feat(go/M2.6): port domain/synch.GenerateSyncID

SHA-256 dedup hash from sync_fio_to_sheets.py generate_sync_id.
Key subtlety: Python str(float) emits "500.0" for whole-valued floats
and switches to scientific notation at |f|>=1e16 or |f|<1e-4 —
replicated via formatAmount using 'f'/'e' format selection.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.claude/settings.json

@@ -0,0 +1,16 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git add:*)",
+      "Bash(go version *)",
+      "Bash(go mod *)",
+      "Bash(golangci-lint run *)",
+      "Bash(golangci-lint --version)",
+      "Bash(gofumpt *)",
+      "Bash(./bin/fuj help *)",
+      "Bash(./bin/fuj version *)",
+      "Bash(make go-test *)",
+      "Bash(make go-lint *)"
+    ]
+  }
+}

.gitea/workflows/build.yaml

@@ -31,5 +31,35 @@ jobs:
             TAG=${{ inputs.tag }}
           fi
           IMAGE=gitea.home.hrajfrisbee.cz/${{ github.repository }}:$TAG
-          docker build -f build/Dockerfile -t $IMAGE .
+          docker build -f build/Dockerfile \
+            --build-arg GIT_TAG=$TAG \
+            --build-arg GIT_COMMIT=${{ github.sha }} \
+            --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
+            -t $IMAGE .
+          docker push $IMAGE
+
+  build-go:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Login to Gitea registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin gitea.home.hrajfrisbee.cz
+
+      - name: Build and push Go image
+        run: |
+          TAG=${{ github.ref_name }}
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            TAG=${{ inputs.tag }}
+          fi
+          IMAGE=gitea.home.hrajfrisbee.cz/${{ github.repository }}:$TAG-go
+          docker build -f go/build/Dockerfile \
+            --build-arg GIT_TAG=$TAG \
+            --build-arg GIT_COMMIT=${{ github.sha }} \
+            --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
+            -t $IMAGE go/
           docker push $IMAGE

.gitignore

@@ -1,3 +1,9 @@
 # python cache
 **/*.pyc
 .secret
+
+# local tmp folder
+tmp/
+
+# go build output
+bin/

.vscode/launch.json

@@ -0,0 +1,33 @@
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Python Debugger: Flask",
+            "type": "debugpy",
+            "request": "launch",
+            "module": "flask",
+            "python": "${workspaceFolder}/.venv/bin/python",
+            "env": {
+                "FLASK_APP": "app.py",
+                "FLASK_DEBUG": "1"
+            },
+            "args": [
+                "run",
+                "--no-debugger",
+                "--no-reload",
+                "--host", "0.0.0.0",
+                "--port", "5001"
+            ],
+            "jinja": true
+        },
+        {
+            "name": "Python Debugger: Attach",
+            "type": "debugpy",
+            "request": "attach",
+            "connect": {
+                "host": "localhost",
+                "port": 5678
+            }
+        }
+    ]
+}

CHANGELOG.md

@@ -0,0 +1,70 @@
+# Changelog
+
+## 2026-05-06 12:43 CEST — feat(go/M2.6): port domain/synch.GenerateSyncID
+
+- New `go/internal/domain/synch` package with `GenerateSyncID(Transaction) string` ported from `scripts/sync_fio_to_sheets.py` `generate_sync_id`.
+- Byte-stable SHA-256 hash over `date|amount|currency|sender|vs|message|bank_id` (lowercased, UTF-8); `Currency: ""` defaults to `"CZK"` matching the Python missing-key fallback.
+- Key subtlety: Python's `str(float)` emits `"500.0"` for whole-valued floats and switches to scientific notation at `|f| >= 1e16` or `|f| < 1e-4` — replicated in `formatAmount` using `'f'`/`'e'` format selection.
+- 6 table-driven hash tests + 9 `formatAmount` tests; all expected values verified against live Python on 2026-05-06.
+
+## 2026-05-06 09:38 CEST — feat(go/M2.5): port domain/money.ParseCZK
+
+- New `go/internal/domain/money` package with `ParseCZK(string) (float64, error)` ported from `scripts/infer_payments.py` `parse_czk_amount`.
+- Preserves the Czech-locale heuristic: comma → decimal sep; 2+ dots → thousand seps; single dot → decimal (so `"1.500"` → `1.5`).
+- Returns `(0, ErrInvalidAmount)` on parse failure; callers wanting Python's silent-zero contract use `v, _ := ParseCZK(s)`.
+- 15 table-driven tests plus a silent-zero contract test; all expected values verified against live Python on 2026-05-06.
+
+## 2026-05-06 09:24 CEST — feat(go/M2.3+M2.4): port domain/fees.CalculateFee and CalculateJuniorFee
+
+- New `go/internal/domain/fees` package with adult and junior fee calculators ported from `scripts/attendance.py`.
+- `CalculateFee(count, monthKey) int` — `0→0`, `1→200`, `2+→AdultFeeMonthlyRate[month]` (fallback 700 CZK).
+- `CalculateJuniorFee(count, monthKey) Expected` — `0→{0}`, `1→{Unknown:true}` (the `"?"` sentinel, now strictly typed), `2+→JuniorFeeMonthlyRate[month]` (fallback 500 CZK).
+- 20 table-driven tests, all verified against live Python; `-race` clean; `golangci-lint` clean.
+
+## 2026-05-06 00:07 CEST — feat(go/M2.2): port czech.ParseMonthReferences
+
+- `internal/domain/czech.ParseMonthReferences`: three-pass regex (numeric slash, dot, Czech month names) with range wrap-around and `m≥10 → previousYear` heuristic, byte-equivalent to Python.
+- 35 table-driven tests; all expected outputs verified against live Python before locking (addresses risk #4 from the rewrite plan).
+
+## 2026-05-05 23:33 CEST — feat(go/M2.1): port czech.Normalize
+
+- First M2 pure-domain task: `internal/domain/czech.Normalize` (NFKD + Mn-strip + lowercase), byte-equivalent to Python `czech_utils.normalize`.
+- Adds `golang.org/x/text v0.36.0` as first external Go dependency.
+- 13-case table-driven test, all spot-checked against Python before locking.
+
+## 2026-05-04 23:08 CEST — fix: payment inference exact-match short-circuit
+
+- `match_members()` now short-circuits on whole-word full-name hits; nickname/partial checks only run when no full name is present.
+- Replaced bare `in` substring checks with `_word_in()` word-boundary regex throughout, closing the class of bugs where a short nickname (e.g. `tov`) matches inside another member's surname (`ottova`).
+- Added `tests/test_match_members.py` (6 cases). Affects `scripts/match_payments.py`.
+
+## 2026-05-04 23:08 CEST — feat: lower adult monthly fee to 700 CZK from April 2026
+
+- `ADULT_FEE_DEFAULT` reduced from 750 → 700 CZK.
+- `ADULT_FEE_MONTHLY_RATE` now pins Sep 2025 – Feb 2026 at 750 to preserve historical billing; Mar 2026 stays 350; Apr–May 2026 at 700. Affects `scripts/attendance.py`.
+
+## 2026-05-04 12:02 CEST — Go rewrite M1: skeleton + tooling
+
+- Created `go/` tree with module `fuj-management/go` (Go 1.26).
+- `cmd/fuj`: stdlib-flag subcommand dispatcher; `server` and `version` implemented, stubs for M2/M4 commands.
+- `internal/config`: env loader mirroring `scripts/config.py` (same env var names and defaults).
+- `internal/logging`: slog setup accepting log level from config.
+- `internal/web`: `net/http` ServeMux on `:8080`; `middleware/timer.go` logs method/path/status/ms.
+- `go/build/Dockerfile`: multi-stage (`golang:1.26` → `alpine:3`) producing a static binary image.
+- Makefile: `web` → `web-py` alias; added `web-go`, `go-build`, `go-test`, `go-run`, `go-lint`.
+- `.gitea/workflows/build.yaml`: parallel `build-go` job pushing `<tag>-go` image.
+- Gate: `make go-build`, `make go-lint`, `make go-test`, `curl :8080` all pass.
+
+## 2026-05-03 20:37 CEST — Fix Balance column to correctly reflect past-month debt
+
+- Balance (and Pay-All) are now computed as `sum(paid − expected)` over past months only, iterating directly over the ledger entries from `reconcile()`.
+- Previously the balance used `total_balance` (which includes current/future-month activity and out-of-window credits) plus a one-sided current-month debt adjustment. Current-month *surplus* leaked through, making the balance appear less negative than the actual past-month debt.
+- Pay-All is now `max(0, −balance)` so the two values are derived from a single source and can never disagree.
+- Affected: `adults_view()` and `juniors_view()` in `app.py`.
+
+## 2026-05-03 19:26 CEST — Fee-aware allocation for multi-month payments
+
+- `reconcile()` no longer splits a multi-month payment evenly. Allocation is now per-member with two phases: greedy (if amount ≥ total expected, each month gets exactly its expected fee and overflow → credit) and proportional (otherwise distribute by each month's expected). Fixes the case where e.g. 1250 CZK covering 3 months with mixed fees (750/350/150) marked two months red.
+- Out-of-window months keep the previous even-split-to-credit behavior. Fallback to even split when all matched months have `expected = 0` (prepayment before attendance is recorded).
+- Display layer only — no changes to how payments are stored in Google Sheets; `Inferred Amount` still holds the full bank amount.
+- Files: [scripts/match_payments.py](scripts/match_payments.py), [tests/test_reconcile_exceptions.py](tests/test_reconcile_exceptions.py) (6 new test cases).

CLAUDE.md

@@ -4,44 +4,156 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Status
 
-This is a greenfield project in early discovery/design phase. No source code exists yet. The project aims to automate financial and operational management for a small sports club.
-
-See `docs/project-notes.md` for the current brainstorming state, domain model, and open questions that need answering before implementation begins.
+Flask-based financial management system for FUJ (Frisbee Ultimate Jablonec). Handles attendance-based fee calculation, Fio bank transaction sync, payment reconciliation, and a web dashboard.
 
 ## Key Constraints
 
 - **PII separation**: Member data (names, emails, payment info) must never be committed to git. Enforce config/data separation from day one.
-- **Incremental approach**: Start with highest-ROI automation (likely fee billing & payment tracking), not a full platform.
-
-## Development Workflow
-
-This project uses a hybrid workflow:
-- Claude.ai chat for brainstorming and design exploration
-- Claude Code for implementation
-
-## When Code Exists
+- **Configuration**: External service IDs, credentials, and tunable parameters are centralized in `scripts/config.py`. Domain-specific constants (fees, merged months) stay in their respective modules.
 
 ## Development Setup
 
 This project uses `uv` for dependency management.
 
 ```bash
-uv venv          # Create virtual environment
-uv sync          # Install dependencies from pyproject.toml
+uv venv && uv sync
 source .venv/bin/activate
 ```
 
-Alternatively, use the Makefile:
-- `make sync`      - Sync bank transactions to Google Sheets
-- `make infer`     - Automatically infer Person/Purpose/Amount in the sheet
-- `make reconcile` - Generate balance report from Google Sheets data
-- `make fees`      - Calculate expected fees from attendance
-- `make match`     - (Legacy) Match bank data directly
-- `make web`       - Start dashboard
-- `make image`     - Build Docker image
+Set `PYTHONPATH=scripts:.` when running scripts directly (the Makefile does this automatically).
 
-Requires `credentials.json` in the root for Google Sheets API access.
+## Commands
+
+```bash
+make web          # Start dashboard at http://localhost:5001
+make web-debug    # Same with FLASK_DEBUG=1
+make test         # Run all tests (unittest discover)
+make test-v       # Tests with verbose output
+make fees         # Print fee report from attendance sheet
+make sync-2026    # Sync Fio bank transactions for 2026 to Google Sheets
+make infer        # Auto-fill Person/Purpose/Amount columns in payments sheet
+make reconcile    # Print balance report from Google Sheets data
+make image        # Build Docker image
+```
+
+Run a single test:
+```bash
+PYTHONPATH=scripts:. python -m unittest tests.test_app.TestWebApp.test_adults_route
+```
+
+## Architecture
+
+### Data flow
+
+```
+Google Sheets (attendance) ──► attendance.py ──► reconcile() ──► Flask routes ──► templates/
+Google Sheets (payments)   ──► match_payments.py ──┘
+Fio Bank API               ──► sync_fio_to_sheets.py ──► Google Sheets (payments)
+```
+
+### Key modules
+
+- `app.py` — Flask app; routes for `/adults`, `/juniors`, `/payments`, `/sync-bank`, `/qr`, `/flush-cache`
+- `scripts/attendance.py` — Fetches attendance CSV from Google Sheets, computes per-member per-month fees. Contains fee rate constants (`ADULT_FEE_DEFAULT`, `JUNIOR_FEE_DEFAULT`) and `ADULT_MERGED_MONTHS` / `JUNIOR_MERGED_MONTHS` dicts.
+- `scripts/match_payments.py` — `reconcile()` matches transactions to members/months. `fetch_sheet_data()` reads the payments sheet. `fetch_exceptions()` reads the `exceptions` tab.
+- `scripts/cache_utils.py` — Invalidation via Google Drive API `modifiedTime`; falls back to 5-minute TTL buckets when Drive API is unavailable. Cache files live in `tmp/`.
+- `scripts/sync_fio_to_sheets.py` — Pulls Fio bank transactions and appends them to the payments Google Sheet.
+- `scripts/infer_payments.py` — Fills in Person/Purpose/Inferred Amount columns using name-matching heuristics.
+- `scripts/config.py` — All external IDs, paths, and tunable TTLs. Override via env vars (`CREDENTIALS_PATH`, `BANK_ACCOUNT`, `CACHE_TTL_SECONDS`).
+
+### Member tiers
+
+Tiers are set in column B of the attendance sheet:
+- `A` — Adult, pays fees (per-month rate from `ADULT_FEE_MONTHLY_RATE`, fallback 700 CZK for 2+ sessions; 200 CZK for exactly 1)
+- `J` — Junior attending adult practices; their attendance is merged with the junior sheet
+- `X` — Excluded from junior fee calculation (coaches, etc.)
+
+### Fee calculation
+
+- Adults: 0 sessions → 0, 1 session → 200 CZK, 2+ sessions → monthly rate (default 700 CZK)
+- Juniors: 0 → 0, 1 → `"?"` (manual review required), 2+ → monthly rate (default 500 CZK)
+- Per-member per-month overrides live in the `exceptions` tab of the payments sheet (columns: Name, Period YYYY-MM, Amount, Note). Exceptions are keyed by `(normalize(name), normalize(period))`.
+
+### Merged months
+
+`ADULT_MERGED_MONTHS` / `JUNIOR_MERGED_MONTHS` in `attendance.py` map a source month to a target month (e.g., `"2025-12": "2026-01"` merges December into January billing). The target month accumulates attendance from both months.
+
+### Caching
+
+`get_cached_data()` in `app.py` checks the Drive API `modifiedTime` before each request and serves a JSON file from `tmp/` when the sheet hasn't changed. Cache is warmed up at startup (`warmup_cache()`). Flush via `/flush-cache` (POST) or `flush_cache()`.
+
+### Payments sheet columns
+
+`Date | Amount | manual fix | Person | Purpose | Inferred Amount | Sender | VS | Message | Bank ID | Sync ID`
+
+`Person` and `Purpose` are written by `infer_payments.py` and can be manually corrected. `manual fix` column presence disables re-inference for that row. Multiple people or months are comma-separated in Person/Purpose.
+
+### QR codes
+
+`/qr?account=…&amount=…&message=…` generates a Czech QR Platba PNG (SPD format).
+
+## Branching & merge requests
+
+The remote is Gitea (`gitea.home.hrajfrisbee.cz/kacerr/fuj-management`).
+For **features**, do not commit to `main` directly. Use a branch + merge
+request flow:
+
+1. **Create a branch off `main`** before starting work:
+   - `feat/<slug>` for features (e.g. `feat/qr-code-overlay`)
+   - `fix/<slug>` for bug-fix branches the user explicitly asks for
+   - `<slug>` is short kebab-case
+2. **Commit on the branch** following the existing commit conventions
+   (Co-Authored-By trailer, etc.).
+3. **Push the branch** to `origin` with `-u` so it tracks.
+4. **Open the MR with `tea`** rather than printing a compare URL:
+
+   ```bash
+   tea pr create \
+     --title "<short title>" \
+     --description "<body>" \
+     --base main \
+     --head <branch>
+   ```
+
+   `tea` is already authenticated against the Gitea instance; just run it.
+   Print the resulting PR URL for the user. If `tea` is unavailable for
+   some reason, fall back to printing the compare URL
+   (`https://gitea.home.hrajfrisbee.cz/kacerr/fuj-management/compare/main...<branch>`)
+   and let the user open the MR manually.
+5. **Do not merge or delete the branch** from the CLI — neither via `tea`,
+   `gh`, nor `git push --delete`. The user does that in Gitea.
+
+**Exceptions — when committing straight to `main` is fine:**
+- Small bug fixes / hotfixes the user describes as such.
+- Typo / comment / formatting tweaks.
+- Edits the user explicitly says to push to `main`.
+
+When uncertain whether something is a feature or a small fix, ask before
+committing.
 
 ## Git Commits
 
-When making git commits, always append yourself as co-author trailer to the end of the commit message to indicate AI assistance
+When making git commits, always append yourself as co-author trailer to the end of the commit message to indicate AI assistance
+
+## Changelog
+
+Maintain a running changelog in `CHANGELOG.md` at the repo root. After every significant change, fix, or update — once the user confirms it works — append a new entry **at the top** of the file in this format:
+
+```markdown
+## YYYY-MM-DD HH:MM TZ — short title
+
+- One-line summary of what changed and why.
+- Key files touched (optional, only if useful for traceability).
+```
+
+Get the timestamp with `date "+%Y-%m-%d %H:%M %Z"`. Skip trivial edits (typos, formatting, comment tweaks); only log changes a future reader would care about.
+
+## Plans
+
+When Claude Code's plan mode is used, save the plan file inside the repo at
+`docs/plans/YYYY-MM-DD-HHMM-<slug>.md` instead of the default `~/.claude/plans/`
+location. Get the timestamp with `date "+%Y-%m-%d-%H%M"` (matches the changelog
+convention). The `<slug>` should be a short kebab-case summary of the plan's topic.
+
+Create the `docs/plans/` directory on first use. Plan files are committed to the
+repo so other contributors can review historical decisions.

Makefile

@@ -1,10 +1,13 @@
-.PHONY: help fees match web image run sync sync-2026 test test-v docs
+.PHONY: help fees match web web-py web-debug web-go go-build go-test go-run go-lint image run sync sync-2026 test test-v docs
 
 export PYTHONPATH := scripts:$(PYTHONPATH)
 VENV := .venv
 PYTHON := $(VENV)/bin/python3
 CREDENTIALS := .secret/fuj-management-bot-credentials.json
 
+GO_SRC := go
+GO_BIN := bin/fuj
+
 $(PYTHON): .venv/.last_sync
 
 .venv/.last_sync: pyproject.toml
@@ -13,19 +16,25 @@ $(PYTHON): .venv/.last_sync
 
 help:
 	@echo "Available targets:"
-	@echo "  make fees   - Calculate monthly fees from the attendance sheet"
-	@echo "  make match  - Match Fio bank payments against expected attendance fees"
-	@echo "  make web    - Start a dynamic web dashboard locally"
-	@echo "  make image  - Build an OCI container image"
-	@echo "  make run    - Run the built Docker image locally"
+	@echo "  make fees        - Calculate monthly fees from the attendance sheet"
+	@echo "  make match       - Match Fio bank payments against expected attendance fees"
+	@echo "  make web         - Start Python dashboard (alias for web-py, until M8)"
+	@echo "  make web-py      - Start Python dashboard on :5001"
+	@echo "  make web-go      - Build and start Go dashboard on :8080"
+	@echo "  make web-debug   - Start Python dashboard in debug mode"
+	@echo "  make go-build    - Build Go binary to bin/fuj"
+	@echo "  make go-test     - Run Go tests"
+	@echo "  make go-lint     - Run golangci-lint on Go code"
+	@echo "  make image       - Build Python OCI container image"
+	@echo "  make run         - Run the built Python Docker image locally"
 	@echo "  make sync        - Sync Fio transactions to Google Sheets"
 	@echo "  make sync-2025   - Sync Fio transactions for Q4 2025 (Oct-Dec)"
 	@echo "  make sync-2026   - Sync Fio transactions for the whole year of 2026"
 	@echo "  make infer       - Infer payment details (Person, Purpose, Amount) in the sheet"
 	@echo "  make reconcile   - Show balance report using Google Sheets data"
 	@echo "  make venv        - Sync virtual environment with pyproject.toml"
-	@echo "  make test        - Run web application infrastructure tests"
-	@echo "  make test-v      - Run tests with verbose output"
+	@echo "  make test        - Run Python web application infrastructure tests"
+	@echo "  make test-v      - Run Python tests with verbose output"
 	@echo "  make docs        - Serve documentation in a browser"
 
 venv:
@@ -37,11 +46,39 @@ fees: $(PYTHON)
 match: $(PYTHON)
 	$(PYTHON) scripts/match_payments.py
 
-web: $(PYTHON)
+web: web-py
+
+web-py: $(PYTHON)
 	$(PYTHON) app.py
 
+web-debug: $(PYTHON)
+	FLASK_DEBUG=1 $(PYTHON) app.py
+
+go-build:
+	cd $(GO_SRC) && go build -trimpath \
+	  -ldflags "-X main.version=$$(git describe --tags --always 2>/dev/null || echo dev) \
+	            -X main.commit=$$(git rev-parse --short HEAD) \
+	            -X main.buildDate=$$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+	  -o ../$(GO_BIN) ./cmd/fuj
+
+go-test:
+	cd $(GO_SRC) && go test -race ./...
+
+go-run: go-build
+	./$(GO_BIN) $(ARGS)
+
+go-lint:
+	cd $(GO_SRC) && golangci-lint run ./...
+
+web-go: go-build
+	./$(GO_BIN) server
+
 image:
-	docker build -t fuj-management:latest -f build/Dockerfile .
+	docker build -t fuj-management:latest \
+		--build-arg GIT_TAG=$$(git describe --tags --always 2>/dev/null || echo "untagged") \
+		--build-arg GIT_COMMIT=$$(git rev-parse --short HEAD) \
+		--build-arg BUILD_DATE=$$(date -u +%Y-%m-%dT%H:%M:%SZ) \
+		-f build/Dockerfile .
 
 run:
 	docker run -it --rm -p 5001:5001 -v $(CURDIR)/.secret:/app/.secret:ro fuj-management:latest

app.py

@@ -6,14 +6,37 @@ import time
 import os
 import io
 import qrcode
+import logging
 from flask import Flask, render_template, g, send_file, request
 
+# Configure logging, allowing override via LOG_LEVEL environment variable
+log_level = os.environ.get("LOG_LEVEL", "INFO").upper()
+logging.basicConfig(level=getattr(logging, log_level, logging.INFO), format='%(asctime)s - %(name)s:%(filename)s:%(lineno)d [%(funcName)s] - %(levelname)s - %(message)s')
+
 # Add scripts directory to path to allow importing from it
 scripts_dir = Path(__file__).parent / "scripts"
 sys.path.append(str(scripts_dir))
 
-from attendance import get_members_with_fees, get_junior_members_with_fees, SHEET_ID as ATTENDANCE_SHEET_ID, JUNIOR_SHEET_GID, ADULT_MERGED_MONTHS, JUNIOR_MERGED_MONTHS
-from match_payments import reconcile, fetch_sheet_data, fetch_exceptions, normalize, DEFAULT_SPREADSHEET_ID as PAYMENTS_SHEET_ID
+from config import (
+    ATTENDANCE_SHEET_ID, PAYMENTS_SHEET_ID, JUNIOR_SHEET_GID,
+    BANK_ACCOUNT, CREDENTIALS_PATH,
+)
+from attendance import get_members_with_fees, get_junior_members_with_fees, ADULT_MERGED_MONTHS, JUNIOR_MERGED_MONTHS
+from match_payments import reconcile, fetch_sheet_data, fetch_exceptions, normalize, canonical_member_key
+from cache_utils import get_sheet_modified_time, read_cache, write_cache, _LAST_CHECKED, flush_cache
+from sync_fio_to_sheets import sync_to_sheets
+from infer_payments import infer_payments
+
+def get_cached_data(cache_key, sheet_id, fetch_func, *args, serialize=None, deserialize=None, **kwargs):
+    mod_time = get_sheet_modified_time(cache_key)
+    if mod_time:
+        cached = read_cache(cache_key, mod_time)
+        if cached is not None:
+            return deserialize(cached) if deserialize else cached
+    data = fetch_func(*args, **kwargs)
+    if mod_time:
+        write_cache(cache_key, mod_time, serialize(data) if serialize else data)
+    return data
 
 def get_month_labels(sorted_months, merged_months):
     labels = {}
@@ -34,10 +57,50 @@ def get_month_labels(sorted_months, merged_months):
             labels[m] = dt.strftime("%b %Y")
     return labels
 
+def group_payments_by_person(transactions, member_names=None):
+    canonical_by_key = (
+        {canonical_member_key(n): n for n in member_names} if member_names else {}
+    )
+    grouped = {}
+    for tx in transactions:
+        person = str(tx.get("person", "")).strip()
+        if not person:
+            continue
+        for p in person.split(","):
+            p = re.sub(r"\[\?\]\s*", "", p).strip()
+            if not p:
+                continue
+            key = canonical_by_key.get(canonical_member_key(p), p)
+            grouped.setdefault(key, []).append(tx)
+    for rows in grouped.values():
+        rows.sort(key=lambda t: str(t.get("date", "")), reverse=True)
+    return grouped
+
+def warmup_cache():
+    """Pre-fetch all cached data so first request is fast."""
+    logger = logging.getLogger(__name__)
+    logger.info("Warming up cache...")
+    credentials_path = CREDENTIALS_PATH
+
+    get_cached_data("attendance_regular", ATTENDANCE_SHEET_ID, get_members_with_fees)
+    get_cached_data("attendance_juniors", ATTENDANCE_SHEET_ID, get_junior_members_with_fees)
+    get_cached_data("payments_transactions", PAYMENTS_SHEET_ID, fetch_sheet_data, PAYMENTS_SHEET_ID, credentials_path)
+    get_cached_data("exceptions_dict", PAYMENTS_SHEET_ID, fetch_exceptions,
+        PAYMENTS_SHEET_ID, credentials_path,
+        serialize=lambda d: [[list(k), v] for k, v in d.items()],
+        deserialize=lambda c: {tuple(k): v for k, v in c},
+    )
+    logger.info("Cache warmup complete.")
+
 app = Flask(__name__)
 
-# Bank account for QR code payments (can be overridden by ENV)
-BANK_ACCOUNT = os.environ.get("BANK_ACCOUNT", "CZ8520100000002800359168")
+import json as _json
+_meta_path = Path(__file__).parent / "build_meta.json"
+BUILD_META = _json.loads(_meta_path.read_text()) if _meta_path.exists() else {
+    "tag": "dev", "commit": "local", "build_date": ""
+}
+
+warmup_cache()
 
 @app.before_request
 def start_timer():
@@ -66,254 +129,242 @@ def inject_render_time():
             "total": f"{total:.3f}",
             "breakdown": " | ".join(breakdown)
         }
-    return dict(get_render_time=get_render_time)
+    return dict(get_render_time=get_render_time, build_meta=BUILD_META)
 
 @app.route("/")
 def index():
-    # Redirect root to /fees for convenience while there are no other apps
-    return '<meta http-equiv="refresh" content="0; url=/fees" />'
+    # Redirect root to /adults for convenience while there are no other apps
+    return '<meta http-equiv="refresh" content="0; url=/adults" />'
 
-@app.route("/fees")
-def fees():
+@app.route("/flush-cache", methods=["GET", "POST"])
+def flush_cache_endpoint():
+    if request.method == "GET":
+        return render_template("flush-cache.html")
+    deleted = flush_cache()
+    return render_template("flush-cache.html", flushed=True, deleted=deleted)
+
+@app.route("/sync-bank")
+def sync_bank():
+    import contextlib
+    output = io.StringIO()
+    success = True
+    try:
+        with contextlib.redirect_stdout(output), contextlib.redirect_stderr(output):
+            # sync_to_sheets: equivalent of make sync-2026
+            output.write("=== Syncing Fio transactions (2026) ===\n")
+            sync_to_sheets(
+                spreadsheet_id=PAYMENTS_SHEET_ID,
+                credentials_path=CREDENTIALS_PATH,
+                date_from_str="2026-01-01",
+                date_to_str="2026-12-31",
+                sort_by_date=True,
+            )
+            output.write("\n=== Inferring payment details ===\n")
+            infer_payments(PAYMENTS_SHEET_ID, CREDENTIALS_PATH)
+            output.write("\n=== Flushing cache ===\n")
+            deleted = flush_cache()
+            output.write(f"Deleted {deleted} cache files.\n")
+            output.write("\n=== Done ===\n")
+    except Exception as e:
+        import traceback
+        output.write(f"\n!!! Error: {e}\n")
+        output.write(traceback.format_exc())
+        success = False
+    return render_template("sync.html", output=output.getvalue(), success=success)
+
+@app.route("/version")
+def version():
+    return BUILD_META
+
+@app.route("/adults")
+def adults_view():
     attendance_url = f"https://docs.google.com/spreadsheets/d/{ATTENDANCE_SHEET_ID}/edit"
     payments_url = f"https://docs.google.com/spreadsheets/d/{PAYMENTS_SHEET_ID}/edit"
+    credentials_path = CREDENTIALS_PATH
     
-    members, sorted_months = get_members_with_fees()
+    members_data = get_cached_data("attendance_regular", ATTENDANCE_SHEET_ID, get_members_with_fees)
     record_step("fetch_members")
-    if not members:
-        return "No data."
-
-    # Filter to adults only for display
-    results = [(name, fees) for name, tier, fees in members if tier == "A"]
-
-    # Format month labels
-    month_labels = get_month_labels(sorted_months, ADULT_MERGED_MONTHS)
-
-    monthly_totals = {m: 0 for m in sorted_months}
-    
-    # Get exceptions for formatting
-    credentials_path = ".secret/fuj-management-bot-credentials.json"
-    exceptions = fetch_exceptions(PAYMENTS_SHEET_ID, credentials_path)
-    record_step("fetch_exceptions")
-    
-    formatted_results = []
-    for name, month_fees in results:
-        row = {"name": name, "months": []}
-        norm_name = normalize(name)
-        for m in sorted_months:
-            fee, count = month_fees.get(m, (0, 0))
-            
-            # Check for exception
-            norm_period = normalize(m)
-            ex_data = exceptions.get((norm_name, norm_period))
-            override_amount = ex_data["amount"] if ex_data else None
-            
-            if override_amount is not None and override_amount != fee:
-                cell = f"{override_amount} ({fee}) CZK ({count})" if count > 0 else f"{override_amount} ({fee}) CZK"
-                is_overridden = True
-            else:
-                if isinstance(fee, int):
-                    monthly_totals[m] += fee
-                cell = f"{fee} CZK ({count})" if count > 0 else "-"
-                is_overridden = False
-            row["months"].append({"cell": cell, "overridden": is_overridden})
-        formatted_results.append(row)
-
-    record_step("process_data")
-
-    return render_template(
-        "fees.html", 
-        months=[month_labels[m] for m in sorted_months], 
-        results=formatted_results,
-        totals=[f"{monthly_totals[m]} CZK" for m in sorted_months],
-        attendance_url=attendance_url,
-        payments_url=payments_url
-    )
-
-@app.route("/fees-juniors")
-def fees_juniors():
-    attendance_url = f"https://docs.google.com/spreadsheets/d/{ATTENDANCE_SHEET_ID}/edit#gid={JUNIOR_SHEET_GID}"
-    payments_url = f"https://docs.google.com/spreadsheets/d/{PAYMENTS_SHEET_ID}/edit"
-    
-    members, sorted_months = get_junior_members_with_fees()
-    record_step("fetch_junior_members")
-    if not members:
-        return "No data."
-
-    # Sort members by name
-    results = sorted([(name, fees) for name, tier, fees in members], key=lambda x: x[0])
-
-    # Format month labels
-    month_labels = get_month_labels(sorted_months, JUNIOR_MERGED_MONTHS)
-
-    monthly_totals = {m: 0 for m in sorted_months}
-    
-    # Get exceptions for formatting (reusing payments sheet)
-    credentials_path = ".secret/fuj-management-bot-credentials.json"
-    exceptions = fetch_exceptions(PAYMENTS_SHEET_ID, credentials_path)
-    record_step("fetch_exceptions")
-    
-    formatted_results = []
-    for name, month_fees in results:
-        row = {"name": name, "months": []}
-        norm_name = normalize(name)
-        for m in sorted_months:
-            fee_data = month_fees.get(m, (0, 0, 0, 0))
-            if len(fee_data) == 4:
-                fee, total_count, adult_count, junior_count = fee_data
-            else:
-                fee, total_count = fee_data
-                adult_count, junior_count = 0, 0
-                
-            # Check for exception
-            norm_period = normalize(m)
-            ex_data = exceptions.get((norm_name, norm_period))
-            override_amount = ex_data["amount"] if ex_data else None
-            
-            if ex_data is None and isinstance(fee, int):
-                monthly_totals[m] += fee
-            
-            # Formulate the count string display
-            if adult_count > 0 and junior_count > 0:
-                count_str = f"{total_count} ({adult_count}A+{junior_count}J)"
-            elif adult_count > 0:
-                count_str = f"{total_count} (A)"
-            elif junior_count > 0:
-                count_str = f"{total_count} (J)"
-            else:
-                count_str = f"{total_count}"
-            
-            if override_amount is not None and override_amount != fee:
-                cell = f"{override_amount} ({fee}) CZK / {count_str}" if total_count > 0 else f"{override_amount} ({fee}) CZK"
-                is_overridden = True
-            else:
-                if fee == "?":
-                    cell = f"? / {count_str}" if total_count > 0 else "-"
-                else:
-                    cell = f"{fee} CZK / {count_str}" if total_count > 0 else "-"
-                is_overridden = False
-            row["months"].append({"cell": cell, "overridden": is_overridden})
-        formatted_results.append(row)
-
-    record_step("process_data")
-
-    return render_template(
-        "fees-juniors.html", 
-        months=[month_labels[m] for m in sorted_months], 
-        results=formatted_results,
-        totals=[f"{t} CZK" if isinstance(t, int) else t for t in monthly_totals.values()],
-        attendance_url=attendance_url,
-        payments_url=payments_url
-    )
-
-@app.route("/reconcile")
-def reconcile_view():
-    attendance_url = f"https://docs.google.com/spreadsheets/d/{ATTENDANCE_SHEET_ID}/edit"
-    payments_url = f"https://docs.google.com/spreadsheets/d/{PAYMENTS_SHEET_ID}/edit"
-    
-    # Use hardcoded credentials path for now, consistent with other scripts
-    credentials_path = ".secret/fuj-management-bot-credentials.json"
-    
-    members, sorted_months = get_members_with_fees()
-    record_step("fetch_members")
-    if not members:
+    if not members_data:
         return "No data."
+    members, sorted_months = members_data
         
-    transactions = fetch_sheet_data(PAYMENTS_SHEET_ID, credentials_path)
+    transactions = get_cached_data("payments_transactions", PAYMENTS_SHEET_ID, fetch_sheet_data, PAYMENTS_SHEET_ID, credentials_path)
     record_step("fetch_payments")
-    exceptions = fetch_exceptions(PAYMENTS_SHEET_ID, credentials_path)
+    exceptions = get_cached_data(
+            "exceptions_dict", PAYMENTS_SHEET_ID, fetch_exceptions,
+            PAYMENTS_SHEET_ID, credentials_path,
+            serialize=lambda d: [[list(k), v] for k, v in d.items()],
+            deserialize=lambda c: {tuple(k): v for k, v in c},
+        )
     record_step("fetch_exceptions")
     result = reconcile(members, sorted_months, transactions, exceptions)
     record_step("reconcile")
     
-    # Format month labels
     month_labels = get_month_labels(sorted_months, ADULT_MERGED_MONTHS)
-    
-    # Filter to adults for the main table
     adult_names = sorted([name for name, tier, _ in members if tier == "A"])
-    
+    current_month = datetime.now().strftime("%Y-%m")
+
+    monthly_totals = {m: {"expected": 0, "paid": 0} for m in sorted_months}
     formatted_results = []
     for name in adult_names:
         data = result["members"][name]
-        row = {"name": name, "months": [], "balance": data["total_balance"], "unpaid_periods": ""}
+        row = {"name": name, "months": [], "balance": data["total_balance"], "unpaid_periods": "", "raw_unpaid_periods": ""}
         unpaid_months = []
+        raw_unpaid_months = []
         for m in sorted_months:
-            mdata = data["months"].get(m, {"expected": 0, "original_expected": 0, "paid": 0})
-            expected = mdata["expected"]
-            paid = int(mdata["paid"])
-            
+            mdata = data["months"].get(m, {"expected": 0, "original_expected": 0, "attendance_count": 0, "paid": 0, "exception": None})
+            expected = mdata.get("expected", 0)
+            original_expected = mdata.get("original_expected", 0)
+            count = mdata.get("attendance_count", 0)
+            paid = int(mdata.get("paid", 0))
+            exception_info = mdata.get("exception", None)
+
+            monthly_totals[m]["expected"] += expected
+            monthly_totals[m]["paid"] += paid
+
+            override_amount = exception_info["amount"] if exception_info else None
+
+            if override_amount is not None and override_amount != original_expected:
+                is_overridden = True
+                fee_display = f"{override_amount} ({original_expected}) CZK ({count})" if count > 0 else f"{override_amount} ({original_expected}) CZK"
+            else:
+                is_overridden = False
+                fee_display = f"{expected} CZK ({count})" if count > 0 else f"{expected} CZK"
+
             status = "empty"
             cell_text = "-"
             amount_to_pay = 0
-            
+
             if expected > 0:
+                amount_to_pay = max(0, expected - paid)
                 if paid >= expected:
                     status = "ok"
-                    cell_text = "OK"
+                    cell_text = f"{paid}/{fee_display}"
                 elif paid > 0:
                     status = "partial"
-                    cell_text = f"{paid}/{expected}"
-                    amount_to_pay = expected - paid
-                    unpaid_months.append(month_labels[m])
+                    cell_text = f"{paid}/{fee_display}"
+                    if m < current_month:
+                        unpaid_months.append(month_labels[m])
+                        raw_unpaid_months.append(datetime.strptime(m, "%Y-%m").strftime("%m/%Y"))
                 else:
                     status = "unpaid"
-                    cell_text = f"UNPAID {expected}"
-                    amount_to_pay = expected
-                    unpaid_months.append(month_labels[m])
+                    cell_text = f"0/{fee_display}"
+                    if m < current_month:
+                        unpaid_months.append(month_labels[m])
+                        raw_unpaid_months.append(datetime.strptime(m, "%Y-%m").strftime("%m/%Y"))
             elif paid > 0:
                 status = "surplus"
                 cell_text = f"PAID {paid}"
-            
+            else:
+                cell_text = "-"
+                amount_to_pay = 0
+
+            if expected > 0 or paid > 0:
+                tooltip = f"Received: {paid}, Expected: {expected}"
+            else:
+                tooltip = ""
+
             row["months"].append({
                 "text": cell_text,
+                "overridden": is_overridden,
                 "status": status,
                 "amount": amount_to_pay,
-                "month": month_labels[m]
+                "month": month_labels[m],
+                "raw_month": m,
+                "tooltip": tooltip
             })
-            
-        row["unpaid_periods"] = ", ".join(unpaid_months) if unpaid_months else ("Older debt" if data["total_balance"] < 0 else "")
-        row["balance"] = data["total_balance"] # Updated to use total_balance
+
+        # Balance = sum of (paid - expected) for past months only; current/future months ignored.
+        settled_balance = 0
+        for m, mdata in data["months"].items():
+            if m >= current_month:
+                continue
+            exp = mdata.get("expected", 0)
+            if isinstance(exp, int):
+                settled_balance += int(mdata.get("paid", 0)) - exp
+
+        payable_amount = max(0, -settled_balance)
+        row["unpaid_periods"] = ", ".join(unpaid_months)
+        row["raw_unpaid_periods"] = "+".join(raw_unpaid_months)
+        row["balance"] = settled_balance
+        row["payable_amount"] = payable_amount
         formatted_results.append(row)
-        
-    # Format credits and debts
-    credits = sorted([{"name": n, "amount": a["total_balance"]} for n, a in result["members"].items() if a["total_balance"] > 0 and n in adult_names], key=lambda x: x["name"])
-    debts = sorted([{"name": n, "amount": abs(a["total_balance"])} for n, a in result["members"].items() if a["total_balance"] < 0 and n in adult_names], key=lambda x: x["name"])
-    # Format unmatched
+
+    formatted_totals = []
+    for m in sorted_months:
+        t = monthly_totals[m]
+        status = "empty"
+        if t["expected"] > 0 or t["paid"] > 0:
+            if t["paid"] == t["expected"]:
+                status = "ok"
+            elif t["paid"] < t["expected"]:
+                status = "unpaid"
+            else:
+                status = "surplus"
+
+        formatted_totals.append({
+            "text": f"{t['paid']} / {t['expected']} CZK",
+            "status": status
+        })
+
+    def settled_balance(name):
+        data = result["members"][name]
+        total = 0
+        for m, mdata in data["months"].items():
+            if m >= current_month:
+                continue
+            exp = mdata.get("expected", 0)
+            if isinstance(exp, int):
+                total += int(mdata.get("paid", 0)) - exp
+        return total
+
+    credits = sorted([{"name": n, "amount": settled_balance(n)} for n in adult_names if settled_balance(n) > 0], key=lambda x: x["name"])
+    debts = sorted([{"name": n, "amount": abs(settled_balance(n))} for n in adult_names if settled_balance(n) < 0], key=lambda x: x["name"])
     unmatched = result["unmatched"]
     import json
     
+    raw_payments_by_person = group_payments_by_person(transactions, [name for name, _, _ in members])
     record_step("process_data")
 
     return render_template(
-        "reconcile.html",
+        "adults.html",
         months=[month_labels[m] for m in sorted_months],
         raw_months=sorted_months,
         results=formatted_results,
+        totals=formatted_totals,
         member_data=json.dumps(result["members"]),
         month_labels_json=json.dumps(month_labels),
+        raw_payments_json=json.dumps(raw_payments_by_person),
         credits=credits,
         debts=debts,
         unmatched=unmatched,
         attendance_url=attendance_url,
         payments_url=payments_url,
-        bank_account=BANK_ACCOUNT
+        bank_account=BANK_ACCOUNT,
+        current_month=current_month
     )
 
-@app.route("/reconcile-juniors")
-def reconcile_juniors_view():
+@app.route("/juniors")
+def juniors_view():
     attendance_url = f"https://docs.google.com/spreadsheets/d/{ATTENDANCE_SHEET_ID}/edit#gid={JUNIOR_SHEET_GID}"
     payments_url = f"https://docs.google.com/spreadsheets/d/{PAYMENTS_SHEET_ID}/edit"
     
-    credentials_path = ".secret/fuj-management-bot-credentials.json"
+    credentials_path = CREDENTIALS_PATH
     
-    junior_members, sorted_months = get_junior_members_with_fees()
+    junior_members_data = get_cached_data("attendance_juniors", ATTENDANCE_SHEET_ID, get_junior_members_with_fees)
     record_step("fetch_junior_members")
-    if not junior_members:
+    if not junior_members_data:
         return "No data."
+    junior_members, sorted_months = junior_members_data
         
-    transactions = fetch_sheet_data(PAYMENTS_SHEET_ID, credentials_path)
+    transactions = get_cached_data("payments_transactions", PAYMENTS_SHEET_ID, fetch_sheet_data, PAYMENTS_SHEET_ID, credentials_path)
     record_step("fetch_payments")
-    exceptions = fetch_exceptions(PAYMENTS_SHEET_ID, credentials_path)
+    exceptions = get_cached_data(
+            "exceptions_dict", PAYMENTS_SHEET_ID, fetch_exceptions,
+            PAYMENTS_SHEET_ID, credentials_path,
+            serialize=lambda d: [[list(k), v] for k, v in d.items()],
+            deserialize=lambda c: {tuple(k): v for k, v in c},
+        )
     record_step("fetch_exceptions")
 
     # Adapt junior tuple format (name, tier, {month: (fee, total_count, adult_count, junior_count)}) 
@@ -335,110 +386,196 @@ def reconcile_juniors_view():
     
     # Format month labels
     month_labels = get_month_labels(sorted_months, JUNIOR_MERGED_MONTHS)
-    
-    # Filter to juniors for the main table
     junior_names = sorted([name for name, tier, _ in adapted_members])
-    
+    junior_members_dict = {name: fees_dict for name, _, fees_dict in junior_members}
+    current_month = datetime.now().strftime("%Y-%m")
+
+    monthly_totals = {m: {"expected": 0, "paid": 0} for m in sorted_months}
     formatted_results = []
     for name in junior_names:
         data = result["members"][name]
-        row = {"name": name, "months": [], "balance": data["total_balance"], "unpaid_periods": ""}
+        row = {"name": name, "months": [], "balance": data["total_balance"], "unpaid_periods": "", "raw_unpaid_periods": ""}
         unpaid_months = []
+        raw_unpaid_months = []
         for m in sorted_months:
-            mdata = data["months"].get(m, {"expected": 0, "original_expected": 0, "paid": 0})
-            expected = mdata["expected"]
-            paid = int(mdata["paid"])
-            
+            mdata = data["months"].get(m, {"expected": 0, "original_expected": 0, "attendance_count": 0, "paid": 0, "exception": None})
+            expected = mdata.get("expected", 0)
+            original_expected = mdata.get("original_expected", 0)
+            count = mdata.get("attendance_count", 0)
+            paid = int(mdata.get("paid", 0))
+            exception_info = mdata.get("exception", None)
+
+            if expected != "?" and isinstance(expected, int):
+                monthly_totals[m]["expected"] += expected
+            monthly_totals[m]["paid"] += paid
+
+            orig_fee_data = junior_members_dict.get(name, {}).get(m)
+            adult_count = 0
+            junior_count = 0
+            if orig_fee_data and len(orig_fee_data) == 4:
+                _, _, adult_count, junior_count = orig_fee_data
+
+            breakdown = ""
+            if adult_count > 0 and junior_count > 0:
+                breakdown = f":{junior_count}J,{adult_count}A"
+            elif junior_count > 0:
+                breakdown = f":{junior_count}J"
+            elif adult_count > 0:
+                breakdown = f":{adult_count}A"
+
+            count_str = f" ({count}{breakdown})" if count > 0 else ""
+
+            override_amount = exception_info["amount"] if exception_info else None
+
+            if override_amount is not None and override_amount != original_expected:
+                is_overridden = True
+                fee_display = f"{override_amount} ({original_expected}) CZK{count_str}"
+            else:
+                is_overridden = False
+                fee_display = f"{expected} CZK{count_str}"
+
             status = "empty"
             cell_text = "-"
             amount_to_pay = 0
-            
+
             if expected == "?" or (isinstance(expected, int) and expected > 0):
                 if expected == "?":
                     status = "empty"
-                    cell_text = "?"
+                    cell_text = f"?{count_str}"
                 elif paid >= expected:
                     status = "ok"
-                    cell_text = "OK"
+                    cell_text = f"{paid}/{fee_display}"
                 elif paid > 0:
                     status = "partial"
-                    cell_text = f"{paid}/{expected}"
+                    cell_text = f"{paid}/{fee_display}"
                     amount_to_pay = expected - paid
-                    unpaid_months.append(month_labels[m])
+                    if m < current_month:
+                        unpaid_months.append(month_labels[m])
+                        raw_unpaid_months.append(datetime.strptime(m, "%Y-%m").strftime("%m/%Y"))
                 else:
                     status = "unpaid"
-                    cell_text = f"UNPAID {expected}"
+                    cell_text = f"0/{fee_display}"
                     amount_to_pay = expected
-                    unpaid_months.append(month_labels[m])
+                    if m < current_month:
+                        unpaid_months.append(month_labels[m])
+                        raw_unpaid_months.append(datetime.strptime(m, "%Y-%m").strftime("%m/%Y"))
             elif paid > 0:
                 status = "surplus"
                 cell_text = f"PAID {paid}"
-            
+
+            if (isinstance(expected, int) and expected > 0) or paid > 0:
+                tooltip = f"Received: {paid}, Expected: {expected}"
+            else:
+                tooltip = ""
+
             row["months"].append({
                 "text": cell_text,
+                "overridden": is_overridden,
                 "status": status,
                 "amount": amount_to_pay,
-                "month": month_labels[m]
+                "month": month_labels[m],
+                "raw_month": m,
+                "tooltip": tooltip
             })
-            
-        row["unpaid_periods"] = ", ".join(unpaid_months) if unpaid_months else ("Older debt" if data["total_balance"] < 0 else "")
-        row["balance"] = data["total_balance"]
+
+        # Balance = sum of (paid - expected) for past months only; current/future months ignored.
+        settled_balance = 0
+        for m, mdata in data["months"].items():
+            if m >= current_month:
+                continue
+            exp = mdata.get("expected", 0)
+            if isinstance(exp, int):
+                settled_balance += int(mdata.get("paid", 0)) - exp
+
+        payable_amount = max(0, -settled_balance)
+        row["unpaid_periods"] = ", ".join(unpaid_months)
+        row["raw_unpaid_periods"] = "+".join(raw_unpaid_months)
+        row["balance"] = settled_balance
+        row["payable_amount"] = payable_amount
         formatted_results.append(row)
-        
+
+    formatted_totals = []
+    for m in sorted_months:
+        t = monthly_totals[m]
+        status = "empty"
+        if t["expected"] > 0 or t["paid"] > 0:
+            if t["paid"] == t["expected"]:
+                status = "ok"
+            elif t["paid"] < t["expected"]:
+                status = "unpaid"
+            else:
+                status = "surplus"
+
+        formatted_totals.append({
+            "text": f"{t['paid']} / {t['expected']} CZK",
+            "status": status
+        })
+
     # Format credits and debts
-    credits = sorted([{"name": n, "amount": a["total_balance"]} for n, a in result["members"].items() if a["total_balance"] > 0], key=lambda x: x["name"])
-    debts = sorted([{"name": n, "amount": abs(a["total_balance"])} for n, a in result["members"].items() if a["total_balance"] < 0], key=lambda x: x["name"])
+    def junior_settled_balance(name):
+        data = result["members"][name]
+        total = 0
+        for m, mdata in data["months"].items():
+            if m >= current_month:
+                continue
+            exp = mdata.get("expected", 0)
+            if isinstance(exp, int):
+                total += int(mdata.get("paid", 0)) - exp
+        return total
+
+    junior_all_names = [name for name, _, _ in adapted_members]
+    credits = sorted([{"name": n, "amount": junior_settled_balance(n)} for n in junior_all_names if junior_settled_balance(n) > 0], key=lambda x: x["name"])
+    debts = sorted([{"name": n, "amount": abs(junior_settled_balance(n))} for n in junior_all_names if junior_settled_balance(n) < 0], key=lambda x: x["name"])
     unmatched = result["unmatched"]
+    raw_payments_by_person = group_payments_by_person(transactions, [name for name, _, _ in adapted_members])
     import json
-    
+
     record_step("process_data")
 
     return render_template(
-        "reconcile-juniors.html",
+        "juniors.html",
         months=[month_labels[m] for m in sorted_months],
         raw_months=sorted_months,
         results=formatted_results,
+        totals=formatted_totals,
         member_data=json.dumps(result["members"]),
         month_labels_json=json.dumps(month_labels),
+        raw_payments_json=json.dumps(raw_payments_by_person),
         credits=credits,
         debts=debts,
         unmatched=unmatched,
         attendance_url=attendance_url,
         payments_url=payments_url,
-        bank_account=BANK_ACCOUNT
+        bank_account=BANK_ACCOUNT,
+        current_month=current_month
     )
 
 @app.route("/payments")
 def payments():
     attendance_url = f"https://docs.google.com/spreadsheets/d/{ATTENDANCE_SHEET_ID}/edit"
     payments_url = f"https://docs.google.com/spreadsheets/d/{PAYMENTS_SHEET_ID}/edit"
-    credentials_path = ".secret/fuj-management-bot-credentials.json"
+    credentials_path = CREDENTIALS_PATH
     
-    transactions = fetch_sheet_data(PAYMENTS_SHEET_ID, credentials_path)
+    transactions = get_cached_data("payments_transactions", PAYMENTS_SHEET_ID, fetch_sheet_data, PAYMENTS_SHEET_ID, credentials_path)
     record_step("fetch_payments")
-    
-    # Group transactions by person
-    grouped = {}
+
+    adults_data = get_cached_data("attendance_regular", ATTENDANCE_SHEET_ID, get_members_with_fees)
+    juniors_data = get_cached_data("attendance_juniors", ATTENDANCE_SHEET_ID, get_junior_members_with_fees)
+    member_names = []
+    if adults_data:
+        member_names.extend(name for name, _, _ in adults_data[0])
+    if juniors_data:
+        member_names.extend(name for name, _, _ in juniors_data[0])
+
+    grouped = group_payments_by_person(transactions, member_names)
+    # payments page also groups unmatched rows under a fallback key
     for tx in transactions:
-        person = str(tx.get("person", "")).strip()
-        if not person:
-            person = "Unmatched / Unknown"
-            
-        # Handle multiple people (comma separated)
-        people = [p.strip() for p in person.split(",") if p.strip()]
-        for p in people:
-            # Strip markers
-            clean_p = re.sub(r"\[\?\]\s*", "", p)
-            if clean_p not in grouped:
-                grouped[clean_p] = []
-            grouped[clean_p].append(tx)
-            
-    # Sort people and their transactions
+        if not str(tx.get("person", "")).strip():
+            grouped.setdefault("Unmatched / Unknown", []).append(tx)
+    for rows in grouped.values():
+        rows.sort(key=lambda t: str(t.get("date", "")), reverse=True)
     sorted_people = sorted(grouped.keys())
-    for p in sorted_people:
-        # Sort by date descending
-        grouped[p].sort(key=lambda x: str(x.get("date", "")), reverse=True)
-        
+
     record_step("process_data")
     return render_template(
         "payments.html",
@@ -453,7 +590,11 @@ def qr_code():
     account = request.args.get("account", BANK_ACCOUNT)
     amount = request.args.get("amount", "0")
     message = request.args.get("message", "")
-    
+
+    # Validate account: allow IBAN (letters+digits) or Czech format (digits/digits)
+    if not re.match(r'^[A-Z]{2}\d{2,34}$|^\d{1,16}/\d{4}$', account):
+        account = BANK_ACCOUNT
+
     # QR Platba standard: SPD*1.0*ACC:accountNumber*BC:bankCode*AM:amount*CC:CZK*MSG:message
     acc_parts = account.split('/')
     if len(acc_parts) == 2:
@@ -463,12 +604,14 @@ def qr_code():
 
     try:
         amt_val = float(amount)
+        if amt_val < 0 or amt_val > 10_000_000:
+            amt_val = 0
         amt_str = f"{amt_val:.2f}"
     except ValueError:
         amt_str = "0.00"
 
-    # Message max 60 characters
-    msg_str = message[:60]
+    # Message max 60 characters, strip SPD delimiters to prevent injection
+    msg_str = message[:60].replace("*", "")
     
     qr_data = f"SPD*1.0*ACC:{acc_str}*AM:{amt_str}*CC:CZK*MSG:{msg_str}"
     

build/Dockerfile

@@ -14,7 +14,8 @@ RUN pip install --no-cache-dir \
     google-auth-httplib2 \
     google-auth-oauthlib \
     qrcode \
-    pillow
+    pillow \
+    gunicorn
 
 COPY app.py Makefile ./
 COPY scripts/ ./scripts/
@@ -23,6 +24,17 @@ COPY templates/ ./templates/
 COPY build/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
+ARG GIT_TAG=unknown
+ARG GIT_COMMIT=unknown
+ARG BUILD_DATE=unknown
+
+LABEL org.opencontainers.image.version="${GIT_TAG}" \
+      org.opencontainers.image.revision="${GIT_COMMIT}" \
+      org.opencontainers.image.created="${BUILD_DATE}" \
+      org.opencontainers.image.title="fuj-management"
+
+RUN echo "{\"tag\": \"${GIT_TAG}\", \"commit\": \"${GIT_COMMIT}\", \"build_date\": \"${BUILD_DATE}\"}" > /app/build_meta.json
+
 EXPOSE 5001
 
 HEALTHCHECK --interval=60s --timeout=5s --start-period=5s \

build/entrypoint.sh

@@ -1,8 +1,11 @@
 #!/bin/bash
 set -euo pipefail
 
-echo "[entrypoint] Starting Flask app on port 5001..."
+echo "[entrypoint] Starting gunicorn on port 5001..."
 
-# Running the app directly via python
-# For a production setup, we would ideally use gunicorn/waitress, but sticking to what's in app.py for now.
-exec python3 /app/app.py
+exec gunicorn \
+    --bind 0.0.0.0:5001 \
+    --workers "${GUNICORN_WORKERS:-2}" \
+    --timeout "${GUNICORN_TIMEOUT:-120}" \
+    --access-logfile - \
+    app:app

docs/README.md

@@ -0,0 +1,15 @@
+# FUJ Management Documentation
+
+Welcome to the documentation for the FUJ Management application.
+
+This project automates financial and operational management for the FUJ (Frisbee Ultimate Jablonec) club.
+
+## Navigation
+
+Use the sidebar to explore the documentation:
+
+* **[Project Notes](project-notes.md)**: Main brainstorming and domain model.
+* **[Scripts](scripts.md)**: Details about available CLI tools.
+* **[Fee Specification](fee-calculation-spec.md)**: Rules for fee calculation.
+
+For more technical details, check out the guides by Claude and Gemini in the sidebar.

docs/_sidebar.md

@@ -0,0 +1,25 @@
+* [Home](README.md)
+* [Project Notes](project-notes.md)
+* [Scripts](scripts.md)
+* [Fee Spec](fee-calculation-spec.md)
+
+* **By Claude Opus**
+  * [README](by-claude-opus/README.md)
+  * [User Guide](by-claude-opus/user-guide.md)
+  * [Web App](by-claude-opus/web-app.md)
+  * [Deployment](by-claude-opus/deployment.md)
+  * [Architecture](by-claude-opus/architecture.md)
+  * [Data Model](by-claude-opus/data-model.md)
+  * [Development](by-claude-opus/development.md)
+  * [Scripts](by-claude-opus/scripts.md)
+  * [Testing](by-claude-opus/testing.md)
+
+* **By Gemini**
+  * [README](by-gemini/README.md)
+  * [User Guide](by-gemini/user-guide.md)
+  * [Architecture](by-gemini/architecture.md)
+  * [Deployment](by-gemini/deployment.md)
+  * [Scripts](by-gemini/scripts.md)
+
+* **Specs**
+  * [Fio Sync](spec/fio_to_sheets_sync.md)

docs/by-claude-opus/README.md

@@ -0,0 +1,214 @@
+# FUJ Management — Comprehensive Documentation
+
+> **FUJ = Frisbee Ultimate Jablonec** — a small sports club in the Czech Republic.
+
+## What Is This Project?
+
+FUJ Management is a purpose-built financial management system for a small ultimate frisbee club. It automates the tedious process of tracking **who attended practice**, **how much they owe**, **who has paid**, and **who still owes money** — a workflow that would otherwise require manual cross-referencing between attendance spreadsheets and bank statements.
+
+The system is built around two Google Sheets (one for attendance, one for payments) and a Fio bank transparent account. A set of Python scripts sync and process the data, while a Flask-based web dashboard provides real-time visibility into fees, payments, and reconciliation status.
+
+### The Problem It Solves
+
+Before this system, the club treasurer had to:
+
+1. **Manually count** attendance marks for each member each month
+2. **Calculate** whether each person owes 0, 200, or 750 CZK based on how many times they showed up
+3. **Cross-reference** bank statements to figure out who paid and for which month
+4. **Chase** members who hadn't paid, often losing track of partial payments and advance payments
+5. **Handle edge cases** like members paying for multiple months at once, using nicknames in payment messages, or paying via a family member's account
+
+This system automates steps 1–4 entirely, and provides tooling for step 5.
+
+## System Overview
+
+```
+┌──────────────────────────┐     ┌──────────────────────────┐
+│   Attendance Sheet        │     │     Fio Bank Account      │
+│   (Google Sheets)         │     │   (transparent account)   │
+│                           │     │                           │
+│  Members × Dates × ✓/✗   │     │  Incoming payments with   │
+│  Tier (A/J/X)             │     │  sender, amount, message  │
+└──────────┬───────────────┘     └──────────┬───────────────┘
+           │                                 │
+           │  CSV export                     │  API / HTML scraping
+           │                                 │
+           ▼                                 ▼
+  ┌─────────────────┐            ┌───────────────────────┐
+  │  attendance.py   │            │  sync_fio_to_sheets.py │
+  │                  │            │                        │
+  │  Fetches sheet,  │            │  Syncs bank txns to    │
+  │  computes fees   │            │  Payments Google Sheet  │
+  └────────┬────────┘            └───────────┬────────────┘
+           │                                  │
+           │                                  ▼
+           │                     ┌───────────────────────┐
+           │                     │  Payments Sheet        │
+           │                     │  (Google Sheets)       │
+           │                     │                        │
+           │                     │  Date|Amount|Person|   │
+           │                     │  Purpose|Sender|etc.   │
+           │                     └───────────┬────────────┘
+           │                                  │
+           │        ┌─────────────────────────┤
+           │        │                         │
+           │        ▼                         ▼
+           │   ┌──────────────┐    ┌──────────────────┐
+           │   │infer_payments│    │ match_payments.py │
+           │   │   .py        │    │                   │
+           │   │              │    │  Reconciliation   │
+           │   │ Auto-fills   │    │  engine: matches  │
+           │   │ Person,      │    │  payments against  │
+           │   │ Purpose,     │    │  expected fees     │
+           │   │ Amount       │    └────────┬──────────┘
+           │   └──────────────┘             │
+           │                                │
+           └────────────────┬───────────────┘
+                            │
+                            ▼
+                 ┌──────────────────────┐
+                 │      Flask Web App    │
+                 │       (app.py)        │
+                 │                       │
+                 │  /fees       – fee    │
+                 │               table   │
+                 │  /reconcile – balance │
+                 │               matrix  │
+                 │  /payments  – ledger  │
+                 │  /qr        – QR code │
+                 └───────────────────────┘
+```
+
+## Quick Start
+
+### Prerequisites
+
+- **Python 3.13+**
+- **[uv](https://docs.astral.sh/uv/)** — fast Python package manager
+- **Google Sheets API credentials** — a service account JSON file placed at `.secret/fuj-management-bot-credentials.json`
+- *Optional*: `FIO_API_TOKEN` environment variable for Fio REST API access (falls back to transparent page scraping)
+
+### Setup
+
+```bash
+# Clone and install dependencies
+git clone <repo-url>
+cd fuj-management
+uv sync              # Installs all dependencies from pyproject.toml
+
+# Place your Google API credentials
+mkdir -p .secret
+cp /path/to/your/credentials.json .secret/fuj-management-bot-credentials.json
+```
+
+### Common Operations
+
+| Command | Purpose |
+|---------|---------|
+| `make web` | Start the web dashboard at `http://localhost:5001` |
+| `make sync` | Pull new bank transactions into the Google Sheet |
+| `make infer` | Auto-fill Person/Purpose/Amount for new transactions |
+| `make reconcile` | Print a CLI balance report |
+| `make fees` | Print fee calculation table from attendance |
+| `make test` | Run the test suite |
+| `make image` | Build the Docker container image |
+
+### Typical Workflow
+
+```
+make sync       →  make infer       →  (manual review in Google Sheets)  →  make web
+  ↓                   ↓                          ↓                             ↓
+Pull new bank    Auto-match        Fix any [?]                       View live
+  transactions     payments to      flagged rows                       dashboard
+  into sheet       members/months   in the sheet
+```
+
+## Documentation Index
+
+| Document | Contents |
+|----------|----------|
+| [Architecture](architecture.md) | System design, data flow diagrams, module dependency graph |
+| [Web Application](web-app.md) | Flask app architecture, routes, templates, interactive features |
+| [User Guide](user-guide.md) | End-user guide for the web dashboard — what each page shows |
+| [Scripts Reference](scripts.md) | Detailed reference for all CLI scripts and shared modules |
+| [Data Model](data-model.md) | Google Sheets schemas, fee calculation rules, bank integration |
+| [Deployment](deployment.md) | Docker containerization, Gitea CI/CD, Kubernetes deployment |
+| [Testing](testing.md) | Test infrastructure, coverage, how to write new tests |
+| [Development Guide](development.md) | Local setup, coding conventions, tooling, project history |
+
+## Technology Stack
+
+| Layer | Technology |
+|-------|-----------|
+| Language | Python 3.13+ |
+| Web framework | Flask 3.1 |
+| Package management | uv + pyproject.toml |
+| Data sources | Google Sheets API, Fio Bank API / HTML scraping |
+| QR codes | `qrcode` library (PIL backend) |
+| Containerization | Docker (Alpine-based) |
+| CI/CD | Gitea Actions |
+| Deployment target | Self-hosted Kubernetes |
+| Frontend | Server-rendered HTML/CSS/JS (terminal-aesthetic theme) |
+
+## Project Structure
+
+```
+fuj-management/
+├── app.py                          # Flask web application (4 routes)
+├── Makefile                        # Build automation (13 targets)
+├── pyproject.toml                  # Python dependencies and metadata
+│
+├── scripts/
+│   ├── attendance.py               # Shared: attendance data + fee calculation
+│   ├── calculate_fees.py           # CLI: print fee table
+│   ├── match_payments.py           # Core: reconciliation engine + CLI report
+│   ├── infer_payments.py           # Auto-fill Person/Purpose in Google Sheet
+│   ├── sync_fio_to_sheets.py       # Sync Fio bank → Google Sheet
+│   ├── fio_utils.py                # Shared: Fio bank data fetching
+│   └── czech_utils.py              # Shared: diacritics normalization + Czech month parsing
+│
+├── templates/
+│   ├── fees.html                   # Attendance/fees dashboard
+│   ├── reconcile.html              # Payment reconciliation with modals + QR
+│   └── payments.html               # Payments ledger grouped by member
+│
+├── tests/
+│   ├── test_app.py                 # Flask route tests (mocked data)
+│   └── test_reconcile_exceptions.py # Reconciliation with fee exceptions
+│
+├── build/
+│   ├── Dockerfile                  # Alpine-based container image
+│   └── entrypoint.sh               # Container entry point
+│
+├── .gitea/workflows/
+│   ├── build.yaml                  # CI: build + push Docker image
+│   └── kubernetes-deploy.yaml      # CD: deploy to K8s cluster
+│
+├── .secret/                        # (gitignored) API credentials
+├── docs/                           # Project documentation
+│   ├── project-notes.md            # Original brainstorming and design notes
+│   ├── fee-calculation-spec.md     # Fee rules and payment matching spec
+│   ├── scripts.md                  # Legacy scripts documentation
+│   └── spec/
+│       └── fio_to_sheets_sync.md   # Fio-to-Sheets sync specification
+│
+└── CLAUDE.md                       # AI assistant context file
+```
+
+## Key Design Decisions
+
+1. **No database** — Google Sheets serves as both the data store and the manual editing interface. This keeps the system simple and accessible to non-technical club members who can review and edit data directly in the spreadsheet.
+
+2. **PII separation** — No member names or personal data are stored in the git repository. All data is fetched at runtime from Google Sheets and the bank account.
+
+3. **Idempotent sync** — The Fio-to-Sheets sync uses SHA-256 hashes as deduplication keys, making re-runs safe and append-only.
+
+4. **Graceful fallbacks** — Bank data can be fetched via the REST API (if a token is available) or by scraping the public transparent account page. The system doesn't break if the API token is missing.
+
+5. **Czech language support** — Payment messages are in Czech and use diacritics. The system normalizes text (strips diacritics) and understands Czech month names in all grammatical declensions.
+
+6. **Terminal aesthetic** — The web dashboard uses a monospace, dark-themed, terminal-inspired design that matches the project's pragmatic, CLI-first philosophy.
+
+---
+
+*This documentation was generated on 2026-03-03 by Claude Opus, based on a comprehensive analysis of the complete codebase.*

docs/by-claude-opus/architecture.md

@@ -0,0 +1,268 @@
+# System Architecture
+
+## Overview
+
+FUJ Management follows a **pipeline architecture** where data flows from external sources (Google Sheets, Fio Bank) through processing scripts into a web dashboard. There is no central database — Google Sheets serves as the persistent data store, and the Flask app renders views by fetching and processing data on every request.
+
+## Component Architecture
+
+```
+                  ┌─────────────────────────────────────────────────┐
+                  │                EXTERNAL DATA SOURCES            │
+                  │                                                 │
+                  │  ┌──────────────────┐  ┌──────────────────────┐ │
+                  │  │ Attendance Sheet  │  │   Fio Bank Account   │ │
+                  │  │ (Google Sheets)   │  │                      │ │
+                  │  │                   │  │  ┌────────────────┐  │ │
+                  │  │ ID: 1E2e_gT...   │  │  │ REST API       │  │ │
+                  │  │                   │  │  │ (JSON, w/token)│  │ │
+                  │  │ CSV export (pub)  │  │  ├────────────────┤  │ │
+                  │  │                   │  │  │ Transparent    │  │ │
+                  │  └────────┬─────────┘  │  │ page (HTML)    │  │ │
+                  │           │            │  └───────┬────────┘  │ │
+                  │           │            └──────────┼──────────┘ │
+                  └───────────┼───────────────────────┼────────────┘
+                              │                       │
+                 ─ ─ ─ ─ ─ ─ ┼ ─ ─ DATA INGESTION ─ ┼ ─ ─ ─ ─ ─
+                              │                       │
+                  ┌───────────▼──────┐    ┌───────────▼──────────┐
+                  │  attendance.py   │    │    fio_utils.py       │
+                  │                  │    │                       │
+                  │ fetch_csv()      │    │ fetch_transactions()  │
+                  │ parse_dates()    │    │ FioTableParser        │
+                  │ group_by_month() │    │ parse_czech_amount()  │
+                  │ calculate_fee()  │    │ parse_czech_date()    │
+                  │ get_members()    │    │                       │
+                  │ get_members_     │    │ API + HTML fallback   │
+                  │   with_fees()    │    │                       │
+                  └───────────┬──────┘    └───────────┬──────────┘
+                              │                       │
+                 ─ ─ ─ ─ ─ ─ ┼ ─ ─ PROCESSING ─ ─ ─ ┼ ─ ─ ─ ─ ─
+                              │                       │
+                              │         ┌─────────────▼──────────┐
+                              │         │ sync_fio_to_sheets.py  │ ──▶ Payments Sheet
+                              │         │                        │     (Google Sheets)
+                              │         │ generate_sync_id()     │
+                              │         │ sort_sheet_by_date()   │
+                              │         │ get_sheets_service()   │
+                              │         └────────────────────────┘
+                              │                       │
+                              │         ┌─────────────▼──────────┐
+                              │         │   infer_payments.py    │ ──▶ Writes back to
+                              │         │                        │     Payments Sheet
+                              │         │ infer Person/Purpose/  │
+                              │         │ Amount for empty rows  │
+                              │         └────────────────────────┘
+                              │                       │
+                              │    ┌──────────────────▼──────────┐
+                              │    │     czech_utils.py          │
+                              │    │                             │
+                              │    │ normalize()  — strip        │
+                              │    │               diacritics    │
+                              │    │ parse_month_references()    │
+                              │    │ CZECH_MONTHS dict           │
+                              │    └─────────────────────────────┘
+                              │                       │
+                 ─ ─ ─ ─ ─ ─ ┼ ─ RECONCILIATION  ─ ─┼ ─ ─ ─ ─ ─
+                              │                       │
+                    ┌─────────▼───────────────────────▼───────────┐
+                    │           match_payments.py                  │
+                    │                                              │
+                    │  _build_name_variants()  — name matching    │
+                    │  match_members()         — fuzzy match      │
+                    │  infer_transaction_details()                │
+                    │  fetch_sheet_data()      — read payments    │
+                    │  fetch_exceptions()      — fee overrides    │
+                    │  reconcile()            — CORE ENGINE       │
+                    │  print_report()         — CLI output        │
+                    └──────────────────────┬──────────────────────┘
+                                           │
+                 ─ ─ ─ ─ ─ ─ ─ PRESENTATION ┼ ─ ─ ─ ─ ─ ─ ─ ─ ─
+                                           │
+                    ┌──────────────────────▼──────────────────────┐
+                    │              app.py (Flask)                  │
+                    │                                              │
+                    │  GET /         → redirect to /fees          │
+                    │  GET /fees     → fees.html                  │
+                    │  GET /reconcile → reconcile.html            │
+                    │  GET /payments → payments.html              │
+                    │  GET /qr       → PNG QR code (SPD format)  │
+                    └─────────────────────────────────────────────┘
+```
+
+## Module Dependency Graph
+
+```
+app.py
+  ├── attendance.py
+  │     └── (stdlib: csv, urllib, datetime)
+  └── match_payments.py
+        ├── attendance.py
+        ├── czech_utils.py
+        │     └── (stdlib: re, unicodedata)
+        └── sync_fio_to_sheets.py  (for get_sheets_service, DEFAULT_SPREADSHEET_ID)
+              └── fio_utils.py
+                    └── (stdlib: json, urllib, html.parser, datetime)
+
+infer_payments.py
+  ├── sync_fio_to_sheets.py
+  ├── match_payments.py
+  └── attendance.py
+
+calculate_fees.py
+  └── attendance.py
+```
+
+### Import Relationships
+
+| Module | Imports from |
+|--------|-------------|
+| `app.py` | `attendance` (`get_members_with_fees`, `SHEET_ID`), `match_payments` (`reconcile`, `fetch_sheet_data`, `fetch_exceptions`, `normalize`, `DEFAULT_SPREADSHEET_ID`) |
+| `match_payments.py` | `attendance` (`get_members_with_fees`), `czech_utils` (`normalize`, `parse_month_references`), `sync_fio_to_sheets` (`get_sheets_service`, `DEFAULT_SPREADSHEET_ID`) |
+| `infer_payments.py` | `sync_fio_to_sheets` (`get_sheets_service`, `DEFAULT_SPREADSHEET_ID`), `match_payments` (`infer_transaction_details`), `attendance` (`get_members_with_fees`) |
+| `sync_fio_to_sheets.py` | `fio_utils` (`fetch_transactions`) |
+| `calculate_fees.py` | `attendance` (`get_members_with_fees`) |
+
+## Data Flow Patterns
+
+### Pattern 1: Sync & Enrich (Batch Pipeline)
+
+This is the primary workflow for keeping the payments ledger up to date:
+
+```
+1. make sync                     2. make infer
+   ┌──────┐    ┌──────────┐         ┌──────────┐    ┌──────────┐
+   │ Fio  │───▶│ Payments │         │ Payments │───▶│ Payments │
+   │ Bank │    │  Sheet   │         │  Sheet   │    │  Sheet   │
+   └──────┘    │ (append) │         │ (read)   │    │ (update) │
+               └──────────┘         └──────────┘    └──────────┘
+   
+   - Fetches last 30 days            - Reads empty Person/Purpose rows
+   - SHA-256 dedup prevents            - Uses name matching + Czech month
+     duplicate entries                   parsing to auto-fill
+                                      - Marks uncertain matches with [?]
+```
+
+### Pattern 2: Real-Time Rendering (Web Dashboard)
+
+Every web request triggers a fresh data fetch — no caching layer exists:
+
+```
+Browser Request → Flask Route → Fetch (Google Sheets API/CSV) → Process → Render HTML
+                                    │                              │
+                                    │  attendance.py               │  reconcile()
+                                    │  fetch_sheet_data()          │  or direct
+                                    │  fetch_exceptions()          │  formatting
+                                    ▼                              ▼
+                              ~1-3 seconds                    Template with
+                              (network I/O)                   inline CSS + JS
+```
+
+### Pattern 3: QR Code Generation (On-Demand)
+
+```
+Browser clicks "Pay" → GET /qr?account=...&amount=...&message=... → SPD QR PNG
+                                                                         │
+                                                                    qrcode lib
+                                                                    generates
+                                                                    in-memory PNG
+```
+
+## Key Design Patterns
+
+### 1. Google Sheets as Database
+
+Instead of a traditional database, the system uses two Google Sheets:
+
+| Sheet | Purpose | Access Method |
+|-------|---------|---------------|
+| Attendance Sheet (`1E2e_gT...`) | Member names, tiers, practice dates, attendance marks | Public CSV export (no auth needed) |
+| Payments Sheet (`1Om0YPo...`) | Bank transactions with Person/Purpose annotations | Google Sheets API (service account auth) |
+
+**Trade-offs**:
+- ✅ Non-technical users can view and edit data directly
+- ✅ No database setup or maintenance
+- ✅ Built-in audit trail (Google Sheets version history)
+- ❌ Every page load incurs 1-3s of API latency
+- ❌ No complex queries or indexing
+- ❌ Rate limits on Google Sheets API
+
+### 2. Dual-Mode Bank Access
+
+`fio_utils.py` implements a transparent fallback pattern:
+
+```python
+def fetch_transactions(date_from, date_to):
+    token = os.environ.get("FIO_API_TOKEN", "").strip()
+    if token:
+        return fetch_transactions_api(token, date_from, date_to)    # Structured JSON
+    return fetch_transactions_transparent(...)                       # HTML scraping
+```
+
+The API provides richer data (sender account numbers, stable bank IDs) but requires a token. The transparent page is always available but lacks some fields.
+
+### 3. Name Matching with Confidence Levels
+
+The reconciliation engine uses a multi-tier matching strategy:
+
+| Priority | Method | Confidence | Example |
+|----------|--------|-----------|---------|
+| 1 | Full name match | `auto` | "František Vrbík" in message |
+| 2 | Both first + last name (any order) | `auto` | "Vrbík František" |
+| 3 | Nickname match | `auto` | "(Štrúdl)" from member list |
+| 4 | Last name only (≥4 chars, not common) | `review` | "Vrbík" alone |
+| 5 | First name only (≥3 chars) | `review` | "František" alone |
+
+When both `auto` and `review` matches exist, `review` matches are discarded. This prevents false positives from generic first names.
+
+### 4. Exception System
+
+Fee overrides are managed through an `exceptions` sheet tab in the Payments Google Sheet:
+
+| Column | Content |
+|--------|---------|
+| Name | Member name |
+| Period | Month (YYYY-MM) |
+| Amount | Overridden fee in CZK |
+| Note | Reason for the exception |
+
+Exceptions are applied during reconciliation, replacing the attendance-calculated fee with the manually specified amount.
+
+### 5. Render-Time Performance Tracking
+
+Every page includes a performance breakdown:
+
+```python
+@app.before_request
+def start_timer():
+    g.start_time = time.perf_counter()
+    g.steps = []
+
+def record_step(name):
+    g.steps.append((name, time.perf_counter()))
+```
+
+The footer displays total render time and, on click, reveals a detailed breakdown (e.g., `fetch_members:0.892s | fetch_payments:1.205s | reconcile:0.003s | render:0.015s`).
+
+## Security Considerations
+
+| Concern | Mitigation |
+|---------|-----------|
+| PII in git | `.secret/` is gitignored; all data fetched at runtime |
+| Google API credentials | Service account JSON stored in `.secret/`, mounted as Docker secret |
+| Bank API token | Passed via `FIO_API_TOKEN` environment variable, never committed |
+| Web app authentication | **None currently** — the app has no auth layer |
+| CSRF protection | **None currently** — Flask default (no POST routes exist) |
+
+## Scalability Notes
+
+This system is purpose-built for a small club (~20-40 members). It makes deliberate trade-offs favoring simplicity over scale:
+
+- **No caching**: Every page load fetches live data from Google Sheets (1-3s latency). For a single-user admin dashboard, this is acceptable.
+- **No background workers**: Sync and inference are manual `make` commands, not scheduled jobs.
+- **No database**: Google Sheets handles 10s of members and 100s of transactions with ease.
+- **Single-process Flask**: The built-in development server runs directly in production (via Docker). For this use case, this is intentional — it's a personal tool, not a public service.
+
+---
+
+*Architecture documentation generated from comprehensive code analysis on 2026-03-03.*

docs/by-claude-opus/data-model.md

@@ -0,0 +1,201 @@
+# Data Model
+
+## Overview
+
+FUJ Management operates on two Google Sheets and an external bank account. There is no local database — all persistent data lives in Google Sheets, and all member data is fetched at runtime (never committed to git).
+
+## External Data Sources
+
+### 1. Attendance Google Sheet
+
+| Property | Value |
+|----------|-------|
+| **Sheet ID** | `1E2e_gT_K5AwSRCDLDTa2UetZTkHmBOcz0kFbBUNUNBA` |
+| **Access** | Public CSV export (no authentication required) |
+| **Purpose** | Member roster, weekly practice attendance marks |
+| **Scope** | Tuesday practices (20:30–22:00) |
+
+#### Schema
+
+```
+Row 1:  [Title]  [blank]  [blank]  [10/1/2025]  [10/8/2025]  [10/15/2025]  ...
+Row 2:  Venue per date (ignored by the system)
+Row 3:  Subtotals per date (ignored by the system)
+Row 4+: [Name]   [Tier]   [Total]  [TRUE/FALSE]  [TRUE/FALSE] ...
+...
+Row N:  # last line  (sentinel — stops parsing)
+```
+
+| Column | Index | Content | Example |
+|--------|-------|---------|---------|
+| A | 0 | Member name | `Jan Novák` |
+| B | 1 | Tier code | `A`, `J`, or `X` |
+| C | 2 | Total attendance (auto-calculated, ignored by the system) | `12` |
+| D+ | 3+ | Attendance per date | `TRUE` or `FALSE` |
+
+#### Tier Codes
+
+| Code | Meaning | Pays fees? |
+|------|---------|-----------|
+| `A` | Adult | Yes — calculated from this sheet |
+| `J` | Junior | No — managed via a separate sheet |
+| `X` | Exempt | No |
+
+#### Sentinel Row
+
+The system stops parsing member rows when it encounters a row whose first column contains `# last line` (case-insensitive). Rows starting with `#` are also skipped as comments.
+
+### 2. Payments Google Sheet
+
+| Property | Value |
+|----------|-------|
+| **Sheet ID** | `1Om0YPoDVCH5cV8BrNz5LG5eR5MMU05ypQC7UMN1xn_Y` |
+| **Access** | Google Sheets API (service account authentication) |
+| **Purpose** | Intermediary ledger for bank transactions + manual annotations |
+| **Managed by** | `sync_fio_to_sheets.py` (append), `infer_payments.py` (update) |
+
+#### Main Sheet Schema (Columns A–K)
+
+| Column | Label | Populated by | Description |
+|--------|-------|-------------|-------------|
+| A | Date | `sync` | Transaction date (`YYYY-MM-DD`) |
+| B | Amount | `sync` | Bank transaction amount in CZK |
+| C | manual fix | Human | If non-empty, `infer` will skip this row |
+| D | Person | `infer` or human | Member name(s), comma-separated for multi-person payments |
+| E | Purpose | `infer` or human | Month(s) covered, e.g. `2026-01` or `2026-01, 2026-02` |
+| F | Inferred Amount | `infer` or human | Amount to use for reconciliation (may differ from bank amount) |
+| G | Sender | `sync` | Bank sender name/account |
+| H | VS | `sync` | Variable symbol |
+| I | Message | `sync` | Payment message for recipient |
+| J | Bank ID | `sync` | Fio transaction ID (API only) |
+| K | Sync ID | `sync` | SHA-256 deduplication hash |
+
+#### Exceptions Sheet Tab
+
+A separate tab named `exceptions` in the same spreadsheet, used for manual fee overrides:
+
+| Column | Label | Content |
+|--------|-------|---------|
+| A | Name | Member name (plain text) |
+| B | Period | Month (`YYYY-MM`) |
+| C | Amount | Overridden fee in CZK |
+| D | Note | Reason for override (optional) |
+
+The first row is assumed to be a header and is skipped. Name and period values are normalized (diacritics stripped, lowercased) for matching.
+
+### 3. Fio Bank Account
+
+| Property | Value |
+|----------|-------|
+| **Account number** | `2800359168/2010` |
+| **IBAN** | `CZ8520100000002800359168` |
+| **Type** | Transparent account |
+| **Owner** | Nathan Heilmann |
+| **Public URL** | `https://ib.fio.cz/ib/transparent?a=2800359168` |
+
+#### Access Methods
+
+| Method | Trigger | Data richness |
+|--------|---------|--------------|
+| REST API | `FIO_API_TOKEN` env var set | Full data: sender account, bank ID, user identification, currency |
+| HTML scraping | `FIO_API_TOKEN` not set | Partial: date, amount, sender name, message, VS/KS/SS |
+
+#### API Rate Limit
+
+The Fio REST API allows 1 request per 30 seconds per token.
+
+## Fee Calculation Rules
+
+Fees apply only to **tier A (Adult)** members. They are calculated per calendar month based on Tuesday practice attendance:
+
+| Practices attended | Monthly fee |
+|-------------------|-------------|
+| 0 | 0 CZK |
+| 1 | 200 CZK |
+| 2+ | 750 CZK |
+
+### Exception Overrides
+
+The fee can be manually overridden per member per month via the `exceptions` tab. When an exception exists:
+- The `expected` amount in reconciliation uses the exception amount
+- The `original_expected` amount preserves the attendance-based calculation
+- The override is displayed in amber/orange in the web UI
+
+### Advance Payments
+
+If a payment references a month not yet covered by attendance data:
+- It is tracked as **credit** on the member's account
+- Credits are added to the total balance
+- When attendance data becomes available for that month, the credit effectively offsets the expected fee
+
+## Reconciliation Data Model
+
+The `reconcile()` function returns this structure:
+
+```python
+{
+    "members": {
+        "Jan Novák": {
+            "tier": "A",
+            "months": {
+                "2026-01": {
+                    "expected": 750,           # Fee after exception application
+                    "original_expected": 750,  # Attendance-based fee
+                    "attendance_count": 4,     # How many times they came
+                    "exception": None,         # or {"amount": 400, "note": "..."}
+                    "paid": 750.0,             # Total matched payments
+                    "transactions": [          # Individual payment records
+                        {
+                            "amount": 750.0,
+                            "date": "2026-01-15",
+                            "sender": "Jan Novák",
+                            "message": "leden",
+                            "confidence": "auto"
+                        }
+                    ]
+                }
+            },
+            "total_balance": 0  # sum(paid - expected) across all months + off-window credits
+        }
+    },
+    "unmatched": [              # Transactions that couldn't be assigned
+        {
+            "date": "2026-01-20",
+            "amount": 500,
+            "sender": "Unknown",
+            "message": "dar"
+        }
+    ],
+    "credits": {                # Alias for positive total_balance entries
+        "Jan Novák": 200
+    }
+}
+```
+
+## Sync ID Generation
+
+The deduplication key for bank transactions is a SHA-256 hash of:
+
+```
+sha256("date|amount|currency|sender|vs|message|bank_id")
+```
+
+All values are lowercased before hashing. This ensures:
+- Same transaction fetched twice produces the same ID
+- Two payments on the same day with different amounts/senders produce different IDs
+- The hash is stable across API and HTML scraping modes (shared fields)
+
+## Date Handling
+
+| Source | Format | Normalization |
+|--------|--------|--------------|
+| Attendance Sheet header | `M/D/YYYY` (US format) | `datetime.strptime(raw, "%m/%d/%Y")` |
+| Fio API | `YYYY-MM-DD+HHMM` | Take first 10 characters |
+| Fio transparent page | `DD.MM.YYYY` | `datetime.strptime(raw, "%d.%m.%Y")` |
+| Google Sheets (unformatted) | Serial number (days since 1899-12-30) | `datetime(1899, 12, 30) + timedelta(days=val)` |
+
+All internal date representation uses `YYYY-MM-DD` format. Month keys use `YYYY-MM`.
+
+---
+
+*Data model documentation generated from comprehensive code analysis on 2026-03-03.*

docs/by-claude-opus/deployment.md

@@ -0,0 +1,198 @@
+# Deployment Guide
+
+## Local Development
+
+### Prerequisites
+
+- **Python 3.13+** (required by `pyproject.toml`)
+- **[uv](https://docs.astral.sh/uv/)** — Fast Python package manager
+- Google Sheets API credentials (service account JSON)
+
+### Setup
+
+```bash
+git clone <repo-url>
+cd fuj-management
+
+# Install dependencies
+uv sync
+
+# Configure credentials
+mkdir -p .secret
+cp /path/to/credentials.json .secret/fuj-management-bot-credentials.json
+
+# Optional: Set Fio API token for richer bank data
+export FIO_API_TOKEN=your_token_here
+
+# Start the web dashboard
+make web
+# → Flask server at http://localhost:5001
+```
+
+### Makefile Targets
+
+| Target | Command | Description |
+|--------|---------|-------------|
+| `help` | `make help` | List all available targets |
+| `venv` | `make venv` | Sync virtual environment with pyproject.toml |
+| `fees` | `make fees` | Print fee calculation table |
+| `match` | `make match` | (Legacy) Direct bank matching |
+| `web` | `make web` | Start Flask dashboard on port 5001 |
+| `sync` | `make sync` | Sync last 30 days of bank transactions |
+| `sync-2026` | `make sync-2026` | Sync full year 2026 transactions |
+| `infer` | `make infer` | Auto-fill Person/Purpose in the sheet |
+| `reconcile` | `make reconcile` | Print CLI balance report |
+| `test` | `make test` | Run test suite |
+| `test-v` | `make test-v` | Run tests with verbose output |
+| `image` | `make image` | Build Docker image |
+| `run` | `make run` | Run Docker container locally |
+
+The Makefile includes **automatic venv management**: targets that need Python depend on `.venv/.last_sync`, which triggers `uv sync` when `pyproject.toml` changes.
+
+---
+
+## Docker Container
+
+### Building
+
+```bash
+make image
+# → docker build -t fuj-management:latest -f build/Dockerfile .
+```
+
+### Dockerfile Details
+
+**Base image**: `python:3.13-alpine`
+
+**Build stages**:
+1. Install system packages (`bash`, `tzdata`)
+2. Set timezone to `Europe/Prague`
+3. Install Python dependencies via pip
+4. Copy application files (`app.py`, `scripts/`, `templates/`, `Makefile`)
+5. Copy entrypoint script
+
+**Exposed port**: 5001
+
+**Health check**: `wget -q -O /dev/null http://localhost:5001/` every 60s
+
+### Running Locally via Docker
+
+```bash
+make run
+# → docker run -it --rm -p 5001:5001 fuj-management:latest
+
+# With credentials and environment:
+docker run -it --rm \
+  -p 5001:5001 \
+  -v $(pwd)/.secret:/app/.secret:ro \
+  -e FIO_API_TOKEN=your_token \
+  -e BANK_ACCOUNT=CZ8520100000002800359168 \
+  fuj-management:latest
+```
+
+### Entrypoint
+
+The `build/entrypoint.sh` script simply runs:
+```bash
+exec python3 /app/app.py
+```
+
+This uses Flask's built-in server directly. For a production deployment, consider adding gunicorn or waitress (noted as a TODO in the entrypoint).
+
+### Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `BANK_ACCOUNT` | `CZ8520100000002800359168` | IBAN for QR code generation |
+| `FIO_API_TOKEN` | *(none)* | Fio REST API token |
+| `PYTHONUNBUFFERED` | `1` (set in Dockerfile) | Ensures real-time log output |
+
+---
+
+## CI/CD Pipeline
+
+### Gitea Actions
+
+The project uses two Gitea Actions workflows:
+
+#### 1. Build and Push (`build.yaml`)
+
+**Triggers**:
+- Push of any tag
+- Manual dispatch (with custom tag input)
+
+**Steps**:
+1. Checkout code
+2. Login to Gitea container registry (`gitea.home.hrajfrisbee.cz`)
+3. Build Docker image using `build/Dockerfile`
+4. Push to `gitea.home.hrajfrisbee.cz/<owner>/<repo>:<tag>`
+
+**Tag resolution**: Uses the git tag name. For manual dispatch, uses the provided input.
+
+#### 2. Deploy to Kubernetes (`kubernetes-deploy.yaml`)
+
+**Triggers**:
+- Push to any branch
+- Manual dispatch
+
+**Steps**:
+1. Checkout code
+2. Install kubectl
+3. Retrieve Kanidm token from HashiCorp Vault:
+   - Authenticate to Vault via AppRole (`VAULT_ROLE_ID` / `VAULT_SECRET_ID`)
+   - Fetch API token from `secret/data/gitea/gitea-ci`
+4. Exchange API token for K8s OIDC token via Kanidm:
+   - POST to `https://idm.home.hrajfrisbee.cz/oauth2/token`
+   - Token exchange using `urn:ietf:params:oauth:grant-type:token-exchange`
+5. Configure kubectl with the OIDC token
+6. Run `kubectl auth whoami` and `kubectl get ns` (deploy commands are commented out — WIP)
+
+**Required secrets**:
+
+| Secret | Purpose |
+|--------|---------|
+| `REGISTRY_TOKEN` | Docker registry authentication |
+| `VAULT_ROLE_ID` | HashiCorp Vault AppRole role ID |
+| `VAULT_SECRET_ID` | HashiCorp Vault AppRole secret ID |
+| `K8S_CA_CERT` | Kubernetes cluster CA certificate |
+
+### Infrastructure Topology
+
+```
+Gitea (git push / tag)
+   │
+   ├── build.yaml → Docker Build → Gitea Container Registry
+   │                                  (gitea.home.hrajfrisbee.cz)
+   │
+   └── kubernetes-deploy.yaml → Vault → Kanidm → K8s Cluster
+                                                   (192.168.0.31:6443)
+```
+
+This is a self-hosted infrastructure stack:
+- **Gitea** for git hosting and CI/CD
+- **HashiCorp Vault** for secret management
+- **Kanidm** for identity/OIDC
+- **Kubernetes** for container orchestration
+
+---
+
+## Credentials Management
+
+### Google Sheets API
+
+The system uses a **Google Cloud service account** for accessing the Payments Google Sheet. The credentials file must be:
+- Stored at `.secret/fuj-management-bot-credentials.json`
+- In Google Cloud service account JSON format
+- The service account must be shared (as editor) on the target Google Sheet
+
+For local development with OAuth2 (personal Google account), the system also supports the OAuth2 installed app flow — it will generate a `token.pickle` file on first use.
+
+### Fio Bank API
+
+Optional. Set the `FIO_API_TOKEN` environment variable. The token is generated in Fio internetbanking under Settings → API.
+
+**Rate limit**: 1 request per 30 seconds per token.
+
+---
+
+*Deployment documentation generated from comprehensive code analysis on 2026-03-03.*

docs/by-claude-opus/development.md

@@ -0,0 +1,228 @@
+# Development Guide
+
+## Development Environment
+
+### Required Tools
+
+| Tool | Version | Purpose |
+|------|---------|---------|
+| Python | 3.13+ | Runtime |
+| uv | Latest | Dependency management |
+| Docker | Latest | Container builds |
+| Git | Any | Version control |
+| Make | Any | Build automation |
+
+### Initial Setup
+
+```bash
+# 1. Clone the repository
+git clone <repo-url>
+cd fuj-management
+
+# 2. Install dependencies (creates .venv automatically)
+uv sync
+
+# 3. Activate the virtual environment
+source .venv/bin/activate
+
+# 4. Set up credentials
+mkdir -p .secret
+# Copy your Google service account JSON here:
+cp ~/Downloads/fuj-management-bot-credentials.json .secret/
+
+# 5. (Optional) Set Fio API token
+export FIO_API_TOKEN=your_token_here
+```
+
+### IDE Configuration
+
+The `.vscode/` directory contains workspace settings. If using VS Code, the Python interpreter should automatically detect the `.venv` directory.
+
+**PYTHONPATH note**: When running scripts from the project root, the Makefile sets `PYTHONPATH=scripts:$PYTHONPATH`. If your IDE doesn't do this, you may see import errors in `match_payments.py` and other scripts that import sibling modules.
+
+## Project Dependencies
+
+Defined in `pyproject.toml`:
+
+| Dependency | Version | Purpose |
+|------------|---------|---------|
+| `flask` | ≥3.1.3 | Web framework |
+| `google-api-python-client` | ≥2.162.0 | Google Sheets API |
+| `google-auth-httplib2` | ≥0.2.0 | Google auth transport |
+| `google-auth-oauthlib` | ≥1.2.1 | OAuth2 support |
+| `qrcode[pil]` | ≥8.0 | QR code generation (with PIL/Pillow backend) |
+
+The project uses `uv` with `package = false` in `[tool.uv]`, meaning it's not an installable package — dependencies are synced directly to the virtual environment.
+
+## Coding Conventions
+
+### Python Style
+
+- No linter or formatter is configured — the codebase uses a pragmatic, readable style
+- Type hints are used for function signatures but not exhaustively
+- Docstrings follow Google-style format on key functions
+- Scripts use `if __name__ == "__main__": main()` pattern
+
+### Import Pattern
+
+Scripts in the `scripts/` directory import from each other as top-level modules:
+
+```python
+# In match_payments.py:
+from attendance import get_members_with_fees
+from czech_utils import normalize, parse_month_references
+from sync_fio_to_sheets import get_sheets_service, DEFAULT_SPREADSHEET_ID
+```
+
+This works because `scripts/` is added to `sys.path` at runtime (by `app.py` on startup, by Makefile via `PYTHONPATH`, or by scripts adding their own directory to `sys.path`).
+
+### Template Style
+
+- All CSS is inline (no external stylesheets)
+- No CSS preprocessors or frameworks
+- No JavaScript frameworks — plain DOM manipulation
+- Terminal-inspired aesthetic: monospace fonts, green-on-black, dashed borders
+
+### Commit Conventions
+
+The project uses [Conventional Commits](https://www.conventionalcommits.org/):
+```
+feat: add keyboard navigation to member popup
+fix: correct diacritic-insensitive search filter
+chore: update dependencies
+```
+
+AI commits include a co-author trailer:
+```
+Co-authored-by: Antigravity <antigravity@google.com>
+```
+
+## Architecture Decisions
+
+### Why No Database?
+
+Google Sheets serves as the database because:
+1. Club members can view and correct data without special tools
+2. No database server to manage or back up
+3. Built-in version history and collaborative editing
+4. Good enough for ~40 members and ~hundreds of transactions
+
+### Why No Template Inheritance?
+
+Each HTML template is self-contained. While this means CSS duplication, it keeps each page fully independent and easy to understand. For a 3-page app, the duplication cost is minimal.
+
+### Why Flask Development Server in Production?
+
+The Docker container runs Flask's built-in server (`python3 app.py`) rather than gunicorn or waitress. This is intentional — the dashboard is an internal tool accessed by one person at a time. The simplicity outweighs the performance cost.
+
+### Why Scrape HTML When There's an API?
+
+The Fio transparent page scraping exists as a **zero-configuration fallback**. Not everyone has an API token, and the transparent page is always publicly accessible. The API is preferred when available (richer data, stable IDs).
+
+## Common Development Tasks
+
+### Adding a New Web Route
+
+1. Add the route function in `app.py`:
+```python
+@app.route("/new-page")
+def new_page():
+    # Fetch data
+    record_step("fetch_data")
+    # Process
+    record_step("process_data")
+    return render_template("new_page.html", ...)
+```
+
+2. Create `templates/new_page.html` (copy structure from `fees.html`)
+
+3. Add a link in the nav bar across all templates:
+```html
+<a href="/new-page">[New Page]</a>
+```
+
+4. Add a test in `tests/test_app.py`
+
+### Adding a New Script
+
+1. Create `scripts/new_script.py`
+2. Add a Makefile target:
+```makefile
+new-target: $(PYTHON)
+    $(PYTHON) scripts/new_script.py
+```
+3. Update `make help` output
+4. Add the `.PHONY` declaration
+
+### Modifying Fee Rules
+
+Fee rules are defined as constants in `scripts/attendance.py`:
+```python
+FEE_FULL = 750    # 2+ practices
+FEE_SINGLE = 200  # 1 practice
+```
+
+The calculation logic is in `calculate_fee()`:
+```python
+def calculate_fee(attendance_count: int) -> int:
+    if attendance_count == 0: return 0
+    if attendance_count == 1: return FEE_SINGLE
+    return FEE_FULL
+```
+
+### Adding a New Czech Month Form
+
+If you encounter a Czech month declension not yet supported, add it to `CZECH_MONTHS` in `scripts/czech_utils.py`:
+
+```python
+CZECH_MONTHS = {
+    "leden": 1, "ledna": 1, "lednu": 1,
+    "lednem": 1,  # New instrumental case
+    ...
+}
+```
+
+## Project History
+
+The project evolved through distinct phases:
+
+1. **Design phase** — Initial brainstorming captured in `docs/project-notes.md`
+2. **CLI tools** — `calculate_fees.py` and `match_payments.py` for command-line workflows
+3. **Bank integration** — `fio_utils.py` for transparent page scraping, later API support
+4. **Google Sheets sync** — `sync_fio_to_sheets.py` + `infer_payments.py` for the ledger pipeline
+5. **Web dashboard** — `app.py` with the `/fees`, `/reconcile`, and `/payments` pages
+6. **Interactive features** — Modal popups, QR payments, keyboard navigation, search filter
+7. **Fee exceptions** — Manual override system via the `exceptions` sheet tab
+8. **CI/CD** — Gitea Actions for Docker builds and Kubernetes deployment
+
+## Troubleshooting
+
+### "No data." on the web dashboard
+
+The attendance Google Sheet couldn't be fetched, or it returned empty data. Check:
+- Internet connectivity
+- The sheet ID in `attendance.py` is still valid
+- The sheet's public sharing settings haven't changed
+
+### Slow page loads
+
+Each page fetches data from Google Sheets on every request (no caching). Typical load times are 1-3 seconds. If significantly slower:
+- Check the performance breakdown (click the render time in the footer)
+- Google Sheets API rate limiting may be the cause
+
+### Import errors in scripts
+
+Ensure `PYTHONPATH` includes the `scripts/` directory:
+```bash
+export PYTHONPATH=scripts:$PYTHONPATH
+```
+
+Or use the Makefile, which sets this automatically.
+
+### "Could not fetch exceptions" warning
+
+The `exceptions` tab doesn't exist in the Payments Google Sheet. This is non-fatal — reconciliation proceeds without fee overrides.
+
+---
+
+*Development guide generated from comprehensive code analysis on 2026-03-03.*

docs/by-claude-opus/scripts.md

@@ -0,0 +1,325 @@
+# Scripts Reference
+
+All scripts live in the `scripts/` directory and are invoked via `make` targets or directly with Python.
+
+## Pipeline Scripts
+
+These scripts form the core data processing pipeline. They are typically run in sequence:
+
+### `sync_fio_to_sheets.py` — Bank → Google Sheet
+
+Syncs incoming Fio bank transactions to the Payments Google Sheet. Implements an append-only, deduplicated sync — re-running is always safe.
+
+**Usage**:
+```bash
+make sync                # Last 30 days
+make sync-2026           # Full year 2026 (Jan 1 – Dec 31, sorted)
+
+# Direct invocation with options:
+python scripts/sync_fio_to_sheets.py \
+  --credentials .secret/fuj-management-bot-credentials.json \
+  --from 2026-01-01 --to 2026-03-01 \
+  --sort-by-date
+```
+
+**Arguments**:
+
+| Argument | Default | Description |
+|----------|---------|-------------|
+| `--days` | `30` | Days to look back (ignored if `--from`/`--to` set) |
+| `--sheet-id` | Built-in ID | Target Google Sheet |
+| `--credentials` | `credentials.json` | Path to Google API credentials |
+| `--from` | *(auto)* | Start date (YYYY-MM-DD) |
+| `--to` | *(auto)* | End date (YYYY-MM-DD) |
+| `--sort-by-date` | `false` | Sort the entire sheet by date after sync |
+
+**How it works**:
+
+1. Reads existing Sync IDs (column K) from the Google Sheet
+2. Fetches transactions from Fio bank (API or transparent page scraping)
+3. For each transaction, generates a SHA-256 hash: `sha256(date|amount|currency|sender|vs|message|bank_id)`
+4. Appends only transactions whose hash doesn't exist in the sheet
+5. Optionally sorts the sheet by date
+
+**Key functions**:
+
+| Function | Signature | Description |
+|----------|-----------|-------------|
+| `get_sheets_service` | `(credentials_path: str) → Resource` | Authenticates with Google Sheets API. Supports both service accounts and OAuth2 flows. |
+| `generate_sync_id` | `(tx: dict) → str` | Creates the SHA-256 deduplication hash for a transaction. |
+| `sort_sheet_by_date` | `(service, spreadsheet_id)` | Sorts all rows (excluding header) by the Date column. |
+| `sync_to_sheets` | `(spreadsheet_id, credentials_path, ...)` | Main sync logic — read existing, fetch new, deduplicate, append. |
+
+**Output example**:
+```
+Connecting to Google Sheets using .secret/fuj-management-bot-credentials.json...
+Reading existing sync IDs from sheet...
+Fetching Fio transactions from 2026-02-01 to 2026-03-03...
+Found 15 transactions.
+Appending 3 new transactions to the sheet...
+Sync completed successfully.
+Sheet sorted by date.
+```
+
+---
+
+### `infer_payments.py` — Auto-Fill Person/Purpose
+
+Scans the Payments Google Sheet for rows with empty Person/Purpose columns and uses name matching and Czech month parsing to fill them automatically.
+
+**Usage**:
+```bash
+make infer
+
+# Dry run (preview without writing):
+python scripts/infer_payments.py \
+  --credentials .secret/fuj-management-bot-credentials.json \
+  --dry-run
+```
+
+**Arguments**:
+
+| Argument | Default | Description |
+|----------|---------|-------------|
+| `--sheet-id` | Built-in ID | Target Google Sheet |
+| `--credentials` | `credentials.json` | Path to Google API credentials |
+| `--dry-run` | `false` | Print inferences without writing to the sheet |
+
+**How it works**:
+
+1. Reads all rows from the Payments Google Sheet
+2. Fetches the member list from the Attendance Sheet
+3. For each row where Person AND Purpose are empty AND there's no "manual fix":
+   - Combines sender name + message text
+   - Attempts to match against member names (using name variants and diacritics normalization)
+   - Parses Czech month references from the message
+   - Writes inferred Person, Purpose, and Amount back to the sheet
+4. Low-confidence matches are prefixed with `[?]` for manual review
+
+**Skipping rules**:
+- If `manual fix` column has any value → skip
+- If `Person` column already has a value → skip
+- If `Purpose` column already has a value → skip
+
+**Output example**:
+```
+Connecting to Google Sheets...
+Reading sheet data...
+Fetching member list for matching...
+Inffering details for empty rows...
+Row 45: Inferred Jan Novák for 2026-02 (750 CZK)
+Row 46: Inferred [?] František Vrbík for 2026-01, 2026-02 (1500 CZK)
+Applying 2 updates to the sheet...
+Update completed successfully.
+```
+
+---
+
+### `match_payments.py` — Reconciliation Engine + CLI Report
+
+The core reconciliation engine. Matches payment transactions against expected fees and generates a detailed report. Also used as a library by `app.py` and `infer_payments.py`.
+
+**Usage**:
+```bash
+make reconcile
+
+# Direct invocation:
+python scripts/match_payments.py \
+  --credentials .secret/fuj-management-bot-credentials.json \
+  --sheet-id YOUR_SHEET_ID
+```
+
+**Arguments**:
+
+| Argument | Default | Description |
+|----------|---------|-------------|
+| `--sheet-id` | Built-in ID | Payments Google Sheet |
+| `--credentials` | `.secret/fuj-management-bot-credentials.json` | Google API credentials |
+| `--bank` | `false` | Fetch directly from Fio bank instead of the Google Sheet |
+
+**Key functions**:
+
+| Function | Description |
+|----------|-------------|
+| `_build_name_variants(name)` | Generates searchable name variants from a member name. E.g., "František Vrbík (Štrúdl)" → `["frantisek vrbik", "strudl", "vrbik", "frantisek"]` |
+| `match_members(text, member_names)` | Finds members mentioned in text. Returns `(name, confidence)` tuples where confidence is `auto` or `review`. |
+| `infer_transaction_details(tx, member_names)` | Infers member(s) and month(s) for a single transaction. |
+| `format_date(val)` | Normalizes dates from Google Sheets (handles serial numbers and strings). |
+| `fetch_sheet_data(spreadsheet_id, credentials_path)` | Reads all rows from the Payments sheet as a list of dicts. |
+| `fetch_exceptions(spreadsheet_id, credentials_path)` | Reads fee overrides from the `exceptions` sheet tab. |
+| `reconcile(members, sorted_months, transactions, exceptions)` | **Core engine**: matches transactions to members/months, calculates balances. |
+| `print_report(result, sorted_months)` | Prints the CLI reconciliation report. |
+
+**Name matching strategy**:
+
+The matching algorithm uses multiple tiers, in order of confidence:
+
+| Priority | What it checks | Confidence |
+|----------|---------------|-----------|
+| 1 | Full name (normalized) found in text | `auto` |
+| 2 | Both first and last name present (any order) | `auto` |
+| 3 | Nickname from parentheses matches | `auto` |
+| 4 | Last name only (≥4 chars, not in common surname list) | `review` |
+| 5 | First name only (≥3 chars) | `review` |
+
+**Common surnames excluded from last-name-only matching**: `novak`, `novakova`, `prach`
+
+If any `auto`-confidence match exists, all `review` matches are discarded.
+
+**Payment allocation**:
+
+When a transaction matches multiple members and/or multiple months, the amount is split **evenly** across all allocations:
+```
+per_allocation = amount / (num_members × num_months)
+```
+
+**CLI report sections**:
+
+1. **Summary table** — Per-member, per-month grid: `OK`, `UNPAID {amount}`, `{paid}/{expected}`, balance
+2. **Credits** — Members with positive total balance
+3. **Debts** — Members with negative total balance
+4. **Unmatched transactions** — Payments that couldn't be assigned
+5. **Matched transaction details** — Full breakdown with `[REVIEW]` flags
+
+---
+
+### `calculate_fees.py` — Fee Calculation
+
+Calculates and prints monthly fees in a simple table format.
+
+**Usage**:
+```bash
+make fees
+```
+
+**Output example**:
+```
+Member                  |        Jan 2026 |        Feb 2026
+-------------------------------------------------------
+Jan Novák               |    750 CZK (4)  |    200 CZK (1)
+Alice Testová           |              -  |    750 CZK (3)
+-------------------------------------------------------
+TOTAL                   |       750 CZK   |       950 CZK
+```
+
+This is a simpler CLI version of the `/fees` web page. It only shows adults (tier A).
+
+---
+
+## Shared Modules
+
+### `attendance.py` — Attendance Data & Fee Logic
+
+Shared module that fetches attendance data from the Google Sheet and computes fees.
+
+**Constants**:
+
+| Constant | Value | Description |
+|----------|-------|-------------|
+| `SHEET_ID` | `1E2e_gT_K5AwSRCDLDTa2UetZTkHmBOcz0kFbBUNUNBA` | Attendance Google Sheet ID |
+| `FEE_FULL` | `750` | Monthly fee for 2+ practices |
+| `FEE_SINGLE` | `200` | Monthly fee for exactly 1 practice |
+| `COL_NAME` | `0` | Column index for member name |
+| `COL_TIER` | `1` | Column index for member tier |
+| `FIRST_DATE_COL` | `3` | First column with date headers |
+
+**Functions**:
+
+| Function | Signature | Description |
+|----------|-----------|-------------|
+| `fetch_csv` | `() → list[list[str]]` | Downloads the attendance sheet as CSV via its public export URL. No authentication needed. |
+| `parse_dates` | `(header_row) → list[tuple[int, datetime]]` | Parses `M/D/YYYY` dates from the header row and returns `(column_index, date)` pairs. |
+| `group_by_month` | `(dates) → dict[str, list[int]]` | Groups column indices by `YYYY-MM` month key. |
+| `calculate_fee` | `(count: int) → int` | Applies fee rules: 0→0, 1→200, 2+→750 CZK. |
+| `get_members` | `(rows) → list[tuple[str, str, list[str]]]` | Parses member rows. Stops at `# last line` sentinel. Skips comment rows (starting with `#`). |
+| `get_members_with_fees` | `() → tuple[list, list[str]]` | Full pipeline: fetch → parse → compute. Returns `(members, sorted_months)` where each member is `(name, tier, {month: (fee, count)})`. |
+
+**Member tier codes**:
+
+| Tier | Meaning | Fees? |
+|------|---------|-------|
+| `A` | Adult | Yes (200 or 750 CZK) |
+| `J` | Junior | No (separate sheet) |
+| `X` | Exempt | No |
+
+---
+
+### `fio_utils.py` — Fio Bank Integration
+
+Handles fetching transactions from Fio bank, supporting both API and HTML scraping modes.
+
+**Functions**:
+
+| Function | Description |
+|----------|-------------|
+| `fetch_transactions(date_from, date_to)` | Main entry point. Uses API if `FIO_API_TOKEN` is set, falls back to transparent page scraping. |
+| `fetch_transactions_api(token, date_from, date_to)` | Fetches via Fio REST API (JSON). Returns richer data including sender account and stable bank IDs. |
+| `fetch_transactions_transparent(date_from, date_to, account_id)` | Scrapes the public Fio transparent account HTML page. |
+| `parse_czech_amount(s)` | Parses Czech currency strings like `"1 500,00 CZK"` to float. |
+| `parse_czech_date(s)` | Parses `DD.MM.YYYY` or `DD/MM/YYYY` to `YYYY-MM-DD`. |
+
+**FioTableParser** — A custom `HTMLParser` subclass that extracts transaction rows from the second `<table class="table">` on the Fio transparent page. Column mapping:
+
+| Index | Column |
+|-------|--------|
+| 0 | Date (Datum) |
+| 1 | Amount (Částka) |
+| 2 | Type (Typ) |
+| 3 | Sender name (Název protiúčtu) |
+| 4 | Message (Zpráva pro příjemce) |
+| 5 | KS (constant symbol) |
+| 6 | VS (variable symbol) |
+| 7 | SS (specific symbol) |
+| 8 | Note (Poznámka) |
+
+**Transaction dict format** (returned by all fetch functions):
+
+```python
+{
+    "date": "2026-01-15",      # YYYY-MM-DD
+    "amount": 750.0,           # Float, always positive (outgoing filtered)
+    "sender": "Jan Novák",     # Sender name
+    "message": "příspěvek",    # Message for recipient
+    "vs": "12345",             # Variable symbol
+    "ks": "",                  # Constant symbol
+    "ss": "",                  # Specific symbol
+    "bank_id": "abc123",       # Bank operation ID (API only)
+    "user_id": "...",          # User identification (API only)
+    "sender_account": "...",   # Sender account number (API only)
+    "currency": "CZK"          # Currency (API only)
+}
+```
+
+---
+
+### `czech_utils.py` — Czech Language Utilities
+
+Text processing utilities for Czech language content, critical for matching payment messages.
+
+**`normalize(text: str) → str`**
+
+Strips diacritics and lowercases text using Unicode NFKD normalization:
+- `"Štrúdl"` → `"strudl"`
+- `"František Vrbík"` → `"frantisek vrbik"`
+- `"LEDEN 2026"` → `"leden 2026"`
+
+**`parse_month_references(text: str, default_year=2026) → list[str]`**
+
+Extracts YYYY-MM month references from Czech free text. Handles a remarkable variety of formats:
+
+| Input | Output | Pattern |
+|-------|--------|---------|
+| `"leden"` | `["2026-01"]` | Czech month name |
+| `"ledna"` | `["2026-01"]` | Czech month declension |
+| `"01/26"` | `["2026-01"]` | Numeric short year |
+| `"1/2026"` | `["2026-01"]` | Numeric full year |
+| `"11+12/2025"` | `["2025-11", "2025-12"]` | Multiple slash-separated |
+| `"12.2025"` | `["2025-12"]` | Dot notation |
+| `"listopad-leden"` | `["2025-11", "2025-12", "2026-01"]` | Range with year wrap |
+| `"říjen"` | `["2025-10"]` | Months ≥ October assumed previous year |
+
+**`CZECH_MONTHS`** — Dictionary mapping all Czech month name forms (nominative, genitive, locative) to month numbers. 35 entries covering all 12 months in multiple declensions.
+
+---
+
+*Scripts reference generated from comprehensive code analysis on 2026-03-03.*

docs/by-claude-opus/testing.md

@@ -0,0 +1,145 @@
+# Testing Guide
+
+## Overview
+
+The project uses Python's built-in `unittest` framework with `unittest.mock` for mocking external dependencies (Google Sheets API, attendance data). Tests live in the `tests/` directory.
+
+## Running Tests
+
+```bash
+make test        # Run all tests
+make test-v      # Run with verbose output
+```
+
+Under the hood:
+```bash
+PYTHONPATH=scripts:. python3 -m unittest discover tests
+```
+
+The `PYTHONPATH` includes both `scripts/` and the project root so that test files can import from both `app.py` and `scripts/*.py`.
+
+## Test Files
+
+### `test_app.py` — Flask Route Tests
+
+Tests the Flask web application routes using Flask's built-in test client. All external data fetching is mocked.
+
+| Test | What it verifies |
+|------|-----------------|
+| `test_index_page` | `GET /` returns 200 and contains a redirect to `/fees` |
+| `test_fees_route` | `GET /fees` renders the fees dashboard with correct member names |
+| `test_reconcile_route` | `GET /reconcile` renders the reconciliation page with payment matching |
+| `test_payments_route` | `GET /payments` renders the ledger with grouped transactions |
+
+**Mocking strategy**:
+
+```python
+@patch('app.get_members_with_fees')
+def test_fees_route(self, mock_get_members):
+    mock_get_members.return_value = (
+        [('Test Member', 'A', {'2026-01': (750, 4)})],
+        ['2026-01']
+    )
+    response = self.client.get('/fees')
+    self.assertEqual(response.status_code, 200)
+    self.assertIn(b'Test Member', response.data)
+```
+
+Each test patches the data-fetching functions (`get_members_with_fees`, `fetch_sheet_data`) to return controlled test data, avoiding any network calls.
+
+**Notable**: The reconcile route test also mocks `fetch_sheet_data` and verifies that the reconciliation engine correctly matches a payment against an expected fee (checking for "OK" in the response).
+
+### `test_reconcile_exceptions.py` — Reconciliation Logic Tests
+
+Tests the `reconcile()` function directly (unit tests for the core business logic):
+
+| Test | What it verifies |
+|------|-----------------|
+| `test_reconcile_applies_exceptions` | When a fee exception exists (400 CZK instead of 750), the expected amount is overridden and balance is calculated correctly |
+| `test_reconcile_fallback_to_attendance` | When no exception exists, the attendance-based fee is used |
+
+**Why these tests matter**: The exception system is critical for correctness — an incorrect override could cause members to be shown incorrect amounts owed. These tests verify that:
+- Exceptions properly override the attendance-based fee
+- The absence of an exception correctly falls back to the standard calculation
+- Balances are computed correctly against overridden amounts
+
+## Test Data Patterns
+
+The tests use minimal but representative data:
+
+```python
+# A member with attendance-based fee
+members = [('Alice', 'A', {'2026-01': (750, 4)})]
+
+# An exception reducing the fee
+exceptions = {('alice', '2026-01'): {'amount': 400, 'note': 'Test exception'}}
+
+# A matching payment
+transactions = [{
+    'date': '2026-01-05',
+    'amount': 400,
+    'person': 'Alice',
+    'purpose': '2026-01',
+    'inferred_amount': 400,
+    'sender': 'Alice Sender',
+    'message': 'fee'
+}]
+```
+
+## What's Not Tested
+
+| Area | Status | Notes |
+|------|--------|-------|
+| Name matching logic | ❌ Not tested | `match_members()`, `_build_name_variants()` |
+| Czech month parsing | ❌ Not tested | `parse_month_references()` |
+| Fio bank data fetching | ❌ Not tested | Both API and HTML scraping |
+| Sync deduplication | ❌ Not tested | `generate_sync_id()` |
+| QR code generation | ❌ Not tested | `/qr` route |
+| Payment inference | ❌ Not tested | `infer_payments.py` logic |
+| Multi-person payment splitting | ❌ Not tested | Even split across members/months |
+| Edge cases | ❌ Not tested | Empty sheets, malformed dates, etc. |
+
+## Writing New Tests
+
+### Adding a Flask route test
+
+```python
+# In tests/test_app.py
+
+@patch('app.some_function')
+def test_new_route(self, mock_fn):
+    mock_fn.return_value = expected_data
+    response = self.client.get('/new-route')
+    self.assertEqual(response.status_code, 200)
+    self.assertIn(b'expected content', response.data)
+```
+
+### Adding a reconciliation logic test
+
+```python
+# In tests/test_reconcile_exceptions.py (or a new test file)
+
+def test_multi_month_payment(self):
+    members = [('Bob', 'A', {
+        '2026-01': (750, 3),
+        '2026-02': (750, 4)
+    })]
+    transactions = [{
+        'date': '2026-02-01',
+        'amount': 1500,
+        'person': 'Bob',
+        'purpose': '2026-01, 2026-02',
+        'inferred_amount': 1500,
+        'sender': 'Bob',
+        'message': 'leden+unor'
+    }]
+    result = reconcile(members, ['2026-01', '2026-02'], transactions)
+    bob = result['members']['Bob']
+    self.assertEqual(bob['months']['2026-01']['paid'], 750)
+    self.assertEqual(bob['months']['2026-02']['paid'], 750)
+    self.assertEqual(bob['total_balance'], 0)
+```
+
+---
+
+*Testing documentation generated from comprehensive code analysis on 2026-03-03.*

docs/by-claude-opus/user-guide.md

@@ -0,0 +1,166 @@
+# User Guide — FUJ Web Dashboard
+
+## Getting Started
+
+Start the dashboard with:
+
+```bash
+make web
+```
+
+The dashboard is available at **http://localhost:5001** and provides three pages accessible via the green navigation bar at the top.
+
+## Page 1: Attendance & Fees (`/fees`)
+
+This page answers the question: **"How much does each member owe this month?"**
+
+### What You See
+
+A table with one row per adult member and one column per month. Each cell shows:
+
+| Cell | Meaning |
+|------|---------|
+| `750 CZK (4)` | Member owes 750 CZK (attended 4 practices that month) |
+| `200 CZK (1)` | Member owes 200 CZK (attended 1 practice) |
+| `-` | Member didn't attend — no fee |
+| `400 (750) CZK (3)` | Fee **overridden** from 750 to 400 CZK (shown in orange) |
+
+The bottom row shows **monthly totals** — the total amount expected from all adult members.
+
+### Fee Rules
+
+| Practices in a month | Monthly fee |
+|----------------------|-------------|
+| 0 | 0 CZK (no charge) |
+| 1 | 200 CZK |
+| 2 or more | 750 CZK |
+
+### Source Links
+
+At the top, you'll find direct links to:
+- **Attendance Sheet** — the Google Sheet with raw attendance data
+- **Payments Ledger** — the Google Sheet with bank transactions
+
+---
+
+## Page 2: Payment Reconciliation (`/reconcile`)
+
+This page answers: **"Who has paid, who hasn't, and who owes extra?"**
+
+### Main Table
+
+Each cell in the matrix shows the payment status for a member × month combination:
+
+| Cell | Color | Meaning |
+|------|-------|---------|
+| `OK` | 🟢 Green | Fully paid |
+| `UNPAID 750` | 🔴 Red | Haven't paid at all |
+| `300/750` | 🔴 Red | Partially paid (300 out of 750) |
+| `-` | Gray | No fee expected |
+| `PAID 200` | — | Payment received but no fee expected |
+
+The rightmost column shows each member's **total balance**:
+- **Positive** (green): Member has overpaid / has credit
+- **Negative** (red): Member still owes money
+- **Zero**: Fully settled
+
+### Search Filter
+
+Type in the search box at the top to filter members by name. The search is **diacritic-insensitive** — typing "novak" will match "Novák".
+
+### Member Details
+
+Click the **`[i]`** icon next to any member's name to open a detailed popup:
+
+1. **Status Summary** — Month-by-month breakdown with attendance count, expected fee, paid amount, and status. Overridden fees are marked with an amber asterisk.
+
+2. **Fee Exceptions** — If any months have manual fee overrides, they're listed here with the override amount and reason.
+
+3. **Payment History** — Every bank transaction matched to this member, showing the date, amount, sender, and payment message.
+
+**Keyboard shortcuts** (when the popup is open):
+- `↑` / `↓` — Navigate to the previous/next member
+- `Escape` — Close the popup
+
+### QR Code Payments
+
+When you hover over an unpaid or partially paid cell, a red **"Pay"** button appears. Clicking it opens a QR code that can be scanned with any Czech banking app. The QR code is pre-filled with:
+
+- The club's bank account number
+- The exact amount owed
+- A payment message identifying the member and month
+
+This makes it trivial to send a payment link to a member who owes money.
+
+### Summary Sections
+
+Below the main table, three additional sections may appear:
+
+| Section | Shows |
+|---------|-------|
+| **Credits** | Members with positive balances (advance payments or overpayments) |
+| **Debts** | Members with negative balances (outstanding fees) |
+| **Unmatched Transactions** | Bank transactions that couldn't be automatically matched to any member |
+
+---
+
+## Page 3: Payments Ledger (`/payments`)
+
+This page answers: **"What payments has each member made?"**
+
+### What You See
+
+Transactions grouped by member name, each showing:
+- **Date** — When the payment was received
+- **Amount** — How much was paid (in CZK)
+- **Purpose** — Which month(s) the payment covers
+- **Bank Message** — The original message from the bank transfer
+
+Transactions are sorted newest-first within each member's section.
+
+### Unmatched Payments
+
+Transactions that couldn't be assigned to a member appear under **"Unmatched / Unknown"** — these typically need manual review in the Google Sheet.
+
+---
+
+## Performance Footer
+
+Every page shows a **render time** in the bottom-right corner (very small, gray text). This tells you how long the page took to generate.
+
+Click on it to reveal a detailed breakdown showing how much time was spent on each step (fetching members, fetching payments, reconciliation, template rendering, etc.). This is mostly useful for debugging slow page loads.
+
+---
+
+## Common Workflows
+
+### "A member asks how much they owe"
+
+1. Open `/reconcile`
+2. Search for the member's name
+3. Their row shows the exact status per month
+4. Click `[i]` for detailed payment history
+
+### "A member wants to pay"
+
+1. Open `/reconcile`
+2. Find the unpaid cell
+3. Hover and click the red **Pay** button
+4. Share the QR code with the member (screenshot or show on screen)
+
+### "I want to see all payments from one person"
+
+1. Open `/payments`
+2. Scroll to the member's section (alphabetically sorted)
+
+### "A transaction wasn't matched correctly"
+
+1. Open the **Payments Ledger** Google Sheet (link at the top of any page)
+2. Find the row
+3. Manually correct the **Person** and/or **Purpose** columns
+4. Put any marker in the **manual fix** column to prevent the inference script from overwriting your edit
+5. Refresh the web dashboard
+
+---
+
+*User guide generated from comprehensive code analysis on 2026-03-03.*

docs/by-claude-opus/web-app.md

@@ -0,0 +1,256 @@
+# Web Application Documentation
+
+## Overview
+
+The FUJ Management web application is a Flask-based dashboard that provides real-time visibility into club finances. It renders server-side HTML with embedded CSS and JavaScript — no build tools, no npm, no framework. The UI follows a distinctive **terminal-inspired aesthetic** with monospace fonts, green-on-black colors, and dashed borders.
+
+## Routes
+
+### `GET /` — Index (Redirect)
+
+Redirects to `/fees` via an HTML meta refresh tag. This exists so the root URL always leads somewhere useful.
+
+### `GET /fees` — Attendance & Fees Dashboard
+
+**Template**: `templates/fees.html`
+
+Displays a table of all adult members with their calculated monthly fees based on attendance. Each cell shows the fee amount (in CZK), the number of practices attended, or a dash for months with zero attendance.
+
+**Data pipeline**:
+```
+attendance.py::get_members_with_fees()    →  Filter to tier "A" (adults)
+match_payments.py::fetch_exceptions()     →  Check for fee overrides
+                                           →  Format cells with override indicators
+                                           →  Render fees.html with totals row
+```
+
+**Visual features**:
+- Fee overrides shown in **orange** with the original amount in parentheses
+- Empty months shown in muted gray
+- Monthly totals row at the bottom
+- Performance timing in the footer (click to expand breakdown)
+
+**Template variables**:
+
+| Variable | Type | Content |
+|----------|------|---------|
+| `months` | `list[str]` | Month labels like "Jan 2026" |
+| `results` | `list[dict]` | `{name, months: [{cell, overridden}]}` |
+| `totals` | `list[str]` | Monthly total strings like "3750 CZK" |
+| `attendance_url` | `str` | Link to the attendance Google Sheet |
+| `payments_url` | `str` | Link to the payments Google Sheet |
+
+### `GET /reconcile` — Payment Reconciliation
+
+**Template**: `templates/reconcile.html`  (802 lines — the most complex template)
+
+The centerpiece of the application. Shows a matrix of members × months with payment status, plus summary sections for credits, debts, and unmatched transactions.
+
+**Data pipeline**:
+```
+attendance.py::get_members_with_fees()    →  All members + fees
+match_payments.py::fetch_sheet_data()     →  All payment transactions
+match_payments.py::fetch_exceptions()     →  Fee overrides
+match_payments.py::reconcile()            →  Match payments ↔ fees
+                                           →  Render reconcile.html
+```
+
+**Cell statuses**:
+
+| Status | CSS Class | Display | Meaning |
+|--------|-----------|---------|---------|
+| `empty` | `cell-empty` | `-` | No fee expected, no payment |
+| `ok` | `cell-ok` | `OK` | Paid in full (green) |
+| `partial` | `cell-unpaid` | `300/750` | Partially paid (red) |
+| `unpaid` | `cell-unpaid` | `UNPAID 750` | Nothing paid (red) |
+| `surplus` | — | `PAID 200` | Payment received but no fee expected |
+
+**Interactive features**:
+
+1. **Member detail modal** — Click the `[i]` icon next to any member name to see:
+   - Status summary table (month, attendance count, expected, paid, status)
+   - Fee exceptions (if any, shown in amber)
+   - Full payment history with dates, amounts, senders, and messages
+
+2. **Keyboard navigation** — When a member modal is open:
+   - `↑` / `↓` arrows navigate between members (respecting search filter)
+   - `Escape` closes the modal
+
+3. **Name search filter** — Type in the search box to filter members. Uses diacritic-insensitive matching (e.g., typing "novak" matches "Novák").
+
+4. **QR Payment** — Hover over an unpaid/partial cell to reveal a "Pay" button. Clicking it opens a QR code modal with:
+   - A Czech SPD-format QR code (scannable by Czech banking apps)
+   - Pre-filled account number, amount, and payment message
+   - The QR image is generated server-side via `GET /qr`
+
+**Client-side data**:
+
+The template receives a full JSON dump of member data (`member_data`) embedded in a `<script>` tag. This powers the modal without additional API calls:
+
+```javascript
+const memberData = {{ member_data | safe }};
+const sortedMonths = {{ raw_months | tojson }};
+```
+
+**Summary sections** (rendered below the main table):
+
+| Section | Shown when | Content |
+|---------|-----------|---------|
+| Credits | Any member has positive balance | Names with surplus amounts |
+| Debts | Any member has negative balance | Names with outstanding amounts (red) |
+| Unmatched Transactions | Any transaction couldn't be matched | Date, amount, sender, message |
+
+### `GET /payments` — Payments Ledger
+
+**Template**: `templates/payments.html`
+
+Displays all bank transactions grouped by member name. Each member section shows their transactions in reverse chronological order.
+
+**Data pipeline**:
+```
+match_payments.py::fetch_sheet_data()     →  All transactions
+                                           →  Group by Person column
+                                           →  Strip [?] markers
+                                           →  Handle comma-separated people
+                                           →  Sort by date descending
+                                           →  Render payments.html
+```
+
+**Multi-person handling**: If a transaction's "Person" field contains comma-separated names (e.g., "Alice, Bob"), the transaction appears under both Alice's and Bob's sections.
+
+### `GET /qr` — QR Code Generator
+
+Returns a PNG image containing a Czech SPD (Short Payment Descriptor) QR code.
+
+**Query parameters**:
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `account` | `BANK_ACCOUNT` env var | IBAN or Czech account number |
+| `amount` | `0` | Payment amount |
+| `message` | *(empty)* | Payment message (max 60 chars) |
+
+**SPD format**: `SPD*1.0*ACC:{account}*AM:{amount}*CC:CZK*MSG:{message}`
+
+This format is recognized by all Czech banking apps and generates a pre-filled payment order when scanned.
+
+## UI Design System
+
+### Color Palette
+
+| Element | Color | Hex |
+|---------|-------|-----|
+| Background | Near-black | `#0c0c0c` |
+| Base text | Medium gray | `#cccccc` |
+| Headings, accents, "OK" | Terminal green | `#00ff00` |
+| Unpaid, debts | Alert red | `#ff3333` |
+| Fee overrides | Amber/orange | `#ffa500` / `#ffaa00` |
+| Empty/muted | Dark gray | `#444444` |
+| Borders | Subtle gray | `#333` (dashed), `#555` (solid) |
+
+### Typography
+
+All text uses the system monospace font stack:
+```css
+font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, 
+             "Liberation Mono", "Courier New", monospace;
+```
+
+Base font size is 11px with 1.2 line-height — intentionally dense for a data-heavy dashboard.
+
+### Navigation
+
+A persistent nav bar appears at the top of every page:
+```
+[Attendance/Fees]   [Payment Reconciliation]   [Payments Ledger]
+```
+The active page's link is highlighted with inverted colors (black text on green background).
+
+### Shared Footer
+
+Every page includes a click-to-expand performance timer showing total render time and a per-step breakdown.
+
+## Flask Application Architecture
+
+### Request Lifecycle
+
+```
+Request → @app.before_request (start timer) → Route handler → Template → Response
+              │                                     │
+              ▼                                     ▼
+         g.start_time                        record_step("fetch_members")
+         g.steps = []                        record_step("fetch_payments")
+                                             record_step("process_data")
+                                                    │
+                                                    ▼
+                                             @app.context_processor
+                                             inject_render_time()
+                                                    │
+                                                    ▼
+                                             {{ get_render_time() }}
+                                             in template footer
+```
+
+### Module Loading
+
+The Flask app adds the `scripts/` directory to `sys.path` at startup, allowing direct imports from scripts:
+
+```python
+scripts_dir = Path(__file__).parent / "scripts"
+sys.path.append(str(scripts_dir))
+
+from attendance import get_members_with_fees, SHEET_ID
+from match_payments import reconcile, fetch_sheet_data, fetch_exceptions, normalize
+```
+
+### Environment Variables
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `BANK_ACCOUNT` | `CZ8520100000002800359168` | Bank account for QR code generation |
+| `FIO_API_TOKEN` | *(none)* | Fio API token (used by `fio_utils.py`) |
+
+### Error Handling
+
+The application has minimal error handling:
+- If Google Sheets returns no data, routes return a simple "No data." text response
+- No custom error pages for 404/500
+- Exceptions propagate to Flask's default error handler (debug mode in development, 500 in production)
+
+## Template Architecture
+
+All three page templates share a common structure:
+
+```html
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>FUJ [Page Name]</title>
+    <style>
+        /* ALL CSS is inline — no external stylesheets */
+        /* ~150-400 lines of CSS per template */
+    </style>
+</head>
+<body>
+    <div class="nav"><!-- 3-link navigation --></div>
+    <h1>Page Title</h1>
+    <div class="description"><!-- Source links --></div>
+    
+    <!-- Page-specific content -->
+    
+    <div class="footer"><!-- Render time --></div>
+    
+    <script>
+        /* Page-specific JavaScript (only in reconcile.html) */
+    </script>
+</body>
+</html>
+```
+
+There is no shared base template (no Jinja2 template inheritance). CSS is duplicated across templates with small variations.
+
+---
+
+*Web application documentation generated from comprehensive code analysis on 2026-03-03.*

docs/by-gemini/README.md

@@ -0,0 +1,36 @@
+# FUJ Management System
+
+Welcome to the **FUJ Management System**, a streamlined solution for managing Ultimate Frisbee club finances, attendance, and member payments. This system automates the tedious parts of club management, keeping your ledger clean and your reconciliation painless.
+
+## 🚀 Mission
+
+The project's goal is to minimize manual entry and potential human error in club management by:
+1.  **Automating Bank Synchronization**: Periodically fetching transactions from Fio bank.
+2.  **Smart Inference**: Using heuristics to match bank transactions to members and payment periods.
+3.  **Visual Reconciliation**: Providing a clear, real-time web dashboard for managers to track who has paid and who is in debt.
+
+## ✨ Key Features
+
+-   **Seamless Bank Integration**: Synchronize transactions directly from the Fio bank API into a Google Spreadsheet.
+-   **Intelligent Matching**: Automatic detection of member names and payment periods from transaction messages using diacritic-insensitive Czech text processing.
+-   **Dynamic Dashboard**: A Flask-powered web interface displaying monthly fees, payment status (OK, Partial, Unpaid), and total balances.
+-   **Manual Overrides**: Support for fee exceptions and manual payment matching when automation needs a human touch.
+-   **QR Payment Generation**: Integrated QR code generation to make paying outstanding fees trivial for members.
+
+## 🛠 Tech Stack
+
+-   **Backend**: Python 3.12+ (managed with `uv`)
+-   **Web Framework**: Flask with Jinja2 templates
+-   **Data Storage**: Google Sheets (used as a collaborative database)
+-   **APIs**: Fio Bank API, Google Sheets API v4
+-   **Containerization**: Docker / OCI Images
+-   **Automation**: `Makefile` based workflow
+
+---
+
+## 📂 Documentation Guide
+
+-   [Architecture](architecture.md): High-level system design and data flow.
+-   [User Guide](user-guide.md): How to operate the system as a club manager.
+-   [Support Scripts](scripts.md): Detailed reference for CLI tools.
+-   [Deployment](deployment.md): Technical setup and infrastructure instructions.

docs/by-gemini/architecture.md

@@ -0,0 +1,48 @@
+# System Architecture
+
+The FUJ Management system is designed around a **"Sheet-as-a-Database"** architecture. This allows for easy manual editing and transparency while enabling powerful automation.
+
+## 🔄 High-Level Data Flow
+
+```mermaid
+graph TD
+    Fio[Fio Bank API] -->|Sync Script| GS(Google Spreadsheet)
+    Att[Attendance Sheet] -->|CSV Export| App(Flask Web App)
+    GS -->|API Fetch| App
+    App -->|Display| UI[Manager Dashboard]
+    GS -.->|Manual Edits| GS
+    App -->|Generate| QR[QR Codes for Members]
+```
+
+### 1. Data Ingestion (Bank to Sheet)
+The synchronization pipeline moves raw bank data into a structured format:
+-   `sync_fio_to_sheets.py` fetches transactions and appends them to the "Transactions" sheet.
+-   Each transaction is assigned a unique `Sync ID` to prevent duplicates.
+-   `infer_payments.py` processes new rows, attempting to fill the `Person`, `Purpose`, and `Inferred Amount` columns based on the message and sender.
+
+### 2. Logic & Reconciliation
+The core logic resides in shared Python scripts:
+-   **Attendance**: `attendance.py` pulls the latest practice data from a separate attendance sheet and calculates expected fees (e.g., 0/200/750 CZK rules).
+-   **Matching**: `match_payments.py` performs the "heavy lifting" by correlating members, months, and payments. It handles partial payments, overpayments (credits), and manual exceptions.
+
+### 3. Presentation Layer
+The Flask application (`app.py`) serves as the primary interface:
+-   **Fees View**: Shows attendance-based charges.
+-   **Reconciliation View**: The main "truth" dashboard showing balance per member.
+-   **Payments View**: Historical list of transactions grouped by member.
+
+## 🛡 Security & Authentication
+
+-   **Fio Bank**: Authorized via a private API token (kept in `.secret/`).
+-   **Google Sheets**: Authenticated via a **Service Account** or **OAuth2** (using `.secret/fuj-management-bot-credentials.json`).
+-   **Environment**: Secrets are never committed; the `.secret/` directory is git-ignored.
+
+## 🧩 Key Components
+
+| Component | Responsibility |
+| :--- | :--- |
+| **Google Spreadsheet** | Unified source of truth for transactions and manual overrides. |
+| **scripts/** | A suite of CLI utilities for batch processing and data maintenance. |
+| **Flask App** | Read-only views for state visualization and QR code generation. |
+| **czech_utils.py** | Diacritic-normalization and NLP for Czech month/name parsing. |
+```

docs/by-gemini/deployment.md

@@ -0,0 +1,72 @@
+# Deployment & Technical Setup
+
+This document provides instructions for developers and devops engineers to set up and deploy the FUJ Management system.
+
+## 🛠 Prerequisites
+
+-   **Python 3.12+**: The project uses modern type hinting and syntax features.
+-   **uv**: High-performance Python package installer and resolver.
+    -   Install via brew: `brew install uv`
+-   **Docker** (Optional): For containerized deployments.
+
+## ⚙️ Initial Setup
+
+1.  **Clone the repository**:
+    ```bash
+    git clone <repo-url>
+    cd fuj-management
+    ```
+
+2.  **Install dependencies**:
+    Using `uv`, everything is handled automatically:
+    ```bash
+    make venv
+    ```
+
+3.  **Secrets Management**:
+    Create a `.secret/` directory. You will need two main credentials:
+    -   `fuj-management-bot-credentials.json`: A Google Cloud Service Account key with access to the Sheets API.
+    -   `fio-token.txt`: (Implicitly used by `fio_utils.py`) Your Fio bank API token.
+
+    Ensure these are never committed! They are ignored by `.gitignore`.
+
+## 🐳 Containerization
+
+The project can be built and run as an OCI image.
+
+1.  **Build the image**:
+    ```bash
+    make image
+    ```
+    This uses the `build/Dockerfile`, which is optimized for small size and security.
+
+2.  **Run the container**:
+    ```bash
+    make run
+    ```
+    The app exposes port `5001`.
+
+## 🧪 Testing & Validation
+
+The project includes a suite of infrastructure and logic tests.
+
+-   **Run all tests**:
+    ```bash
+    make test
+    ```
+-   **Verbose output**:
+    ```bash
+    make test-v
+    ```
+
+Tests are located in the `tests/` directory and use the standard Python `unittest` framework. They cover:
+-   CSV parsing logic.
+-   Fee calculation rules.
+-   Name matching and normalization.
+
+## 🚀 Future Roadmap
+
+-   **Automated Backups**: Regular snapshots of the Google Sheet.
+-   **Authentication Layer**: Login for the web dashboard (currently assumes internal VPN or trusted environment).
+-   **Gitea Actions**: Continuous Integration for building and testing images.
+```

docs/by-gemini/scripts.md

@@ -0,0 +1,66 @@
+# Support Scripts Reference
+
+The project includes several CLI utilities located in the `scripts/` directory. Most are accessible via `make` targets.
+
+## 🚀 Primary Scripts
+
+### `sync_fio_to_sheets.py`
+**Target**: `make sync` | `make sync-2026`
+- **Purpose**: Downloads transactions from Fio bank via API and appends new ones to the Google Sheet.
+- **Key Logic**: Uses a `Sync ID` (SHA-256 hash of transaction details) to ensure that even if the sync is run multiple times, no duplicate rows are created.
+- **Arguments**:
+    - `--days`: How many days back to look (default 30).
+    - `--from/--to`: Specific date range.
+    - `--sort-by-date`: Re-sorts the spreadsheet after appending.
+
+### `infer_payments.py`
+**Target**: `make infer`
+- **Purpose**: Processes the "Transactions" sheet to fill in `Person`, `Purpose`, and `Inferred Amount`.
+- **Logic**: 
+    - Analyzes the `Sender` and `Message` fields.
+    - Uses `match_payments.py` heuristics to find members.
+    - If confidence is low, prefixes the name with `[?]` to flag it for manual review.
+    - Won't overwrite cells that already have data (respecting your manual fixes).
+
+### `match_payments.py`
+**Target**: `make match` | `make reconcile`
+- **Purpose**: The core "Reconciliation Engine".
+- **Logic**:
+    - Fetches attendance fees (from `attendance.py`).
+    - Fetches transaction data.
+    - Correlates them based on inferred `Person` and `Purpose`.
+    - Handles "rollover" balances—extra money from one month is tracked as a credit for the next.
+
+---
+
+## 🛠 Utility Modules
+
+### `attendance.py`
+- Handles the connection to the Google Attendance sheet (exported as CSV).
+- Implements the club's fee rules:
+    - 0 practices = 0 CZK
+    - 1 practice = 200 CZK
+    - 2+ practices = 750 CZK
+- *Note*: Fee calculation only applies to members in Tier "A" (Adults).
+
+### `czech_utils.py`
+- **Normalization**: Strips diacritics and lowercases text (e.g., `František` -> `frantisek`).
+- **Month Parsing**: Advanced regex to detect month references in Czech (e.g., "leden-brezen", "11+12/25", "na únor").
+
+### `fio_utils.py`
+- Low-level wrapper for the Fio Bank API.
+- Handles HTTP requests and JSON parsing for transaction lists.
+
+---
+
+## ⚙️ Makefile Summary
+
+| Command | Action |
+| :--- | :--- |
+| `make fees` | Preview calculated fees based on attendance. |
+| `make sync` | Sync last 30 days of bank data. |
+| `make infer` | Run smart tagging on the sheet. |
+| `make reconcile` | Run a text-based reconciliation report in terminal. |
+| `make web` | Start the Flask dashboard. |
+| `make test` | Run the test suite. |
+```

docs/by-gemini/user-guide.md

@@ -0,0 +1,61 @@
+# User Guide
+
+This guide is intended for club managers who use the FUJ Management system for day-to-day operations.
+
+## 🛠 Operational Workflow
+
+To keep the club finances up-to-date, follow these steps periodically (e.g., once a week):
+
+1.  **Sync Bank Transactions**:
+    Run the sync script to pull the latest payments from Fio.
+    ```bash
+    make sync
+    ```
+2.  **Infer Payments**:
+    Let the system automatically tag who paid for what.
+    ```bash
+    make infer
+    ```
+3.  **Manual Review (Google Sheets)**:
+    Open the Google Spreadsheet. Check rows with the `[?]` prefix in the `Person` column—these require human confirmation.
+    - If correct: Remove the `[?]` prefix.
+    - If incorrect: Manually fix the `Person` and `Purpose`.
+    - If a payment covers a special case: Use the **exceptions** sheet to override expected fees.
+4.  **Check Reconciliation Dashboard**:
+    Start the web app to see the final balance report.
+    ```bash
+    make web
+    ```
+    Navigate to `http://localhost:5001/reconcile`.
+
+---
+
+## 📊 Understanding the Dashboard
+
+### Reconciliation Page
+- **Green (OK)**: Member has paid exactly what was expected (or more).
+- **Orange (Partial)**: Some payment was received, but there's still a debt.
+- **Red (UNPAID)**: No payment recorded for this month.
+- **Blue (SURPLUS)**: Payment received for a month where no fee was expected.
+
+### Handling Debts
+If a member is in debt, you can click on the unpaid/partial cell to get a **QR Platba** link. You can send this link or screenshot to the member to facilitate quick payment.
+
+---
+
+## ❓ FAQ & Troubleshooting
+
+### Why is a payment "Unmatched"?
+A payment stays unmatched if neither the sender name nor the message contains recognizable member names or nicknames. 
+- **Fix**: Manually enter the member's name in the `Person` column in the Google Sheet.
+
+### How do I handle a "Family Discount" or "Prepaid Year"?
+Use the `exceptions` sheet in the Google Spreadsheet.
+1. Add the member's name (exactly as it appears in attendance).
+2. Enter the month (e.g., `2026-03`).
+3. Enter the new `Amount` (use `0` for prepaid).
+4. Add a `Note` for clarity.
+
+### The web app is slow to load.
+The app fetches data from Google Sheets API on every request. This ensures real-time data but can take a few seconds. The "Performance Breakdown" footer shows exactly where the time was spent.
+```

docs/index.html

@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <title>FUJ Management - Documentation</title>
+    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
+    <meta name="description" content="Documentation for FUJ Management Application">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
+    <link rel="stylesheet" href="//cdn.jsdelivr.net/npm/docsify@4/lib/themes/vue.css">
+    <style>
+        :root {
+            --theme-color: #42b983;
+        }
+
+        .sidebar {
+            background-color: #f8f9fa;
+        }
+    </style>
+</head>
+
+<body>
+    <div id="app">Loading documentation...</div>
+    <script>
+        window.$docsify = {
+            name: 'FUJ Management',
+            repo: '',
+            loadSidebar: true,
+            subMaxLevel: 2,
+            search: 'auto',
+            auto2top: true,
+            alias: {
+                '/.*/_sidebar.md': '/_sidebar.md'
+            }
+        }
+    </script>
+    <!-- Docsify v4 -->
+    <script src="//cdn.jsdelivr.net/npm/docsify@4"></script>
+    <script src="//cdn.jsdelivr.net/npm/docsify/lib/plugins/search.min.js"></script>
+    <script src="//cdn.jsdelivr.net/npm/docsify-copy-code"></script>
+</body>
+
+</html>

docs/operation-manual.md

@@ -0,0 +1,52 @@
+# Operation Manual
+
+## Adding a Monthly Fee Override
+
+Use this when the club decides to charge a different flat fee for a specific month — for example, a reduced fee during a short or holiday month.
+
+There are two independent dictionaries in [scripts/attendance.py](../scripts/attendance.py), one for adults and one for juniors. Edit whichever tiers need an override.
+
+### Adults
+
+Add an entry to `ADULT_FEE_MONTHLY_RATE` (line ~15):
+
+```python
+ADULT_FEE_MONTHLY_RATE = {
+    "2026-03": 350  # reduced fee for March 2026
+}
+```
+
+The key is `YYYY-MM`, the value is the fee in CZK. This replaces `ADULT_FEE_DEFAULT` (750 CZK) for members who attended 2+ practices that month. The single-practice fee (`ADULT_FEE_SINGLE`, 200 CZK) is unaffected.
+
+### Juniors
+
+Add an entry to `JUNIOR_MONTHLY_RATE` (line ~20):
+
+```python
+JUNIOR_MONTHLY_RATE = {
+    "2025-09": 250,  # reduced fee for September 2025
+    "2026-03": 250   # reduced fee for March 2026
+}
+```
+
+The key is `YYYY-MM`, the value is the fee in CZK. This replaces `JUNIOR_FEE_DEFAULT` (500 CZK) for members who attended 2+ practices that month.
+
+### Example: March 2026
+
+Both tiers reduced to 350 CZK (adults) and 250 CZK (juniors):
+
+```python
+ADULT_FEE_MONTHLY_RATE = {
+    "2026-03": 350
+}
+
+JUNIOR_MONTHLY_RATE = {
+    "2026-03": 250
+}
+```
+
+### Notes
+
+- Overrides apply to all members of the given tier — use the **exceptions sheet** in Google Sheets for per-member overrides instead.
+- After changing these values, restart the web dashboard (`make web`) for the change to take effect.
+- The override only affects the calculated/expected fee. It does not modify any already-recorded payments in the bank sheet.

docs/plans/2026-05-03-2325-document-plan-location-convention.md

@@ -0,0 +1,52 @@
+# Plan: Document plan-file location convention in `CLAUDE.md`
+
+## Context
+
+The user wants all plan files (created during Claude Code's plan mode) to live
+inside the project at `docs/plans/`, with a creation timestamp in the filename.
+This keeps planning artifacts version-controlled alongside the code, makes it
+easy to see when each plan was drafted, and — critically — needs to be
+discoverable by other contributors who use Claude Code on this repo. So the
+convention belongs in `CLAUDE.md`, not in private agent memory.
+
+## Approach
+
+1. **Add a new section to `CLAUDE.md`** (placed near the existing "Changelog"
+   section, since both are about persisted artifacts that Claude maintains):
+
+   ```markdown
+   ## Plans
+
+   When Claude Code's plan mode is used, save the plan file inside the repo at
+   `docs/plans/YYYY-MM-DD-HHMM-<slug>.md` instead of the default
+   `~/.claude/plans/` location. Get the timestamp with
+   `date "+%Y-%m-%d-%H%M"` (matches the changelog convention). The `<slug>`
+   should be a short kebab-case summary of the plan's topic.
+
+   Create the `docs/plans/` directory on first use. Plan files are committed
+   to the repo so other contributors can review historical decisions.
+   ```
+
+2. **Create the `docs/plans/` directory** with a `.gitkeep` (or just let it
+   appear when the first plan is moved in) so the path exists.
+
+3. **Move this current plan** into the new location once plan mode exits:
+   `docs/plans/2026-05-03-1200-document-plan-location-convention.md`
+   (timestamp will be re-generated with the actual `date` output).
+
+4. **No memory entry needed** — the rule lives in `CLAUDE.md` and is loaded
+   automatically into every Claude Code session in this repo.
+
+## Files touched
+
+- [CLAUDE.md](CLAUDE.md) — add the new "## Plans" section.
+- New directory: [docs/plans/](docs/plans/) — created on first use.
+- Move this plan file from `~/.claude/plans/...` into `docs/plans/` with the
+  proper timestamped filename.
+
+## Verification
+
+- `grep -A 5 "## Plans" CLAUDE.md` shows the new section.
+- `ls docs/plans/` lists this plan file with a `YYYY-MM-DD-HHMM-` prefix.
+- Next time plan mode is entered in this repo, the new plan is written to
+  `docs/plans/` with a fresh timestamp (verify by re-entering plan mode).

docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md

@@ -0,0 +1,158 @@
+# Go Rewrite — Progress Tracker
+
+Companion to [2026-05-03-2349-go-backend-rewrite.md](2026-05-03-2349-go-backend-rewrite.md).
+
+**Current milestone:** M2 — Pure-domain helpers
+**Started:** 2026-05-04
+**Last updated:** 2026-05-06
+
+## How to use
+
+- Tick a checkbox when the task's PR/commit lands. Append the SHA in the same
+  line: `[x] **M1.1** ... — `abc1234``.
+- One task = one focused commit or PR. If a task balloons, split it and add
+  sub-tasks below the parent.
+- Note decisions, surprises, or blockers under "Notes & decisions" at the
+  bottom — that's where future-you (or a contributor) will look first.
+- Don't reorder milestones. Within a milestone, tasks can be done in any
+  order unless explicitly noted.
+
+---
+
+## M1 — Skeleton + tooling
+
+Goal: `make web-go` serves a hello page on :8080 in parallel with `make web-py` on :5001. Lint clean.
+
+- [x] **M1.1** Create `go/` tree skeleton + `go.mod` initialized to latest stable Go
+- [x] **M1.2** Add `cmd/fuj/main.go` with subcommand dispatcher — stdlib `flag` + `os.Args[1]` switch
+- [x] **M1.3** Wire `fuj server` subcommand: `net/http` ServeMux on `:8080`, plaintext hello page
+- [x] **M1.4** Add Makefile targets: `go-build`, `go-test`, `go-run`, `go-lint`
+- [x] **M1.5** Rename existing `make web` → `make web-py`; added `make web-go`; kept `make web` as alias
+- [x] **M1.6** Add `go/.golangci.yml` (govet, staticcheck, errcheck, gofumpt, unused) + `make go-lint` clean
+- [x] **M1.7** Write `go/build/Dockerfile` (multi-stage `golang:1.26` → `alpine:3`); parallel `build-go` job in Gitea CI
+- [x] **M1.8** Add `internal/config` package mirroring `scripts/config.py` (same env var names + defaults)
+- [x] **M1.9** Add `internal/logging` (slog, level from config) + `middleware/timer.go` (method/path/status/ms)
+- [x] **M1.10** Gate passed: `make go-build`, `make go-lint`, `make go-test`, `curl :8080` all green; CHANGELOG entry added
+
+**Gate:** ✅ `make go-build` succeeds, `curl localhost:8080` returns hello page, `make go-lint` clean.
+
+---
+
+## M2 — Pure-domain helpers (port leaf-first)
+
+Goal: every pure function from the Python backend exists in Go with a parity test against captured fixtures (M3 produces fixtures in parallel — order is M2.1 → M3.1/M3.2 → M3.3+ alongside M2.2+).
+
+Each task: port the function, write Go unit tests for fresh cases, hook into the Tier-1 parity runner.
+
+- [x] **M2.1** `domain/czech.Normalize` — port [czech_utils.py](scripts/czech_utils.py) `normalize` (NFKD + combining-mark strip + lowercase) — `20ade6d`
+- [x] **M2.2** `domain/czech.ParseMonthReferences` — port `parse_month_references` (45 month declensions, range wrap, year inference) — `0a8017f`
+- [x] **M2.3** `domain/fees.CalculateFee` — port [attendance.py](scripts/attendance.py) `calculate_fee` (constants table) — `0fc3b6d`
+- [x] **M2.4** `domain/fees.CalculateJuniorFee` — port `calculate_junior_fee` with `Expected{Value int; Unknown bool}` for the `"?"` sentinel — `0fc3b6d`
+- [x] **M2.5** `domain/money.ParseCZK` — port [infer_payments.py](scripts/infer_payments.py) `parse_czk_amount` (Czech locale: comma decimal, dot/space thousand separators) — `d24d205`
+- [x] **M2.6** `domain/synch.GenerateSyncID` — port [sync_fio_to_sheets.py](scripts/sync_fio_to_sheets.py) `generate_sync_id` (SHA-256, byte-stable hash; verify float string format against real sheet rows)
+- [ ] **M2.7** `domain/matching.BuildNameVariants` + `MatchMembers` — port `_build_name_variants` and `match_members` from [match_payments.py](scripts/match_payments.py) (auto vs review confidence, common-surname filter)
+- [ ] **M2.8** `domain/matching.InferTransactionDetails` — port `infer_transaction_details` (composes name + month parsing)
+- [ ] **M2.9** `domain/matching.FormatDate` — port `format_date` (handles Google Sheets serial-day numbers since 1899-12-30)
+- [ ] **M2.10** `domain/reconcile.Reconcile` — port `reconcile` (three-phase allocation: greedy / proportional with float-remainder absorption / even-split fallback). The single most load-bearing function; budget extra time.
+- [ ] **M2.11** `fuj fees` subcommand wired up via `domain/fees` + (M4-stub) attendance loader — fail gracefully on missing IO until M4 lands
+- [ ] **M2.12** `fuj reconcile` subcommand similarly stubbed
+
+**Gate:** `cd go && go test -tags=parity ./tests/parity/pure/...` green for every fixture in `tests/fixtures/pure/`.
+
+---
+
+## M3 — Fixture capture + characterization framework
+
+Goal: deterministic, PII-free fixture corpus that drives parity tests. Runs in parallel with M2 (M3.1/M3.2 unblocks M2.1).
+
+- [ ] **M3.1** `scripts/capture_fixtures.py` — pure-function output dumper. Reads inputs from stdin / argv, prints `{"input":..., "output":...}` JSON
+- [ ] **M3.2** `scripts/scrub_fixtures.py` — replaces names with `Member_<8hex>` (deterministic per name); scrambles sender/account/VS/bank_id with stable bijection; preserves dates, amounts, exception keys
+- [ ] **M3.3** Capture pure-fn fixtures for M2.1–M2.9 (run helper + scrubber, commit to `tests/fixtures/pure/<func>/<case>.json`)
+- [ ] **M3.4** Capture ~10 reconcile fixtures spanning every code path: greedy, proportional (float remainder), even-split, out-of-window credit, exception override, `other:` purpose, junior `"?"`, multi-person comma-split, multi-month range, unmatched. Commit to `tests/fixtures/reconcile/`
+- [ ] **M3.5** Hook fixtures into Tier-1 test runner with `-tags=parity` build constraint
+- [ ] **M3.6** Document fixture-refresh workflow in `tests/fixtures/README.md` (what to do when sheet schema changes)
+
+**Gate:** `tests/fixtures/` populated; M2 parity tests green; raw `tmp/*.json` confirmed gitignored.
+
+---
+
+## M4 — IO layer behind interfaces
+
+Goal: every external IO (Sheets, Drive, Fio, file cache) accessed through a narrow Go interface with both a real and a fake implementation.
+
+- [ ] **M4.1** Design IO interfaces (`SheetsClient`, `DriveClient`, `FioClient`, `FileCache`) + in-memory fakes seeded from M3 fixtures
+- [ ] **M4.2** `internal/io/sheets` — Google client (read + append + batchUpdate); integration test against a separate test sheet (NOT prod)
+- [ ] **M4.3** `internal/io/drive` — Drive `modifiedTime` client + integration test
+- [ ] **M4.4** `internal/io/fio` — API JSON impl (token-based); parses by hardcoded `column0..column22` indices matching [fio_utils.py](scripts/fio_utils.py)
+- [ ] **M4.5** `internal/io/fio` — transparent-page HTML scraper using `golang.org/x/net/html` token visitor; targets the **second** `<table class="table">`
+- [ ] **M4.6** `internal/io/cache` — FileCache with `modifiedTime` gating + two TTL knobs + atomic writes (`os.Rename`)
+- [ ] **M4.7** `services/banksync.SyncToSheets` + `fuj sync` subcommand
+- [ ] **M4.8** `services/banksync.InferPayments` + `fuj infer [--dry-run]` subcommand
+
+**Gate:** `go test -tags=integration ./internal/io/...` round-trips against test sheet; default-tag tests run on fakes.
+
+---
+
+## M5 — JSON-only `/api/...` routes
+
+Goal: byte-equal JSON between Python and Go for every route. This is the parity contract.
+
+- [ ] **M5.1** Hand-author Go structs for `/api/adults`, `/api/juniors`, `/api/payments`, `/api/version` with explicit `json:` tags matching Python keys; emit JSON Schemas via `github.com/invopop/jsonschema` to `tests/fixtures/api-schema/`
+- [ ] **M5.2** Implement Go handlers for `/api/*` routes composing `services/*` results into the JSON structs
+- [ ] **M5.3** Add Python `/api/X` shadow endpoints in [app.py](app.py): `jsonify(view_model_dict)` — no transformation
+- [ ] **M5.4** Build `cmd/parity/main.go`: hits both backends' `/api/X`, normalizes allowlist (`render_time.total`, `build_meta`), prints `cmp.Diff`. Add `make parity` target
+
+**Gate:** For each route, `make parity` reports zero non-allowlisted diffs across the M3 fixture corpus.
+
+---
+
+## M6 — Go-native HTML frontend
+
+Goal: feature-equivalent UX on the Go side, designed cleanly. Not a Jinja port.
+
+- [ ] **M6.1** Template skeleton: base layout, nav (Adults/Juniors/Payments/Sync/Flush), terminal-green-on-black theme; `embed.FS` for `templates/` + `static/`
+- [ ] **M6.2** `/adults` page: table, name filter input, month range filter, totals row, credits/debts/unmatched sections, Pay buttons that link to `/qr`
+- [ ] **M6.3** `/juniors` page: same structure + per-month J/A attendance breakdown + `"?"` sentinel rendering
+- [ ] **M6.4** `/payments` page: grouped-by-person ledger view
+- [ ] **M6.5** Modal JS module (`static/js/member-detail.js`): fetches `/api/adults` (or juniors), renders status/exceptions/transactions on row click; keyboard nav (Esc, ↑/↓)
+- [ ] **M6.6** `/qr`, `/sync-bank`, `/flush-cache`, `/version` pages
+- [ ] **M6.7** Wire `embed.FS` into handlers; verify single-binary deployment includes all assets
+
+**Gate:** Browser smoke on :8080: all pages render, name+month filters work, modal opens with correct data, QR loads, sync/flush work end-to-end.
+
+---
+
+## M7 — Parallel-running watch period
+
+Goal: prove parity over real time before flipping the default.
+
+- [ ] **M7.1** Add Go service to `docker-compose.yml` on different port (alongside Python container)
+- [ ] **M7.2** Set up `parity-nightly.yml` Gitea workflow: boot both, replay fixed transaction script, fail on diff
+- [ ] **M7.3** Run `make parity` daily for 7–14 days, log any diffs; investigate and fix root cause (don't just allowlist)
+- [ ] **M7.4** Manual feature parity check: walk through every UI feature on both sides, sign off in Notes section
+
+**Gate:** Zero non-allowlisted JSON diffs over 7 consecutive days, including a sync-bank execution + flush + attendance update; user sign-off on UI feature parity.
+
+---
+
+## M8 — Cutover + Python retirement
+
+Goal: Go is the one true backend.
+
+- [ ] **M8.1** Update bookmarks, README, CLAUDE.md to point at Go (`make web` aliases to `make web-go`)
+- [ ] **M8.2** Run Go-only for 2 weeks including a month-end settlement; keep Python container available but unrouted
+- [ ] **M8.3** Manual reconciliation review: produce a balance report on `python-final` and on Go for the same period; sign off they match
+- [ ] **M8.4** Tag final Python image as `python-final` in registry; remove Python service from `docker-compose.yml`
+- [ ] **M8.5** Delete [app.py](app.py), [scripts/](scripts/), Python `Dockerfile`, [tests/](tests/), `pyproject.toml`, `uv.lock`
+- [ ] **M8.6** Update [CLAUDE.md](CLAUDE.md) to reflect Go-only state (commands, architecture, key modules); CHANGELOG entry
+
+**Gate:** Two consecutive months of Go-only operation with end-of-month settlement complete; zero rollbacks.
+
+---
+
+## Notes & decisions
+
+(Add entries as you go. Format: `YYYY-MM-DD — short note`.)
+
+- 2026-05-04 — Plan approved. Versioning policy: latest stable for Go and all libs at the time M1 starts. Frontends explicitly allowed to diverge between Python and Go; only the JSON API contract is parity-locked. No reverse proxy — both backends run on different ports via `make web-py` / `make web-go`.
+- 2026-05-04 — M1 complete. Dockerfile base changed from `distroless/static:nonroot` → `alpine:3` for debuggability (can tighten later). CLI dispatcher uses stdlib `flag`; module path `fuj-management/go`. golangci-lint v1 embedded gofumpt merges all imports into one group (no stdlib/local split) — accepted as the project style.

docs/plans/2026-05-03-2349-go-backend-rewrite.md

@@ -0,0 +1,424 @@
+# Plan: Full Go rewrite of the Python/Flask backend
+
+## Context
+
+The current Flask app ([app.py](app.py) + [scripts/](scripts/), ~2400 LOC of
+Python) handles attendance-based fee calculation, Fio bank sync, payment
+reconciliation, and a server-rendered dashboard. The user wants a full
+rewrite in Go with two goals:
+
+1. **Quality Go code** as the primary outcome — idiomatic stdlib-first
+   design, strong typing, proper layering. The Python codebase grew
+   organically and mixes domain logic, IO, and HTTP concerns.
+2. **Feature-parity certainty** — no behavioural drift between the Python
+   and Go versions on anything that touches money. Reconciliation is real
+   money; silent divergence is unacceptable.
+
+**Switchable runtime**: both backends run on different TCP ports, started
+independently via Makefile targets (`make web-py` on :5001, `make web-go` on
+:8080). The user opens whichever they want in a browser. No reverse proxy,
+no traffic-splitting, no shared frontend constraint — just two services
+that read the same Google Sheets and the same `tmp/` cache.
+
+**Frontends are allowed to diverge.** The Go web layer is designed cleanly
+in its own right rather than as a byte-compatible Jinja port. Both backends
+expose a JSON API (`/api/...`) with an identical contract — that's what
+parity testing locks down. Rendered HTML and inline JS can be different.
+
+## Versioning policy
+
+- **Go**: latest stable release at project start. Pin in `go.mod` via the
+  `go` directive (e.g. `go 1.X`) and use the matching `golang:1.X` builder
+  image. Bump on each new minor as it lands stable.
+- **Go libraries**: latest stable for every dependency in `go.mod`; run
+  `go get -u ./... && go mod tidy` at the start and quarterly thereafter.
+- **Python deps** (during the parallel-run period): keep
+  [pyproject.toml](pyproject.toml) on its current versions to avoid
+  destabilizing the parity baseline; bump only after Python retires.
+- **Base images**: `golang:latest-stable` builder → `gcr.io/distroless/static:latest`
+  runtime, both pinned by digest in CI for reproducibility.
+- **CI runners**: latest stable Linux image on Gitea Actions.
+
+The plan does not hardcode specific version numbers below — implementation
+picks current-stable at the time M1 starts.
+
+## Approach summary
+
+- **Three-layer Go architecture**: pure domain (no IO) → IO clients (behind
+  interfaces, easily faked) → HTTP/services (composition).
+- **Capture-then-port**: dump current Python outputs as JSON fixtures, port
+  Go function-by-function, assert byte-equality with `cmp.Diff`.
+- **JSON contract is the spec, not the templates.** Each Python route gets
+  an `/api/X` shadow that returns the dict already passed to the template.
+  Go defines typed structs matching that shape; both sides validate against
+  generated JSON Schema.
+- **Money is integer CZK**: existing fees are integer CZK (750/200/500);
+  keep it that way to avoid float drift in reconcile allocation. Where
+  Sheets returns floats, parse and round at the boundary.
+- **Frontend rewrite, not port**: Go uses `html/template` with cleanly
+  organized templates and JS extracted into static files served via
+  `embed.FS`. Same UX (filterable table, member-detail modal, QR launcher)
+  but designed natively, no Jinja-port baggage.
+
+## Go project layout
+
+`go/` lives at the repo root alongside `scripts/` and `templates/` so both
+backends share the same git history during migration.
+
+```
+go/
+  cmd/
+    fuj/main.go                    # single binary, subcommands: server | fees | sync | infer | reconcile
+    parity/main.go                 # diff tool: hits both backends' /api/X, prints JSON diff
+  internal/
+    domain/                        # pure, no IO, no net/*
+      czech/                       # normalize, parse_month_references
+      fees/                        # calculate_fee, calculate_junior_fee, "?" sentinel type
+      money/                       # parse_czk_amount, format helpers
+      reconcile/                   # reconcile() + Ledger, MemberResult types
+      matching/                    # _build_name_variants, match_members, infer_transaction_details
+      synch/                       # generate_sync_id (pure hash)
+    io/                            # IO behind interfaces, all impls have an in-memory fake
+      sheets/                      # SheetsClient + Google impl + fake
+      drive/                       # DriveClient for modifiedTime
+      fio/                         # FioClient: API JSON impl + transparent-page HTML scraper
+      cache/                       # FileCache with modifiedTime gating + two TTL knobs
+    services/                      # composition layer; pure + IO, no HTTP
+      attendance/                  # GetMembersWithFees, GetJuniorMembersWithFees
+      payments/                    # FetchTransactions, FetchExceptions, BuildView
+      banksync/                    # SyncToSheets, InferPayments (write ops)
+    web/
+      handlers/                    # one file per route family
+      view/                        # HTML view-model structs (per route)
+      api/                         # JSON view-model structs (the parity-locked contract)
+      templates/                   # *.tmpl, embed.FS — designed natively, not a Jinja port
+      static/                      # js/*.js, css/*.css served via embed.FS
+      middleware/                  # request timer, recovery, slog
+    config/                        # mirrors scripts/config.py (env loading)
+    qr/                            # SPD string builder + PNG via go-qrcode
+  tests/
+    fixtures/                      # JSON fixtures captured from Python (PII-scrubbed)
+    parity/                        # Go-side characterization tests (replay fixtures)
+  build/Dockerfile                 # multi-stage: latest-stable golang builder → distroless static
+  go.mod
+```
+
+## Library choices
+
+All on latest stable as per the versioning policy above.
+
+| Concern | Pick | Rationale |
+|---|---|---|
+| HTTP routing | `net/http` ServeMux | 8 static routes; no need for chi/gin given modern stdlib pattern matching |
+| Templates | `html/template` | Auto-escaping; native Go feel |
+| Static assets | `embed.FS` | Single binary, no loose files |
+| Sheets/Drive | `google.golang.org/api/{sheets/v4,drive/v3}` + `option` | Official client; service-account auth via `option.WithCredentialsFile` |
+| OAuth | `golang.org/x/oauth2/google` (token only; drop installed-app flow + pickle) | Production already uses service accounts |
+| QR PNG | `github.com/skip2/go-qrcode` | Mature, byte-stable PNG output |
+| NFKD | `golang.org/x/text/unicode/norm` + `unicode.IsMark` | Direct equivalent of `unicodedata.normalize("NFKD", ...)` |
+| HTML scrape | `golang.org/x/net/html` token visitor | Counts `<table class="table">` to target the second one |
+| CSV | `encoding/csv` (stdlib) | Match for Python `csv.reader` |
+| Logging | `log/slog` (stdlib) | Honors `LOG_LEVEL` env |
+| Diff/testing | `testing` + `github.com/google/go-cmp/cmp` | Readable `cmp.Diff` for parity assertions |
+| Lint | `golangci-lint` (govet, staticcheck, errcheck, gofumpt, unused) | Standard quality gate |
+
+## Migration sequencing — eight milestones with hard gates
+
+**M1 — Skeleton + tooling.** Create `go/` tree, `go.mod` (latest stable
+Go), Makefile targets (`go-build`, `go-test`, `go-run`, `web-go`),
+`golangci-lint` config. `cmd/fuj server` prints a hello + version and
+listens on :8080.
+*Gate:* `make go-build` succeeds; `make web-go` serves a "hello" page on
+:8080 in parallel with `make web` on :5001; lint clean.
+
+**M2 — Pure-domain helpers, port leaf-first.** Order:
+[czech_utils.py](scripts/czech_utils.py) `normalize` → `parse_month_references` →
+[attendance.py](scripts/attendance.py) `calculate_fee`/`calculate_junior_fee` →
+[infer_payments.py](scripts/infer_payments.py) `parse_czk_amount` →
+[sync_fio_to_sheets.py](scripts/sync_fio_to_sheets.py) `generate_sync_id` →
+[match_payments.py](scripts/match_payments.py) helpers (`_build_name_variants`,
+`match_members`, `infer_transaction_details`, `format_date`) → `reconcile`.
+Each gets a Go unit test plus a parity test driven by JSON fixtures from M3.
+Also: `fuj fees` and `fuj reconcile` subcommands wired up (pure-domain CLIs).
+*Gate:* All ported helpers pass parity tests.
+
+**M3 — Fixture capture + characterization framework.** Build
+`scripts/capture_fixtures.py` (Python helper that prints function results as
+JSON to stdout — user pipes to disk) and `scripts/scrub_fixtures.py`
+(replaces member names with deterministic pseudonyms `Member_<8hex>`,
+scrambles sender/account/VS/bank_id while preserving structural
+relationships, dates, amounts, exception keys). Capture ~10 reconcile
+fixtures spanning every code path: greedy, proportional with float
+remainder, even-split fallback, out-of-window credit, exception override,
+`other:` purpose, junior `"?"`, comma-separated multi-person, multi-month
+range, unmatched.
+*Gate:* `tests/fixtures/` populated and committed; M2 parity tests green.
+
+**M4 — IO layer behind interfaces.** Implement Sheets/Drive/Fio clients
+matching Python return shapes. Drop the OAuth+pickle path entirely (service
+account only). All clients have in-memory fakes for tests. Wire `fuj sync`
+and `fuj infer` subcommands.
+*Gate:* `go test -tags=integration ./internal/io/...` round-trips against a
+test sheet (separate from prod); default-tag tests use fakes.
+
+**M5 — JSON-only `/api/...` routes.** Add 8 Go route handlers that return
+JSON. Add symmetric `/api/X` shadow endpoints in [app.py](app.py) that
+`jsonify` the existing view-model dict (no transformation).
+*Gate:* For each route, `cmd/parity` asserts
+`cmp.Diff(python.json, go.json) == ""` modulo allowlist
+(`render_time.total`, `build_meta`).
+
+**M6 — Go-native HTML frontend.** Design Go templates cleanly (not a Jinja
+port). Extract JS from inline into `internal/web/static/js/*.js` served via
+`embed.FS`. Vanilla JS, no framework — same UX as Python (sortable table,
+member-detail modal, name filter, month range filter, QR launcher) but
+organized as proper modules. Templates render the JSON API response into
+HTML; frontend JS fetches additional data from `/api/X` for the modal
+rather than embedding `member_data` in `<script>`.
+*Gate:* Browser smoke test of all routes on :8080 covers: name filter,
+month filter, modal opens with correct months/transactions/exceptions, QR
+modal renders, navigation between adults/juniors/payments works.
+
+**M7 — Parallel-running watch period.** Both `make web-py` and `make web-go`
+running locally (and in production via two containers on different ports).
+Daily/manual `cmd/parity` runs catch any JSON drift. The user verifies the
+Go UI matches what they expect feature-by-feature against the Python UI.
+Run 1–2 weeks.
+*Gate:* Zero non-allowlisted JSON diffs over 7 consecutive days, including
+a sync-bank execution, a flush, and an attendance update. User sign-off
+that the Go UI is feature-complete.
+
+**M8 — Cutover + Python retirement.** Switch the bookmarked URL / docs to
+the Go port. Keep Python container running but unrouted (or stopped) for
+1 week as rollback. Then delete [app.py](app.py), [scripts/](scripts/),
+the Python `Dockerfile`, and the Python tests. Update
+[CLAUDE.md](CLAUDE.md) to reflect the Go-only state.
+*Gate:* Two consecutive months of Go-only operation including end-of-month
+settlement.
+
+## CLI port (decided: port as Go subcommands)
+
+Single Go binary `fuj` with subcommands replacing the existing Makefile
+targets. Each reuses the domain layer directly:
+
+| Old | New | Backed by | Milestone |
+|---|---|---|---|
+| `make fees` | `fuj fees` | `domain/fees` + `services/attendance` | M2 |
+| `make reconcile` | `fuj reconcile` | `domain/reconcile` | M2 |
+| `make sync-2026` | `fuj sync --year=2026` | `services/banksync.SyncToSheets` | M4 |
+| `make infer` | `fuj infer [--dry-run]` | `services/banksync.InferPayments` | M4 |
+| `make web` (py) | stays as Python `make web-py` until M8 | — | — |
+| `make web-go` | `fuj server` | `web/handlers` | M1 |
+
+Makefile targets get rewritten to invoke `./bin/fuj <subcommand>` once each
+is ported. The Python `make` targets for already-ported commands stay as
+`make X-py` aliases until M8, so you can run either side for cross-checks.
+
+## JSON API contract strategy
+
+**Go-defines, Python-conforms** with a 1-step bootstrap:
+
+1. Run Python locally and dump `result["members"]`, `formatted_results`,
+   `monthly_totals`, etc., to JSON. This is the spec.
+2. Hand-author Go structs with explicit `json:` tags matching exact Python
+   keys (`total_balance`, `original_expected`, `attendance_count` — no
+   reliance on default lowercasing).
+3. Generate `tests/fixtures/api-schema/*.schema.json` from the Go structs
+   using `github.com/invopop/jsonschema`. Commit them.
+4. Add a Python-side schema validator running in CI against the new
+   `/api/X` responses.
+
+**Two known-tricky shapes:**
+
+- Junior `expected: int | "?"` →
+  ```go
+  type Expected struct{ Value int; Unknown bool }
+  // MarshalJSON emits 42 or "?"
+  ```
+  Same for `original_expected`.
+- Tuple dict keys `(normalize(name), normalize(period))` for exceptions —
+  internal only, never crosses JSON. Use
+  `map[ExceptionKey]Exception` with `ExceptionKey struct{ Name, Period string }`.
+
+## Characterization test harness — two tiers
+
+(HTML rendering parity dropped: frontends are intentionally different.)
+
+**Tier 1 — Pure-function parity** (fast, every commit). Fixtures at
+`tests/fixtures/pure/<func>/<case>.json` containing `{input, output}`,
+captured once via `scripts/capture_fixtures.py`. Go test reads each, calls
+the ported function, asserts deep equality with `cmp.Diff`. Functions in
+scope: `normalize`, `parse_month_references`, `parse_czk_amount`,
+`parse_czech_amount`, `parse_czech_date`, `format_date`,
+`_build_name_variants`, `match_members`, `infer_transaction_details`,
+`generate_sync_id`, `calculate_fee`, `calculate_junior_fee`, `reconcile`.
+
+**Tier 2 — JSON API parity** (medium, on PR + nightly). `cmd/parity/main.go`
+hits both `:5001/api/X` and `:8080/api/X` with a fixture-seeded `tmp/`
+cache, normalizes volatile fields (`render_time`, build metadata), asserts
+byte-equality. Cache freezing: pre-populate `tmp/*_cache.json` from
+scrubbed snapshots so both backends read identical data.
+
+**PII scrubbing** is mandatory ([CLAUDE.md](CLAUDE.md): "Member data must
+never be committed"). `scripts/scrub_fixtures.py` produces deterministic
+pseudonyms preserving uniqueness and structural relationships. Only
+scrubbed fixtures land in `tests/fixtures/`; raw `tmp/*.json` stays
+gitignored.
+
+## Side-by-side runtime
+
+Two services on different ports, started independently. No reverse proxy.
+
+```
+make web-py    # Python on :5001 (existing target, perhaps renamed from `make web`)
+make web-go    # Go on :8080
+```
+
+Both read the same Google Sheets and write to the same `tmp/` cache
+directory. The user opens `localhost:5001` or `localhost:8080` directly to
+A/B compare.
+
+**Cache directory coordination**: both backends use `tmp/`. Go writes via
+`os.WriteFile` to `tmp/<key>_cache.json.tmp` then `os.Rename` (atomic on
+Linux). Python's writes are pre-existing-non-atomic; accept until Python
+retires.
+
+**Sync coordination**: `/sync-bank` is non-idempotent under concurrency.
+Both backends `flock` on `tmp/sync.lock`; Go uses `syscall.Flock`. (In
+practice the user is unlikely to trigger sync from both UIs at once, but
+the lock is cheap insurance.)
+
+**Production deployment**: keep the existing Python container; add a Go
+container in `docker-compose.yml` exposed on a different port. After M8,
+remove the Python service.
+
+## CI/CD
+
+Currently zero test CI ([.gitea/workflows/build.yaml](.gitea/workflows/build.yaml)
+only does `docker build`/`push`). Add `/.gitea/workflows/test.yml`:
+
+```yaml
+jobs:
+  python-tests:    # fix M3 broken-test references first
+    - uv sync && pytest tests/
+  go-tests:
+    - cd go && go test -race ./...
+    - cd go && golangci-lint run
+  parity-pure:     # Tier 1
+    - cd go && go test -tags=parity ./tests/parity/...
+```
+
+Branch protection: `python-tests`, `go-tests`, `parity-pure` block merge.
+Tier-2 parity runs nightly via `parity-nightly.yml` (boots both servers
+via docker-compose with seeded caches, replays a fixed transaction script,
+fails on any non-allowlisted diff).
+
+A new Go `build/Dockerfile` (multi-stage: latest-stable `golang` builder →
+`gcr.io/distroless/static:latest`, both pinned by digest) mirrors the
+existing Python build job and produces a single static binary image.
+
+## Risk register (top 4)
+
+(Template auto-escape divergence dropped: irrelevant when frontends differ.)
+
+1. **Sync ID hash drift** — HIGH/HIGH. Python builds the SHA-256 input by
+   `str()`-ing each field then `.lower()`-ing the joined string;
+   `str(750.0) == "750.0"`, `str(750) == "750"`. If Sheets API returns
+   floats in Python but Go unmarshals as int, `750` vs `750.0` → different
+   hash → duplicate rows. *Mitigation:* dedicated parity test with ~50
+   real-row fixtures; if Go can't reproduce Python's float string format,
+   normalize at the boundary (round to 2 decimals, format with explicit
+   precision).
+2. **Float allocation in `reconcile()` proportional phase** — HIGH/MEDIUM.
+   Python's "last month absorbs remainder" depends on dict iteration order;
+   Go map iteration is randomized. *Mitigation:* always iterate
+   `sorted_months` explicitly in Go, never the map. Lock the distribution
+   with a parity test on (300, 300, 150) months × 751-CZK payment.
+3. **NFKD edge cases** — MEDIUM/MEDIUM. Python `unicodedata` and Go
+   `golang.org/x/text` use the same algorithm but can differ on niche
+   compatibility decompositions if `x/text` is older than CPython's tables.
+   *Mitigation:* parity test with every distinct character ever observed in
+   member names; pin `x/text` version explicitly.
+4. **Czech month parser semantics** — MEDIUM/MEDIUM. Wrap-around year
+   inference (`if start_m > end_m and m >= start_m: year = default_year - 1`)
+   plus the "month >= 10 → previous year" heuristic are easy to mis-port.
+   *Mitigation:* port table and algorithm verbatim line-for-line; parity
+   test with ~30 real `message`-field fixture strings.
+
+## Cutover plan
+
+Simpler without a proxy in the middle:
+
+1. After M7's 7-day clean window + user sign-off, treat Go as primary.
+   Update bookmarks, docs, `make web` to point at Go.
+2. Keep `make web-py` available for 1-week rollback. Run both containers
+   in production but only point users at the Go one.
+3. Watch 2 weeks including a month-end settlement on Go-only.
+4. Decommission Python: remove from `docker-compose.yml`, delete
+   [app.py](app.py) and [scripts/](scripts/), update
+   [CLAUDE.md](CLAUDE.md). Keep image tagged `python-final` in registry as
+   a 6-month rollback option.
+
+**Retirement criteria:** zero parity-diff incidents in last 30 days, zero
+rollbacks, two month-end settlements completed Go-only, manual
+reconciliation review against `python-final` signed off.
+
+## Critical files
+
+- [scripts/match_payments.py](scripts/match_payments.py) — `reconcile()` is
+  the single most load-bearing function (~200 lines of allocation logic)
+  that must port byte-equivalently.
+- [scripts/czech_utils.py](scripts/czech_utils.py) — `normalize` and
+  `parse_month_references` underpin every member/month match across the
+  system. 45 Czech month declensions, range wrap-around, year inference.
+- [app.py](app.py) — defines the 8-route HTTP surface and view-model
+  shapes. The spec for the Go web layer's JSON API.
+- [scripts/sync_fio_to_sheets.py](scripts/sync_fio_to_sheets.py) —
+  `generate_sync_id` defines the dedup contract against existing rows in
+  the live sheet. Any drift creates duplicates.
+- [scripts/attendance.py](scripts/attendance.py) — fee math + merged-month
+  logic + junior `"?"` sentinel.
+- [scripts/cache_utils.py](scripts/cache_utils.py) — Drive `modifiedTime`
+  gating + two-TTL fallback that must be reproduced for shared-cache
+  safety.
+- [templates/adults.html](templates/adults.html) — read for the JSON shape
+  the existing inline JS consumes (`member_data`); the Go frontend doesn't
+  have to mirror the template, but the JSON contract derived from this
+  page's data injection is the parity spec.
+
+## Verification
+
+End-to-end checks per milestone:
+
+- **M1**: `make go-build && ./bin/fuj server --help` prints subcommand
+  list. `make web-go` serves :8080 in parallel with `make web-py` on :5001.
+- **M2-M3**: `cd go && go test -tags=parity ./tests/parity/pure/...` green.
+  Spot-check: feed a known Czech-message string through both
+  `parse_month_references` implementations, diff outputs.
+- **M4**: `go test -tags=integration ./internal/io/sheets/...` round-trips
+  against a test sheet (separate from prod).
+- **M5**: `curl localhost:5001/api/adults | jq -S . > py.json && curl
+  localhost:8080/api/adults | jq -S . > go.json && diff py.json go.json` —
+  empty diff modulo allowlist.
+- **M6**: Browser open `localhost:8080/adults`, click a member row, modal
+  opens with all months / transactions / exceptions correctly populated.
+  Same on `/juniors`. Click a Pay button → QR loads. Name filter and month
+  range filter work.
+- **M7**: Run `cd go && ./bin/parity --base http://localhost:5001
+  --candidate http://localhost:8080 --routes adults,juniors,payments`
+  daily for 7 days, zero non-allowlisted diffs. User confirms Go UI is
+  feature-complete vs Python UI side-by-side.
+- **M8**: `make web-py` removed from Makefile; `make web` points at Go;
+  manual end-of-month settlement on Go matches the prior month's
+  Python-produced report.
+
+## Open questions / forks the user can override at review
+
+- **Frontend JS organization in M6**: default is vanilla JS in separate
+  files via `embed.FS`. If the user wants HTMX, Alpine.js, or a small
+  framework, raise it before M6.
+- **CI host**: Gitea Actions assumed (matches existing
+  [.gitea/workflows/build.yaml](.gitea/workflows/build.yaml)).
+- **Test sheet for M4 integration tests**: would need provisioning.
+  Confirm whether to use a copy of the production sheet (PII!) or a
+  synthetic one seeded by the fixture-capture process.

docs/plans/2026-05-04-1115-go-rewrite-m1-kickoff.md

@@ -0,0 +1,233 @@
+# Plan: Go rewrite — M1 kickoff (skeleton + tooling)
+
+Companion to [2026-05-03-2349-go-backend-rewrite.md](2026-05-03-2349-go-backend-rewrite.md)
+and the progress tracker
+[2026-05-03-2349-go-backend-rewrite-progress.md](2026-05-03-2349-go-backend-rewrite-progress.md).
+
+## Context
+
+The master plan for a full Go rewrite of the Flask backend is approved
+(2026-05-04). No Go code exists yet — this plan executes **M1** end-to-end:
+a working `go/` skeleton, a `fuj` binary with a `server` subcommand serving
+a hello page on `:8080`, lint config, Makefile + CI integration, and an
+`internal/config` package mirroring [scripts/config.py](scripts/config.py).
+
+After M1, both backends run side-by-side locally (`make web-py` on `:5001`,
+`make web-go` on `:8080`) — that side-by-side capability is what unblocks
+M2's parity testing and every later milestone.
+
+## Locked-in decisions
+
+| # | Decision | Choice |
+|---|---|---|
+| 1 | CLI dispatcher | stdlib `flag` + `os.Args[1]` switch (no cobra) |
+| 2 | Go module path | `fuj-management/go` |
+| 3 | Go version | `1.26` (latest stable; user toolchain is `go1.26.1`) |
+| 4 | M1 scope | all 10 progress-tracker sub-tasks in one session |
+| 5 | Lint | `golangci-lint` with govet, staticcheck, errcheck, gofumpt, unused |
+| 6 | Logging | `log/slog` text handler, level from `LOG_LEVEL` env |
+| 7 | HTTP | `net/http.ServeMux` (Go 1.22+ pattern matching) |
+| 8 | Container base | `golang:1.26` builder → `gcr.io/distroless/static:nonroot` runtime |
+| 9 | CI | extend [.gitea/workflows/build.yaml](.gitea/workflows/build.yaml) with a `go-build` job parallel to existing Python `build` job; tag suffix `-go` |
+
+## Files to create
+
+```
+go/
+  go.mod                              # module fuj-management/go, go 1.26
+  go.sum                              # empty / generated
+  .golangci.yml                       # govet, staticcheck, errcheck, gofumpt, unused
+  cmd/fuj/main.go                     # subcommand dispatcher + version vars
+  internal/
+    config/config.go                  # env loader mirroring scripts/config.py
+    logging/logger.go                 # slog setup honoring LOG_LEVEL
+    web/
+      server.go                       # `fuj server` handler: ServeMux on :8080, hello page
+      middleware/timer.go             # request-timer middleware (parity with Python `get_render_time`)
+  build/
+    Dockerfile                        # multi-stage golang:1.26 → distroless/static
+```
+
+No `embed.FS`, no templates, no static assets in M1 — the hello page is
+inline HTML in `server.go`. Templates land in M6.
+
+## Files to edit
+
+- [Makefile](Makefile) — add Go targets, rename `web` → `web-py`, keep
+  `web` as transitional alias to `web-py` until M8.
+- [.gitignore](.gitignore) — add `bin/` and `go/.cache/` (if any).
+- [.gitea/workflows/build.yaml](.gitea/workflows/build.yaml) — add
+  `go-build` job that builds and pushes `<tag>-go` image.
+- [CHANGELOG.md](CHANGELOG.md) — top-of-file entry per CLAUDE.md convention.
+- [docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md](docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md)
+  — tick M1.1–M1.10 with commit SHAs as they land.
+
+## Execution sequence
+
+Order is tight: each step keeps the tree compilable and lint-clean.
+
+1. **Skeleton (M1.1)** — `mkdir -p go/{cmd/fuj,internal/{config,logging,web/middleware},build}` and `cd go && go mod init fuj-management/go`. Pin `go 1.26` in `go.mod`.
+
+2. **Config + logger (M1.8, M1.9)** — write `internal/config/config.go` mirroring [scripts/config.py](scripts/config.py): exported constants for `AttendanceSheetID`, `PaymentsSheetID`, `JuniorSheetGID`, env-driven `CredentialsPath`, `BankAccount`, `CacheTTL`, `CacheAPICheckTTL`, `LogLevel`, `FioAPIToken`. Write `internal/logging/logger.go` with a `New() *slog.Logger` honoring `LOG_LEVEL` (`DEBUG|INFO|WARN|ERROR`).
+
+3. **Web middleware + handler (M1.3)** — `internal/web/middleware/timer.go` logs `method path status ms` for every request. `internal/web/server.go` exposes `Run(ctx, addr) error`: `http.ServeMux` with `GET /` returning a minimal HTML hello page that includes `version`, `commit`, and `buildDate` (linker-injected via `-X main.version=…`).
+
+4. **Subcommand dispatcher (M1.2)** — `cmd/fuj/main.go`:
+   - Package-level `var version, commit, buildDate string` for `-ldflags -X` injection.
+   - `os.Args[1]` switch over `server | version | fees | reconcile | sync | infer | help`. M1 implements `server` and `version`; the rest print `<cmd>: not implemented yet (lands in M2/M4)` and exit 2.
+   - Each subcommand parses its own `flag.NewFlagSet`. `server` flags: `--addr` (default `:8080`).
+
+5. **Lint config (M1.6)** — `go/.golangci.yml` enabling `govet`, `staticcheck`, `errcheck`, `gofumpt`, `unused`. Run `golangci-lint run ./...` to confirm clean.
+
+6. **Makefile (M1.4, M1.5)** — add:
+   ```make
+   GO_BIN := bin/fuj
+   GO_SRC := go
+
+   go-build:
+   	cd $(GO_SRC) && go build -trimpath \
+   	  -ldflags "-X main.version=$$(git describe --tags --always 2>/dev/null || echo dev) \
+   	            -X main.commit=$$(git rev-parse --short HEAD) \
+   	            -X main.buildDate=$$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+   	  -o ../$(GO_BIN) ./cmd/fuj
+
+   go-test:
+   	cd $(GO_SRC) && go test -race ./...
+
+   go-run: go-build
+   	./$(GO_BIN) $(ARGS)
+
+   go-lint:
+   	cd $(GO_SRC) && golangci-lint run ./...
+
+   web-go: go-build
+   	./$(GO_BIN) server --addr :8080
+   ```
+   Rename existing `web:` target to `web-py:` and add `web: web-py` as alias.
+
+7. **Dockerfile + CI (M1.7)** — `go/build/Dockerfile`:
+   ```dockerfile
+   FROM golang:1.26 AS build
+   WORKDIR /src
+   COPY go/go.mod go/go.sum ./
+   RUN go mod download
+   COPY go/ ./
+   ARG GIT_TAG=unknown
+   ARG GIT_COMMIT=unknown
+   ARG BUILD_DATE=unknown
+   RUN CGO_ENABLED=0 go build -trimpath \
+         -ldflags "-s -w -X main.version=${GIT_TAG} -X main.commit=${GIT_COMMIT} -X main.buildDate=${BUILD_DATE}" \
+         -o /out/fuj ./cmd/fuj
+
+   FROM gcr.io/distroless/static:nonroot
+   COPY --from=build /out/fuj /usr/local/bin/fuj
+   EXPOSE 8080
+   USER nonroot:nonroot
+   ENTRYPOINT ["/usr/local/bin/fuj","server"]
+   ```
+   In [.gitea/workflows/build.yaml](.gitea/workflows/build.yaml), add a parallel job:
+   ```yaml
+   build-go:
+     runs-on: ubuntu-latest
+     steps:
+       - uses: actions/checkout@v4
+       - run: docker login ...
+       - run: |
+           docker build -f go/build/Dockerfile \
+             --build-arg GIT_TAG=$TAG \
+             --build-arg GIT_COMMIT=${{ github.sha }} \
+             --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
+             -t gitea.home.hrajfrisbee.cz/${{ github.repository }}:$TAG-go .
+           docker push gitea.home.hrajfrisbee.cz/${{ github.repository }}:$TAG-go
+   ```
+
+8. **Smoke verify (M1.10)** — see Verification section below; then append a CHANGELOG entry and tick M1 boxes in the progress tracker with commit SHAs.
+
+## Reuse / parity with Python side
+
+- `internal/config` mirrors [scripts/config.py](scripts/config.py) **exactly** — same env var names, same defaults. No new env knobs in M1.
+- Request-timer middleware records elapsed milliseconds; this is the Go-side
+  equivalent of the Python `get_render_time` helper that supplies
+  `render_time.total` to templates. Allowlisted as volatile in the future
+  parity diff (M5).
+- Constants `AttendanceSheetID`, `PaymentsSheetID`, `JuniorSheetGID` are
+  copied verbatim from [scripts/config.py](scripts/config.py); they don't
+  get used until M4 but live in `internal/config` from day one.
+
+## Verification
+
+Run from repo root after all changes are in place:
+
+```bash
+# 1. Builds clean
+make go-build && test -x bin/fuj
+
+# 2. Lint clean
+make go-lint
+
+# 3. Subcommand dispatcher works
+./bin/fuj help
+./bin/fuj version          # prints version/commit/buildDate
+./bin/fuj fees             # prints "not implemented yet" and exits 2
+
+# 4. Server runs and hello page is served
+make web-go &
+GO_PID=$!
+sleep 1
+curl -sf http://localhost:8080/ | grep -q "fuj"
+kill $GO_PID
+
+# 5. Side-by-side: both backends up
+make web-py &     # :5001
+PY_PID=$!
+make web-go &     # :8080
+GO_PID=$!
+sleep 2
+curl -sf http://localhost:5001/ >/dev/null && echo "py OK"
+curl -sf http://localhost:8080/ >/dev/null && echo "go OK"
+kill $PY_PID $GO_PID
+
+# 6. Race-free unit tests pass (none yet beyond a smoke test, but harness works)
+make go-test
+
+# 7. Docker image builds locally
+docker build -f go/build/Dockerfile -t fuj-go:dev .
+docker run --rm -p 8080:8080 fuj-go:dev &
+sleep 1
+curl -sf http://localhost:8080/ >/dev/null && echo "container OK"
+docker stop $(docker ps -lq)
+```
+
+All seven steps must succeed. Then update the progress tracker and
+CHANGELOG.
+
+## Out of scope for M1 (deferred to later milestones)
+
+- Domain logic — `czech.Normalize`, fees, reconcile, etc. → **M2**.
+- Fixture capture and parity tests → **M3**.
+- Sheets/Drive/Fio clients and `internal/io/*` → **M4**.
+- `/api/*` JSON routes and `cmd/parity` → **M5**.
+- HTML templates, static assets, `embed.FS` → **M6**.
+- Removing the Python backend → **M8**.
+
+## Open items / forks the user can override at review
+
+- **CI tag suffix**: `<tag>-go` proposed. Alternative: separate image
+  repository (`fuj-management-go:<tag>`). The suffix keeps things in one
+  registry path; speak up if separate repos are preferred.
+- **Distroless variant**: `nonroot` chosen for least privilege. If the
+  existing Python container runs as root and the user expects parity,
+  switch to `gcr.io/distroless/static` (root). Doesn't affect M1
+  functionality.
+- **Hello page content**: minimal HTML mentioning `fuj`, version, commit,
+  build date, link list to future routes. Speak up if you want a different
+  shape — it gets thrown away in M6 anyway.
+
+## Critical files
+
+- [docs/plans/2026-05-03-2349-go-backend-rewrite.md](docs/plans/2026-05-03-2349-go-backend-rewrite.md) — master plan (approved 2026-05-04)
+- [docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md](docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md) — task tracker; tick M1.1–M1.10 here
+- [Makefile](Makefile) — current target structure (renaming `web` → `web-py`)
+- [scripts/config.py](scripts/config.py) — source of truth for env vars / IDs that `internal/config` mirrors
+- [build/Dockerfile](build/Dockerfile) — Python container (unchanged); the new Go Dockerfile lives at `go/build/Dockerfile`
+- [.gitea/workflows/build.yaml](.gitea/workflows/build.yaml) — extended with parallel `build-go` job

docs/plans/2026-05-04-2249-payment-name-match-exact.md

@@ -0,0 +1,81 @@
+# Exact full-name match for payment inference
+
+## Context
+
+A bank payment with the message `Henrietta Ottová (Heny): 04/2026` is being inferred to **two** members: the correct `Henrietta Ottová` *and* the unrelated `Tomáš Němeček (Tov)`. As a result, `reconcile()` splits the amount 50/50 between them, producing wrong balances.
+
+**Root cause** (`scripts/match_payments.py:51-115`): `match_members` runs four substring checks via raw Python `in`, with no word boundaries. Tomáš's nickname `Tov` normalizes to `tov`, which is literally a substring of `ottova`. Check #3 (`match_payments.py:79-85`) treats bare nickname presence as an `auto`-confidence match, so Tomáš is appended even though no part of his name is actually in the message. There is also no short-circuit when a member's full canonical name appears verbatim — every other member is still scored against the same haystack.
+
+**Goal:** when a member's full canonical name (diacritics-insensitive) appears in the message as whole words, return only the full-name hit(s) and skip nickname/partial scoring entirely. Additionally, harden the remaining checks with word boundaries so future substring collisions (any nickname or short name part that happens to live inside another member's surname) can't reproduce this class of bug.
+
+## Approach
+
+Single-file change in [scripts/match_payments.py](scripts/match_payments.py). Two coordinated edits to `match_members` (`match_payments.py:51-115`):
+
+### 1. Add an exact-canonical-name short-circuit (new, before the existing loop)
+
+After computing `normalized_text`, do a first pass that collects every member whose `normalized_base` (the full name minus the parenthesized nickname, normalized) appears in the haystack as **whole words**. If at least one is found, return *only* those as `auto` matches and skip the rest of the function.
+
+Implementation sketch (inserted between [match_payments.py:58](scripts/match_payments.py#L58) and [match_payments.py:61](scripts/match_payments.py#L61)):
+
+```python
+exact_matches = []
+for name in member_names:
+    variants = _build_name_variants(name)
+    full_name = variants[0] if variants else ""
+    if full_name and re.search(rf"\b{re.escape(full_name)}\b", normalized_text):
+        exact_matches.append((name, "auto"))
+if exact_matches:
+    return exact_matches
+```
+
+This satisfies the user's primary ask: when the message literally contains the canonical name, that wins outright. Multi-member messages still work — every full-name occurrence is collected.
+
+### 2. Replace remaining `in normalized_text` checks with `\b…\b` regex
+
+For the three checks that survive the short-circuit (and the `review`-tier partials), swap raw `in` for whole-word regex so `tov` cannot match inside `ottova`, `dan` cannot match inside `bohdan`, etc. Affected lines:
+
+- [match_payments.py:73](scripts/match_payments.py#L73) — first+last name both present
+- [match_payments.py:82](scripts/match_payments.py#L82) — nickname presence
+- [match_payments.py:94](scripts/match_payments.py#L94) — last-name partial (`review`)
+- [match_payments.py:99](scripts/match_payments.py#L99) — first-name partial (`review`)
+- [match_payments.py:104](scripts/match_payments.py#L104) — single-name member partial
+
+Helper to keep the call sites tidy:
+
+```python
+def _word_in(needle: str, haystack: str) -> bool:
+    return bool(re.search(rf"\b{re.escape(needle)}\b", haystack))
+```
+
+Check #1 (line 67) becomes redundant once the short-circuit is in place, but leave it untouched as a defensive fallback in case `_build_name_variants` ever returns a `full_name` shorter than the 3-char filter would allow. (No code change there.)
+
+### 3. Why this is sufficient
+
+- The reported message `Henrietta Ottová (Heny): 04/2026` hits the new short-circuit on `henrietta ottova`, returns `[("Henrietta Ottová", "auto")]`, and never even evaluates Tomáš.
+- Bare-nickname messages (e.g. `Heny 04/2026`) skip the short-circuit (no full name present) and fall into the existing nickname check — now word-bounded, so `tov` no longer collides with `ottova` even there.
+- Combined-payment messages listing two full names continue to work: both are collected by the short-circuit.
+
+### Files to modify
+
+- [scripts/match_payments.py](scripts/match_payments.py) — only `match_members` (lines 51-115). Add `_word_in` helper just above it.
+
+### Files to read for confidence (no edits)
+
+- [scripts/czech_utils.py](scripts/czech_utils.py) — confirm `normalize()` semantics (NFKD strip + lowercase). Already understood; relevant because `re.escape` on already-normalized lowercase ASCII is safe.
+- [scripts/infer_payments.py](scripts/infer_payments.py) — confirm it just consumes the `match_members` output verbatim and writes comma-joined names. No change needed; the upstream fix propagates.
+- [scripts/match_payments.py:336-362](scripts/match_payments.py#L336-L362) — `reconcile()` only re-runs inference when `Person` is empty, so existing wrong rows in the sheet must be cleared by hand or via the `manual fix`/blank-cell workflow before re-running `make infer`.
+
+## Verification
+
+1. **Unit test** — add `tests/test_match_members.py` (new file, mirroring `tests/test_reconcile_exceptions.py` style). Cases:
+   - `match_members("Henrietta Ottová (Heny): 04/2026", ["Henrietta Ottová", "Tomáš Němeček (Tov)"])` → `[("Henrietta Ottová", "auto")]` only.
+   - `match_members("Heny 04/2026", ["Tomáš Němeček (Tov)", "Henrietta Ottová"])` → no match for Tomáš (the substring trap is closed); whatever the legitimate behavior for "Heny" is, document it.
+   - Combined payment: `match_members("Henrietta Ottová a Tomáš Němeček 04/2026", ["Henrietta Ottová", "Tomáš Němeček (Tov)"])` → both as `auto`.
+   - Sanity: `match_members("VS 1234 Tomáš Němeček", [...])` still returns Tomáš.
+
+2. **Run the suite**: `make test`.
+
+3. **End-to-end**: clear the buggy row's `Person`/`Purpose` cells in the payments sheet, then `make infer`, then `make reconcile`. Confirm the payment now allocates fully to Henrietta and balance reflects it.
+
+4. **Changelog**: per [CLAUDE.md](CLAUDE.md), append an entry to [CHANGELOG.md](CHANGELOG.md) once the user confirms the fix works in production. Format: `## 2026-05-04 HH:MM TZ — fix: payment inference exact-match short-circuit`.

docs/plans/2026-05-05-1637-member-modal-raw-payments-debug.md

@@ -0,0 +1,99 @@
+# Member modal — raw payments debug list
+
+## Context
+
+When a payer's bank message doesn't follow our convention, [`infer_payments.py`](scripts/infer_payments.py) may map the transfer to the wrong period (or none), and today the member detail modal hides this — it only shows the post-allocation, per-month splits produced by [`reconcile()`](scripts/match_payments.py:295). To diagnose these cases the user needs to see the **original sheet rows** that were attributed to a member: full `Amount`, `Inferred Amount`, `Person`, `Purpose`, `Sender`, `Message`, `Bank ID`, `manual fix`. The list should be hidden by default and revealed by a small toggle, since it is only relevant during debugging.
+
+## Approach
+
+Reuse the grouping logic that already exists in the [`/payments` route](app.py:540-553): group raw `tx` dicts by parsed `Person`, expose that mapping to the modal, and render it on demand under a new collapsible section.
+
+### 1. Backend — group raw txs by member
+
+In [`app.py`](app.py):
+
+- Factor the existing per-person grouping in [`payments()`](app.py:530-568) into a small helper near the top of the file:
+  ```python
+  def group_payments_by_person(transactions):
+      grouped = {}
+      for tx in transactions:
+          person = str(tx.get("person", "")).strip()
+          if not person:
+              continue  # unmatched rows are not tied to a member
+          for p in person.split(","):
+              p = re.sub(r"\[\?\]\s*", "", p).strip()
+              if not p:
+                  continue
+              grouped.setdefault(p, []).append(tx)
+      for rows in grouped.values():
+          rows.sort(key=lambda t: str(t.get("date", "")), reverse=True)
+      return grouped
+  ```
+  Call it from [`payments()`](app.py:530), [`adults_view()`](app.py:160) and [`juniors_view()`](app.py:326) — the existing `payments()` body collapses to one line.
+
+- In `adults_view()` and `juniors_view()`, after `transactions = get_cached_data(...)`, build `raw_payments_by_person = group_payments_by_person(transactions)` and pass it to `render_template` as `raw_payments_json=json.dumps(raw_payments_by_person)`.
+
+- Note: rows where `Person` is empty are skipped on purpose — those have no member to attach to and are already shown by the dashboard's `Unmatched` block.
+
+### 2. Templates — add a collapsible raw section to the modal
+
+In [`templates/adults.html`](templates/adults.html) and [`templates/juniors.html`](templates/juniors.html), make the same structural and JS changes (the modal markup is mirrored in both files — `adults.html:677-682` and `juniors.html:658-663`).
+
+- Inject the new dataset alongside the existing `memberData`:
+  ```html
+  const rawPaymentsByPerson = {{ raw_payments_json| safe }};
+  ```
+  (next to [`adults.html:696`](templates/adults.html#L696)).
+
+- Add a new section directly **after** the Payment History block:
+  ```html
+  <div class="modal-section">
+      <div class="modal-section-title">
+          Raw Payments
+          <a href="#" id="rawPaymentsToggle" class="raw-toggle"
+             onclick="toggleRawPayments(event)">[show]</a>
+      </div>
+      <div id="modalRawList" class="tx-list" style="display: none;">
+          <!-- Filled by JS -->
+      </div>
+  </div>
+  ```
+  Add a small CSS rule for `.raw-toggle` (muted color, smaller font, `margin-left: 8px`) — a few lines next to the existing `.modal-section-title` style. Don't restyle the whole modal.
+
+- In `showMemberDetails(name)`:
+  - Reset the toggle to `[show]` and the `#modalRawList` to `display: none` on every open (so the state doesn't leak between members).
+  - Populate `#modalRawList` from `rawPaymentsByPerson[name] || []`. For each row render: `Date | Purpose` on the meta line, `Amount CZK` (with `Inferred: X CZK` annotation when `inferred_amount` differs from `amount`), `Sender`, `Person` (full string — useful when split between multiple people), `Message`, and a small footer with `Bank ID` and a `[manual fix]` marker if `manual_fix` is truthy. Reuse the existing `tx-item` / `tx-meta` / `tx-main` / `tx-msg` styles to match the rest of the modal.
+  - When the list is empty, render `<div style="color: #444; font-style: italic; padding: 10px 0;">No raw payments tied to this member.</div>` (same idiom used at [`adults.html:813`](templates/adults.html#L813)).
+
+- Add the toggle handler near `closeModal`:
+  ```js
+  function toggleRawPayments(ev) {
+      ev.preventDefault();
+      const list = document.getElementById('modalRawList');
+      const link = document.getElementById('rawPaymentsToggle');
+      const hidden = list.style.display === 'none';
+      list.style.display = hidden ? 'block' : 'none';
+      link.textContent = hidden ? '[hide]' : '[show]';
+  }
+  ```
+
+### 3. Why not extend `reconcile()` instead
+
+`reconcile()` already collapses each row into per-month allocated shares and drops `purpose`, `inferred_amount`, `bank_id`, `manual_fix`, and the gross `amount` ([trace](scripts/match_payments.py:436-469)). Carrying the raw `tx` through `reconcile()` would inflate the contract for every consumer when only the modal needs it. Grouping the already-fetched `transactions` list at the route level is one extra dict per request and reuses the cached payments data — no new sheet reads.
+
+## Critical files
+
+- [app.py](app.py) — add `group_payments_by_person()` helper; call it in `adults_view()`, `juniors_view()`, and `payments()`; pass `raw_payments_json` to the two dashboard templates.
+- [templates/adults.html](templates/adults.html) — modal section + JS + tiny CSS for the toggle link.
+- [templates/juniors.html](templates/juniors.html) — same changes as adults.html.
+
+## Verification
+
+1. `make web-debug` and open `http://localhost:5001/adults`.
+2. Pick a member known to have multiple payments (use the existing `/payments` page as a cross-reference).
+3. Click `[i]` → modal opens, raw list is hidden, link shows `[show]`. Click the link → list appears with the raw rows; click again → hides, link returns to `[show]`.
+4. Switch to another member via keyboard (ArrowDown) — the toggle resets to hidden and the list updates to the new member's rows (no leaking).
+5. Compare the raw rows in the modal against the `/payments` page grouping for the same person — same set of rows, same `Date`/`Amount`/`Message`.
+6. Pick a row with a non-conformant message (e.g. one where `Person` was inferred to multiple people) — confirm `Person` shows the full comma-separated string and `Inferred Amount` is visible when it differs from `Amount`.
+7. Repeat the click-through on `/juniors` to confirm parity.
+8. `make test` — no backend behavior change is expected, but run to catch template/route smoke breakage.

docs/plans/2026-05-05-1717-payment-person-name-canonicalization.md

@@ -0,0 +1,135 @@
+# Tolerate diacritic / case / whitespace mismatches between `Person` column and member names
+
+## Context
+
+For "Mária Maco" there is a payment row in the payments sheet with `Purpose = 2026-04`, but the modal for that member shows neither a paid 2026-04 cell **nor** a row in payment history. Both symptoms collapse to a single root cause in [`reconcile()`](scripts/match_payments.py#L295), confirmed by reading the code:
+
+- [`scripts/match_payments.py:404`](scripts/match_payments.py#L404) — `if member_name not in ledger:` is a **byte-exact** comparison. `member_name` is the `Person` cell from the payments sheet with only `.strip()` and `[?]` markers removed ([:349-353](scripts/match_payments.py#L349-L353)). `ledger` keys are the canonical names from the attendance sheet. There is no diacritic, case, or whitespace normalization on this path. (`czech_utils.normalize` is imported and used for the `exceptions` lookup at [:282-283 / :321-322](scripts/match_payments.py#L282-L322), but **not** for member-name matching.)
+- When a row falls through that check, it is appended to `unmatched` and never reaches `ledger[member_name][m]['paid']` or `['transactions']`. The dashboard's per-month "paid" cell stays unpaid, and because the modal's payment history is built from `data.months[m].transactions` ([`templates/adults.html:772-776`](templates/adults.html#L772-L776)), the row also disappears from the modal's history list.
+- The new "Raw Payments" debug section ([`templates/adults.html:861`](templates/adults.html#L861)) uses `rawPaymentsByPerson[name]`. Its keys come from [`group_payments_by_person()` in `app.py:60-73`](app.py#L60-L73), which also stores the **literal** `Person` string (only `.strip()` and `[?]` stripped). So if the attendance-sheet name and the `Person` cell differ at the byte level, that section also returns an empty list — which is why the user does not see the row anywhere in the modal.
+
+The most likely cause for "Mária Maco" specifically: the `Person` cell was typed (or pasted) without the `á` diacritic — `Maria Maco` vs `Mária Maco`. Other plausible variants the current code silently drops: case differences (`mária maco`), trailing/embedded extra whitespace, and NBSP characters.
+
+The fix is to make the matching tolerant via the existing [`czech_utils.normalize()`](scripts/czech_utils.py#L22-L25) helper (NFKD + lowercase), with a small whitespace-collapse on top, and apply the same canonicalization in `group_payments_by_person()` so the modal's raw-payments lookup uses the canonical attendance-sheet name as the key.
+
+## Approach
+
+### 1. `scripts/match_payments.py` — tolerant `Person` → `ledger` resolution in `reconcile()`
+
+- Add a small private helper at module scope:
+
+  ```python
+  def _canonical_key(name: str) -> str:
+      return re.sub(r"\s+", " ", normalize(name)).strip()
+  ```
+
+  Uses the existing `normalize()` from `czech_utils` ([:22-25](scripts/czech_utils.py#L22-L25)) and additionally collapses whitespace runs to a single space so `"Mária  Maco"` and `"Mária Maco"` both reduce to `"maria maco"`.
+
+- Inside [`reconcile()`](scripts/match_payments.py#L295), right after `member_names` is computed ([:308](scripts/match_payments.py#L308)), build a lookup dict once:
+
+  ```python
+  canonical_by_key: dict[str, str] = {}
+  for name in member_names:
+      key = _canonical_key(name)
+      canonical_by_key.setdefault(key, name)  # first wins; ambiguity handled below
+  ```
+
+- Replace the byte-exact check at [:404](scripts/match_payments.py#L404). Resolve each `member_name` from `matched_members` to the canonical attendance-sheet name before any ledger / credits access:
+
+  ```python
+  for raw_member_name, confidence in matched_members:
+      member_name = canonical_by_key.get(_canonical_key(raw_member_name))
+      if member_name is None:
+          logger.warning(
+              "Payment matched to unknown member %r (tx: %s, %s) — adding to unmatched",
+              raw_member_name, tx.get("date", "?"), tx.get("message", "?"),
+          )
+          unmatched.append(tx)
+          continue
+      if member_name != raw_member_name:
+          logger.info(
+              "Person cell %r resolved to canonical member %r — consider fixing the sheet",
+              raw_member_name, member_name,
+          )
+      # ... rest of the loop body unchanged: ledger[member_name], credits[member_name], …
+  ```
+
+  The `logger.info` line lets the user see (in `make web-debug` logs) which sheet rows have a non-canonical `Person` value, so they can clean them up at their own pace — without breaking allocation in the meantime.
+
+- Leave the rest of the function untouched. Once `member_name` is the canonical name, every downstream key (`ledger[member_name]`, `credits[member_name]`, `other_ledger[member_name]`, the `tx["person"]` echo into `transactions`) is already correct.
+
+### 2. `app.py` — canonicalize the raw-payments grouping key
+
+- The current [`group_payments_by_person()`](app.py#L60-L73) cannot canonicalize on its own because it does not know the attendance-sheet member list. Extend its signature to accept the member list and reuse `_canonical_key`:
+
+  ```python
+  from match_payments import _canonical_key  # or re-export via a tiny public name
+
+  def group_payments_by_person(transactions, member_names=None):
+      canonical_by_key = (
+          {_canonical_key(n): n for n in member_names} if member_names else {}
+      )
+      grouped = {}
+      for tx in transactions:
+          person = str(tx.get("person", "")).strip()
+          if not person:
+              continue
+          for p in person.split(","):
+              p = re.sub(r"\[\?\]\s*", "", p).strip()
+              if not p:
+                  continue
+              key = canonical_by_key.get(_canonical_key(p), p)  # fallback: keep raw
+              grouped.setdefault(key, []).append(tx)
+      for rows in grouped.values():
+          rows.sort(key=lambda t: str(t.get("date", "")), reverse=True)
+      return grouped
+  ```
+
+- Update the three call sites to pass `member_names`:
+  - `adults_view()` around [`app.py:333`](app.py#L333) — `members` is already in scope; pass `[name for name, _, _ in members]`.
+  - `juniors_view()` around [`app.py:539`](app.py#L539) — same.
+  - `payments()` around [`app.py:549`](app.py#L549) — same; needs the adult+junior member names so the `/payments` per-person grouping is consistent.
+
+- Naming: `_canonical_key` starts with an underscore inside `match_payments.py`. To avoid leaking a private symbol, expose it as `canonical_member_key` (no underscore) in `match_payments.py` and import that name from `app.py`.
+
+### 3. Why not also touch `infer_payments.py`
+
+`infer_payments.py` already writes canonical attendance-sheet names into the `Person` column (it picks from `member_names`). The bug only manifests when the cell was filled in **manually** by a human (typed without diacritics, different case) or was written by an older inference that has since drifted from a renamed attendance row. Making `reconcile()` tolerant fixes the symptom for both cases without changing inference. The `logger.info` line is sufficient signal for the user to clean up the sheet on their own schedule.
+
+### 4. Tests
+
+**4a. Delete obsolete route tests in [tests/test_app.py](tests/test_app.py).** Four tests target Flask routes that no longer exist (the old fee/reconcile pages were merged into `/adults` and `/juniors`); they currently fail with 404. Their coverage is already provided by `test_adults_route`, `test_juniors_route`, and `test_payments_route`. Delete:
+
+- `test_fees_route` ([tests/test_app.py:22-35](tests/test_app.py#L22-L35)) — hits `/fees`
+- `test_fees_juniors_route` ([tests/test_app.py:37-55](tests/test_app.py#L37-L55)) — hits `/fees-juniors`
+- `test_reconcile_route` ([tests/test_app.py:57-81](tests/test_app.py#L57-L81)) — hits `/reconcile`; also asserts a literal `OK` string the merged dashboard no longer renders
+- `test_reconcile_juniors_route` ([tests/test_app.py:101-131](tests/test_app.py#L101-L131)) — hits `/reconcile-juniors`; same `OK` assertion mismatch
+
+The two tests that reference junior-only formatting (`? / 1 (J)` and `500 CZK / 4 (1A+3J)`) are testing a retired template, not the live `/juniors` page — no need to migrate those assertions; the live `/juniors` format is already covered by `test_juniors_route`.
+
+**4b. Add `tests/test_match_payments.py`** (new file) covering the resolution helper and `reconcile()` end-to-end for the canonicalization fix:
+
+- `_canonical_key("Mária  Maco") == _canonical_key("maria maco")`
+- `reconcile()` with member `"Mária Maco"` and a tx `{person: "Maria Maco", purpose: "2026-04", amount: 750, ...}` produces:
+  - `result['members']['Mária Maco']['months']['2026-04']['paid'] == 750`
+  - the tx appears in `result['members']['Mária Maco']['months']['2026-04']['transactions']`
+  - `result['unmatched']` is empty
+- `reconcile()` with `Person = "Někdo Neznámý"` (no match in members) still routes to `unmatched`.
+
+## Critical files
+
+- [scripts/match_payments.py](scripts/match_payments.py) — add `canonical_member_key()` helper; build `canonical_by_key` once in `reconcile()`; resolve `raw_member_name` → `member_name` before ledger access at [:404](scripts/match_payments.py#L404).
+- [app.py](app.py) — extend `group_payments_by_person()` to accept `member_names` and key the grouped dict by canonical attendance-sheet name; update three call sites.
+- [tests/test_app.py](tests/test_app.py) — delete the four obsolete route tests listed in §4a.
+- [tests/test_match_payments.py](tests/test_match_payments.py) — add the cases above (create the file if missing).
+- [docs/plans/](docs/plans/) — per project [CLAUDE.md](CLAUDE.md), move this plan file to `docs/plans/2026-05-05-1640-payment-person-name-canonicalization.md` once execution starts (the plan-mode harness writes to `~/.claude/plans/` by default).
+
+## Verification
+
+1. **Reproduce first.** Before touching code, open `/adults`, click `[i]` next to "Mária Maco", and confirm both: 2026-04 is unpaid and the payment is missing from history. Inspect the actual `Person` cell value in the payments sheet for the 2026-04 row — confirm it differs from `"Mária Maco"` (likely missing the `á`). Record the exact string for the test case.
+2. `make test` — new tests pass; existing tests still green.
+3. `make web-debug` and reload `/adults`. The 2026-04 cell for "Mária Maco" turns green (`cell-ok`); the modal's payment history shows the row; the "Raw Payments" section also shows the row. Server log emits `Person cell 'Maria Maco' resolved to canonical member 'Mária Maco' — consider fixing the sheet`.
+4. Cross-check `/payments` — the row appears under the `Mária Maco` group (canonical key), not under a separate `Maria Maco` group.
+5. Spot-check one member with the conventionally-correct `Person` value (e.g. one of the recent payers visible on the dashboard) — paid cells and history are unchanged, no spurious resolution log line.
+6. Confirm a payment with a genuinely unknown `Person` (typo of a non-member) still ends up in the dashboard's `Unmatched` block and emits the existing `Payment matched to unknown member …` warning.
+7. Append a `CHANGELOG.md` entry per [CLAUDE.md](CLAUDE.md) once the user confirms the fix works.

docs/plans/2026-05-05-2144-branch-per-feature-workflow.md

@@ -0,0 +1,83 @@
+# Branch-per-feature + Gitea MR workflow
+
+## Context
+
+Until now, Claude has been committing feature work directly to `main`
+(see recent history: `feat: Lower adult monthly fee…`, `feat: Go rewrite M1…`,
+all on `main`). The user wants to switch to a branch-per-feature flow with
+review via a Gitea merge request, so that:
+
+- Feature work is reviewable as a self-contained diff before it lands.
+- `main` stays releasable.
+- The change history shows reviewed merges, not unsupervised pushes.
+
+The remote is Gitea (`https://gitea.home.hrajfrisbee.cz/kacerr/fuj-management.git`),
+which supports the standard pull/merge-request flow.
+
+This plan only modifies `CLAUDE.md`. No code changes.
+
+## Scope clarification (from user)
+
+- **MR creation method:** Claude pushes the branch and prints the Gitea
+  "compare" URL. The user opens / merges the MR in the browser. No `tea` CLI,
+  no API calls.
+- **When the flow applies:** Features only. Small bug fixes and hotfixes can
+  still be committed straight to `main`. Claude decides feature-vs-fix based
+  on scope; when uncertain, ask.
+- **Branch naming:** `feat/<slug>` for features, `fix/<slug>` for the
+  occasional bug-fix branch the user explicitly requests. `<slug>` is
+  kebab-case, short, descriptive.
+
+## Change
+
+Add a new top-level section to `CLAUDE.md` titled **"Branching & merge requests"**,
+placed immediately before the existing `## Git Commits` section so the workflow
+context appears before the commit-message convention.
+
+### Proposed section content
+
+```markdown
+## Branching & merge requests
+
+The remote is Gitea (`gitea.home.hrajfrisbee.cz/kacerr/fuj-management`).
+For **features**, do not commit to `main` directly. Use a branch + merge
+request flow:
+
+1. **Create a branch off `main`** before starting work:
+   - `feat/<slug>` for features (e.g. `feat/qr-code-overlay`)
+   - `fix/<slug>` for bug-fix branches the user explicitly asks for
+   - `<slug>` is short kebab-case
+2. **Commit on the branch** following the existing commit conventions
+   (Co-Authored-By trailer, etc.).
+3. **Push the branch** to `origin` with `-u` so it tracks.
+4. **Print the Gitea compare URL** so the user can open the MR in the
+   browser:
+   `https://gitea.home.hrajfrisbee.cz/kacerr/fuj-management/compare/main...<branch>`
+   Do **not** use `tea`, `gh`, or call the Gitea API — the user opens and
+   merges the MR themselves.
+5. **Do not merge or delete the branch** from the CLI. The user does that
+   in Gitea.
+
+**Exceptions — when committing straight to `main` is fine:**
+- Small bug fixes / hotfixes the user describes as such.
+- Typo / comment / formatting tweaks.
+- Edits the user explicitly says to push to `main`.
+
+When uncertain whether something is "feature" or "small fix", ask before
+committing.
+```
+
+## Files to modify
+
+- [CLAUDE.md](CLAUDE.md) — insert the new `## Branching & merge requests`
+  section just above the existing `## Git Commits` section (around line 95).
+
+## Verification
+
+- Re-read `CLAUDE.md` and confirm the new section is well-placed and the
+  existing structure (`## Git Commits`, `## Changelog`, `## Plans`) is intact.
+- `git diff CLAUDE.md` should show only an additive change.
+- No code, tests, or runtime behavior changes — nothing else to test.
+- Behavior verification happens on the **next** feature request: Claude
+  should create a `feat/<slug>` branch, commit there, push, and print the
+  compare URL instead of committing on `main`.

docs/plans/2026-05-05-2204-go-rewrite-m2-1-czech-normalize.md

@@ -0,0 +1,154 @@
+# Plan: Go rewrite — M2.1 `domain/czech.Normalize`
+
+## Context
+
+The Go rewrite finished M1 (skeleton, tooling, hello server) in commit
+`cf0f176` on 2026-05-04. The next milestone, **M2 — Pure-domain helpers**,
+is current per [progress tracker](2026-05-03-2349-go-backend-rewrite-progress.md)
+but has no work landed yet (all 12 sub-tasks unchecked).
+
+This plan covers only the **first** M2 task: porting Python's
+`normalize` from [scripts/czech_utils.py](../../scripts/czech_utils.py)
+to Go as `internal/domain/czech.Normalize`. It is the lowest-level helper
+in the domain — `parse_month_references`, `_build_name_variants`,
+`match_members`, exception keys, and `reconcile` all transitively depend
+on it. Getting it byte-equivalent first removes a class of "why does my
+match not fire" failures from every later M2 task.
+
+**Decision (confirmed in plan-mode Q):** start with hand-written Go unit
+tests for fresh Czech edge cases. Defer parity-fixture wiring until
+M3.1/M3.2 land (separate task); add the parity test for `Normalize`
+retroactively at that point.
+
+## Scope
+
+- New package `go/internal/domain/czech/` with `Normalize` and unit tests.
+- Add `golang.org/x/text` dependency to `go/go.mod` (currently zero deps).
+- **Out of scope:** `ParseMonthReferences` (M2.2), fixture tooling
+  (M3.1/M3.2), CLI subcommand wiring (M2.11/M2.12), parity test runner.
+
+## Recommended approach
+
+### Python contract to match
+
+```python
+def normalize(text: str) -> str:
+    nfkd = unicodedata.normalize("NFKD", text)
+    return "".join(c for c in nfkd if not unicodedata.combining(c)).lower()
+```
+
+Three semantic operations:
+1. NFKD decompose
+2. Drop characters where `unicodedata.combining(c)` is non-zero
+3. Lowercase
+
+### Go implementation
+
+`go/internal/domain/czech/normalize.go`:
+
+```go
+package czech
+
+import (
+    "strings"
+    "unicode"
+    "golang.org/x/text/unicode/norm"
+)
+
+func Normalize(s string) string {
+    decomposed := norm.NFKD.String(s)
+    var b strings.Builder
+    b.Grow(len(decomposed))
+    for _, r := range decomposed {
+        if unicode.In(r, unicode.Mn) {
+            continue
+        }
+        b.WriteRune(r)
+    }
+    return strings.ToLower(b.String())
+}
+```
+
+**Two precision points worth flagging:**
+
+1. **`unicode.Mn` not `unicode.IsMark`.** The plan's library-choices
+   table mentions `unicode.IsMark`, but that covers Mn + Mc + Me. Python
+   `unicodedata.combining()` returns 0 for Mc/Me (their canonical
+   combining class is 0), so it effectively filters only Mn. Use
+   `unicode.In(r, unicode.Mn)` for byte-equivalence with Python. Cite
+   this in a one-line code comment; it's the kind of thing a future
+   reader will second-guess.
+2. **`strings.ToLower` vs Go's locale-aware tools.** Python's `.lower()`
+   on already-decomposed Latin is straight ASCII lowercase for Czech.
+   Stdlib `strings.ToLower` matches; do not pull in `golang.org/x/text/cases`.
+
+### Tests
+
+`go/internal/domain/czech/normalize_test.go` — table-driven, covers:
+
+- ASCII passthrough: `"Honza" → "honza"`
+- Czech lowercase diacritics: `"žluťoučký" → "zlutoucky"`
+- Mixed case + diacritics: `"Příliš" → "prilis"`
+- Czech caron + ring: `"Dvořák" → "dvorak"`, `"Růžena" → "ruzena"`
+- Hard letters: `"Čeněk" → "cenek"`, `"Kačer" → "kacer"`
+- Empty string: `"" → ""`
+- Already-normalized: `"prilis" → "prilis"` (idempotence)
+- Pre-composed vs decomposed input both produce the same output (NFC
+  `"é"` and `"é"` both → `"e"`)
+- Whitespace preserved: `"Jan Novák" → "jan novak"`
+
+Run a one-shot cross-check against the live Python implementation for
+each test input before locking the table:
+```
+PYTHONPATH=scripts:. python -c \
+  'from czech_utils import normalize; print(repr(normalize("Dvořák")))'
+```
+This is the manual stand-in for the M3 parity fixtures.
+
+### Wire-up
+
+- `go get golang.org/x/text@latest` (run from `go/`); `go mod tidy`.
+- No CLI changes — `cmd/fuj` already stubs `fees`/`reconcile` with
+  exit code 2; no need to touch dispatcher for this task. `Normalize`
+  is consumed by other domain code, not by users directly.
+
+## Critical files
+
+- New: [go/internal/domain/czech/normalize.go](../../go/internal/domain/czech/normalize.go)
+- New: [go/internal/domain/czech/normalize_test.go](../../go/internal/domain/czech/normalize_test.go)
+- Modified: [go/go.mod](../../go/go.mod), `go/go.sum` (new)
+- Reference (read-only): [scripts/czech_utils.py](../../scripts/czech_utils.py) — the porting source
+- Reference (read-only): [docs/plans/2026-05-03-2349-go-backend-rewrite.md](2026-05-03-2349-go-backend-rewrite.md) — risk #3 (NFKD edge cases)
+
+## Verification
+
+End-to-end checks before marking M2.1 done:
+
+1. `cd go && go build ./...` — clean compile.
+2. `cd go && go test ./internal/domain/czech/...` — all table cases green.
+3. `cd go && go test -race ./...` — race-clean.
+4. `cd go && golangci-lint run` (or `make go-lint` from repo root) — clean.
+5. **Spot parity** (manual, will be automated in M3): for each Go test
+   input, run the Python `normalize` via `PYTHONPATH=scripts:. python -c
+   '...'` and confirm bytes match. Capture the diff in the commit
+   message if anything surprises.
+6. `make go-build && make go-test && make go-lint` from repo root — proves
+   the existing M1 gate still passes.
+
+## Branching & follow-up
+
+Per [CLAUDE.md](../../CLAUDE.md), this is feature work → branch + Gitea MR:
+
+- Branch: `feat/m2-1-czech-normalize` off `main`.
+- Single commit, Co-Authored-By trailer.
+- Push with `-u`, print compare URL
+  `https://gitea.home.hrajfrisbee.cz/kacerr/fuj-management/compare/main...feat/m2-1-czech-normalize`
+- User opens/merges the MR.
+- After merge: tick `M2.1` in the progress tracker with the commit SHA;
+  add a one-line CHANGELOG entry; record any porting surprise in the
+  tracker's "Notes & decisions" section (e.g. the `Mn`-vs-`IsMark`
+  precision point if it bears noting).
+
+Next task after this lands is **M2.2 `ParseMonthReferences`** — the
+larger, edge-case-heavier sibling. Whether to start it before or after
+M3.1/M3.2 is a separate decision the user can make then.

docs/plans/2026-05-05-2337-go-rewrite-m2-2-parse-month-references.md

@@ -0,0 +1,205 @@
+# Plan: Go rewrite — M2.2 `domain/czech.ParseMonthReferences`
+
+## Context
+
+M2.1 (`domain/czech.Normalize`) merged via PR #4 (`d9a61b3`) on
+2026-05-05. Per the [progress tracker](2026-05-03-2349-go-backend-rewrite-progress.md),
+**M2.2** is next: port `parse_month_references` from
+[scripts/czech_utils.py](../../scripts/czech_utils.py) to Go as
+`internal/domain/czech.ParseMonthReferences`.
+
+This function is the second-most-load-bearing pure helper after
+`reconcile`: every payment-message → month inference goes through it.
+Risk #4 in the [parent plan](2026-05-03-2349-go-backend-rewrite.md)
+specifically calls out its semantics — wrap-around year inference and
+the `m >= 10 → previous year` standalone heuristic — as easy to mis-port.
+
+This plan locks the test table against the live Python implementation
+*before* coding, so the Go port has a verified parity baseline even
+before the M3.1/M3.2 fixture infrastructure exists.
+
+## Scope
+
+- New file `go/internal/domain/czech/parse_month_references.go` in the
+  existing `czech` package (alongside [normalize.go](../../go/internal/domain/czech/normalize.go)).
+- New file `go/internal/domain/czech/parse_month_references_test.go`
+  with the test table below.
+- **Out of scope:** parity-fixture wiring (M3.1/M3.2); CLI hook-up
+  (M2.11/M2.12); any consumer call-sites.
+- **No new dependencies** — stdlib `regexp`, `sort`, `strconv`, `strings`
+  plus the existing `czech.Normalize` cover everything.
+
+## Recommended approach
+
+### Python contract to mirror
+
+Three regex passes, all run on `normalize(text)`:
+
+1. `([\d+]+)\s*/\s*(\d{2,4})` — captures `"11+12/2025"`, `"01/26"`, `"1/26"`.
+   Split the months part on `+`, keep digit-only tokens, validate `1..12`.
+   Year < 100 → year + 2000.
+2. `(\d{1,2})\s*\.\s*(\d{4})` — captures `"12.2025"`. **4-digit year only**
+   (so `"1.26"` does not match).
+3. Czech month names. First the **range** sub-pass:
+   `(name)\s*-\s*(name)` finds pairs; walk start→end with `m % 12 + 1`,
+   stopping when `m == end_m`. Wrap rule: if `start_m > end_m`, months
+   `>= start_m` are `defaultYear - 1`, the rest are `defaultYear`. Both
+   matched names go into a `foundInRanges` set.
+   Then the **standalone** sub-pass: `\b(name)\b`, skipping any name in
+   `foundInRanges`. For each remaining match, `m >= 10 → defaultYear - 1`,
+   else `defaultYear`.
+
+Output: sorted, deduplicated `[]string` of `"YYYY-MM"`.
+
+### Go signature
+
+```go
+package czech
+
+// ParseMonthReferences extracts YYYY-MM month references from Czech
+// free text. defaultYear seeds two heuristics: standalone month names
+// with m >= 10 are treated as defaultYear-1 (out-of-year backfill), and
+// wrap-around ranges (e.g. listopad-leden) place months >= start in
+// defaultYear-1.
+func ParseMonthReferences(text string, defaultYear int) []string
+```
+
+Required `defaultYear` (no default value — Go convention).
+
+### Implementation sketch
+
+```go
+var czechMonths = map[string]int{
+    "leden": 1, "ledna": 1, "lednu": 1,
+    "unor": 2, "unora": 2, "unoru": 2,
+    "brezen": 3, "brezna": 3, "breznu": 3,
+    "duben": 4, "dubna": 4, "dubnu": 4,
+    "kveten": 5, "kvetna": 5, "kvetnu": 5,
+    "cerven": 6, "cervna": 6, "cervnu": 6,
+    "cervenec": 7, "cervnce": 7, "cervenci": 7,
+    "srpen": 8, "srpna": 8, "srpnu": 8,
+    "zari": 9,
+    "rijen": 10, "rijna": 10, "rijnu": 10,
+    "listopad": 11, "listopadu": 11,
+    "prosinec": 12, "prosince": 12, "prosinci": 12,
+}
+
+// Sorted by descending length at init, so longer alternatives win in
+// the regex (e.g. "cervenec" beats "cerven"). Mirrors Python's
+// sorted(..., key=len, reverse=True).
+var monthNameAlt = buildMonthNameAlt()
+
+var (
+    numericRe = regexp.MustCompile(`([\d+]+)\s*/\s*(\d{2,4})`)
+    dotRe     = regexp.MustCompile(`(\d{1,2})\s*\.\s*(\d{4})`)
+    rangeRe   = regexp.MustCompile(`(` + monthNameAlt + `)\s*-\s*(` + monthNameAlt + `)`)
+    standRe   = regexp.MustCompile(`\b(` + monthNameAlt + `)\b`)
+)
+```
+
+Three Go-specific gotchas worth a code comment:
+
+1. **RE2 alternation is leftmost-first**, same as Python `re`. Sorting
+   month names by descending length is therefore necessary (otherwise
+   `"cervenec"` matches as `"cerven"` + leftover `"ec"`). Mirror the
+   Python sort exactly.
+2. **Map iteration is randomized in Go.** Build the alternation list
+   from a sorted slice of keys, not by iterating the map.
+3. **`\d` and `\b`** in Go RE2 are ASCII-only, which matches the
+   effective behavior on `Normalize`'d input (NFKD already collapsed
+   any Unicode digits/letters that would matter; standalone Devanagari
+   digits in member messages aren't a real-world concern).
+
+The walk loop uses a bounded counter (max 12 iterations) defensively in
+Go; Python's `while True` is fine because every range terminates within
+12 hops, but a future reader appreciates the bound.
+
+### Test table (verified against live Python — `default_year=2026`)
+
+Locked outputs from `PYTHONPATH=scripts:. python -c 'from czech_utils
+import parse_month_references; print(parse_month_references(<input>, 2026))'`
+on 2026-05-05.
+
+| # | Input | Expected | Path exercised |
+|---|---|---|---|
+| 1 | `""` | `[]` | empty |
+| 2 | `"11+12/2025"` | `["2025-11", "2025-12"]` | numeric, plus-split |
+| 3 | `"1/2026"` | `["2026-01"]` | numeric, single |
+| 4 | `"01/26"` | `["2026-01"]` | 2-digit year normalization |
+| 5 | `"11+12/25"` | `["2025-11", "2025-12"]` | plus-split + 2-digit year |
+| 6 | `"12+1+2/2026"` | `["2026-01", "2026-02", "2026-12"]` | sorting |
+| 7 | `"12.2025"` | `["2025-12"]` | dot pattern |
+| 8 | `"1.26"` | `[]` | dot pattern requires 4-digit year |
+| 9 | `"leden"` | `["2026-01"]` | standalone, m<10 |
+| 10 | `"prosinec"` | `["2025-12"]` | standalone, m≥10 → previous year |
+| 11 | `"prosince"` | `["2025-12"]` | declension |
+| 12 | `"lednu"` | `["2026-01"]` | declension |
+| 13 | `"rijen"` | `["2025-10"]` | m≥10 boundary (10 itself) |
+| 14 | `"zari"` | `["2026-09"]` | m<10 just below boundary |
+| 15 | `"listopad-leden"` | `["2025-11", "2025-12", "2026-01"]` | wrap range Nov→Jan |
+| 16 | `"rijen-leden"` | `["2025-10", "2025-11", "2025-12", "2026-01"]` | wrap from October |
+| 17 | `"unor-kveten"` | `["2026-02", "2026-03", "2026-04", "2026-05"]` | non-wrap range |
+| 18 | `"leden-leden"` | `["2026-01"]` | degenerate range |
+| 19 | `"unor-listopad"` | `["2026-02", ..., "2026-11"]` (10 entries) | range spans m≥10 — heuristic does NOT fire (range exclusion) |
+| 20 | `"cervenec-srpen"` | `["2026-07", "2026-08"]` | longest-match alt (`cervenec` not `cerven`+`ec`) |
+| 21 | `"listopad-leden, prosinec"` | `["2025-11", "2025-12", "2026-01"]` | range + standalone, dedup |
+| 22 | `"prosinec leden"` | `["2025-12", "2026-01"]` | two standalones, no range |
+| 23 | `"11+12/2025, leden-brezen"` | `["2025-11", "2025-12", "2026-01", "2026-02", "2026-03"]` | numeric + range mix |
+| 24 | `"11+12/25 a listopad"` | `["2025-11", "2025-12"]` | dedup across passes |
+| 25 | `"prosince/2025"` | `["2025-12"]` | numeric pattern fails (no digits before `/`); standalone fires |
+| 26 | `"listopad-prosinec/2025"` | `["2026-11", "2026-12"]` | range wins; numeric pattern fails |
+| 27 | `"01.2026 / 02.2026"` | `["2026-01", "2026-02"]` | dot pattern only; numeric matches `(2026, 02)` but month 2026 is out of range |
+| 28 | `"/12/2025"` | `["2025-12"]` | numeric matches at second `/` |
+| 29 | `"PROSINEC"` | `["2025-12"]` | normalize lowercases |
+| 30 | `"Žluťoučký prosinec"` | `["2025-12"]` | normalize strips diacritics |
+| 31 | `"Únor - květen"` | `["2026-02", ..., "2026-05"]` | range tolerates spaces around `-`, diacritics survive normalize |
+| 32 | `"platba 11/2025 a leden"` | `["2025-11", "2026-01"]` | mixed natural-language |
+| 33 | `"December"` | `[]` | English month names not recognized |
+| 34 | `"11+12/2025 11+12/2025"` | `["2025-11", "2025-12"]` | dedup of repeated input |
+| 35 | `"leden 2026"` | `["2026-01"]` | trailing year is ignored unless dot/slash separator present |
+
+35 cases is enough to lock semantics; the M3.x corpus will pile on
+real-message fixtures later.
+
+### Wire-up
+
+- No `go.mod` changes (stdlib only).
+- No CLI changes.
+- `Normalize` is in the same package, so call it directly.
+
+## Critical files
+
+- New: [go/internal/domain/czech/parse_month_references.go](../../go/internal/domain/czech/parse_month_references.go)
+- New: [go/internal/domain/czech/parse_month_references_test.go](../../go/internal/domain/czech/parse_month_references_test.go)
+- Reference (read-only): [scripts/czech_utils.py](../../scripts/czech_utils.py) — the porting source
+- Reference (read-only): [docs/plans/2026-05-03-2349-go-backend-rewrite.md](2026-05-03-2349-go-backend-rewrite.md) — risk #4
+- Reuses: [go/internal/domain/czech/normalize.go](../../go/internal/domain/czech/normalize.go) — `Normalize` is called once at the top of `ParseMonthReferences`
+
+## Verification
+
+End-to-end checks before marking M2.2 done:
+
+1. `cd go && go build ./...` — clean compile.
+2. `cd go && go test ./internal/domain/czech/...` — all 35 table cases green.
+3. `cd go && go test -race ./...` — race-clean (regex compiles are global; verify no init races).
+4. `cd go && golangci-lint run` (or `make go-lint` from repo root) — clean, gofumpt-formatted.
+5. **Spot parity** (manual, will be automated in M3.x): each test input has its expected output captured from the live Python implementation on 2026-05-05; the test table itself is the parity record. If any case diverges during implementation, re-run Python with the exact input to confirm the truth and update either the Go code or the test entry.
+6. `make go-build && make go-test && make go-lint` from repo root — proves M1/M2.1 gate still passes.
+
+## Branching & follow-up
+
+Per [CLAUDE.md](../../CLAUDE.md), this is feature work → branch + Gitea MR via `tea`:
+
+- Branch: `feat/m2-2-parse-month-references` off `main`.
+- Single focused commit, Co-Authored-By trailer.
+- Push with `-u`.
+- Open MR with `tea pr create --title "feat(go/M2.2): port czech.ParseMonthReferences" --description ... --base main --head feat/m2-2-parse-month-references`. Print the MR URL for the user.
+- User merges/deletes the branch in Gitea — never from the CLI.
+
+After merge (small doc edits land straight on `main` per CLAUDE.md exception):
+
+- Tick `M2.2` in the [progress tracker](2026-05-03-2349-go-backend-rewrite-progress.md) with the merge SHA.
+- Add a one-line `CHANGELOG.md` entry (timestamp via `date "+%Y-%m-%d %H:%M %Z"`).
+- Record any porting surprise (e.g. an unexpected diff between Go RE2 and Python `re`) in the tracker's "Notes & decisions" section.
+
+Next task is **M2.3 `domain/fees.CalculateFee`** — straightforward constants table; no parser semantics to debate.

docs/plans/2026-05-06-0928-go-m2-5-money-parse-czk.md

@@ -0,0 +1,199 @@
+# M2.5 — Port `parse_czk_amount` to `domain/money.ParseCZK`
+
+> On execution, this plan should be moved to
+> `docs/plans/2026-05-06-0928-go-m2-5-money-parse-czk.md` per project CLAUDE.md
+> (`docs/plans/YYYY-MM-DD-HHMM-<slug>.md`). Plan mode forces it to live under
+> `~/.claude/plans/` until then.
+
+## Context
+
+Continuing the Go backend rewrite tracked in
+[2026-05-03-2349-go-backend-rewrite-progress.md](../../srv/personal/fuj-management/docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md).
+M2.1–M2.4 are landed. Next leaf-level pure function is
+`parse_czk_amount` from [scripts/infer_payments.py:17-45](../../srv/personal/fuj-management/scripts/infer_payments.py#L17-L45),
+the Czech-locale amount parser used at [scripts/infer_payments.py:124](../../srv/personal/fuj-management/scripts/infer_payments.py#L124)
+when reading the `Inferred Amount` column out of the payments sheet.
+
+It's a small, isolated string→float helper, but its heuristic for
+disambiguating `.` and `,` as decimal vs thousand separator is
+non-obvious and needs to behave identically in Go to keep parity once
+the Go infer pipeline lands in M4.8.
+
+## Python behaviour (the spec)
+
+```py
+def parse_czk_amount(val) -> float:
+    if val is None or val == "":
+        return 0.0
+    if isinstance(val, (int, float)):
+        return float(val)
+
+    val = str(val)
+    val = val.replace("Kč", "").replace("CZK", "").strip()
+    if "," in val:
+        # 1.500,00 -> 1500.00 — comma is decimal sep
+        val = val.replace(".", "").replace(" ", "").replace(",", ".")
+    else:
+        if val.count(".") > 1:
+            # 1.500.000 -> 1500000 — multiple dots = thousand sep
+            val = val.replace(".", "").replace(" ", "")
+        else:
+            # "1 500.00" -> "1500.00", "1.500" stays "1.500" (= 1.5)
+            val = val.replace(" ", "")
+    try:
+        return float(val)
+    except ValueError:
+        return 0.0
+```
+
+Key behavioural notes for the Go port:
+
+1. Empty / None → 0, no error.
+2. `"1.500"` (single dot, no comma) is parsed as **1.5**, not 1500.
+   The heuristic intentionally treats a lone dot as decimal.
+3. `"1.500,00"` → 1500.0 (comma wins, dots are thousand seps).
+4. `"1.500.000"` → 1500000.0 (multiple dots → all thousand seps).
+5. `"1 500"` / `"1 500.00"` / `"500 Kč"` → spaces stripped.
+6. Garbage → 0, no error in Python.
+7. Strips literal substrings `"Kč"` and `"CZK"` (case-sensitive in Python).
+
+## Approach
+
+Create new package `internal/domain/money` mirroring the layout of
+`internal/domain/fees` (single-file module + test file alongside).
+
+### Signature
+
+```go
+// Package money ports Czech-locale currency parsing from
+// scripts/infer_payments.py.
+package money
+
+// ParseCZK parses a Czech-locale amount string and returns the value
+// in CZK as a float64.
+//
+// Mirrors scripts/infer_payments.py parse_czk_amount:
+//   - empty input → (0, nil)
+//   - "Kč"/"CZK" suffixes are stripped (case-sensitive, like Python)
+//   - if input contains ",", comma is the decimal separator and
+//     dots/spaces are thousand separators ("1.500,00" → 1500.0)
+//   - else if input contains 2+ dots, all dots are thousand seps
+//     ("1.500.000" → 1500000.0)
+//   - else single dot stays as the decimal point ("1.500" → 1.5,
+//     matching the Python heuristic)
+//   - on parse failure, returns (0, ErrInvalidAmount). Callers wanting
+//     Python-equivalent silent-zero behaviour can discard the error.
+func ParseCZK(s string) (float64, error)
+```
+
+`ErrInvalidAmount` is a package-level sentinel:
+
+```go
+var ErrInvalidAmount = errors.New("money: invalid CZK amount")
+```
+
+Why `(float64, error)` instead of mirroring Python's silent zero:
+
+- Go idiom prefers explicit errors.
+- The single Python call site doesn't distinguish parse-fail from
+  empty-input (both → 0), so if we want byte-equal behaviour at the
+  Go infer site (M4.8), the caller can `v, _ := money.ParseCZK(s)`
+  and get exactly the Python result.
+- Future callers (e.g. user-facing import flows) may want to surface
+  the error.
+
+This matches the precedent set in M2.4 where we used
+`Expected{Unknown bool}` rather than copying the Python `"?"` sentinel
+verbatim — Go-idiomatic surface, parity-preserving semantics.
+
+### Polymorphic input?
+
+Python's `parse_czk_amount` also accepts raw int/float (passed through
+unchanged) because Google Sheets API can return numeric cells as
+`float64` rather than strings. **Skip this in Go.** The Sheets IO
+adapter is M4.2, and that's where the `[]any` → string normalisation
+will live. Keeping `ParseCZK` string-only keeps the leaf function tiny.
+
+### Tests
+
+`money_test.go` mirrors the existing `fees_test.go` table-driven style,
+including the verification comment showing the Python command used to
+confirm each expected value:
+
+```sh
+PYTHONPATH=scripts:. python -c '
+from infer_payments import parse_czk_amount
+for v in [None, "", "0", "500", "500 Kč", "500 CZK",
+          "1 500", "1500.00", "1 500.00",
+          "1.500,00", "1500,5", "1.500.000",
+          "1.500", "abc", "  ", "100,5 Kč"]:
+    print(repr(v), "->", parse_czk_amount(v))
+'
+```
+
+Cases to cover (all numeric outputs verified against the Python output
+of the snippet above):
+
+| input | expected |
+|---|---|
+| `""` | 0 |
+| `"0"` | 0 |
+| `"500"` | 500 |
+| `"500 Kč"` | 500 |
+| `"500 CZK"` | 500 |
+| `"1 500"` | 1500 |
+| `"1500.00"` | 1500 |
+| `"1 500.00"` | 1500 |
+| `"1.500,00"` | 1500 |
+| `"1500,5"` | 1500.5 |
+| `"1.500.000"` | 1500000 |
+| `"1.500"` | 1.5 *(heuristic — single dot = decimal)* |
+| `"100,5 Kč"` | 100.5 |
+| `"abc"` | 0, returns `ErrInvalidAmount` |
+| `"  "` | 0, returns `ErrInvalidAmount` *(or 0 nil — confirm against Python; trim leaves `""`, then `float("")` raises → Python returns 0; Go test will assert whichever Python actually produces)* |
+
+The `"  "` row is the only one that needs the Python verification step
+to settle — once verified, lock the behaviour in.
+
+Also add a "documentation example" assertion in the test that
+`v, _ := ParseCZK(s)` recovers the Python silent-zero contract for
+every garbage input, so we don't lose that property at the Go infer
+call site.
+
+## Files to create
+
+- `go/internal/domain/money/money.go` — package + `ParseCZK` + `ErrInvalidAmount`
+- `go/internal/domain/money/money_test.go` — table-driven tests
+
+No existing Go files need editing.
+
+## Verification
+
+```sh
+cd go && go test ./internal/domain/money/...
+make go-lint
+make go-build   # sanity: nothing else broke
+```
+
+Also run the Python snippet from the Tests section above and diff its
+output against the test table to confirm parity.
+
+## Out of scope (explicit non-goals)
+
+- Polymorphic `any` input — leave for M4.2 IO adapter.
+- Hooking into the Tier-1 parity runner — that comes with M3.5
+  (`-tags=parity` build constraint). M2.5 just needs unit tests.
+- Any callsite migration — `infer_payments.py` keeps using its own
+  Python function until M4.8.
+
+## Progress tracker + changelog
+
+After the commit lands:
+
+- Tick `M2.5` in [docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md](../../srv/personal/fuj-management/docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md)
+  with the commit SHA, mirroring the M2.4 entry style.
+- Add a CHANGELOG.md entry at top:
+  `## YYYY-MM-DD HH:MM TZ — feat(go/M2.5): port domain/money.ParseCZK`.
+
+Branch: `feat/m2-5-money-parse-czk` (per CLAUDE.md branch-per-feature
+workflow). Push, open MR via `tea pr create`, leave merge to the user.

docs/plans/2026-05-06-1236-go-m2-6-synch-generate-sync-id.md

@@ -0,0 +1,265 @@
+
+## Context
+
+Continuing the Go backend rewrite tracked in
+[2026-05-03-2349-go-backend-rewrite-progress.md](../../srv/personal/fuj-management/docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md).
+M2.1–M2.5 are landed. Next leaf-level pure function is `generate_sync_id`
+from [scripts/sync_fio_to_sheets.py:62-77](../../srv/personal/fuj-management/scripts/sync_fio_to_sheets.py#L62-L77).
+
+It computes a SHA-256 hash over a fixed seven-field projection of a Fio
+transaction (`date|amount|currency|sender|vs|message|bank_id`) and is
+the deduplication key written into column K (`Sync ID`) of the payments
+sheet. The Go port must produce a **byte-identical** digest for the same
+transaction; otherwise the Go-side sync (M4.7) would re-append rows
+already written by the Python sync, double-counting payments.
+
+The non-trivial part is the `amount` field's string serialisation:
+upstream `fio_utils.py` always supplies `amount` as a Python `float`
+(API path: `float(val(1) or 0)`; HTML path: `parse_czech_amount(...)`
+which returns `float`). Python's `str(float)` produces `"500.0"` for
+whole-valued floats; Go's `strconv.FormatFloat(f, 'g', -1, 64)` produces
+`"500"`. This is the gotcha called out in the M2.6 line of the progress
+tracker.
+
+## Python behaviour (the spec)
+
+```py
+def generate_sync_id(tx: dict) -> str:
+    components = [
+        str(tx.get("date", "")),
+        str(tx.get("amount", "")),
+        str(tx.get("currency", "CZK")),
+        str(tx.get("sender", "")),
+        str(tx.get("vs", "")),
+        str(tx.get("message", "")),
+        str(tx.get("bank_id", "")),
+    ]
+    raw_str = "|".join(components).lower()
+    return hashlib.sha256(raw_str.encode("utf-8")).hexdigest()
+```
+
+Behavioural notes for the Go port:
+
+1. **Field order is load-bearing.** `date|amount|currency|sender|vs|message|bank_id` exactly.
+2. **Separator is `"|"`.**
+3. **Whole string is `.lower()`-ed before hashing** (so e.g. "ABC" sender vs "abc" hash identically). Unicode lower; in practice Fio data is ASCII + Czech diacritics.
+4. **`currency` defaults to `"CZK"`** when missing from the dict (HTML scraper path never sets it). Other fields default to `""`.
+5. **`amount` is a `float`.** Always. Real Fio data is `500.0`, `1234.56`, etc. — no NaN/Inf, but parity test must pin the format.
+6. **Output is `hashlib.sha256(...).hexdigest()`** — 64-char lowercase hex.
+7. **Encoding is UTF-8.**
+
+### `str(float)` cases observed in real Fio amounts
+
+| float64 | Python `str(f)` | Go `strconv.FormatFloat(f,'g',-1,64)` | Need |
+|---|---|---|---|
+| `500.0` | `"500.0"` | `"500"` | append `.0` |
+| `1234.56` | `"1234.56"` | `"1234.56"` | matches |
+| `0.0` | `"0.0"` | `"0"` | append `.0` |
+| `-500.0` | `"-500.0"` | `"-500"` | append `.0` |
+| `0.1` | `"0.1"` | `"0.1"` | matches |
+| `99999.99` | `"99999.99"` | `"99999.99"` | matches |
+
+For the Fio amount domain (signed CZK, ≤ ~7 digits, ≤2 decimal places),
+the rule "`'g'` with prec -1, then append `.0` if result has no `.` and
+no `e`/`E`" is exact. We do not need to handle Python's
+scientific-notation crossover (`>= 1e16`) for real data, but the
+implementation should still cope with it correctly via the same rule.
+
+## Approach
+
+Create new package `internal/domain/synch` mirroring the layout of
+`internal/domain/money` (single-file module + test file alongside).
+
+### Package + signature
+
+```go
+// Package synch ports the bank-sync deduplication helper from
+// scripts/sync_fio_to_sheets.py.
+package synch
+
+// Transaction is the projection of a Fio transaction that participates
+// in the Sync ID hash. Other fields (ks, ss, sender_account, …) are
+// intentionally excluded — they are not part of the Python hash.
+//
+// Currency: leave "" to inherit the Python default of "CZK" (matches
+// the HTML scraper path which omits the key entirely).
+type Transaction struct {
+    Date     string
+    Amount   float64
+    Currency string
+    Sender   string
+    VS       string
+    Message  string
+    BankID   string
+}
+
+// GenerateSyncID returns the lowercase SHA-256 hex digest of
+// "date|amount|currency|sender|vs|message|bank_id" (lower-cased), used
+// as the dedup key in column K of the payments sheet.
+//
+// Byte-stable with scripts/sync_fio_to_sheets.py generate_sync_id.
+func GenerateSyncID(tx Transaction) string
+```
+
+### `Currency` default
+
+In Go every struct field is always present, so we lose Python's
+"missing key vs empty string" distinction. Real-world data either sets
+`currency = "CZK"` (API path) or omits the key (HTML path → `"CZK"`
+default). Empty string never occurs in practice. The Go port collapses
+the two by treating `Currency == ""` as "use `CZK`":
+
+```go
+currency := tx.Currency
+if currency == "" {
+    currency = "CZK"
+}
+```
+
+This is byte-equal to Python for every input we will ever see in
+production, and avoids forcing callers to pass a `*string`.
+
+### Float formatter
+
+Internal helper, unexported:
+
+```go
+// formatAmount mimics Python's str(float) for the float values that
+// appear in Fio transactions. For mundane decimal amounts the rule
+// is: format with 'g' precision -1, then append ".0" if the result
+// has no decimal point and no exponent.
+func formatAmount(f float64) string {
+    s := strconv.FormatFloat(f, 'g', -1, 64)
+    if !strings.ContainsAny(s, ".eE") {
+        s += ".0"
+    }
+    return s
+}
+```
+
+Tested explicitly (see Tests below) so the edge cases (`0`, whole
+numbers, negatives, large/small with exponent) stay locked.
+
+### Hash composition
+
+```go
+func GenerateSyncID(tx Transaction) string {
+    currency := tx.Currency
+    if currency == "" {
+        currency = "CZK"
+    }
+    raw := strings.ToLower(strings.Join([]string{
+        tx.Date,
+        formatAmount(tx.Amount),
+        currency,
+        tx.Sender,
+        tx.VS,
+        tx.Message,
+        tx.BankID,
+    }, "|"))
+    sum := sha256.Sum256([]byte(raw))
+    return hex.EncodeToString(sum[:])
+}
+```
+
+(`crypto/sha256` + `encoding/hex` — both stdlib, no `go.mod` change.)
+
+## Tests
+
+`synch_test.go` mirrors `money_test.go`'s table-driven style with the
+verification snippet at the top of the function. Two test functions:
+
+### 1. `TestGenerateSyncID`
+
+Each row's expected digest is computed from the Python source:
+
+```sh
+PYTHONPATH=scripts:. python -c '
+from sync_fio_to_sheets import generate_sync_id
+cases = [
+    {"date":"2026-01-15","amount":500.0,"currency":"CZK","sender":"Jan Novak","vs":"123","message":"clenske 1/2026","bank_id":"abc123"},
+    {"date":"2026-01-15","amount":500.0,"sender":"Jan Novak","vs":"123","message":"clenske 1/2026","bank_id":"abc123"},  # currency missing → CZK
+    {"date":"2026-02-10","amount":1234.56,"currency":"CZK","sender":"ABC SRO","vs":"","message":"FAKTURA 42","bank_id":"xyz"},  # mixed case → lowercased
+    {"date":"2026-03-01","amount":-500.0,"currency":"CZK","sender":"refund","vs":"","message":"","bank_id":""},  # negative
+    {"date":"2026-04-01","amount":0.0,"currency":"CZK","sender":"","vs":"","message":"","bank_id":""},  # zero amount
+    {},  # empty dict — every field falls back to default
+]
+for c in cases:
+    print(repr(c), "->", generate_sync_id(c))
+'
+```
+
+Cases (one row per dict above), each asserting the exact 64-char hex
+digest the snippet prints. Cover:
+
+- Happy path with all fields set.
+- `Currency: ""` → `"CZK"` default (parity with missing key).
+- Mixed-case sender/message → lowercased before hashing.
+- Negative amount.
+- Zero amount.
+- Zero-value `Transaction{}` — every field at Go zero, currency defaults
+  to `"CZK"`, hash matches Python `generate_sync_id({})`.
+
+### 2. `TestFormatAmount`
+
+Pin the float formatter against Python's `str(float)`:
+
+```sh
+PYTHONPATH=scripts:. python -c '
+for v in [0.0, 500.0, -500.0, 0.1, 1234.56, 99999.99, 1500000.0, 1e16, 1e-5]:
+    print(repr(v), "->", repr(str(v)))
+'
+```
+
+Table of `(float64, expected string)` pairs. Whole numbers must end in
+`.0`; existing decimal representations pass through unchanged;
+exponent-form floats (`1e16`, `1e-5`) keep their format.
+
+## Files to create
+
+- `go/internal/domain/synch/synch.go` — package, `Transaction`,
+  `GenerateSyncID`, internal `formatAmount`.
+- `go/internal/domain/synch/synch_test.go` — `TestGenerateSyncID` +
+  `TestFormatAmount`.
+
+No existing Go files need editing.
+
+## Verification
+
+```sh
+cd go && go test ./internal/domain/synch/...
+make go-lint
+make go-build   # sanity: nothing else broke
+```
+
+Plus run the two Python snippets in the Tests section and diff their
+output against the test tables to confirm parity.
+
+## Out of scope (explicit non-goals)
+
+- **Hooking into the Tier-1 parity runner.** That comes with M3.5
+  (`-tags=parity` build constraint and `tests/fixtures/pure/`). M2.6
+  ships with hand-written, Python-verified test tables — same approach
+  used by M2.1–M2.5.
+- **A richer `Transaction` struct** covering ks/ss/note/sender_account.
+  Those fields aren't part of the hash. M4.4 (Fio IO adapter) will
+  decide whether to reuse `synch.Transaction` or define its own struct
+  and convert at the boundary.
+- **Polymorphic input** (e.g. accepting a `map[string]any`). Python's
+  duck-typing is a non-goal in Go.
+- **Any Python callsite migration.** `sync_fio_to_sheets.py` keeps using
+  its own `generate_sync_id` until M4.7 ports the sync service.
+
+## Progress tracker + changelog
+
+After the commit lands:
+
+- Tick `M2.6` in
+  [docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md](../../srv/personal/fuj-management/docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md)
+  with the commit SHA, mirroring the M2.5 entry style.
+- Add a `CHANGELOG.md` entry at top:
+  `## YYYY-MM-DD HH:MM TZ — feat(go/M2.6): port domain/synch.GenerateSyncID`.
+
+Branch: `feat/m2-6-synch-generate-sync-id` (per CLAUDE.md
+branch-per-feature workflow). Push, open MR via `tea pr create`, leave
+merge to the user.

go/.golangci.yml

@@ -0,0 +1,11 @@
+linters:
+  enable:
+    - govet
+    - staticcheck
+    - errcheck
+    - gofumpt
+    - unused
+
+linters-settings:
+  gofumpt:
+    extra-rules: true

go/build/Dockerfile

@@ -0,0 +1,30 @@
+FROM golang:1.26 AS build
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+
+ARG GIT_TAG=unknown
+ARG GIT_COMMIT=unknown
+ARG BUILD_DATE=unknown
+
+RUN CGO_ENABLED=0 go build -trimpath \
+      -ldflags "-s -w \
+                -X main.version=${GIT_TAG} \
+                -X main.commit=${GIT_COMMIT} \
+                -X main.buildDate=${BUILD_DATE}" \
+      -o /out/fuj ./cmd/fuj
+
+FROM alpine:3
+
+RUN addgroup -S fuj && adduser -S fuj -G fuj
+
+COPY --from=build /out/fuj /usr/local/bin/fuj
+
+EXPOSE 8080
+USER fuj
+
+ENTRYPOINT ["/usr/local/bin/fuj", "server"]

go/cmd/fuj/main.go

@@ -0,0 +1,84 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"fuj-management/go/internal/config"
+	"fuj-management/go/internal/logging"
+	"fuj-management/go/internal/web"
+	"os"
+)
+
+// Injected at build time via -ldflags "-X main.version=... -X main.commit=... -X main.buildDate=..."
+var (
+	version   = "dev"
+	commit    = "unknown"
+	buildDate = "unknown"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(2)
+	}
+
+	cmd, args := os.Args[1], os.Args[2:]
+
+	switch cmd {
+	case "server":
+		serverCmd(args)
+	case "version":
+		versionCmd()
+	case "fees", "reconcile", "sync", "infer":
+		fmt.Fprintf(os.Stderr, "fuj %s: not implemented yet (lands in M2/M4)\n", cmd)
+		os.Exit(2)
+	case "-h", "--help", "help":
+		usage()
+	default:
+		fmt.Fprintf(os.Stderr, "fuj: unknown command %q\n\n", cmd)
+		usage()
+		os.Exit(2)
+	}
+}
+
+func serverCmd(args []string) {
+	fs := flag.NewFlagSet("server", flag.ExitOnError)
+	addr := fs.String("addr", "", "listen address (default from SERVER_ADDR env or :8080)")
+	fs.Usage = func() {
+		fmt.Fprintln(os.Stderr, "usage: fuj server [--addr :8080]")
+		fs.PrintDefaults()
+	}
+	if err := fs.Parse(args); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(2)
+	}
+
+	cfg := config.Load()
+	if *addr != "" {
+		cfg.ServerAddr = *addr
+	}
+
+	logger := logging.New(cfg.LogLevel)
+	build := web.BuildInfo{Version: version, Commit: commit, BuildDate: buildDate}
+
+	if err := web.Run(logger, cfg.ServerAddr, build); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func versionCmd() {
+	fmt.Printf("fuj %s (%s) built %s\n", version, commit, buildDate)
+}
+
+func usage() {
+	fmt.Fprintln(os.Stderr, `usage: fuj <command> [flags]
+
+Commands:
+  server      Start HTTP server (default :8080)
+  version     Print version information
+  fees        Calculate monthly fees  [M2]
+  reconcile   Show balance report     [M2]
+  sync        Sync Fio transactions   [M4]
+  infer       Infer payment details   [M4]`)
+}

go/go.mod

@@ -0,0 +1,5 @@
+module fuj-management/go
+
+go 1.26.1
+
+require golang.org/x/text v0.36.0

go/go.sum

@@ -0,0 +1,2 @@
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=

go/internal/config/config.go

@@ -0,0 +1,56 @@
+package config
+
+import (
+	"os"
+	"strconv"
+	"time"
+)
+
+// Google Sheets IDs — change in code if sheets change (not from env).
+const (
+	AttendanceSheetID = "1E2e_gT_K5AwSRCDLDTa2UetZTkHmBOcz0kFbBUNUNBA"
+	PaymentsSheetID   = "1Om0YPoDVCH5cV8BrNz5LG5eR5MMU05ypQC7UMN1xn_Y"
+	JuniorSheetGID    = "1213318614"
+)
+
+// Config holds all runtime configuration loaded from environment variables.
+// Mirrors scripts/config.py.
+type Config struct {
+	CredentialsPath  string
+	BankAccount      string
+	CacheTTL         time.Duration
+	CacheAPICheckTTL time.Duration
+	LogLevel         string
+	FioAPIToken      string
+	ServerAddr       string
+}
+
+// Load reads configuration from the environment, applying defaults that
+// match the Python side.
+func Load() Config {
+	return Config{
+		CredentialsPath:  env("CREDENTIALS_PATH", ".secret/fuj-management-bot-credentials.json"),
+		BankAccount:      env("BANK_ACCOUNT", "CZ8520100000002800359168"),
+		CacheTTL:         envDuration("CACHE_TTL_SECONDS", 300),
+		CacheAPICheckTTL: envDuration("CACHE_API_CHECK_TTL_SECONDS", 300),
+		LogLevel:         env("LOG_LEVEL", "INFO"),
+		FioAPIToken:      env("FIO_API_TOKEN", ""),
+		ServerAddr:       env("SERVER_ADDR", ":8080"),
+	}
+}
+
+func env(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}
+
+func envDuration(key string, defaultSeconds int) time.Duration {
+	if v := os.Getenv(key); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			return time.Duration(n) * time.Second
+		}
+	}
+	return time.Duration(defaultSeconds) * time.Second
+}

go/internal/domain/czech/normalize.go

@@ -0,0 +1,26 @@
+package czech
+
+import (
+	"strings"
+	"unicode"
+
+	"golang.org/x/text/unicode/norm"
+)
+
+// Normalize strips diacritics and lowercases s.
+//
+// Matches Python: unicodedata.normalize("NFKD", s) then filter out
+// combining characters (unicode.Mn only — not Mc/Me, which have
+// combining class 0 in Python's unicodedata.combining()).
+func Normalize(s string) string {
+	decomposed := norm.NFKD.String(s)
+	var b strings.Builder
+	b.Grow(len(decomposed))
+	for _, r := range decomposed {
+		if unicode.In(r, unicode.Mn) {
+			continue
+		}
+		b.WriteRune(r)
+	}
+	return strings.ToLower(b.String())
+}

go/internal/domain/czech/normalize_test.go

@@ -0,0 +1,31 @@
+package czech
+
+import "testing"
+
+func TestNormalize(t *testing.T) {
+	cases := []struct {
+		in   string
+		want string
+	}{
+		{"Honza", "honza"},
+		{"žluťoučký", "zlutoucky"},
+		{"Příliš", "prilis"},
+		{"Dvořák", "dvorak"},
+		{"Růžena", "ruzena"},
+		{"Čeněk", "cenek"},
+		{"Kačer", "kacer"},
+		{"", ""},
+		{"prilis", "prilis"},                     // idempotent
+		{"Jan Novák", "jan novak"},               // whitespace preserved
+		{"é", "e"},                               // precomposed é (NFC)
+		{"é", "e"},                              // decomposed e + combining acute
+		{"Ondřej Procházka", "ondrej prochazka"}, // realistic full name
+	}
+
+	for _, tc := range cases {
+		got := Normalize(tc.in)
+		if got != tc.want {
+			t.Errorf("Normalize(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}

go/internal/domain/czech/parse_month_references.go

@@ -0,0 +1,154 @@
+package czech
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+var czechMonths = map[string]int{
+	"leden": 1, "ledna": 1, "lednu": 1,
+	"unor": 2, "unora": 2, "unoru": 2,
+	"brezen": 3, "brezna": 3, "breznu": 3,
+	"duben": 4, "dubna": 4, "dubnu": 4,
+	"kveten": 5, "kvetna": 5, "kvetnu": 5,
+	"cerven": 6, "cervna": 6, "cervnu": 6,
+	"cervenec": 7, "cervnce": 7, "cervenci": 7,
+	"srpen": 8, "srpna": 8, "srpnu": 8,
+	"zari":  9,
+	"rijen": 10, "rijna": 10, "rijnu": 10,
+	"listopad": 11, "listopadu": 11,
+	"prosinec": 12, "prosince": 12, "prosinci": 12,
+}
+
+var (
+	numericRe *regexp.Regexp
+	dotRe     *regexp.Regexp
+	rangeRe   *regexp.Regexp
+	standRe   *regexp.Regexp
+)
+
+func init() {
+	// Sort by descending length so longer alternatives win in RE2 leftmost-first
+	// matching (e.g. "cervenec" is tried before "cerven").
+	names := make([]string, 0, len(czechMonths))
+	for name := range czechMonths {
+		names = append(names, name)
+	}
+	sort.Slice(names, func(i, j int) bool {
+		if len(names[i]) != len(names[j]) {
+			return len(names[i]) > len(names[j])
+		}
+		return names[i] < names[j]
+	})
+	alt := strings.Join(names, "|")
+
+	numericRe = regexp.MustCompile(`([\d+]+)\s*/\s*(\d{2,4})`)
+	dotRe = regexp.MustCompile(`(\d{1,2})\s*\.\s*(\d{4})`)
+	rangeRe = regexp.MustCompile(`(` + alt + `)\s*-\s*(` + alt + `)`)
+	standRe = regexp.MustCompile(`\b(` + alt + `)\b`)
+}
+
+// ParseMonthReferences extracts YYYY-MM month references from Czech free text.
+//
+// defaultYear seeds two heuristics: standalone month names with m >= 10 are
+// treated as defaultYear-1 (out-of-year backfill), and wrap-around ranges
+// (e.g. listopad-leden) place months >= start_m in defaultYear-1.
+//
+// Returns a sorted, deduplicated slice of "YYYY-MM" strings.
+func ParseMonthReferences(text string, defaultYear int) []string {
+	normalized := Normalize(text)
+	seen := map[string]struct{}{}
+
+	add := func(year, m int) {
+		if m >= 1 && m <= 12 {
+			seen[fmt.Sprintf("%04d-%02d", year, m)] = struct{}{}
+		}
+	}
+
+	// Pass 1: numeric months — "11+12/2025", "01/26", "1/2026"
+	for _, groups := range numericRe.FindAllStringSubmatch(normalized, -1) {
+		monthsPart, yearStr := groups[1], groups[2]
+		year, err := strconv.Atoi(yearStr)
+		if err != nil {
+			continue
+		}
+		if year < 100 {
+			year += 2000
+		}
+		for mStr := range strings.SplitSeq(monthsPart, "+") {
+			mStr = strings.TrimSpace(mStr)
+			if mStr == "" {
+				continue
+			}
+			allDigits := true
+			for _, c := range mStr {
+				if c < '0' || c > '9' {
+					allDigits = false
+					break
+				}
+			}
+			if !allDigits {
+				continue
+			}
+			m, err := strconv.Atoi(mStr)
+			if err != nil {
+				continue
+			}
+			add(year, m)
+		}
+	}
+
+	// Pass 2: dot-separated month.year — "12.2025" (4-digit year only)
+	for _, groups := range dotRe.FindAllStringSubmatch(normalized, -1) {
+		m, _ := strconv.Atoi(groups[1])
+		year, _ := strconv.Atoi(groups[2])
+		add(year, m)
+	}
+
+	// Pass 3a: Czech month name ranges — "listopad-leden"
+	foundInRanges := map[string]struct{}{}
+	for _, groups := range rangeRe.FindAllStringSubmatch(normalized, -1) {
+		startName, endName := groups[1], groups[2]
+		foundInRanges[startName] = struct{}{}
+		foundInRanges[endName] = struct{}{}
+		startM := czechMonths[startName]
+		endM := czechMonths[endName]
+		wraps := startM > endM
+		m := startM
+		for range 12 {
+			year := defaultYear
+			if wraps && m >= startM {
+				year = defaultYear - 1
+			}
+			add(year, m)
+			if m == endM {
+				break
+			}
+			m = m%12 + 1
+		}
+	}
+
+	// Pass 3b: standalone Czech month names (not part of a range)
+	for _, groups := range standRe.FindAllStringSubmatch(normalized, -1) {
+		name := groups[1]
+		if _, inRange := foundInRanges[name]; inRange {
+			continue
+		}
+		m := czechMonths[name]
+		year := defaultYear
+		if m >= 10 {
+			year = defaultYear - 1
+		}
+		add(year, m)
+	}
+
+	result := make([]string, 0, len(seen))
+	for k := range seen {
+		result = append(result, k)
+	}
+	sort.Strings(result)
+	return result
+}

go/internal/domain/czech/parse_month_references_test.go

@@ -0,0 +1,244 @@
+package czech
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestParseMonthReferences(t *testing.T) {
+	t.Parallel()
+
+	// All expected outputs verified against live Python implementation on 2026-05-05:
+	//   PYTHONPATH=scripts:. python -c 'from czech_utils import parse_month_references; print(parse_month_references("<input>", 2026))'
+	tests := []struct {
+		name        string
+		input       string
+		defaultYear int
+		want        []string
+	}{
+		{
+			name:        "empty",
+			input:       "",
+			defaultYear: 2026,
+			want:        []string{},
+		},
+		{
+			name:        "numeric plus-split two months full year",
+			input:       "11+12/2025",
+			defaultYear: 2026,
+			want:        []string{"2025-11", "2025-12"},
+		},
+		{
+			name:        "numeric single month full year",
+			input:       "1/2026",
+			defaultYear: 2026,
+			want:        []string{"2026-01"},
+		},
+		{
+			name:        "numeric 2-digit year",
+			input:       "01/26",
+			defaultYear: 2026,
+			want:        []string{"2026-01"},
+		},
+		{
+			name:        "numeric plus-split with 2-digit year",
+			input:       "11+12/25",
+			defaultYear: 2026,
+			want:        []string{"2025-11", "2025-12"},
+		},
+		{
+			name:        "numeric three months sorted",
+			input:       "12+1+2/2026",
+			defaultYear: 2026,
+			want:        []string{"2026-01", "2026-02", "2026-12"},
+		},
+		{
+			name:        "dot pattern",
+			input:       "12.2025",
+			defaultYear: 2026,
+			want:        []string{"2025-12"},
+		},
+		{
+			name:        "dot pattern requires 4-digit year",
+			input:       "1.26",
+			defaultYear: 2026,
+			want:        []string{},
+		},
+		{
+			name:        "standalone month below m10 threshold",
+			input:       "leden",
+			defaultYear: 2026,
+			want:        []string{"2026-01"},
+		},
+		{
+			name:        "standalone month m10 heuristic",
+			input:       "prosinec",
+			defaultYear: 2026,
+			want:        []string{"2025-12"},
+		},
+		{
+			name:        "declension prosince",
+			input:       "prosince",
+			defaultYear: 2026,
+			want:        []string{"2025-12"},
+		},
+		{
+			name:        "declension lednu",
+			input:       "lednu",
+			defaultYear: 2026,
+			want:        []string{"2026-01"},
+		},
+		{
+			name:        "standalone m10 boundary (rijen = October)",
+			input:       "rijen",
+			defaultYear: 2026,
+			want:        []string{"2025-10"},
+		},
+		{
+			name:        "standalone m9 just below boundary (zari = September)",
+			input:       "zari",
+			defaultYear: 2026,
+			want:        []string{"2026-09"},
+		},
+		{
+			name:        "range wrap Nov-Jan",
+			input:       "listopad-leden",
+			defaultYear: 2026,
+			want:        []string{"2025-11", "2025-12", "2026-01"},
+		},
+		{
+			name:        "range wrap starting at October",
+			input:       "rijen-leden",
+			defaultYear: 2026,
+			want:        []string{"2025-10", "2025-11", "2025-12", "2026-01"},
+		},
+		{
+			name:        "range no wrap",
+			input:       "unor-kveten",
+			defaultYear: 2026,
+			want:        []string{"2026-02", "2026-03", "2026-04", "2026-05"},
+		},
+		{
+			name:        "degenerate range same month",
+			input:       "leden-leden",
+			defaultYear: 2026,
+			want:        []string{"2026-01"},
+		},
+		{
+			name:        "range spanning m10 — heuristic does NOT fire for range members",
+			input:       "unor-listopad",
+			defaultYear: 2026,
+			want:        []string{"2026-02", "2026-03", "2026-04", "2026-05", "2026-06", "2026-07", "2026-08", "2026-09", "2026-10", "2026-11"},
+		},
+		{
+			name:        "longest-match alternation cervenec beats cerven",
+			input:       "cervenec-srpen",
+			defaultYear: 2026,
+			want:        []string{"2026-07", "2026-08"},
+		},
+		{
+			name:        "range plus standalone — range excludes, dedup",
+			input:       "listopad-leden, prosinec",
+			defaultYear: 2026,
+			want:        []string{"2025-11", "2025-12", "2026-01"},
+		},
+		{
+			name:        "two standalones no range",
+			input:       "prosinec leden",
+			defaultYear: 2026,
+			want:        []string{"2025-12", "2026-01"},
+		},
+		{
+			name:        "numeric plus range mix",
+			input:       "11+12/2025, leden-brezen",
+			defaultYear: 2026,
+			want:        []string{"2025-11", "2025-12", "2026-01", "2026-02", "2026-03"},
+		},
+		{
+			name:        "dedup across numeric and standalone passes",
+			input:       "11+12/25 a listopad",
+			defaultYear: 2026,
+			want:        []string{"2025-11", "2025-12"},
+		},
+		{
+			name:        "no digits before slash — standalone fires instead",
+			input:       "prosince/2025",
+			defaultYear: 2026,
+			want:        []string{"2025-12"},
+		},
+		{
+			name:        "range with trailing slash-year — numeric fails, range wins",
+			input:       "listopad-prosinec/2025",
+			defaultYear: 2026,
+			want:        []string{"2026-11", "2026-12"},
+		},
+		{
+			name:        "dot pattern only — numeric matches but month out of 1-12 range",
+			input:       "01.2026 / 02.2026",
+			defaultYear: 2026,
+			want:        []string{"2026-01", "2026-02"},
+		},
+		{
+			name:        "leading slash — numeric matches at second slash",
+			input:       "/12/2025",
+			defaultYear: 2026,
+			want:        []string{"2025-12"},
+		},
+		{
+			name:        "uppercase input normalized",
+			input:       "PROSINEC",
+			defaultYear: 2026,
+			want:        []string{"2025-12"},
+		},
+		{
+			name:        "diacritics stripped by Normalize",
+			input:       "Žluťoučký prosinec",
+			defaultYear: 2026,
+			want:        []string{"2025-12"},
+		},
+		{
+			name:        "diacritics in range with spaces around dash",
+			input:       "Únor - květen",
+			defaultYear: 2026,
+			want:        []string{"2026-02", "2026-03", "2026-04", "2026-05"},
+		},
+		{
+			name:        "natural language mixed with numeric and standalone",
+			input:       "platba 11/2025 a leden",
+			defaultYear: 2026,
+			want:        []string{"2025-11", "2026-01"},
+		},
+		{
+			name:        "English month name not recognized",
+			input:       "December",
+			defaultYear: 2026,
+			want:        []string{},
+		},
+		{
+			name:        "duplicate input deduped",
+			input:       "11+12/2025 11+12/2025",
+			defaultYear: 2026,
+			want:        []string{"2025-11", "2025-12"},
+		},
+		{
+			name:        "trailing year without separator ignored",
+			input:       "leden 2026",
+			defaultYear: 2026,
+			want:        []string{"2026-01"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := ParseMonthReferences(tc.input, tc.defaultYear)
+			if got == nil {
+				got = []string{}
+			}
+			if !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("ParseMonthReferences(%q, %d)\n  got  %v\n  want %v",
+					tc.input, tc.defaultYear, got, tc.want)
+			}
+		})
+	}
+}

go/internal/domain/fees/fees.go

@@ -0,0 +1,34 @@
+// Package fees ports fee calculation from scripts/attendance.py.
+package fees
+
+const (
+	AdultFeeDefault = 700 // CZK fallback for 2+ practices when month not in AdultFeeMonthlyRate
+	AdultFeeSingle  = 200 // CZK for exactly 1 practice
+)
+
+// AdultFeeMonthlyRate mirrors ADULT_FEE_MONTHLY_RATE in scripts/attendance.py.
+// Months absent from this map fall back to AdultFeeDefault.
+var AdultFeeMonthlyRate = map[string]int{
+	"2025-09": 750, "2025-10": 750, "2025-11": 750, "2025-12": 750,
+	"2026-01": 750, "2026-02": 750, "2026-03": 350,
+	"2026-04": 700, "2026-05": 700,
+}
+
+// CalculateFee returns the adult fee in CZK for attendanceCount practices in
+// the given monthKey (format "YYYY-MM").
+//
+//	0 practices → 0
+//	1 practice  → AdultFeeSingle (200)
+//	2+          → AdultFeeMonthlyRate[monthKey] or AdultFeeDefault
+func CalculateFee(attendanceCount int, monthKey string) int {
+	if attendanceCount == 0 {
+		return 0
+	}
+	if attendanceCount == 1 {
+		return AdultFeeSingle
+	}
+	if rate, ok := AdultFeeMonthlyRate[monthKey]; ok {
+		return rate
+	}
+	return AdultFeeDefault
+}

go/internal/domain/fees/fees_test.go

@@ -0,0 +1,37 @@
+package fees
+
+import "testing"
+
+func TestCalculateFee(t *testing.T) {
+	t.Parallel()
+
+	// All expected outputs verified against live Python implementation on 2026-05-06:
+	//   PYTHONPATH=scripts:. python -c 'from attendance import calculate_fee; print([calculate_fee(c,m) for c,m in [(0,"2026-05"),(0,""),(1,"2026-05"),(1,"unknown"),(2,"2026-05"),(2,"2026-03"),(2,"2025-09"),(5,"2026-05"),(2,"2027-01"),(2,"")]])'
+	tests := []struct {
+		name  string
+		count int
+		month string
+		want  int
+	}{
+		{"zero short-circuits", 0, "2026-05", 0},
+		{"zero empty month", 0, "", 0},
+		{"single practice", 1, "2026-05", 200},
+		{"single ignores monthKey", 1, "unknown", 200},
+		{"two practices configured month", 2, "2026-05", 700},
+		{"two practices reduced march", 2, "2026-03", 350},
+		{"two practices early season", 2, "2025-09", 750},
+		{"high count same as two", 5, "2026-05", 700},
+		{"unknown future month falls back", 2, "2027-01", 700},
+		{"empty month falls back", 2, "", 700},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := CalculateFee(tc.count, tc.month)
+			if got != tc.want {
+				t.Errorf("CalculateFee(%d, %q) = %d, want %d", tc.count, tc.month, got, tc.want)
+			}
+		})
+	}
+}

go/internal/domain/fees/junior.go

@@ -0,0 +1,37 @@
+package fees
+
+const JuniorFeeDefault = 500 // CZK fallback for 2+ practices when month not in JuniorFeeMonthlyRate
+
+// JuniorFeeMonthlyRate mirrors JUNIOR_MONTHLY_RATE in scripts/attendance.py.
+// Months absent from this map fall back to JuniorFeeDefault.
+var JuniorFeeMonthlyRate = map[string]int{
+	"2025-09": 250,
+	"2026-03": 250,
+}
+
+// Expected is the result of a junior fee calculation.
+// When Unknown is true the fee requires manual review (Python returns "?");
+// in that case Value is meaningless — always check Unknown first.
+type Expected struct {
+	Value   int
+	Unknown bool
+}
+
+// CalculateJuniorFee returns the junior fee for attendanceCount practices in
+// the given monthKey (format "YYYY-MM").
+//
+//	0 practices → Expected{Value: 0}
+//	1 practice  → Expected{Unknown: true}  (manual review; Python sentinel "?")
+//	2+          → Expected{Value: JuniorFeeMonthlyRate[monthKey] or JuniorFeeDefault}
+func CalculateJuniorFee(attendanceCount int, monthKey string) Expected {
+	if attendanceCount == 0 {
+		return Expected{Value: 0}
+	}
+	if attendanceCount == 1 {
+		return Expected{Unknown: true}
+	}
+	if rate, ok := JuniorFeeMonthlyRate[monthKey]; ok {
+		return Expected{Value: rate}
+	}
+	return Expected{Value: JuniorFeeDefault}
+}

go/internal/domain/fees/junior_test.go

@@ -0,0 +1,37 @@
+package fees
+
+import "testing"
+
+func TestCalculateJuniorFee(t *testing.T) {
+	t.Parallel()
+
+	// All expected outputs verified against live Python implementation on 2026-05-06:
+	//   PYTHONPATH=scripts:. python -c 'from attendance import calculate_junior_fee; print([calculate_junior_fee(c,m) for c,m in [(0,"2026-05"),(0,""),(1,"2026-05"),(1,"unknown"),(2,"2026-05"),(2,"2025-09"),(2,"2026-03"),(5,"2025-09"),(2,"2027-01"),(2,"")]])'
+	tests := []struct {
+		name  string
+		count int
+		month string
+		want  Expected
+	}{
+		{"zero short-circuits", 0, "2026-05", Expected{Value: 0}},
+		{"zero empty month", 0, "", Expected{Value: 0}},
+		{"single practice sentinel", 1, "2026-05", Expected{Unknown: true}},
+		{"single ignores monthKey", 1, "unknown", Expected{Unknown: true}},
+		{"two practices default month", 2, "2026-05", Expected{Value: 500}},
+		{"two practices reduced sept", 2, "2025-09", Expected{Value: 250}},
+		{"two practices reduced march", 2, "2026-03", Expected{Value: 250}},
+		{"high count same as two", 5, "2025-09", Expected{Value: 250}},
+		{"unknown future month falls back", 2, "2027-01", Expected{Value: 500}},
+		{"empty month falls back", 2, "", Expected{Value: 500}},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := CalculateJuniorFee(tc.count, tc.month)
+			if got != tc.want {
+				t.Errorf("CalculateJuniorFee(%d, %q) = %+v, want %+v", tc.count, tc.month, got, tc.want)
+			}
+		})
+	}
+}

go/internal/domain/money/money.go

@@ -0,0 +1,49 @@
+// Package money ports Czech-locale currency parsing from scripts/infer_payments.py.
+package money
+
+import (
+	"errors"
+	"strconv"
+	"strings"
+)
+
+// ErrInvalidAmount is returned by ParseCZK when the input cannot be parsed.
+var ErrInvalidAmount = errors.New("money: invalid CZK amount")
+
+// ParseCZK parses a Czech-locale amount string and returns the value in CZK
+// as a float64. Mirrors scripts/infer_payments.py parse_czk_amount:
+//
+//   - empty input → (0, nil)
+//   - "Kč"/"CZK" suffixes stripped (case-sensitive, like Python)
+//   - comma present → comma is decimal sep, dots/spaces are thousand seps
+//     ("1.500,00" → 1500.0)
+//   - no comma, 2+ dots → all dots are thousand seps ("1.500.000" → 1500000.0)
+//   - no comma, ≤1 dot → dot is decimal sep ("1.500" → 1.5)
+//   - on parse failure → (0, ErrInvalidAmount); callers wanting Python's
+//     silent-zero behaviour can discard the error: v, _ := ParseCZK(s)
+func ParseCZK(s string) (float64, error) {
+	if s == "" {
+		return 0, nil
+	}
+
+	s = strings.ReplaceAll(s, "Kč", "")
+	s = strings.ReplaceAll(s, "CZK", "")
+	s = strings.TrimSpace(s)
+
+	if strings.ContainsRune(s, ',') {
+		s = strings.ReplaceAll(s, ".", "")
+		s = strings.ReplaceAll(s, " ", "")
+		s = strings.ReplaceAll(s, ",", ".")
+	} else if strings.Count(s, ".") > 1 {
+		s = strings.ReplaceAll(s, ".", "")
+		s = strings.ReplaceAll(s, " ", "")
+	} else {
+		s = strings.ReplaceAll(s, " ", "")
+	}
+
+	v, err := strconv.ParseFloat(s, 64)
+	if err != nil {
+		return 0, ErrInvalidAmount
+	}
+	return v, nil
+}

go/internal/domain/money/money_test.go

@@ -0,0 +1,67 @@
+package money
+
+import (
+	"testing"
+)
+
+func TestParseCZK(t *testing.T) {
+	t.Parallel()
+
+	// All expected outputs verified against live Python implementation on 2026-05-06:
+	//   PYTHONPATH=scripts:. python -c '
+	//   from infer_payments import parse_czk_amount
+	//   for v in [None, "", "0", "500", "500 Kč", "500 CZK",
+	//             "1 500", "1500.00", "1 500.00",
+	//             "1.500,00", "1500,5", "1.500.000",
+	//             "1.500", "abc", "  ", "100,5 Kč"]:
+	//       print(repr(v), "->", parse_czk_amount(v))
+	//   '
+	tests := []struct {
+		name    string
+		input   string
+		want    float64
+		wantErr bool
+	}{
+		{"empty string", "", 0, false},
+		{"zero string", "0", 0, false},
+		{"plain integer", "500", 500, false},
+		{"with Kč suffix", "500 Kč", 500, false},
+		{"with CZK suffix", "500 CZK", 500, false},
+		{"space thousand sep", "1 500", 1500, false},
+		{"dot decimal", "1500.00", 1500, false},
+		{"space thousands dot decimal", "1 500.00", 1500, false},
+		{"dot thousand comma decimal", "1.500,00", 1500, false},
+		{"comma decimal no thousands", "1500,5", 1500.5, false},
+		{"multiple dot thousand seps", "1.500.000", 1500000, false},
+		{"single dot is decimal heuristic", "1.500", 1.5, false},
+		{"comma decimal with Kč", "100,5 Kč", 100.5, false},
+		{"garbage text", "abc", 0, true},
+		{"spaces only", "  ", 0, true},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := ParseCZK(tc.input)
+			if (err != nil) != tc.wantErr {
+				t.Errorf("ParseCZK(%q) error = %v, wantErr %v", tc.input, err, tc.wantErr)
+			}
+			if got != tc.want {
+				t.Errorf("ParseCZK(%q) = %v, want %v", tc.input, got, tc.want)
+			}
+		})
+	}
+}
+
+// TestParseCZKSilentZero documents that discarding the error recovers Python's
+// silent-zero behaviour for any garbage input.
+func TestParseCZKSilentZero(t *testing.T) {
+	t.Parallel()
+
+	for _, s := range []string{"abc", "  ", "Kč", "CZK"} {
+		v, _ := ParseCZK(s)
+		if v != 0 {
+			t.Errorf("ParseCZK(%q) silent-zero: got %v, want 0", s, v)
+		}
+	}
+}

go/internal/domain/synch/synch.go

@@ -0,0 +1,65 @@
+// Package synch ports the bank-sync deduplication helper from
+// scripts/sync_fio_to_sheets.py.
+package synch
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"math"
+	"strconv"
+	"strings"
+)
+
+// Transaction is the projection of a Fio transaction that participates
+// in the Sync ID hash. Other fields (ks, ss, sender_account, …) are
+// intentionally excluded — they are not part of the Python hash.
+//
+// Currency: leave "" to inherit the Python default of "CZK" (matches
+// the HTML scraper path which omits the key entirely).
+type Transaction struct {
+	Date     string
+	Amount   float64
+	Currency string
+	Sender   string
+	VS       string
+	Message  string
+	BankID   string
+}
+
+// GenerateSyncID returns the lowercase SHA-256 hex digest of
+// "date|amount|currency|sender|vs|message|bank_id" (lower-cased), used
+// as the dedup key in column K of the payments sheet.
+//
+// Byte-stable with scripts/sync_fio_to_sheets.py generate_sync_id.
+func GenerateSyncID(tx Transaction) string {
+	currency := tx.Currency
+	if currency == "" {
+		currency = "CZK"
+	}
+	raw := strings.ToLower(strings.Join([]string{
+		tx.Date,
+		formatAmount(tx.Amount),
+		currency,
+		tx.Sender,
+		tx.VS,
+		tx.Message,
+		tx.BankID,
+	}, "|"))
+	sum := sha256.Sum256([]byte(raw))
+	return hex.EncodeToString(sum[:])
+}
+
+// formatAmount mimics Python's str(float) for Fio transaction amounts.
+// Python uses decimal notation for abs(f) in [1e-4, 1e16) and scientific
+// notation outside that range, always adding ".0" to whole-valued decimals.
+func formatAmount(f float64) string {
+	abs := math.Abs(f)
+	if abs != 0 && (abs < 1e-4 || abs >= 1e16) {
+		return strconv.FormatFloat(f, 'e', -1, 64)
+	}
+	s := strconv.FormatFloat(f, 'f', -1, 64)
+	if !strings.ContainsRune(s, '.') {
+		s += ".0"
+	}
+	return s
+}

go/internal/domain/synch/synch_test.go

@@ -0,0 +1,119 @@
+package synch
+
+import (
+	"testing"
+)
+
+// All expected digests verified against the live Python implementation on 2026-05-06:
+//
+//	PYTHONPATH=scripts:. python -c '
+//	from sync_fio_to_sheets import generate_sync_id
+//	cases = [
+//	    {"date":"2026-01-15","amount":500.0,"currency":"CZK","sender":"Jan Novak","vs":"123","message":"clenske 1/2026","bank_id":"abc123"},
+//	    {"date":"2026-01-15","amount":500.0,"sender":"Jan Novak","vs":"123","message":"clenske 1/2026","bank_id":"abc123"},
+//	    {"date":"2026-02-10","amount":1234.56,"currency":"CZK","sender":"ABC SRO","vs":"","message":"FAKTURA 42","bank_id":"xyz"},
+//	    {"date":"2026-03-01","amount":-500.0,"currency":"CZK","sender":"refund","vs":"","message":"","bank_id":""},
+//	    {"date":"2026-04-01","amount":0.0,"currency":"CZK","sender":"","vs":"","message":"","bank_id":""},
+//	    {"date":"","amount":0.0,"currency":"CZK","sender":"","vs":"","message":"","bank_id":""},
+//	]
+//	for c in cases: print(generate_sync_id(c))
+//	'
+func TestGenerateSyncID(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name string
+		tx   Transaction
+		want string
+	}{
+		{
+			name: "all fields set",
+			tx: Transaction{
+				Date: "2026-01-15", Amount: 500.0, Currency: "CZK",
+				Sender: "Jan Novak", VS: "123", Message: "clenske 1/2026", BankID: "abc123",
+			},
+			want: "4ac26598b6f23965380690172156a438a7e97a97dcedf222e5afe1afbe2c1bc4",
+		},
+		{
+			name: "currency empty defaults to CZK",
+			tx: Transaction{
+				Date: "2026-01-15", Amount: 500.0, Currency: "",
+				Sender: "Jan Novak", VS: "123", Message: "clenske 1/2026", BankID: "abc123",
+			},
+			want: "4ac26598b6f23965380690172156a438a7e97a97dcedf222e5afe1afbe2c1bc4",
+		},
+		{
+			name: "mixed-case fields lowercased before hashing",
+			tx: Transaction{
+				Date: "2026-02-10", Amount: 1234.56, Currency: "CZK",
+				Sender: "ABC SRO", VS: "", Message: "FAKTURA 42", BankID: "xyz",
+			},
+			want: "d40fa224d4fa572ffcd58e308e5c6508c4d5ca087b24ef6ff9284528fc128250",
+		},
+		{
+			name: "negative amount",
+			tx: Transaction{
+				Date: "2026-03-01", Amount: -500.0, Currency: "CZK",
+				Sender: "refund", VS: "", Message: "", BankID: "",
+			},
+			want: "0c630a407160367c396a2beec08efb94c319b4d84a8b90cc2be89e6ea10c391f",
+		},
+		{
+			name: "zero amount",
+			tx: Transaction{
+				Date: "2026-04-01", Amount: 0.0, Currency: "CZK",
+				Sender: "", VS: "", Message: "", BankID: "",
+			},
+			want: "6a23ce53717cd539064d550d2c2ec5de2e9bf81016d16852820ca9b8e259331f",
+		},
+		{
+			// Python equivalent: {"date":"","amount":0.0,"currency":"CZK","sender":"","vs":"","message":"","bank_id":""}
+			// Note: Python generate_sync_id({}) hashes "" for missing amount, not "0.0".
+			name: "zero-value Transaction",
+			tx:   Transaction{},
+			want: "d33d7e391f5a43f0192bb5a34c0ec15715139125678ecef8e1324af7d943b21d",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := GenerateSyncID(tc.tx)
+			if got != tc.want {
+				t.Errorf("GenerateSyncID(%+v) = %q, want %q", tc.tx, got, tc.want)
+			}
+		})
+	}
+}
+
+// All expected strings verified against the live Python implementation on 2026-05-06:
+//
+//	PYTHONPATH=scripts:. python -c '
+//	for v in [0.0, 500.0, -500.0, 0.1, 1234.56, 99999.99, 1500000.0, 1e16, 1e-5]:
+//	    print(repr(v), "->", repr(str(v)))
+//	'
+func TestFormatAmount(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		in   float64
+		want string
+	}{
+		{0.0, "0.0"},
+		{500.0, "500.0"},
+		{-500.0, "-500.0"},
+		{0.1, "0.1"},
+		{1234.56, "1234.56"},
+		{99999.99, "99999.99"},
+		{1500000.0, "1500000.0"},
+		{1e16, "1e+16"},
+		{1e-5, "1e-05"},
+	}
+
+	for _, tc := range cases {
+		got := formatAmount(tc.in)
+		if got != tc.want {
+			t.Errorf("formatAmount(%v) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}

go/internal/logging/logger.go

@@ -0,0 +1,24 @@
+package logging
+
+import (
+	"log/slog"
+	"os"
+	"strings"
+)
+
+// New returns a slog.Logger at the given level (DEBUG|INFO|WARN|ERROR).
+// Pass config.Config.LogLevel as the argument. Defaults to INFO on unrecognised input.
+func New(level string) *slog.Logger {
+	var l slog.Level
+	switch strings.ToUpper(level) {
+	case "DEBUG":
+		l = slog.LevelDebug
+	case "WARN", "WARNING":
+		l = slog.LevelWarn
+	case "ERROR":
+		l = slog.LevelError
+	default:
+		l = slog.LevelInfo
+	}
+	return slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: l}))
+}

go/internal/web/middleware/timer.go

@@ -0,0 +1,34 @@
+package middleware
+
+import (
+	"log/slog"
+	"net/http"
+	"time"
+)
+
+type statusWriter struct {
+	http.ResponseWriter
+	status int
+}
+
+func (sw *statusWriter) WriteHeader(code int) {
+	sw.status = code
+	sw.ResponseWriter.WriteHeader(code)
+}
+
+// RequestTimer logs method, path, status, and elapsed milliseconds for every
+// request. Parity with Python's get_render_time — the elapsed value maps to
+// render_time.total in the M5 JSON allowlist.
+func RequestTimer(logger *slog.Logger, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+		sw := &statusWriter{ResponseWriter: w, status: http.StatusOK}
+		next.ServeHTTP(sw, r)
+		logger.Info("req",
+			"method", r.Method,
+			"path", r.URL.Path,
+			"status", sw.status,
+			"ms", time.Since(start).Milliseconds(),
+		)
+	})
+}

go/internal/web/server.go

@@ -0,0 +1,32 @@
+package web
+
+import (
+	"fmt"
+	"fuj-management/go/internal/web/middleware"
+	"log/slog"
+	"net/http"
+)
+
+// BuildInfo carries the linker-injected build metadata.
+type BuildInfo struct {
+	Version   string
+	Commit    string
+	BuildDate string
+}
+
+// Run registers routes and starts the HTTP server on addr.
+func Run(logger *slog.Logger, addr string, build BuildInfo) error {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /{$}", helloHandler(build))
+
+	logger.Info("starting server", "addr", addr)
+	return http.ListenAndServe(addr, middleware.RequestTimer(logger, mux))
+}
+
+func helloHandler(build BuildInfo) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		fmt.Fprintf(w, "fuj-go ok\nversion: %s\ncommit:  %s\nbuilt:   %s\n",
+			build.Version, build.Commit, build.BuildDate)
+	}
+}

prompts/2026-03-09-add-pay-all.md

@@ -0,0 +1 @@
+Now on both reconiciliation pages in the balance column i want to have a button "Pay All" which will create a new row in the transactions table with amount equal to the balance and with a note same as for payment for single period but stating all periods debt consist of

prompts/2026-03-10-cache-data-from-google-sheets.md

@@ -0,0 +1,7 @@
+i would like to implement caching of data that we load from the google documents. For all of them. I do not need persistence across application restarts, so file of whatever format in tmp directory would be good enough. I think it would be good idea to read metadata about documents we access - last modified time? and reload these files only when document is newer than cached data.
+
+Suggest solution, suggest file format for caching.
+
+------------
+
+i do not need caching for scripts, caching is relevant for web app only

prompts/outcomes/2026-03-10-cache-data-from-google-sheets.md

@@ -0,0 +1,29 @@
+# Google Sheets Data Caching Implementation
+
+**Date:** 2026-03-11
+**Objective:** Optimize Flask application performance by heavily caching expensive Google Sheets data processing, avoiding redundant HTTP roundtrips to Google APIs, and ensuring rate limits are not exhausted during simple web app reloads.
+
+## Implemented Features
+
+### 1. File-Based JSON Caching (`cache_utils.py`)
+- **Mechanism:** Implemented a new generic caching system that saves API responses and heavily calculated datasets as `.json` files directly to the local `/tmp/` directory.
+- **Drive Metadata Checks:** The cache is validated by asking the Google Drive API (`drive.files().get`) for the remote `modifiedTime` of the target Sheet.
+- **Cache Hit logic:** If the cached version on disk matches the remote `modifiedTime`, the application skips downloading the full CSV payload and computing tuples—instead serving the instant static cache via `json.load`.
+
+### 2. Global API Auth Object Reuse
+- **The Problem:** The `_get_drive_service()` and `get_sheets_service()` implementations were completely rebuilding `googleapiclient.discovery` objects for *every single file check*—re-seeking and exchanging Google Service Account tokens constantly. 
+- **The Fix:** Service objects (`_DRIVE_SERVICE`, `_SHEETS_SERVICE`) are now globally cached in application memory. The server authenticates exactly *once* when it wakes up, dramatically saving milliseconds and network resources across every web request. The underlying `httplib2` and `google-auth` intelligently handle silent token refreshes natively.
+
+### 3. Graceful Configurable Rate Limiting 
+- **In-Memory Debouncing:** Implemented an internal memory state (`_LAST_CHECKED`) inside `cache_utils` that forcefully prevents checking the Drive API `modifiedTime` for a specific file if we already explicitly checked it within the last 5 minutes. This prevents flooding the Google Drive API while clicking wildly around the app GUI. 
+- **Semantic Mappings:** Created a `CACHE_SHEET_MAP` that maps friendly internal cache keys (e.g. `attendance_regular`) back to their raw 44-character Google Sheet IDs.
+
+### 4. HTTP / Socket Timeout Safety Fix
+- **The Bug:** Originally, `socket.setdefaulttimeout(10)` was used to prevent Google Drive metadata checks from locking up the worker pool. However, this brutally mutated the underlying Werkzeug/Flask default sockets globally. If fetching thousands of lines from Google *Sheets* (the payload logic) took longer than 10 seconds, Flask would just kill the request with a random `TimeoutError('timed out')`. 
+- **The Fix:** Removed the global mutation. Instantiated a targeted, isolated `httplib2.Http(timeout=10)` injected *specifically* into only the Google Drive API build. The rest of the app can now download massive files without randomly timing out.
+
+### 5. Developer Experience (DX) Enhancements
+- **Logging Line Origins:** Enriched the console logging format strings (`logging.basicConfig`) to output `[%(funcName)s]` and `%(filename)s:%(lineno)d` to easily trace exactly which exact file and function is executing on complex stack traces.
+- **Improved VS Code Local Debugging:**
+  - Integrated `debugpy` launch profiles in `.vscode/launch.json` for "Python Debugger: Flask" (Launching) and "Python Debugger: Attach" (Connecting).
+  - Implemented a standard `make web-attach` target inside the Makefile via `uv run python -m debugpy --listen ...` to allow the background web app to automatically halt and wait for external debuggers before bootstrapping caching layers.

pyproject.toml

@@ -8,8 +8,15 @@ dependencies = [
     "google-auth-httplib2>=0.2.0",
     "google-auth-oauthlib>=1.2.1",
     "qrcode[pil]>=8.0",
+    "gunicorn>=23.0",
 ]
 requires-python = ">=3.13"
 
+[dependency-groups]
+dev = [
+    "pytest>=8.0",
+    "pytest-cov>=6.0",
+]
+
 [tool.uv]
 package = false

scripts/attendance.py

@@ -5,17 +5,29 @@ import io
 import urllib.request
 from datetime import datetime
 
-SHEET_ID = "1E2e_gT_K5AwSRCDLDTa2UetZTkHmBOcz0kFbBUNUNBA"
-JUNIOR_SHEET_GID = "1213318614"
+from config import ATTENDANCE_SHEET_ID as SHEET_ID, JUNIOR_SHEET_GID
+
 EXPORT_URL = f"https://docs.google.com/spreadsheets/d/{SHEET_ID}/export?format=csv&gid=0"
 JUNIOR_EXPORT_URL = f"https://docs.google.com/spreadsheets/d/{SHEET_ID}/export?format=csv&gid={JUNIOR_SHEET_GID}"
 
-FEE_FULL = 750  # CZK, for 2+ practices in a month
-FEE_SINGLE = 200  # CZK, for exactly 1 practice in a month
+ADULT_FEE_DEFAULT = 700  # CZK, for 2+ practices in a month
+ADULT_FEE_SINGLE = 200  # CZK, for exactly 1 practice in a month
+ADULT_FEE_MONTHLY_RATE = {
+    "2025-09": 750,
+    "2025-10": 750,
+    "2025-11": 750,
+    "2025-12": 750,
+    "2026-01": 750,
+    "2026-02": 750,
+    "2026-03": 350,
+    "2026-04": 700,
+    "2026-05": 700,
+}
 
 JUNIOR_FEE_DEFAULT = 500  # CZK for 2+ practices
 JUNIOR_MONTHLY_RATE = {
-    "2025-09": 250
+    "2025-09": 250,
+    "2026-03": 250   # reduced fee for March 2026
 }
 ADULT_MERGED_MONTHS = {
     #"2025-12": "2026-01",   # keys are merged into values
@@ -34,13 +46,8 @@ FIRST_DATE_COL = 3
 
 def fetch_csv(url: str = EXPORT_URL) -> list[list[str]]:
     """Fetch the attendance Google Sheet as parsed CSV rows."""
-    import ssl
-    ctx = ssl.create_default_context()
-    ctx.check_hostname = False
-    ctx.verify_mode = ssl.CERT_NONE
-    
     req = urllib.request.Request(url)
-    with urllib.request.urlopen(req, context=ctx) as resp:
+    with urllib.request.urlopen(req) as resp:
         text = resp.read().decode("utf-8")
     reader = csv.reader(io.StringIO(text))
     return list(reader)
@@ -81,13 +88,13 @@ def group_by_month(dates: list[tuple[int, datetime]], merged_months: dict[str, s
     return months
 
 
-def calculate_fee(attendance_count: int) -> int:
-    """Apply fee rules: 0 → 0, 1 → 200, 2+ → 750."""
+def calculate_fee(attendance_count: int, month_key: str) -> int:
+    """Apply fee rules: 0 → 0, 1 → 200, 2+ → configured rate (default 750)."""
     if attendance_count == 0:
         return 0
     if attendance_count == 1:
-        return FEE_SINGLE
-    return FEE_FULL
+        return ADULT_FEE_SINGLE
+    return ADULT_FEE_MONTHLY_RATE.get(month_key, ADULT_FEE_DEFAULT)
 
 
 def calculate_junior_fee(attendance_count: int, month_key: str) -> str | int:
@@ -191,7 +198,7 @@ def get_members_with_fees() -> tuple[list[tuple[str, str, dict[str, int]]], list
                 for c in cols
                 if c < len(row) and row[c].strip().upper() == "TRUE"
             )
-            fee = calculate_fee(count) if tier == "A" else 0
+            fee = calculate_fee(count, month_key) if tier == "A" else 0
             month_fees[month_key] = (fee, count)
         members.append((name, tier, month_fees))
 

scripts/cache_utils.py

@@ -0,0 +1,173 @@
+import json
+import socket
+import logging
+from datetime import datetime
+from google.oauth2 import service_account
+from googleapiclient.discovery import build
+
+from config import (
+    CACHE_DIR, CREDENTIALS_PATH as CREDS_PATH, DRIVE_TIMEOUT,
+    CACHE_TTL_SECONDS, CACHE_API_CHECK_TTL_SECONDS, CACHE_SHEET_MAP,
+)
+
+logger = logging.getLogger(__name__)
+
+# Global state to track last Drive API check time per sheet
+_LAST_CHECKED = {}
+_DRIVE_SERVICE = None
+
+def _get_drive_service():
+    global _DRIVE_SERVICE
+    if _DRIVE_SERVICE is not None:
+        return _DRIVE_SERVICE
+
+    if not CREDS_PATH.exists():
+        logger.warning(f"Credentials not found at {CREDS_PATH}. Cannot check Google Drive API.")
+        return None
+        
+    try:
+        creds = service_account.Credentials.from_service_account_file(
+            str(CREDS_PATH), 
+            scopes=["https://www.googleapis.com/auth/drive.readonly"]
+        )
+        
+        # Apply timeout safely to the httplib2 connection without mutating global socket
+        import httplib2
+        import google_auth_httplib2
+        http = httplib2.Http(timeout=DRIVE_TIMEOUT)
+        http = google_auth_httplib2.AuthorizedHttp(creds, http=http)
+        
+        _DRIVE_SERVICE = build("drive", "v3", http=http, cache_discovery=False)
+        return _DRIVE_SERVICE
+    except Exception as e:
+        logger.error(f"Failed to build Drive API service: {e}")
+        return None
+
+import time
+
+def get_sheet_modified_time(cache_key: str) -> str | None:
+    """Gets the modifiedTime from Google Drive API for a given cache_key.
+    Returns the ISO timestamp string if successful.
+    If the Drive API fails (e.g., lack of permissions for public sheets),
+    it generates a virtual time bucket string to provide a 5-minute TTL cache.
+    """
+    sheet_id = CACHE_SHEET_MAP.get(cache_key, cache_key)
+    
+    cache_file = CACHE_DIR / f"{cache_key}_cache.json"
+    
+    # 1. Check if we should skip the Drive API check entirely (global memory TTL)
+    now = time.time()
+    last_check = _LAST_CHECKED.get(sheet_id, 0)
+    
+    if CACHE_API_CHECK_TTL_SECONDS > 0 and (now - last_check) < CACHE_API_CHECK_TTL_SECONDS:
+        # We checked recently. Return cached modifiedTime if cache file exists.
+        if cache_file.exists():
+            try:
+                with open(cache_file, "r", encoding="utf-8") as f:
+                    cache_data = json.load(f)
+                    cached_time = cache_data.get("modifiedTime")
+                    if cached_time:
+                        logger.info(f"Skipping Drive API check for {sheet_id} due to {CACHE_API_CHECK_TTL_SECONDS}s API check TTL")
+                        return cached_time
+            except Exception as e:
+                logger.warning(f"Error reading existing cache during API skip for {sheet_id}: {e}")
+                
+    # 2. Check if the cache file is simply too new (legacy check)
+    if CACHE_TTL_SECONDS > 0 and cache_file.exists():
+        try:
+            file_mtime = cache_file.stat().st_mtime
+            if time.time() - file_mtime < CACHE_TTL_SECONDS:
+                with open(cache_file, "r", encoding="utf-8") as f:
+                    cache_data = json.load(f)
+                    cached_time = cache_data.get("modifiedTime")
+                    if cached_time:
+                        logger.info(f"Skipping Drive API check for {sheet_id} due to {CACHE_TTL_SECONDS}s max CACHE_TTL")
+                        # We consider this a valid check, update the global state
+                        _LAST_CHECKED[sheet_id] = now
+                        return cached_time
+        except Exception as e:
+            logger.warning(f"Error checking cache TTL for {sheet_id}: {e}")
+
+    def _fallback_ttl():
+        bucket = int(time.time() // 300)
+        return f"ttl-5m-{bucket}"
+
+    logger.info(f"Checking Drive API for {sheet_id}")
+    drive_service = _get_drive_service()
+    if not drive_service:
+        return _fallback_ttl()
+        
+    try:
+        file_meta = drive_service.files().get(fileId=sheet_id, fields="modifiedTime", supportsAllDrives=True).execute()
+        # Successfully checked API, update the global state
+        _LAST_CHECKED[sheet_id] = time.time()
+        return file_meta.get("modifiedTime")
+    except Exception as e:
+        logger.warning(f"Could not get modifiedTime for sheet {sheet_id}: {e}. Falling back to 5-minute TTL.")
+        return _fallback_ttl()
+
+def read_cache(sheet_id: str, current_modified_time: str) -> list | dict | None:
+    """Reads the JSON cache for the given sheet_id.
+    Returns the cached data if it exists AND the cached modifiedTime matches
+    current_modified_time.
+    Otherwise, returns None.
+    """
+    if not current_modified_time:
+        return None
+        
+    cache_file = CACHE_DIR / f"{sheet_id}_cache.json"
+    if not cache_file.exists():
+        return None
+        
+    try:
+        with open(cache_file, "r", encoding="utf-8") as f:
+            cache_data = json.load(f)
+            
+        cached_time = cache_data.get("modifiedTime")
+        if cached_time == current_modified_time:
+            logger.info(f"Cache hit for {sheet_id} ({current_modified_time})")
+            return cache_data.get("data")
+        else:
+            logger.info(f"Cache miss for {sheet_id}. Cached: {cached_time}, Current: {current_modified_time}")
+            return None
+    except Exception as e:
+        logger.error(f"Failed to read cache {cache_file}: {e}")
+        return None
+
+def write_cache(sheet_id: str, modified_time: str, data: list | dict) -> None:
+    """Writes the data to a JSON cache file with the given modified_time."""
+    if not modified_time:
+        return
+        
+    try:
+        CACHE_DIR.mkdir(parents=True, exist_ok=True)
+        cache_file = CACHE_DIR / f"{sheet_id}_cache.json"
+        
+        cache_data = {
+            "modifiedTime": modified_time,
+            "data": data,
+            "cachedAt": datetime.now().isoformat()
+        }
+        
+        with open(cache_file, "w", encoding="utf-8") as f:
+            json.dump(cache_data, f, ensure_ascii=False)
+            
+        logger.info(f"Wrote cache for {sheet_id}")
+    except Exception as e:
+        logger.error(f"Failed to write cache {sheet_id}: {e}")
+
+def flush_cache():
+    """Delete all cache files and reset in-memory state. Returns count of deleted files."""
+    global _DRIVE_SERVICE
+    _LAST_CHECKED.clear()
+    _DRIVE_SERVICE = None
+
+    deleted = 0
+    if CACHE_DIR.exists():
+        for f in CACHE_DIR.glob("*_cache.json"):
+            f.unlink()
+            deleted += 1
+            logger.info(f"Deleted cache file: {f.name}")
+
+    logger.info(f"Cache flushed: {deleted} files deleted, timers reset")
+    return deleted

scripts/config.py

@@ -0,0 +1,39 @@
+"""Centralized configuration for FUJ management scripts.
+
+External service IDs, credentials, and tunable parameters.
+Domain-specific constants (fees, column indices) stay in their respective modules.
+"""
+
+import os
+from pathlib import Path
+
+# Paths
+PROJECT_ROOT = Path(__file__).parent.parent
+CREDENTIALS_PATH = Path(os.environ.get(
+    "CREDENTIALS_PATH",
+    str(PROJECT_ROOT / ".secret" / "fuj-management-bot-credentials.json"),
+))
+
+# Google Sheets IDs
+ATTENDANCE_SHEET_ID = "1E2e_gT_K5AwSRCDLDTa2UetZTkHmBOcz0kFbBUNUNBA"
+PAYMENTS_SHEET_ID = "1Om0YPoDVCH5cV8BrNz5LG5eR5MMU05ypQC7UMN1xn_Y"
+
+# Attendance sheet tab GIDs
+JUNIOR_SHEET_GID = "1213318614"
+
+# Bank
+BANK_ACCOUNT = os.environ.get("BANK_ACCOUNT", "CZ8520100000002800359168")
+
+# Cache settings
+CACHE_DIR = PROJECT_ROOT / "tmp"
+DRIVE_TIMEOUT = 10  # seconds
+CACHE_TTL_SECONDS = int(os.environ.get("CACHE_TTL_SECONDS", 300))  # 5 min default
+CACHE_API_CHECK_TTL_SECONDS = int(os.environ.get("CACHE_API_CHECK_TTL_SECONDS", 300))  # 5 min default
+
+# Maps cache keys to their source sheet IDs (used by cache_utils)
+CACHE_SHEET_MAP = {
+    "attendance_regular": ATTENDANCE_SHEET_ID,
+    "attendance_juniors": ATTENDANCE_SHEET_ID,
+    "exceptions_dict": PAYMENTS_SHEET_ID,
+    "payments_transactions": PAYMENTS_SHEET_ID,
+}

scripts/infer_payments.py

@@ -102,7 +102,7 @@ def infer_payments(spreadsheet_id: str, credentials_path: str, dry_run: bool = F
     member_names = [m[0] for m in members_data]
 
     # 3. Process rows
-    print("Inffering details for empty rows...")
+    print("Inferring details for empty rows...")
     updates = []
     
     for i, row in enumerate(rows[1:], start=2):

scripts/match_payments.py

@@ -3,17 +3,29 @@
 
 import argparse
 import json
+import logging
 import os
 import re
 import urllib.request
 from datetime import datetime, timedelta
 from html.parser import HTMLParser
 
+logger = logging.getLogger(__name__)
+
 from attendance import get_members_with_fees
 from czech_utils import normalize, parse_month_references
 from sync_fio_to_sheets import get_sheets_service, DEFAULT_SPREADSHEET_ID
 
 
+def canonical_member_key(name: str) -> str:
+    """Diacritic-, case-, and whitespace-insensitive key for member-name matching.
+
+    Used to resolve `Person`-column values from the payments sheet to canonical
+    attendance-sheet names, tolerating cells like "Maria Maco" vs "Mária Maco".
+    """
+    return re.sub(r"\s+", " ", normalize(name)).strip()
+
+
 # ---------------------------------------------------------------------------
 # Name matching
 # ---------------------------------------------------------------------------
@@ -45,6 +57,11 @@ def _build_name_variants(name: str) -> list[str]:
     return [v for v in variants if len(v) >= 3]
 
 
+def _word_in(needle: str, haystack: str) -> bool:
+    """Return True if needle appears as a whole word in haystack."""
+    return bool(re.search(rf"\b{re.escape(needle)}\b", haystack))
+
+
 def match_members(
     text: str, member_names: list[str]
 ) -> list[tuple[str, str]]:
@@ -53,13 +70,26 @@ def match_members(
     Returns list of (member_name, confidence) where confidence is 'auto' or 'review'.
     """
     normalized_text = normalize(text)
+
+    # Short-circuit: if any member's full canonical name appears verbatim (whole words),
+    # return only those matches and skip all fuzzy/nickname checks. This prevents a
+    # nickname that is a substring of another member's surname from producing false hits.
+    exact_matches = []
+    for name in member_names:
+        variants = _build_name_variants(name)
+        full_name = variants[0] if variants else ""
+        if full_name and _word_in(full_name, normalized_text):
+            exact_matches.append((name, "auto"))
+    if exact_matches:
+        return exact_matches
+
     matches = []
 
     for name in member_names:
         variants = _build_name_variants(name)
         full_name = variants[0] if variants else ""
         parts = full_name.split()
-        
+
         # 1. Full name match (exact sequence) = high confidence
         if full_name and full_name in normalized_text:
             matches.append((name, "auto"))
@@ -67,17 +97,16 @@ def match_members(
 
         # 2. Both first and last name present (any order) = high confidence
         if len(parts) >= 2:
-            if parts[0] in normalized_text and parts[-1] in normalized_text:
+            if _word_in(parts[0], normalized_text) and _word_in(parts[-1], normalized_text):
                 matches.append((name, "auto"))
                 continue
 
-        # 3. Nickname + one part of the name = high confidence
+        # 3. Nickname present = high confidence
         nickname = ""
         nickname_match = re.search(r"\(([^)]+)\)", name)
         if nickname_match:
             nickname = normalize(nickname_match.group(1))
-            if nickname and nickname in normalized_text:
-                # Nickname alone is often enough, but let's check if it's combined with a name part
+            if nickname and _word_in(nickname, normalized_text):
                 matches.append((name, "auto"))
                 continue
 
@@ -86,19 +115,16 @@ def match_members(
             first_name = parts[0]
             last_name = parts[-1]
             _COMMON_SURNAMES = {"novak", "novakova", "prach"}
-            
-            # Match last name
-            if len(last_name) >= 4 and last_name not in _COMMON_SURNAMES and last_name in normalized_text:
+
+            if len(last_name) >= 4 and last_name not in _COMMON_SURNAMES and _word_in(last_name, normalized_text):
                 matches.append((name, "review"))
                 continue
-            
-            # Match first name (if not too short)
-            if len(first_name) >= 3 and first_name in normalized_text:
+
+            if len(first_name) >= 3 and _word_in(first_name, normalized_text):
                 matches.append((name, "review"))
                 continue
         elif len(parts) == 1:
-            # Single name member
-            if len(parts[0]) >= 4 and parts[0] in normalized_text:
+            if len(parts[0]) >= 4 and _word_in(parts[0], normalized_text):
                 matches.append((name, "review"))
                 continue
 
@@ -106,7 +132,6 @@ def match_members(
     # If we have any "auto" matches, discard all "review" matches
     auto_matches = [m for m in matches if m[1] == "auto"]
     if auto_matches:
-        # If multiple auto matches, keep them (ambiguous but high priority)
         return auto_matches
 
     return matches
@@ -203,7 +228,7 @@ def fetch_sheet_data(spreadsheet_id: str, credentials_path: str) -> list[dict]:
         return -1
 
     idx_date = get_col_index("Date")
-    idx_amount = get_col_index("Amount") 
+    idx_amount = get_col_index("Amount")
     idx_manual = get_col_index("manual fix")
     idx_person = get_col_index("Person")
     idx_purpose = get_col_index("Purpose")
@@ -212,6 +237,11 @@ def fetch_sheet_data(spreadsheet_id: str, credentials_path: str) -> list[dict]:
     idx_message = get_col_index("Message")
     idx_bank_id = get_col_index("Bank ID")
 
+    required = {"Date": idx_date, "Amount": idx_amount, "Person": idx_person, "Purpose": idx_purpose}
+    missing = [name for name, idx in required.items() if idx == -1]
+    if missing:
+        raise ValueError(f"Required columns missing from payments sheet: {', '.join(missing)}. Found headers: {header}")
+
     transactions = []
     for row in rows[1:]:
         def get_val(idx):
@@ -288,6 +318,12 @@ def reconcile(
     member_tiers = {name: tier for name, tier, _ in members}
     member_fees = {name: fees for name, _, fees in members}
 
+    # Map canonical key → first attendance-sheet name with that key, so a
+    # `Person` cell that drifts in diacritics/case/whitespace still resolves.
+    canonical_by_key: dict[str, str] = {}
+    for name in member_names:
+        canonical_by_key.setdefault(canonical_member_key(name), name)
+
     # Initialize ledger
     ledger: dict[str, dict[str, dict]] = {}
     other_ledger: dict[str, list] = {}
@@ -300,8 +336,8 @@ def reconcile(
             norm_name = normalize(name)
             norm_period = normalize(m)
             fee_data = member_fees[name].get(m, (0, 0))
-            original_expected = fee_data[0] if isinstance(fee_data, tuple) else fee_data
-            attendance_count = fee_data[1] if isinstance(fee_data, tuple) else 0
+            original_expected = fee_data[0] if isinstance(fee_data, (tuple, list)) else fee_data
+            attendance_count = fee_data[1] if isinstance(fee_data, (tuple, list)) else 0
             
             ex_data = exceptions.get((norm_name, norm_period))
             if ex_data is not None:
@@ -365,8 +401,9 @@ def reconcile(
         if is_other:
             num_allocations = len(matched_members)
             per_allocation = amount / num_allocations if num_allocations > 0 else 0
-            for member_name, confidence in matched_members:
-                if member_name in other_ledger:
+            for raw_member_name, confidence in matched_members:
+                member_name = canonical_by_key.get(canonical_member_key(raw_member_name))
+                if member_name is not None:
                     other_ledger[member_name].append({
                         "amount": per_allocation,
                         "date": tx["date"],
@@ -377,31 +414,81 @@ def reconcile(
                     })
             continue
 
-        num_allocations = len(matched_members) * len(matched_months)
-        per_allocation = amount / num_allocations if num_allocations > 0 else 0
+        member_share = amount / len(matched_members) if matched_members else 0
 
-        for member_name, confidence in matched_members:
-            # If we matched via sheet 'Person' column, name might be partial or have markers
-            # but usually it's the exact member name from get_members_with_fees.
-            # Let's ensure it exists in our ledger.
-            if member_name not in ledger:
-                # Try matching by base name if it was Jan Novak (Kačerr) etc.
-                pass
+        for raw_member_name, confidence in matched_members:
+            member_name = canonical_by_key.get(canonical_member_key(raw_member_name))
+            if member_name is None:
+                logger.warning(
+                    "Payment matched to unknown member %r (tx: %s, %s) — adding to unmatched",
+                    raw_member_name, tx.get("date", "?"), tx.get("message", "?"),
+                )
+                unmatched.append(tx)
+                continue
+            if member_name != raw_member_name:
+                logger.info(
+                    "Person cell %r resolved to canonical member %r — consider fixing the sheet",
+                    raw_member_name, member_name,
+                )
 
-            for month_key in matched_months:
-                entry = {
-                    "amount": per_allocation,
-                    "date": tx["date"],
-                    "sender": tx["sender"],
-                    "message": tx["message"],
-                    "confidence": confidence,
-                }
-                if month_key in ledger.get(member_name, {}):
-                    ledger[member_name][month_key]["paid"] += per_allocation
-                    ledger[member_name][month_key]["transactions"].append(entry)
-                else:
-                    # Future month — track as credit
-                    credits[member_name] = credits.get(member_name, 0) + int(per_allocation)
+            in_window = [(m, ledger[member_name][m]["expected"]) for m in matched_months if m in ledger[member_name]]
+            out_of_window = [m for m in matched_months if m not in ledger[member_name]]
+
+            # Out-of-window months (outside display range): even split → credit, same as before.
+            n_total = len(matched_months)
+            if out_of_window and n_total > 0:
+                out_credit = member_share / n_total * len(out_of_window)
+                credits[member_name] = credits.get(member_name, 0) + int(out_credit)
+            else:
+                out_credit = 0.0
+
+            in_window_share = member_share - out_credit
+
+            if not in_window:
+                continue
+
+            total_expected = sum(e for _, e in in_window)
+
+            if total_expected > 0 and in_window_share >= total_expected:
+                # Greedy phase: payment covers all in-window fees; overflow → credit.
+                credits[member_name] = credits.get(member_name, 0) + int(in_window_share - total_expected)
+                for m, exp in in_window:
+                    alloc = float(exp)
+                    ledger[member_name][m]["paid"] += alloc
+                    ledger[member_name][m]["transactions"].append({
+                        "amount": alloc,
+                        "date": tx["date"],
+                        "sender": tx["sender"],
+                        "message": tx["message"],
+                        "confidence": confidence,
+                    })
+            elif total_expected > 0:
+                # Proportional phase: distribute in_window_share by each month's expected fee.
+                # Last month absorbs any float remainder so the sum equals in_window_share exactly.
+                remaining = in_window_share
+                for i, (m, exp) in enumerate(in_window):
+                    alloc = remaining if i == len(in_window) - 1 else in_window_share * exp / total_expected
+                    remaining -= alloc
+                    ledger[member_name][m]["paid"] += alloc
+                    ledger[member_name][m]["transactions"].append({
+                        "amount": alloc,
+                        "date": tx["date"],
+                        "sender": tx["sender"],
+                        "message": tx["message"],
+                        "confidence": confidence,
+                    })
+            else:
+                # Fallback: no expected fees (prepayment before attendance recorded); even split.
+                per_month = in_window_share / len(in_window)
+                for m, _ in in_window:
+                    ledger[member_name][m]["paid"] += per_month
+                    ledger[member_name][m]["transactions"].append({
+                        "amount": per_month,
+                        "date": tx["date"],
+                        "sender": tx["sender"],
+                        "message": tx["message"],
+                        "confidence": confidence,
+                    })
 
     # Calculate final total balances (window + off-window credits)
     final_balances: dict[str, int] = {}

scripts/sync_fio_to_sheets.py

@@ -14,13 +14,18 @@ from googleapiclient.discovery import build
 
 from fio_utils import fetch_transactions
 
-# Configuration
-DEFAULT_SPREADSHEET_ID = "1Om0YPoDVCH5cV8BrNz5LG5eR5MMU05ypQC7UMN1xn_Y"
+from config import PAYMENTS_SHEET_ID as DEFAULT_SPREADSHEET_ID
 SCOPES = ["https://www.googleapis.com/auth/spreadsheets"]
 TOKEN_FILE = "token.pickle"
 COLUMN_LABELS = ["Date", "Amount", "manual fix", "Person", "Purpose", "Inferred Amount", "Sender", "VS", "Message", "Bank ID", "Sync ID"]
+_SHEETS_SERVICE = None
+
 def get_sheets_service(credentials_path: str):
     """Authenticate and return the Google Sheets API service."""
+    global _SHEETS_SERVICE
+    if _SHEETS_SERVICE is not None:
+        return _SHEETS_SERVICE
+
     if not os.path.exists(credentials_path):
         raise FileNotFoundError(f"Credentials file not found: {credentials_path}")
 
@@ -50,7 +55,8 @@ def get_sheets_service(credentials_path: str):
             with open(TOKEN_FILE, "wb") as token:
                 pickle.dump(creds, token)
 
-    return build("sheets", "v4", credentials=creds)
+    _SHEETS_SERVICE = build("sheets", "v4", credentials=creds)
+    return _SHEETS_SERVICE
 
 
 def generate_sync_id(tx: dict) -> str:

templates/adults.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>FUJ Payment Reconciliation</title>
+    <title>FUJ Adults Dashboard</title>
     <style>
         body {
             font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
@@ -45,8 +45,16 @@
             margin-bottom: 20px;
             font-size: 12px;
             color: #555;
+            display: flex;
+            flex-direction: column;
+            gap: 10px;
+            align-items: center;
+        }
+
+        .nav > div {
             display: flex;
             gap: 15px;
+            align-items: center;
         }
 
         .nav a {
@@ -67,6 +75,23 @@
             border-color: #555;
         }
 
+        .nav-archived a {
+            font-size: 10px;
+            color: #666;
+            border-color: #222;
+        }
+
+        .nav-archived a.active {
+            color: #ccc;
+            background-color: #333;
+            border-color: #555;
+        }
+
+        .nav-archived a:hover {
+            color: #999;
+            border-color: #444;
+        }
+
         .description {
             margin-bottom: 20px;
             text-align: center;
@@ -142,6 +167,16 @@
             position: relative;
         }
 
+        .cell-unpaid-current {
+            color: #994444;
+            background-color: rgba(153, 68, 68, 0.05);
+            position: relative;
+        }
+
+        .cell-overridden {
+            color: #ffa500 !important;
+        }
+
         .pay-btn {
             display: none;
             position: absolute;
@@ -230,6 +265,24 @@
             border-color: #00ff00;
         }
 
+        .filter-select {
+            background-color: #1a1a1a;
+            border: 1px solid #333;
+            color: #00ff00;
+            font-family: inherit;
+            font-size: 11px;
+            padding: 4px 8px;
+            outline: none;
+        }
+
+        .filter-select:focus {
+            border-color: #00ff00;
+        }
+
+        .month-hidden {
+            display: none !important;
+        }
+
         .filter-label {
             color: #888;
             text-transform: lowercase;
@@ -312,6 +365,19 @@
             border-bottom: 1px dashed #222;
         }
 
+        .raw-toggle {
+            color: #333;
+            font-size: 9px;
+            text-transform: lowercase;
+            margin-left: 8px;
+            text-decoration: none;
+            letter-spacing: 0;
+        }
+
+        .raw-toggle:hover {
+            color: #666;
+        }
+
         .modal-table {
             width: 100%;
             border-collapse: collapse;
@@ -423,14 +489,22 @@
 
 <body>
     <div class="nav">
-        <a href="/fees">[Adult - Attendance/Fees]</a>
-        <a href="/fees-juniors">[Junior Attendance/Fees]</a>
-        <a href="/reconcile" class="active">[Adult Payment Reconciliation]</a>
-        <a href="/reconcile-juniors">[Junior Payment Reconciliation]</a>
-        <a href="/payments">[Payments Ledger]</a>
+        <div>
+            <a href="/adults" class="active">[Adults]</a>
+            <a href="/juniors">[Juniors]</a>
+        </div>
+        <div class="nav-archived">
+            <span style="color: #666; margin-right: 5px;">Archived:</span>
+            <a href="/payments">[Payments Ledger]</a>
+        </div>
+        <div class="nav-archived">
+            <span style="color: #666; margin-right: 5px;">Tools:</span>
+            <a href="/sync-bank">[Sync Bank Data]</a>
+            <a href="/flush-cache">[Flush Cache]</a>
+        </div>
     </div>
 
-    <h1>Payment Reconciliation</h1>
+    <h1>Adults Dashboard</h1>
 
     <div class="description">
         Balances calculated by matching Google Sheet payments against attendance fees.<br>
@@ -441,6 +515,20 @@
     <div class="filter-container">
         <span class="filter-label">search member:</span>
         <input type="text" id="nameFilter" class="filter-input" placeholder="..." autocomplete="off">
+        <span class="filter-label" style="margin-left: 16px;">from:</span>
+        <select id="fromMonth" class="filter-select">
+            {% for m in months %}
+            <option value="{{ loop.index0 }}">{{ m }}</option>
+            {% endfor %}
+        </select>
+        <span class="filter-label" style="margin-left: 8px;">to:</span>
+        <select id="toMonth" class="filter-select">
+            {% for m in months %}
+            <option value="{{ loop.index0 }}">{{ m }}</option>
+            {% endfor %}
+        </select>
+        <button type="button" onclick="applyMonthFilter()" class="filter-select" style="cursor: pointer;">Apply</button>
+        <button type="button" onclick="resetMonthFilter()" class="filter-select" style="cursor: pointer;">All</button>
     </div>
 
     <div class="table-container">
@@ -449,7 +537,7 @@
                 <tr>
                     <th>Member</th>
                     {% for m in months %}
-                    <th>{{ m }}</th>
+                    <th data-month-idx="{{ loop.index0 }}">{{ m }}</th>
                     {% endfor %}
                     <th>Balance</th>
                 </tr>
@@ -462,24 +550,36 @@
                         <span class="info-icon" onclick="showMemberDetails('{{ row.name|e }}')">[i]</span>
                     </td>
                     {% for cell in row.months %}
-                    <td
-                        class="{% if cell.status == 'empty' %}cell-empty{% elif cell.status == 'unpaid' or cell.status == 'partial' %}cell-unpaid{% elif cell.status == 'ok' %}cell-ok{% endif %}">
+                    <td data-month-idx="{{ loop.index0 }}" title="{{ cell.tooltip }}"
+                        class="{% if cell.status == 'empty' %}cell-empty{% elif (cell.status == 'unpaid' or cell.status == 'partial') and cell.raw_month >= current_month %}cell-unpaid-current{% elif cell.status == 'unpaid' or cell.status == 'partial' %}cell-unpaid{% elif cell.status == 'ok' %}cell-ok{% endif %}{% if cell.overridden %} cell-overridden{% endif %}">
                         {{ cell.text }}
-                        {% if cell.status == 'unpaid' or cell.status == 'partial' %}
+                        {% if (cell.status == 'unpaid' or cell.status == 'partial') and cell.raw_month < current_month %}
                         <button class="pay-btn"
-                            onclick="showPayQR('{{ row.name|e }}', {{ cell.amount }}, '{{ cell.month|e }}')">Pay</button>
+                            onclick="showPayQR('{{ row.name|e }}', {{ cell.amount }}, '{{ cell.month|e }}', '{{ cell.raw_month }}')">Pay</button>
                         {% endif %}
                     </td>
                     {% endfor %}
                     <td class="{% if row.balance > 0 %}balance-pos{% elif row.balance < 0 %}balance-neg{% endif %}" style="position: relative;">
                         {{ "%+d"|format(row.balance) if row.balance != 0 else "0" }}
-                        {% if row.balance < 0 %}
+                        {% if row.payable_amount > 0 %}
                         <button class="pay-btn"
-                            onclick="showPayQR('{{ row.name|e }}', {{ -row.balance }}, '{{ row.unpaid_periods|e }}')">Pay All</button>
+                            onclick="showPayQR('{{ row.name|e }}', {{ row.payable_amount }}, '{{ row.unpaid_periods|e }}', '{{ row.raw_unpaid_periods|e }}')">Pay All</button>
                         {% endif %}
                     </td>
                 </tr>
                 {% endfor %}
+                <tr class="totals-row" style="font-weight: bold; background-color: #111; border-top: 2px solid #333;">
+                    <td style="text-align: left; padding: 6px 8px;">
+                        TOTAL
+                    </td>
+                    {% for t in totals %}
+                    <td data-month-idx="{{ loop.index0 }}" class="{% if t.status == 'ok' %}cell-ok{% elif t.status == 'unpaid' %}cell-unpaid{% elif t.status == 'surplus' %}cell-overridden{% endif %}" style="padding-top: 4px; padding-bottom: 4px;">
+                        <span style="font-size: 0.6em; font-weight: normal; color: #666; text-transform: lowercase; display: block; margin-bottom: 2px;">received / expected</span>
+                        {{ t.text }}
+                    </td>
+                    {% endfor %}
+                    <td></td>
+                </tr>
             </tbody>
         </table>
     </div>
@@ -593,13 +693,23 @@
                     <!-- Filled by JS -->
                 </div>
             </div>
+
+            <div class="modal-section">
+                <div class="modal-section-title">
+                    Raw Payments
+                    <a href="#" id="rawPaymentsToggle" class="raw-toggle" onclick="toggleRawPayments(event)">[show]</a>
+                </div>
+                <div id="modalRawList" class="tx-list" style="display: none;">
+                    <!-- Filled by JS -->
+                </div>
+            </div>
         </div>
     </div>
 
     {% set rt = get_render_time() %}
     <div class="footer"
         onclick="document.getElementById('perf-details').style.display = (document.getElementById('perf-details').style.display === 'block' ? 'none' : 'block')">
-        render time: {{ rt.total }}s
+        {{ build_meta.tag }}@{{ build_meta.commit }} | render time: {{ rt.total }}s
         <div id="perf-details" class="perf-breakdown">
             {{ rt.breakdown }}
         </div>
@@ -609,6 +719,7 @@
         const memberData = {{ member_data| safe }};
         const sortedMonths = {{ raw_months| tojson }};
         const monthLabels = {{ month_labels_json| safe }};
+        const rawPaymentsByPerson = {{ raw_payments_json| safe }};
         let currentMemberName = null;
 
         function showMemberDetails(name) {
@@ -638,9 +749,9 @@
                 let status = '-';
                 let statusClass = '';
                 if (expected > 0 || paid > 0) {
-                    if (paid >= expected && expected > 0) { status = 'OK'; statusClass = 'cell-ok'; }
+                    if (paid >= expected && expected > 0) { status = paid + '/' + expected; statusClass = 'cell-ok'; }
                     else if (paid > 0) { status = paid + '/' + expected; }
-                    else { status = 'UNPAID ' + expected; statusClass = 'cell-unpaid'; }
+                    else { status = '0/' + expected; statusClass = 'cell-unpaid'; }
                 }
 
                 const expectedCell = mdata.exception
@@ -741,9 +852,49 @@
                 });
             }
 
+            // Raw payments (debug) — hidden by default, reset toggle on each open
+            const rawList = document.getElementById('modalRawList');
+            const rawToggle = document.getElementById('rawPaymentsToggle');
+            rawList.style.display = 'none';
+            rawToggle.textContent = '[show]';
+            rawList.innerHTML = '';
+            const rawRows = rawPaymentsByPerson[name] || [];
+            if (rawRows.length === 0) {
+                rawList.innerHTML = '<div style="color: #444; font-style: italic; padding: 10px 0;">No raw payments tied to this member.</div>';
+            } else {
+                rawRows.forEach(tx => {
+                    const inferredNote = tx.inferred_amount && tx.inferred_amount !== '' && tx.inferred_amount != tx.amount
+                        ? ` <span style="color:#888;">(inferred: ${tx.inferred_amount})</span>`
+                        : '';
+                    const manualNote = tx.manual_fix ? ' <span style="color:#ffaa00;">[manual fix]</span>' : '';
+                    const bankIdNote = tx.bank_id ? `<span style="color:#444;"> · bank_id: ${tx.bank_id}</span>` : '';
+                    const item = document.createElement('div');
+                    item.className = 'tx-item';
+                    item.innerHTML = `
+                        <div class="tx-meta">${tx.date} | purpose: ${tx.purpose || '—'}${manualNote}</div>
+                        <div class="tx-main">
+                            <span class="tx-amount">${tx.amount} CZK${inferredNote}</span>
+                            <span class="tx-sender">${tx.sender || ''}</span>
+                        </div>
+                        <div class="tx-msg">${tx.message || ''}</div>
+                        <div class="tx-meta">${tx.person || ''}${bankIdNote}</div>
+                    `;
+                    rawList.appendChild(item);
+                });
+            }
+
             document.getElementById('memberModal').classList.add('active');
         }
 
+        function toggleRawPayments(ev) {
+            ev.preventDefault();
+            const list = document.getElementById('modalRawList');
+            const link = document.getElementById('rawPaymentsToggle');
+            const hidden = list.style.display === 'none';
+            list.style.display = hidden ? 'block' : 'none';
+            link.textContent = hidden ? '[hide]' : '[show]';
+        }
+
         function closeModal(id) {
             if (id) {
                 document.getElementById(id).style.display = 'none';
@@ -809,9 +960,13 @@
                 showMemberDetails(nextName);
             }
         }
-        function showPayQR(name, amount, month) {
+        function showPayQR(name, amount, month, rawMonth) {
             const account = "{{ bank_account }}";
-            const message = `${name} / ${month}`;
+            // Convert YYYY-MM to MM/YYYY for infer_payments.py compatibility
+            const numericMonth = rawMonth.includes('+')
+                ? rawMonth.split('+').map(p => p.replace(/(\d{4})-(\d{2})/, '$2/$1')).join('+')
+                : rawMonth.replace(/(\d{4})-(\d{2})/, '$2/$1');
+            const message = `${name}: ${numericMonth}`;
             const qrTitle = document.getElementById('qrTitle');
             const qrImg = document.getElementById('qrImg');
             const qrAccount = document.getElementById('qrAccount');
@@ -836,6 +991,64 @@
                 event.target.style.display = 'none';
             }
         }
+
+        // Month range filter
+        var maxMonthIdx;
+
+        function applyMonthFilter() {
+            var fromIdx = parseInt(document.getElementById('fromMonth').value);
+            var toIdx = parseInt(document.getElementById('toMonth').value);
+            document.querySelectorAll('[data-month-idx]').forEach(function(el) {
+                var idx = parseInt(el.getAttribute('data-month-idx'));
+                if (idx >= fromIdx && idx <= toIdx) {
+                    el.classList.remove('month-hidden');
+                } else {
+                    el.classList.add('month-hidden');
+                }
+            });
+        }
+
+        function resetMonthFilter() {
+            var fromSelect = document.getElementById('fromMonth');
+            var toSelect = document.getElementById('toMonth');
+            fromSelect.value = 0;
+            toSelect.value = maxMonthIdx;
+            applyMonthFilter();
+        }
+
+        // Remove future months from selects, set defaults, apply on load
+        (function() {
+            var now = new Date();
+            var currentMonth = now.getFullYear() + '-' + String(now.getMonth() + 1).padStart(2, '0');
+            maxMonthIdx = sortedMonths.length - 1;
+            for (var i = 0; i < sortedMonths.length; i++) {
+                if (sortedMonths[i] > currentMonth) {
+                    maxMonthIdx = i - 1;
+                    break;
+                }
+            }
+
+            var fromSelect = document.getElementById('fromMonth');
+            var toSelect = document.getElementById('toMonth');
+
+            // Remove future month options
+            for (var i = fromSelect.options.length - 1; i > maxMonthIdx; i--) {
+                fromSelect.remove(i);
+                toSelect.remove(i);
+            }
+
+            // Hide future month columns permanently
+            document.querySelectorAll('[data-month-idx]').forEach(function(el) {
+                if (parseInt(el.getAttribute('data-month-idx')) > maxMonthIdx) {
+                    el.classList.add('month-hidden');
+                }
+            });
+
+            var defaultFrom = Math.max(0, maxMonthIdx - 4);
+            fromSelect.value = defaultFrom;
+            toSelect.value = maxMonthIdx;
+            applyMonthFilter();
+        })();
     </script>
 </body>
 

templates/fees-juniors.html

@@ -1,216 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>FUJ Junior Fees Dashboard</title>
-    <style>
-        body {
-            font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
-            background-color: #0c0c0c;
-            color: #cccccc;
-            padding: 10px;
-            margin: 0;
-            display: flex;
-            flex-direction: column;
-            align-items: center;
-            font-size: 11px;
-            line-height: 1.2;
-        }
-
-        h1 {
-            color: #00ff00;
-            font-family: inherit;
-            margin-top: 10px;
-            margin-bottom: 20px;
-            text-transform: uppercase;
-            letter-spacing: 1px;
-            font-size: 14px;
-        }
-
-        .table-container {
-            background-color: transparent;
-            border: 1px solid #333;
-            box-shadow: none;
-            overflow-x: auto;
-            width: 100%;
-            max-width: 1200px;
-        }
-
-        table {
-            border-collapse: collapse;
-            width: 100%;
-            table-layout: auto;
-        }
-
-        th,
-        td {
-            padding: 2px 8px;
-            text-align: right;
-            border-bottom: 1px dashed #222;
-            white-space: nowrap;
-        }
-
-        th:first-child,
-        td:first-child {
-            text-align: left;
-        }
-
-        th {
-            background-color: transparent;
-            color: #888888;
-            font-weight: normal;
-            border-bottom: 1px solid #555;
-            text-transform: lowercase;
-        }
-
-        tr:hover {
-            background-color: #1a1a1a;
-        }
-
-        .total {
-            font-weight: bold;
-            background-color: transparent;
-            color: #00ff00;
-            border-top: 1px solid #555;
-        }
-
-        .total:hover {
-            background-color: transparent;
-        }
-
-        .cell-empty {
-            color: #444444;
-        }
-
-        .cell-paid {
-            color: #aaaaaa;
-        }
-
-        .cell-overridden {
-            color: #ffa500 !important;
-        }
-
-        .nav {
-            margin-bottom: 20px;
-            font-size: 12px;
-            color: #555;
-            display: flex;
-            gap: 15px;
-        }
-
-        .nav a {
-            color: #00ff00;
-            text-decoration: none;
-            padding: 2px 8px;
-            border: 1px solid #333;
-        }
-
-        .nav a.active {
-            color: #000;
-            background-color: #00ff00;
-            border-color: #00ff00;
-        }
-
-        .nav a:hover {
-            color: #fff;
-            border-color: #555;
-        }
-
-        .description {
-            margin-bottom: 20px;
-            text-align: center;
-            color: #888;
-            max-width: 800px;
-        }
-
-        .description a {
-            color: #00ff00;
-            text-decoration: none;
-        }
-
-        .description a:hover {
-            text-decoration: underline;
-        }
-
-        .footer {
-            margin-top: 50px;
-            margin-bottom: 20px;
-            color: #333;
-            font-size: 9px;
-            text-align: center;
-            width: 100%;
-            cursor: pointer;
-            user-select: none;
-        }
-
-        .perf-breakdown {
-            display: none;
-            margin-top: 5px;
-            color: #222;
-        }
-    </style>
-</head>
-
-<body>
-    <div class="nav">
-        <a href="/fees">[Adult - Attendance/Fees]</a>
-        <a href="/fees-juniors" class="active">[Junior Attendance/Fees]</a>
-        <a href="/reconcile">[Adult Payment Reconciliation]</a>
-        <a href="/reconcile-juniors">[Junior Payment Reconciliation]</a>
-        <a href="/payments">[Payments Ledger]</a>
-    </div>
-
-    <h1>FUJ Junior Fees Dashboard</h1>
-
-    <div class="description">
-        Calculated monthly fees based on attendance markers.<br>
-        Source: <a href="{{ attendance_url }}" target="_blank">Junior Attendance Sheet</a> |
-        <a href="{{ payments_url }}" target="_blank">Payments Ledger</a>
-    </div>
-
-    <div class="table-container">
-        <table>
-            <thead>
-                <tr>
-                    <th>Member</th>
-                    {% for m in months %}
-                    <th>{{ m }}</th>
-                    {% endfor %}
-                </tr>
-            </thead>
-            <tbody>
-                {% for row in results %}
-                <tr>
-                    <td>{{ row.name }}</td>
-                    {% for mdata in row.months %}
-                    <td
-                        class="{% if mdata.cell == '-' %}cell-empty{% elif mdata.overridden %}cell-overridden{% else %}cell-paid{% endif %}">
-                        {{ mdata.cell }}
-                    </td>
-                    {% endfor %}
-                </tr>
-                {% endfor %}
-            </tbody>
-            <tfoot>
-                <tr class="total">
-                    <td>TOTAL</td>
-                    {% for t in totals %}
-                    <td>{{ t }}</td>
-                    {% endfor %}
-                </tr>
-            </tfoot>
-        </table>
-    </div>
-    {% set rt = get_render_time() %}
-    <div class="footer"
-        onclick="document.getElementById('perf-details').style.display = (document.getElementById('perf-details').style.display === 'block' ? 'none' : 'block')">
-        render time: {{ rt.total }}s
-        <div id="perf-details" class="perf-breakdown">
-            {{ rt.breakdown }}
-        </div>
-    </div>
-</body>
-
-</html>

templates/fees.html

@@ -1,231 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>FUJ Fees Dashboard</title>
-    <style>
-        body {
-            font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
-            background-color: #0c0c0c;
-            /* Deeper black */
-            color: #cccccc;
-            /* Base gray terminal text */
-            padding: 10px;
-            margin: 0;
-            display: flex;
-            flex-direction: column;
-            align-items: center;
-            font-size: 11px;
-            /* Even smaller font */
-            line-height: 1.2;
-        }
-
-        h1 {
-            color: #00ff00;
-            /* Terminal green */
-            font-family: inherit;
-            /* Use monospace for header too */
-            margin-top: 10px;
-            margin-bottom: 20px;
-            text-transform: uppercase;
-            letter-spacing: 1px;
-            font-size: 14px;
-        }
-
-        .table-container {
-            background-color: transparent;
-            /* Remove the card background */
-            border: 1px solid #333;
-            /* Just a thin outline if needed, or none */
-            box-shadow: none;
-            overflow-x: auto;
-            width: 100%;
-            max-width: 1200px;
-        }
-
-        table {
-            border-collapse: collapse;
-            width: 100%;
-            table-layout: auto;
-        }
-
-        th,
-        td {
-            padding: 2px 8px;
-            /* Extremely tight padding */
-            text-align: right;
-            border-bottom: 1px dashed #222;
-            /* Dashed lines for terminal feel */
-            white-space: nowrap;
-        }
-
-        th:first-child,
-        td:first-child {
-            text-align: left;
-        }
-
-        th {
-            background-color: transparent;
-            color: #888888;
-            font-weight: normal;
-            border-bottom: 1px solid #555;
-            /* Stronger border for header */
-            text-transform: lowercase;
-        }
-
-        tr:hover {
-            background-color: #1a1a1a;
-            /* Very subtle hover */
-        }
-
-        .total {
-            font-weight: bold;
-            background-color: transparent;
-            color: #00ff00;
-            /* Highlight total row */
-            border-top: 1px solid #555;
-        }
-
-        .total:hover {
-            background-color: transparent;
-        }
-
-        .cell-empty {
-            color: #444444;
-            /* Darker gray for empty cells */
-        }
-
-        .cell-paid {
-            color: #aaaaaa;
-            /* Light gray for normal cells */
-        }
-
-        .cell-overridden {
-            color: #ffa500 !important;
-            /* Orange for overrides */
-        }
-
-        .nav {
-            margin-bottom: 20px;
-            font-size: 12px;
-            color: #555;
-            display: flex;
-            gap: 15px;
-        }
-
-        .nav a {
-            color: #00ff00;
-            text-decoration: none;
-            padding: 2px 8px;
-            border: 1px solid #333;
-        }
-
-        .nav a.active {
-            color: #000;
-            background-color: #00ff00;
-            border-color: #00ff00;
-        }
-
-        .nav a:hover {
-            color: #fff;
-            border-color: #555;
-        }
-
-        .description {
-            margin-bottom: 20px;
-            text-align: center;
-            color: #888;
-            max-width: 800px;
-        }
-
-        .description a {
-            color: #00ff00;
-            text-decoration: none;
-        }
-
-        .description a:hover {
-            text-decoration: underline;
-        }
-
-        .footer {
-            margin-top: 50px;
-            margin-bottom: 20px;
-            color: #333;
-            font-size: 9px;
-            text-align: center;
-            width: 100%;
-            cursor: pointer;
-            user-select: none;
-        }
-
-        .perf-breakdown {
-            display: none;
-            margin-top: 5px;
-            color: #222;
-        }
-    </style>
-</head>
-
-<body>
-    <div class="nav">
-        <a href="/fees" class="active">[Adult - Attendance/Fees]</a>
-        <a href="/fees-juniors">[Junior Attendance/Fees]</a>
-        <a href="/reconcile">[Adult Payment Reconciliation]</a>
-        <a href="/reconcile-juniors">[Junior Payment Reconciliation]</a>
-        <a href="/payments">[Payments Ledger]</a>
-    </div>
-
-    <h1>FUJ Fees Dashboard</h1>
-
-    <div class="description">
-        Calculated monthly fees based on attendance markers.<br>
-        Source: <a href="{{ attendance_url }}" target="_blank">Attendance Sheet</a> |
-        <a href="{{ payments_url }}" target="_blank">Payments Ledger</a>
-    </div>
-
-    <div class="table-container">
-        <table>
-            <thead>
-                <tr>
-                    <th>Member</th>
-                    {% for m in months %}
-                    <th>{{ m }}</th>
-                    {% endfor %}
-                </tr>
-            </thead>
-            <tbody>
-                {% for row in results %}
-                <tr>
-                    <td>{{ row.name }}</td>
-                    {% for mdata in row.months %}
-                    <td
-                        class="{% if mdata.cell == '-' %}cell-empty{% elif mdata.overridden %}cell-overridden{% else %}cell-paid{% endif %}">
-                        {{ mdata.cell }}
-                    </td>
-                    {% endfor %}
-                </tr>
-                {% endfor %}
-            </tbody>
-            <tfoot>
-                <tr class="total">
-                    <td>TOTAL</td>
-                    {% for t in totals %}
-                    <td>{{ t }}</td>
-                    {% endfor %}
-                </tr>
-            </tfoot>
-        </table>
-    </div>
-    {% set rt = get_render_time() %}
-    <div class="footer"
-        onclick="document.getElementById('perf-details').style.display = (document.getElementById('perf-details').style.display === 'block' ? 'none' : 'block')">
-        render time: {{ rt.total }}s
-        <div id="perf-details" class="perf-breakdown">
-            {{ rt.breakdown }}
-        </div>
-    </div>
-</body>
-
-</html>

templates/flush-cache.html

@@ -0,0 +1,163 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>FUJ - Flush Cache</title>
+    <style>
+        body {
+            font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+            background-color: #0c0c0c;
+            color: #cccccc;
+            padding: 10px;
+            margin: 0;
+            display: flex;
+            flex-direction: column;
+            align-items: center;
+            font-size: 11px;
+            line-height: 1.2;
+        }
+
+        h1 {
+            color: #00ff00;
+            font-family: inherit;
+            margin-top: 10px;
+            margin-bottom: 20px;
+            text-transform: uppercase;
+            letter-spacing: 1px;
+            font-size: 14px;
+        }
+
+        .nav {
+            margin-bottom: 20px;
+            font-size: 12px;
+            color: #555;
+            display: flex;
+            flex-direction: column;
+            gap: 10px;
+            align-items: center;
+        }
+
+        .nav > div {
+            display: flex;
+            gap: 15px;
+            align-items: center;
+        }
+
+        .nav a {
+            color: #00ff00;
+            text-decoration: none;
+            padding: 2px 8px;
+            border: 1px solid #333;
+        }
+
+        .nav a.active {
+            color: #000;
+            background-color: #00ff00;
+            border-color: #00ff00;
+        }
+
+        .nav a:hover {
+            color: #fff;
+            border-color: #555;
+        }
+
+        .nav-archived a {
+            font-size: 10px;
+            color: #666;
+            border-color: #222;
+        }
+
+        .nav-archived a.active {
+            color: #ccc;
+            background-color: #333;
+            border-color: #555;
+        }
+
+        .nav-archived a:hover {
+            color: #999;
+            border-color: #444;
+        }
+
+        .flush-container {
+            background-color: #111;
+            border: 1px solid #333;
+            padding: 30px;
+            width: 100%;
+            max-width: 600px;
+            margin-bottom: 30px;
+            text-align: center;
+        }
+
+        .flush-btn {
+            font-family: inherit;
+            font-size: 12px;
+            color: #00ff00;
+            background-color: #1a1a1a;
+            border: 1px solid #00ff00;
+            padding: 8px 24px;
+            cursor: pointer;
+            text-transform: uppercase;
+            letter-spacing: 1px;
+        }
+
+        .flush-btn:hover {
+            background-color: #00ff00;
+            color: #000;
+        }
+
+        .status {
+            margin-bottom: 15px;
+            font-size: 12px;
+        }
+
+        .status-ok { color: #00ff00; }
+
+        .footer {
+            text-align: center;
+            color: #333;
+            margin-top: 20px;
+            font-size: 10px;
+        }
+    </style>
+</head>
+
+<body>
+    <div class="nav">
+        <div>
+            <a href="/adults">[Adults]</a>
+            <a href="/juniors">[Juniors]</a>
+        </div>
+        <div class="nav-archived">
+            <span style="color: #666; margin-right: 5px;">Archived:</span>
+            <a href="/payments">[Payments Ledger]</a>
+        </div>
+        <div class="nav-archived">
+            <span style="color: #666; margin-right: 5px;">Tools:</span>
+            <a href="/sync-bank">[Sync Bank Data]</a>
+            <a href="/flush-cache" class="active">[Flush Cache]</a>
+        </div>
+    </div>
+
+    <h1>Flush Cache</h1>
+
+    {% if flushed %}
+    <div class="status">
+        <span class="status-ok">Cache flushed successfully. {{ deleted }} file(s) deleted.</span>
+    </div>
+    {% endif %}
+
+    <div class="flush-container">
+        <p style="margin-bottom: 20px; color: #888;">Clears all cached Google Sheets data and resets refresh timers.</p>
+        <form method="POST" action="/flush-cache">
+            <button type="submit" class="flush-btn">[Flush Cache]</button>
+        </form>
+    </div>
+
+    <div class="footer">
+        {{ build_meta.tag }} | {{ build_meta.commit }} | {{ build_meta.build_date }}
+    </div>
+</body>
+
+</html>

templates/juniors.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>FUJ Junior Payment Reconciliation</title>
+    <title>FUJ Juniors Dashboard</title>
     <style>
         body {
             font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
@@ -45,8 +45,16 @@
             margin-bottom: 20px;
             font-size: 12px;
             color: #555;
+            display: flex;
+            flex-direction: column;
+            gap: 10px;
+            align-items: center;
+        }
+
+        .nav > div {
             display: flex;
             gap: 15px;
+            align-items: center;
         }
 
         .nav a {
@@ -67,6 +75,23 @@
             border-color: #555;
         }
 
+        .nav-archived a {
+            font-size: 10px;
+            color: #666;
+            border-color: #222;
+        }
+
+        .nav-archived a.active {
+            color: #ccc;
+            background-color: #333;
+            border-color: #555;
+        }
+
+        .nav-archived a:hover {
+            color: #999;
+            border-color: #444;
+        }
+
         .description {
             margin-bottom: 20px;
             text-align: center;
@@ -142,6 +167,16 @@
             position: relative;
         }
 
+        .cell-unpaid-current {
+            color: #994444;
+            background-color: rgba(153, 68, 68, 0.05);
+            position: relative;
+        }
+
+        .cell-overridden {
+            color: #ffa500 !important;
+        }
+
         .pay-btn {
             display: none;
             position: absolute;
@@ -230,6 +265,24 @@
             border-color: #00ff00;
         }
 
+        .filter-select {
+            background-color: #1a1a1a;
+            border: 1px solid #333;
+            color: #00ff00;
+            font-family: inherit;
+            font-size: 11px;
+            padding: 4px 8px;
+            outline: none;
+        }
+
+        .filter-select:focus {
+            border-color: #00ff00;
+        }
+
+        .month-hidden {
+            display: none !important;
+        }
+
         .filter-label {
             color: #888;
             text-transform: lowercase;
@@ -312,6 +365,19 @@
             border-bottom: 1px dashed #222;
         }
 
+        .raw-toggle {
+            color: #333;
+            font-size: 9px;
+            text-transform: lowercase;
+            margin-left: 8px;
+            text-decoration: none;
+            letter-spacing: 0;
+        }
+
+        .raw-toggle:hover {
+            color: #666;
+        }
+
         .modal-table {
             width: 100%;
             border-collapse: collapse;
@@ -423,17 +489,25 @@
 
 <body>
     <div class="nav">
-        <a href="/fees">[Adult - Attendance/Fees]</a>
-        <a href="/fees-juniors">[Junior Attendance/Fees]</a>
-        <a href="/reconcile">[Adult Payment Reconciliation]</a>
-        <a href="/reconcile-juniors" class="active">[Junior Payment Reconciliation]</a>
-        <a href="/payments">[Payments Ledger]</a>
+        <div>
+            <a href="/adults">[Adults]</a>
+            <a href="/juniors" class="active">[Juniors]</a>
+        </div>
+        <div class="nav-archived">
+            <span style="color: #666; margin-right: 5px;">Archived:</span>
+            <a href="/payments">[Payments Ledger]</a>
+        </div>
+        <div class="nav-archived">
+            <span style="color: #666; margin-right: 5px;">Tools:</span>
+            <a href="/sync-bank">[Sync Bank Data]</a>
+            <a href="/flush-cache">[Flush Cache]</a>
+        </div>
     </div>
 
-    <h1>Junior Payment Reconciliation</h1>
+    <h1>Juniors Dashboard</h1>
 
     <div class="description">
-        Balances calculated by matching Google Sheet payments against junior attendance fees.<br>
+        Balances calculated by matching Google Sheet payments against attendance fees.<br>
         Source: <a href="{{ attendance_url }}" target="_blank">Attendance Sheet</a> |
         <a href="{{ payments_url }}" target="_blank">Payments Ledger</a>
     </div>
@@ -441,6 +515,20 @@
     <div class="filter-container">
         <span class="filter-label">search member:</span>
         <input type="text" id="nameFilter" class="filter-input" placeholder="..." autocomplete="off">
+        <span class="filter-label" style="margin-left: 16px;">from:</span>
+        <select id="fromMonth" class="filter-select">
+            {% for m in months %}
+            <option value="{{ loop.index0 }}">{{ m }}</option>
+            {% endfor %}
+        </select>
+        <span class="filter-label" style="margin-left: 8px;">to:</span>
+        <select id="toMonth" class="filter-select">
+            {% for m in months %}
+            <option value="{{ loop.index0 }}">{{ m }}</option>
+            {% endfor %}
+        </select>
+        <button type="button" onclick="applyMonthFilter()" class="filter-select" style="cursor: pointer;">Apply</button>
+        <button type="button" onclick="resetMonthFilter()" class="filter-select" style="cursor: pointer;">All</button>
     </div>
 
     <div class="table-container">
@@ -449,7 +537,7 @@
                 <tr>
                     <th>Member</th>
                     {% for m in months %}
-                    <th>{{ m }}</th>
+                    <th data-month-idx="{{ loop.index0 }}">{{ m }}</th>
                     {% endfor %}
                     <th>Balance</th>
                 </tr>
@@ -462,24 +550,36 @@
                         <span class="info-icon" onclick="showMemberDetails('{{ row.name|e }}')">[i]</span>
                     </td>
                     {% for cell in row.months %}
-                    <td
-                        class="{% if cell.status == 'empty' %}cell-empty{% elif cell.status == 'unpaid' or cell.status == 'partial' %}cell-unpaid{% elif cell.status == 'ok' %}cell-ok{% endif %}">
+                    <td data-month-idx="{{ loop.index0 }}" title="{{ cell.tooltip }}"
+                        class="{% if cell.status == 'empty' %}cell-empty{% elif (cell.status == 'unpaid' or cell.status == 'partial') and cell.raw_month >= current_month %}cell-unpaid-current{% elif cell.status == 'unpaid' or cell.status == 'partial' %}cell-unpaid{% elif cell.status == 'ok' %}cell-ok{% endif %}{% if cell.overridden %} cell-overridden{% endif %}">
                         {{ cell.text }}
-                        {% if cell.status == 'unpaid' or cell.status == 'partial' %}
+                        {% if (cell.status == 'unpaid' or cell.status == 'partial') and cell.raw_month < current_month %}
                         <button class="pay-btn"
-                            onclick="showPayQR('{{ row.name|e }}', {{ cell.amount }}, '{{ cell.month|e }}')">Pay</button>
+                            onclick="showPayQR('{{ row.name|e }}', {{ cell.amount }}, '{{ cell.month|e }}', '{{ cell.raw_month }}')">Pay</button>
                         {% endif %}
                     </td>
                     {% endfor %}
                     <td class="{% if row.balance > 0 %}balance-pos{% elif row.balance < 0 %}balance-neg{% endif %}" style="position: relative;">
                         {{ "%+d"|format(row.balance) if row.balance != 0 else "0" }}
-                        {% if row.balance < 0 %}
+                        {% if row.payable_amount > 0 %}
                         <button class="pay-btn"
-                            onclick="showPayQR('{{ row.name|e }}', {{ -row.balance }}, '{{ row.unpaid_periods|e }}')">Pay All</button>
+                            onclick="showPayQR('{{ row.name|e }}', {{ row.payable_amount }}, '{{ row.unpaid_periods|e }}', '{{ row.raw_unpaid_periods|e }}')">Pay All</button>
                         {% endif %}
                     </td>
                 </tr>
                 {% endfor %}
+                <tr class="totals-row" style="font-weight: bold; background-color: #111; border-top: 2px solid #333;">
+                    <td style="text-align: left; padding: 6px 8px;">
+                        TOTAL
+                    </td>
+                    {% for t in totals %}
+                    <td data-month-idx="{{ loop.index0 }}" class="{% if t.status == 'ok' %}cell-ok{% elif t.status == 'unpaid' %}cell-unpaid{% elif t.status == 'surplus' %}cell-overridden{% endif %}" style="padding-top: 4px; padding-bottom: 4px;">
+                        <span style="font-size: 0.6em; font-weight: normal; color: #666; text-transform: lowercase; display: block; margin-bottom: 2px;">received / expected</span>
+                        {{ t.text }}
+                    </td>
+                    {% endfor %}
+                    <td></td>
+                </tr>
             </tbody>
         </table>
     </div>
@@ -508,25 +608,6 @@
     </div>
     {% endif %}
 
-    {% if unmatched %}
-    <h2>Unmatched Transactions</h2>
-    <div class="list-container">
-        <div class="unmatched-row unmatched-header">
-            <span>Date</span>
-            <span>Amount</span>
-            <span>Sender</span>
-            <span>Message</span>
-        </div>
-        {% for tx in unmatched %}
-        <div class="unmatched-row">
-            <span>{{ tx.date }}</span>
-            <span>{{ tx.amount }}</span>
-            <span>{{ tx.sender }}</span>
-            <span>{{ tx.message }}</span>
-        </div>
-        {% endfor %}
-    </div>
-    {% endif %}
 
     <!-- QR Code Modal -->
     <div id="qrModal" class="modal"
@@ -593,13 +674,23 @@
                     <!-- Filled by JS -->
                 </div>
             </div>
+
+            <div class="modal-section">
+                <div class="modal-section-title">
+                    Raw Payments
+                    <a href="#" id="rawPaymentsToggle" class="raw-toggle" onclick="toggleRawPayments(event)">[show]</a>
+                </div>
+                <div id="modalRawList" class="tx-list" style="display: none;">
+                    <!-- Filled by JS -->
+                </div>
+            </div>
         </div>
     </div>
 
     {% set rt = get_render_time() %}
     <div class="footer"
         onclick="document.getElementById('perf-details').style.display = (document.getElementById('perf-details').style.display === 'block' ? 'none' : 'block')">
-        render time: {{ rt.total }}s
+        {{ build_meta.tag }}@{{ build_meta.commit }} | render time: {{ rt.total }}s
         <div id="perf-details" class="perf-breakdown">
             {{ rt.breakdown }}
         </div>
@@ -609,6 +700,7 @@
         const memberData = {{ member_data| safe }};
         const sortedMonths = {{ raw_months| tojson }};
         const monthLabels = {{ month_labels_json| safe }};
+        const rawPaymentsByPerson = {{ raw_payments_json| safe }};
         let currentMemberName = null;
 
         function showMemberDetails(name) {
@@ -638,9 +730,9 @@
                 let status = '-';
                 let statusClass = '';
                 if (expected > 0 || paid > 0) {
-                    if (paid >= expected && expected > 0) { status = 'OK'; statusClass = 'cell-ok'; }
+                    if (paid >= expected && expected > 0) { status = paid + '/' + expected; statusClass = 'cell-ok'; }
                     else if (paid > 0) { status = paid + '/' + expected; }
-                    else { status = 'UNPAID ' + expected; statusClass = 'cell-unpaid'; }
+                    else { status = '0/' + expected; statusClass = 'cell-unpaid'; }
                 }
 
                 const expectedCell = mdata.exception
@@ -741,9 +833,49 @@
                 });
             }
 
+            // Raw payments (debug) — hidden by default, reset toggle on each open
+            const rawList = document.getElementById('modalRawList');
+            const rawToggle = document.getElementById('rawPaymentsToggle');
+            rawList.style.display = 'none';
+            rawToggle.textContent = '[show]';
+            rawList.innerHTML = '';
+            const rawRows = rawPaymentsByPerson[name] || [];
+            if (rawRows.length === 0) {
+                rawList.innerHTML = '<div style="color: #444; font-style: italic; padding: 10px 0;">No raw payments tied to this member.</div>';
+            } else {
+                rawRows.forEach(tx => {
+                    const inferredNote = tx.inferred_amount && tx.inferred_amount !== '' && tx.inferred_amount != tx.amount
+                        ? ` <span style="color:#888;">(inferred: ${tx.inferred_amount})</span>`
+                        : '';
+                    const manualNote = tx.manual_fix ? ' <span style="color:#ffaa00;">[manual fix]</span>' : '';
+                    const bankIdNote = tx.bank_id ? `<span style="color:#444;"> · bank_id: ${tx.bank_id}</span>` : '';
+                    const item = document.createElement('div');
+                    item.className = 'tx-item';
+                    item.innerHTML = `
+                        <div class="tx-meta">${tx.date} | purpose: ${tx.purpose || '—'}${manualNote}</div>
+                        <div class="tx-main">
+                            <span class="tx-amount">${tx.amount} CZK${inferredNote}</span>
+                            <span class="tx-sender">${tx.sender || ''}</span>
+                        </div>
+                        <div class="tx-msg">${tx.message || ''}</div>
+                        <div class="tx-meta">${tx.person || ''}${bankIdNote}</div>
+                    `;
+                    rawList.appendChild(item);
+                });
+            }
+
             document.getElementById('memberModal').classList.add('active');
         }
 
+        function toggleRawPayments(ev) {
+            ev.preventDefault();
+            const list = document.getElementById('modalRawList');
+            const link = document.getElementById('rawPaymentsToggle');
+            const hidden = list.style.display === 'none';
+            list.style.display = hidden ? 'block' : 'none';
+            link.textContent = hidden ? '[hide]' : '[show]';
+        }
+
         function closeModal(id) {
             if (id) {
                 document.getElementById(id).style.display = 'none';
@@ -809,9 +941,13 @@
                 showMemberDetails(nextName);
             }
         }
-        function showPayQR(name, amount, month) {
+        function showPayQR(name, amount, month, rawMonth) {
             const account = "{{ bank_account }}";
-            const message = `${name} / ${month}`;
+            // Convert YYYY-MM to MM/YYYY for infer_payments.py compatibility
+            const numericMonth = rawMonth.includes('+')
+                ? rawMonth.split('+').map(p => p.replace(/(\d{4})-(\d{2})/, '$2/$1')).join('+')
+                : rawMonth.replace(/(\d{4})-(\d{2})/, '$2/$1');
+            const message = `${name}: ${numericMonth}`;
             const qrTitle = document.getElementById('qrTitle');
             const qrImg = document.getElementById('qrImg');
             const qrAccount = document.getElementById('qrAccount');
@@ -836,6 +972,64 @@
                 event.target.style.display = 'none';
             }
         }
+
+        // Month range filter
+        var maxMonthIdx;
+
+        function applyMonthFilter() {
+            var fromIdx = parseInt(document.getElementById('fromMonth').value);
+            var toIdx = parseInt(document.getElementById('toMonth').value);
+            document.querySelectorAll('[data-month-idx]').forEach(function(el) {
+                var idx = parseInt(el.getAttribute('data-month-idx'));
+                if (idx >= fromIdx && idx <= toIdx) {
+                    el.classList.remove('month-hidden');
+                } else {
+                    el.classList.add('month-hidden');
+                }
+            });
+        }
+
+        function resetMonthFilter() {
+            var fromSelect = document.getElementById('fromMonth');
+            var toSelect = document.getElementById('toMonth');
+            fromSelect.value = 0;
+            toSelect.value = maxMonthIdx;
+            applyMonthFilter();
+        }
+
+        // Remove future months from selects, set defaults, apply on load
+        (function() {
+            var now = new Date();
+            var currentMonth = now.getFullYear() + '-' + String(now.getMonth() + 1).padStart(2, '0');
+            maxMonthIdx = sortedMonths.length - 1;
+            for (var i = 0; i < sortedMonths.length; i++) {
+                if (sortedMonths[i] > currentMonth) {
+                    maxMonthIdx = i - 1;
+                    break;
+                }
+            }
+
+            var fromSelect = document.getElementById('fromMonth');
+            var toSelect = document.getElementById('toMonth');
+
+            // Remove future month options
+            for (var i = fromSelect.options.length - 1; i > maxMonthIdx; i--) {
+                fromSelect.remove(i);
+                toSelect.remove(i);
+            }
+
+            // Hide future month columns permanently
+            document.querySelectorAll('[data-month-idx]').forEach(function(el) {
+                if (parseInt(el.getAttribute('data-month-idx')) > maxMonthIdx) {
+                    el.classList.add('month-hidden');
+                }
+            });
+
+            var defaultFrom = Math.max(0, maxMonthIdx - 4);
+            fromSelect.value = defaultFrom;
+            toSelect.value = maxMonthIdx;
+            applyMonthFilter();
+        })();
     </script>
 </body>
 

templates/payments.html

@@ -45,8 +45,16 @@
             margin-bottom: 20px;
             font-size: 12px;
             color: #555;
+            display: flex;
+            flex-direction: column;
+            gap: 10px;
+            align-items: center;
+        }
+
+        .nav > div {
             display: flex;
             gap: 15px;
+            align-items: center;
         }
 
         .nav a {
@@ -67,6 +75,23 @@
             border-color: #555;
         }
 
+        .nav-archived a {
+            font-size: 10px;
+            color: #666;
+            border-color: #222;
+        }
+
+        .nav-archived a.active {
+            color: #ccc;
+            background-color: #333;
+            border-color: #555;
+        }
+
+        .nav-archived a:hover {
+            color: #999;
+            border-color: #444;
+        }
+
         .description {
             margin-bottom: 20px;
             text-align: center;
@@ -159,11 +184,19 @@
 
 <body>
     <div class="nav">
-        <a href="/fees">[Adult - Attendance/Fees]</a>
-        <a href="/fees-juniors">[Junior Attendance/Fees]</a>
-        <a href="/reconcile">[Adult Payment Reconciliation]</a>
-        <a href="/reconcile-juniors">[Junior Payment Reconciliation]</a>
-        <a href="/payments" class="active">[Payments Ledger]</a>
+        <div>
+            <a href="/adults">[Adults]</a>
+            <a href="/juniors">[Juniors]</a>
+        </div>
+        <div class="nav-archived">
+            <span style="color: #666; margin-right: 5px;">Archived:</span>
+            <a href="/payments" class="active">[Payments Ledger]</a>
+        </div>
+        <div class="nav-archived">
+            <span style="color: #666; margin-right: 5px;">Tools:</span>
+            <a href="/sync-bank">[Sync Bank Data]</a>
+            <a href="/flush-cache">[Flush Cache]</a>
+        </div>
     </div>
 
     <h1>Payments Ledger</h1>
@@ -205,7 +238,7 @@
     {% set rt = get_render_time() %}
     <div class="footer"
         onclick="document.getElementById('perf-details').style.display = (document.getElementById('perf-details').style.display === 'block' ? 'none' : 'block')">
-        render time: {{ rt.total }}s
+        {{ build_meta.tag }}@{{ build_meta.commit }} | render time: {{ rt.total }}s
         <div id="perf-details" class="perf-breakdown">
             {{ rt.breakdown }}
         </div>

templates/sync.html

@@ -0,0 +1,153 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>FUJ - Sync Bank Data</title>
+    <style>
+        body {
+            font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+            background-color: #0c0c0c;
+            color: #cccccc;
+            padding: 10px;
+            margin: 0;
+            display: flex;
+            flex-direction: column;
+            align-items: center;
+            font-size: 11px;
+            line-height: 1.2;
+        }
+
+        h1 {
+            color: #00ff00;
+            font-family: inherit;
+            margin-top: 10px;
+            margin-bottom: 20px;
+            text-transform: uppercase;
+            letter-spacing: 1px;
+            font-size: 14px;
+        }
+
+        .nav {
+            margin-bottom: 20px;
+            font-size: 12px;
+            color: #555;
+            display: flex;
+            flex-direction: column;
+            gap: 10px;
+            align-items: center;
+        }
+
+        .nav > div {
+            display: flex;
+            gap: 15px;
+            align-items: center;
+        }
+
+        .nav a {
+            color: #00ff00;
+            text-decoration: none;
+            padding: 2px 8px;
+            border: 1px solid #333;
+        }
+
+        .nav a.active {
+            color: #000;
+            background-color: #00ff00;
+            border-color: #00ff00;
+        }
+
+        .nav a:hover {
+            color: #fff;
+            border-color: #555;
+        }
+
+        .nav-archived a {
+            font-size: 10px;
+            color: #666;
+            border-color: #222;
+        }
+
+        .nav-archived a.active {
+            color: #ccc;
+            background-color: #333;
+            border-color: #555;
+        }
+
+        .nav-archived a:hover {
+            color: #999;
+            border-color: #444;
+        }
+
+        .output-container {
+            background-color: #111;
+            border: 1px solid #333;
+            padding: 15px;
+            width: 100%;
+            max-width: 1200px;
+            margin-bottom: 30px;
+            overflow-x: auto;
+        }
+
+        .output-container pre {
+            margin: 0;
+            white-space: pre-wrap;
+            word-wrap: break-word;
+            color: {% if success %}#cccccc{% else %}#ff6666{% endif %};
+        }
+
+        .status {
+            margin-bottom: 15px;
+            font-size: 12px;
+        }
+
+        .status-ok { color: #00ff00; }
+        .status-error { color: #ff6666; }
+
+        .footer {
+            text-align: center;
+            color: #333;
+            margin-top: 20px;
+            font-size: 10px;
+        }
+    </style>
+</head>
+
+<body>
+    <div class="nav">
+        <div>
+            <a href="/adults">[Adults]</a>
+            <a href="/juniors">[Juniors]</a>
+        </div>
+        <div class="nav-archived">
+            <span style="color: #666; margin-right: 5px;">Archived:</span>
+            <a href="/payments">[Payments Ledger]</a>
+        </div>
+        <div class="nav-archived">
+            <span style="color: #666; margin-right: 5px;">Tools:</span>
+            <a href="/sync-bank" class="active">[Sync Bank Data]</a>
+            <a href="/flush-cache">[Flush Cache]</a>
+        </div>
+    </div>
+
+    <h1>Sync Bank Data</h1>
+
+    <div class="status">
+        {% if success %}
+        <span class="status-ok">Sync completed successfully.</span>
+        {% else %}
+        <span class="status-error">Sync failed - see output below.</span>
+        {% endif %}
+    </div>
+
+    <div class="output-container">
+        <pre>{{ output }}</pre>
+    </div>
+
+    <div class="footer">
+        {{ build_meta.tag }} | {{ build_meta.commit }} | {{ build_meta.build_date }}
+    </div>
+</body>
+
+</html>

tests/test_app.py

@@ -1,83 +1,28 @@
 import unittest
-from unittest.mock import patch, MagicMock
+from unittest.mock import patch
 from app import app
 
+
+def _bypass_cache(cache_key, sheet_id, fetch_func, *args, serialize=None, deserialize=None, **kwargs):
+    """Test helper: call fetch_func directly, bypassing the cache layer."""
+    return fetch_func(*args, **kwargs)
+
+
 class TestWebApp(unittest.TestCase):
     def setUp(self):
-        # Configure app for testing
         app.config['TESTING'] = True
         self.client = app.test_client()
 
-    @patch('app.get_members_with_fees')
-    def test_index_page(self, mock_get_members):
+    def test_index_page(self):
         """Test that / returns the refresh meta tag"""
         response = self.client.get('/')
         self.assertEqual(response.status_code, 200)
-        self.assertIn(b'url=/fees', response.data)
-
-    @patch('app.get_members_with_fees')
-    def test_fees_route(self, mock_get_members):
-        """Test that /fees returns 200 and renders the dashboard"""
-        # Mock attendance data
-        mock_get_members.return_value = (
-            [('Test Member', 'A', {'2026-01': (750, 4)})],
-            ['2026-01']
-        )
-        
-        response = self.client.get('/fees')
-        self.assertEqual(response.status_code, 200)
-        self.assertIn(b'FUJ Fees Dashboard', response.data)
-        self.assertIn(b'Test Member', response.data)
-
-    @patch('app.get_junior_members_with_fees')
-    def test_fees_juniors_route(self, mock_get_junior_members):
-        """Test that /fees-juniors returns 200 and renders the junior dashboard"""
-        # Mock attendance data: one with string symbol '?', one with integer
-        mock_get_junior_members.return_value = (
-            [
-                ('Test Junior 1', 'J', {'2026-01': ('?', 1, 0, 1)}),
-                ('Test Junior 2', 'J', {'2026-01': (500, 4, 1, 3)})
-            ],
-            ['2026-01']
-        )
-        
-        response = self.client.get('/fees-juniors')
-        self.assertEqual(response.status_code, 200)
-        self.assertIn(b'FUJ Junior Fees Dashboard', response.data)
-        self.assertIn(b'Test Junior 1', response.data)
-        self.assertIn(b'? / 1 (J)', response.data)
-        self.assertIn(b'500 CZK / 4 (1A+3J)', response.data)
+        self.assertIn(b'url=/adults', response.data)
 
+    @patch('app.get_cached_data', side_effect=_bypass_cache)
     @patch('app.fetch_sheet_data')
-    @patch('app.get_members_with_fees')
-    def test_reconcile_route(self, mock_get_members, mock_fetch_sheet):
-        """Test that /reconcile returns 200 and shows matches"""
-        # Mock attendance data
-        mock_get_members.return_value = (
-            [('Test Member', 'A', {'2026-01': (750, 4)})],
-            ['2026-01']
-        )
-        # Mock sheet data - include all keys required by reconcile
-        mock_fetch_sheet.return_value = [{
-            'date': '2026-01-01',
-            'amount': 750,
-            'person': 'Test Member',
-            'purpose': '2026-01',
-            'message': 'test payment',
-            'sender': 'External Bank User',
-            'inferred_amount': 750
-        }]
-        
-        response = self.client.get('/reconcile')
-        self.assertEqual(response.status_code, 200)
-        self.assertIn(b'Payment Reconciliation', response.data)
-        self.assertIn(b'Test Member', response.data)
-        self.assertIn(b'OK', response.data)
-
-    @patch('app.fetch_sheet_data')
-    def test_payments_route(self, mock_fetch_sheet):
+    def test_payments_route(self, mock_fetch_sheet, mock_cache):
         """Test that /payments returns 200 and groups transactions"""
-        # Mock sheet data
         mock_fetch_sheet.return_value = [{
             'date': '2026-01-01',
             'amount': 750,
@@ -92,20 +37,48 @@ class TestWebApp(unittest.TestCase):
         self.assertIn(b'Test Member', response.data)
         self.assertIn(b'Direct Member Payment', response.data)
 
+    @patch('app.get_cached_data', side_effect=_bypass_cache)
     @patch('app.fetch_sheet_data')
-    @patch('app.fetch_exceptions')
+    @patch('app.fetch_exceptions', return_value={})
+    @patch('app.get_members_with_fees')
+    def test_adults_route(self, mock_get_members, mock_exceptions, mock_fetch_sheet, mock_cache):
+        """Test that /adults returns 200 and shows combined matches"""
+        mock_get_members.return_value = (
+            [('Test Member', 'A', {'2026-01': (750, 4)})],
+            ['2026-01']
+        )
+        mock_fetch_sheet.return_value = [{
+            'date': '2026-01-01',
+            'amount': 750,
+            'person': 'Test Member',
+            'purpose': '2026-01',
+            'message': 'test payment',
+            'sender': 'External Bank User',
+            'inferred_amount': 750
+        }]
+
+        response = self.client.get('/adults')
+        self.assertEqual(response.status_code, 200)
+        self.assertIn(b'Adults Dashboard', response.data)
+        self.assertIn(b'Test Member', response.data)
+        self.assertNotIn(b'OK', response.data)
+        self.assertIn(b'750/750 CZK (4)', response.data)
+
+    @patch('app.get_cached_data', side_effect=_bypass_cache)
+    @patch('app.fetch_sheet_data')
+    @patch('app.fetch_exceptions', return_value={})
     @patch('app.get_junior_members_with_fees')
-    def test_reconcile_juniors_route(self, mock_get_junior, mock_exceptions, mock_transactions):
-        """Test that /reconcile-juniors correctly computes balances for juniors."""
-        mock_get_junior.return_value = (
+    def test_juniors_route(self, mock_get_junior_members, mock_exceptions, mock_fetch_sheet, mock_cache):
+        """Test that /juniors returns 200, uses single line format, and displays '?' properly"""
+        mock_get_junior_members.return_value = (
             [
-                ('Junior One', 'J', {'2026-01': (500, 4, 2, 2)}),
+                ('Junior One', 'J', {'2026-01': (500, 3, 0, 3)}),
                 ('Junior Two', 'X', {'2026-01': ('?', 1, 0, 1)})
             ],
             ['2026-01']
         )
         mock_exceptions.return_value = {}
-        mock_transactions.return_value = [{
+        mock_fetch_sheet.return_value = [{
             'date': '2026-01-15',
             'amount': 500,
             'person': 'Junior One',
@@ -115,12 +88,13 @@ class TestWebApp(unittest.TestCase):
             'inferred_amount': 500
         }]
         
-        response = self.client.get('/reconcile-juniors')
+        response = self.client.get('/juniors')
         self.assertEqual(response.status_code, 200)
-        self.assertIn(b'Junior Payment Reconciliation', response.data)
+        self.assertIn(b'Juniors Dashboard', response.data)
         self.assertIn(b'Junior One', response.data)
         self.assertIn(b'Junior Two', response.data)
-        self.assertIn(b'OK', response.data)
+        self.assertNotIn(b'OK', response.data)
+        self.assertIn(b'500/500 CZK', response.data)
         self.assertIn(b'?', response.data)
 
 if __name__ == '__main__':

tests/test_match_members.py

@@ -0,0 +1,53 @@
+import unittest
+from scripts.match_payments import match_members
+
+
+MEMBERS = [
+    "Henrietta Ottová",
+    "Tomáš Němeček (Tov)",
+    "František Vrbík (Štrúdl)",
+    "Jana Nováková",
+]
+
+
+class TestMatchMembersExact(unittest.TestCase):
+    def test_full_name_in_message_returns_only_that_member(self):
+        # "tov" is a substring of "ottova" — the old code returned both members
+        result = match_members("Henrietta Ottová (Heny): 04/2026", MEMBERS)
+        names = [r[0] for r in result]
+        self.assertEqual(names, ["Henrietta Ottová"])
+        self.assertTrue(all(conf == "auto" for _, conf in result))
+
+    def test_nickname_tov_not_matched_inside_ottova(self):
+        # Bare nickname message should NOT match Tomáš via "tov" inside "ottova"
+        result = match_members("platba ottova 04/2026", MEMBERS)
+        names = [r[0] for r in result]
+        self.assertNotIn("Tomáš Němeček (Tov)", names)
+
+    def test_combined_payment_two_full_names(self):
+        result = match_members("Henrietta Ottová a Tomáš Němeček 04/2026", MEMBERS)
+        names = [r[0] for r in result]
+        self.assertIn("Henrietta Ottová", names)
+        self.assertIn("Tomáš Němeček (Tov)", names)
+        self.assertTrue(all(conf == "auto" for _, conf in result))
+
+    def test_nickname_alone_still_matches_correctly(self):
+        # "Tov" alone should still match Tomáš (as long as "ottova" is not in the text)
+        result = match_members("Tov platba 04/2026", MEMBERS)
+        names = [r[0] for r in result]
+        self.assertIn("Tomáš Němeček (Tov)", names)
+
+    def test_full_name_no_diacritics_still_matches(self):
+        result = match_members("Henrietta Ottova 04/2026", MEMBERS)
+        names = [r[0] for r in result]
+        self.assertIn("Henrietta Ottová", names)
+        self.assertNotIn("Tomáš Němeček (Tov)", names)
+
+    def test_first_last_name_present_any_order(self):
+        result = match_members("Platba od Nemeček Tomas 04/2026", MEMBERS)
+        names = [r[0] for r in result]
+        self.assertIn("Tomáš Němeček (Tov)", names)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_match_payments.py

@@ -0,0 +1,69 @@
+import unittest
+
+from scripts.match_payments import canonical_member_key, reconcile
+
+
+class TestCanonicalMemberKey(unittest.TestCase):
+    def test_diacritics_and_case_collapse(self):
+        self.assertEqual(canonical_member_key("Mária Maco"), "maria maco")
+        self.assertEqual(canonical_member_key("MARIA MACO"), "maria maco")
+        self.assertEqual(canonical_member_key("maria maco"), "maria maco")
+
+    def test_whitespace_runs_collapse(self):
+        self.assertEqual(canonical_member_key("Mária  Maco"), "maria maco")
+        self.assertEqual(canonical_member_key("  Mária Maco  "), "maria maco")
+
+    def test_unknown_name_passes_through_normalized(self):
+        # Two genuinely different names must not collide.
+        self.assertNotEqual(
+            canonical_member_key("Mária Maco"),
+            canonical_member_key("Marek Maco"),
+        )
+
+
+class TestReconcileTolerantPersonMatching(unittest.TestCase):
+    def _members(self):
+        return [("Mária Maco", "A", {"2026-04": (750, 4)})]
+
+    def _tx(self, person):
+        return {
+            "date": "2026-04-15",
+            "amount": 750,
+            "person": person,
+            "purpose": "2026-04",
+            "inferred_amount": 750,
+            "sender": "Maco Family",
+            "message": "fee",
+        }
+
+    def test_person_without_diacritics_matches(self):
+        result = reconcile(self._members(), ["2026-04"], [self._tx("Maria Maco")], {})
+
+        member = result["members"]["Mária Maco"]
+        self.assertEqual(member["months"]["2026-04"]["paid"], 750)
+        self.assertEqual(len(member["months"]["2026-04"]["transactions"]), 1)
+        self.assertEqual(result["unmatched"], [])
+
+    def test_person_with_extra_whitespace_matches(self):
+        result = reconcile(self._members(), ["2026-04"], [self._tx("Mária  Maco")], {})
+
+        self.assertEqual(result["members"]["Mária Maco"]["months"]["2026-04"]["paid"], 750)
+        self.assertEqual(result["unmatched"], [])
+
+    def test_person_lowercase_matches(self):
+        result = reconcile(self._members(), ["2026-04"], [self._tx("mária maco")], {})
+
+        self.assertEqual(result["members"]["Mária Maco"]["months"]["2026-04"]["paid"], 750)
+        self.assertEqual(result["unmatched"], [])
+
+    def test_truly_unknown_person_still_unmatched(self):
+        result = reconcile(
+            self._members(), ["2026-04"], [self._tx("Někdo Neznámý")], {}
+        )
+
+        self.assertEqual(result["members"]["Mária Maco"]["months"]["2026-04"]["paid"], 0)
+        self.assertEqual(len(result["unmatched"]), 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_reconcile_exceptions.py

@@ -52,5 +52,108 @@ class TestReconcileWithExceptions(unittest.TestCase):
         alice_data = result['members']['Alice']
         self.assertEqual(alice_data['months']['2026-01']['expected'], 750, "Should fallback to attendance fee")
 
+def _tx(person, purpose, amount):
+    return {
+        'date': '2026-01-01',
+        'amount': amount,
+        'person': person,
+        'purpose': purpose,
+        'inferred_amount': amount,
+        'sender': 'Sender',
+        'message': 'fee',
+    }
+
+
+class TestMultiMonthAllocation(unittest.TestCase):
+    """Fee-aware allocation across multiple months in a single payment."""
+
+    def test_greedy_exact_match(self):
+        """Payment equals total expected → every month fully covered (green)."""
+        members = [('Alice', 'A', {'2026-02': (750, 3), '2026-03': (350, 3), '2026-04': (150, 2)})]
+        sorted_months = ['2026-02', '2026-03', '2026-04']
+        tx = _tx('Alice', '2026-02, 2026-03, 2026-04', 1250)
+
+        result = reconcile(members, sorted_months, [tx])
+        months = result['members']['Alice']['months']
+
+        self.assertEqual(int(months['2026-02']['paid']), 750)
+        self.assertEqual(int(months['2026-03']['paid']), 350)
+        self.assertEqual(int(months['2026-04']['paid']), 150)
+
+    def test_greedy_overpayment_goes_to_credit(self):
+        """Payment exceeds total expected → each month fully covered, surplus → credit."""
+        members = [('Alice', 'A', {'2026-01': (750, 3), '2026-02': (750, 3)})]
+        sorted_months = ['2026-01', '2026-02']
+        tx = _tx('Alice', '2026-01, 2026-02', 2000)
+
+        result = reconcile(members, sorted_months, [tx])
+        months = result['members']['Alice']['months']
+
+        self.assertEqual(int(months['2026-01']['paid']), 750)
+        self.assertEqual(int(months['2026-02']['paid']), 750)
+        self.assertEqual(result['credits'].get('Alice', 0), 500)
+
+    def test_proportional_underpayment(self):
+        """Payment < total expected → proportional split; sum of paid == payment amount."""
+        members = [('Alice', 'A', {'2026-02': (750, 3), '2026-03': (350, 3), '2026-04': (750, 3)})]
+        sorted_months = ['2026-02', '2026-03', '2026-04']
+        amount = 1250
+        tx = _tx('Alice', '2026-02, 2026-03, 2026-04', amount)
+
+        result = reconcile(members, sorted_months, [tx])
+        months = result['members']['Alice']['months']
+
+        paid_02 = months['2026-02']['paid']
+        paid_03 = months['2026-03']['paid']
+        paid_04 = months['2026-04']['paid']
+
+        # All months should be partial (underpaid)
+        self.assertLess(paid_02, 750)
+        self.assertLess(paid_03, 350)
+        self.assertLess(paid_04, 750)
+        # Sum must equal the original payment (no CZK lost)
+        self.assertAlmostEqual(paid_02 + paid_03 + paid_04, amount, places=2)
+        # 02 and 04 have equal expected → equal allocation
+        self.assertAlmostEqual(paid_02, paid_04, places=2)
+
+    def test_single_month_unchanged(self):
+        """Single-month payment: full amount goes to that month (regression guard)."""
+        members = [('Alice', 'A', {'2026-01': (750, 3)})]
+        sorted_months = ['2026-01']
+        tx = _tx('Alice', '2026-01', 750)
+
+        result = reconcile(members, sorted_months, [tx])
+        self.assertAlmostEqual(result['members']['Alice']['months']['2026-01']['paid'], 750, places=2)
+
+    def test_two_members_multi_month(self):
+        """Two members, 2 months: each member gets member_share, then fee-aware per month."""
+        members = [
+            ('Alice', 'A', {'2026-01': (750, 3), '2026-02': (350, 3)}),
+            ('Bob',   'A', {'2026-01': (750, 3), '2026-02': (350, 3)}),
+        ]
+        sorted_months = ['2026-01', '2026-02']
+        # Both members pay together; total expected per member = 1100
+        tx = _tx('Alice, Bob', '2026-01, 2026-02', 2200)
+
+        result = reconcile(members, sorted_months, [tx])
+
+        for name in ('Alice', 'Bob'):
+            months = result['members'][name]['months']
+            self.assertAlmostEqual(months['2026-01']['paid'], 750, places=2)
+            self.assertAlmostEqual(months['2026-02']['paid'], 350, places=2)
+
+    def test_fallback_even_split_when_no_expected(self):
+        """All matched months have expected=0 → falls back to even split."""
+        members = [('Alice', 'A', {'2026-01': (0, 0), '2026-02': (0, 0)})]
+        sorted_months = ['2026-01', '2026-02']
+        tx = _tx('Alice', '2026-01, 2026-02', 300)
+
+        result = reconcile(members, sorted_months, [tx])
+        months = result['members']['Alice']['months']
+
+        self.assertAlmostEqual(months['2026-01']['paid'], 150, places=2)
+        self.assertAlmostEqual(months['2026-02']['paid'], 150, places=2)
+
+
 if __name__ == '__main__':
     unittest.main()

uv.lock

@@ -127,6 +127,75 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
 ]
 
+[[package]]
+name = "coverage"
+version = "7.13.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/24/56/95b7e30fa389756cb56630faa728da46a27b8c6eb46f9d557c68fff12b65/coverage-7.13.4.tar.gz", hash = "sha256:e5c8f6ed1e61a8b2dcdf31eb0b9bbf0130750ca79c1c49eb898e2ad86f5ccc91", size = 827239, upload-time = "2026-02-09T12:59:03.86Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/db/23/aad45061a31677d68e47499197a131eea55da4875d16c1f42021ab963503/coverage-7.13.4-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:b66a2da594b6068b48b2692f043f35d4d3693fb639d5ea8b39533c2ad9ac3ab9", size = 219474, upload-time = "2026-02-09T12:57:19.332Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/70/9b8b67a0945f3dfec1fd896c5cefb7c19d5a3a6d74630b99a895170999ae/coverage-7.13.4-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3599eb3992d814d23b35c536c28df1a882caa950f8f507cef23d1cbf334995ac", size = 219844, upload-time = "2026-02-09T12:57:20.66Z" },
+    { url = "https://files.pythonhosted.org/packages/97/fd/7e859f8fab324cef6c4ad7cff156ca7c489fef9179d5749b0c8d321281c2/coverage-7.13.4-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:93550784d9281e374fb5a12bf1324cc8a963fd63b2d2f223503ef0fd4aa339ea", size = 250832, upload-time = "2026-02-09T12:57:22.007Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/dc/b2442d10020c2f52617828862d8b6ee337859cd8f3a1f13d607dddda9cf7/coverage-7.13.4-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:b720ce6a88a2755f7c697c23268ddc47a571b88052e6b155224347389fdf6a3b", size = 253434, upload-time = "2026-02-09T12:57:23.339Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/88/6728a7ad17428b18d836540630487231f5470fb82454871149502f5e5aa2/coverage-7.13.4-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7b322db1284a2ed3aa28ffd8ebe3db91c929b7a333c0820abec3d838ef5b3525", size = 254676, upload-time = "2026-02-09T12:57:24.774Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/bc/21244b1b8cedf0dff0a2b53b208015fe798d5f2a8d5348dbfece04224fff/coverage-7.13.4-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f4594c67d8a7c89cf922d9df0438c7c7bb022ad506eddb0fdb2863359ff78242", size = 256807, upload-time = "2026-02-09T12:57:26.125Z" },
+    { url = "https://files.pythonhosted.org/packages/97/a0/ddba7ed3251cff51006737a727d84e05b61517d1784a9988a846ba508877/coverage-7.13.4-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:53d133df809c743eb8bce33b24bcababb371f4441340578cd406e084d94a6148", size = 251058, upload-time = "2026-02-09T12:57:27.614Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/55/e289addf7ff54d3a540526f33751951bf0878f3809b47f6dfb3def69c6f7/coverage-7.13.4-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:76451d1978b95ba6507a039090ba076105c87cc76fc3efd5d35d72093964d49a", size = 252805, upload-time = "2026-02-09T12:57:29.066Z" },
+    { url = "https://files.pythonhosted.org/packages/13/4e/cc276b1fa4a59be56d96f1dabddbdc30f4ba22e3b1cd42504c37b3313255/coverage-7.13.4-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:7f57b33491e281e962021de110b451ab8a24182589be17e12a22c79047935e23", size = 250766, upload-time = "2026-02-09T12:57:30.522Z" },
+    { url = "https://files.pythonhosted.org/packages/94/44/1093b8f93018f8b41a8cf29636c9292502f05e4a113d4d107d14a3acd044/coverage-7.13.4-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:1731dc33dc276dafc410a885cbf5992f1ff171393e48a21453b78727d090de80", size = 254923, upload-time = "2026-02-09T12:57:31.946Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/55/ea2796da2d42257f37dbea1aab239ba9263b31bd91d5527cdd6db5efe174/coverage-7.13.4-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:bd60d4fe2f6fa7dff9223ca1bbc9f05d2b6697bc5961072e5d3b952d46e1b1ea", size = 250591, upload-time = "2026-02-09T12:57:33.842Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/fa/7c4bb72aacf8af5020675aa633e59c1fbe296d22aed191b6a5b711eb2bc7/coverage-7.13.4-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:9181a3ccead280b828fae232df12b16652702b49d41e99d657f46cc7b1f6ec7a", size = 252364, upload-time = "2026-02-09T12:57:35.743Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/38/a8d2ec0146479c20bbaa7181b5b455a0c41101eed57f10dd19a78ab44c80/coverage-7.13.4-cp313-cp313-win32.whl", hash = "sha256:f53d492307962561ac7de4cd1de3e363589b000ab69617c6156a16ba7237998d", size = 222010, upload-time = "2026-02-09T12:57:37.25Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/0c/dbfafbe90a185943dcfbc766fe0e1909f658811492d79b741523a414a6cc/coverage-7.13.4-cp313-cp313-win_amd64.whl", hash = "sha256:e6f70dec1cc557e52df5306d051ef56003f74d56e9c4dd7ddb07e07ef32a84dd", size = 222818, upload-time = "2026-02-09T12:57:38.734Z" },
+    { url = "https://files.pythonhosted.org/packages/04/d1/934918a138c932c90d78301f45f677fb05c39a3112b96fd2c8e60503cdc7/coverage-7.13.4-cp313-cp313-win_arm64.whl", hash = "sha256:fb07dc5da7e849e2ad31a5d74e9bece81f30ecf5a42909d0a695f8bd1874d6af", size = 221438, upload-time = "2026-02-09T12:57:40.223Z" },
+    { url = "https://files.pythonhosted.org/packages/52/57/ee93ced533bcb3e6df961c0c6e42da2fc6addae53fb95b94a89b1e33ebd7/coverage-7.13.4-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:40d74da8e6c4b9ac18b15331c4b5ebc35a17069410cad462ad4f40dcd2d50c0d", size = 220165, upload-time = "2026-02-09T12:57:41.639Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/e0/969fc285a6fbdda49d91af278488d904dcd7651b2693872f0ff94e40e84a/coverage-7.13.4-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4223b4230a376138939a9173f1bdd6521994f2aff8047fae100d6d94d50c5a12", size = 220516, upload-time = "2026-02-09T12:57:44.215Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/b8/9531944e16267e2735a30a9641ff49671f07e8138ecf1ca13db9fd2560c7/coverage-7.13.4-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:1d4be36a5114c499f9f1f9195e95ebf979460dbe2d88e6816ea202010ba1c34b", size = 261804, upload-time = "2026-02-09T12:57:45.989Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/f3/e63df6d500314a2a60390d1989240d5f27318a7a68fa30ad3806e2a9323e/coverage-7.13.4-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:200dea7d1e8095cc6e98cdabe3fd1d21ab17d3cee6dab00cadbb2fe35d9c15b9", size = 263885, upload-time = "2026-02-09T12:57:47.42Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/67/7654810de580e14b37670b60a09c599fa348e48312db5b216d730857ffe6/coverage-7.13.4-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b8eb931ee8e6d8243e253e5ed7336deea6904369d2fd8ae6e43f68abbf167092", size = 266308, upload-time = "2026-02-09T12:57:49.345Z" },
+    { url = "https://files.pythonhosted.org/packages/37/6f/39d41eca0eab3cc82115953ad41c4e77935286c930e8fad15eaed1389d83/coverage-7.13.4-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:75eab1ebe4f2f64d9509b984f9314d4aa788540368218b858dad56dc8f3e5eb9", size = 267452, upload-time = "2026-02-09T12:57:50.811Z" },
+    { url = "https://files.pythonhosted.org/packages/50/6d/39c0fbb8fc5cd4d2090811e553c2108cf5112e882f82505ee7495349a6bf/coverage-7.13.4-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c35eb28c1d085eb7d8c9b3296567a1bebe03ce72962e932431b9a61f28facf26", size = 261057, upload-time = "2026-02-09T12:57:52.447Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/a2/60010c669df5fa603bb5a97fb75407e191a846510da70ac657eb696b7fce/coverage-7.13.4-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:eb88b316ec33760714a4720feb2816a3a59180fd58c1985012054fa7aebee4c2", size = 263875, upload-time = "2026-02-09T12:57:53.938Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/d9/63b22a6bdbd17f1f96e9ed58604c2a6b0e72a9133e37d663bef185877cf6/coverage-7.13.4-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:7d41eead3cc673cbd38a4417deb7fd0b4ca26954ff7dc6078e33f6ff97bed940", size = 261500, upload-time = "2026-02-09T12:57:56.012Z" },
+    { url = "https://files.pythonhosted.org/packages/70/bf/69f86ba1ad85bc3ad240e4c0e57a2e620fbc0e1645a47b5c62f0e941ad7f/coverage-7.13.4-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:fb26a934946a6afe0e326aebe0730cdff393a8bc0bbb65a2f41e30feddca399c", size = 265212, upload-time = "2026-02-09T12:57:57.5Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/f2/5f65a278a8c2148731831574c73e42f57204243d33bedaaf18fa79c5958f/coverage-7.13.4-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:dae88bc0fc77edaa65c14be099bd57ee140cf507e6bfdeea7938457ab387efb0", size = 260398, upload-time = "2026-02-09T12:57:59.027Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/80/6e8280a350ee9fea92f14b8357448a242dcaa243cb2c72ab0ca591f66c8c/coverage-7.13.4-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:845f352911777a8e722bfce168958214951e07e47e5d5d9744109fa5fe77f79b", size = 262584, upload-time = "2026-02-09T12:58:01.129Z" },
+    { url = "https://files.pythonhosted.org/packages/22/63/01ff182fc95f260b539590fb12c11ad3e21332c15f9799cb5e2386f71d9f/coverage-7.13.4-cp313-cp313t-win32.whl", hash = "sha256:2fa8d5f8de70688a28240de9e139fa16b153cc3cbb01c5f16d88d6505ebdadf9", size = 222688, upload-time = "2026-02-09T12:58:02.736Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/43/89de4ef5d3cd53b886afa114065f7e9d3707bdb3e5efae13535b46ae483d/coverage-7.13.4-cp313-cp313t-win_amd64.whl", hash = "sha256:9351229c8c8407645840edcc277f4a2d44814d1bc34a2128c11c2a031d45a5dd", size = 223746, upload-time = "2026-02-09T12:58:05.362Z" },
+    { url = "https://files.pythonhosted.org/packages/35/39/7cf0aa9a10d470a5309b38b289b9bb07ddeac5d61af9b664fe9775a4cb3e/coverage-7.13.4-cp313-cp313t-win_arm64.whl", hash = "sha256:30b8d0512f2dc8c8747557e8fb459d6176a2c9e5731e2b74d311c03b78451997", size = 222003, upload-time = "2026-02-09T12:58:06.952Z" },
+    { url = "https://files.pythonhosted.org/packages/92/11/a9cf762bb83386467737d32187756a42094927150c3e107df4cb078e8590/coverage-7.13.4-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:300deaee342f90696ed186e3a00c71b5b3d27bffe9e827677954f4ee56969601", size = 219522, upload-time = "2026-02-09T12:58:08.623Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/28/56e6d892b7b052236d67c95f1936b6a7cf7c3e2634bf27610b8cbd7f9c60/coverage-7.13.4-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:29e3220258d682b6226a9b0925bc563ed9a1ebcff3cad30f043eceea7eaf2689", size = 219855, upload-time = "2026-02-09T12:58:10.176Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/69/233459ee9eb0c0d10fcc2fe425a029b3fa5ce0f040c966ebce851d030c70/coverage-7.13.4-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:391ee8f19bef69210978363ca930f7328081c6a0152f1166c91f0b5fdd2a773c", size = 250887, upload-time = "2026-02-09T12:58:12.503Z" },
+    { url = "https://files.pythonhosted.org/packages/06/90/2cdab0974b9b5bbc1623f7876b73603aecac11b8d95b85b5b86b32de5eab/coverage-7.13.4-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:0dd7ab8278f0d58a0128ba2fca25824321f05d059c1441800e934ff2efa52129", size = 253396, upload-time = "2026-02-09T12:58:14.615Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/15/ea4da0f85bf7d7b27635039e649e99deb8173fe551096ea15017f7053537/coverage-7.13.4-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:78cdf0d578b15148b009ccf18c686aa4f719d887e76e6b40c38ffb61d264a552", size = 254745, upload-time = "2026-02-09T12:58:16.162Z" },
+    { url = "https://files.pythonhosted.org/packages/99/11/bb356e86920c655ca4d61daee4e2bbc7258f0a37de0be32d233b561134ff/coverage-7.13.4-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:48685fee12c2eb3b27c62f2658e7ea21e9c3239cba5a8a242801a0a3f6a8c62a", size = 257055, upload-time = "2026-02-09T12:58:17.892Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/0f/9ae1f8cb17029e09da06ca4e28c9e1d5c1c0a511c7074592e37e0836c915/coverage-7.13.4-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:4e83efc079eb39480e6346a15a1bcb3e9b04759c5202d157e1dd4303cd619356", size = 250911, upload-time = "2026-02-09T12:58:19.495Z" },
+    { url = "https://files.pythonhosted.org/packages/89/3a/adfb68558fa815cbc29747b553bc833d2150228f251b127f1ce97e48547c/coverage-7.13.4-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:ecae9737b72408d6a950f7e525f30aca12d4bd8dd95e37342e5beb3a2a8c4f71", size = 252754, upload-time = "2026-02-09T12:58:21.064Z" },
+    { url = "https://files.pythonhosted.org/packages/32/b1/540d0c27c4e748bd3cd0bd001076ee416eda993c2bae47a73b7cc9357931/coverage-7.13.4-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:ae4578f8528569d3cf303fef2ea569c7f4c4059a38c8667ccef15c6e1f118aa5", size = 250720, upload-time = "2026-02-09T12:58:22.622Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/95/383609462b3ffb1fe133014a7c84fc0dd01ed55ac6140fa1093b5af7ebb1/coverage-7.13.4-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:6fdef321fdfbb30a197efa02d48fcd9981f0d8ad2ae8903ac318adc653f5df98", size = 254994, upload-time = "2026-02-09T12:58:24.548Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/ba/1761138e86c81680bfc3c49579d66312865457f9fe405b033184e5793cb3/coverage-7.13.4-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2b0f6ccf3dbe577170bebfce1318707d0e8c3650003cb4b3a9dd744575daa8b5", size = 250531, upload-time = "2026-02-09T12:58:26.271Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/8e/05900df797a9c11837ab59c4d6fe94094e029582aab75c3309a93e6fb4e3/coverage-7.13.4-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:75fcd519f2a5765db3f0e391eb3b7d150cce1a771bf4c9f861aeab86c767a3c0", size = 252189, upload-time = "2026-02-09T12:58:27.807Z" },
+    { url = "https://files.pythonhosted.org/packages/00/bd/29c9f2db9ea4ed2738b8a9508c35626eb205d51af4ab7bf56a21a2e49926/coverage-7.13.4-cp314-cp314-win32.whl", hash = "sha256:8e798c266c378da2bd819b0677df41ab46d78065fb2a399558f3f6cae78b2fbb", size = 222258, upload-time = "2026-02-09T12:58:29.441Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/4d/1f8e723f6829977410efeb88f73673d794075091c8c7c18848d273dc9d73/coverage-7.13.4-cp314-cp314-win_amd64.whl", hash = "sha256:245e37f664d89861cf2329c9afa2c1fe9e6d4e1a09d872c947e70718aeeac505", size = 223073, upload-time = "2026-02-09T12:58:31.026Z" },
+    { url = "https://files.pythonhosted.org/packages/51/5b/84100025be913b44e082ea32abcf1afbf4e872f5120b7a1cab1d331b1e13/coverage-7.13.4-cp314-cp314-win_arm64.whl", hash = "sha256:ad27098a189e5838900ce4c2a99f2fe42a0bf0c2093c17c69b45a71579e8d4a2", size = 221638, upload-time = "2026-02-09T12:58:32.599Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/e4/c884a405d6ead1370433dad1e3720216b4f9fd8ef5b64bfd984a2a60a11a/coverage-7.13.4-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:85480adfb35ffc32d40918aad81b89c69c9cc5661a9b8a81476d3e645321a056", size = 220246, upload-time = "2026-02-09T12:58:34.181Z" },
+    { url = "https://files.pythonhosted.org/packages/81/5c/4d7ed8b23b233b0fffbc9dfec53c232be2e695468523242ea9fd30f97ad2/coverage-7.13.4-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:79be69cf7f3bf9b0deeeb062eab7ac7f36cd4cc4c4dd694bd28921ba4d8596cc", size = 220514, upload-time = "2026-02-09T12:58:35.704Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/6f/3284d4203fd2f28edd73034968398cd2d4cb04ab192abc8cff007ea35679/coverage-7.13.4-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:caa421e2684e382c5d8973ac55e4f36bed6821a9bad5c953494de960c74595c9", size = 261877, upload-time = "2026-02-09T12:58:37.864Z" },
+    { url = "https://files.pythonhosted.org/packages/09/aa/b672a647bbe1556a85337dc95bfd40d146e9965ead9cc2fe81bde1e5cbce/coverage-7.13.4-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:14375934243ee05f56c45393fe2ce81fe5cc503c07cee2bdf1725fb8bef3ffaf", size = 264004, upload-time = "2026-02-09T12:58:39.492Z" },
+    { url = "https://files.pythonhosted.org/packages/79/a1/aa384dbe9181f98bba87dd23dda436f0c6cf2e148aecbb4e50fc51c1a656/coverage-7.13.4-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:25a41c3104d08edb094d9db0d905ca54d0cd41c928bb6be3c4c799a54753af55", size = 266408, upload-time = "2026-02-09T12:58:41.852Z" },
+    { url = "https://files.pythonhosted.org/packages/53/5e/5150bf17b4019bc600799f376bb9606941e55bd5a775dc1e096b6ffea952/coverage-7.13.4-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6f01afcff62bf9a08fb32b2c1d6e924236c0383c02c790732b6537269e466a72", size = 267544, upload-time = "2026-02-09T12:58:44.093Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/ed/f1de5c675987a4a7a672250d2c5c9d73d289dbf13410f00ed7181d8017dd/coverage-7.13.4-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:eb9078108fbf0bcdde37c3f4779303673c2fa1fe8f7956e68d447d0dd426d38a", size = 260980, upload-time = "2026-02-09T12:58:45.721Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/e3/fe758d01850aa172419a6743fe76ba8b92c29d181d4f676ffe2dae2ba631/coverage-7.13.4-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:0e086334e8537ddd17e5f16a344777c1ab8194986ec533711cbe6c41cde841b6", size = 263871, upload-time = "2026-02-09T12:58:47.334Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/76/b829869d464115e22499541def9796b25312b8cf235d3bb00b39f1675395/coverage-7.13.4-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:725d985c5ab621268b2edb8e50dfe57633dc69bda071abc470fed55a14935fd3", size = 261472, upload-time = "2026-02-09T12:58:48.995Z" },
+    { url = "https://files.pythonhosted.org/packages/14/9e/caedb1679e73e2f6ad240173f55218488bfe043e38da577c4ec977489915/coverage-7.13.4-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:3c06f0f1337c667b971ca2f975523347e63ec5e500b9aa5882d91931cd3ef750", size = 265210, upload-time = "2026-02-09T12:58:51.178Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/10/0dd02cb009b16ede425b49ec344aba13a6ae1dc39600840ea6abcb085ac4/coverage-7.13.4-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:590c0ed4bf8e85f745e6b805b2e1c457b2e33d5255dd9729743165253bc9ad39", size = 260319, upload-time = "2026-02-09T12:58:53.081Z" },
+    { url = "https://files.pythonhosted.org/packages/92/8e/234d2c927af27c6d7a5ffad5bd2cf31634c46a477b4c7adfbfa66baf7ebb/coverage-7.13.4-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:eb30bf180de3f632cd043322dad5751390e5385108b2807368997d1a92a509d0", size = 262638, upload-time = "2026-02-09T12:58:55.258Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/64/e5547c8ff6964e5965c35a480855911b61509cce544f4d442caa759a0702/coverage-7.13.4-cp314-cp314t-win32.whl", hash = "sha256:c4240e7eded42d131a2d2c4dec70374b781b043ddc79a9de4d55ca71f8e98aea", size = 223040, upload-time = "2026-02-09T12:58:56.936Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/96/38086d58a181aac86d503dfa9c47eb20715a79c3e3acbdf786e92e5c09a8/coverage-7.13.4-cp314-cp314t-win_amd64.whl", hash = "sha256:4c7d3cc01e7350f2f0f6f7036caaf5673fb56b6998889ccfe9e1c1fe75a9c932", size = 224148, upload-time = "2026-02-09T12:58:58.645Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/72/8d10abd3740a0beb98c305e0c3faf454366221c0f37a8bcf8f60020bb65a/coverage-7.13.4-cp314-cp314t-win_arm64.whl", hash = "sha256:23e3f687cf945070d1c90f85db66d11e3025665d8dafa831301a0e0038f3db9b", size = 222172, upload-time = "2026-02-09T12:59:00.396Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/4a/331fe2caf6799d591109bb9c08083080f6de90a823695d412a935622abb2/coverage-7.13.4-py3-none-any.whl", hash = "sha256:1af1641e57cf7ba1bd67d677c9abdbcd6cc2ab7da3bca7fa1e2b7e50e65f2ad0", size = 211242, upload-time = "2026-02-09T12:59:02.032Z" },
+]
+
 [[package]]
 name = "cryptography"
 version = "46.0.5"
@@ -206,18 +275,32 @@ dependencies = [
     { name = "google-api-python-client" },
     { name = "google-auth-httplib2" },
     { name = "google-auth-oauthlib" },
+    { name = "gunicorn" },
     { name = "qrcode", extra = ["pil"] },
 ]
 
+[package.dev-dependencies]
+dev = [
+    { name = "pytest" },
+    { name = "pytest-cov" },
+]
+
 [package.metadata]
 requires-dist = [
     { name = "flask", specifier = ">=3.1.3" },
     { name = "google-api-python-client", specifier = ">=2.162.0" },
     { name = "google-auth-httplib2", specifier = ">=0.2.0" },
     { name = "google-auth-oauthlib", specifier = ">=1.2.1" },
+    { name = "gunicorn", specifier = ">=23.0" },
     { name = "qrcode", extras = ["pil"], specifier = ">=8.0" },
 ]
 
+[package.metadata.requires-dev]
+dev = [
+    { name = "pytest", specifier = ">=8.0" },
+    { name = "pytest-cov", specifier = ">=6.0" },
+]
+
 [[package]]
 name = "google-api-core"
 version = "2.30.0"
@@ -302,6 +385,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c4/ab/09169d5a4612a5f92490806649ac8d41e3ec9129c636754575b3553f4ea4/googleapis_common_protos-1.72.0-py3-none-any.whl", hash = "sha256:4299c5a82d5ae1a9702ada957347726b167f9f8d1fc352477702a1e851ff4038", size = 297515, upload-time = "2025-11-06T18:29:13.14Z" },
 ]
 
+[[package]]
+name = "gunicorn"
+version = "25.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "packaging" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/66/13/ef67f59f6a7896fdc2c1d62b5665c5219d6b0a9a1784938eb9a28e55e128/gunicorn-25.1.0.tar.gz", hash = "sha256:1426611d959fa77e7de89f8c0f32eed6aa03ee735f98c01efba3e281b1c47616", size = 594377, upload-time = "2026-02-13T11:09:58.989Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/da/73/4ad5b1f6a2e21cf1e85afdaad2b7b1a933985e2f5d679147a1953aaa192c/gunicorn-25.1.0-py3-none-any.whl", hash = "sha256:d0b1236ccf27f72cfe14bce7caadf467186f19e865094ca84221424e839b8b8b", size = 197067, upload-time = "2026-02-13T11:09:57.146Z" },
+]
+
 [[package]]
 name = "httplib2"
 version = "0.31.2"
@@ -323,6 +418,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
 ]
 
+[[package]]
+name = "iniconfig"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/34/14ca021ce8e5dfedc35312d08ba8bf51fdd999c576889fc2c24cb97f4f10/iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730", size = 20503, upload-time = "2025-10-18T21:55:43.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
+]
+
 [[package]]
 name = "itsdangerous"
 version = "2.2.0"
@@ -405,6 +509,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/be/9c/92789c596b8df838baa98fa71844d84283302f7604ed565dafe5a6b5041a/oauthlib-3.3.1-py3-none-any.whl", hash = "sha256:88119c938d2b8fb88561af5f6ee0eec8cc8d552b7bb1f712743136eb7523b7a1", size = 160065, upload-time = "2025-06-19T22:48:06.508Z" },
 ]
 
+[[package]]
+name = "packaging"
+version = "26.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/65/ee/299d360cdc32edc7d2cf530f3accf79c4fca01e96ffc950d8a52213bd8e4/packaging-26.0.tar.gz", hash = "sha256:00243ae351a257117b6a241061796684b084ed1c516a08c48a3f7e147a9d80b4", size = 143416, upload-time = "2026-01-21T20:50:39.064Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b7/b9/c538f279a4e237a006a2c98387d081e9eb060d203d8ed34467cc0f0b9b53/packaging-26.0-py3-none-any.whl", hash = "sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529", size = 74366, upload-time = "2026-01-21T20:50:37.788Z" },
+]
+
 [[package]]
 name = "pillow"
 version = "12.1.1"
@@ -463,6 +576,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ec/d2/de599c95ba0a973b94410477f8bf0b6f0b5e67360eb89bcb1ad365258beb/pillow-12.1.1-cp314-cp314t-win_arm64.whl", hash = "sha256:7b03048319bfc6170e93bd60728a1af51d3dd7704935feb228c4d4faab35d334", size = 2546446, upload-time = "2026-02-11T04:22:50.342Z" },
 ]
 
+[[package]]
+name = "pluggy"
+version = "1.6.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f9/e2/3e91f31a7d2b083fe6ef3fa267035b518369d9511ffab804f839851d2779/pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3", size = 69412, upload-time = "2025-05-15T12:30:07.975Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
+]
+
 [[package]]
 name = "proto-plus"
 version = "1.27.1"
@@ -520,6 +642,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992", size = 48172, upload-time = "2026-01-21T14:26:50.693Z" },
 ]
 
+[[package]]
+name = "pygments"
+version = "2.19.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" },
+]
+
 [[package]]
 name = "pyparsing"
 version = "3.3.2"
@@ -529,6 +660,36 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/10/bd/c038d7cc38edc1aa5bf91ab8068b63d4308c66c4c8bb3cbba7dfbc049f9c/pyparsing-3.3.2-py3-none-any.whl", hash = "sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d", size = 122781, upload-time = "2026-01-21T03:57:55.912Z" },
 ]
 
+[[package]]
+name = "pytest"
+version = "9.0.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "iniconfig" },
+    { name = "packaging" },
+    { name = "pluggy" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/d1/db/7ef3487e0fb0049ddb5ce41d3a49c235bf9ad299b6a25d5780a89f19230f/pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11", size = 1568901, upload-time = "2025-12-06T21:30:51.014Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/3b/ab/b3226f0bd7cdcf710fbede2b3548584366da3b19b5021e74f5bde2a8fa3f/pytest-9.0.2-py3-none-any.whl", hash = "sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b", size = 374801, upload-time = "2025-12-06T21:30:49.154Z" },
+]
+
+[[package]]
+name = "pytest-cov"
+version = "7.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "coverage" },
+    { name = "pluggy" },
+    { name = "pytest" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/5e/f7/c933acc76f5208b3b00089573cf6a2bc26dc80a8aece8f52bb7d6b1855ca/pytest_cov-7.0.0.tar.gz", hash = "sha256:33c97eda2e049a0c5298e91f519302a1334c26ac65c1a483d6206fd458361af1", size = 54328, upload-time = "2025-09-09T10:57:02.113Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ee/49/1377b49de7d0c1ce41292161ea0f721913fa8722c19fb9c1e3aa0367eecb/pytest_cov-7.0.0-py3-none-any.whl", hash = "sha256:3b8e9558b16cc1479da72058bdecf8073661c7f57f7d3c5f22a1c23507f2d861", size = 22424, upload-time = "2025-09-09T10:57:00.695Z" },
+]
+
 [[package]]
 name = "qrcode"
 version = "8.2"