diff --git a/TASK.md b/TASK.md
index 40e13ab..e23de9b 100644
--- a/TASK.md
+++ b/TASK.md
@@ -1,843 +1,866 @@
-# TASK: Storage Namespace (`felhom-data/`) + Test Node Wipe Script (v0.26.0)
+# TASK: App Telemetry & Analytics
 
-**Controller:** v0.25.0 → v0.26.0
+**Controller:** v0.27.3 → v0.28.0
+**Hub:** v0.3.8 → v0.4.0
 
 ## Overview
 
-All felhom-managed data on external drives moves under a `felhom-data/` subdirectory, cleanly separating our data from user files. Plus a wipe script for repeatable testing.
-
-**Key design principle:** `HDD_PATH` env var stays as the mount point (e.g., `/mnt/hdd_1`). The `felhom-data` segment is embedded in path helpers and compose templates, not in `HDD_PATH`.
+Add per-app (per-stack) memory/CPU telemetry and container log error scanning to the controller's report push cycle, then build fleet-wide analytics dashboard pages in the hub.
 
 ---
 
-## Phase 1: Path Helpers (`internal/backup/paths.go`)
+## Spec Issues Found (corrections already applied in this plan)
 
-This is the foundation. All other changes depend on this.
-
-### File: `controller/internal/backup/paths.go`
-
-**Add constant at top of file (after imports):**
-```go
-// FelhomDataDir is the namespace directory on storage drives for all felhom-managed data.
-const FelhomDataDir = "felhom-data"
-```
-
-**Update 8 functions** to include `FelhomDataDir` in the path. Each function gets `FelhomDataDir` inserted between `drivePath` and the next segment:
-
-| Function | Current first segment | New first segment |
-|----------|----------------------|-------------------|
-| `PrimaryBackupPath` | `"backups"` | `FelhomDataDir, "backups"` |
-| `PrimaryResticRepoPath` | `"backups"` | `FelhomDataDir, "backups"` |
-| `AppDBDumpPath` | `"backups"` | `FelhomDataDir, "backups"` |
-| `SecondaryBackupPath` | `"backups"` | `FelhomDataDir, "backups"` |
-| `AppSecondaryRsyncPath` | `"backups"` | `FelhomDataDir, "backups"` |
-| `SecondaryResticRepoPath` | `"backups"` | `FelhomDataDir, "backups"` |
-| `SecondaryInfraPath` | `"backups"` | `FelhomDataDir, "backups"` |
-| `AppDataDir` | `"appdata"` | `FelhomDataDir, "appdata"` |
-
-**DO NOT change `InfraBackupDir`** — it stays at drive root (DR scanner needs it).
-
-Example transformation for each function — replace:
-```go
-return filepath.Join(drivePath, "backups", "primary")
-```
-with:
-```go
-return filepath.Join(drivePath, FelhomDataDir, "backups", "primary")
-```
-
-And for `AppDataDir` replace:
-```go
-return filepath.Join(drivePath, "appdata", stackName)
-```
-with:
-```go
-return filepath.Join(drivePath, FelhomDataDir, "appdata", stackName)
-```
+1. **Wrong column name in metrics DB**: Spec uses `memory_bytes` — actual column is `mem_usage_mb` (already in MB). No byte→MB conversion needed.
+2. **`ts` column is INTEGER (Unix timestamp)**, not datetime — WHERE clauses must use `unix()`.
+3. **`metricsStore` already passed to `BuildReport()`** — no main.go wiring change needed for that dependency.
+4. **Chart.js is NOT in the hub** — needs to be added (copy from controller's `internal/web/static/chart.min.js`).
+5. **Hub nav is header-based**, not sidebar — add "Alkalmazások" to the header `<nav>`.
+6. **`StackInfo` type undefined** in spec — use existing `stacks.Stack` directly (report already imports stacks).
+7. **Fingerprinting threshold**: Use 6+ digits instead of 4+ to avoid mangling HTTP status codes (404, 503) and port numbers.
 
 ---
 
-## Phase 2: Fix Hardcoded Paths
+## Phase 1: Controller — Metrics Telemetry
 
-### 2a. `controller/internal/stacks/delete.go` — `ProtectedHDDPaths()`
+### File: `controller/internal/metrics/telemetry.go` (NEW)
 
-**Line 54-65.** Cannot import `backup` package (architectural boundary via `StackDataProvider`).
+Create this new file in the existing `metrics` package.
 
-Add local constant at top of file (after imports, before types):
 ```go
-// felhomDataDir matches backup.FelhomDataDir — duplicated to avoid circular import via StackDataProvider.
-const felhomDataDir = "felhom-data"
-```
+package metrics
 
-Update `ProtectedHDDPaths()`:
-```go
-func ProtectedHDDPaths(hddPath string) map[string]bool {
-	if hddPath == "" {
-		return nil
-	}
-	return map[string]bool{
-		hddPath:                                                true,
-		filepath.Join(hddPath, felhomDataDir):                  true,
-		filepath.Join(hddPath, felhomDataDir, "appdata"):       true,
-		filepath.Join(hddPath, felhomDataDir, "backups"):       true,
-		filepath.Join(hddPath, "media"):                        true,
-		filepath.Join(hddPath, "Dokumentumok"):                 true,
-	}
+import (
+    "time"
+)
+
+// ContainerTelemetry holds aggregated resource stats for one container.
+type ContainerTelemetry struct {
+    ContainerName  string  `json:"container_name"`
+    MemoryCurrentMB float64 `json:"memory_current_mb"`
+    MemoryAvgMB    float64 `json:"memory_avg_mb"`
+    MemoryPeakMB   float64 `json:"memory_peak_mb"`
+    CPUAvgPercent  float64 `json:"cpu_avg_percent"`
+    SampleCount    int     `json:"sample_count"`
+}
+
+// GetContainerTelemetry queries the metrics DB for per-container resource
+// summaries since the given time. Returns empty slice (not error) if no data.
+func (s *MetricsStore) GetContainerTelemetry(since time.Time) ([]ContainerTelemetry, error) {
+    sinceUnix := since.Unix()
+
+    // Get averages and peaks
+    rows, err := s.db.Query(`
+        SELECT container_name,
+               AVG(mem_usage_mb),
+               MAX(mem_usage_mb),
+               AVG(cpu_percent),
+               COUNT(*)
+        FROM container_metrics
+        WHERE ts > ?
+        GROUP BY container_name`, sinceUnix)
+    if err != nil {
+        return nil, err
+    }
+    defer rows.Close()
+
+    var results []ContainerTelemetry
+    for rows.Next() {
+        var ct ContainerTelemetry
+        if err := rows.Scan(&ct.ContainerName, &ct.MemoryAvgMB, &ct.MemoryPeakMB,
+            &ct.CPUAvgPercent, &ct.SampleCount); err != nil {
+            continue
+        }
+        results = append(results, ct)
+    }
+
+    // Get current (most recent) memory per container using QueryContainerSummary
+    if stats, err := s.QueryContainerSummary(); err == nil {
+        currentMap := make(map[string]float64, len(stats))
+        for _, st := range stats {
+            currentMap[st.ContainerName] = st.MemUsageMB
+        }
+        for i := range results {
+            if cur, ok := currentMap[results[i].ContainerName]; ok {
+                results[i].MemoryCurrentMB = cur
+            }
+        }
+    }
+
+    if results == nil {
+        results = []ContainerTelemetry{}
+    }
+    return results, nil
 }
 ```
 
-### 2b. `controller/internal/stacks/delete.go` — `GetStackBackupData()`
+**Key details:**
+- Method on existing `*MetricsStore` — no new struct needed
+- `ts` column is Unix INTEGER — compare with `since.Unix()`
+- `mem_usage_mb` is already in MB — no conversion
+- Uses existing `QueryContainerSummary()` for current values (returns latest row per container, ordered by CPU DESC)
+- Returns empty slice on no data, not error
 
-**Line 355 and 359.** Replace hardcoded paths with the local constant:
+---
 
-Replace:
-```go
-dbDumpPath := filepath.Join(drivePath, "backups", "primary", name, "db-dumps")
-```
-with:
-```go
-dbDumpPath := filepath.Join(drivePath, felhomDataDir, "backups", "primary", name, "db-dumps")
-```
+## Phase 2: Controller — Log Scanner
 
-Replace:
-```go
-rsyncPath := filepath.Join(drivePath, "backups", "secondary", name, "rsync")
-```
-with:
-```go
-rsyncPath := filepath.Join(drivePath, felhomDataDir, "backups", "secondary", name, "rsync")
-```
+### File: `controller/internal/metrics/logscanner.go` (NEW)
 
-### 2c. `controller/internal/storage/migrate_drive.go` — Conflict check & verify
+Create in the `metrics` package (it's data collection, same domain as metrics).
 
-**Import `backup` package** (safe — `backup` does NOT import `storage`):
 ```go
-"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
-```
+package metrics
 
-**Line 183** — conflict check before migration. Replace:
-```go
-destAppData := filepath.Join(req.DestPath, "appdata", app.Name)
-```
-with:
-```go
-destAppData := backup.AppDataDir(req.DestPath, app.Name)
-```
-
-**Line 325** — verify after copy. Replace:
-```go
-destAppData := filepath.Join(req.DestPath, "appdata", app.Name)
-```
-with:
-```go
-destAppData := backup.AppDataDir(req.DestPath, app.Name)
-```
-
-### 2d. `controller/internal/storage/migrate_drive.go` — rsync exclude paths
-
-**CRITICAL BUG FIX.** Line 254-256. The rsync copies the entire drive root. The exclude patterns are relative paths. After namespace change, restic repos are under `felhom-data/backups/*/restic/`.
-
-Replace:
-```go
-rsyncCmd := exec.CommandContext(ctx, "rsync", "-a", "--info=progress2",
-    "--exclude=backups/primary/restic/",
-    "--exclude=backups/secondary/restic/",
-    req.SourcePath+"/", req.DestPath+"/",
-)
-```
-with:
-```go
-rsyncCmd := exec.CommandContext(ctx, "rsync", "-a", "--info=progress2",
-    "--exclude=felhom-data/backups/primary/restic/",
-    "--exclude=felhom-data/backups/secondary/restic/",
-    req.SourcePath+"/", req.DestPath+"/",
+import (
+    "context"
+    "os/exec"
+    "regexp"
+    "strings"
+    "time"
+    "unicode/utf8"
+    "log"
+    "sort"
 )
 ```
 
-Use `backup.FelhomDataDir` constant in the string construction if preferred, but since these are string literals for rsync args, hardcoding `"felhom-data"` is acceptable.
-
-### 2e. `controller/internal/storage/migrate_drive.go` — Size estimation
-
-**BUG FIX.** Lines 196-208. This scans the drive root for size estimation. After namespace change, `entry.Name() == "backups"` never matches because backups are now under `felhom-data/`.
-
-Replace the size estimation block:
+**Types:**
 ```go
-// Estimate total size (exclude restic repos)
-var totalBytes int64
-entries, _ := os.ReadDir(req.SourcePath)
-for _, entry := range entries {
-    entryPath := filepath.Join(req.SourcePath, entry.Name())
-    if entry.IsDir() {
-        // Skip restic repos in size estimate
-        if entry.Name() == "backups" {
-            totalBytes += dirSizeExcluding(entryPath, "restic")
-        } else {
-            totalBytes += dirSize(entryPath)
+type ContainerLogSummary struct {
+    ContainerName string     `json:"container_name"`
+    ErrorCount    int        `json:"error_count"`
+    WarnCount     int        `json:"warn_count"`
+    RecentIssues  []LogIssue `json:"recent_issues,omitempty"`
+}
+
+type LogIssue struct {
+    Severity string    `json:"severity"`
+    Message  string    `json:"message"`
+    Count    int       `json:"count"`
+    LastSeen time.Time `json:"last_seen"`
+}
+```
+
+**Function: `ScanContainerLogs(containerNames []string, since time.Duration, logger *log.Logger) []ContainerLogSummary`**
+
+Implementation notes:
+- Iterate `containerNames` **sequentially** (not parallel — avoid load spikes)
+- For each container, run: `exec.CommandContext(ctx, "docker", "logs", "--since=15m", "--tail=1000", containerName)`
+  - Context timeout: 10 seconds per container
+  - Merge stderr into stdout (`cmd.CombinedOutput()`)
+  - On error: log at DEBUG, skip container, continue
+- **Skip non-UTF-8 lines** using `utf8.Valid([]byte(line))`
+- **Truncate lines** to 500 chars before matching
+- **Pattern matching** — check first 5 space-separated words of each line (case-insensitive):
+  - Error patterns: `error`, `fatal`, `panic`, `crit`, `oom`, `killed`, `exception`, `traceback`
+  - Warning patterns: `warn`, `warning`
+- **Fingerprinting for deduplication:**
+  - Strip leading timestamp (regex: `^\d{4}[-/]\d{2}[-/]\d{2}[T ]\d{2}:\d{2}:\d{2}[.\d]*[Z ]?` and syslog-style `^[A-Z][a-z]{2} \d{1,2} \d{2}:\d{2}:\d{2} `)
+  - Replace sequences of 6+ digits with `<N>` (NOT 4+ — avoids mangling HTTP status codes, port numbers)
+  - Replace hex strings of 8+ chars with `<HEX>`
+  - Replace UUIDs (`[0-9a-f]{8}-[0-9a-f]{4}-...`) with `<UUID>`
+  - Trim whitespace, lowercase for grouping key
+- **Group by fingerprint**, keep count + last_seen time
+- **Limits:** Max 10 `RecentIssues` per container (sorted by count DESC, then last_seen DESC). Cap total issues across all containers at 50.
+- **Total scan warning:** If total scan takes > 5 minutes, log a warning
+- Return `[]ContainerLogSummary` (nil-safe — return empty slice)
+
+**The caller (report builder) is responsible for filtering out infrastructure containers before calling this function.** The function doesn't need config access.
+
+---
+
+## Phase 3: Controller — Report Integration
+
+### File: `controller/internal/report/types.go` (MODIFY)
+
+Add these types and the new field to `Report`:
+
+```go
+// Add to Report struct:
+AppTelemetry []AppTelemetry `json:"app_telemetry,omitempty"`
+
+// New types (add after StacksReport):
+
+// AppTelemetry holds per-app (per-stack) resource and log telemetry.
+type AppTelemetry struct {
+    AppName         string            `json:"app_name"`
+    DisplayName     string            `json:"display_name"`
+    Containers      []string          `json:"containers"`
+    MemoryCurrentMB float64           `json:"memory_current_mb"`
+    MemoryAvgMB     float64           `json:"memory_avg_mb"`
+    MemoryPeakMB    float64           `json:"memory_peak_mb"`
+    CPUAvgPercent   float64           `json:"cpu_avg_percent"`
+    CatalogEstimate string            `json:"catalog_estimate"`
+    CatalogLimit    string            `json:"catalog_limit"`
+    LogErrors       int               `json:"log_errors"`
+    LogWarnings     int               `json:"log_warnings"`
+    Issues          []metrics.LogIssue `json:"issues,omitempty"`
+}
+```
+
+Note: `LogIssue` is defined in the `metrics` package (from logscanner.go). The `report` package already imports `metrics`.
+
+### File: `controller/internal/report/telemetry.go` (NEW)
+
+**Function: `buildAppTelemetry(allStacks []stacks.Stack, telemetry []metrics.ContainerTelemetry, logs []metrics.ContainerLogSummary) []AppTelemetry`**
+
+Private function (lowercase `b`), called from `BuildReport`. Logic:
+
+1. Build lookup maps: `containerName → ContainerTelemetry` and `containerName → ContainerLogSummary`
+2. Iterate `allStacks`. Skip stacks where `s.Protected || !s.Deployed`
+3. For each stack:
+   - Collect container names from `s.Containers`
+   - Sum `MemoryCurrentMB`, `MemoryAvgMB`, `MemoryPeakMB`, `CPUAvgPercent` across all containers in the stack
+   - Sum `ErrorCount`, `WarnCount` across all containers
+   - Merge `RecentIssues` from all containers, sort by count DESC, cap at 10
+   - Get `CatalogEstimate` from `s.Meta.Resources.MemRequest` and `CatalogLimit` from `s.Meta.Resources.MemLimit`
+   - Get `DisplayName` from `s.Meta.DisplayName`
+4. Return slice sorted by `AppName`
+
+### File: `controller/internal/report/builder.go` (MODIFY)
+
+In `BuildReport()`, add AFTER the stacks section (before the final debug log), approximately at line 151:
+
+```go
+// App telemetry (metrics + log scan)
+r.AppTelemetry = buildAppTelemetrySection(cfg, stackMgr, metricsStore, logger)
+```
+
+Create helper function `buildAppTelemetrySection`:
+```go
+func buildAppTelemetrySection(cfg *config.Config, stackMgr *stacks.Manager, metricsStore *metrics.MetricsStore, logger *log.Logger) []AppTelemetry {
+    allStacks := stackMgr.GetStacks()
+
+    // 1. Get metrics telemetry (last 15 minutes)
+    var telemetry []metrics.ContainerTelemetry
+    if metricsStore != nil {
+        var err error
+        telemetry, err = metricsStore.GetContainerTelemetry(time.Now().Add(-15 * time.Minute))
+        if err != nil && logger != nil {
+            logger.Printf("[WARN] Telemetry metrics query failed: %v", err)
         }
     }
-}
-```
 
-with:
-```go
-// Estimate total size (exclude restic repos inside felhom-data/backups/)
-var totalBytes int64
-entries, _ := os.ReadDir(req.SourcePath)
-for _, entry := range entries {
-    if !entry.IsDir() {
-        continue
-    }
-    entryPath := filepath.Join(req.SourcePath, entry.Name())
-    if entry.Name() == backup.FelhomDataDir {
-        // Scan inside namespace dir, excluding restic repos from estimate
-        subEntries, _ := os.ReadDir(entryPath)
-        for _, sub := range subEntries {
-            if !sub.IsDir() {
-                continue
-            }
-            subPath := filepath.Join(entryPath, sub.Name())
-            if sub.Name() == "backups" {
-                totalBytes += dirSizeExcluding(subPath, "restic")
-            } else {
-                totalBytes += dirSize(subPath)
-            }
+    // 2. Collect non-protected container names for log scan
+    var containerNames []string
+    for _, s := range allStacks {
+        if s.Protected || !s.Deployed {
+            continue
         }
-    } else {
-        totalBytes += dirSize(entryPath)
+        for _, c := range s.Containers {
+            containerNames = append(containerNames, c.Name)
+        }
+    }
+
+    // 3. Scan logs
+    logs := metrics.ScanContainerLogs(containerNames, 15*time.Minute, logger)
+
+    // 4. Build per-app telemetry
+    return buildAppTelemetry(allStacks, telemetry, logs)
+}
+```
+
+**Key: uses `s.Protected` (from config's protected list) to skip infrastructure containers** — no hardcoded names.
+
+### File: `controller/cmd/controller/main.go` (MODIFY)
+
+**Minimal change needed.** The `metricsStore` is already passed to `BuildReport()`. However, `config.Config` (the `cfg` parameter) is also already available in `BuildReport`. Check if `BuildReport` signature needs `*config.Config` for the protected stacks check — **it already receives `cfg *config.Config`** on line 25. No signature change needed.
+
+Actually, looking at this more carefully: `buildAppTelemetrySection` needs `cfg` to check `cfg.IsProtectedStack()`. But we're NOT using `cfg.IsProtectedStack()` — we're using `s.Protected` which is already set on each stack by the manager during `ScanStacks()`. So **no config dependency needed in the telemetry builder** beyond what's already available.
+
+Wait — double check: the `buildAppTelemetrySection` function as written takes `cfg *config.Config` but only uses `stackMgr.GetStacks()` which already has `s.Protected` set. We can simplify by removing the `cfg` parameter:
+
+```go
+func buildAppTelemetrySection(stackMgr *stacks.Manager, metricsStore *metrics.MetricsStore, logger *log.Logger) []AppTelemetry {
+```
+
+**No changes to main.go needed.**
+
+---
+
+## Phase 4: Hub — Store Changes
+
+### File: `hub/internal/store/store.go` (MODIFY)
+
+#### 4a. Add table creation in `migrate()` function
+
+Add after the existing table creation statements:
+
+```sql
+CREATE TABLE IF NOT EXISTS app_telemetry (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    customer_id TEXT NOT NULL,
+    app_name TEXT NOT NULL,
+    display_name TEXT NOT NULL DEFAULT '',
+    reported_at DATETIME NOT NULL,
+    memory_current_mb REAL DEFAULT 0,
+    memory_avg_mb REAL DEFAULT 0,
+    memory_peak_mb REAL DEFAULT 0,
+    cpu_avg_percent REAL DEFAULT 0,
+    catalog_estimate TEXT DEFAULT '',
+    catalog_limit TEXT DEFAULT '',
+    log_errors INTEGER DEFAULT 0,
+    log_warnings INTEGER DEFAULT 0,
+    containers_json TEXT DEFAULT '[]',
+    issues_json TEXT DEFAULT '[]'
+);
+
+CREATE INDEX IF NOT EXISTS idx_app_telemetry_lookup
+    ON app_telemetry(app_name, reported_at);
+CREATE INDEX IF NOT EXISTS idx_app_telemetry_customer
+    ON app_telemetry(customer_id, app_name, reported_at);
+CREATE INDEX IF NOT EXISTS idx_app_telemetry_prune
+    ON app_telemetry(reported_at);
+
+CREATE TABLE IF NOT EXISTS app_log_issues (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    app_name TEXT NOT NULL,
+    fingerprint TEXT NOT NULL,
+    severity TEXT NOT NULL,
+    message TEXT NOT NULL,
+    first_seen DATETIME NOT NULL,
+    last_seen DATETIME NOT NULL,
+    occurrence_count INTEGER DEFAULT 1,
+    affected_customers TEXT DEFAULT '[]',
+    UNIQUE(app_name, fingerprint)
+);
+
+CREATE INDEX IF NOT EXISTS idx_app_log_issues_app
+    ON app_log_issues(app_name, last_seen DESC);
+```
+
+#### 4b. Add types (top of file or separate types section)
+
+```go
+type AppTelemetryRecord struct {
+    AppName         string   `json:"app_name"`
+    DisplayName     string   `json:"display_name"`
+    Containers      []string `json:"containers"`
+    MemoryCurrentMB float64  `json:"memory_current_mb"`
+    MemoryAvgMB     float64  `json:"memory_avg_mb"`
+    MemoryPeakMB    float64  `json:"memory_peak_mb"`
+    CPUAvgPercent   float64  `json:"cpu_avg_percent"`
+    CatalogEstimate string   `json:"catalog_estimate"`
+    CatalogLimit    string   `json:"catalog_limit"`
+    LogErrors       int      `json:"log_errors"`
+    LogWarnings     int      `json:"log_warnings"`
+    Issues          []struct {
+        Severity string    `json:"severity"`
+        Message  string    `json:"message"`
+        Count    int       `json:"count"`
+        LastSeen time.Time `json:"last_seen"`
+    } `json:"issues,omitempty"`
+}
+
+type FleetAppSummary struct {
+    AppName         string
+    DisplayName     string
+    DeploymentCount int
+    AvgMemoryMB     float64
+    PeakMemoryMB    float64  // max across fleet
+    P95MemoryMB     float64
+    AvgCPU          float64
+    TotalErrors     int
+    TotalWarnings   int
+    CatalogEstimate string
+    CatalogLimit    string
+}
+
+type AppTelemetryPoint struct {
+    ReportedAt      time.Time
+    CustomerID      string
+    MemoryAvgMB     float64
+    MemoryPeakMB    float64
+    CPUAvgPercent   float64
+    LogErrors       int
+    LogWarnings     int
+}
+
+type AppCustomerStats struct {
+    CustomerID      string
+    AvgMemoryMB     float64
+    PeakMemoryMB    float64
+    AvgCPU          float64
+    TotalErrors     int
+    LastReport      time.Time
+}
+
+type CustomerAppSummary struct {
+    AppName         string
+    DisplayName     string
+    MemoryCurrentMB float64
+    MemoryAvgMB     float64
+    MemoryPeakMB    float64
+    CatalogLimit    string
+    LogErrors       int
+    LogWarnings     int
+}
+
+type AppIssue struct {
+    ID                int
+    AppName           string
+    Fingerprint       string
+    Severity          string
+    Message           string
+    FirstSeen         time.Time
+    LastSeen          time.Time
+    OccurrenceCount   int
+    AffectedCustomers []string
+}
+```
+
+#### 4c. Add store methods
+
+**`SaveAppTelemetry(customerID string, reportedAt time.Time, records []AppTelemetryRecord) error`**
+- Insert each record into `app_telemetry` table
+- Serialize `Containers` to JSON for `containers_json`
+- Serialize `Issues` to JSON for `issues_json`
+- Use a transaction for batch insert
+- For each record with non-empty issues, call `upsertAppIssue` for each issue
+
+**`upsertAppIssue(appName, fingerprint, severity, message, customerID string, lastSeen time.Time) error`**
+- Private helper
+- Use `INSERT INTO app_log_issues ... ON CONFLICT(app_name, fingerprint) DO UPDATE SET last_seen=MAX(last_seen, excluded.last_seen), occurrence_count=occurrence_count+1, ...`
+- For `affected_customers`: parse existing JSON array, add customerID if not present, re-serialize
+
+**`GetFleetAppSummary(since time.Time) ([]FleetAppSummary, error)`**
+```sql
+SELECT app_name,
+       MAX(display_name) as display_name,
+       COUNT(DISTINCT customer_id) as deployment_count,
+       AVG(memory_avg_mb) as avg_memory_mb,
+       MAX(memory_peak_mb) as peak_memory_mb,
+       AVG(cpu_avg_percent) as avg_cpu,
+       SUM(log_errors) as total_errors,
+       SUM(log_warnings) as total_warnings,
+       MAX(catalog_estimate) as catalog_estimate,
+       MAX(catalog_limit) as catalog_limit
+FROM app_telemetry
+WHERE reported_at > ?
+GROUP BY app_name
+ORDER BY deployment_count DESC, avg_memory_mb DESC
+```
+
+For P95 memory: separate query per app (can be batched in Go):
+```sql
+SELECT memory_peak_mb FROM app_telemetry
+WHERE app_name = ? AND reported_at > ?
+ORDER BY memory_peak_mb ASC
+LIMIT 1 OFFSET (
+    SELECT CAST(COUNT(*) * 0.95 AS INTEGER)
+    FROM app_telemetry WHERE app_name = ? AND reported_at > ?
+)
+```
+
+**`GetAppTelemetryHistory(appName string, since time.Time) ([]AppTelemetryPoint, error)`**
+```sql
+SELECT reported_at, customer_id, memory_avg_mb, memory_peak_mb, cpu_avg_percent, log_errors, log_warnings
+FROM app_telemetry
+WHERE app_name = ? AND reported_at > ?
+ORDER BY reported_at ASC
+```
+
+**`GetAppCustomerBreakdown(appName string, since time.Time) ([]AppCustomerStats, error)`**
+```sql
+SELECT customer_id, AVG(memory_avg_mb), MAX(memory_peak_mb), AVG(cpu_avg_percent),
+       SUM(log_errors), MAX(reported_at)
+FROM app_telemetry
+WHERE app_name = ? AND reported_at > ?
+GROUP BY customer_id
+ORDER BY AVG(memory_avg_mb) DESC
+```
+
+**`GetCustomerAppSummary(customerID string, since time.Time) ([]CustomerAppSummary, error)`**
+```sql
+SELECT t1.app_name, t1.display_name, t1.memory_current_mb,
+       AVG(t2.memory_avg_mb), MAX(t2.memory_peak_mb),
+       MAX(t2.catalog_limit),
+       SUM(t2.log_errors), SUM(t2.log_warnings)
+FROM app_telemetry t1
+INNER JOIN (
+    SELECT app_name, MAX(reported_at) as max_reported
+    FROM app_telemetry WHERE customer_id = ? AND reported_at > ?
+    GROUP BY app_name
+) latest ON t1.app_name = latest.app_name AND t1.reported_at = latest.max_reported AND t1.customer_id = ?
+LEFT JOIN app_telemetry t2 ON t2.app_name = t1.app_name AND t2.customer_id = ? AND t2.reported_at > ?
+GROUP BY t1.app_name
+ORDER BY AVG(t2.memory_avg_mb) DESC
+```
+
+Actually, this query is overly complex. Simpler approach:
+```sql
+-- Get 7d averages/peaks
+SELECT app_name, MAX(display_name), AVG(memory_avg_mb), MAX(memory_peak_mb),
+       MAX(catalog_limit), SUM(log_errors), SUM(log_warnings)
+FROM app_telemetry WHERE customer_id = ? AND reported_at > ?
+GROUP BY app_name ORDER BY AVG(memory_avg_mb) DESC
+```
+Then for current memory, get from the latest record per app:
+```sql
+SELECT app_name, memory_current_mb FROM app_telemetry
+WHERE customer_id = ? AND reported_at = (
+    SELECT MAX(reported_at) FROM app_telemetry WHERE customer_id = ? AND app_name = app_telemetry.app_name
+)
+```
+
+Or just do two queries and merge in Go. Simpler and more readable.
+
+**`GetAppIssues(appName string, limit int) ([]AppIssue, error)`**
+```sql
+SELECT id, app_name, fingerprint, severity, message, first_seen, last_seen,
+       occurrence_count, affected_customers
+FROM app_log_issues WHERE app_name = ?
+ORDER BY last_seen DESC LIMIT ?
+```
+Parse `affected_customers` from JSON string to `[]string` in Go.
+
+**`GetRecentIssuesAllApps(limit int) ([]AppIssue, error)`**
+```sql
+SELECT id, app_name, fingerprint, severity, message, first_seen, last_seen,
+       occurrence_count, affected_customers
+FROM app_log_issues ORDER BY last_seen DESC LIMIT ?
+```
+
+**`PruneAppTelemetry(before time.Time) (int64, error)`**
+```sql
+DELETE FROM app_telemetry WHERE reported_at < ?
+```
+
+**`PruneStaleIssues(notSeenSince time.Time) (int64, error)`**
+```sql
+DELETE FROM app_log_issues WHERE last_seen < ?
+```
+
+---
+
+## Phase 5: Hub — API Handler Changes
+
+### File: `hub/internal/api/handler.go` (MODIFY)
+
+In the report handler (`POST /api/v1/report`), AFTER `store.SaveReport(customerID, body)`:
+
+```go
+// Parse and save app telemetry (backward-compatible — old controllers won't have this field)
+var telemetryPayload struct {
+    AppTelemetry []store.AppTelemetryRecord `json:"app_telemetry"`
+}
+if err := json.Unmarshal(body, &telemetryPayload); err == nil && len(telemetryPayload.AppTelemetry) > 0 {
+    if err := h.store.SaveAppTelemetry(customerID, time.Now(), telemetryPayload.AppTelemetry); err != nil {
+        h.logger.Printf("[WARN] Failed to save app telemetry for %s: %v", customerID, err)
     }
 }
 ```
 
-### 2f. `controller/internal/storage/migrate.go` — Post-migration DB dump copy
+This is non-breaking: if `app_telemetry` is absent or null, the slice will be empty and nothing is stored.
 
-**Lines 397-398.** Add import for `backup` package (same import section as 2c — `storage` package can safely import `backup`).
+---
+
+## Phase 6: Hub — Prune Updates
+
+### File: `hub/cmd/hub/main.go` (MODIFY)
+
+In the prune goroutine (find where `store.Prune(maxDays)` is called), add after it:
 
-Replace:
 ```go
-srcDBDumps := filepath.Join(req.CurrentHDDPath, "backups", "primary", req.StackName, "db-dumps")
-dstDBDumps := filepath.Join(req.TargetPath, "backups", "primary", req.StackName, "db-dumps")
+if n, err := st.PruneAppTelemetry(time.Now().Add(-90 * 24 * time.Hour)); err != nil {
+    logger.Printf("[ERROR] Prune app telemetry: %v", err)
+} else if n > 0 {
+    logger.Printf("[INFO] Pruned %d old app telemetry rows", n)
+}
+if n, err := st.PruneStaleIssues(time.Now().Add(-30 * 24 * time.Hour)); err != nil {
+    logger.Printf("[ERROR] Prune stale issues: %v", err)
+} else if n > 0 {
+    logger.Printf("[INFO] Pruned %d stale app issues", n)
+}
 ```
-with:
+
+---
+
+## Phase 7: Hub — Web Dashboard Pages
+
+### 7a. Add Chart.js to hub
+
+**Copy** `controller/internal/web/static/chart.min.js` to `hub/internal/web/static/chart.min.js`.
+
+**Create or modify** `hub/internal/web/embed.go`:
 ```go
-srcDBDumps := backup.AppDBDumpPath(req.CurrentHDDPath, req.StackName)
-dstDBDumps := backup.AppDBDumpPath(req.TargetPath, req.StackName)
+package web
+
+import "embed"
+
+//go:embed templates/*.html templates/*.css
+var templateFS embed.FS
+
+//go:embed static/chart.min.js
+var chartJS []byte
 ```
 
-Add to the import block:
+The hub already has `hub/internal/web/embed.go` with `//go:embed templates/*` and `var templateFS embed.FS`. Add the chart.min.js embed directive there alongside the existing ones.
+
+**Add route** in `server.go` ServeHTTP:
 ```go
-"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
+case path == "/static/chart.min.js":
+    w.Header().Set("Content-Type", "application/javascript")
+    w.Header().Set("Cache-Control", "public, max-age=86400")
+    w.Write(chartJS)
 ```
 
-### 2g. `controller/internal/web/handlers.go` — Legacy "storage" path (pre-existing bug)
+### 7b. Add routes in `server.go` ServeHTTP
 
-**Line 1223.** Replace legacy dead code that uses `"storage"` instead of `"appdata"`.
+Add BEFORE the `case strings.HasPrefix(path, "/customers/")` block (to avoid the prefix match catching `/apps`):
 
-The `backup` package is already imported in `handlers.go`, so use the helper directly:
-
-Replace:
 ```go
-appDataDir := filepath.Join(storagePath, "storage", stack.Name)
+case path == "/apps" || path == "/apps/":
+    s.handleApps(w, r)
+case strings.HasPrefix(path, "/apps/"):
+    appName := strings.TrimPrefix(path, "/apps/")
+    s.handleAppDetail(w, r, appName)
 ```
-with:
+
+### 7c. Navigation update
+
+In **`hub/internal/web/templates/dashboard.html`** (or wherever the header nav is defined), add between "Dashboard" and "Customers" links:
+
+```html
+<a href="/apps" class="nav-link">Alkalmazások</a>
+```
+
+If the nav is in a shared layout/header included in all templates, update it there. If each template has its own nav block, update all of them.
+
+### 7d. Handler: `handleApps`
+
+**File: `hub/internal/web/server.go`** (or a new `hub/internal/web/apps.go` for cleaner organization)
+
 ```go
-appDataDir := backup.AppDataDir(storagePath, stack.Name)
+func (s *Server) handleApps(w http.ResponseWriter, r *http.Request) {
+    // Parse time range from query param: ?period=24h|7d|30d (default 7d)
+    period := r.URL.Query().Get("period")
+    since := parsePeriod(period, 7*24*time.Hour) // helper: returns time.Now().Add(-duration)
+
+    // Sort param: ?sort=memory|deployments|errors&order=asc|desc
+    sortBy := r.URL.Query().Get("sort")
+    order := r.URL.Query().Get("order")
+
+    summary, err := s.store.GetFleetAppSummary(since)
+    if err != nil { ... }
+
+    // Sort in Go based on query params (default: by deployment count DESC)
+    sortFleetSummary(summary, sortBy, order)
+
+    // Summary cards
+    totalApps := len(summary)
+    totalDeployments := 0
+    appsWithErrors := 0
+    for _, s := range summary {
+        totalDeployments += s.DeploymentCount
+        if s.TotalErrors > 0 { appsWithErrors++ }
+    }
+
+    data := map[string]interface{}{
+        "Apps": summary, "Period": period,
+        "TotalApps": totalApps, "TotalDeployments": totalDeployments,
+        "AppsWithErrors": appsWithErrors,
+        "Sort": sortBy, "Order": order,
+        "CSRFToken": csrfToken,
+    }
+    s.templates.ExecuteTemplate(w, "apps.html", data)
+}
 ```
 
-No import addition needed.
-
----
-
-## Phase 3: Format & Attach — Create `felhom-data/` Directory
-
-### 3a. `controller/internal/storage/format_linux.go`
-
-**Line 211.** Replace `"storage"` with `"felhom-data"` in the subdirectory creation list:
-
-Replace:
+Add helper `parsePeriod(s string, defaultDur time.Duration) time.Time`:
 ```go
-for _, subdir := range []string{"storage", "Dokumentumok"} {
+func parsePeriod(s string, defaultDur time.Duration) time.Time {
+    switch s {
+    case "24h": return time.Now().Add(-24 * time.Hour)
+    case "7d": return time.Now().Add(-7 * 24 * time.Hour)
+    case "30d": return time.Now().Add(-30 * 24 * time.Hour)
+    default: return time.Now().Add(-defaultDur)
+    }
+}
 ```
-with:
+
+### 7e. Handler: `handleAppDetail`
+
 ```go
-for _, subdir := range []string{"felhom-data", "Dokumentumok"} {
+func (s *Server) handleAppDetail(w http.ResponseWriter, r *http.Request, appName string) {
+    period := r.URL.Query().Get("period")
+    since := parsePeriod(period, 7*24*time.Hour)
+
+    // Get customer breakdown
+    customers, _ := s.store.GetAppCustomerBreakdown(appName, since)
+
+    // Get telemetry history for chart
+    history, _ := s.store.GetAppTelemetryHistory(appName, since)
+
+    // Get issues
+    issues, _ := s.store.GetAppIssues(appName, 20)
+
+    // Compute fleet summary for this single app (for overview card)
+    fleetAll, _ := s.store.GetFleetAppSummary(since)
+    var appSummary *FleetAppSummary
+    for i := range fleetAll {
+        if fleetAll[i].AppName == appName { appSummary = &fleetAll[i]; break }
+    }
+
+    // Suggested mem_limit: ceil(P95 * 1.2), rounded to nearest 32M
+    var suggestedLimit int
+    if appSummary != nil && appSummary.P95MemoryMB > 0 {
+        raw := appSummary.P95MemoryMB * 1.2
+        suggestedLimit = ((int(raw) + 31) / 32) * 32 // round up to nearest 32
+    }
+
+    // Prepare chart data (aggregate by time bucket for fleet-wide view)
+    // Group history points by reported_at hour, compute avg of avgs and max of peaks
+    chartData := aggregateHistoryForChart(history)
+
+    data := map[string]interface{}{
+        "AppName": appName, "Summary": appSummary,
+        "Customers": customers, "Issues": issues,
+        "ChartData": chartData, "SuggestedLimit": suggestedLimit,
+        "Period": period, "CSRFToken": csrfToken,
+    }
+    s.templates.ExecuteTemplate(w, "app_detail.html", data)
+}
 ```
 
-### 3b. `controller/internal/storage/attach_linux.go`
+`aggregateHistoryForChart` groups data points into hourly buckets, returns `{Labels []string, AvgMemory []float64, PeakMemory []float64, CatalogLimit []float64}` for Chart.js.
 
-**Line 313.** Same change:
+### 7f. Extend `handleCustomerUnified`
+
+In **`hub/internal/web/configs.go`** where `handleCustomerUnified` builds its template data, add:
 
-Replace:
 ```go
-for _, subdir := range []string{"storage", "Dokumentumok"} {
-```
-with:
-```go
-for _, subdir := range []string{"felhom-data", "Dokumentumok"} {
+// App telemetry section
+appTelemetry, _ := s.store.GetCustomerAppSummary(customerID, time.Now().Add(-7*24*time.Hour))
+// Only show section if data exists
+data["AppTelemetry"] = appTelemetry
+data["HasAppTelemetry"] = len(appTelemetry) > 0
 ```
 
----
+### 7g. Template: `hub/internal/web/templates/apps.html` (NEW)
 
-## Phase 4: Verification Grep
+Fleet-wide app list page. Follow existing hub template patterns:
+- Same dark theme, same table styles
+- Header nav with "Alkalmazások" active
+- Summary cards row at top (3 cards: Total apps, Total deployments, Apps with errors)
+- Time range selector buttons (24h / 7d / 30d) — links to `?period=...`
+- Main table with columns: App name (link to /apps/{name}), Deployments, Avg Memory, P95 Memory, Catalog Estimate, Catalog Limit, Estimate Accuracy (icon), Errors (24h badge), Warnings (24h badge)
+- Sortable column headers (links to `?sort=...&order=...`)
+- Estimate accuracy: green dot if P95 < limit, yellow if P95 > 50% of limit, red if P95 > limit
+- All text in Hungarian
 
-After making all the above changes, run these greps to verify no hardcoded paths remain:
+### 7h. Template: `hub/internal/web/templates/app_detail.html` (NEW)
 
-```bash
-grep -rn '"appdata"' controller/internal/ --include='*.go' | grep -v '_test.go\|paths.go\|CLAUDE\|README'
-grep -rn '"backups"' controller/internal/ --include='*.go' | grep -v '_test.go\|paths.go\|CLAUDE\|README'
+Per-app detail page with:
+1. **Overview card**: App name, display name, catalog estimates, deployment count, suggested mem_limit
+2. **Memory trend chart**: `<canvas id="memoryChart">`, Chart.js line chart with:
+   - Lines: Avg Memory (blue), Peak Memory (red)
+   - Dashed horizontal line: Catalog mem_limit (green)
+   - Data from `chartData` (injected via `{{ json .ChartData }}`)
+3. **Customer breakdown table**: Customer link, Avg Memory, Peak Memory, CPU, Errors, Last Report
+4. **Common issues table**: Severity badge, Message, Occurrences, Affected Customers, First/Last Seen
+
+Include Chart.js: `<script src="/static/chart.min.js"></script>`
+
+### 7i. Template: `hub/internal/web/templates/customer_unified.html` (MODIFY)
+
+Add new section "Alkalmazás telemetria" (conditionally shown):
+
+```html
+{{ if .HasAppTelemetry }}
+<div class="section">
+  <h2>Alkalmazás telemetria</h2>
+  <table class="data-table">
+    <thead>
+      <tr>
+        <th>Alkalmazás</th>
+        <th>Memória (jelenlegi)</th>
+        <th>Memória (átlag 7d)</th>
+        <th>Memória (csúcs 7d)</th>
+        <th>Katalógus limit</th>
+        <th>Hibák (24ó)</th>
+        <th>Figyelmeztetések (24ó)</th>
+      </tr>
+    </thead>
+    <tbody>
+      {{ range .AppTelemetry }}
+      <tr>
+        <td><a href="/apps/{{ .AppName }}">{{ .DisplayName }}</a></td>
+        <td>{{ formatFloat .MemoryCurrentMB }} MB</td>
+        <td>{{ formatFloat .MemoryAvgMB }} MB</td>
+        <td>{{ formatFloat .MemoryPeakMB }} MB</td>
+        <td>{{ .CatalogLimit }}</td>
+        <td>{{ if gt .LogErrors 0 }}<span class="badge badge-error">{{ .LogErrors }}</span>{{ else }}0{{ end }}</td>
+        <td>{{ if gt .LogWarnings 0 }}<span class="badge badge-warn">{{ .LogWarnings }}</span>{{ else }}0{{ end }}</td>
+      </tr>
+      {{ end }}
+    </tbody>
+  </table>
+</div>
+{{ end }}
 ```
 
-**Expected remaining hits** (all OK — not filesystem path construction):
-- `web/handlers.go` — `"backups"` as page name for template routing (display context)
-- `web/templates/layout.html` — navigation link text
-- `web/templates/backups.html` — template define name
-- Any template/HTML display contexts
+Memory cell coloring: Use inline style or CSS class based on percentage of catalog_limit. This requires a template function to parse the limit string and compare — add a `memoryColor(currentMB float64, limitStr string) string` template function that returns a CSS color.
 
-**Any remaining `filepath.Join(*, "appdata", *)` or `filepath.Join(*, "backups", *)` outside of `paths.go` is a BUG** — fix it.
+### 7j. CSS additions in `hub/internal/web/templates/style.css` (MODIFY)
+
+Add styles for:
+- `.badge`, `.badge-error` (red), `.badge-warn` (yellow)
+- `.summary-cards` (flex row of 3 cards)
+- `.summary-card` (dark card with number + label)
+- `.chart-container` (responsive canvas wrapper)
+- `.period-selector` (button group for time ranges)
+- `.accuracy-dot` (small colored circle for estimate accuracy)
+- Memory cell colors: `.mem-ok` (green text), `.mem-warn` (yellow), `.mem-danger` (red)
+
+Follow existing hub dark theme color variables.
 
 ---
 
-## Phase 5: Verification of Auto-Propagating Changes
+## Phase 8: Version Bumps & Changelog
 
-These components use path helpers and automatically get the namespace change from Phase 1:
+### Controller
+- Update version constant to `v0.28.0` in the appropriate file (likely `cmd/controller/main.go` or a `version.go` file)
+- Add CHANGELOG.md entry
 
-### 5a. `controller/internal/backup/crossdrive.go`
-
-The `syncInfraConfig()` method (line 504) uses `SecondaryInfraPath(dest)` — auto-updated.
-The `runRsyncBackup()` method (line 367) uses `AppSecondaryRsyncPath()` — auto-updated.
-The `copyStackDBDumps()` method (line 455) uses `AppDBDumpPath()` — auto-updated.
-
-**No changes needed.** Just verify by reading the file.
-
-### 5b. `controller/internal/backup/restore.go`
-
-Line 65: `AppDBDumpPath(drivePath, stackName)` — auto-updated.
-Line 84: `PrimaryResticRepoPath(drivePath)` — auto-updated.
-
-**No changes needed.**
-
-### 5c. `controller/internal/backup/backup.go`
-
-Multiple uses of `AppDataDir()`, `AppDBDumpPath()`, `PrimaryResticRepoPath()` — all auto-updated.
-
-**No changes needed.**
+### Hub
+- Update version constant to `v0.4.0`
+- Add CHANGELOG.md entry (if hub has one)
 
 ---
 
-## Phase 6: Build & Verify
+## Implementation Checklist
 
-```bash
-cd controller && go build ./... && go vet ./...
-```
+### Controller (can be deployed and tested independently)
+- [ ] `internal/metrics/telemetry.go` — GetContainerTelemetry method
+- [ ] `internal/metrics/logscanner.go` — ScanContainerLogs + types
+- [ ] `internal/report/types.go` — Add AppTelemetry field + type definitions
+- [ ] `internal/report/telemetry.go` — buildAppTelemetry + buildAppTelemetrySection
+- [ ] `internal/report/builder.go` — Call buildAppTelemetrySection in BuildReport
+- [ ] Test: build, deploy to demo, verify `app_telemetry` in report JSON
 
-Must compile cleanly with no errors or warnings.
+### Hub (deploy after controller verified)
+- [ ] `internal/store/store.go` — Tables + types + all store methods
+- [ ] `internal/api/handler.go` — Parse & save telemetry from reports
+- [ ] `cmd/hub/main.go` — Add prune calls
+- [ ] `internal/web/static/chart.min.js` — Copy from controller
+- [ ] `internal/web/embed.go` — Add chart.min.js embed
+- [ ] `internal/web/server.go` — Routes + handlers + chart.js serving + parsePeriod helper
+- [ ] `internal/web/templates/apps.html` — Fleet app list page
+- [ ] `internal/web/templates/app_detail.html` — App detail page with chart
+- [ ] `internal/web/templates/customer_unified.html` — Add telemetry section
+- [ ] `internal/web/templates/style.css` — New styles
+- [ ] Navigation update in all templates (add "Alkalmazások" link)
+- [ ] Test: deploy hub, verify pages after a few report cycles
 
 ---
 
-## Phase 7: Wipe Script
-
-### File: `scripts/felhom-wipe.sh`
-
-Create the following script. It must be executable (`chmod +x`).
-
-```bash
-#!/usr/bin/env bash
-set -euo pipefail
-
-# ===================================================================
-# felhom-wipe.sh — Clean felhom data from a test node
-# Usage: ./felhom-wipe.sh --level <soft|controller|full|nuclear> [--yes]
-# ===================================================================
-
-# --- Colors ---
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-GREEN='\033[0;32m'
-CYAN='\033[0;36m'
-BOLD='\033[1m'
-NC='\033[0m'
-
-# --- Defaults ---
-LEVEL=""
-DRY_RUN=true
-INCLUDE_PROTECTED=false
-
-# --- Configuration (auto-detected) ---
-CONTROLLER_YAML="/opt/docker/felhom-controller/controller.yaml"
-DATA_DIR="/opt/docker/felhom-controller/data"
-COMPOSE_DIR="/opt/docker/felhom-controller"
-STACKS_DIR="/opt/docker/stacks"
-SETTINGS_JSON="$DATA_DIR/settings.json"
-
-# --- Helpers ---
-die()  { echo -e "${RED}ERROR: $1${NC}" >&2; exit 1; }
-info() { echo -e "${GREEN}$1${NC}"; }
-warn() { echo -e "${YELLOW}$1${NC}"; }
-bold() { echo -e "${BOLD}$1${NC}"; }
-
-human_size() {
-    local path="$1"
-    if [ -e "$path" ]; then
-        du -sh "$path" 2>/dev/null | cut -f1 || echo "?"
-    else
-        echo "n/a"
-    fi
-}
-
-usage() {
-    cat <<EOF
-Usage: $(basename "$0") --level <level> [--yes] [--include-protected]
-
-Levels:
-  soft        Controller state only (settings.json, metrics.db, session data)
-  controller  Soft + remove all app containers, volumes, stack dirs, app.yaml files
-  full        Controller + felhom-data/ on all drives (appdata, backups)
-  nuclear     Full + controller.yaml, controller container, Traefik, Portainer, all Docker data
-
-Options:
-  --yes                Execute the wipe (default: dry run)
-  --include-protected  Also remove protected stacks (controller level only)
-
-EOF
-    exit 1
-}
-
-# --- Parse Args ---
-parse_args() {
-    while [[ $# -gt 0 ]]; do
-        case "$1" in
-            --level)       LEVEL="$2"; shift 2 ;;
-            --yes)         DRY_RUN=false; shift ;;
-            --include-protected) INCLUDE_PROTECTED=true; shift ;;
-            -h|--help)     usage ;;
-            *)             die "Unknown argument: $1" ;;
-        esac
-    done
-
-    [[ -z "$LEVEL" ]] && usage
-    case "$LEVEL" in
-        soft|controller|full|nuclear) ;;
-        *) die "Invalid level: $LEVEL (must be soft|controller|full|nuclear)" ;;
-    esac
-}
-
-# --- Detect Paths ---
-detect_paths() {
-    # Auto-detect from controller.yaml if present
-    if [ -f "$CONTROLLER_YAML" ]; then
-        local sd
-        sd=$(grep -oP 'stacks_dir:\s*\K\S+' "$CONTROLLER_YAML" 2>/dev/null || true)
-        [ -n "$sd" ] && STACKS_DIR="$sd"
-        local dd
-        dd=$(grep -oP 'data_dir:\s*\K\S+' "$CONTROLLER_YAML" 2>/dev/null || true)
-        [ -n "$dd" ] && DATA_DIR="$dd" && SETTINGS_JSON="$dd/settings.json"
-    fi
-}
-
-# --- Detect Storage Paths ---
-declare -a STORAGE_PATHS=()
-
-detect_storage_paths() {
-    # From settings.json
-    if [ -f "$SETTINGS_JSON" ]; then
-        while IFS= read -r p; do
-            [ -n "$p" ] && STORAGE_PATHS+=("$p")
-        done < <(python3 -c "
-import json, sys
-try:
-    d = json.load(open('$SETTINGS_JSON'))
-    for sp in d.get('storage_paths', []):
-        print(sp.get('path', ''))
-except: pass
-" 2>/dev/null || true)
-    fi
-
-    # Also scan /mnt/* for felhom-data dirs not in registry
-    for d in /mnt/*/; do
-        [ -d "${d}felhom-data" ] || [ -d "${d}appdata" ] || continue
-        local already=false
-        for sp in "${STORAGE_PATHS[@]:-}"; do
-            [ "$sp" = "${d%/}" ] && already=true && break
-        done
-        $already || STORAGE_PATHS+=("${d%/}")
-    done
-}
-
-# --- List App Containers (non-infra) ---
-list_app_containers() {
-    docker ps -a --format '{{.Names}}' 2>/dev/null | grep -v -E '^(felhom-controller|traefik|cloudflared|portainer)$' || true
-}
-
-# --- List App Volumes (non-infra) ---
-list_app_volumes() {
-    docker volume ls -q 2>/dev/null | grep -v -E '^(portainer_data)$' || true
-}
-
-# --- Protected Stacks ---
-get_protected_stacks() {
-    if [ -f "$CONTROLLER_YAML" ]; then
-        grep -A 20 'protected_stacks:' "$CONTROLLER_YAML" 2>/dev/null | grep -oP '^\s*-\s*\K\S+' || true
-    fi
-}
-
-# --- Print Plan ---
-print_plan() {
-    echo ""
-    bold "=== Felhom Wipe — Level: $LEVEL ==="
-    echo ""
-
-    # State files
-    echo -e "${CYAN}Controller state:${NC}"
-    local state_files=("$DATA_DIR/settings.json" "$DATA_DIR/metrics.db" "$DATA_DIR/setup-state.json" "$DATA_DIR/update-state.json" "$DATA_DIR/session-data.json" "$DATA_DIR/snapshot-history.json")
-    for f in "${state_files[@]}"; do
-        if [ -f "$f" ]; then
-            echo -e "  ${YELLOW}DELETE${NC} $f ($(human_size "$f"))"
-        fi
-    done
-
-    if [[ "$LEVEL" == "controller" || "$LEVEL" == "full" || "$LEVEL" == "nuclear" ]]; then
-        echo ""
-        echo -e "${CYAN}Docker containers:${NC}"
-        local containers
-        containers=$(list_app_containers)
-        if [ -n "$containers" ]; then
-            echo "$containers" | while read -r c; do
-                echo -e "  ${YELLOW}REMOVE${NC} $c"
-            done
-        else
-            echo -e "  ${GREEN}(none)${NC}"
-        fi
-
-        echo ""
-        echo -e "${CYAN}Docker volumes:${NC}"
-        local volumes
-        volumes=$(list_app_volumes)
-        if [ -n "$volumes" ]; then
-            echo "$volumes" | while read -r v; do
-                echo -e "  ${YELLOW}REMOVE${NC} $v"
-            done
-        else
-            echo -e "  ${GREEN}(none)${NC}"
-        fi
-
-        echo ""
-        echo -e "${CYAN}Stack directories:${NC}"
-        if [ -d "$STACKS_DIR" ]; then
-            for sd in "$STACKS_DIR"/*/; do
-                [ -d "$sd" ] || continue
-                local stack_name
-                stack_name=$(basename "$sd")
-                local protected_stacks
-                protected_stacks=$(get_protected_stacks)
-                if echo "$protected_stacks" | grep -qx "$stack_name" && ! $INCLUDE_PROTECTED; then
-                    echo -e "  ${GREEN}KEEP${NC}   $sd (protected)"
-                else
-                    echo -e "  ${YELLOW}DELETE${NC} $sd"
-                fi
-            done
-        else
-            echo -e "  ${GREEN}(not found)${NC}"
-        fi
-    fi
-
-    if [[ "$LEVEL" == "full" || "$LEVEL" == "nuclear" ]]; then
-        echo ""
-        echo -e "${CYAN}Storage data:${NC}"
-        if [ ${#STORAGE_PATHS[@]} -gt 0 ]; then
-            for sp in "${STORAGE_PATHS[@]}"; do
-                if [ -d "$sp/felhom-data" ]; then
-                    echo -e "  ${YELLOW}DELETE${NC} $sp/felhom-data/ ($(human_size "$sp/felhom-data"))"
-                fi
-                # Old-style paths
-                if [ -d "$sp/appdata" ]; then
-                    echo -e "  ${YELLOW}DELETE${NC} $sp/appdata/ ($(human_size "$sp/appdata")) [old-style]"
-                fi
-                if [ -d "$sp/backups" ]; then
-                    echo -e "  ${YELLOW}DELETE${NC} $sp/backups/ ($(human_size "$sp/backups")) [old-style]"
-                fi
-            done
-        else
-            echo -e "  ${GREEN}(no storage paths found)${NC}"
-        fi
-    fi
-
-    if [[ "$LEVEL" == "nuclear" ]]; then
-        echo ""
-        echo -e "${RED}Nuclear:${NC}"
-        echo -e "  ${RED}DELETE${NC} controller.yaml"
-        echo -e "  ${RED}DELETE${NC} controller container + image"
-        echo -e "  ${RED}DELETE${NC} Traefik container"
-        echo -e "  ${RED}DELETE${NC} Cloudflared container"
-        echo -e "  ${RED}DELETE${NC} Portainer container + volume"
-        echo -e "  ${RED}DELETE${NC} .felhom-infra-backup/ (DR markers on all drives)"
-        echo -e "  ${RED}DELETE${NC} All Docker data (docker system prune -af --volumes)"
-    fi
-
-    echo ""
-    echo -e "${CYAN}Will preserve:${NC}"
-    echo -e "  ${GREEN}- OS and system files${NC}"
-    if [[ "$LEVEL" != "nuclear" ]]; then
-        echo -e "  ${GREEN}- Controller container (felhom-controller)${NC}"
-        echo -e "  ${GREEN}- Controller image${NC}"
-        echo -e "  ${GREEN}- Traefik, Cloudflare Tunnel${NC}"
-        echo -e "  ${GREEN}- controller.yaml${NC}"
-        echo -e "  ${GREEN}- .felhom-infra-backup/ (DR markers on drives)${NC}"
-    fi
-    if [[ "$LEVEL" != "full" && "$LEVEL" != "nuclear" ]]; then
-        echo -e "  ${GREEN}- Storage data on drives${NC}"
-    fi
-    echo -e "  ${GREEN}- User files (Dokumentumok, media, etc.)${NC}"
-    echo ""
-}
-
-# --- Wipe Functions ---
-
-do_soft_wipe() {
-    info "Soft wipe: removing controller state..."
-    local state_files=("$DATA_DIR/settings.json" "$DATA_DIR/metrics.db" "$DATA_DIR/setup-state.json" "$DATA_DIR/update-state.json" "$DATA_DIR/session-data.json" "$DATA_DIR/snapshot-history.json")
-    for f in "${state_files[@]}"; do
-        [ -f "$f" ] && rm -f "$f" && info "  Removed: $f"
-    done
-}
-
-do_controller_wipe() {
-    do_soft_wipe
-
-    info "Controller wipe: stopping and removing app containers..."
-
-    # Stop and remove app containers
-    local containers
-    containers=$(list_app_containers)
-    if [ -n "$containers" ]; then
-        echo "$containers" | while read -r c; do
-            docker rm -f "$c" 2>/dev/null && info "  Removed container: $c" || warn "  Failed to remove: $c"
-        done
-    fi
-
-    # Remove app volumes
-    info "Removing app volumes..."
-    local volumes
-    volumes=$(list_app_volumes)
-    if [ -n "$volumes" ]; then
-        echo "$volumes" | while read -r v; do
-            docker volume rm "$v" 2>/dev/null && info "  Removed volume: $v" || warn "  Failed to remove: $v"
-        done
-    fi
-
-    # Remove stack directories
-    info "Removing stack directories..."
-    if [ -d "$STACKS_DIR" ]; then
-        local protected_stacks
-        protected_stacks=$(get_protected_stacks)
-        for sd in "$STACKS_DIR"/*/; do
-            [ -d "$sd" ] || continue
-            local stack_name
-            stack_name=$(basename "$sd")
-            if echo "$protected_stacks" | grep -qx "$stack_name" && ! $INCLUDE_PROTECTED; then
-                warn "  Skipping protected stack: $stack_name"
-                continue
-            fi
-            rm -rf "$sd" && info "  Removed: $sd"
-        done
-    fi
-
-    # NOTE: No restart here — callers handle restart after all cleanup is done.
-}
-
-do_full_wipe() {
-    do_controller_wipe
-
-    info "Full wipe: removing storage data..."
-    for sp in "${STORAGE_PATHS[@]}"; do
-        # New-style namespace
-        if [ -d "$sp/felhom-data" ]; then
-            rm -rf "$sp/felhom-data" && info "  Removed: $sp/felhom-data/"
-        fi
-        # Old-style paths
-        if [ -d "$sp/appdata" ]; then
-            rm -rf "$sp/appdata" && info "  Removed: $sp/appdata/ [old-style]"
-        fi
-        if [ -d "$sp/backups" ]; then
-            rm -rf "$sp/backups" && info "  Removed: $sp/backups/ [old-style]"
-        fi
-    done
-
-    # Restart controller after all cleanup is done
-    info "Restarting controller..."
-    docker restart felhom-controller 2>/dev/null || warn "Could not restart controller"
-}
-
-do_nuclear_wipe() {
-    do_full_wipe
-
-    info "Nuclear wipe: removing all infrastructure..."
-
-    # Stop infrastructure containers
-    for c in felhom-controller traefik cloudflared portainer; do
-        docker rm -f "$c" 2>/dev/null && info "  Removed: $c" || true
-    done
-
-    # Remove controller.yaml
-    [ -f "$CONTROLLER_YAML" ] && rm -f "$CONTROLLER_YAML" && info "  Removed: controller.yaml"
-
-    # Remove DR markers (nuclear = brand-new machine simulation)
-    for sp in "${STORAGE_PATHS[@]}"; do
-        if [ -d "$sp/.felhom-infra-backup" ]; then
-            rm -rf "$sp/.felhom-infra-backup" && info "  Removed: $sp/.felhom-infra-backup/"
-        fi
-    done
-
-    # Remove all Docker data
-    warn "Pruning all Docker data..."
-    docker system prune -af --volumes 2>/dev/null || warn "Docker prune failed"
-
-    echo ""
-    info "Nuclear wipe complete."
-    echo -e "${CYAN}To redeploy, run:${NC}"
-    echo "  curl -fsSL https://gitea.dooplex.hu/admin/deploy-felhom-compose/raw/branch/main/scripts/docker-setup.sh | bash"
-}
-
-# --- Main ---
-main() {
-    # Must run as root
-    if [ "$(id -u)" -ne 0 ]; then
-        die "Must run as root (use sudo)"
-    fi
-
-    # Check Docker
-    if ! docker info >/dev/null 2>&1; then
-        die "Docker is not running"
-    fi
-
-    parse_args "$@"
-    detect_paths
-    detect_storage_paths
-    print_plan
-
-    if $DRY_RUN; then
-        warn "Dry run — nothing deleted. Use --yes to execute."
-        exit 0
-    fi
-
-    # Confirmation
-    echo -e "${RED}${BOLD}This will permanently delete the data listed above.${NC}"
-    read -rp "Type YES to confirm: " confirm
-    if [ "$confirm" != "YES" ]; then
-        echo "Aborted."
-        exit 1
-    fi
-
-    echo ""
-    case "$LEVEL" in
-        soft)       do_soft_wipe ;;
-        controller) do_controller_wipe
-                    info "Restarting controller..."
-                    docker restart felhom-controller 2>/dev/null || warn "Could not restart controller"
-                    ;;
-        full)       do_full_wipe ;;
-        nuclear)    do_nuclear_wipe ;;
-    esac
-
-    echo ""
-    info "Wipe complete (level: $LEVEL)."
-}
-
-main "$@"
-```
-
----
-
-## Phase 8: Version Bump
-
-### File: `controller/cmd/controller/main.go`
-
-Find the `Version` constant and update:
-```go
-const Version = "0.26.0"
-```
-
----
-
-## Phase 9: Documentation
-
-### 9a. CHANGELOG.md
-
-Read first 30 lines for format reference, then insert new entry at top of changelog:
-
-```markdown
-## v0.26.0 — 2026-02-XX
-
-### Changed
-- **Storage namespace**: All felhom-managed data on external drives now lives under `felhom-data/` subdirectory, cleanly separating from user files
-  - Path helpers (`paths.go`) updated: 8 functions now include `felhom-data` segment
-  - `InfraBackupDir()` unchanged — stays at drive root for DR scanner
-  - `ProtectedHDDPaths()` updated with namespace-aware paths
-  - Fixed hardcoded paths in `delete.go`, `migrate.go`, `migrate_drive.go`
-  - Format and attach wizards now create `felhom-data/` instead of legacy `storage/` subdirectory
-  - Fixed legacy `"storage"` path reference in `handlers.go` (was dead code)
-  - Drive migration rsync excludes updated for new path structure
-  - Drive migration size estimation updated for namespace directory
-
-### Added
-- `scripts/felhom-wipe.sh` — Test node cleanup script with 4 wipe levels (soft, controller, full, nuclear)
-- `backup.FelhomDataDir` constant for namespace directory name
-
-### Notes
-- Pre-v0.26.0 restic snapshots use old path structure without `felhom-data/`
-- App-catalog compose templates need separate update (see post-implementation task)
-- `HDD_PATH` env var value unchanged — still the mount point (e.g., `/mnt/hdd_1`)
-```
-
-### 9b. Controller README.md
-
-Update the "Storage Layout" section to show the new `felhom-data/` structure. Update path helper documentation. Add wipe script to scripts section. Add note about pre-v0.26.0 restic snapshot paths.
-
----
-
-## Complete File Change List
-
-| # | File | Action | Phase |
-|---|------|--------|-------|
-| 1 | `internal/backup/paths.go` | Edit: add constant + update 8 functions | 1 |
-| 2 | `internal/stacks/delete.go` | Edit: add local constant + fix `ProtectedHDDPaths()` + fix `GetStackBackupData()` | 2a, 2b |
-| 3 | `internal/storage/migrate_drive.go` | Edit: add import + fix conflict check + fix verify + fix rsync excludes + fix size estimation | 2c, 2d, 2e |
-| 4 | `internal/storage/migrate.go` | Edit: add import + fix DB dump copy paths | 2f |
-| 5 | `internal/web/handlers.go` | Edit: fix legacy `"storage"` path | 2g |
-| 6 | `internal/storage/format_linux.go` | Edit: replace `"storage"` with `"felhom-data"` | 3a |
-| 7 | `internal/storage/attach_linux.go` | Edit: replace `"storage"` with `"felhom-data"` | 3b |
-| 8 | `scripts/felhom-wipe.sh` | **New file** | 7 |
-| 9 | `cmd/controller/main.go` | Edit: version bump | 8 |
-| 10 | `CHANGELOG.md` | Edit: add v0.26.0 entry | 9a |
-| 11 | `README.md` | Edit: update storage layout + paths + scripts sections | 9b |
-
----
-
-## Testing Checklist
-
-1. `go build ./...` succeeds
-2. `go vet ./...` passes
-3. `grep -rn '"appdata"' controller/internal/ --include='*.go' | grep -v paths.go` — only display/template contexts
-4. `grep -rn '"backups"' controller/internal/ --include='*.go' | grep -v paths.go` — only display/template contexts
-5. Verify `felhom-wipe.sh` has correct bash syntax: `bash -n scripts/felhom-wipe.sh`
-
----
-
-## Post-Implementation: App Catalog Update (SEPARATE TASK)
-
-After this task, update `app-catalog-felhom.eu` compose templates:
-```
-${HDD_PATH}/appdata/  →  ${HDD_PATH}/felhom-data/appdata/
-${HDD_PATH}/backups/  →  ${HDD_PATH}/felhom-data/backups/
-```
-
-Media paths (`${HDD_PATH}/media/`) stay at drive root (user data, not felhom-managed).
-
----
-
-## Important Reminders
-
-- `FelhomDataDir` = `"felhom-data"` (hyphen, not underscore)
-- `InfraBackupDir()` does NOT get namespace — stays at drive root
-- `stacks/delete.go` duplicates the constant (can't import `backup`)
-- `storage/migrate.go` and `storage/migrate_drive.go` CAN import `backup` (no cycle)
-- Wipe script handles BOTH old-style and new-style paths
-- `HDD_PATH` env var in app.yaml stays as mount point — does NOT include `felhom-data`
+## Notes for Implementation
+
+1. **Run `go build ./...` after each phase** to catch compile errors early
+2. **The report package already imports `metrics` and `stacks`** — no new import cycles
+3. **Hub templates use `template.Must(template.New("").Funcs(funcMap).ParseFS(templateFS, "templates/*.html"))`** — new .html files are automatically picked up
+4. **Hub already has `embed.go`** at `hub/internal/web/embed.go` — add chart.min.js embed directive there. Create `hub/internal/web/static/` directory
+5. **All hub template functions** are defined in `server.go` New() constructor — add any new functions (like `memoryColor`) there
+6. **CSRF tokens**: All POST forms need `<input type="hidden" name="_csrf" value="{{ .CSRFToken }}">` — but the apps pages are read-only (GET only), so no CSRF needed
+7. **Hub's ServeHTTP uses hasSuffix/hasPrefix routing** — put exact matches (`/apps`) BEFORE prefix matches. The `/apps/{name}` route must come before `/apps/` fallback