', composed))
+    linked_sections = set(get_section_ids())
+
+    identity = sorted(key for key, value in section_map.items() if key == value)
+    assert not identity, (
+        "sectionMap entries that map a key to itself are redundant because "
+        f"scrollToSection already falls back to the raw id: {identity}"
+    )
+
+    dangling = sorted(
+        f"{key} -> {value}"
+        for key, value in section_map.items()
+        if value not in template_ids
+    )
+    assert not dangling, (
+        f"sectionMap targets resolve to elements that do not exist: {dangling}"
+    )
+
+    unreferenced = sorted(
+        key for key in section_map if key not in linked_sections
+    )
+    assert not unreferenced, (
+        "sectionMap aliases that no sidebar link uses should be removed: "
+        f"{unreferenced}"
+    )
+
+    print(f"sectionMap holds {len(section_map)} real alias(es), all resolving.")
+
+
 def test_conditional_agent_template_destination_matches_card():
-    """Keep the optional Agent Template Approvals card and link in sync."""
+    """Keep the optional Agent Template Approvals card and link in sync.
+
+    The card is rendered only when the agent template gallery is enabled, so
+    its navigation entry has to carry the same condition. Otherwise the sidebar
+    offers a destination that does not exist on the page.
+    """
     contract = _navigation_contract()
     card_marker = 'id="agent-template-approvals-section"'
-    link_marker = 'data-section="agent-template-approvals-section"'
 
     card_condition = contract["admin_source"].index(
         "{% if settings.enable_agent_template_gallery %}"
@@ -207,12 +262,18 @@ def test_conditional_agent_template_destination_matches_card():
     card_end = contract["admin_source"].index("{% endif %}", card_position)
     assert card_condition < card_position < card_end
 
-    link_condition = contract["sidebar_source"].index(
-        "{% if app_settings.enable_agent_template_gallery %}"
+    conditioned = {
+        section["id"]: section.get("condition")
+        for _, tab in iter_tabs()
+        for section in tab["sections"]
+    }
+    assert conditioned.get("agent-template-approvals-section") == (
+        "enable_agent_template_gallery"
+    ), (
+        "The Agent Template Approvals nav entry must declare the same "
+        "condition as its card, otherwise the sidebar links to a destination "
+        "that is not rendered."
     )
-    link_position = contract["sidebar_source"].index(link_marker)
-    link_end = contract["sidebar_source"].index("{% endif %}", link_position)
-    assert link_condition < link_position < link_end
 
 
 def test_sidebar_search_no_results_uses_safe_text_rendering():
diff --git a/functional_tests/test_admin_settings_template_composition.py b/functional_tests/test_admin_settings_template_composition.py
new file mode 100644
index 000000000..1e71cea5a
--- /dev/null
+++ b/functional_tests/test_admin_settings_template_composition.py
@@ -0,0 +1,208 @@
+#!/usr/bin/env python3
+# test_admin_settings_template_composition.py
+"""
+Functional test for the Admin Settings composed-template contract.
+Version: 0.260.005
+Implemented in: 0.260.004
+
+Admin Settings is assembled from per-tab partials under templates/admin/, so
+reading admin_settings.html straight from disk only yields the parent shell.
+This test pins that contract:
+
+  1. The parent template delegates its tab panes to partials.
+  2. Every partial is reachable from the parent.
+  3. The composed template still exposes every configuration card.
+  4. No functional test reads admin_settings.html without composing it first,
+     which would silently assert against markup that is no longer there.
+"""
+
+import re
+import sys
+from pathlib import Path
+
+from test_support.templates import (
+    ADMIN_SETTINGS_TEMPLATE,
+    TEMPLATE_DIR,
+    read_admin_settings_template,
+)
+from test_support.versioning import assert_app_version_at_least
+
+
+TESTS_DIR = Path(__file__).resolve().parent
+PARTIAL_DIR = TEMPLATE_DIR / "admin"
+
+# Tests that legitimately reference the template path without reading markup,
+# or that already compose it through the shared helpers.
+COMPOSITION_HELPERS = (
+    "read_admin_settings_template",
+    "compose_if_admin_settings",
+    "resolve_template_includes",
+    "read_composed_template",
+)
+
+
+def test_every_pane_partial_is_balanced():
+    """An unbalanced pane silently nests the panes that follow it.
+
+    A stray or missing closing tag does not fail to render. It changes the
+    document tree, so later panes end up inside the broken one and are hidden
+    with it, which only shows up as a confusing failure somewhere unrelated.
+    """
+    print("Testing Admin Settings pane partials are balanced...")
+
+    panes_dir = PARTIAL_DIR / "_panes"
+    unbalanced = []
+    for path in sorted(panes_dir.glob("*.html")):
+        markup = path.read_text(encoding="utf-8")
+        for tag in ("div", "section"):
+            opened = len(re.findall(rf"<{tag}\b", markup))
+            closed = len(re.findall(rf"</{tag}>", markup))
+            if opened != closed:
+                unbalanced.append(f"{path.name}: {opened} <{tag}> vs {closed} </{tag}>")
+
+    assert not unbalanced, "Unbalanced tab pane partials:\n  " + "\n  ".join(unbalanced)
+
+    print(f"All {len(list(panes_dir.glob('*.html')))} pane partials are balanced.")
+    return True
+
+
+def test_parent_template_delegates_panes_to_partials():
+    """The parent template should include partials rather than inline panes."""
+    print("Testing Admin Settings partial delegation...")
+
+    assert_app_version_at_least("0.260.004")
+    parent = ADMIN_SETTINGS_TEMPLATE.read_text(encoding="utf-8")
+
+    includes = re.findall(r'\{%\s*include\s+"(admin/[^"]+)"\s*%\}', parent)
+    assert includes, "Parent template should include Admin Settings partials"
+
+    missing = [
+        target for target in includes if not (TEMPLATE_DIR / target).is_file()
+    ]
+    assert not missing, f"Parent includes missing partials: {missing}"
+
+    print(f"Parent delegates to {len(includes)} partial(s).")
+
+
+def test_every_partial_is_reachable_from_the_parent():
+    """Orphaned partials would silently drop settings from the page."""
+    print("Testing Admin Settings partial reachability...")
+
+    parent = ADMIN_SETTINGS_TEMPLATE.read_text(encoding="utf-8")
+    composed = read_admin_settings_template()
+
+    referenced = set()
+    for target in re.findall(r'\{%\s*include\s+"(admin/[^"]+)"\s*%\}', parent):
+        referenced.add((TEMPLATE_DIR / target).resolve())
+    for target in re.findall(r'\{%\s*include\s+"(admin/[^"]+)"\s*%\}', composed):
+        referenced.add((TEMPLATE_DIR / target).resolve())
+
+    on_disk = {path.resolve() for path in PARTIAL_DIR.rglob("*.html")}
+    orphans = sorted(path.name for path in on_disk - referenced)
+
+    assert not orphans, f"Partials are never included: {orphans}"
+    print(f"All {len(on_disk)} partial(s) are reachable.")
+
+
+def test_composed_template_exposes_configuration_cards():
+    """Composition must restore the cards that live inside the partials."""
+    print("Testing composed Admin Settings card visibility...")
+
+    parent = ADMIN_SETTINGS_TEMPLATE.read_text(encoding="utf-8")
+    composed = read_admin_settings_template()
+
+    card_pattern = re.compile(r'<div class="card[^"]*"[^>]*\sid="([^"]+)"')
+    parent_cards = set(card_pattern.findall(parent))
+    composed_cards = set(card_pattern.findall(composed))
+
+    assert len(composed_cards) > len(parent_cards), (
+        "Composing the template should reveal cards held in partials "
+        f"(parent={len(parent_cards)}, composed={len(composed_cards)})"
+    )
+
+    # Spot-check cards that are known to live in partials.
+    for card_id in ("keyvault-section", "branding-section", "content-safety-section"):
+        assert card_id in composed_cards, (
+            f"Composed template is missing '{card_id}'"
+        )
+
+    print(f"Composed template exposes {len(composed_cards)} card(s).")
+
+
+def test_no_functional_test_reads_the_template_uncomposed():
+    """Guard the convention so new tests do not assert on the parent shell.
+
+    Only tests that actually reference a card or form field living exclusively
+    inside a partial are flagged. Tests that assert on markup still held by the
+    parent (the nav, the form tag, the modals) are reading what they expect.
+    """
+    print("Testing Admin Settings read convention across functional tests...")
+
+    parent = ADMIN_SETTINGS_TEMPLATE.read_text(encoding="utf-8")
+    composed = read_admin_settings_template()
+
+    card_pattern = re.compile(r'<div class="card[^"]*"[^>]*\sid="([^"]+)"')
+    field_pattern = re.compile(r'\sname="([^"]+)"')
+
+    parent_cards = set(card_pattern.findall(parent))
+    partial_only_cards = set(card_pattern.findall(composed)) - parent_cards
+    assert partial_only_cards, "Expected some cards to live only in partials"
+
+    parent_fields = set(field_pattern.findall(parent))
+    partial_only_fields = set(field_pattern.findall(composed)) - parent_fields
+    assert partial_only_fields, "Expected some fields to live only in partials"
+
+    offenders = []
+    for path in sorted(TESTS_DIR.glob("test_*.py")):
+        if path.name == Path(__file__).name:
+            continue
+
+        source = path.read_text(encoding="utf-8")
+        if "admin_settings.html" not in source:
+            continue
+        if any(helper in source for helper in COMPOSITION_HELPERS):
+            continue
+
+        referenced = sorted(
+            card_id for card_id in partial_only_cards if card_id in source
+        )
+        referenced += sorted(
+            f'name="{field}"'
+            for field in partial_only_fields
+            if f'name="{field}"' in source
+        )
+        if referenced:
+            offenders.append(f"{path.name} -> {', '.join(referenced[:3])}")
+
+    assert not offenders, (
+        "These tests reference cards that live inside Admin Settings partials "
+        "but read admin_settings.html without composing it, so they assert "
+        "against an incomplete template. Use "
+        "test_support.templates.read_admin_settings_template() or "
+        "compose_if_admin_settings():\n  " + "\n  ".join(offenders)
+    )
+
+    print("All functional tests compose the template before asserting.")
+
+
+if __name__ == "__main__":
+    tests = [
+        test_parent_template_delegates_panes_to_partials,
+        test_every_partial_is_reachable_from_the_parent,
+        test_composed_template_exposes_configuration_cards,
+        test_no_functional_test_reads_the_template_uncomposed,
+    ]
+
+    results = []
+    for test in tests:
+        try:
+            test()
+            results.append(True)
+        except Exception as exc:
+            print(f"FAILED {test.__name__}: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_admin_settings_walkthrough_targets.py b/functional_tests/test_admin_settings_walkthrough_targets.py
new file mode 100644
index 000000000..8d0a4015c
--- /dev/null
+++ b/functional_tests/test_admin_settings_walkthrough_targets.py
@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+"""
+Functional test for the Admin Settings setup walkthrough targets.
+Version: 0.260.018
+Implemented in: 0.260.018
+
+The setup walkthrough used to name a tab id for each step. That recorded the
+same knowledge twice: the step already knew which setting it was about, and the
+tab id was a second copy that went stale the moment a setting moved. After the
+information architecture rework, eleven of its twelve steps pointed at tabs that
+no longer existed, and the walkthrough would have silently gone nowhere.
+
+Steps now name the card they are about and the owning tab is resolved from the
+page. This test ensures every step still points at a card that exists.
+"""
+
+import os
+import re
+import sys
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+from test_support.templates import read_admin_settings_template  # noqa: E402
+
+APP_ROOT = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "application",
+    "single_app",
+)
+ADMIN_JS = os.path.join(APP_ROOT, "static", "js", "admin", "admin_settings.js")
+
+CARD_PATTERN = re.compile(r"^\s*(\d+):\s*\{\s*card:\s*'([^']+)'(?:,\s*focus:\s*'([^']+)')?", re.M)
+
+
+def _read(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def _walkthrough_targets():
+    source = _read(ADMIN_JS)
+    start = source.index("const stepToCard = {")
+    end = source.index("};", start)
+    return CARD_PATTERN.findall(source[start:end])
+
+
+def test_walkthrough_targets_exist():
+    """A step pointing at a missing card sends the walkthrough nowhere."""
+    print("Testing setup walkthrough targets exist...")
+
+    markup = read_admin_settings_template()
+    targets = _walkthrough_targets()
+    assert targets, "Expected the walkthrough step map to be readable"
+
+    missing = []
+    for step, card, focus in targets:
+        if f'id="{card}"' not in markup:
+            missing.append(f"step {step}: card '{card}'")
+        if focus and f'id="{focus}"' not in markup:
+            missing.append(f"step {step}: focus '{focus}'")
+
+    assert not missing, "Walkthrough steps point at elements that do not exist:\n  " + "\n  ".join(missing)
+
+    print(f"All {len(targets)} walkthrough steps point at elements that exist.")
+    return True
+
+
+def test_walkthrough_does_not_hardcode_tab_ids():
+    """Naming a tab id duplicates knowledge that then goes stale."""
+    print("Testing the walkthrough resolves tabs from the page...")
+
+    source = _read(ADMIN_JS)
+    assert "const stepToTab" not in source, (
+        "The walkthrough should not map steps to tab ids. Name the card the "
+        "step is about and let openAdminCard find the owning tab, so the map "
+        "cannot go stale when a setting moves between tabs."
+    )
+    assert "window.openAdminCard" in source, (
+        "The walkthrough should navigate through openAdminCard, which resolves "
+        "the owning tab from the page"
+    )
+
+    print("The walkthrough resolves tabs from the page.")
+    return True
+
+
+def test_every_walkthrough_step_is_mapped():
+    """A gap in the map silently skips navigation for that step."""
+    print("Testing walkthrough step numbering is contiguous...")
+
+    steps = sorted(int(step) for step, _, _ in _walkthrough_targets())
+    assert steps, "Expected walkthrough steps"
+    expected = list(range(1, len(steps) + 1))
+    assert steps == expected, (
+        f"Walkthrough steps should be numbered 1..{len(steps)} without gaps, got {steps}"
+    )
+
+    print(f"Steps 1..{len(steps)} are all mapped.")
+    return True
+
+
+if __name__ == "__main__":
+    tests = [
+        test_walkthrough_targets_exist,
+        test_walkthrough_does_not_hardcode_tab_ids,
+        test_every_walkthrough_step_is_mapped,
+    ]
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        try:
+            results.append(bool(test()))
+        except Exception as error:  # noqa: BLE001 - report and continue
+            print(f"Test failed: {error}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} tests passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_admin_source_review_depth_save.py b/functional_tests/test_admin_source_review_depth_save.py
index d7e74b15c..528bf0c0e 100644
--- a/functional_tests/test_admin_source_review_depth_save.py
+++ b/functional_tests/test_admin_source_review_depth_save.py
@@ -12,6 +12,7 @@
 
 import os
 import sys
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -27,7 +28,7 @@
 def read_admin_template():
     """Read the Admin Settings template for static regression checks."""
     with open(ADMIN_TEMPLATE, "r", encoding="utf-8") as template_file:
-        return template_file.read()
+        return compose_if_admin_settings(ADMIN_TEMPLATE, template_file.read())
 
 
 def test_source_review_depth_has_single_form_field():
@@ -40,9 +41,11 @@ def test_source_review_depth_has_single_form_field():
         f"Expected exactly one source_review_max_depth form field, found {depth_field_name_count}."
     )
 
+    # Bound the Latest Features visibility block by its own container rather
+    # than by a neighbouring card, so the check survives cards moving between
+    # tabs during information architecture work.
     latest_features_start = template_content.index('id="support_latest_features_settings"')
-    external_links_start = template_content.index('id="external-links-section"')
-    latest_features_section = template_content[latest_features_start:external_links_start]
+    latest_features_section = template_content[latest_features_start:latest_features_start + 8000]
 
     assert 'name="source_review_max_depth"' not in latest_features_section, (
         "Latest Features visibility controls must not post source_review_max_depth."
diff --git a/functional_tests/test_agents_catalog_feature.py b/functional_tests/test_agents_catalog_feature.py
index dc7282e9c..9c313714a 100644
--- a/functional_tests/test_agents_catalog_feature.py
+++ b/functional_tests/test_agents_catalog_feature.py
@@ -13,6 +13,7 @@
 from pathlib import Path
 import sys
 from types import ModuleType, SimpleNamespace
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -21,7 +22,10 @@
 
 
 def read_repo_file(relative_path):
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def assert_contains(text, expected, label):
diff --git a/functional_tests/test_ai_models_tab_embedding_image_location.py b/functional_tests/test_ai_models_tab_embedding_image_location.py
index 21f60c9e0..e111b1c3d 100644
--- a/functional_tests/test_ai_models_tab_embedding_image_location.py
+++ b/functional_tests/test_ai_models_tab_embedding_image_location.py
@@ -2,19 +2,34 @@
 #!/usr/bin/env python3
 """
 Functional test for AI Models tab placement of embeddings and image generation sections.
-Version: 0.236.014
+Version: 0.260.015
 Implemented in: 0.236.014
 
-This test ensures embeddings and image generation settings remain on the AI Models tab
-and are not nested inside the legacy model modal.
+This test ensures embeddings and image generation settings stay in the AI Models
+group and are not nested inside the legacy model modal.
 """
 
 import os
+import re
+from test_support.templates import compose_if_admin_settings
 
 
 def read_file_text(file_path):
-    with open(file_path, 'r', encoding='utf-8') as file:
-        return file.read()
+    with open(file_path, "r", encoding="utf-8") as file:
+        return compose_if_admin_settings(file_path, file.read())
+
+
+def _modal_span(content, modal_marker):
+    """Return the (start, end) character span of a modal by balancing its divs."""
+    start = content.index(modal_marker)
+    # Back up to the opening tag of the element carrying the id.
+    start = content.rindex("<div", 0, start)
+    depth = 0
+    for match in re.finditer(r"<div\b|</div>", content[start:]):
+        depth += 1 if match.group(0) == "<div" else -1
+        if depth == 0:
+            return start, start + match.end()
+    raise AssertionError(f"Unbalanced markup for {modal_marker}")
 
 
 def test_ai_models_tab_embedding_image_location():
@@ -32,14 +47,17 @@ def test_ai_models_tab_embedding_image_location():
     assert image_marker in content, "Image generation configuration section is missing."
     assert legacy_modal_marker in content, "Legacy model modal is missing."
 
-    embeddings_index = content.index(embeddings_marker)
-    image_index = content.index(image_marker)
-    legacy_modal_index = content.index(legacy_modal_marker)
-
-    assert embeddings_index < legacy_modal_index, "Embeddings section should be outside legacy modal."
-    assert image_index < legacy_modal_index, "Image generation section should be outside legacy modal."
+    # These cards now live in their own tab panes, so plain document order no
+    # longer says anything useful. What matters is that neither card sits
+    # *inside* the legacy modal, where it would only be reachable through it.
+    modal_start, modal_end = _modal_span(content, legacy_modal_marker)
+    for name, marker in (("Embeddings", embeddings_marker), ("Image generation", image_marker)):
+        index = content.index(marker)
+        assert not (modal_start < index < modal_end), (
+            f"{name} section should be outside the legacy model modal."
+        )
 
-    print("✅ Embeddings and image generation sections are on the AI Models tab.")
+    print("Embeddings and image generation sections are outside the legacy model modal.")
 
 
 if __name__ == "__main__":
diff --git a/functional_tests/test_audio_ffmpeg_fallback.py b/functional_tests/test_audio_ffmpeg_fallback.py
index 400e0b795..b27dbb692 100644
--- a/functional_tests/test_audio_ffmpeg_fallback.py
+++ b/functional_tests/test_audio_ffmpeg_fallback.py
@@ -17,6 +17,7 @@
 import shutil
 import subprocess
 import sys
+from test_support.templates import compose_if_admin_settings
 
 
 ROOT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -31,8 +32,8 @@
 
 
 def read_file(path):
-    with open(path, 'r', encoding='utf-8') as file_handle:
-        return file_handle.read()
+    with open(path, "r", encoding="utf-8") as file_handle:
+        return compose_if_admin_settings(path, file_handle.read())
 
 
 def parse_functions_documents():
diff --git a/functional_tests/test_azure_openai_identity_split.py b/functional_tests/test_azure_openai_identity_split.py
index 380a3a966..e182fd30c 100644
--- a/functional_tests/test_azure_openai_identity_split.py
+++ b/functional_tests/test_azure_openai_identity_split.py
@@ -13,6 +13,7 @@
 from pathlib import Path
 import re
 import sys
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -20,7 +21,10 @@
 
 def read_workspace_file(relative_path):
     """Read a workspace file as UTF-8 text."""
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def test_backend_and_admin_guidance_identity_split():
diff --git a/functional_tests/test_chat_completion_audio_cues.py b/functional_tests/test_chat_completion_audio_cues.py
index 966c4d562..9daea0dfa 100644
--- a/functional_tests/test_chat_completion_audio_cues.py
+++ b/functional_tests/test_chat_completion_audio_cues.py
@@ -15,6 +15,7 @@
 import sys
 import wave
 from pathlib import Path
+from test_support.templates import compose_if_admin_settings
 
 
 ROOT_DIR = Path(__file__).resolve().parents[1]
@@ -49,7 +50,9 @@
 
 def read_text(path):
     """Read a UTF-8 source file."""
-    return path.read_text(encoding="utf-8")
+    return compose_if_admin_settings(
+        path, path.read_text(encoding="utf-8")
+    )
 
 
 def test_local_audio_assets():
diff --git a/functional_tests/test_chat_file_upload_access_control.py b/functional_tests/test_chat_file_upload_access_control.py
index 06f3139e4..0da714ea6 100644
--- a/functional_tests/test_chat_file_upload_access_control.py
+++ b/functional_tests/test_chat_file_upload_access_control.py
@@ -15,6 +15,7 @@
 import re
 import sys
 import traceback
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -51,7 +52,7 @@
 def read_file(path):
     """Read a UTF-8 text file from the repo."""
     with open(path, "r", encoding="utf-8") as file_handle:
-        return file_handle.read()
+        return compose_if_admin_settings(path, file_handle.read())
 
 
 def read_version():
diff --git a/functional_tests/test_content_safety_violation_message.py b/functional_tests/test_content_safety_violation_message.py
index d16ba8165..46ed92922 100644
--- a/functional_tests/test_content_safety_violation_message.py
+++ b/functional_tests/test_content_safety_violation_message.py
@@ -23,6 +23,8 @@
 ADMIN_SETTINGS_TEMPLATE_PATH = Path(APPLICATION_PATH) / 'templates' / 'admin_settings.html'
 sys.path.insert(0, APPLICATION_PATH)
 
+from test_support.templates import read_admin_settings_template
+
 from functions_content_safety import (
     CONTENT_SAFETY_VIOLATION_MESSAGE_DEFAULT,
     CONTENT_SAFETY_VIOLATION_MESSAGE_MAX_LENGTH,
@@ -59,7 +61,7 @@ def test_message_normalization_preserves_safe_admin_defaults():
 
 def test_admin_settings_uses_the_markdown_editor_toolbar():
     """The Content Safety message field uses the standard local Markdown toolbar."""
-    admin_settings_template = ADMIN_SETTINGS_TEMPLATE_PATH.read_text(encoding='utf-8')
+    admin_settings_template = read_admin_settings_template()
 
     assert '<script src="/static/js/simplemde/simplemde.min.js"></script>' in admin_settings_template
     assert 'id="content_safety_violation_message"' in admin_settings_template
diff --git a/functional_tests/test_content_understanding_extraction_engine.py b/functional_tests/test_content_understanding_extraction_engine.py
index 28246e0a4..3b6b5c706 100644
--- a/functional_tests/test_content_understanding_extraction_engine.py
+++ b/functional_tests/test_content_understanding_extraction_engine.py
@@ -22,6 +22,7 @@
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 
 from test_support.versioning import assert_app_version_at_least  # noqa: E402
+from test_support.templates import compose_if_admin_settings
 
 
 def load_content_understanding_module(azure_environment="public"):
@@ -305,7 +306,10 @@ def test_government_cloud_blocks_content_understanding():
 
 def read_repo_file(relative_path):
     """Read a repository file as UTF-8 text."""
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def assert_contains(content, expected_text, description):
diff --git a/functional_tests/test_control_center_auto_refresh_schedule.py b/functional_tests/test_control_center_auto_refresh_schedule.py
index bbe47b5d3..c4497c601 100644
--- a/functional_tests/test_control_center_auto_refresh_schedule.py
+++ b/functional_tests/test_control_center_auto_refresh_schedule.py
@@ -17,6 +17,8 @@
 from datetime import datetime, timezone
 from pathlib import Path
 
+from test_support.templates import read_admin_settings_template
+
 
 ROOT_DIR = Path(__file__).resolve().parents[1]
 APP_DIR = ROOT_DIR / "application" / "single_app"
@@ -165,7 +167,7 @@ def test_integration_wiring():
     background_source = BACKGROUND_TASKS_FILE.read_text(encoding="utf-8")
     admin_route_source = ADMIN_SETTINGS_ROUTE_FILE.read_text(encoding="utf-8")
     control_center_route_source = CONTROL_CENTER_ROUTE_FILE.read_text(encoding="utf-8")
-    template_source = ADMIN_TEMPLATE_FILE.read_text(encoding="utf-8")
+    template_source = read_admin_settings_template()
     javascript_source = CONTROL_CENTER_JS_FILE.read_text(encoding="utf-8")
 
     expected_settings = [
diff --git a/functional_tests/test_conversation_contents_drawer_settings.py b/functional_tests/test_conversation_contents_drawer_settings.py
index 200b00b80..70be7c0f9 100644
--- a/functional_tests/test_conversation_contents_drawer_settings.py
+++ b/functional_tests/test_conversation_contents_drawer_settings.py
@@ -13,6 +13,7 @@
 from pathlib import Path
 
 from flask import Flask, jsonify, request
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -27,7 +28,10 @@
 
 
 def _read(relative_path):
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def test_admin_setting_defaults_on_and_persists():
diff --git a/functional_tests/test_cosmos_wave4a1_admin_document_access_ui.py b/functional_tests/test_cosmos_wave4a1_admin_document_access_ui.py
index 588107e6d..fb8a5e6ae 100644
--- a/functional_tests/test_cosmos_wave4a1_admin_document_access_ui.py
+++ b/functional_tests/test_cosmos_wave4a1_admin_document_access_ui.py
@@ -20,6 +20,7 @@
 import os
 import sys
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 ROOT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -27,8 +28,9 @@
 
 
 def _read(relative_path):
-    with open(os.path.join(ROOT_DIR, relative_path), "r", encoding="utf-8") as file:
-        return file.read()
+    _path = os.path.join(ROOT_DIR, relative_path)
+    with open(_path, "r", encoding="utf-8") as file:
+        return compose_if_admin_settings(_path, file.read())
 
 
 def test_admin_template_exposes_safe_document_access_controls():
diff --git a/functional_tests/test_cosmos_wave4b_document_access_shadow_validation.py b/functional_tests/test_cosmos_wave4b_document_access_shadow_validation.py
index 817d17dbe..303cbae35 100644
--- a/functional_tests/test_cosmos_wave4b_document_access_shadow_validation.py
+++ b/functional_tests/test_cosmos_wave4b_document_access_shadow_validation.py
@@ -28,6 +28,7 @@
 from contextlib import contextmanager
 from datetime import datetime, timezone
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import read_admin_settings_template
 
 
 ROOT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -673,11 +674,7 @@ def test_wave4b_admin_routes_and_version_are_wired():
         "r",
         encoding="utf-8",
     ).read()
-    admin_template = open(
-        os.path.join(SINGLE_APP_DIR, "templates", "admin_settings.html"),
-        "r",
-        encoding="utf-8",
-    ).read()
+    admin_template = read_admin_settings_template()
     personal_route = open(os.path.join(SINGLE_APP_DIR, "route_backend_documents.py"), "r", encoding="utf-8").read()
     group_route = open(os.path.join(SINGLE_APP_DIR, "route_backend_group_documents.py"), "r", encoding="utf-8").read()
     public_route = open(os.path.join(SINGLE_APP_DIR, "route_external_public_documents.py"), "r", encoding="utf-8").read()
diff --git a/functional_tests/test_cosmos_wave5a_document_access_read_switch.py b/functional_tests/test_cosmos_wave5a_document_access_read_switch.py
index badcfafcc..a0eb1acd0 100644
--- a/functional_tests/test_cosmos_wave5a_document_access_read_switch.py
+++ b/functional_tests/test_cosmos_wave5a_document_access_read_switch.py
@@ -24,6 +24,7 @@
 import types
 from contextlib import contextmanager
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import read_admin_settings_template
 
 
 ROOT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -799,11 +800,7 @@ def test_wave5b_route_and_admin_contract_are_wired():
         "r",
         encoding="utf-8",
     ).read()
-    admin_template = open(
-        os.path.join(SINGLE_APP_DIR, "templates", "admin_settings.html"),
-        "r",
-        encoding="utf-8",
-    ).read()
+    admin_template = read_admin_settings_template()
     admin_route = open(
         os.path.join(SINGLE_APP_DIR, "route_frontend_admin_settings.py"),
         "r",
diff --git a/functional_tests/test_custom_pages_wiring.py b/functional_tests/test_custom_pages_wiring.py
index 702be5e97..d44ac9fc7 100644
--- a/functional_tests/test_custom_pages_wiring.py
+++ b/functional_tests/test_custom_pages_wiring.py
@@ -12,6 +12,7 @@
 
 from pathlib import Path
 import sys
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -20,7 +21,10 @@
 
 def read_text(relative_path):
     """Read a repository file as UTF-8 text."""
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def assert_contains(content, expected, description):
diff --git a/functional_tests/test_data_management_history_pagination.py b/functional_tests/test_data_management_history_pagination.py
index 9233477e4..7fe626979 100644
--- a/functional_tests/test_data_management_history_pagination.py
+++ b/functional_tests/test_data_management_history_pagination.py
@@ -35,6 +35,7 @@
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 
 from test_support.versioning import compare_simplechat_versions
+from test_support.templates import read_admin_settings_template
 
 
 class FakeHistoryContainer:
@@ -823,9 +824,7 @@ def test_deployers_apply_the_data_management_history_index():
 
 def test_retention_cleanup_button_explains_what_it_does():
     """Give admins hover and expandable guidance before deleting expired backups."""
-    template = (
-        APP_ROOT / "templates" / "admin_settings.html"
-    ).read_text(encoding="utf-8")
+    template = read_admin_settings_template()
 
     cleanup_button_start = template.index("data-management-run-retention-cleanup-btn")
     cleanup_button = template[cleanup_button_start:cleanup_button_start + 600]
diff --git a/functional_tests/test_data_management_security_patterns.py b/functional_tests/test_data_management_security_patterns.py
index 9df41f807..982adfcca 100644
--- a/functional_tests/test_data_management_security_patterns.py
+++ b/functional_tests/test_data_management_security_patterns.py
@@ -34,6 +34,9 @@
 import re
 from pathlib import Path
 from test_support.versioning import assert_app_version_at_least
+from test_support.nav import iter_tabs
+from test_support.templates import compose_if_admin_settings
+from test_support.nav import iter_tabs
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -50,7 +53,9 @@
 
 
 def read_text(path):
-    return path.read_text(encoding="utf-8")
+    return compose_if_admin_settings(
+        path, path.read_text(encoding="utf-8")
+    )
 
 
 def route_functions_with_decorators():
@@ -340,7 +345,6 @@ def test_admin_javascript_uses_safe_dom_patterns():
     for required_snippet in [
         'document.createElement("tr")',
         'document.createElement("td")',
-        'openKeyVaultSettings',
         'buildMigrationPlan()',
         'queueMigration(false)',
         'loadMigrationCatalog(targetType, "reset")',
@@ -410,9 +414,13 @@ def test_admin_ui_exposes_data_management_without_external_assets():
     sidebar = read_text(SIDEBAR_TEMPLATE)
 
     for marker in [
-        'id="data-management-tab"',
-        'id="data-management"',
-        'id="data-management" role="tabpanel" aria-labelledby="data-management-tab" data-testid="data-management-tab-pane" data-ignore-settings-change="true"',
+        # Backup, Migrate & Restore is now five tabs rather than one, so each
+        # pane is asserted individually.
+        'id="backup" role="tabpanel" aria-labelledby="backup-tab" data-testid="backup-tab-pane" data-ignore-settings-change="true"',
+        'id="migrate" role="tabpanel" aria-labelledby="migrate-tab" data-testid="migrate-tab-pane" data-ignore-settings-change="true"',
+        'id="restore" role="tabpanel" aria-labelledby="restore-tab" data-testid="restore-tab-pane" data-ignore-settings-change="true"',
+        'id="cosmos-editor" role="tabpanel" aria-labelledby="cosmos-editor-tab" data-testid="cosmos-editor-tab-pane" data-ignore-settings-change="true"',
+        'id="jobs" role="tabpanel" aria-labelledby="jobs-tab" data-testid="jobs-tab-pane" data-ignore-settings-change="true"',
         'id="data-management-save-settings-btn"',
         'id="data-management-save-settings-btn" disabled aria-disabled="true"',
         'id="data-management-operational-warning"',
@@ -560,15 +568,45 @@ def test_admin_ui_exposes_data_management_without_external_assets():
     assert "saveButton.classList.toggle('d-none', isDataManagementActive);" in admin_settings_js
     assert "window.updateAdminSettingsSaveButtonState = updateSaveButtonState;" in admin_settings_js
     assert '<span class="nav-text">Target Cosmos</span>' not in sidebar
-    assert '<span class="nav-text">Migration</span>' in sidebar
-    assert '<span class="nav-text">Backup, Migrate &amp; Restore</span>' in sidebar
+    # Sidebar labels now come from the navigation map, which both the sidebar
+    # and the top tab strip render from. Backup, Migrate & Restore is spread
+    # across the Backup & Recovery group's tabs, so scope by group rather than
+    # by a single tab id.
+    backup_recovery_tabs = [
+        tab for group, tab in iter_tabs() if group["id"] == "backup-recovery"
+    ]
+    assert backup_recovery_tabs, "Backup & Recovery group missing from the navigation map"
+
+    data_management_sections = {
+        section["label"]
+        for tab in backup_recovery_tabs
+        for section in tab["sections"]
+    }
+    assert "Target Cosmos" not in data_management_sections
+    assert "Migration" in data_management_sections
+
+    tab_labels = {tab["label"] for tab in backup_recovery_tabs}
+    for expected_label in ("Backup", "Migrate", "Restore", "Jobs"):
+        assert expected_label in tab_labels, (
+            f"Backup & Recovery is missing the {expected_label} tab"
+        )
     assert 'cdn.jsdelivr.net' not in read_text(ADMIN_JS)
-    assert 'data-tab="data-management"' in sidebar
-    assert 'data-section="data-management-readiness-section"' in sidebar
-    assert 'data-section="data-management-backup-section"' in sidebar
-    assert 'data-section="data-management-cosmos-editor-section"' in sidebar
-    assert 'data-section="data-management-backup-inventory-section"' in sidebar
-    assert 'data-section="data-management-migration-section"' in sidebar
+
+    data_management_section_ids = {
+        section["id"]
+        for tab in backup_recovery_tabs
+        for section in tab["sections"]
+    }
+    for expected_section in (
+        "data-management-readiness-section",
+        "data-management-backup-section",
+        "data-management-cosmos-editor-section",
+        "data-management-backup-inventory-section",
+        "data-management-migration-section",
+    ):
+        assert expected_section in data_management_section_ids, (
+            f"Navigation map is missing {expected_section}"
+        )
 
 
 if __name__ == "__main__":
diff --git a/functional_tests/test_deep_research_explicit_toggle.py b/functional_tests/test_deep_research_explicit_toggle.py
index 9476e424f..d88dedbca 100644
--- a/functional_tests/test_deep_research_explicit_toggle.py
+++ b/functional_tests/test_deep_research_explicit_toggle.py
@@ -22,12 +22,13 @@
 sys.path.insert(0, APP_ROOT)
 
 from functions_source_review import get_source_review_config, should_auto_enable_source_review  # noqa: E402
+from test_support.templates import compose_if_admin_settings
 
 
 def read_text(path):
     """Read text content for static regression checks."""
     with open(path, "r", encoding="utf-8") as file_handle:
-        return file_handle.read()
+        return compose_if_admin_settings(path, file_handle.read())
 
 
 def test_web_search_does_not_auto_enable_deep_research():
diff --git a/functional_tests/test_default_model_selection_fallback.py b/functional_tests/test_default_model_selection_fallback.py
index 76ec94002..9faa7a0f1 100644
--- a/functional_tests/test_default_model_selection_fallback.py
+++ b/functional_tests/test_default_model_selection_fallback.py
@@ -12,11 +12,12 @@
 """
 
 import os
+from test_support.templates import compose_if_admin_settings
 
 
 def read_file_text(file_path):
     with open(file_path, "r", encoding="utf-8") as file:
-        return file.read()
+        return compose_if_admin_settings(file_path, file.read())
 
 
 def test_default_model_selection_wiring():
diff --git a/functional_tests/test_desktop_notification_settings.py b/functional_tests/test_desktop_notification_settings.py
index df21c9374..0b2085673 100644
--- a/functional_tests/test_desktop_notification_settings.py
+++ b/functional_tests/test_desktop_notification_settings.py
@@ -9,13 +9,17 @@
 """
 
 from pathlib import Path
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
 
 
 def _read(relative_path):
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def test_desktop_notification_settings_are_wired_end_to_end():
diff --git a/functional_tests/test_disable_group_creation_fix.py b/functional_tests/test_disable_group_creation_fix.py
index 4faffe706..451a8eb2f 100644
--- a/functional_tests/test_disable_group_creation_fix.py
+++ b/functional_tests/test_disable_group_creation_fix.py
@@ -20,6 +20,7 @@
 
 import sys
 import os
+from test_support.templates import compose_if_admin_settings
 
 # Add parent directory to path for imports
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
@@ -37,7 +38,7 @@ def test_form_field_name_matches_backend():
         )
         
         with open(template_path, 'r', encoding='utf-8') as f:
-            template_content = f.read()
+            template_content = compose_if_admin_settings(template_path, f.read())
         
         # Verify the form field exists with name="disable_group_creation"
         assert 'name="disable_group_creation"' in template_content, \
@@ -88,7 +89,7 @@ def test_control_center_toggle_exists():
         )
         
         with open(template_path, 'r', encoding='utf-8') as f:
-            template_content = f.read()
+            template_content = compose_if_admin_settings(template_path, f.read())
         
         # Verify the toggle exists
         assert 'id="disableGroupCreation"' in template_content, \
diff --git a/functional_tests/test_document_action_capability_settings.py b/functional_tests/test_document_action_capability_settings.py
index 8ff9114f9..d8ba9e6d8 100644
--- a/functional_tests/test_document_action_capability_settings.py
+++ b/functional_tests/test_document_action_capability_settings.py
@@ -12,13 +12,17 @@
 
 from pathlib import Path
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 ROOT = Path(__file__).resolve().parents[1]
 
 
 def read_text(relative_path: str) -> str:
-    return (ROOT / relative_path).read_text(encoding="utf-8")
+    _path = ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def test_document_action_capability_settings_wiring() -> None:
diff --git a/functional_tests/test_document_intelligence_pdf_image_extraction_mode.py b/functional_tests/test_document_intelligence_pdf_image_extraction_mode.py
index 155f66c29..abfe5ad61 100644
--- a/functional_tests/test_document_intelligence_pdf_image_extraction_mode.py
+++ b/functional_tests/test_document_intelligence_pdf_image_extraction_mode.py
@@ -16,6 +16,7 @@
 
 import sys
 from pathlib import Path
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -23,7 +24,10 @@
 
 def read_repo_file(relative_path):
     """Read a repository file as UTF-8 text."""
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def assert_contains(content, expected_text, description):
diff --git a/functional_tests/test_endpoints_tab_order_visibility.py b/functional_tests/test_endpoints_tab_order_visibility.py
index 90eed4254..aa653af6c 100644
--- a/functional_tests/test_endpoints_tab_order_visibility.py
+++ b/functional_tests/test_endpoints_tab_order_visibility.py
@@ -19,6 +19,7 @@
 """
 
 import os
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
@@ -30,7 +31,7 @@
 
 def read_file_text(file_path):
     with open(file_path, "r", encoding="utf-8") as file:
-        return file.read()
+        return compose_if_admin_settings(file_path, file.read())
 
 
 def test_workspace_endpoints_tab_order_visibility():
diff --git a/functional_tests/test_enhanced_citations_startup_storage_degradation.py b/functional_tests/test_enhanced_citations_startup_storage_degradation.py
index 21b585b8c..29d6dff54 100644
--- a/functional_tests/test_enhanced_citations_startup_storage_degradation.py
+++ b/functional_tests/test_enhanced_citations_startup_storage_degradation.py
@@ -14,6 +14,7 @@
 from pathlib import Path
 
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -27,7 +28,9 @@
 
 def read_text(path):
     """Read a repository file as UTF-8 text."""
-    return path.read_text(encoding="utf-8")
+    return compose_if_admin_settings(
+        path, path.read_text(encoding="utf-8")
+    )
 
 
 def get_function_source(path, function_name):
diff --git a/functional_tests/test_external_health_check_duplication_fix.py b/functional_tests/test_external_health_check_duplication_fix.py
index fabfe15e8..aa750b418 100644
--- a/functional_tests/test_external_health_check_duplication_fix.py
+++ b/functional_tests/test_external_health_check_duplication_fix.py
@@ -11,6 +11,7 @@
 import sys
 import os
 import re
+from test_support.templates import compose_if_admin_settings
 
 def test_external_health_check_duplication():
     """Test that there is only one External Health Check section in admin settings."""
@@ -27,7 +28,7 @@ def test_external_health_check_duplication():
             raise FileNotFoundError(f"Template file not found: {template_path}")
         
         with open(template_path, 'r', encoding='utf-8') as f:
-            content = f.read()
+            content = compose_if_admin_settings(template_path, f.read())
         
         # Count occurrences of "External Health Check" headers
         header_pattern = r'<h5>External Health Check</h5>'
@@ -81,7 +82,7 @@ def test_ui_structure_integrity():
         )
         
         with open(template_path, 'r', encoding='utf-8') as f:
-            content = f.read()
+            content = compose_if_admin_settings(template_path, f.read())
         
         # Check for proper card structure
         card_open_count = len(re.findall(r'<div class="card[^"]*">', content))
diff --git a/functional_tests/test_file_sync_azure_blob_storage.py b/functional_tests/test_file_sync_azure_blob_storage.py
index cb2b53040..0f7607513 100644
--- a/functional_tests/test_file_sync_azure_blob_storage.py
+++ b/functional_tests/test_file_sync_azure_blob_storage.py
@@ -27,6 +27,7 @@
 from typing import Any, Dict, List, Optional, Tuple
 from urllib.parse import parse_qsl, quote, unquote, urlparse
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -39,7 +40,10 @@
 
 def read_text(relative_path):
     """Read a repository file as UTF-8 text."""
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def parse_app(relative_path):
diff --git a/functional_tests/test_file_sync_azure_files_identity.py b/functional_tests/test_file_sync_azure_files_identity.py
index e3af89e90..b7fbc7398 100644
--- a/functional_tests/test_file_sync_azure_files_identity.py
+++ b/functional_tests/test_file_sync_azure_files_identity.py
@@ -19,6 +19,7 @@
 import sys
 from pathlib import Path
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -27,7 +28,10 @@
 
 def read_text(relative_path):
     """Read a repository file as UTF-8 text."""
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def parse_app(relative_path):
diff --git a/functional_tests/test_file_sync_capability.py b/functional_tests/test_file_sync_capability.py
index fc3fd1321..86644fd9c 100644
--- a/functional_tests/test_file_sync_capability.py
+++ b/functional_tests/test_file_sync_capability.py
@@ -15,6 +15,7 @@
 import sys
 from pathlib import Path
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -22,7 +23,10 @@
 
 
 def read_text(relative_path):
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def test_config_version_and_containers():
diff --git a/functional_tests/test_file_sync_onedrive_personal.py b/functional_tests/test_file_sync_onedrive_personal.py
index bdf0a8f9a..828ceeccc 100644
--- a/functional_tests/test_file_sync_onedrive_personal.py
+++ b/functional_tests/test_file_sync_onedrive_personal.py
@@ -19,6 +19,7 @@
 import sys
 from pathlib import Path
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -26,7 +27,10 @@
 
 def read_text(relative_path):
     """Read a repository file as UTF-8 text."""
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def parse_app(relative_path):
diff --git a/functional_tests/test_file_sync_workspace_assignment_gates.py b/functional_tests/test_file_sync_workspace_assignment_gates.py
index 431f439bf..b5bb09f9d 100644
--- a/functional_tests/test_file_sync_workspace_assignment_gates.py
+++ b/functional_tests/test_file_sync_workspace_assignment_gates.py
@@ -13,6 +13,7 @@
 import ast
 import sys
 from pathlib import Path
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -21,7 +22,10 @@
 
 def read_text(relative_path):
     """Read a repository file as UTF-8 text."""
-    return (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+    _path = REPO_ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def get_function_source(relative_path, function_name):
diff --git a/functional_tests/test_governance_admin_scope_toggle_visibility.py b/functional_tests/test_governance_admin_scope_toggle_visibility.py
index 9e1547430..d0647a527 100644
--- a/functional_tests/test_governance_admin_scope_toggle_visibility.py
+++ b/functional_tests/test_governance_admin_scope_toggle_visibility.py
@@ -11,6 +11,7 @@
 
 import os
 import sys
+from test_support.templates import compose_if_admin_settings
 
 
 ROOT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -19,7 +20,7 @@
 def _read(*parts):
     path = os.path.join(ROOT_DIR, *parts)
     with open(path, "r", encoding="utf-8") as handle:
-        return handle.read()
+        return compose_if_admin_settings(path, handle.read())
 
 
 GOVERNANCE_SCOPE_CONTROLS = {
diff --git a/functional_tests/test_governance_enforcement_logic.py b/functional_tests/test_governance_enforcement_logic.py
index 8f7c88686..0b826e492 100644
--- a/functional_tests/test_governance_enforcement_logic.py
+++ b/functional_tests/test_governance_enforcement_logic.py
@@ -53,6 +53,7 @@ def delete_item(self, item, partition_key):
 sys.modules.setdefault("functions_public_workspaces", functions_public_workspaces_stub)
 
 import functions_governance as governance
+from test_support.templates import compose_if_admin_settings
 
 
 ROOT_DIR = os.path.dirname(CURRENT_DIR)
@@ -61,7 +62,7 @@ def delete_item(self, item, partition_key):
 def _read_repo_file(*parts):
     path = os.path.join(ROOT_DIR, *parts)
     with open(path, "r", encoding="utf-8") as handle:
-        return handle.read()
+        return compose_if_admin_settings(path, handle.read())
 
 
 def test_ensure_governance_access_allows_when_feature_toggle_disabled():
diff --git a/functional_tests/test_governance_route_and_wiring_coverage.py b/functional_tests/test_governance_route_and_wiring_coverage.py
index c784ba466..73ecb1ffb 100644
--- a/functional_tests/test_governance_route_and_wiring_coverage.py
+++ b/functional_tests/test_governance_route_and_wiring_coverage.py
@@ -12,6 +12,7 @@
 
 import os
 import sys
+from test_support.templates import compose_if_admin_settings
 
 
 ROOT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -23,7 +24,7 @@
 def _read(*parts):
     path = os.path.join(ROOT_DIR, *parts)
     with open(path, "r", encoding="utf-8") as handle:
-        return handle.read()
+        return compose_if_admin_settings(path, handle.read())
 
 
 def test_governance_route_registration_and_guards():
@@ -131,7 +132,7 @@ def test_governance_enforcement_hooks_across_changed_routes():
         assert key in settings_content, f"Missing governance default setting key: {key}"
 
     for marker in [
-        "id=\"governance\"",
+        "id=\"feature-governance\"",
         "governance-feature-policies-table",
         "governance-item-policies-table",
         "governance-item-policy-card-controls",
diff --git a/functional_tests/test_idle_logout_timeout.py b/functional_tests/test_idle_logout_timeout.py
index 4dda5e7f8..10d388baf 100644
--- a/functional_tests/test_idle_logout_timeout.py
+++ b/functional_tests/test_idle_logout_timeout.py
@@ -14,6 +14,8 @@
 import ast
 import traceback
 
+from test_support.templates import compose_if_admin_settings
+
 sys.path.append(os.path.dirname(os.path.abspath(__file__)))
 
 
@@ -24,7 +26,7 @@ def _read_file(*path_parts):
         *path_parts
     )
     with open(file_path, 'r', encoding='utf-8') as file_handle:
-        return file_handle.read()
+        return compose_if_admin_settings(file_path, file_handle.read())
 
 
 def _parse_python_file(*path_parts):
diff --git a/functional_tests/test_inbound_mcp_admin_ui.py b/functional_tests/test_inbound_mcp_admin_ui.py
index 6f7bfaaa2..4dafbf5f7 100644
--- a/functional_tests/test_inbound_mcp_admin_ui.py
+++ b/functional_tests/test_inbound_mcp_admin_ui.py
@@ -39,6 +39,9 @@
 import sys
 from pathlib import Path
 from test_support.versioning import assert_app_version_at_least
+from test_support.nav import iter_tabs
+from test_support.templates import compose_if_admin_settings
+from test_support.nav import iter_tabs
 
 
 ROOT_DIR = Path(__file__).resolve().parents[1]
@@ -46,7 +49,10 @@
 
 def read_repo_file(relative_path):
     """Read a repository file for source-level contract validation."""
-    return (ROOT_DIR / relative_path).read_text(encoding="utf-8")
+    _path = ROOT_DIR / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def test_inbound_mcp_runtime_settings_are_app_settings():
@@ -173,9 +179,26 @@ def test_admin_settings_mcp_ui_is_gated_and_minimal():
         assert f"'{operational_setting}'," in admin_route_source
         assert f"INBOUND_MCP_SETTINGS_DEFAULTS['{operational_setting}']" in admin_route_source
 
-    assert "{% if mcp_ui_enabled %}" in sidebar_template
-    assert 'data-section="inbound-mcp-configuration"' in sidebar_template
-    assert "Inbound MCP" in sidebar_template
+    # The Inbound MCP navigation entry is gated by the same flag as its card,
+    # declared in the navigation map rather than inline in the sidebar.
+    inbound_section = next(
+        (
+            section
+            for _, tab in iter_tabs()
+            for section in tab["sections"]
+            if section["id"] == "inbound-mcp-configuration"
+        ),
+        None,
+    )
+    assert inbound_section is not None, (
+        "Inbound MCP navigation entry missing from the navigation map"
+    )
+    assert inbound_section.get("condition") == "mcp_ui_enabled", (
+        "Inbound MCP navigation entry must be gated by mcp_ui_enabled"
+    )
+    assert inbound_section["label"] == "Inbound MCP", (
+        f"Unexpected Inbound MCP navigation label: {inbound_section['label']}"
+    )
 
 
 def test_inbound_mcp_auth_uses_settings_runtime_config():
diff --git a/functional_tests/test_latest_features_action_links.py b/functional_tests/test_latest_features_action_links.py
index 3019b1575..0e8807a6b 100644
--- a/functional_tests/test_latest_features_action_links.py
+++ b/functional_tests/test_latest_features_action_links.py
@@ -13,6 +13,7 @@
 from pathlib import Path
 import sys
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
@@ -29,7 +30,9 @@
 
 
 def read_text(path: Path) -> str:
-    return path.read_text(encoding="utf-8")
+    return compose_if_admin_settings(
+        path, path.read_text(encoding="utf-8")
+    )
 
 
 def assert_markers(file_path: Path, markers: list[str]) -> None:
diff --git a/functional_tests/test_multimedia_support_reorganization.py b/functional_tests/test_multimedia_support_reorganization.py
index 68bda79ea..93e96dc0d 100644
--- a/functional_tests/test_multimedia_support_reorganization.py
+++ b/functional_tests/test_multimedia_support_reorganization.py
@@ -15,6 +15,8 @@
 import os
 import sys
 
+from test_support.templates import compose_if_admin_settings
+
 sys.path.append(os.path.dirname(os.path.abspath(__file__)))
 
 
@@ -29,8 +31,9 @@ def test_multimedia_support_move():
         )
 
         with open(admin_settings_path, 'r', encoding='utf-8') as file_handle:
-            content = file_handle.read()
-
+            content = compose_if_admin_settings(
+                admin_settings_path, file_handle.read()
+            )
         search_extract_section = content.find('id="search-extract" role="tabpanel"')
         multimedia_support_section = content.find('id="video-intelligence-section"')
 
diff --git a/functional_tests/test_multimodal_vision_multi_endpoint_connection.py b/functional_tests/test_multimodal_vision_multi_endpoint_connection.py
index 526599f7b..58b2294d7 100644
--- a/functional_tests/test_multimodal_vision_multi_endpoint_connection.py
+++ b/functional_tests/test_multimodal_vision_multi_endpoint_connection.py
@@ -13,6 +13,8 @@
 import sys
 from pathlib import Path
 
+from test_support.templates import read_admin_settings_template
+
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
 ADMIN_SETTINGS_JS = REPO_ROOT / "application" / "single_app" / "static" / "js" / "admin" / "admin_settings.js"
@@ -31,7 +33,7 @@ def test_multimodal_vision_multi_endpoint_wiring():
     print("Testing multi-endpoint Vision test connection wiring...")
 
     js_content = ADMIN_SETTINGS_JS.read_text(encoding="utf-8")
-    template_content = ADMIN_SETTINGS_TEMPLATE.read_text(encoding="utf-8")
+    template_content = read_admin_settings_template()
     backend_content = ROUTE_BACKEND_SETTINGS.read_text(encoding="utf-8")
 
     assert_contains(js_content, "opt.dataset.endpointId = ep.id || '';", "vision endpoint id option metadata")
diff --git a/functional_tests/test_personal_workflows_feature.py b/functional_tests/test_personal_workflows_feature.py
index 43044feb8..e722495b4 100644
--- a/functional_tests/test_personal_workflows_feature.py
+++ b/functional_tests/test_personal_workflows_feature.py
@@ -10,13 +10,17 @@
 
 from pathlib import Path
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 ROOT = Path(__file__).resolve().parents[1]
 
 
 def read_text(relative_path):
-    return (ROOT / relative_path).read_text(encoding="utf-8")
+    _path = ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def test_personal_workflows_feature_wiring():
diff --git a/functional_tests/test_public_workspace_display_name_settings.py b/functional_tests/test_public_workspace_display_name_settings.py
index e36ef529d..f8fc46824 100644
--- a/functional_tests/test_public_workspace_display_name_settings.py
+++ b/functional_tests/test_public_workspace_display_name_settings.py
@@ -16,6 +16,7 @@
 from types import SimpleNamespace
 
 from jinja2 import Environment
+from test_support.templates import compose_if_admin_settings
 
 sys.path.append(os.path.dirname(os.path.abspath(__file__)))
 
@@ -29,7 +30,7 @@
 
 def read_source(path):
     with open(path, "r", encoding="utf-8") as source_file:
-        return source_file.read()
+        return compose_if_admin_settings(path, source_file.read())
 
 
 def assert_contains(source, needle, description):
diff --git a/functional_tests/test_support/admin_settings_field_baseline.json b/functional_tests/test_support/admin_settings_field_baseline.json
new file mode 100644
index 000000000..3c9fe0019
--- /dev/null
+++ b/functional_tests/test_support/admin_settings_field_baseline.json
@@ -0,0 +1,463 @@
+{
+  "_comment": "Contract for Admin Settings form field names. Regenerate with test_admin_settings_field_contract.py --update-baseline only when a field is intentionally removed or renamed.",
+  "field_names": [
+    "access_denied_message",
+    "agent_templates_allow_user_submission",
+    "agent_templates_require_approval",
+    "agents_page_disclaimer_markdown",
+    "agents_page_hero_color_mode",
+    "agents_page_hero_primary_color",
+    "agents_page_hero_secondary_color",
+    "agents_page_promoted_popular_agents_json",
+    "agents_page_promoted_popular_order",
+    "agents_page_promoted_popular_tag_enabled",
+    "agents_page_promoted_popular_tag_label",
+    "agents_page_show_instructions_in_details",
+    "agents_page_subtitle",
+    "agents_page_title",
+    "ai_notice_frequency",
+    "ai_notice_message",
+    "allow_group_agents",
+    "allow_group_custom_endpoints",
+    "allow_group_plugins",
+    "allow_group_workflows",
+    "allow_group_workspace_file_downloads",
+    "allow_personal_workspace_file_downloads",
+    "allow_public_workspace_file_downloads",
+    "allow_user_agents",
+    "allow_user_custom_endpoints",
+    "allow_user_plugins",
+    "allow_user_workflows",
+    "app_title",
+    "audio_files_storage_account_url",
+    "azure_ai_search_authentication_type",
+    "azure_ai_search_endpoint",
+    "azure_ai_search_key",
+    "azure_apim_ai_search_endpoint",
+    "azure_apim_ai_search_subscription_key",
+    "azure_apim_content_safety_endpoint",
+    "azure_apim_content_safety_subscription_key",
+    "azure_apim_document_intelligence_endpoint",
+    "azure_apim_document_intelligence_subscription_key",
+    "azure_apim_embedding_api_version",
+    "azure_apim_embedding_deployment",
+    "azure_apim_embedding_endpoint",
+    "azure_apim_embedding_subscription_key",
+    "azure_apim_gpt_api_version",
+    "azure_apim_gpt_deployment",
+    "azure_apim_gpt_endpoint",
+    "azure_apim_gpt_subscription_key",
+    "azure_apim_image_gen_api_version",
+    "azure_apim_image_gen_deployment",
+    "azure_apim_image_gen_endpoint",
+    "azure_apim_image_gen_subscription_key",
+    "azure_content_understanding_analyzer_id",
+    "azure_content_understanding_api_version",
+    "azure_content_understanding_authentication_type",
+    "azure_content_understanding_endpoint",
+    "azure_content_understanding_image_analyzer_id",
+    "azure_content_understanding_key",
+    "azure_document_intelligence_authentication_type",
+    "azure_document_intelligence_endpoint",
+    "azure_document_intelligence_key",
+    "azure_openai_embedding_api_version",
+    "azure_openai_embedding_authentication_type",
+    "azure_openai_embedding_endpoint",
+    "azure_openai_embedding_key",
+    "azure_openai_embedding_resource_group",
+    "azure_openai_embedding_subscription_id",
+    "azure_openai_gpt_api_version",
+    "azure_openai_gpt_authentication_type",
+    "azure_openai_gpt_endpoint",
+    "azure_openai_gpt_key",
+    "azure_openai_gpt_resource_group",
+    "azure_openai_gpt_subscription_id",
+    "azure_openai_image_gen_api_version",
+    "azure_openai_image_gen_authentication_type",
+    "azure_openai_image_gen_endpoint",
+    "azure_openai_image_gen_key",
+    "azure_openai_image_gen_resource_group",
+    "azure_openai_image_gen_subscription_id",
+    "chunk_size_csv",
+    "chunk_size_doc",
+    "chunk_size_docm",
+    "chunk_size_docx",
+    "chunk_size_excel",
+    "chunk_size_html",
+    "chunk_size_json",
+    "chunk_size_log",
+    "chunk_size_md",
+    "chunk_size_pdf",
+    "chunk_size_pptx",
+    "chunk_size_transcript",
+    "chunk_size_txt",
+    "chunk_size_xml",
+    "chunk_size_yaml",
+    "chunk_size_yml",
+    "classification_banner_color",
+    "classification_banner_enabled",
+    "classification_banner_text",
+    "classification_banner_text_color",
+    "content_safety_authentication_type",
+    "content_safety_endpoint",
+    "content_safety_include_trigger_information",
+    "content_safety_key",
+    "content_safety_violation_message",
+    "control_center_auto_refresh_enabled",
+    "control_center_auto_refresh_time",
+    "control_center_auto_refresh_timezone",
+    "conversation_cache_ttl_seconds",
+    "conversation_history_limit",
+    "cosmos_throughput_account_name",
+    "cosmos_throughput_auto_scale_down_enabled",
+    "cosmos_throughput_auto_scale_up_enabled",
+    "cosmos_throughput_autoscale_enabled",
+    "cosmos_throughput_container_policies_json",
+    "cosmos_throughput_convert_manual_to_autoscale_enabled",
+    "cosmos_throughput_database_name",
+    "cosmos_throughput_enforce_container_defaults",
+    "cosmos_throughput_ignore_max_limit",
+    "cosmos_throughput_ignore_min_limit",
+    "cosmos_throughput_max_ru",
+    "cosmos_throughput_metrics_window_minutes",
+    "cosmos_throughput_min_ru",
+    "cosmos_throughput_resource_group",
+    "cosmos_throughput_scale_down_cooldown_minutes",
+    "cosmos_throughput_scale_down_step_ru",
+    "cosmos_throughput_scale_down_threshold_percent",
+    "cosmos_throughput_scale_up_cooldown_minutes",
+    "cosmos_throughput_scale_up_step_ru",
+    "cosmos_throughput_scale_up_threshold_percent",
+    "cosmos_throughput_subscription_id",
+    "custom_pages_force_menu",
+    "custom_pages_menu_name",
+    "custom_pages_restart_acknowledged",
+    "data_management_migration_groups_mode_choice",
+    "data_management_migration_mode",
+    "data_management_migration_public_workspaces_mode_choice",
+    "data_management_migration_users_mode_choice",
+    "debug_timer_unit",
+    "debug_timer_value",
+    "deep_research_enable_ledger_artifact",
+    "deep_research_enable_query_planning",
+    "deep_research_max_search_queries_per_turn",
+    "deep_research_max_user_urls_per_turn",
+    "default_model_selection_json",
+    "default_retention_conversation_group",
+    "default_retention_conversation_personal",
+    "default_retention_conversation_public",
+    "default_retention_document_group",
+    "default_retention_document_personal",
+    "default_retention_document_public",
+    "default_system_prompt",
+    "disable_group_creation",
+    "document_access_index_backfill_batch_size",
+    "document_access_index_cache_ttl_seconds",
+    "document_access_index_repair_batch_size",
+    "document_action_analyze_chat_max_documents",
+    "document_action_analyze_enabled",
+    "document_action_analyze_workflow_max_documents",
+    "document_action_comparison_chat_max_documents",
+    "document_action_comparison_enabled",
+    "document_action_comparison_workflow_max_documents",
+    "document_classification_categories_json",
+    "document_intelligence_auto_sample_pages",
+    "document_intelligence_pdf_image_extraction_mode",
+    "embedding_model_json",
+    "enable_agent_template_gallery",
+    "enable_ai_notice",
+    "enable_ai_search_apim",
+    "enable_appinsights_global_logging",
+    "enable_audio_file_support",
+    "enable_chat_completion_audio_cues",
+    "enable_chat_file_uploads",
+    "enable_chunk_size_override",
+    "enable_content_safety",
+    "enable_content_safety_apim",
+    "enable_conversation_archiving",
+    "enable_conversation_cache",
+    "enable_conversation_contents_drawer",
+    "enable_custom_pages",
+    "enable_dark_mode_default",
+    "enable_debug_logging",
+    "enable_debug_logging_timer",
+    "enable_deep_source_review",
+    "enable_default_embedding_model_plugin",
+    "enable_desktop_notifications",
+    "enable_document_access_index_cache",
+    "enable_document_access_index_reads",
+    "enable_document_access_index_shadow_validation",
+    "enable_document_access_index_write_through",
+    "enable_document_classification",
+    "enable_document_intelligence_apim",
+    "enable_document_intelligence_formula_extraction",
+    "enable_embedding_apim",
+    "enable_enhanced_citations",
+    "enable_enhanced_extraction",
+    "enable_external_healthcheck",
+    "enable_external_links",
+    "enable_extract_meta_data",
+    "enable_fact_memory_plugin",
+    "enable_file_processing_logs",
+    "enable_file_processing_logs_timer",
+    "enable_file_sharing",
+    "enable_file_sync",
+    "enable_file_sync_group",
+    "enable_file_sync_personal",
+    "enable_file_sync_public",
+    "enable_front_door",
+    "enable_gpt_apim",
+    "enable_group_workspaces",
+    "enable_http_plugin",
+    "enable_idle_timeout",
+    "enable_image_gen_apim",
+    "enable_image_generation",
+    "enable_inbound_mcp_rate_limits",
+    "enable_inbound_mcp_server",
+    "enable_key_vault_secret_expiration_reminders",
+    "enable_key_vault_secret_storage",
+    "enable_landing_page_editor",
+    "enable_left_nav_default",
+    "enable_math_plugin",
+    "enable_mcp_destination_governance",
+    "enable_multi_model_endpoints",
+    "enable_multimodal_vision",
+    "enable_no_auth_external_healthcheck",
+    "enable_office_embedded_image_analysis",
+    "enable_public_workspaces",
+    "enable_redis_cache",
+    "enable_retention_policy_group",
+    "enable_retention_policy_personal",
+    "enable_retention_policy_public",
+    "enable_semantic_kernel",
+    "enable_source_review",
+    "enable_speech_to_text_input",
+    "enable_startup_document_access_index_backfill",
+    "enable_support_latest_feature_documentation_links",
+    "enable_support_latest_features",
+    "enable_support_menu",
+    "enable_support_send_feedback",
+    "enable_swagger",
+    "enable_tabular_durable_run_confirmation",
+    "enable_terms_of_use",
+    "enable_text_plugin",
+    "enable_text_to_speech",
+    "enable_thoughts",
+    "enable_time_plugin",
+    "enable_url_access",
+    "enable_user_agreement",
+    "enable_user_agreement_daily",
+    "enable_user_feedback",
+    "enable_user_workspace",
+    "enable_video_file_support",
+    "enable_wait_plugin",
+    "enable_web_search",
+    "enable_web_search_user_notice",
+    "enforce_workspace_scope_lock",
+    "external_links_force_menu",
+    "external_links_json",
+    "external_links_menu_name",
+    "favicon_file",
+    "file_download_allowed_group_ids",
+    "file_download_allowed_public_workspace_ids",
+    "file_sync_allow_recursive_sources",
+    "file_sync_allowed_group_ids",
+    "file_sync_allowed_public_workspace_ids",
+    "file_sync_group_admin_only",
+    "file_sync_max_concurrent_runs",
+    "file_sync_max_files_per_run",
+    "file_sync_max_gb_per_run",
+    "file_sync_max_sources_per_scope",
+    "file_sync_min_schedule_interval_minutes",
+    "file_sync_personal_admin_only",
+    "file_sync_personal_require_app_role",
+    "file_sync_public_admin_only",
+    "file_sync_visible_source_types",
+    "file_timer_unit",
+    "file_timer_value",
+    "front_door_url",
+    "governance_global_actions_usage",
+    "governance_global_agents_usage",
+    "governance_global_endpoints",
+    "governance_group_actions",
+    "governance_group_agents",
+    "governance_group_endpoints",
+    "governance_user_actions",
+    "governance_user_agents",
+    "governance_user_endpoints",
+    "gpt_model_json",
+    "group_workflow_allowed_group_ids",
+    "hide_app_title",
+    "idle_timeout_minutes",
+    "idle_warning_message",
+    "idle_warning_minutes",
+    "image_gen_model_json",
+    "inbound_mcp_allow_all_source_ids",
+    "inbound_mcp_allow_external_tenants",
+    "inbound_mcp_allowed_client_app_entries_json",
+    "inbound_mcp_allowed_source_entries_json",
+    "inbound_mcp_allowed_tenant_entries_json",
+    "inbound_mcp_max_request_bytes",
+    "inbound_mcp_rate_limit_read_per_window",
+    "inbound_mcp_rate_limit_search_per_window",
+    "inbound_mcp_rate_limit_window_seconds",
+    "inbound_mcp_rate_limit_write_per_window",
+    "inbound_mcp_required_app_role",
+    "inbound_mcp_required_scope",
+    "inbound_mcp_required_user_role",
+    "inbound_mcp_source_header",
+    "key_vault_identity",
+    "key_vault_name",
+    "key_vault_secret_expiration_admin_roles",
+    "key_vault_secret_expiration_default_contact_email",
+    "key_vault_secret_expiration_default_lead_days",
+    "key_vault_secret_expiration_emit_contact_email_in_telemetry",
+    "key_vault_secret_expiration_require_expiration",
+    "key_vault_secret_expiration_scan_interval_seconds",
+    "landing_page_alignment",
+    "landing_page_logo_scale_percent",
+    "landing_page_text",
+    "latest_features_enable_enhanced_citations_proxy",
+    "latest_features_enable_redis_cache_proxy",
+    "latest_features_enable_thoughts_proxy",
+    "latest_features_office_docs_authentication_type_proxy",
+    "latest_features_office_docs_storage_account_blob_endpoint_proxy",
+    "latest_features_office_docs_storage_account_url_proxy",
+    "latest_features_redis_auth_type_proxy",
+    "latest_features_redis_key_proxy",
+    "latest_features_redis_url_proxy",
+    "latest_features_tabular_preview_max_blob_size_mb_proxy",
+    "logo_dark_file",
+    "logo_file",
+    "max_file_size_mb",
+    "max_rounds_per_agent",
+    "mcp_block_unsafe_destinations",
+    "merge_global_semantic_kernel_with_workspace",
+    "metadata_extraction_model",
+    "metadata_extraction_model_selection_json",
+    "model_endpoint_identity_header_enabled",
+    "model_endpoint_identity_header_name",
+    "model_endpoint_identity_header_value_type",
+    "model_endpoints_json",
+    "multimodal_vision_model",
+    "office_docs_authentication_type",
+    "office_docs_storage_account_blob_endpoint",
+    "office_docs_storage_account_url",
+    "office_embedded_image_max_per_document",
+    "office_embedded_image_min_pixels",
+    "orchestration_type",
+    "per_user_semantic_kernel",
+    "public_workspace_display_name",
+    "redis_auth_type",
+    "redis_key",
+    "redis_url",
+    "release_notifications_email",
+    "release_notifications_name",
+    "release_notifications_org",
+    "release_notifications_registered",
+    "release_notifications_registered_at",
+    "release_notifications_updated_at",
+    "require_group_assignment_for_file_downloads",
+    "require_group_assignment_for_file_sync",
+    "require_group_assignment_for_group_workflows",
+    "require_member_of_chat_file_upload_user",
+    "require_member_of_control_center_admin",
+    "require_member_of_control_center_dashboard_reader",
+    "require_member_of_create_group",
+    "require_member_of_create_public_workspace",
+    "require_member_of_deep_research_user",
+    "require_member_of_feedback_admin",
+    "require_member_of_safety_violation_admin",
+    "require_member_of_url_access_user",
+    "require_member_of_workflow_user",
+    "require_owner_for_group_agent_management",
+    "require_public_workspace_assignment_for_file_downloads",
+    "require_public_workspace_assignment_for_file_sync",
+    "require_shared_conversation_file_approval",
+    "retention_policy_execution_hour",
+    "send_feedback_bug_details",
+    "send_feedback_bug_email",
+    "send_feedback_bug_name",
+    "send_feedback_bug_org",
+    "send_feedback_feature_details",
+    "send_feedback_feature_email",
+    "send_feedback_feature_name",
+    "send_feedback_feature_org",
+    "show_logo",
+    "source_review_allow_internal_hosts",
+    "source_review_allow_js_rendering",
+    "source_review_audit_logging",
+    "source_review_default_mode",
+    "source_review_enable_llm_planning",
+    "source_review_js_load_more_clicks",
+    "source_review_max_bytes_per_page_mb",
+    "source_review_max_depth",
+    "source_review_max_pages_per_turn",
+    "source_review_max_redirects",
+    "source_review_max_seed_pages_per_turn",
+    "source_review_respect_robots_txt",
+    "source_review_timeout_seconds",
+    "speech_service_authentication_type",
+    "speech_service_endpoint",
+    "speech_service_key",
+    "speech_service_locale",
+    "speech_service_location",
+    "speech_service_resource_group",
+    "speech_service_resource_id",
+    "speech_service_resource_name",
+    "speech_service_subscription_id",
+    "support_feedback_recipient_email",
+    "support_menu_name",
+    "tabular_durable_run_confirmation_threshold_batches",
+    "tabular_durable_run_confirmation_threshold_rows",
+    "tabular_generated_output_chunk_model_deployment",
+    "tabular_generated_output_chunk_model_mode",
+    "tabular_preview_max_blob_size_mb",
+    "terms_of_use_accept_button_text",
+    "terms_of_use_decline_button_text",
+    "terms_of_use_decline_redirect_url",
+    "terms_of_use_frequency",
+    "terms_of_use_message",
+    "terms_of_use_title",
+    "url_access_allowed_domains",
+    "url_access_blocked_domains",
+    "url_access_max_chat_urls_per_turn",
+    "url_access_max_workflow_urls_per_run",
+    "user_agreement_apply_chat",
+    "user_agreement_apply_group",
+    "user_agreement_apply_personal",
+    "user_agreement_apply_public",
+    "user_agreement_text",
+    "video_files_storage_account_url",
+    "video_index_timeout",
+    "video_indexer_account_id",
+    "video_indexer_account_name",
+    "video_indexer_arm_api_version",
+    "video_indexer_endpoint",
+    "video_indexer_location",
+    "video_indexer_resource_group",
+    "video_indexer_subscription_id",
+    "web_search_consent_accepted",
+    "web_search_foundry_agent_id",
+    "web_search_foundry_api_version",
+    "web_search_foundry_auth_type",
+    "web_search_foundry_authority",
+    "web_search_foundry_client_id",
+    "web_search_foundry_client_secret",
+    "web_search_foundry_cloud",
+    "web_search_foundry_endpoint",
+    "web_search_foundry_managed_identity_client_id",
+    "web_search_foundry_managed_identity_type",
+    "web_search_foundry_tenant_id",
+    "web_search_user_notice_text",
+    "workflow_max_auto_invoke_attempts",
+    "workflow_max_tasks"
+  ],
+  "allowed_duplicates": {
+    "data_management_migration_groups_mode_choice": 3,
+    "data_management_migration_mode": 3,
+    "data_management_migration_public_workspaces_mode_choice": 3,
+    "data_management_migration_users_mode_choice": 3,
+    "file_sync_visible_source_types": 3
+  }
+}
diff --git a/functional_tests/test_support/nav.py b/functional_tests/test_support/nav.py
new file mode 100644
index 000000000..ed847b2ef
--- /dev/null
+++ b/functional_tests/test_support/nav.py
@@ -0,0 +1,34 @@
+# nav.py
+"""Access to the Admin Settings navigation map from functional tests.
+
+``admin_settings_nav`` lives in ``application/single_app``, which is not on the
+test path by default. Centralising the import here keeps individual tests from
+each manipulating ``sys.path``, and gives them one place to read navigation
+structure from.
+"""
+
+import sys
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+APP_ROOT = REPO_ROOT / "application" / "single_app"
+
+if str(APP_ROOT) not in sys.path:
+    sys.path.insert(0, str(APP_ROOT))
+
+from admin_settings_nav import (  # noqa: E402
+    ADMIN_NAV,
+    get_group_for_tab,
+    get_section_ids,
+    get_tab_ids,
+    iter_tabs,
+)
+
+__all__ = [
+    "ADMIN_NAV",
+    "get_group_for_tab",
+    "get_section_ids",
+    "get_tab_ids",
+    "iter_tabs",
+]
diff --git a/functional_tests/test_support/templates.py b/functional_tests/test_support/templates.py
new file mode 100644
index 000000000..3b88eea8c
--- /dev/null
+++ b/functional_tests/test_support/templates.py
@@ -0,0 +1,96 @@
+# templates.py
+"""Shared helpers for reading composed SimpleChat templates in functional tests.
+
+Admin Settings is assembled from per-tab partials under
+``templates/admin/``. Any test that asserts on the rendered structure has to
+read the fully composed markup instead of the parent template alone, so these
+helpers inline ``{% include %}`` directives before the markup is parsed.
+"""
+
+import re
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+TEMPLATE_DIR = REPO_ROOT / "application" / "single_app" / "templates"
+ADMIN_SETTINGS_TEMPLATE = TEMPLATE_DIR / "admin_settings.html"
+
+INCLUDE_PATTERN = re.compile(
+    r'^(?P<indent>[ \t]*)\{%-?\s*include\s+["\'](?P<target>[^"\']+)["\'].*?%\}',
+    flags=re.MULTILINE,
+)
+
+# Only the Admin Settings tab partials are inlined by default. Unrelated
+# includes (info modals and shared widgets) carry their own tab markup, and
+# pulling them in would silently widen assertions that are meant to describe
+# the Admin Settings panes alone.
+DEFAULT_INCLUDE_PREFIX = "admin/"
+
+
+def resolve_template_includes(
+    source,
+    template_dir=None,
+    include_prefix=DEFAULT_INCLUDE_PREFIX,
+    _seen=None,
+):
+    """Return ``source`` with resolvable ``{% include %}`` directives inlined.
+
+    Only includes whose target starts with ``include_prefix`` are expanded;
+    pass ``include_prefix=""`` to inline every resolvable include. Includes
+    that cannot be found on disk, and includes that would recurse into a
+    template already being expanded, are left untouched so the original markup
+    is still visible to the caller.
+    """
+    directory = Path(template_dir) if template_dir else TEMPLATE_DIR
+    seen = set() if _seen is None else _seen
+
+    def _replace(match):
+        target = match.group("target")
+        partial = directory / target
+        if include_prefix and not target.startswith(include_prefix):
+            return match.group(0)
+        if target in seen or not partial.is_file():
+            return match.group(0)
+
+        nested = resolve_template_includes(
+            partial.read_text(encoding="utf-8"),
+            directory,
+            include_prefix,
+            seen | {target},
+        )
+        indent = match.group("indent")
+        return "\n".join(
+            f"{indent}{line}" if line.strip() else line
+            for line in nested.split("\n")
+        )
+
+    return INCLUDE_PATTERN.sub(_replace, source)
+
+
+def read_composed_template(path, template_dir=None, include_prefix=DEFAULT_INCLUDE_PREFIX):
+    """Read a template file with its Admin Settings includes inlined."""
+    template_path = Path(path)
+    directory = Path(template_dir) if template_dir else template_path.parent
+    return resolve_template_includes(
+        template_path.read_text(encoding="utf-8"),
+        directory,
+        include_prefix,
+    )
+
+
+def compose_if_admin_settings(path, content):
+    """Inline Admin Settings partials when ``path`` is the admin template.
+
+    Functional tests read many repository files through a single helper. Only
+    admin_settings.html is composed from partials, so this leaves every other
+    file untouched and keeps those tests reading exactly what is on disk.
+    """
+    template_path = Path(path)
+    if template_path.name != "admin_settings.html":
+        return content
+    return resolve_template_includes(content, template_path.parent)
+
+
+def read_admin_settings_template():
+    """Read the fully composed Admin Settings template."""
+    return read_composed_template(ADMIN_SETTINGS_TEMPLATE, TEMPLATE_DIR)
diff --git a/functional_tests/test_support_menu_user_feature.py b/functional_tests/test_support_menu_user_feature.py
index 0ea36578a..1d653c895 100644
--- a/functional_tests/test_support_menu_user_feature.py
+++ b/functional_tests/test_support_menu_user_feature.py
@@ -15,6 +15,8 @@
 import os
 import sys
 import importlib.util
+from test_support.templates import compose_if_admin_settings
+from test_support.nav import iter_tabs
 
 
 CURRENT_DIR = os.path.dirname(os.path.abspath(__file__))
@@ -39,8 +41,8 @@
 
 
 def read_text(path):
-    with open(path, 'r', encoding='utf-8') as file_handle:
-        return file_handle.read()
+    with open(path, "r", encoding="utf-8") as file_handle:
+        return compose_if_admin_settings(path, file_handle.read())
 
 
 def load_module(path, module_name):
@@ -260,7 +262,6 @@ def test_support_menu_navigation_and_routes():
     support_route_content = read_text(SUPPORT_ROUTE)
 
     sidebar_markers = [
-        'data-section="support-menu-section"',
         'id="support-menu-toggle"',
         "url_for('frontend_support.support_latest_features')",
         "url_for('frontend_support.support_send_feedback')",
@@ -269,6 +270,13 @@ def test_support_menu_navigation_and_routes():
     missing_sidebar = [marker for marker in sidebar_markers if marker not in sidebar_content]
     assert not missing_sidebar, f'Missing support menu sidebar markers: {missing_sidebar}'
 
+    # The admin destination for the Support card comes from the navigation map.
+    assert any(
+        section["id"] == "support-menu-section"
+        for _, tab in iter_tabs()
+        for section in tab["sections"]
+    ), 'Support menu admin destination missing from the navigation map'
+
     assert sidebar_content.index('id="support-menu-toggle"') < sidebar_content.index('id="external-links-toggle"'), 'Support menu should render before external links in the sidebar'
 
     short_sidebar_markers = [
diff --git a/functional_tests/test_tabular_processing_enhanced_citations_dependency.py b/functional_tests/test_tabular_processing_enhanced_citations_dependency.py
index 7762d8565..7a94e262c 100644
--- a/functional_tests/test_tabular_processing_enhanced_citations_dependency.py
+++ b/functional_tests/test_tabular_processing_enhanced_citations_dependency.py
@@ -11,6 +11,7 @@
 """
 
 import os
+from test_support.templates import compose_if_admin_settings
 
 
 CURRENT_DIR = os.path.dirname(os.path.abspath(__file__))
@@ -27,8 +28,8 @@
 
 
 def read_text(path):
-    with open(path, 'r', encoding='utf-8') as file_handle:
-        return file_handle.read()
+    with open(path, "r", encoding="utf-8") as file_handle:
+        return compose_if_admin_settings(path, file_handle.read())
 
 
 def test_functions_settings_derives_tabular_enablement():
diff --git a/functional_tests/test_thoughts_feature.py b/functional_tests/test_thoughts_feature.py
index cc295159c..aea6c11a1 100644
--- a/functional_tests/test_thoughts_feature.py
+++ b/functional_tests/test_thoughts_feature.py
@@ -11,6 +11,7 @@
 
 import sys
 import os
+from test_support.templates import compose_if_admin_settings
 
 sys.path.insert(0, os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'application', 'single_app'))
 
@@ -289,7 +290,7 @@ def test_thoughts_admin_settings():
         )
 
         with open(html_file, 'r', encoding='utf-8') as f:
-            content = f.read()
+            content = compose_if_admin_settings(html_file, f.read())
 
         checks = {
             'enable_thoughts checkbox': 'id="enable_thoughts"' in content,
diff --git a/functional_tests/test_workflow_access_controls.py b/functional_tests/test_workflow_access_controls.py
index 562ee7b2c..3c455da17 100644
--- a/functional_tests/test_workflow_access_controls.py
+++ b/functional_tests/test_workflow_access_controls.py
@@ -12,13 +12,19 @@
 import json
 from pathlib import Path
 from test_support.versioning import assert_app_version_at_least
+from test_support.nav import iter_tabs
+from test_support.templates import compose_if_admin_settings
+from test_support.nav import iter_tabs
 
 
 ROOT = Path(__file__).resolve().parents[1]
 
 
 def read_text(relative_path):
-    return (ROOT / relative_path).read_text(encoding="utf-8")
+    _path = ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def test_workflow_access_control_wiring():
@@ -114,9 +120,11 @@ def test_workflow_access_control_wiring():
     assert 'id="require_member_of_workflow_user"' in admin_template_content, (
         "Expected admin WorkflowUser requirement toggle markup."
     )
-    assert 'data-section="workflow-settings-section"' in sidebar_template_content, (
-        "Expected Admin Settings sidebar navigation to link to Workflow settings."
-    )
+    assert any(
+        section["id"] == "workflow-settings-section"
+        for _, tab in iter_tabs()
+        for section in tab["sections"]
+    ), "Expected Admin Settings navigation to link to Workflow settings."
 
     assert '{% if settings.allow_user_workflows %}' in workspace_template_content, (
         "Expected workspace workflow tab and modals to be gated by effective workflow access."
diff --git a/functional_tests/test_workflow_auto_invoke_attempt_settings.py b/functional_tests/test_workflow_auto_invoke_attempt_settings.py
index 0f3d80b17..23365d588 100644
--- a/functional_tests/test_workflow_auto_invoke_attempt_settings.py
+++ b/functional_tests/test_workflow_auto_invoke_attempt_settings.py
@@ -13,13 +13,17 @@
 
 from pathlib import Path
 from test_support.versioning import assert_app_version_at_least
+from test_support.templates import compose_if_admin_settings
 
 
 ROOT = Path(__file__).resolve().parents[1]
 
 
 def read_text(relative_path: str) -> str:
-    return (ROOT / relative_path).read_text(encoding="utf-8")
+    _path = ROOT / relative_path
+    return compose_if_admin_settings(
+        _path, _path.read_text(encoding="utf-8")
+    )
 
 
 def test_workflow_auto_invoke_attempt_settings_wiring() -> None: