diff --git a/.github/scripts/commit-and-tag.cjs b/.github/scripts/commit-and-tag.cjs
index 086e1b83e..405ebe719 100644
--- a/.github/scripts/commit-and-tag.cjs
+++ b/.github/scripts/commit-and-tag.cjs
@@ -13,7 +13,7 @@ module.exports = async ({ github, context }) => {
   const parent = context.sha;
   if (!version) throw new Error("VERSION is not defined");
 
-  const files = ["Cargo.toml", "Cargo.lock"];
+  const files = ["LETRO_VERSION"];
 
   /** @type {{path: string, mode: "100644", type: "blob", sha: string}[]} */
   const tree = [];
@@ -55,7 +55,7 @@ module.exports = async ({ github, context }) => {
   const tag = await github.rest.git.createTag({
     owner,
     repo,
-    tag: `v${version}`,
+    tag: `letro-v${version}`,
     message: version,
     type: "commit",
     object: commit.data.sha,
diff --git a/.github/scripts/create-version-tag.cjs b/.github/scripts/create-version-tag.cjs
index 47e00ecb1..3d78b3467 100644
--- a/.github/scripts/create-version-tag.cjs
+++ b/.github/scripts/create-version-tag.cjs
@@ -17,7 +17,7 @@ module.exports = async ({ github, context }) => {
   const tag = await github.rest.git.createRef({
     owner,
     repo,
-    ref: `refs/tags/v${version}`,
+    ref: `refs/tags/letro-v${version}`,
     sha: tagSha,
   });
   console.log("Created tag ref:", tag.data.url);
diff --git a/.github/scripts/merge-back.cjs b/.github/scripts/merge-back.cjs
index d3948398e..eca79f156 100644
--- a/.github/scripts/merge-back.cjs
+++ b/.github/scripts/merge-back.cjs
@@ -43,6 +43,9 @@ module.exports = async ({ github, context }) => {
     labels: ["T-Task"],
   });
 
+  // Wait for GitHub to register the pending checks before enabling auto-merge
+  await new Promise((resolve) => setTimeout(resolve, 30000));
+
   // Enable auto-merge on the PR
   await github.graphql(
     `
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index bf23e0ef8..cecafa139 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -9,26 +9,21 @@ on:
   push:
     branches:
       - main
-      - "release/**"
     tags:
-      - "v*"
+      - "letro-v*"
 
   # Run when there is a label change on the pull request
   # This runs only if the 'Z-Build-Workflow' is added to the pull request
   pull_request:
     types: [labeled]
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 env:
   CARGO_TERM_COLOR: always
   CARGO_NET_GIT_FETCH_WITH_CLI: "true"
   SCCACHE_GHA_ENABLED: "true"
   RUSTC_WRAPPER: "sccache"
-  IMAGE: ghcr.io/element-hq/matrix-authentication-service
-  BUILDCACHE: ghcr.io/element-hq/matrix-authentication-service/buildcache
+  IMAGE: ghcr.io/p-num/matrix-authentication-service
+  BUILDCACHE: ghcr.io/p-num/matrix-authentication-service/buildcache
   DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
 
 jobs:
@@ -54,12 +49,13 @@ jobs:
       - name: Compute version and timestamp out of git history
         id: git
         run: |
-          echo "describe=$(git describe --tags --match 'v*.*.*' --always)" >> $GITHUB_OUTPUT
+          echo "describe=$(git describe --tags --match 'letro-v*.*.*' --always)" >> $GITHUB_OUTPUT
           echo "timestamp=$(git log -1 --format=%ct)" >> $GITHUB_OUTPUT
 
   build-assets:
     name: Build assets
-    if: github.event_name == 'push' || github.event.label.name == 'Z-Build-Workflow'
+    if: false
+    # if: github.event_name == 'push' || github.event.label.name == 'Z-Build-Workflow'
     runs-on: ubuntu-24.04
 
     permissions:
@@ -91,7 +87,8 @@ jobs:
 
   build-binaries:
     name: Build binaries
-    if: github.event_name == 'push' || github.event.label.name == 'Z-Build-Workflow'
+    if: false
+    # if: github.event_name == 'push' || github.event.label.name == 'Z-Build-Workflow'
     runs-on: ubuntu-24.04
 
     needs:
@@ -101,7 +98,6 @@ jobs:
       matrix:
         include:
           - target: x86_64-unknown-linux-gnu
-          - target: aarch64-unknown-linux-gnu
 
     env:
       VERGEN_GIT_DESCRIBE: ${{ needs.compute-version.outputs.describe }}
@@ -150,7 +146,8 @@ jobs:
 
   assemble-archives:
     name: Assemble release archives
-    if: github.event_name == 'push' || github.event.label.name == 'Z-Build-Workflow'
+    if: false
+    # if: github.event_name == 'push' || github.event.label.name == 'Z-Build-Workflow'
     runs-on: ubuntu-24.04
 
     needs:
@@ -173,29 +170,15 @@ jobs:
           name: binary-x86_64-unknown-linux-gnu
           path: binary-x86_64
 
-      - name: Download binary aarch64
-        uses: actions/download-artifact@v8
-        with:
-          name: binary-aarch64-unknown-linux-gnu
-          path: binary-aarch64
-
       - name: Create final archives
         run: |
-          for arch in x86_64 aarch64; do
-            mkdir -p dist/${arch}/share
-            cp -r assets-dist/share/* dist/${arch}/share/
-            cp assets-dist/LICENSE dist/${arch}/LICENSE
-            cp binary-$arch/mas-cli dist/${arch}/mas-cli
-            chmod -R u=rwX,go=rX dist/${arch}/
-            chmod u=rwx,go=rx dist/${arch}/mas-cli
-            tar -czvf mas-cli-${arch}-linux.tar.gz --owner=0 --group=0 -C dist/${arch}/ .
-          done
-
-      - name: Upload aarch64 archive
-        uses: actions/upload-artifact@v7.0.0
-        with:
-          name: mas-cli-aarch64-linux
-          path: mas-cli-aarch64-linux.tar.gz
+          mkdir -p dist/x86_64/share
+          cp -r assets-dist/share/* dist/x86_64/share/
+          cp assets-dist/LICENSE dist/x86_64/LICENSE
+          cp binary-x86_64/mas-cli dist/x86_64/mas-cli
+          chmod -R u=rwX,go=rX dist/x86_64/
+          chmod u=rwx,go=rx dist/x86_64/mas-cli
+          tar -czvf mas-cli-x86_64-linux.tar.gz --owner=0 --group=0 -C dist/x86_64/ .
 
       - name: Upload x86_64 archive
         uses: actions/upload-artifact@v7.0.0
@@ -224,6 +207,16 @@ jobs:
       SOURCE_DATE_EPOCH: ${{ needs.compute-version.outputs.timestamp }}
 
     steps:
+      - name: Extract semver version from letro tag
+        id: tag-semver
+        run: |
+          tag="${{ github.ref_name }}"
+          if [[ "$tag" == letro-v* ]]; then
+            echo "version=${tag#letro-v}" >> "$GITHUB_OUTPUT"
+          else
+            echo "version=" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v6.0.0
@@ -235,9 +228,9 @@ jobs:
           tags: |
             type=ref,event=branch
             type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
+            type=semver,pattern={{version}},value=${{ steps.tag-semver.outputs.version }},enable=${{ steps.tag-semver.outputs.version != '' }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ steps.tag-semver.outputs.version }},enable=${{ steps.tag-semver.outputs.version != '' }}
+            type=semver,pattern={{major}},value=${{ steps.tag-semver.outputs.version }},enable=${{ steps.tag-semver.outputs.version != '' }}
             type=sha
 
       - name: Docker meta (debug variant)
@@ -252,9 +245,9 @@ jobs:
           tags: |
             type=ref,event=branch
             type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
+            type=semver,pattern={{version}},value=${{ steps.tag-semver.outputs.version }},enable=${{ steps.tag-semver.outputs.version != '' }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ steps.tag-semver.outputs.version }},enable=${{ steps.tag-semver.outputs.version != '' }}
+            type=semver,pattern={{major}},value=${{ steps.tag-semver.outputs.version }},enable=${{ steps.tag-semver.outputs.version != '' }}
             type=sha
 
       - name: Setup Cosign
@@ -268,7 +261,7 @@ jobs:
               mirrors = ["mirror.gcr.io"]
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.0.0
+        uses: docker/login-action@v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -276,7 +269,7 @@ jobs:
 
       - name: Build and push
         id: bake
-        uses: docker/bake-action@v7.0.0
+        uses: docker/bake-action@v7.1.0
         with:
           files: |
             ./docker-bake.hcl
@@ -291,16 +284,18 @@ jobs:
         # This transforms the ouput to an object which looks like this:
         # { reguar: { digest: "…", tags: ["…", "…"] }, debug: { digest: "…", tags: ["…"] }, … }
         id: output
+        env:
+          BAKE_METADATA: ${{ steps.bake.outputs.metadata }}
         run: |
           echo 'metadata<<EOF' >> $GITHUB_OUTPUT
-          echo '${{ steps.bake.outputs.metadata }}' | jq -c 'with_entries(select(.value | (type == "object" and has("containerimage.digest")))) | map_values({ digest: .["containerimage.digest"], tags: (.["image.name"] | split(",")) })' >> $GITHUB_OUTPUT
+          echo "$BAKE_METADATA" | jq -c 'with_entries(select(.value | (type == "object" and has("containerimage.digest")))) | map_values({ digest: .["containerimage.digest"], tags: (.["image.name"] | split(",")) })' >> $GITHUB_OUTPUT
           echo 'EOF' >> $GITHUB_OUTPUT
 
       - name: Sign the images with GitHub Actions provided token
         # Only sign on tags and on commits on main branch
         if: |
           github.event_name != 'pull_request'
-          && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
+          && (startsWith(github.ref, 'refs/tags/letro-v') || github.ref == 'refs/heads/main')
 
         env:
           REGULAR_DIGEST: ${{ steps.output.outputs.metadata && fromJSON(steps.output.outputs.metadata).regular.digest }}
@@ -313,23 +308,50 @@ jobs:
 
   release:
     name: Release
-    if: startsWith(github.ref, 'refs/tags/')
+    if: startsWith(github.ref, 'refs/tags/letro-v')
     runs-on: ubuntu-24.04
     needs:
-      - assemble-archives
       - build-image
+
+    permissions:
+      contents: write
+
     steps:
-      - name: Download the artifacts from the previous job
-        uses: actions/download-artifact@v8
+      - name: Checkout the code (full history for diff)
+        uses: actions/checkout@v6
         with:
-          pattern: mas-cli-*
-          path: artifacts
-          merge-multiple: true
+          fetch-depth: 0
+
+      - name: Read upstream commit from UPSTREAM_VERSION
+        id: upstream
+        run: |
+          echo "commit=$(grep '^commit:' UPSTREAM_VERSION | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+      - name: Fetch upstream commit
+        run: git fetch origin "${{ steps.upstream.outputs.commit }}" || git fetch https://github.com/element-hq/matrix-authentication-service.git "${{ steps.upstream.outputs.commit }}"
+
+      - name: Generate git diff from upstream
+        run: |
+          git diff "${{ steps.upstream.outputs.commit }}" HEAD -- \
+            ':!LETRO_VERSION' ':!FORK_DIVERGENCE.md' ':!UPSTREAM_VERSION' \
+            > fork-changes.diff
 
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+      - name: Generate repository SBOM with Trivy
+        run: |
+          trivy fs \
+            --format cyclonedx \
+            --output sbom.json \
+            .
+            
       - name: Prepare a release
         uses: softprops/action-gh-release@v2.6.1
         with:
           generate_release_notes: true
+          prerelease: ${{ contains(github.ref_name, '-rc.') }}
           body: |
             ### Docker image
 
@@ -358,9 +380,9 @@ jobs:
                 ```
 
           files: |
-            artifacts/mas-cli-aarch64-linux.tar.gz
-            artifacts/mas-cli-x86_64-linux.tar.gz
-          draft: true
+            fork-changes.diff
+            FORK_DIVERGENCE.md
+            sbom.json
 
   unstable:
     name: Update the unstable release
@@ -368,7 +390,6 @@ jobs:
     runs-on: ubuntu-24.04
 
     needs:
-      - assemble-archives
       - build-image
 
     permissions:
@@ -381,13 +402,6 @@ jobs:
           sparse-checkout: |
             .github/scripts
 
-      - name: Download the artifacts from the previous job
-        uses: actions/download-artifact@v8
-        with:
-          pattern: mas-cli-*
-          path: artifacts
-          merge-multiple: true
-
       - name: Update unstable git tag
         uses: actions/github-script@v8.0.0
         with:
@@ -434,9 +448,6 @@ jobs:
                 ') }}
                 ```
 
-          files: |
-            artifacts/mas-cli-aarch64-linux.tar.gz
-            artifacts/mas-cli-x86_64-linux.tar.gz
           prerelease: true
           make_latest: false
 
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1fe4f1a8d..89da690f4 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -11,7 +11,7 @@ on:
       - main
       - "release/**"
     tags:
-      - "v*"
+      - "letro-v*"
   pull_request:
 
 concurrency:
@@ -159,7 +159,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Run `cargo-deny`
-        uses: EmbarkStudios/cargo-deny-action@v2.0.15
+        uses: EmbarkStudios/cargo-deny-action@v2.0.16
         with:
           rust-version: stable
 
diff --git a/.github/workflows/release-branch.yaml b/.github/workflows/release-branch.yaml
index f0843f717..c0ec8b117 100644
--- a/.github/workflows/release-branch.yaml
+++ b/.github/workflows/release-branch.yaml
@@ -36,15 +36,12 @@ jobs:
       - name: Checkout the code
         uses: actions/checkout@v6
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
       - name: Compute the new minor RC
         id: next
         env:
           BUMP: pre${{ inputs.kind }}
         run: |
-          CURRENT_VERSION="$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[] | select(.name == "mas-cli") | .version')"
+          CURRENT_VERSION="$(cat LETRO_VERSION | tr -d '[:space:]')"
           NEXT_VERSION="$(npx --yes semver@7.5.4 -i "$BUMP" --preid rc "${CURRENT_VERSION}")"
           # compute the short minor version, e.g. 0.1.0-rc.1 -> 0.1
           SHORT_VERSION="$(echo "${NEXT_VERSION}" | cut -d. -f1-2)"
@@ -53,6 +50,7 @@ jobs:
 
   localazy:
     name: Create a new branch in Localazy
+    if: false
     runs-on: ubuntu-24.04
     needs: [compute-version]
 
@@ -103,11 +101,12 @@ jobs:
       contents: write
       pull-requests: write
 
-    needs: [tag, compute-version, localazy]
+    needs: [tag, compute-version]
     steps:
       - name: Checkout the code
         uses: actions/checkout@v6
         with:
+          token: ${{ secrets.BOT_GITHUB_TOKEN }}
           sparse-checkout: |
             .github/scripts
 
diff --git a/.github/workflows/release-bump.yaml b/.github/workflows/release-bump.yaml
index a2a20791a..01f164785 100644
--- a/.github/workflows/release-bump.yaml
+++ b/.github/workflows/release-bump.yaml
@@ -35,12 +35,9 @@ jobs:
       - name: Checkout the code
         uses: actions/checkout@v6
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
       - name: Extract the current version
         id: current
-        run: echo "version=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[] | select(.name == "mas-cli") | .version')" >> "$GITHUB_OUTPUT"
+        run: echo "version=$(cat LETRO_VERSION | tr -d '[:space:]')" >> "$GITHUB_OUTPUT"
 
       - name: Compute the new minor RC
         id: next
@@ -78,6 +75,7 @@ jobs:
       - name: Checkout the code
         uses: actions/checkout@v6
         with:
+          token: ${{ secrets.BOT_GITHUB_TOKEN }}
           sparse-checkout: |
             .github/scripts
 
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index c6c394c81..00257a9ef 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -32,18 +32,10 @@ jobs:
       - name: Checkout the code
         uses: actions/checkout@v6
 
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Set the crates version
+      - name: Set the fork version
         env:
           VERSION: ${{ inputs.version }}
-        run: |
-          sed -i "s/^package.version = .*/package.version = \"$VERSION\"/" Cargo.toml
-          sed -i "/path = \".\/crates\//s/version = \".*\"/version = \"=$VERSION\"/" Cargo.toml
-
-      - name: Run `cargo metadata` to make sure the lockfile is up to date
-        run: cargo metadata --format-version 1
+        run: echo "$VERSION" > LETRO_VERSION
 
       - name: Commit and tag using the GitHub API
         uses: actions/github-script@v8.0.0
diff --git a/.gitignore b/.gitignore
index d98402c23..984909b26 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,5 +10,9 @@ target
 .idea
 .nova
 
+# Local config (may contain secrets)
+config.yaml
+config.local.yaml
+
 # OS garbage
 .DS_Store
diff --git a/Cargo.lock b/Cargo.lock
index f78a22e6d..7af27529d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -18,7 +18,16 @@ version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
 dependencies = [
- "gimli",
+ "gimli 0.32.3",
+]
+
+[[package]]
+name = "addr2line"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59317f77929f0e679d39364702289274de2f0f0b22cbf50b2b8cff2169a0b27a"
+dependencies = [
+ "gimli 0.33.0",
 ]
 
 [[package]]
@@ -95,7 +104,7 @@ dependencies = [
  "bytes",
  "cfg-if",
  "http",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "schemars 0.9.0",
  "serde",
  "serde_json",
@@ -314,7 +323,7 @@ dependencies = [
  "futures-timer",
  "futures-util",
  "http",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "mime",
  "multer",
  "num-traits",
@@ -366,7 +375,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34ecdaff7c9cffa3614a9f9999bf9ee4c3078fe3ce4d6a6e161736b56febf2de"
 dependencies = [
  "bytes",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "serde",
  "serde_json",
 ]
@@ -650,11 +659,11 @@ version = "0.3.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
 dependencies = [
- "addr2line",
+ "addr2line 0.25.1",
  "cfg-if",
  "libc",
  "miniz_oxide",
- "object",
+ "object 0.37.3",
  "rustc-demangle",
  "windows-link 0.2.1",
 ]
@@ -766,9 +775,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.19.0"
+version = "3.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
 dependencies = [
  "allocator-api2",
 ]
@@ -1144,46 +1153,48 @@ dependencies = [
 
 [[package]]
 name = "cranelift-assembler-x64"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6abf69c884fde2d9d4cc232a585fb18f16af3ae04c634315c84ebe158ded92d"
+checksum = "046d4b584c3bb9b5eb500c8f29549bec36be11000f1ba2a927cef3d1a9875691"
 dependencies = [
  "cranelift-assembler-x64-meta",
 ]
 
 [[package]]
 name = "cranelift-assembler-x64-meta"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "263d31fcdf83a10267e8c38b53bc8f7688dfbc331267fd8fdf5b22e0dc47a55b"
+checksum = "b9b194a7870becb1490366fc0ae392ccd188065ff35f8391e77ac659db6fb977"
 dependencies = [
  "cranelift-srcgen",
 ]
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d459d5377c01c4472b71029caa2df41afaf47711676aa9b12d7414f15104637b"
+checksum = "bb6a4ab44c6b371e661846b97dab687387a60ac4e2f864e2d4257284aad9e889"
 dependencies = [
  "cranelift-entity",
+ "wasmtime-internal-core",
 ]
 
 [[package]]
 name = "cranelift-bitset"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8283088d5823ba7856ab8d531b7c3654b24984748f9fd99dcf3210701fd1d065"
+checksum = "b8b7a44150c2f471a94023482bda1902710746e4bed9f9973d60c5a94319b06d"
 dependencies = [
  "serde",
  "serde_derive",
+ "wasmtime-internal-core",
 ]
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d3138316d8dd341d725d6ab1598750545c76ad32892837fde558edd68a01b43"
+checksum = "01b06598133b1dd76758b8b95f8d6747c124124aade50cea96a3d88b962da9fa"
 dependencies = [
  "bumpalo",
  "cranelift-assembler-x64",
@@ -1194,8 +1205,9 @@ dependencies = [
  "cranelift-control",
  "cranelift-entity",
  "cranelift-isle",
- "gimli",
- "hashbrown 0.15.5",
+ "gimli 0.33.0",
+ "hashbrown 0.16.1",
+ "libm",
  "log",
  "pulley-interpreter",
  "regalloc2",
@@ -1203,14 +1215,14 @@ dependencies = [
  "serde",
  "smallvec",
  "target-lexicon",
- "wasmtime-internal-math",
+ "wasmtime-internal-core",
 ]
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "505cead19304a8dc8689e31b29038775c3f73f9d5ea7a5e33864437a1f46c6b6"
+checksum = "6190e2e7bcf0a678da2f715363d34ed530fedf7a2f0ab75edaefef72a70465ff"
 dependencies = [
  "cranelift-assembler-x64-meta",
  "cranelift-codegen-shared",
@@ -1221,35 +1233,36 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-shared"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce62ba94f570644ce7de6ed05bd39ca28936665dec10a2a1f6f2c531d6add45c"
+checksum = "f583cf203d1aa8b79560e3b01f929bdacf9070b015eec4ea9c46e22a3f83e4a0"
 
 [[package]]
 name = "cranelift-control"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db6cfe339689c3926412a7060ab00ef3b2b43d936b537e7a3f696121be9d0eaa"
+checksum = "803159df35cc398ae54473c150b16d6c77e92ab2948be638488de126a3328fbc"
 dependencies = [
  "arbitrary",
 ]
 
 [[package]]
 name = "cranelift-entity"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625518090e912bdfe3c41464bf97ae421f6044d4ca0f5c3267dcacdb352b033d"
+checksum = "3109e417257082d88087f5bcce677525bdaa8322b88dd7f175ed1a1fd41d546c"
 dependencies = [
  "cranelift-bitset",
  "serde",
  "serde_derive",
+ "wasmtime-internal-core",
 ]
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17f652d40ddf3afb55be64d8979d312b52b384a8cebbcde1dd1c2e32ebcd4466"
+checksum = "14db6b0e0e4994c581092df78d837be2072578f7cb2528f96a6cf895e56dee63"
 dependencies = [
  "cranelift-codegen",
  "log",
@@ -1259,15 +1272,15 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f512767e83015f4baf6e732cabca93cea82907e3ab237f826ef64f7ece75eb6"
+checksum = "ec66ea5025c7317383699778282ac98741d68444f956e3b1d7b62f12b7216e67"
 
 [[package]]
 name = "cranelift-native"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb1ca6e4dca568ff988d367e4707be2362cee9782265b0a501eaf467ffd550a8"
+checksum = "373ade56438e6232619d85678477d0a88a31b3581936e0503e61e96b546b0800"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -1276,9 +1289,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-srcgen"
-version = "0.127.4"
+version = "0.130.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97400ad8fbd3a434092fc0b486fa7784150b53187941d818b1087f3ac0a547f0"
+checksum = "ef53619d3cd5c78fd998c6d9420547af26b72e6456f94c2a8a2334cb76b42baa"
 
 [[package]]
 name = "crc"
@@ -1755,12 +1768,6 @@ dependencies = [
  "pin-project-lite",
 ]
 
-[[package]]
-name = "fallible-iterator"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
-
 [[package]]
 name = "fancy-regex"
 version = "0.13.0"
@@ -1844,6 +1851,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -2036,9 +2049,16 @@ name = "gimli"
 version = "0.32.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
+
+[[package]]
+name = "gimli"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf7f043f89559805f8c7cacc432749b2fa0d0a0a9ee46ce47164ed5ba7f126c"
 dependencies = [
- "fallible-iterator",
- "indexmap 2.11.4",
+ "fnv",
+ "hashbrown 0.16.1",
+ "indexmap 2.14.0",
  "stable_deref_trait",
 ]
 
@@ -2098,7 +2118,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "http",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -2129,10 +2149,26 @@ checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
  "allocator-api2",
  "equivalent",
- "foldhash",
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "foldhash 0.2.0",
  "serde",
+ "serde_core",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+
 [[package]]
 name = "hashlink"
 version = "0.10.0"
@@ -2664,9 +2700,9 @@ checksum = "1adcf7b613a268af025bc2a2532b4b9ee294e6051c5c0832d8bff20ac0232e68"
 
 [[package]]
 name = "id-arena"
-version = "2.2.1"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25a2bc672d1148e28034f176e01fffebb08b35768468cc954630da77a1449005"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
 
 [[package]]
 name = "ident_case"
@@ -2708,12 +2744,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.11.4"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.5",
+ "hashbrown 0.17.0",
  "serde",
  "serde_core",
 ]
@@ -2978,9 +3014,9 @@ checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
 
 [[package]]
 name = "libm"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libredox"
@@ -3062,7 +3098,7 @@ dependencies = [
 
 [[package]]
 name = "mas-axum-utils"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -3096,7 +3132,7 @@ dependencies = [
 
 [[package]]
 name = "mas-cli"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -3171,7 +3207,7 @@ dependencies = [
 
 [[package]]
 name = "mas-config"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "camino",
@@ -3202,7 +3238,7 @@ dependencies = [
 
 [[package]]
 name = "mas-context"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "console",
  "opentelemetry",
@@ -3218,7 +3254,7 @@ dependencies = [
 
 [[package]]
 name = "mas-data-model"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "base64ct",
  "chrono",
@@ -3239,7 +3275,7 @@ dependencies = [
 
 [[package]]
 name = "mas-email"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "async-trait",
  "lettre",
@@ -3250,7 +3286,7 @@ dependencies = [
 
 [[package]]
 name = "mas-handlers"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "aide",
  "anyhow",
@@ -3272,7 +3308,7 @@ dependencies = [
  "hex",
  "hyper",
  "icu_normalizer",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "insta",
  "lettre",
  "mas-axum-utils",
@@ -3331,7 +3367,7 @@ dependencies = [
 
 [[package]]
 name = "mas-http"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "futures-util",
  "headers",
@@ -3352,7 +3388,7 @@ dependencies = [
 
 [[package]]
 name = "mas-i18n"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "camino",
  "icu_calendar",
@@ -3374,7 +3410,7 @@ dependencies = [
 
 [[package]]
 name = "mas-i18n-scan"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "camino",
  "clap",
@@ -3388,7 +3424,7 @@ dependencies = [
 
 [[package]]
 name = "mas-iana"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "schemars 0.9.0",
  "serde",
@@ -3396,7 +3432,7 @@ dependencies = [
 
 [[package]]
 name = "mas-iana-codegen"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3413,7 +3449,7 @@ dependencies = [
 
 [[package]]
 name = "mas-jose"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "base64ct",
  "chrono",
@@ -3443,7 +3479,7 @@ dependencies = [
 
 [[package]]
 name = "mas-keystore"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "aead",
  "base64ct",
@@ -3471,7 +3507,7 @@ dependencies = [
 
 [[package]]
 name = "mas-listener"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -3495,7 +3531,7 @@ dependencies = [
 
 [[package]]
 name = "mas-matrix"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3505,7 +3541,7 @@ dependencies = [
 
 [[package]]
 name = "mas-matrix-synapse"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3522,7 +3558,7 @@ dependencies = [
 
 [[package]]
 name = "mas-oidc-client"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "assert_matches",
  "async-trait",
@@ -3558,7 +3594,7 @@ dependencies = [
 
 [[package]]
 name = "mas-policy"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -3575,7 +3611,7 @@ dependencies = [
 
 [[package]]
 name = "mas-router"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "axum",
  "serde",
@@ -3586,7 +3622,7 @@ dependencies = [
 
 [[package]]
 name = "mas-spa"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "camino",
  "serde",
@@ -3595,7 +3631,7 @@ dependencies = [
 
 [[package]]
 name = "mas-storage"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "async-trait",
  "chrono",
@@ -3617,7 +3653,7 @@ dependencies = [
 
 [[package]]
 name = "mas-storage-pg"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "async-trait",
  "chrono",
@@ -3647,7 +3683,7 @@ dependencies = [
 
 [[package]]
 name = "mas-tasks"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3679,7 +3715,7 @@ dependencies = [
 
 [[package]]
 name = "mas-templates"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -3711,7 +3747,7 @@ dependencies = [
 
 [[package]]
 name = "mas-tower"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "http",
  "opentelemetry",
@@ -3964,12 +4000,12 @@ dependencies = [
 
 [[package]]
 name = "oauth2-types"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "assert_matches",
  "base64ct",
  "chrono",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "insta",
  "language-tags",
  "mas-iana",
@@ -3987,10 +4023,19 @@ name = "object"
 version = "0.37.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "object"
+version = "0.38.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "271638cd5fa9cca89c4c304675ca658efc4e64a66c716b7cfe1afb4b9611dbbc"
 dependencies = [
  "crc32fast",
- "hashbrown 0.15.5",
- "indexmap 2.11.4",
+ "hashbrown 0.16.1",
+ "indexmap 2.14.0",
  "memchr",
 ]
 
@@ -4008,9 +4053,9 @@ checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
 
 [[package]]
 name = "opa-wasm"
-version = "0.1.9"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "360f7106079ceb334afe98119289eec2ae5c0865f270a04f550e7f56a9bd507c"
+checksum = "7a9d1cb0566372e6dadfe69b407c3cc39505fe5ab49e97f749e9c42d65a92aa1"
 dependencies = [
  "anyhow",
  "base64",
@@ -4190,7 +4235,7 @@ dependencies = [
  "futures-util",
  "opentelemetry",
  "percent-encoding",
- "rand 0.9.2",
+ "rand 0.9.4",
  "thiserror 2.0.17",
  "tokio",
  "tokio-stream",
@@ -4493,7 +4538,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "740ebea15c5d1428f910cd1a5f52cebf8d25006245ed8ade92702f4943d91e07"
 dependencies = [
  "base64",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "quick-xml",
  "serde",
  "time",
@@ -4679,21 +4724,21 @@ dependencies = [
 
 [[package]]
 name = "pulley-interpreter"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5de307c194cf6310d486dd5595ffc329c53b4acafd54e214752c1eb2e68be3a9"
+checksum = "010dec3755eb61b2f1051ecb3611b718460b7a74c131e474de2af20a845938af"
 dependencies = [
  "cranelift-bitset",
  "log",
  "pulley-macros",
- "wasmtime-internal-math",
+ "wasmtime-internal-core",
 ]
 
 [[package]]
 name = "pulley-macros"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99dca2747e910d10bafe911e172a1b35860268421c3ee5ddb7e16c35e0288b4a"
+checksum = "ad360c32e85ca4b083ac0e2b6856e8f11c3d5060dafa7d5dc57b370857fa3018"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4758,9 +4803,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.3",
@@ -4864,9 +4909,9 @@ dependencies = [
 
 [[package]]
 name = "regalloc2"
-version = "0.13.3"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e249c660440317032a71ddac302f25f1d5dff387667bcc3978d1f77aa31ac34"
+checksum = "952ddbfc6f9f64d006c3efd8c9851a6ba2f2b944ba94730db255d55006e0ffda"
 dependencies = [
  "allocator-api2",
  "bumpalo",
@@ -5000,7 +5045,7 @@ dependencies = [
  "base64",
  "bytes",
  "form_urlencoded",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "js_int",
  "percent-encoding",
  "regex",
@@ -5153,9 +5198,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.10"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -5210,7 +5255,7 @@ checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
 dependencies = [
  "chrono",
  "dyn-clone",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "ref-cast",
  "schemars_derive",
  "serde",
@@ -5404,7 +5449,7 @@ version = "0.46.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b0b1e7ca40f965db239da279bf278d87b7407469b98835f27f0c8e59ed189b06"
 dependencies = [
- "rand 0.9.2",
+ "rand 0.9.4",
  "sentry-types",
  "serde",
  "serde_json",
@@ -5457,7 +5502,7 @@ checksum = "567711f01f86a842057e1fc17779eba33a336004227e1a1e7e6cc2599e22e259"
 dependencies = [
  "debugid",
  "hex",
- "rand 0.9.2",
+ "rand 0.9.4",
  "serde",
  "serde_json",
  "thiserror 2.0.17",
@@ -5514,7 +5559,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2f2d7ff8a2140333718bb329f5c40fc5f0865b84c426183ce14c97d2ab8154f"
 dependencies = [
  "form_urlencoded",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "itoa",
  "ryu",
  "serde_core",
@@ -5526,7 +5571,7 @@ version = "1.0.145"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
 dependencies = [
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "itoa",
  "memchr",
  "ryu",
@@ -5589,7 +5634,7 @@ dependencies = [
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "schemars 0.9.0",
  "schemars 1.1.0",
  "serde",
@@ -5617,7 +5662,7 @@ version = "0.9.34+deprecated"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
 dependencies = [
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "itoa",
  "ryu",
  "serde",
@@ -5803,7 +5848,7 @@ dependencies = [
  "futures-util",
  "hashbrown 0.15.5",
  "hashlink",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "ipnetwork",
  "log",
  "memchr",
@@ -6060,7 +6105,7 @@ dependencies = [
 
 [[package]]
 name = "syn2mas"
-version = "1.15.0-rc.0"
+version = "1.16.0-rc.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -6396,7 +6441,7 @@ version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -6958,9 +7003,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-encoder"
-version = "0.243.0"
+version = "0.245.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c55db9c896d70bd9fa535ce83cd4e1f2ec3726b0edd2142079f594fc3be1cb35"
+checksum = "3f9dca005e69bf015e45577e415b9af8c67e8ee3c0e38b5b0add5aa92581ed5c"
 dependencies = [
  "leb128fmt",
  "wasmparser",
@@ -6968,22 +7013,22 @@ dependencies = [
 
 [[package]]
 name = "wasmparser"
-version = "0.243.0"
+version = "0.245.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6d8db401b0528ec316dfbe579e6ab4152d61739cfe076706d2009127970159d"
+checksum = "4f08c9adee0428b7bddf3890fc27e015ac4b761cc608c822667102b8bfd6995e"
 dependencies = [
  "bitflags",
- "hashbrown 0.15.5",
- "indexmap 2.11.4",
+ "hashbrown 0.16.1",
+ "indexmap 2.14.0",
  "semver",
  "serde",
 ]
 
 [[package]]
 name = "wasmprinter"
-version = "0.243.0"
+version = "0.245.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb2b6035559e146114c29a909a3232928ee488d6507a1504d8934e8607b36d7b"
+checksum = "5f41517a3716fbb8ccf46daa9c1325f760fcbff5168e75c7392288e410b91ac8"
 dependencies = [
  "anyhow",
  "termcolor",
@@ -6992,24 +7037,21 @@ dependencies = [
 
 [[package]]
 name = "wasmtime"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0702b64d4c3fe43ae4ce229e06af06a27783e48c519e68586d180717cdd24314"
+checksum = "ce205cd643d661b5ba5ba4717e13730262e8cdbc8f2eacbc7b906d45c1a74026"
 dependencies = [
- "addr2line",
- "anyhow",
+ "addr2line 0.26.1",
  "async-trait",
  "bitflags",
  "bumpalo",
  "cc",
  "cfg-if",
- "hashbrown 0.15.5",
- "indexmap 2.11.4",
  "libc",
  "log",
  "mach2",
  "memfd",
- "object",
+ "object 0.38.1",
  "once_cell",
  "postcard",
  "pulley-interpreter",
@@ -7022,12 +7064,11 @@ dependencies = [
  "wasmparser",
  "wasmtime-environ",
  "wasmtime-internal-component-macro",
+ "wasmtime-internal-core",
  "wasmtime-internal-cranelift",
  "wasmtime-internal-fiber",
  "wasmtime-internal-jit-debug",
  "wasmtime-internal-jit-icache-coherence",
- "wasmtime-internal-math",
- "wasmtime-internal-slab",
  "wasmtime-internal-unwinder",
  "wasmtime-internal-versioned-export-macros",
  "windows-sys 0.61.2",
@@ -7035,32 +7076,36 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-environ"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ffeb777a21965a85e4b1ce7b308c63ba130df91912096b49b95523bf3bdd2c7"
+checksum = "0b8b78abf3677d4a0a5db82e5015b4d085ff3a1b8b472cbb8c70d4b769f019ce"
 dependencies = [
  "anyhow",
+ "cranelift-bforest",
  "cranelift-bitset",
  "cranelift-entity",
- "gimli",
- "indexmap 2.11.4",
+ "gimli 0.33.0",
+ "hashbrown 0.16.1",
+ "indexmap 2.14.0",
  "log",
- "object",
+ "object 0.38.1",
  "postcard",
  "serde",
  "serde_derive",
+ "sha2",
  "smallvec",
  "target-lexicon",
  "wasm-encoder",
  "wasmparser",
  "wasmprinter",
+ "wasmtime-internal-core",
 ]
 
 [[package]]
 name = "wasmtime-internal-component-macro"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "935bb8db1e2829bf26b80ed3daeed6cf9fc804f7002c90a8d17dbd5e93c69e0b"
+checksum = "0d3d6914f34be2f9d78d8ee9f422e834dfc204e71ccce697205fae95fed87892"
 dependencies = [
  "anyhow",
  "proc-macro2",
@@ -7073,58 +7118,69 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-component-util"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52625d0c8fe2df1d7dd96d45d37dae8818c183c183a82b2368e3741ee5253859"
+checksum = "3751b0616b914fdd87fe1bf804694a078f321b000338e6476bc48a4d6e454f21"
 
 [[package]]
-name = "wasmtime-internal-cranelift"
-version = "40.0.4"
+name = "wasmtime-internal-core"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85da1ba5fee01a3ee21c4d0c8052cc9035388639fa091a969b534d4c6f8449d4"
+checksum = "22632b187e1b0716f1b9ac57ad29013bed33175fcb19e10bb6896126f82fac67"
 dependencies = [
  "anyhow",
+ "hashbrown 0.16.1",
+ "libm",
+ "serde",
+]
+
+[[package]]
+name = "wasmtime-internal-cranelift"
+version = "43.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b3ca07b3e0bb3429674b173b5800577719d600774dd81bff58f775c0aaa64ee"
+dependencies = [
  "cfg-if",
  "cranelift-codegen",
  "cranelift-control",
  "cranelift-entity",
  "cranelift-frontend",
  "cranelift-native",
- "gimli",
+ "gimli 0.33.0",
  "itertools 0.14.0",
  "log",
- "object",
+ "object 0.38.1",
  "pulley-interpreter",
  "smallvec",
  "target-lexicon",
  "thiserror 2.0.17",
  "wasmparser",
  "wasmtime-environ",
- "wasmtime-internal-math",
+ "wasmtime-internal-core",
  "wasmtime-internal-unwinder",
  "wasmtime-internal-versioned-export-macros",
 ]
 
 [[package]]
 name = "wasmtime-internal-fiber"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4c7de5a0872764c1ca640886af10a70cf7f8526386906245b43cdb345ece0e6"
+checksum = "20c8b2c9704eb1f33ead025ec16038277ccb63d0a14c31e99d5b765d7c36da55"
 dependencies = [
- "anyhow",
  "cc",
  "cfg-if",
  "libc",
  "rustix",
+ "wasmtime-environ",
  "wasmtime-internal-versioned-export-macros",
  "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "wasmtime-internal-jit-debug"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "160acd973d770d62bef1b2697d7fac83a8fe63ef966215e624382b2a9532bd58"
+checksum = "d950310d07391d34369f62c48336ebb14eacbd4d6f772bb5f349c24e838e0664"
 dependencies = [
  "cc",
  "wasmtime-internal-versioned-export-macros",
@@ -7132,49 +7188,34 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-icache-coherence"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc57f590ba7ea967ea9e8c8560175c6926e5b15d11c29bbde3ad0013a29470eb"
+checksum = "3606662c156962d096be3127b8b8ae8ee2f8be3f896dad29259ff01ddb64abfd"
 dependencies = [
- "anyhow",
  "cfg-if",
  "libc",
+ "wasmtime-internal-core",
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "wasmtime-internal-math"
-version = "40.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07612904518d47b677e8db67ca47c16d8c8cefb0099020729f886776950cb58b"
-dependencies = [
- "libm",
-]
-
-[[package]]
-name = "wasmtime-internal-slab"
-version = "40.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc83ff16531e1e1537e0de2b630af56a0a9e1fab864130c5b7e213da71783a0f"
-
 [[package]]
 name = "wasmtime-internal-unwinder"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47371d697244785e4bbb371229f9a2daa8628d1e03368ec895cf658370e1bf38"
+checksum = "75eef0747e52dc545b075f64fd0e0cc237ae738e641266b1970e07e2d744bc32"
 dependencies = [
- "anyhow",
  "cfg-if",
  "cranelift-codegen",
  "log",
- "object",
+ "object 0.38.1",
+ "wasmtime-environ",
 ]
 
 [[package]]
 name = "wasmtime-internal-versioned-export-macros"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad3cd4aff8f2e7ec658c7a0424b74ad88a6940505303fb0616323592a1c400a6"
+checksum = "d8b0a5dab02a8fb527f547855ecc0e05f9fdc3d5bd57b8b080349408f9a6cece"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -7183,14 +7224,14 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-wit-bindgen"
-version = "40.0.4"
+version = "43.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73a5774737acccdc70ff27bbe9e09c45b156bd7792bb83906735a572ce122247"
+checksum = "7900c3e3c1d6e475bc225d73b02d6d5484815f260022e6964dca9558e50dd01a"
 dependencies = [
  "anyhow",
  "bitflags",
  "heck 0.5.0",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "wit-parser",
 ]
 
@@ -7710,13 +7751,14 @@ checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
 
 [[package]]
 name = "wit-parser"
-version = "0.243.0"
+version = "0.245.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df983a8608e513d8997f435bb74207bf0933d0e49ca97aa9d8a6157164b9b7fc"
+checksum = "330698718e82983499419494dd1e3d7811a457a9bf9f69734e8c5f07a2547929"
 dependencies = [
  "anyhow",
+ "hashbrown 0.16.1",
  "id-arena",
- "indexmap 2.11.4",
+ "indexmap 2.14.0",
  "log",
  "semver",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index f723022dd..37b542a8e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,7 +9,7 @@ members = ["crates/*"]
 resolver = "2"
 
 # Updated in the CI with a `sed` command
-package.version = "1.15.0-rc.0"
+package.version = "1.16.0-rc.0"
 package.license = "AGPL-3.0-only OR LicenseRef-Element-Commercial"
 package.authors = ["Element Backend Team"]
 package.edition = "2024"
@@ -34,35 +34,35 @@ broken_intra_doc_links = "deny"
 [workspace.dependencies]
 
 # Workspace crates
-mas-axum-utils = { path = "./crates/axum-utils/", version = "=1.15.0-rc.0" }
-mas-cli = { path = "./crates/cli/", version = "=1.15.0-rc.0" }
-mas-config = { path = "./crates/config/", version = "=1.15.0-rc.0" }
-mas-context = { path = "./crates/context/", version = "=1.15.0-rc.0" }
-mas-data-model = { path = "./crates/data-model/", version = "=1.15.0-rc.0" }
-mas-email = { path = "./crates/email/", version = "=1.15.0-rc.0" }
-mas-graphql = { path = "./crates/graphql/", version = "=1.15.0-rc.0" }
-mas-handlers = { path = "./crates/handlers/", version = "=1.15.0-rc.0" }
-mas-http = { path = "./crates/http/", version = "=1.15.0-rc.0" }
-mas-i18n = { path = "./crates/i18n/", version = "=1.15.0-rc.0" }
-mas-i18n-scan = { path = "./crates/i18n-scan/", version = "=1.15.0-rc.0" }
-mas-iana = { path = "./crates/iana/", version = "=1.15.0-rc.0" }
-mas-iana-codegen = { path = "./crates/iana-codegen/", version = "=1.15.0-rc.0" }
-mas-jose = { path = "./crates/jose/", version = "=1.15.0-rc.0" }
-mas-keystore = { path = "./crates/keystore/", version = "=1.15.0-rc.0" }
-mas-listener = { path = "./crates/listener/", version = "=1.15.0-rc.0" }
-mas-matrix = { path = "./crates/matrix/", version = "=1.15.0-rc.0" }
-mas-matrix-synapse = { path = "./crates/matrix-synapse/", version = "=1.15.0-rc.0" }
-mas-oidc-client = { path = "./crates/oidc-client/", version = "=1.15.0-rc.0" }
-mas-policy = { path = "./crates/policy/", version = "=1.15.0-rc.0" }
-mas-router = { path = "./crates/router/", version = "=1.15.0-rc.0" }
-mas-spa = { path = "./crates/spa/", version = "=1.15.0-rc.0" }
-mas-storage = { path = "./crates/storage/", version = "=1.15.0-rc.0" }
-mas-storage-pg = { path = "./crates/storage-pg/", version = "=1.15.0-rc.0" }
-mas-tasks = { path = "./crates/tasks/", version = "=1.15.0-rc.0" }
-mas-templates = { path = "./crates/templates/", version = "=1.15.0-rc.0" }
-mas-tower = { path = "./crates/tower/", version = "=1.15.0-rc.0" }
-oauth2-types = { path = "./crates/oauth2-types/", version = "=1.15.0-rc.0" }
-syn2mas = { path = "./crates/syn2mas", version = "=1.15.0-rc.0" }
+mas-axum-utils = { path = "./crates/axum-utils/", version = "=1.16.0-rc.0" }
+mas-cli = { path = "./crates/cli/", version = "=1.16.0-rc.0" }
+mas-config = { path = "./crates/config/", version = "=1.16.0-rc.0" }
+mas-context = { path = "./crates/context/", version = "=1.16.0-rc.0" }
+mas-data-model = { path = "./crates/data-model/", version = "=1.16.0-rc.0" }
+mas-email = { path = "./crates/email/", version = "=1.16.0-rc.0" }
+mas-graphql = { path = "./crates/graphql/", version = "=1.16.0-rc.0" }
+mas-handlers = { path = "./crates/handlers/", version = "=1.16.0-rc.0" }
+mas-http = { path = "./crates/http/", version = "=1.16.0-rc.0" }
+mas-i18n = { path = "./crates/i18n/", version = "=1.16.0-rc.0" }
+mas-i18n-scan = { path = "./crates/i18n-scan/", version = "=1.16.0-rc.0" }
+mas-iana = { path = "./crates/iana/", version = "=1.16.0-rc.0" }
+mas-iana-codegen = { path = "./crates/iana-codegen/", version = "=1.16.0-rc.0" }
+mas-jose = { path = "./crates/jose/", version = "=1.16.0-rc.0" }
+mas-keystore = { path = "./crates/keystore/", version = "=1.16.0-rc.0" }
+mas-listener = { path = "./crates/listener/", version = "=1.16.0-rc.0" }
+mas-matrix = { path = "./crates/matrix/", version = "=1.16.0-rc.0" }
+mas-matrix-synapse = { path = "./crates/matrix-synapse/", version = "=1.16.0-rc.0" }
+mas-oidc-client = { path = "./crates/oidc-client/", version = "=1.16.0-rc.0" }
+mas-policy = { path = "./crates/policy/", version = "=1.16.0-rc.0" }
+mas-router = { path = "./crates/router/", version = "=1.16.0-rc.0" }
+mas-spa = { path = "./crates/spa/", version = "=1.16.0-rc.0" }
+mas-storage = { path = "./crates/storage/", version = "=1.16.0-rc.0" }
+mas-storage-pg = { path = "./crates/storage-pg/", version = "=1.16.0-rc.0" }
+mas-tasks = { path = "./crates/tasks/", version = "=1.16.0-rc.0" }
+mas-templates = { path = "./crates/templates/", version = "=1.16.0-rc.0" }
+mas-tower = { path = "./crates/tower/", version = "=1.16.0-rc.0" }
+oauth2-types = { path = "./crates/oauth2-types/", version = "=1.16.0-rc.0" }
+syn2mas = { path = "./crates/syn2mas", version = "=1.16.0-rc.0" }
 
 # OpenAPI schema generation and validation
 [workspace.dependencies.aide]
@@ -392,7 +392,7 @@ version = "0.3.0"
 
 # Open Policy Agent support through WASM
 [workspace.dependencies.opa-wasm]
-version = "0.1.9"
+version = "0.2.0"
 
 # OpenTelemetry
 [workspace.dependencies.opentelemetry]
diff --git a/Dockerfile b/Dockerfile
index ba2ed16c8..c4626351e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,10 +5,7 @@
 # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
 # Please see LICENSE files in the repository root for full details.
 
-# Builds a minimal image with the binary only. It is multi-arch capable,
-# cross-building to aarch64 and x86_64. When cross-compiling, Docker sets two
-# implicit BUILDARG: BUILDPLATFORM being the host platform and TARGETPLATFORM
-# being the platform being built.
+# Builds a minimal image with the binary only for amd64.
 
 # The Debian version and version name must be in sync
 ARG DEBIAN_VERSION=13
@@ -76,13 +73,12 @@ RUN --network=default \
   cargo install --locked \
   cargo-auditable@=${CARGO_AUDITABLE_VERSION}
 
-# Install all cross-compilation targets
-# Network access: to download the targets
+# Install the cross-compilation target used for the image
+# Network access: to download the target
 RUN --network=default \
   rustup target add  \
   --toolchain "${RUSTC_VERSION}" \
-  x86_64-unknown-linux-gnu \
-  aarch64-unknown-linux-gnu
+  x86_64-unknown-linux-gnu
 
 RUN --network=none \
   dpkg --add-architecture arm64 && \
@@ -90,21 +86,15 @@ RUN --network=none \
 
 ARG BUILDPLATFORM
 
-# Install cross-compilation toolchains for all supported targets
+# Install the cross-compilation toolchain for amd64
 # Network access: to install apt packages
 RUN --network=default \
   apt-get update && apt-get install -y \
-  $(if [ "${BUILDPLATFORM}" != "linux/arm64" ]; then echo "g++-aarch64-linux-gnu"; fi) \
-  $(if [ "${BUILDPLATFORM}" != "linux/amd64" ]; then echo "g++-x86-64-linux-gnu"; fi) \
   libc6-dev-amd64-cross \
-  libc6-dev-arm64-cross \
   g++
 
 # Setup the cross-compilation environment
 ENV \
-  CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc \
-  CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc \
-  CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++ \
   CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=x86_64-linux-gnu-gcc \
   CC_x86_64_unknown_linux_gnu=x86_64-linux-gnu-gcc \
   CXX_x86_64_unknown_linux_gnu=x86_64-linux-gnu-g++
@@ -130,9 +120,7 @@ RUN --network=default \
     --no-default-features \
     --features docker \
     --target x86_64-unknown-linux-gnu \
-    --target aarch64-unknown-linux-gnu \
-  && mv "target/x86_64-unknown-linux-gnu/release/mas-cli" /usr/local/bin/mas-cli-amd64 \
-  && mv "target/aarch64-unknown-linux-gnu/release/mas-cli" /usr/local/bin/mas-cli-arm64
+  && mv "target/x86_64-unknown-linux-gnu/release/mas-cli" /usr/local/bin/mas-cli
 
 #######################################
 ## Prepare /usr/local/share/mas-cli/ ##
@@ -149,8 +137,7 @@ COPY ./translations/ /share/translations
 ##################################
 FROM gcr.io/distroless/cc-debian${DEBIAN_VERSION}:debug-nonroot AS debug
 
-ARG TARGETARCH
-COPY --from=builder /usr/local/bin/mas-cli-${TARGETARCH} /usr/local/bin/mas-cli
+COPY --from=builder /usr/local/bin/mas-cli /usr/local/bin/mas-cli
 COPY --from=share /share /usr/local/share/mas-cli
 
 WORKDIR /
@@ -161,8 +148,7 @@ ENTRYPOINT ["/usr/local/bin/mas-cli"]
 ###################
 FROM gcr.io/distroless/cc-debian${DEBIAN_VERSION}:nonroot
 
-ARG TARGETARCH
-COPY --from=builder /usr/local/bin/mas-cli-${TARGETARCH} /usr/local/bin/mas-cli
+COPY --from=builder /usr/local/bin/mas-cli /usr/local/bin/mas-cli
 COPY --from=share /share /usr/local/share/mas-cli
 
 WORKDIR /
diff --git a/README.md b/README.md
index 6acc6f6eb..4044f1bd7 100644
--- a/README.md
+++ b/README.md
@@ -1,49 +1,27 @@
-# Matrix Authentication Service
+# Matrix Authentication Service (Letro Fork)
 
-MAS (Matrix Authentication Service) is a user management and authentication service for [Matrix](https://matrix.org/) homeservers, written and maintained by [Element](https://element.io/). You can directly run and manage the source code in this repository, available under an AGPL license (or alternatively under a commercial license from Element). Support is not provided by Element unless you have a subscription.
+> **This is a fork of [element-hq/matrix-authentication-service](https://github.com/element-hq/matrix-authentication-service)**  
+> Maintained by [Letro Tech GmbH](https://letro.com)
 
-It has been created to support the migration of Matrix to a next-generation of auth APIs per [MSC3861](https://github.com/matrix-org/matrix-doc/pull/3861).
+MAS (Matrix Authentication Service) is a user management and authentication service for [Matrix](https://matrix.org/) homeservers. This fork contains modifications and customizations specific to Letro's deployment needs.
 
-See the [Documentation](https://element-hq.github.io/matrix-authentication-service/index.html) for information on installation and use.
+For the official upstream documentation, see: [element-hq.github.io/matrix-authentication-service](https://element-hq.github.io/matrix-authentication-service/index.html)
 
-You can learn more about Matrix and next-generation auth at [areweoidcyet.com](https://areweoidcyet.com/).
+## 📋 About this Fork
 
-## 🚀 Getting started
+This repository is a fork of the upstream Matrix Authentication Service with customizations for Letro's infrastructure. 
 
-This component is developed and maintained by [Element](https://element.io). It gets shipped as part of the **Element Server Suite (ESS)** which provides the official means of deployment.
+**Upstream Repository**: [element-hq/matrix-authentication-service](https://github.com/element-hq/matrix-authentication-service)
 
-ESS is a Matrix distribution from Element with focus on quality and ease of use. It ships a full Matrix stack tailored to the respective use case.
+## 💬 Community
 
-There are three editions of ESS:
+For general Matrix Authentication Service discussion, join [#matrix-auth:matrix.org](https://matrix.to/#/#matrix-auth:matrix.org)
 
-- [ESS Community](https://github.com/element-hq/ess-helm) - the free Matrix
-  distribution from Element tailored to small-/mid-scale, non-commercial
-  community use cases
-- [ESS Pro](https://element.io/server-suite) - the commercial Matrix
-  distribution from Element for professional use
-- [ESS TI-M](https://element.io/server-suite/ti-messenger) - a special version
-  of ESS Pro focused on the requirements of TI-Messenger Pro and ePA as
-  specified by the German National Digital Health Agency Gematik
+## 🛠️ Installation
 
-## 💬 Community room
-
-Developers and users of Matrix Authentication Service can chat in the [#matrix-auth:matrix.org](https://matrix.to/#/#matrix-auth:matrix.org) room on Matrix.
-
-## 🛠️ Standalone installation and configuration
-
-The best way to get a modern Element Matrix stack is through the [Element Server Suite](https://element.io/en/server-suite), which includes MAS.
-
-The MAS documentation describes [how to install and configure MAS](https://element-hq.github.io/matrix-authentication-service/setup/).
-We recommend using the [Docker image](https://element-hq.github.io/matrix-authentication-service/setup/installation.html#using-the-docker-image) or the [pre-built binaries](https://element-hq.github.io/matrix-authentication-service/setup/installation.html#pre-built-binaries).
-
-## 📖 Translations
-
-Matrix Authentication Service is available in multiple languages.
-Anyone can contribute to translations through [Localazy](https://localazy.com/element-matrix-authentication-service/).
-
-## 🏗️ Contributing
-
-See the [contribution guidelines](https://element-hq.github.io/matrix-authentication-service/development/contributing.html) for information on how to contribute to this project.
+For installation and configuration, refer to:
+- **Upstream documentation**: [element-hq.github.io/matrix-authentication-service/setup](https://element-hq.github.io/matrix-authentication-service/setup/)
+- Letro-specific deployment documentation (if applicable)
 
 ## ⚖️ Copyright & License
 
@@ -57,5 +35,18 @@ This software is dual-licensed by Element Creations Ltd (Element). It can be use
 
 (1) for free under the terms of the GNU Affero General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
 
-(2) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to).
-Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.
+### Original Work
+Copyright 2021-2024 The Matrix.org Foundation C.I.C.  
+Copyright 2024, 2025 New Vector Ltd.  
+Copyright 2025, 2026 Element Creations Ltd.
+
+### Modifications
+Copyright 2026 Letro Tech GmbH
+
+This software is based on the Matrix Authentication Service and is licensed under the GNU Affero General Public License version 3 (AGPL-3.0).
+
+This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>
\ No newline at end of file
diff --git a/crates/cli/src/commands/server.rs b/crates/cli/src/commands/server.rs
index b72d48111..462da7528 100644
--- a/crates/cli/src/commands/server.rs
+++ b/crates/cli/src/commands/server.rs
@@ -231,6 +231,7 @@ impl Options {
             password_manager.clone(),
             url_builder.clone(),
             limiter.clone(),
+            http_client.clone(),
         );
 
         let state = {
diff --git a/crates/cli/src/util.rs b/crates/cli/src/util.rs
index 454276150..224166b53 100644
--- a/crates/cli/src/util.rs
+++ b/crates/cli/src/util.rs
@@ -243,6 +243,20 @@ pub fn site_config_from_config(
                 soft_limit: c.soft_limit,
                 hard_limit: c.hard_limit,
             }),
+        postnumber_validation: account_config.postnumber_validation.as_ref().map(|c| {
+            mas_data_model::PostnumberValidationConfig {
+                endpoint: c.endpoint.clone(),
+                timeout: c.timeout,
+                on_unavailable: match c.on_unavailable {
+                    mas_config::PostnumberValidationFailureMode::Open => {
+                        mas_data_model::PostnumberValidationFailureMode::Open
+                    }
+                    mas_config::PostnumberValidationFailureMode::Closed => {
+                        mas_data_model::PostnumberValidationFailureMode::Closed
+                    }
+                },
+            }
+        }),
     })
 }
 
diff --git a/crates/config/src/sections/account.rs b/crates/config/src/sections/account.rs
index 2b6538a2b..4b657b96e 100644
--- a/crates/config/src/sections/account.rs
+++ b/crates/config/src/sections/account.rs
@@ -4,8 +4,12 @@
 // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
 // Please see LICENSE files in the repository root for full details.
 
+use std::time::Duration;
+
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
+use serde_with::serde_as;
+use url::Url;
 
 use crate::ConfigurationSection;
 
@@ -27,6 +31,54 @@ const fn is_default_false(value: &bool) -> bool {
     *value == default_false()
 }
 
+fn default_postnumber_timeout() -> Duration {
+    Duration::from_secs(2)
+}
+
+fn is_default_postnumber_timeout(value: &Duration) -> bool {
+    *value == default_postnumber_timeout()
+}
+
+/// How MAS should behave when the postnumber resolver cannot be reached.
+#[derive(Clone, Copy, Debug, Deserialize, JsonSchema, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum PostnumberValidationFailureMode {
+    /// Allow the registration or admin action to proceed without resolver
+    /// input.
+    Open,
+    /// Reject the registration or admin action when the resolver is
+    /// unavailable.
+    Closed,
+}
+
+impl Default for PostnumberValidationFailureMode {
+    fn default() -> Self {
+        Self::Closed
+    }
+}
+
+#[serde_as]
+#[derive(Clone, Debug, Deserialize, JsonSchema, Serialize)]
+/// Configuration for the external postnumber resolver integration.
+pub struct PostnumberValidationConfig {
+    /// Resolver endpoint used to validate user-facing postnumbers.
+    pub endpoint: Url,
+
+    /// Per-request timeout when calling the resolver.
+    #[serde_as(as = "serde_with::DurationSeconds<u64>")]
+    #[schemars(with = "u64")]
+    #[serde(
+        default = "default_postnumber_timeout",
+        skip_serializing_if = "is_default_postnumber_timeout"
+    )]
+    pub timeout: Duration,
+
+    /// Behavior when the resolver cannot be reached or returns an unexpected
+    /// error.
+    #[serde(default)]
+    pub on_unavailable: PostnumberValidationFailureMode,
+}
+
 /// Configuration section to configure features related to account management
 #[allow(clippy::struct_excessive_bools)]
 #[derive(Clone, Debug, Deserialize, JsonSchema, Serialize)]
@@ -88,6 +140,11 @@ pub struct AccountConfig {
     /// is disabled.
     #[serde(default = "default_false", skip_serializing_if = "is_default_false")]
     pub registration_token_required: bool,
+
+    /// Optional external resolver for validating user-facing postnumbers in
+    /// registration flows.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub postnumber_validation: Option<PostnumberValidationConfig>,
 }
 
 impl Default for AccountConfig {
@@ -102,6 +159,7 @@ impl Default for AccountConfig {
             account_deactivation_allowed: default_true(),
             login_with_email_allowed: default_false(),
             registration_token_required: default_false(),
+            postnumber_validation: None,
         }
     }
 }
@@ -117,6 +175,7 @@ impl AccountConfig {
             && is_default_true(&self.account_deactivation_allowed)
             && is_default_false(&self.login_with_email_allowed)
             && is_default_false(&self.registration_token_required)
+            && self.postnumber_validation.is_none()
     }
 }
 
diff --git a/crates/config/src/sections/mod.rs b/crates/config/src/sections/mod.rs
index eb4ff2a44..e2ae0c1ec 100644
--- a/crates/config/src/sections/mod.rs
+++ b/crates/config/src/sections/mod.rs
@@ -28,7 +28,7 @@ mod templates;
 mod upstream_oauth2;
 
 pub use self::{
-    account::AccountConfig,
+    account::{AccountConfig, PostnumberValidationConfig, PostnumberValidationFailureMode},
     branding::BrandingConfig,
     captcha::{CaptchaConfig, CaptchaServiceKind},
     clients::{ClientAuthMethodConfig, ClientConfig, ClientsConfig},
diff --git a/crates/data-model/src/lib.rs b/crates/data-model/src/lib.rs
index 05b2466b9..6854157fc 100644
--- a/crates/data-model/src/lib.rs
+++ b/crates/data-model/src/lib.rs
@@ -40,7 +40,8 @@ pub use self::{
     },
     policy_data::PolicyData,
     site_config::{
-        CaptchaConfig, CaptchaService, SessionExpirationConfig, SessionLimitConfig, SiteConfig,
+        CaptchaConfig, CaptchaService, PostnumberValidationConfig, PostnumberValidationFailureMode,
+        SessionExpirationConfig, SessionLimitConfig, SiteConfig,
     },
     tokens::{
         AccessToken, AccessTokenState, RefreshToken, RefreshTokenState, TokenFormatError, TokenType,
diff --git a/crates/data-model/src/site_config.rs b/crates/data-model/src/site_config.rs
index bb92dc3e4..20d4a2ba2 100644
--- a/crates/data-model/src/site_config.rs
+++ b/crates/data-model/src/site_config.rs
@@ -4,7 +4,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
 // Please see LICENSE files in the repository root for full details.
 
-use std::num::NonZeroU64;
+use std::{num::NonZeroU64, time::Duration as StdDuration};
 
 use chrono::Duration;
 use serde::Serialize;
@@ -111,4 +111,27 @@ pub struct SiteConfig {
 
     /// Limits on the number of application sessions that each user can have
     pub session_limit: Option<SessionLimitConfig>,
+
+    /// Postnumber validation configuration
+    pub postnumber_validation: Option<PostnumberValidationConfig>,
+}
+
+/// What to do when the postnumber resolver is unreachable.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PostnumberValidationFailureMode {
+    /// Allow registration to proceed (fail-open).
+    Open,
+    /// Block registration (fail-closed).
+    Closed,
+}
+
+/// Runtime configuration for the postnumber resolver service.
+#[derive(Debug, Clone)]
+pub struct PostnumberValidationConfig {
+    /// Base URL of the resolver (e.g. `http://localhost:3001`).
+    pub endpoint: Url,
+    /// Per-request timeout.
+    pub timeout: StdDuration,
+    /// Behaviour when the resolver cannot be reached.
+    pub on_unavailable: PostnumberValidationFailureMode,
 }
diff --git a/crates/handlers/src/admin/mod.rs b/crates/handlers/src/admin/mod.rs
index cbb23edbf..a9168b777 100644
--- a/crates/handlers/src/admin/mod.rs
+++ b/crates/handlers/src/admin/mod.rs
@@ -166,6 +166,7 @@ where
     Arc<PolicyFactory>: FromRef<S>,
     SiteConfig: FromRef<S>,
     AppVersion: FromRef<S>,
+    reqwest::Client: FromRef<S>,
 {
     // We *always* want to explicitly set the possible responses, beacuse the
     // infered ones are not necessarily correct
diff --git a/crates/handlers/src/admin/v1/mod.rs b/crates/handlers/src/admin/v1/mod.rs
index 98f1d10e2..769f7f73d 100644
--- a/crates/handlers/src/admin/v1/mod.rs
+++ b/crates/handlers/src/admin/v1/mod.rs
@@ -39,6 +39,7 @@ where
     SiteConfig: FromRef<S>,
     AppVersion: FromRef<S>,
     Arc<PolicyFactory>: FromRef<S>,
+    reqwest::Client: FromRef<S>,
     BoxRng: FromRequestParts<S>,
     CallContext: FromRequestParts<S>,
 {
diff --git a/crates/handlers/src/admin/v1/users/add.rs b/crates/handlers/src/admin/v1/users/add.rs
index 9b3307e8d..78e3f3b2c 100644
--- a/crates/handlers/src/admin/v1/users/add.rs
+++ b/crates/handlers/src/admin/v1/users/add.rs
@@ -17,6 +17,7 @@ use serde::Deserialize;
 use tracing::warn;
 
 use crate::{
+    SiteConfig,
     admin::{
         call_context::CallContext,
         model::User,
@@ -26,14 +27,7 @@ use crate::{
 };
 
 fn valid_username_character(c: char) -> bool {
-    c.is_ascii_lowercase()
-        || c.is_ascii_digit()
-        || c == '='
-        || c == '_'
-        || c == '-'
-        || c == '.'
-        || c == '/'
-        || c == '+'
+    c.is_ascii_lowercase() || c.is_ascii_digit()
 }
 
 // XXX: this should be shared with the graphql handler
@@ -42,12 +36,7 @@ fn username_valid(username: &str) -> bool {
         return false;
     }
 
-    // Should not start with an underscore
-    if username.starts_with('_') {
-        return false;
-    }
-
-    // Should only contain valid characters
+    // Should only contain lowercase ASCII letters and digits
     if !username.chars().all(valid_username_character) {
         return false;
     }
@@ -72,6 +61,12 @@ pub enum RouteError {
 
     #[error("Username is reserved by the homeserver")]
     UsernameReserved,
+
+    #[error("Postnumber is reserved")]
+    PostnumberReserved,
+
+    #[error("Postnumber resolver unavailable")]
+    PostnumberResolverUnavailable,
 }
 
 impl_from_error_for_route!(mas_storage::RepositoryError);
@@ -81,9 +76,13 @@ impl IntoResponse for RouteError {
         let error = ErrorResponse::from_error(&self);
         let sentry_event_id = record_error!(self, Self::Internal(_) | Self::Homeserver(_));
         let status = match self {
-            Self::Internal(_) | Self::Homeserver(_) => StatusCode::INTERNAL_SERVER_ERROR,
+            Self::Internal(_) | Self::Homeserver(_) | Self::PostnumberResolverUnavailable => {
+                StatusCode::INTERNAL_SERVER_ERROR
+            }
             Self::UsernameNotValid => StatusCode::BAD_REQUEST,
-            Self::UserAlreadyExists | Self::UsernameReserved => StatusCode::CONFLICT,
+            Self::UserAlreadyExists | Self::UsernameReserved | Self::PostnumberReserved => {
+                StatusCode::CONFLICT
+            }
         };
         (status, sentry_event_id, Json(error)).into_response()
     }
@@ -103,6 +102,12 @@ pub struct Request {
     /// tokens (like with admin access) for them
     #[serde(default)]
     skip_homeserver_check: bool,
+
+    /// Explicitly claim a postnumber that is marked as reserved by the
+    /// postnumber resolver. Has no effect when postnumber validation is
+    /// not configured.
+    #[serde(default)]
+    claim_reserved_postnumber: bool,
 }
 
 pub fn doc(operation: TransformOperation) -> TransformOperation {
@@ -137,6 +142,8 @@ pub async fn handler(
     }: CallContext,
     NoApi(mut rng): NoApi<BoxRng>,
     State(homeserver): State<Arc<dyn HomeserverConnection>>,
+    State(site_config): State<SiteConfig>,
+    State(http_client): State<reqwest::Client>,
     Json(params): Json<Request>,
 ) -> Result<(StatusCode, Json<SingleResponse<User>>), RouteError> {
     if repo.user().exists(&params.username).await? {
@@ -148,6 +155,35 @@ pub async fn handler(
         return Err(RouteError::UsernameNotValid);
     }
 
+    // Postnumber validation via external resolver
+    match crate::postnumber::check(
+        &http_client,
+        site_config.postnumber_validation.as_ref(),
+        &params.username,
+    )
+    .await
+    {
+        Ok(Some(crate::postnumber::PostnumberOutcome::Allowed) | None) => {
+            // Valid – continue
+        }
+        Ok(Some(crate::postnumber::PostnumberOutcome::Reserved)) => {
+            if !params.claim_reserved_postnumber {
+                return Err(RouteError::PostnumberReserved);
+            }
+            tracing::info!(
+                username = %params.username,
+                "Admin claiming reserved postnumber"
+            );
+        }
+        Err(e) => {
+            tracing::error!(
+                error = &e as &dyn std::error::Error,
+                "postnumber resolver error during admin user creation"
+            );
+            return Err(RouteError::PostnumberResolverUnavailable);
+        }
+    }
+
     // Ask the homeserver if the username is available
     let homeserver_available = homeserver
         .is_localpart_available(&params.username)
@@ -323,4 +359,104 @@ mod tests {
 
         assert_eq!(user.username, "bob");
     }
+
+    #[sqlx::test(migrator = "mas_storage_pg::MIGRATOR")]
+    async fn test_add_user_postnumber_reserved(pool: PgPool) {
+        setup();
+
+        let mock_server = wiremock::MockServer::start().await;
+        wiremock::Mock::given(wiremock::matchers::method("POST"))
+            .and(wiremock::matchers::path("/v1/check"))
+            .respond_with(
+                wiremock::ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                    "normalized": "admin",
+                    "status": "RESERVED",
+                    "match_kind": "exact",
+                    "matched_terms": ["admin"],
+                    "matched_categories": [],
+                    "pattern_family": null
+                })),
+            )
+            .mount(&mock_server)
+            .await;
+
+        let mut site_config = crate::test_utils::test_site_config();
+        site_config.postnumber_validation = Some(mas_data_model::PostnumberValidationConfig {
+            endpoint: url::Url::parse(&format!("{}/", mock_server.uri())).unwrap(),
+            timeout: std::time::Duration::from_secs(5),
+            on_unavailable: mas_data_model::PostnumberValidationFailureMode::Closed,
+        });
+
+        let mut state = TestState::from_pool_with_site_config(pool, site_config)
+            .await
+            .unwrap();
+        let token = state.token_with_scope("urn:mas:admin").await;
+
+        // Reserved postnumber without claim flag → rejected
+        let request = Request::post("/api/admin/v1/users")
+            .bearer(&token)
+            .json(serde_json::json!({
+                "username": "admin",
+            }));
+        let response = state.request(request).await;
+        response.assert_status(StatusCode::CONFLICT);
+        let body: serde_json::Value = response.json();
+        assert_eq!(body["errors"][0]["title"], "Postnumber is reserved");
+
+        // Reserved postnumber with claim flag → allowed
+        let request = Request::post("/api/admin/v1/users")
+            .bearer(&token)
+            .json(serde_json::json!({
+                "username": "admin",
+                "claim_reserved_postnumber": true,
+            }));
+        let response = state.request(request).await;
+        response.assert_status(StatusCode::CREATED);
+        let body: serde_json::Value = response.json();
+        assert_eq!(body["data"]["attributes"]["username"], "admin");
+    }
+
+    #[sqlx::test(migrator = "mas_storage_pg::MIGRATOR")]
+    async fn test_add_user_postnumber_allowed(pool: PgPool) {
+        setup();
+
+        let mock_server = wiremock::MockServer::start().await;
+        wiremock::Mock::given(wiremock::matchers::method("POST"))
+            .and(wiremock::matchers::path("/v1/check"))
+            .respond_with(
+                wiremock::ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                    "normalized": "alice",
+                    "status": "ALLOW",
+                    "match_kind": "allow",
+                    "matched_terms": [],
+                    "matched_categories": [],
+                    "pattern_family": null
+                })),
+            )
+            .mount(&mock_server)
+            .await;
+
+        let mut site_config = crate::test_utils::test_site_config();
+        site_config.postnumber_validation = Some(mas_data_model::PostnumberValidationConfig {
+            endpoint: url::Url::parse(&format!("{}/", mock_server.uri())).unwrap(),
+            timeout: std::time::Duration::from_secs(5),
+            on_unavailable: mas_data_model::PostnumberValidationFailureMode::Closed,
+        });
+
+        let mut state = TestState::from_pool_with_site_config(pool, site_config)
+            .await
+            .unwrap();
+        let token = state.token_with_scope("urn:mas:admin").await;
+
+        // Allowed postnumber → success
+        let request = Request::post("/api/admin/v1/users")
+            .bearer(&token)
+            .json(serde_json::json!({
+                "username": "alice",
+            }));
+        let response = state.request(request).await;
+        response.assert_status(StatusCode::CREATED);
+        let body: serde_json::Value = response.json();
+        assert_eq!(body["data"]["attributes"]["username"], "alice");
+    }
 }
diff --git a/crates/handlers/src/bin/api-schema.rs b/crates/handlers/src/bin/api-schema.rs
index 1b73c05c3..da300cf11 100644
--- a/crates/handlers/src/bin/api-schema.rs
+++ b/crates/handlers/src/bin/api-schema.rs
@@ -61,6 +61,7 @@ impl_from_ref!(mas_handlers::passwords::PasswordManager);
 impl_from_ref!(Arc<mas_policy::PolicyFactory>);
 impl_from_ref!(mas_data_model::SiteConfig);
 impl_from_ref!(mas_data_model::AppVersion);
+impl_from_ref!(reqwest::Client);
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     let (mut api, _) = mas_handlers::admin_api_router::<DummyState>();
diff --git a/crates/handlers/src/graphql/mod.rs b/crates/handlers/src/graphql/mod.rs
index 7ccf9e51b..e70f72f1d 100644
--- a/crates/handlers/src/graphql/mod.rs
+++ b/crates/handlers/src/graphql/mod.rs
@@ -76,6 +76,7 @@ struct GraphQLState {
     password_manager: PasswordManager,
     url_builder: UrlBuilder,
     limiter: Limiter,
+    http_client: reqwest::Client,
 }
 
 #[async_trait::async_trait]
@@ -108,6 +109,10 @@ impl state::State for GraphQLState {
         &self.limiter
     }
 
+    fn http_client(&self) -> &reqwest::Client {
+        &self.http_client
+    }
+
     fn clock(&self) -> BoxClock {
         let clock = SystemClock::default();
         Box::new(clock)
@@ -131,6 +136,7 @@ pub fn schema(
     password_manager: PasswordManager,
     url_builder: UrlBuilder,
     limiter: Limiter,
+    http_client: reqwest::Client,
 ) -> Schema {
     let state = GraphQLState {
         repository_factory,
@@ -140,6 +146,7 @@ pub fn schema(
         password_manager,
         url_builder,
         limiter,
+        http_client,
     };
     let state: BoxState = Box::new(state);
 
diff --git a/crates/handlers/src/graphql/mutations/user.rs b/crates/handlers/src/graphql/mutations/user.rs
index 376652a46..e4c9d8bf8 100644
--- a/crates/handlers/src/graphql/mutations/user.rs
+++ b/crates/handlers/src/graphql/mutations/user.rs
@@ -440,14 +440,7 @@ impl DeactivateUserPayload {
 }
 
 fn valid_username_character(c: char) -> bool {
-    c.is_ascii_lowercase()
-        || c.is_ascii_digit()
-        || c == '='
-        || c == '_'
-        || c == '-'
-        || c == '.'
-        || c == '/'
-        || c == '+'
+    c.is_ascii_lowercase() || c.is_ascii_digit()
 }
 
 // XXX: this should probably be moved somewhere else
@@ -456,12 +449,7 @@ fn username_valid(username: &str) -> bool {
         return false;
     }
 
-    // Should not start with an underscore
-    if username.starts_with('_') {
-        return false;
-    }
-
-    // Should only contain valid characters
+    // Should only contain lowercase ASCII letters and digits
     if !username.chars().all(valid_username_character) {
         return false;
     }
@@ -497,6 +485,29 @@ impl UserMutations {
             return Ok(AddUserPayload::Invalid);
         }
 
+        // Postnumber (username) validation via external resolver
+        match crate::postnumber::check(
+            state.http_client(),
+            state.site_config().postnumber_validation.as_ref(),
+            &input.username,
+        )
+        .await
+        {
+            Ok(Some(crate::postnumber::PostnumberOutcome::Allowed) | None) => {
+                // Valid – continue
+            }
+            Ok(Some(crate::postnumber::PostnumberOutcome::Reserved)) => {
+                return Ok(AddUserPayload::Reserved);
+            }
+            Err(e) => {
+                tracing::error!(
+                    error = &e as &dyn std::error::Error,
+                    "postnumber resolver error during addUser"
+                );
+                return Err(async_graphql::Error::new("Postnumber resolver unavailable"));
+            }
+        }
+
         // Ask the homeserver if the username is available
         let homeserver_available = state
             .homeserver_connection()
diff --git a/crates/handlers/src/graphql/state.rs b/crates/handlers/src/graphql/state.rs
index 7faf76334..a270d7c0f 100644
--- a/crates/handlers/src/graphql/state.rs
+++ b/crates/handlers/src/graphql/state.rs
@@ -26,6 +26,7 @@ pub trait State {
     fn site_config(&self) -> &SiteConfig;
     fn url_builder(&self) -> &UrlBuilder;
     fn limiter(&self) -> &Limiter;
+    fn http_client(&self) -> &reqwest::Client;
 }
 
 pub type BoxState = Box<dyn State + Send + Sync + 'static>;
diff --git a/crates/handlers/src/lib.rs b/crates/handlers/src/lib.rs
index 0cb450f53..ce2be4e95 100644
--- a/crates/handlers/src/lib.rs
+++ b/crates/handlers/src/lib.rs
@@ -64,6 +64,7 @@ mod activity_tracker;
 mod captcha;
 #[cfg(test)]
 mod cleanup_tests;
+pub(crate) mod postnumber;
 mod preferred_language;
 mod rate_limit;
 mod session;
@@ -395,7 +396,7 @@ where
         .route(mas_router::Logout::route(), post(self::views::logout::post))
         .route(
             mas_router::Register::route(),
-            get(self::views::register::get),
+            get(self::views::register::get).post(self::views::register::post),
         )
         .route(
             mas_router::PasswordRegister::route(),
diff --git a/crates/handlers/src/postnumber.rs b/crates/handlers/src/postnumber.rs
new file mode 100644
index 000000000..9d8029b02
--- /dev/null
+++ b/crates/handlers/src/postnumber.rs
@@ -0,0 +1,564 @@
+// Copyright 2025 New Vector Ltd.
+//
+// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+// Please see LICENSE files in the repository root for full details.
+
+//! Client for the external postnumber-resolver service.
+//!
+//! The resolver validates user-facing "postnumbers" (usernames) during
+//! registration and returns whether a value is *allowed* or *reserved*.
+//!
+//! MAS usernames are restricted to `[a-z0-9]` which is the same alphabet
+//! as the resolver.  The `normalize_for_resolver` helper lowercases the
+//! input before sending it to the resolver.
+
+use std::sync::LazyLock;
+
+use mas_data_model::{PostnumberValidationConfig, PostnumberValidationFailureMode};
+use mas_http::RequestBuilderExt as _;
+use opentelemetry::{Key, KeyValue, metrics::Counter};
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+use url::Url;
+
+use crate::METER;
+
+// ---------------------------------------------------------------------------
+// Metrics
+// ---------------------------------------------------------------------------
+
+static OUTCOME: Key = Key::from_static_str("postnumber.outcome");
+
+static CHECK_COUNTER: LazyLock<Counter<u64>> = LazyLock::new(|| {
+    METER
+        .u64_counter("mas.postnumber.check")
+        .with_description("Number of postnumber resolver checks")
+        .with_unit("{check}")
+        .build()
+});
+
+// ---------------------------------------------------------------------------
+// Wire types – mirror of the resolver's HTTP contract
+// ---------------------------------------------------------------------------
+
+/// Request payload sent to `POST /v1/check`.
+#[derive(Debug, Serialize)]
+struct CheckRequest<'a> {
+    value: &'a str,
+}
+
+/// Status returned by the resolver on a successful check.
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum CheckStatus {
+    Allow,
+    Reserved,
+}
+
+/// Full success response from `POST /v1/check`.
+#[derive(Debug, Deserialize)]
+pub struct CheckResponse {
+    pub status: CheckStatus,
+    #[allow(dead_code)]
+    pub match_kind: serde_json::Value, // we don't need the enum on this side
+    #[allow(dead_code)]
+    pub matched_terms: Vec<String>,
+    #[allow(dead_code)]
+    pub matched_categories: Vec<String>,
+    #[allow(dead_code)]
+    pub pattern_family: Option<String>,
+}
+
+// ---------------------------------------------------------------------------
+// Domain result
+// ---------------------------------------------------------------------------
+
+/// Maximum length the resolver accepts. Values longer than this after
+/// stripping non-alphanumeric characters are not postnumbers — skip the
+/// check and let MAS's own rules decide.
+const MAX_RESOLVER_INPUT_LENGTH: usize = 20;
+
+/// The outcome of a postnumber check that callers should act on.
+#[derive(Debug)]
+pub enum PostnumberOutcome {
+    /// The postnumber is valid and available for any user.
+    Allowed,
+    /// The postnumber is valid but reserved by policy (admin-only).
+    Reserved,
+}
+
+// ---------------------------------------------------------------------------
+// Errors
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Error)]
+pub enum Error {
+    /// HTTP-level failure (connection refused, timeout, TLS error, …).
+    #[error("postnumber resolver request failed")]
+    Request(#[from] reqwest::Error),
+
+    /// The resolver returned an unexpected status code or unparseable body.
+    #[error("postnumber resolver returned an unexpected response (status {status})")]
+    UnexpectedResponse { status: reqwest::StatusCode },
+
+    /// The resolver is temporarily unavailable (rate-limited, service down, …)
+    /// and the configured failure-mode decides what happens.
+    #[error("postnumber resolver is unavailable")]
+    Unavailable,
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/// Check a postnumber against the resolver service.
+///
+/// Returns `Ok(None)` when postnumber validation is not configured (i.e. the
+/// feature is disabled).
+///
+/// Returns `Ok(Some(outcome))` with the resolver's decision, or `Err` when the
+/// resolver is unreachable and the failure mode is `Closed`.
+#[tracing::instrument(
+    name = "postnumber.check",
+    skip_all,
+    fields(postnumber.value = %value),
+)]
+pub async fn check(
+    http_client: &reqwest::Client,
+    config: Option<&PostnumberValidationConfig>,
+    value: &str,
+) -> Result<Option<PostnumberOutcome>, Error> {
+    let Some(config) = config else {
+        return Ok(None);
+    };
+
+    // Lowercase the input before sending to the resolver.  If the
+    // result is empty or exceeds the resolver's max length, skip.
+    let sanitized = normalize_for_resolver(value);
+    if sanitized.is_empty() || sanitized.len() > MAX_RESOLVER_INPUT_LENGTH {
+        tracing::debug!(
+            original = %value,
+            sanitized = %sanitized,
+            "skipping postnumber check – value not in resolver's domain",
+        );
+        return Ok(None);
+    }
+
+    match do_check(http_client, &config.endpoint, config.timeout, &sanitized).await {
+        Ok(outcome) => {
+            let label = match &outcome {
+                PostnumberOutcome::Allowed => "allowed",
+                PostnumberOutcome::Reserved => "reserved",
+            };
+            CHECK_COUNTER.add(1, &[KeyValue::new(OUTCOME.clone(), label)]);
+            Ok(Some(outcome))
+        }
+        Err(Error::Unavailable) => {
+            // Single retry with backoff for transient failures before
+            // triggering the fail-open/fail-closed policy.
+            tracing::info!("postnumber resolver unavailable – retrying once after 500ms");
+            tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+
+            match do_check(http_client, &config.endpoint, config.timeout, &sanitized).await {
+                Ok(outcome) => {
+                    let label = match &outcome {
+                        PostnumberOutcome::Allowed => "allowed",
+                        PostnumberOutcome::Reserved => "reserved",
+                    };
+                    CHECK_COUNTER.add(1, &[KeyValue::new(OUTCOME.clone(), label)]);
+                    Ok(Some(outcome))
+                }
+                Err(Error::Unavailable) => match config.on_unavailable {
+                    PostnumberValidationFailureMode::Open => {
+                        tracing::warn!(
+                            "postnumber resolver unavailable after retry – failing open"
+                        );
+                        CHECK_COUNTER.add(1, &[KeyValue::new(OUTCOME.clone(), "unavailable_open")]);
+                        Ok(None)
+                    }
+                    PostnumberValidationFailureMode::Closed => {
+                        tracing::warn!(
+                            "postnumber resolver unavailable after retry – failing closed"
+                        );
+                        CHECK_COUNTER
+                            .add(1, &[KeyValue::new(OUTCOME.clone(), "unavailable_closed")]);
+                        Err(Error::Unavailable)
+                    }
+                },
+                Err(e) => {
+                    CHECK_COUNTER.add(1, &[KeyValue::new(OUTCOME.clone(), "error")]);
+                    Err(e)
+                }
+            }
+        }
+        Err(e) => {
+            CHECK_COUNTER.add(1, &[KeyValue::new(OUTCOME.clone(), "error")]);
+            Err(e)
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Internal request logic
+// ---------------------------------------------------------------------------
+
+/// Lowercases the input for the resolver.  Since MAS now only allows
+/// `[a-z0-9]` usernames, this is effectively just a `.to_ascii_lowercase()`
+/// pass — no characters need to be stripped.
+fn normalize_for_resolver(value: &str) -> String {
+    value
+        .chars()
+        .map(|c| c.to_ascii_lowercase())
+        .collect::<String>()
+}
+
+async fn do_check(
+    http_client: &reqwest::Client,
+    endpoint: &Url,
+    timeout: std::time::Duration,
+    value: &str,
+) -> Result<PostnumberOutcome, Error> {
+    // Ensure the endpoint has a trailing slash so that `Url::join`
+    // appends "v1/check" as a sub-path rather than replacing the last
+    // segment.  For example, without this normalization:
+    //   "http://host:3001/api".join("v1/check") → "http://host:3001/v1/check"
+    // With the trailing slash:
+    //   "http://host:3001/api/".join("v1/check") → "http://host:3001/api/v1/check"
+    let mut base = endpoint.clone();
+    if !base.path().ends_with('/') {
+        base.set_path(&format!("{}/", base.path()));
+    }
+
+    let url = base
+        .join("v1/check")
+        .expect("endpoint URL should be joinable with v1/check");
+
+    let response = http_client
+        .post(url)
+        .timeout(timeout)
+        .json(&CheckRequest { value })
+        .send_traced()
+        .await
+        .map_err(|e| {
+            if e.is_timeout() || e.is_connect() {
+                tracing::warn!(error = &e as &dyn std::error::Error, "resolver unreachable");
+                Error::Unavailable
+            } else {
+                Error::Request(e)
+            }
+        })?;
+
+    let status = response.status();
+
+    if status.is_success() {
+        let body: CheckResponse = response
+            .json()
+            .await
+            .map_err(|_| Error::UnexpectedResponse { status })?;
+
+        match body.status {
+            CheckStatus::Allow => Ok(PostnumberOutcome::Allowed),
+            CheckStatus::Reserved => Ok(PostnumberOutcome::Reserved),
+        }
+    } else if status == reqwest::StatusCode::BAD_REQUEST
+        || status == reqwest::StatusCode::UNPROCESSABLE_ENTITY
+    {
+        // The resolver rejected the format.  Since MAS is the authority on
+        // username format (via OPA policy / `username_valid()`), we treat
+        // this as "not a postnumber" and allow it through.
+        tracing::debug!(
+            %status,
+            %value,
+            "resolver returned client error – treating as allowed",
+        );
+        Ok(PostnumberOutcome::Allowed)
+    } else if status == reqwest::StatusCode::TOO_MANY_REQUESTS
+        || status == reqwest::StatusCode::SERVICE_UNAVAILABLE
+        || status.is_server_error()
+    {
+        Err(Error::Unavailable)
+    } else {
+        Err(Error::UnexpectedResponse { status })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use wiremock::{
+        Mock, MockServer, ResponseTemplate,
+        matchers::{body_json, method, path},
+    };
+
+    use super::*;
+
+    fn test_http_client() -> reqwest::Client {
+        reqwest::Client::builder()
+            .no_proxy()
+            .build()
+            .expect("failed to create test HTTP client")
+    }
+
+    fn test_config(server: &MockServer) -> PostnumberValidationConfig {
+        PostnumberValidationConfig {
+            endpoint: Url::parse(&format!("{}/", server.uri())).unwrap(),
+            timeout: std::time::Duration::from_secs(5),
+            on_unavailable: PostnumberValidationFailureMode::Closed,
+        }
+    }
+
+    #[tokio::test]
+    async fn test_allowed() {
+        let server = MockServer::start().await;
+
+        Mock::given(method("POST"))
+            .and(path("/v1/check"))
+            .and(body_json(serde_json::json!({ "value": "alice" })))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "normalized": "alice",
+                "status": "ALLOW",
+                "match_kind": "allow",
+                "matched_terms": [],
+                "matched_categories": [],
+                "pattern_family": null
+            })))
+            .expect(1)
+            .mount(&server)
+            .await;
+
+        let client = test_http_client();
+        let config = test_config(&server);
+
+        let result = check(&client, Some(&config), "alice").await.unwrap();
+        match result {
+            Some(PostnumberOutcome::Allowed) => {}
+            other => panic!("expected Allowed, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_reserved() {
+        let server = MockServer::start().await;
+
+        Mock::given(method("POST"))
+            .and(path("/v1/check"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "normalized": "admin",
+                "status": "RESERVED",
+                "match_kind": "exact",
+                "matched_terms": ["admin"],
+                "matched_categories": [],
+                "pattern_family": null
+            })))
+            .mount(&server)
+            .await;
+
+        let client = test_http_client();
+        let config = test_config(&server);
+
+        let result = check(&client, Some(&config), "admin").await.unwrap();
+        match result {
+            Some(PostnumberOutcome::Reserved) => {}
+            other => panic!("expected Reserved, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_resolver_400_treated_as_allowed() {
+        // When the resolver rejects the format, MAS treats it as
+        // "not a postnumber" and allows it — MAS's own rules handle format.
+        let server = MockServer::start().await;
+
+        Mock::given(method("POST"))
+            .and(path("/v1/check"))
+            .respond_with(ResponseTemplate::new(400).set_body_json(serde_json::json!({
+                "error": "invalid_postnumber_format",
+                "message": "postnumber must start with a letter"
+            })))
+            .mount(&server)
+            .await;
+
+        let client = test_http_client();
+        let config = test_config(&server);
+
+        let result = check(&client, Some(&config), "abc123").await.unwrap();
+        match result {
+            Some(PostnumberOutcome::Allowed) => { /* correct */ }
+            other => panic!("expected Allowed, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_uppercase_lowered() {
+        // normalize_for_resolver lowercases the input before sending.
+        // Verify the resolver receives "alice", not "Alice".
+        let server = MockServer::start().await;
+
+        Mock::given(method("POST"))
+            .and(path("/v1/check"))
+            .and(body_json(serde_json::json!({ "value": "alice" })))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "normalized": "alice",
+                "status": "ALLOW",
+                "match_kind": "allow",
+                "matched_terms": [],
+                "matched_categories": [],
+                "pattern_family": null
+            })))
+            .expect(1)
+            .mount(&server)
+            .await;
+
+        let client = test_http_client();
+        let config = test_config(&server);
+
+        // "Alice" → "alice" sent to resolver
+        let result = check(&client, Some(&config), "Alice").await.unwrap();
+        match result {
+            Some(PostnumberOutcome::Allowed) => {}
+            other => panic!("expected Allowed, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_long_username_skipped() {
+        // Usernames > 20 alphanumeric chars are outside the resolver's
+        // domain and should be skipped entirely (returns None).
+        let server = MockServer::start().await;
+        // Don't mount any mock — if the resolver is called, the test fails.
+
+        let client = test_http_client();
+        let config = test_config(&server);
+
+        let long_name = "a".repeat(21);
+        let result = check(&client, Some(&config), &long_name).await.unwrap();
+        assert!(result.is_none(), "expected None for long username");
+    }
+
+    #[tokio::test]
+    async fn test_unavailable_closed() {
+        // No server running → connection refused
+        let config = PostnumberValidationConfig {
+            endpoint: Url::parse("http://127.0.0.1:1/").unwrap(),
+            timeout: std::time::Duration::from_millis(200),
+            on_unavailable: PostnumberValidationFailureMode::Closed,
+        };
+
+        let client = test_http_client();
+        let result = check(&client, Some(&config), "test").await;
+        assert!(result.is_err());
+    }
+
+    #[tokio::test]
+    async fn test_unavailable_open() {
+        let config = PostnumberValidationConfig {
+            endpoint: Url::parse("http://127.0.0.1:1/").unwrap(),
+            timeout: std::time::Duration::from_millis(200),
+            on_unavailable: PostnumberValidationFailureMode::Open,
+        };
+
+        let client = test_http_client();
+        let result = check(&client, Some(&config), "test").await.unwrap();
+        assert!(result.is_none());
+    }
+
+    #[tokio::test]
+    async fn test_no_config() {
+        let client = test_http_client();
+        let result = check(&client, None, "anything").await.unwrap();
+        assert!(result.is_none());
+    }
+
+    #[tokio::test]
+    async fn test_rate_limited() {
+        let server = MockServer::start().await;
+
+        // With retry, the resolver will be called twice before giving up.
+        Mock::given(method("POST"))
+            .and(path("/v1/check"))
+            .respond_with(ResponseTemplate::new(429).set_body_json(serde_json::json!({
+                "error": "rate_limited",
+                "message": "Too many requests"
+            })))
+            .expect(2)
+            .mount(&server)
+            .await;
+
+        let client = test_http_client();
+        let config = test_config(&server);
+
+        let result = check(&client, Some(&config), "test").await;
+        assert!(result.is_err());
+    }
+
+    #[tokio::test]
+    async fn test_retry_succeeds_on_second_attempt() {
+        // First call returns 503, second call succeeds.
+        let server = MockServer::start().await;
+
+        // Mount a 503 response that only fires once…
+        Mock::given(method("POST"))
+            .and(path("/v1/check"))
+            .respond_with(ResponseTemplate::new(503))
+            .up_to_n_times(1)
+            .mount(&server)
+            .await;
+
+        // …then an ALLOW response for subsequent calls.
+        Mock::given(method("POST"))
+            .and(path("/v1/check"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "normalized": "bob",
+                "status": "ALLOW",
+                "match_kind": "allow",
+                "matched_terms": [],
+                "matched_categories": [],
+                "pattern_family": null
+            })))
+            .mount(&server)
+            .await;
+
+        let client = test_http_client();
+        let config = test_config(&server);
+
+        let result = check(&client, Some(&config), "bob").await.unwrap();
+        match result {
+            Some(PostnumberOutcome::Allowed) => {}
+            other => panic!("expected Allowed after retry, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn test_endpoint_url_normalization() {
+        // Verify that the URL join works correctly with and without trailing slash.
+        let with_slash = Url::parse("http://localhost:3001/").unwrap();
+        let without_slash = Url::parse("http://localhost:3001").unwrap();
+        let with_path = Url::parse("http://localhost:3001/api").unwrap();
+        let with_path_slash = Url::parse("http://localhost:3001/api/").unwrap();
+
+        // Helper that mirrors the normalization in do_check
+        let normalize_and_join = |endpoint: &Url| -> String {
+            let mut base = endpoint.clone();
+            if !base.path().ends_with('/') {
+                base.set_path(&format!("{}/", base.path()));
+            }
+            base.join("v1/check").unwrap().to_string()
+        };
+
+        assert_eq!(
+            normalize_and_join(&with_slash),
+            "http://localhost:3001/v1/check"
+        );
+        assert_eq!(
+            normalize_and_join(&without_slash),
+            "http://localhost:3001/v1/check"
+        );
+        assert_eq!(
+            normalize_and_join(&with_path),
+            "http://localhost:3001/api/v1/check"
+        );
+        assert_eq!(
+            normalize_and_join(&with_path_slash),
+            "http://localhost:3001/api/v1/check"
+        );
+    }
+}
diff --git a/crates/handlers/src/test_utils.rs b/crates/handlers/src/test_utils.rs
index 521a4848d..4fd4dbb77 100644
--- a/crates/handlers/src/test_utils.rs
+++ b/crates/handlers/src/test_utils.rs
@@ -68,6 +68,13 @@ pub(crate) fn setup() {
         .try_init();
 }
 
+pub(crate) fn test_http_client() -> reqwest::Client {
+    reqwest::Client::builder()
+        .no_proxy()
+        .build()
+        .expect("failed to create test HTTP client")
+}
+
 pub(crate) async fn policy_factory(
     server_name: &str,
     data: serde_json::Value,
@@ -150,6 +157,7 @@ pub fn test_site_config() -> SiteConfig {
         login_with_email_allowed: true,
         plan_management_iframe_uri: None,
         session_limit: None,
+        postnumber_validation: None,
     }
 }
 
@@ -183,7 +191,7 @@ impl TestState {
         )
         .await?;
 
-        let http_client = mas_http::reqwest_client();
+        let http_client = test_http_client();
 
         // TODO: add more test keys to the store
         let rsa =
@@ -228,6 +236,7 @@ impl TestState {
             password_manager: password_manager.clone(),
             url_builder: url_builder.clone(),
             limiter: limiter.clone(),
+            http_client: http_client.clone(),
         };
         let state: crate::graphql::BoxState = Box::new(graphql_state);
 
@@ -441,6 +450,7 @@ struct TestGraphQLState {
     password_manager: PasswordManager,
     url_builder: UrlBuilder,
     limiter: Limiter,
+    http_client: reqwest::Client,
 }
 
 #[async_trait::async_trait]
@@ -482,6 +492,10 @@ impl graphql::State for TestGraphQLState {
         let rng = ChaChaRng::from_rng(&mut *parent_rng).expect("Failed to seed RNG");
         Box::new(rng)
     }
+
+    fn http_client(&self) -> &reqwest::Client {
+        &self.http_client
+    }
 }
 
 impl FromRef<TestState> for PgPool {
diff --git a/crates/handlers/src/upstream_oauth2/cache.rs b/crates/handlers/src/upstream_oauth2/cache.rs
index 0857bc2c1..f5f6ff987 100644
--- a/crates/handlers/src/upstream_oauth2/cache.rs
+++ b/crates/handlers/src/upstream_oauth2/cache.rs
@@ -314,13 +314,13 @@ mod tests {
     };
 
     use super::*;
-    use crate::test_utils::setup;
+    use crate::test_utils::{setup, test_http_client};
 
     #[tokio::test]
     async fn test_metadata_cache() {
         setup();
         let mock_server = MockServer::start().await;
-        let http_client = mas_http::reqwest_client();
+        let http_client = test_http_client();
 
         let cache = MetadataCache::new();
 
@@ -384,7 +384,7 @@ mod tests {
         setup();
 
         let mock_server = MockServer::start().await;
-        let http_client = mas_http::reqwest_client();
+        let http_client = test_http_client();
 
         let expected_calls = 2;
         let mut calls = 0;
diff --git a/crates/handlers/src/upstream_oauth2/link.rs b/crates/handlers/src/upstream_oauth2/link.rs
index e081b0f79..86bc0e419 100644
--- a/crates/handlers/src/upstream_oauth2/link.rs
+++ b/crates/handlers/src/upstream_oauth2/link.rs
@@ -235,6 +235,8 @@ pub(crate) async fn get(
     State(templates): State<Templates>,
     State(url_builder): State<UrlBuilder>,
     State(homeserver): State<Arc<dyn HomeserverConnection>>,
+    State(site_config): State<SiteConfig>,
+    State(http_client): State<reqwest::Client>,
     cookie_jar: CookieJar,
     activity_tracker: BoundActivityTracker,
     user_agent: Option<TypedHeader<headers::UserAgent>>,
@@ -730,6 +732,48 @@ pub(crate) async fn get(
                     ));
                 }
 
+                // Postnumber validation via external resolver
+                match crate::postnumber::check(
+                    &http_client,
+                    site_config.postnumber_validation.as_ref(),
+                    &localpart,
+                )
+                .await
+                {
+                    Ok(Some(crate::postnumber::PostnumberOutcome::Allowed) | None) => {
+                        // Valid – continue
+                    }
+                    Ok(Some(crate::postnumber::PostnumberOutcome::Reserved)) => {
+                        if !forced_or_required {
+                            tracing::warn!(
+                                upstream_oauth_provider.id = %provider.id,
+                                upstream_oauth_link.id = %link.id,
+                                "Upstream provider returned a localpart {localpart:?} which is reserved. As the username is just a suggestion, it was ignored."
+                            );
+                            break 'localpart None;
+                        }
+
+                        let ctx = ErrorContext::new()
+                            .with_code("postnumber-reserved")
+                            .with_description(format!(
+                                r"Localpart {localpart:?} is reserved and cannot be used for self-service registration"
+                            ))
+                            .with_language(&locale);
+
+                        return Ok((
+                            cookie_jar,
+                            Html(templates.render_error(&ctx)?).into_response(),
+                        ));
+                    }
+                    Err(e) => {
+                        tracing::error!(
+                            error = &e as &dyn std::error::Error,
+                            "postnumber resolver error during upstream registration"
+                        );
+                        return Err(RouteError::Internal(Box::new(e)));
+                    }
+                }
+
                 // Now let's check if the localpart is allowed by the homeserver. It's possible
                 // that it's plain invalid (although that should have been caught by the
                 // policy), or just reserved by an application service
@@ -857,6 +901,7 @@ pub(crate) async fn post(
     State(homeserver): State<Arc<dyn HomeserverConnection>>,
     State(url_builder): State<UrlBuilder>,
     State(site_config): State<SiteConfig>,
+    State(http_client): State<reqwest::Client>,
     Path(link_id): Path<Ulid>,
     Form(form): Form<ProtectedForm<FormData>>,
 ) -> Result<Response, RouteError> {
@@ -1128,6 +1173,39 @@ pub(crate) async fn post(
                     );
                 }
 
+                // Postnumber (username) validation via external resolver.
+                // Run after OPA policy so we don't waste HTTP calls on usernames
+                // that OPA would already reject (all-numeric, banned, etc.).
+                if !username.is_empty() && form_state.is_valid() {
+                    match crate::postnumber::check(
+                        &http_client,
+                        site_config.postnumber_validation.as_ref(),
+                        &username,
+                    )
+                    .await
+                    {
+                        Ok(Some(crate::postnumber::PostnumberOutcome::Allowed) | None) => {
+                            // Valid – continue
+                        }
+                        Ok(Some(crate::postnumber::PostnumberOutcome::Reserved)) => {
+                            form_state.add_error_on_field(
+                                mas_templates::UpstreamRegisterFormField::Username,
+                                FieldError::Policy {
+                                    code: Some("postnumber-reserved"),
+                                    message: "This username is reserved".to_owned(),
+                                },
+                            );
+                        }
+                        Err(e) => {
+                            tracing::error!(
+                                error = &e as &dyn std::error::Error,
+                                "postnumber resolver error during upstream registration"
+                            );
+                            form_state.add_error_on_form(FormError::Internal);
+                        }
+                    }
+                }
+
                 form_state
             };
 
diff --git a/crates/handlers/src/views/register/mod.rs b/crates/handlers/src/views/register/mod.rs
index 6a51852ae..a04bcc3ca 100644
--- a/crates/handlers/src/views/register/mod.rs
+++ b/crates/handlers/src/views/register/mod.rs
@@ -3,16 +3,28 @@
 // SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
 // Please see LICENSE files in the repository root for full details.
 
+use std::{net::IpAddr, sync::Arc};
+
 use axum::{
-    extract::State,
+    extract::{Form, State},
     response::{Html, IntoResponse, Response},
 };
 use axum_extra::extract::Query;
-use mas_axum_utils::{InternalError, SessionInfoExt, cookies::CookieJar, csrf::CsrfExt as _};
+use mas_axum_utils::{
+    InternalError, SessionInfoExt,
+    cookies::CookieJar,
+    csrf::{CsrfExt as _, ProtectedForm},
+};
 use mas_data_model::{BoxClock, BoxRng, SiteConfig};
+use mas_matrix::HomeserverConnection;
+use mas_policy::Policy;
 use mas_router::{PasswordRegister, UpstreamOAuth2Authorize, UrlBuilder};
-use mas_storage::BoxRepository;
-use mas_templates::{RegisterContext, TemplateContext, Templates};
+use mas_storage::{BoxRepository, RepositoryAccess};
+use mas_templates::{
+    FieldError, FormError, FormState, RegisterContext, RegisterFormField, TemplateContext,
+    Templates, ToFormState,
+};
+use serde::{Deserialize, Serialize};
 
 use super::shared::OptionalPostAuthAction;
 use crate::{BoundActivityTracker, PreferredLanguage};
@@ -23,6 +35,128 @@ pub(crate) mod steps;
 
 pub use self::cookie::UserRegistrationSessions as UserRegistrationSessionsCookie;
 
+#[derive(Debug, Deserialize, Serialize)]
+pub(crate) struct UsernameForm {
+    username: String,
+    #[serde(flatten)]
+    action: OptionalPostAuthAction,
+}
+
+impl ToFormState for UsernameForm {
+    type Field = RegisterFormField;
+}
+
+#[allow(clippy::too_many_arguments)]
+pub(super) async fn validate_registration_username(
+    state: &mut FormState<RegisterFormField>,
+    username: &str,
+    user_agent: Option<String>,
+    ip_address: Option<IpAddr>,
+    repo: &mut BoxRepository,
+    policy: &mut Policy,
+    homeserver: &Arc<dyn HomeserverConnection>,
+    http_client: &reqwest::Client,
+    site_config: &SiteConfig,
+) -> Result<(), InternalError> {
+    let mut homeserver_denied_username = false;
+    if username.is_empty() {
+        state.add_error_on_field(RegisterFormField::Username, FieldError::Required);
+    } else if repo.user().exists(username).await? {
+        state.add_error_on_field(RegisterFormField::Username, FieldError::Exists);
+    } else if !homeserver
+        .is_localpart_available(username)
+        .await
+        .map_err(InternalError::from_anyhow)?
+    {
+        tracing::warn!(username, "Homeserver denied username provided by user");
+        homeserver_denied_username = true;
+    }
+
+    let res = policy
+        .evaluate_register(mas_policy::RegisterInput {
+            registration_method: mas_policy::RegistrationMethod::Password,
+            username,
+            email: None,
+            requester: mas_policy::Requester {
+                ip_address,
+                user_agent,
+            },
+        })
+        .await?;
+
+    for violation in res.violations {
+        match violation.field.as_deref() {
+            Some("username") => {
+                homeserver_denied_username = false;
+                state.add_error_on_field(
+                    RegisterFormField::Username,
+                    FieldError::Policy {
+                        code: violation.variant.map(|c| c.as_str()),
+                        message: violation.msg,
+                    },
+                );
+            }
+            _ => state.add_error_on_form(FormError::Policy {
+                code: violation.variant.map(|c| c.as_str()),
+                message: violation.msg,
+            }),
+        }
+    }
+
+    if homeserver_denied_username {
+        state.add_error_on_field(RegisterFormField::Username, FieldError::Exists);
+    }
+
+    if !username.is_empty() && state.is_valid() {
+        match crate::postnumber::check(
+            http_client,
+            site_config.postnumber_validation.as_ref(),
+            username,
+        )
+        .await
+        {
+            Ok(Some(crate::postnumber::PostnumberOutcome::Allowed) | None) => {}
+            Ok(Some(crate::postnumber::PostnumberOutcome::Reserved)) => {
+                state.add_error_on_field(
+                    RegisterFormField::Username,
+                    FieldError::Policy {
+                        code: Some("postnumber-reserved"),
+                        message: "This username is reserved".to_owned(),
+                    },
+                );
+            }
+            Err(e) => {
+                tracing::error!(
+                    error = &e as &dyn std::error::Error,
+                    "postnumber resolver error"
+                );
+                state.add_error_on_form(FormError::Internal);
+            }
+        }
+    }
+
+    Ok(())
+}
+
+async fn render(
+    locale: mas_i18n::DataLocale,
+    mut ctx: RegisterContext,
+    action: OptionalPostAuthAction,
+    csrf_token: impl ToString,
+    repo: &mut BoxRepository,
+    templates: &Templates,
+) -> Result<String, InternalError> {
+    let post_action = action
+        .load_context(repo)
+        .await
+        .map_err(InternalError::from_anyhow)?;
+    if let Some(action) = post_action {
+        ctx = ctx.with_post_action(action);
+    }
+
+    Ok(templates.render_register(&ctx.with_csrf(csrf_token).with_language(locale))?)
+}
+
 #[tracing::instrument(name = "handlers.views.register.get", skip_all)]
 pub(crate) async fn get(
     mut rng: BoxRng,
@@ -78,18 +212,80 @@ pub(crate) async fn get(
         return Ok((cookie_jar, url_builder.redirect(&destination)).into_response());
     }
 
-    let mut ctx = RegisterContext::new(providers);
-    let post_action = query
-        .load_context(&mut repo)
-        .await
-        .map_err(InternalError::from_anyhow)?;
-    if let Some(action) = post_action {
-        ctx = ctx.with_post_action(action);
+    let content = render(
+        locale,
+        RegisterContext::new(providers),
+        query,
+        csrf_token.form_value(),
+        &mut repo,
+        &templates,
+    )
+    .await?;
+
+    Ok((cookie_jar, Html(content)).into_response())
+}
+
+#[tracing::instrument(name = "handlers.views.register.post", skip_all)]
+pub(crate) async fn post(
+    mut rng: BoxRng,
+    clock: BoxClock,
+    PreferredLanguage(locale): PreferredLanguage,
+    State(templates): State<Templates>,
+    State(url_builder): State<UrlBuilder>,
+    State(site_config): State<SiteConfig>,
+    State(homeserver): State<Arc<dyn HomeserverConnection>>,
+    State(http_client): State<reqwest::Client>,
+    mut policy: Policy,
+    mut repo: BoxRepository,
+    activity_tracker: BoundActivityTracker,
+    user_agent: Option<axum_extra::typed_header::TypedHeader<headers::UserAgent>>,
+    cookie_jar: CookieJar,
+    Form(form): Form<ProtectedForm<UsernameForm>>,
+) -> Result<Response, InternalError> {
+    let user_agent = user_agent.map(|ua| ua.as_str().to_owned());
+
+    let form = cookie_jar.verify_form(&clock, form)?;
+    let (csrf_token, cookie_jar) = cookie_jar.csrf_token(&clock, &mut rng);
+
+    if !site_config.password_registration_enabled {
+        return Ok(url_builder
+            .redirect(&mas_router::Login::from(form.action.post_auth_action))
+            .into_response());
     }
 
-    let ctx = ctx.with_csrf(csrf_token.form_value()).with_language(locale);
+    let providers = repo.upstream_oauth_provider().all_enabled().await?;
+    let mut state = form.to_form_state();
+    validate_registration_username(
+        &mut state,
+        &form.username,
+        user_agent,
+        activity_tracker.ip(),
+        &mut repo,
+        &mut policy,
+        &homeserver,
+        &http_client,
+        &site_config,
+    )
+    .await?;
 
-    let content = templates.render_register(&ctx)?;
+    if !state.is_valid() {
+        let content = render(
+            locale,
+            RegisterContext::new(providers).with_form_state(state),
+            form.action,
+            csrf_token.form_value(),
+            &mut repo,
+            &templates,
+        )
+        .await?;
 
-    Ok((cookie_jar, Html(content)).into_response())
+        return Ok((cookie_jar, Html(content)).into_response());
+    }
+
+    let mut destination = PasswordRegister::default().with_username(form.username);
+    if let Some(action) = form.action.post_auth_action {
+        destination = destination.and_then(action);
+    }
+
+    Ok((cookie_jar, url_builder.redirect(&destination)).into_response())
 }
diff --git a/crates/handlers/src/views/register/password.rs b/crates/handlers/src/views/register/password.rs
index 39643e972..696af7b4f 100644
--- a/crates/handlers/src/views/register/password.rs
+++ b/crates/handlers/src/views/register/password.rs
@@ -26,7 +26,7 @@ use mas_router::UrlBuilder;
 use mas_storage::{
     BoxRepository, RepositoryAccess,
     queue::{QueueJobRepositoryExt as _, SendEmailAuthenticationCodeJob},
-    user::{UserEmailRepository, UserRepository},
+    user::UserEmailRepository,
 };
 use mas_templates::{
     FieldError, FormError, FormState, PasswordRegisterContext, RegisterFormField, TemplateContext,
@@ -181,27 +181,18 @@ pub(crate) async fn post(
             state.add_error_on_form(FormError::Captcha);
         }
 
-        let mut homeserver_denied_username = false;
-        if form.username.is_empty() {
-            state.add_error_on_field(RegisterFormField::Username, FieldError::Required);
-        } else if repo.user().exists(&form.username).await? {
-            // The user already exists in the database
-            state.add_error_on_field(RegisterFormField::Username, FieldError::Exists);
-        } else if !homeserver
-            .is_localpart_available(&form.username)
-            .await
-            .map_err(InternalError::from_anyhow)?
-        {
-            // The user already exists on the homeserver
-            tracing::warn!(
-                username = &form.username,
-                "Homeserver denied username provided by user"
-            );
-
-            // We defer adding the error on the field, until we know whether we had another
-            // error from the policy, to avoid showing both
-            homeserver_denied_username = true;
-        }
+        super::validate_registration_username(
+            &mut state,
+            &form.username,
+            user_agent.clone(),
+            activity_tracker.ip(),
+            &mut repo,
+            &mut policy,
+            &homeserver,
+            &http_client,
+            &site_config,
+        )
+        .await?;
 
         if let Some(email) = &email {
             // Note that we don't check here if the email is already taken here, as
@@ -267,18 +258,7 @@ pub(crate) async fn post(
                         message: violation.msg,
                     },
                 ),
-                Some("username") => {
-                    // If the homeserver denied the username, but we also had an error on the policy
-                    // side, we don't want to show both, so we reset the state here
-                    homeserver_denied_username = false;
-                    state.add_error_on_field(
-                        RegisterFormField::Username,
-                        FieldError::Policy {
-                            code: violation.variant.map(|c| c.as_str()),
-                            message: violation.msg,
-                        },
-                    );
-                }
+                Some("username") => {}
                 Some("password") => state.add_error_on_field(
                     RegisterFormField::Password,
                     FieldError::Policy {
@@ -293,11 +273,6 @@ pub(crate) async fn post(
             }
         }
 
-        if homeserver_denied_username {
-            // XXX: we may want to return different errors like "this username is reserved"
-            state.add_error_on_field(RegisterFormField::Username, FieldError::Exists);
-        }
-
         if state.is_valid() {
             // Check the rate limit if we are about to process the form
             if let Err(e) = limiter.check_registration(requester) {
@@ -626,7 +601,7 @@ mod tests {
         cookies.save_cookies(&response);
         response.assert_status(StatusCode::OK);
         assert!(
-            response.body().contains("Username is too long"),
+            response.body().contains("PostNumber is too long"),
             "response body: {}",
             response.body()
         );
@@ -680,7 +655,7 @@ mod tests {
         let response = state.request(request).await;
         cookies.save_cookies(&response);
         response.assert_status(StatusCode::OK);
-        assert!(response.body().contains("This username is already taken"));
+        assert!(response.body().contains("This postNumber is already taken"));
     }
 
     /// When the username is already reserved on the homeserver, it should give
@@ -726,7 +701,7 @@ mod tests {
         let response = state.request(request).await;
         cookies.save_cookies(&response);
         response.assert_status(StatusCode::OK);
-        assert!(response.body().contains("This username is already taken"));
+        assert!(response.body().contains("This postNumber is already taken"));
     }
 
     /// Test registration without email when email is not required
diff --git a/crates/handlers/src/views/register/steps/finish.rs b/crates/handlers/src/views/register/steps/finish.rs
index af0b8ef9f..f10121a22 100644
--- a/crates/handlers/src/views/register/steps/finish.rs
+++ b/crates/handlers/src/views/register/steps/finish.rs
@@ -51,6 +51,7 @@ pub(crate) async fn get(
     user_agent: Option<TypedHeader<headers::UserAgent>>,
     State(url_builder): State<UrlBuilder>,
     State(homeserver): State<Arc<dyn HomeserverConnection>>,
+    State(http_client): State<reqwest::Client>,
     State(templates): State<Templates>,
     State(site_config): State<SiteConfig>,
     PreferredLanguage(lang): PreferredLanguage,
@@ -120,6 +121,34 @@ pub(crate) async fn get(
         )));
     }
 
+    // Re-check postnumber reservation to close the TOCTOU window between
+    // the initial form check and this final commit step.
+    match crate::postnumber::check(
+        &http_client,
+        site_config.postnumber_validation.as_ref(),
+        &registration.username,
+    )
+    .await
+    {
+        Ok(Some(crate::postnumber::PostnumberOutcome::Allowed) | None) => {
+            // Valid or not configured – continue
+        }
+        Ok(Some(crate::postnumber::PostnumberOutcome::Reserved)) => {
+            return Err(InternalError::from_anyhow(anyhow::anyhow!(
+                "This PostNumber is reserved and cannot be used for registration"
+            )));
+        }
+        Err(e) => {
+            tracing::error!(
+                error = &e as &dyn std::error::Error,
+                "postnumber resolver error during registration finalization"
+            );
+            return Err(InternalError::from_anyhow(anyhow::anyhow!(
+                "Could not verify PostNumber availability"
+            )));
+        }
+    }
+
     // Check if the registration token is required and was provided
     let registration_token = if site_config.registration_token_required {
         if let Some(registration_token_id) = registration.user_registration_token_id {
diff --git a/crates/oidc-client/tests/it/main.rs b/crates/oidc-client/tests/it/main.rs
index cc8641085..f8f44a7fe 100644
--- a/crates/oidc-client/tests/it/main.rs
+++ b/crates/oidc-client/tests/it/main.rs
@@ -42,10 +42,17 @@ fn now() -> DateTime<Utc> {
     Utc::now()
 }
 
+fn test_http_client() -> reqwest::Client {
+    reqwest::Client::builder()
+        .no_proxy()
+        .build()
+        .expect("failed to create test HTTP client")
+}
+
 async fn init_test() -> (reqwest::Client, MockServer, Url) {
     let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
 
-    let client = mas_http::reqwest_client();
+    let client = test_http_client();
     let mock_server = MockServer::start().await;
     let issuer = Url::parse(&mock_server.uri()).expect("Couldn't parse URL");
 
diff --git a/crates/policy/src/lib.rs b/crates/policy/src/lib.rs
index a5d4805ad..3c20eaed0 100644
--- a/crates/policy/src/lib.rs
+++ b/crates/policy/src/lib.rs
@@ -30,7 +30,7 @@ pub enum LoadError {
     Read(#[from] tokio::io::Error),
 
     #[error("failed to create WASM engine")]
-    Engine(#[source] anyhow::Error),
+    Engine(#[source] opa_wasm::wasmtime::Error),
 
     #[error("module compilation task crashed")]
     CompilationTask(#[from] tokio::task::JoinError),
@@ -89,6 +89,7 @@ impl Entrypoints {
     }
 }
 
+/// Global static data that stays the same for the life of the [`PolicyFactory`]
 #[derive(Debug)]
 pub struct Data {
     base: BaseData,
@@ -198,6 +199,10 @@ fn merge_data_rec(
     Ok(())
 }
 
+/// Global dynamic data
+///
+/// Hint: there is an admin API to manage this, see
+/// `crates/handlers/src/admin/v1/policy_data/set.rs`
 struct DynamicData {
     version: Option<Ulid>,
     merged: serde_json::Value,
@@ -224,7 +229,6 @@ impl PolicyFactory {
         entrypoints: Entrypoints,
     ) -> Result<Self, LoadError> {
         let mut config = Config::default();
-        config.async_support(true);
         config.cranelift_opt_level(OptLevel::SpeedAndSize);
 
         let engine = Engine::new(&config).map_err(LoadError::Engine)?;
@@ -319,6 +323,7 @@ impl PolicyFactory {
         &self,
         data: &serde_json::Value,
     ) -> Result<Policy, InstantiateError> {
+        tracing::debug!("Instantiating policy with data={}", data);
         let mut store = Store::new(&self.engine, ());
         let runtime = Runtime::new(&mut store, &self.module)
             .await
diff --git a/crates/router/src/endpoints.rs b/crates/router/src/endpoints.rs
index 239f24b25..e4b8bda42 100644
--- a/crates/router/src/endpoints.rs
+++ b/crates/router/src/endpoints.rs
@@ -340,6 +340,12 @@ pub struct PasswordRegister {
 }
 
 impl PasswordRegister {
+    #[must_use]
+    pub fn with_username(mut self, username: impl Into<String>) -> Self {
+        self.username = Some(username.into());
+        self
+    }
+
     #[must_use]
     pub fn and_then(mut self, action: PostAuthAction) -> Self {
         self.post_auth_action = Some(action);
diff --git a/crates/templates/src/context.rs b/crates/templates/src/context.rs
index 25123970b..b433894c1 100644
--- a/crates/templates/src/context.rs
+++ b/crates/templates/src/context.rs
@@ -647,6 +647,7 @@ impl FormField for RegisterFormField {
 /// Context used by the `register.html` template
 #[derive(Serialize, Default)]
 pub struct RegisterContext {
+    form: FormState<RegisterFormField>,
     providers: Vec<UpstreamOAuthProvider>,
     next: Option<PostAuthContext>,
 }
@@ -661,6 +662,7 @@ impl TemplateContext for RegisterContext {
         Self: Sized,
     {
         sample_list(vec![RegisterContext {
+            form: FormState::default(),
             providers: Vec::new(),
             next: None,
         }])
@@ -672,11 +674,18 @@ impl RegisterContext {
     #[must_use]
     pub fn new(providers: Vec<UpstreamOAuthProvider>) -> Self {
         Self {
+            form: FormState::default(),
             providers,
             next: None,
         }
     }
 
+    /// Add an error on the registration form
+    #[must_use]
+    pub fn with_form_state(self, form: FormState<RegisterFormField>) -> Self {
+        Self { form, ..self }
+    }
+
     /// Add a post authentication action to the context
     #[must_use]
     pub fn with_post_action(self, next: PostAuthContext) -> Self {
diff --git a/deny.toml b/deny.toml
index 47b0bb9ca..672a13e63 100644
--- a/deny.toml
+++ b/deny.toml
@@ -20,6 +20,9 @@ ignore = [
     # RSA key extraction "Marvin Attack". This is only relevant when using
     # PKCS#1 v1.5 encryption, which we don't
     "RUSTSEC-2023-0071",
+    # Rand 0.8.5 unsoundness with custom logger + thread_rng reseeding.
+    # Only triggers when the `log` feature is enabled, which we don't use.
+    "RUSTSEC-2026-0097",
 ]
 
 [licenses]
@@ -53,7 +56,10 @@ multiple-versions = "deny"
 
 skip = [
     { name = "itertools", version = "0.13.0" },      # zxcvbn depends on this old version
-    { name = "hashbrown", version = "0.14.5" },      # a few crates depend on this old version
+    # a few crates depend on old versions of hashbrown
+    { name = "hashbrown", version = "0.14.5" },
+    { name = "hashbrown", version = "0.15.5" },
+    { name = "hashbrown", version = "0.16.1" },
     # a few dependencies depend on the 1.x version of thiserror
     { name = "thiserror", version = "1.0.69" },
     { name = "thiserror-impl", version = "1.0.69" },
@@ -63,15 +69,19 @@ skip = [
     { name = "unicode-width", version = "0.1.14" },
     # cron depends on this old version
     # https://github.com/zslayton/cron/pull/137
-    { name = "winnow", version = "0.6.20" },
+    { name = "winnow", version = "0.6.26" },
     # hyper-util -> system-configuration depends on this old version
     { name = "core-foundation", version = "0.9.4" },
+    # wasmtime pulls in older versions of these
+    { name = "foldhash", version = "0.1.5" },
+    { name = "gimli", version = "0.32.3" },
+    { name = "object", version = "0.37.3" },
 
     # We are still mainly using rand 0.8
     { name = "rand", version = "0.8.5" },
     { name = "rand_chacha", version = "0.3.1" },
     { name = "rand_core", version = "0.6.4" },
-    { name = "getrandom", version = "0.2.15" },
+    { name = "getrandom", version = "0.2.16" },
 ]
 
 skip-tree = []
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 3c3cac3af..f5e191975 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -29,7 +29,6 @@ target "base" {
 
   platforms = [
     "linux/amd64",
-    "linux/arm64",
   ]
 }
 
diff --git a/docs/development/contributing.md b/docs/development/contributing.md
index 206602784..721aa948a 100644
--- a/docs/development/contributing.md
+++ b/docs/development/contributing.md
@@ -108,6 +108,34 @@ If you haven't already, install [Cargo-Nextest](https://nexte.st/docs/installati
   - `make PODMAN=1 test` (runs inside a container; needs Podman installed)
   - `make DOCKER=1 test` (runs inside a container; needs Docker installed)
 
+### Debug policies
+
+When in doubt, rebuild the policies (see the *Build and run MAS* section above). It's
+really easy to make a change to the policies and forget to rebuild them, which can lead
+to maddening debugging sessions.
+
+The policies get a combination of `data` and `input` when they're evaluated.
+
+ - `data`: App-global data. This is a combination of many things:
+    - Static fields defined in `mas_policy::Data`
+    - `mas_policy::DynamicData` is mixed in and is managed with the admin API.
+    - Arbitrary data can be added via configuration (`policy.data`) ([docs](../reference/configuration.md#policy))
+ - `input`: Information passed during evaluation that is derived from each request.
+    - Each policy has its own input schema defined by the types like `CompatLoginInput`, etc.
+
+To debug what the policy template sees, you can add a
+[`print(...)`](https://www.openpolicyagent.org/docs/cheatsheet#print) statement in the
+policy, which will print to the [server
+logs](https://github.com/matrix-org/rust-opa-wasm/blob/17cdd1570448da02f9d37bbe4e89ffad2ffc5e3f/src/policy.rs#L276)
+(FIXME: this currently doesn't work).
+
+Since the way `data` is assembled is a bit complex, you can use
+`RUST_LOG=info,mas_policy=debug` which will show the `tracing::debug!("Instantiating
+policy with data={}", data);` debug logs.
+
+For `input`, you can just log it more directly where you evaluate the policy.
+
+
 ## 8. Submit a pull request
 
 Once you've made changes, you're ready to submit a pull request.
diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md
index d2d65a0b4..a4ecc17b4 100644
--- a/docs/reference/configuration.md
+++ b/docs/reference/configuration.md
@@ -358,6 +358,25 @@ account:
   # When enabled, users must provide a valid registration token during password
   # registration. This has no effect if password registration is disabled.
   registration_token_required: false
+
+  # Optional external resolver for validating postnumbers (usernames) during
+  # registration. When configured, every self-service and upstream-OAuth
+  # registration will call this service. The Admin API also calls this,
+  # but allows explicitly claiming reserved postnumbers via the
+  # `claim_reserved_postnumber` flag.
+  #
+  # Omit this section entirely to disable postnumber validation.
+  #postnumber_validation:
+  #  # URL of the postnumber-resolver service (required)
+  #  endpoint: "http://localhost:3001/"
+  #
+  #  # Per-request timeout in seconds (default: 2)
+  #  timeout: 2
+  #
+  #  # What to do when the resolver is unreachable:
+  #  #   - "closed" (default): reject the registration
+  #  #   - "open": allow the registration to proceed
+  #  on_unavailable: closed
 ```
 
 ## `captcha`
diff --git a/frontend/index.html b/frontend/index.html
index cdbc8a69d..b18d81d0d 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -13,7 +13,7 @@ Please see LICENSE files in the repository root for full details.
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>matrix-authentication-service</title>
+    <title>letro-authentication-service</title>
     <script type="application/javascript">
       window.APP_CONFIG = JSON.parse(
         '{"root": "/account/", "graphqlEndpoint": "/graphql"}',
diff --git a/frontend/locales/cs.json b/frontend/locales/cs.json
index 443cf8ceb..cb3450ad3 100644
--- a/frontend/locales/cs.json
+++ b/frontend/locales/cs.json
@@ -126,7 +126,8 @@
       "heading": "E-mailová adresa {{email}} se již používá."
     },
     "end_session_button": {
-      "confirmation_modal_title": "Opravdu chcete ukončit tuto relaci?",
+      "confirmation_modal_body_text": "Ujistěte se, že máte vždy přístup k jinému ověřenému zařízení nebo klíči pro obnovení, abyste předešli ztrátě šifrované historie chatu.",
+      "confirmation_modal_title": "Opravdu chcete toto zařízení odstranit?",
       "text": "Odstranit zařízení"
     },
     "error": {
diff --git a/frontend/locales/da.json b/frontend/locales/da.json
index 0529125ff..93c7a0d68 100644
--- a/frontend/locales/da.json
+++ b/frontend/locales/da.json
@@ -125,6 +125,7 @@
       "heading": "E-mailadressen {{email}} er allerede i brug."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Er du sikker på, at du vil afslutte denne session?",
       "text": "Fjern enhed"
     },
@@ -391,7 +392,7 @@
     "scope": {
       "edit_profile": "Rediger din profil og dine kontaktoplysninger",
       "manage_sessions": "Administrer dine enheder og sessioner",
-      "mas_admin": "Administrer enhver bruger på matrix-authentication-service",
+      "mas_admin": "Administrer enhver bruger på letro-authentication-service",
       "send_messages": "Send nye beskeder på dine vegne",
       "synapse_admin": "Administrer Synapse hjemmeserveren",
       "view_messages": "Se dine eksisterende beskeder og data",
diff --git a/frontend/locales/de.json b/frontend/locales/de.json
index 7a78e7c1b..bbd8d4d49 100644
--- a/frontend/locales/de.json
+++ b/frontend/locales/de.json
@@ -125,6 +125,7 @@
       "heading": "Die E-Mail-Adresse {{email}} wird bereits verwendet."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Möchtest du diese Sitzung wirklich beenden?",
       "text": "Gerät entfernen"
     },
diff --git a/frontend/locales/et.json b/frontend/locales/et.json
index e9f90b09a..07e5dd293 100644
--- a/frontend/locales/et.json
+++ b/frontend/locales/et.json
@@ -125,6 +125,7 @@
       "heading": "E-posti aadress {{email}} on juba kasutusel."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Kas sa oled kindel, et soovid selle sessiooni lõpetada?",
       "text": "Eemalda seade"
     },
diff --git a/frontend/locales/fi.json b/frontend/locales/fi.json
index d310668c0..4283fd13f 100644
--- a/frontend/locales/fi.json
+++ b/frontend/locales/fi.json
@@ -125,7 +125,8 @@
       "heading": "Sähköpostiosoite {{email}} on jo käytössä."
     },
     "end_session_button": {
-      "confirmation_modal_title": "Haluatko varmasti lopettaa tämän istunnon?",
+      "confirmation_modal_body_text": "Varmista, että sinulla on toinen vahvistettu laite tai palautusavaimesi käytettävissä, jotta et menetä salattua keskusteluhistoriaasi.",
+      "confirmation_modal_title": "Haluatko varmasti poistaa tämän laitteen?",
       "text": "Poista laite"
     },
     "error": {
@@ -257,10 +258,10 @@
       "button": "Nollaa identiteetti",
       "cancelled": {
         "description_1": "Voit sulkea tämän ikkunan ja palata sovellukseen jatkaaksesi.",
-        "description_2": "Jos olet kirjautunut ulos kaikkialta etkä muista palautuskoodiasi, sinun on silti nollattava identiteettisi.",
-        "heading": "Identiteetin nollaus peruutettu."
+        "description_2": "Jos sinulla ei ole muita vahvistettuja laitteita eikä palautuskoodiasi käytettävissä, sinun on nollattava digitaalinen identiteettisi, jotta voit jatkaa sovelluksen käyttöä.",
+        "heading": "Digitaalisen identiteetin nollaus peruutettu."
       },
-      "description": "Jos et ole kirjautunut muihin laitteisiin ja olet kadottanut palautusavaimesi, sinun on nollattava identiteettisi, jotta voit jatkaa sovelluksen käyttöä.",
+      "description": "Jos sinulla ei ole muita vahvistettuja laitteita eikä palautuskoodiasi käytettävissä, sinun on nollattava digitaalinen identiteettisi, jotta voit jatkaa sovelluksen käyttöä.",
       "effect_list": {
         "negative_1": "Menetät nykyisen viestihistoriasi",
         "negative_2": "Sinun on vahvistettava kaikki olemassa olevat laitteesi ja yhteystietosi uudelleen",
@@ -270,18 +271,18 @@
       },
       "failure": {
         "description": "Tämä saattaa olla väliaikainen ongelma, joten yritä myöhemmin uudelleen. Jos ongelma jatkuu, ota yhteyttä palvelimen ylläpitäjään.",
-        "heading": "Kryptografisen identiteetin nollauksen salliminen epäonnistui",
-        "title": "Kryptografisen identiteetin nollauksen salliminen epäonnistui"
+        "heading": "Digitaalisen identiteetin nollauksen salliminen epäonnistui",
+        "title": "Digitaalisen identiteetin nollauksen salliminen epäonnistui"
       },
       "finish_reset": "Viimeistele nollaus",
-      "heading": "Nollaa identiteettisi, jos et voi vahvistaa muulla tavalla",
+      "heading": "Nollaa digitaalinen identiteettisi, jos et voi vahvistaa muulla tavalla",
       "start_reset": "Aloita nollaus",
       "success": {
-        "description": "Identiteetin nollaus on hyväksytty seuraavaksi {{minutes}} minuutiksi. Voit sulkea tämän ikkunan ja palata sovellukseen jatkaaksesi.",
-        "heading": "Identiteetin nollaus onnistui. Palaa takaisin sovellukseen viimeistelläksesi prosessin.",
-        "title": "Kryptografisen identiteetin nollaus tilapäisesti sallittu"
+        "description": "Digitaalisen identiteetin nollaus on hyväksytty seuraavaksi {{minutes}} minuutiksi. Voit sulkea tämän ikkunan ja palata sovellukseen jatkaaksesi.",
+        "heading": "Digitaalisen identiteetin nollaus onnistui. Palaa takaisin sovellukseen viimeistelläksesi prosessin.",
+        "title": "Digitaalisen identiteetin nollaus tilapäisesti sallittu"
       },
-      "warning": "Nollaa identiteettisi vain, jos et voi käyttää toista laitetta, johon olet kirjautunut, ja olet kadottanut palautusavaimesi."
+      "warning": "Nollaa digitaalinen identiteettisi vain, jos sinulla ei ole toista vahvistettua laitetta tai palautusavaintasi käytettävissä."
     },
     "selectable_session": {
       "label": "Valitse istunto"
diff --git a/frontend/locales/fr.json b/frontend/locales/fr.json
index d9219d9f9..9f2ddfeb3 100644
--- a/frontend/locales/fr.json
+++ b/frontend/locales/fr.json
@@ -125,6 +125,7 @@
       "heading": "L’adresse e-mail {{email}} est déjà utilisée."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Êtes-vous sûr de vouloir terminer cette session ?",
       "text": "Supprimer l’appareil"
     },
diff --git a/frontend/locales/hu.json b/frontend/locales/hu.json
index 888002d91..73949f28d 100644
--- a/frontend/locales/hu.json
+++ b/frontend/locales/hu.json
@@ -125,7 +125,8 @@
       "heading": "A(z) {{email}} e-mail-cím már használatban van."
     },
     "end_session_button": {
-      "confirmation_modal_title": "Biztos, hogy befejezi a munkamenetet?",
+      "confirmation_modal_body_text": "Győződjön meg róla, hogy mindig hozzáfér egy másik ellenőrzött eszközhöz vagy a helyreállítási kulcsához, hogy elkerülje a titkosított csevegési előzmények elvesztését.",
+      "confirmation_modal_title": "Biztos, hogy eltávolítja ezt az eszközt?",
       "text": "Eszköz eltávolítása"
     },
     "error": {
diff --git a/frontend/locales/nb-NO.json b/frontend/locales/nb-NO.json
index 3835e0faf..bac2b8450 100644
--- a/frontend/locales/nb-NO.json
+++ b/frontend/locales/nb-NO.json
@@ -125,6 +125,7 @@
       "heading": "E-postadressen {{email}} er allerede i bruk."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Er du sikker på at du vil avslutte denne sesjonen?",
       "text": "Fjern enheten"
     },
diff --git a/frontend/locales/nl.json b/frontend/locales/nl.json
index 33645eb71..fd0ee0d21 100644
--- a/frontend/locales/nl.json
+++ b/frontend/locales/nl.json
@@ -125,6 +125,7 @@
       "heading": "The email address {{email}} is already in use."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Weet u zeker dat u deze sessie wilt beëindigen?",
       "text": "Uitloggen"
     },
diff --git a/frontend/locales/pl.json b/frontend/locales/pl.json
index b2bfb0dcd..e82ebb474 100644
--- a/frontend/locales/pl.json
+++ b/frontend/locales/pl.json
@@ -126,6 +126,7 @@
       "heading": "Adres e-mail {{email}} jest już używany."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Czy na pewno chcesz zakończyć tę sesję?",
       "text": "Usuń urządzenie"
     },
diff --git a/frontend/locales/pt-BR.json b/frontend/locales/pt-BR.json
index bee110cae..97c920a64 100644
--- a/frontend/locales/pt-BR.json
+++ b/frontend/locales/pt-BR.json
@@ -125,7 +125,8 @@
       "heading": "The email address {{email}} is already in use."
     },
     "end_session_button": {
-      "confirmation_modal_title": "Are you sure you want to end this session?",
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
+      "confirmation_modal_title": "Are you sure you want to remove this device?",
       "text": "Remove device"
     },
     "error": {
diff --git a/frontend/locales/pt.json b/frontend/locales/pt.json
index 5503dd642..166788d81 100644
--- a/frontend/locales/pt.json
+++ b/frontend/locales/pt.json
@@ -125,6 +125,7 @@
       "heading": "O endereço de e-mail {{email}} já está a ser utilizado."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Tem a certeza de que quer terminar esta sessão?",
       "text": "Remover dispositivo"
     },
@@ -391,7 +392,7 @@
     "scope": {
       "edit_profile": "Editar o seu perfil e detalhes de contacto",
       "manage_sessions": "Gerir os seus dispositivos e sessões",
-      "mas_admin": "Administrar qualquer usuário no matrix-authentication-service",
+      "mas_admin": "Administrar qualquer usuário no letro-authentication-service",
       "send_messages": "Envie novas mensagens em seu nome",
       "synapse_admin": "Administrar o servidor Synapse",
       "view_messages": "Ver as mensagens e os dados existentes",
diff --git a/frontend/locales/ru.json b/frontend/locales/ru.json
index 914621be7..9b93dbc39 100644
--- a/frontend/locales/ru.json
+++ b/frontend/locales/ru.json
@@ -126,6 +126,7 @@
       "heading": "Адрес электронной почты {{email}} уже используется."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Вы уверены, что хотите завершить этот сеанс?",
       "text": "Удалить устройство"
     },
diff --git a/frontend/locales/sk.json b/frontend/locales/sk.json
index a43a7cf78..9289f1e82 100644
--- a/frontend/locales/sk.json
+++ b/frontend/locales/sk.json
@@ -125,7 +125,8 @@
       "heading": "The email address {{email}} is already in use."
     },
     "end_session_button": {
-      "confirmation_modal_title": "Are you sure you want to end this session?",
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
+      "confirmation_modal_title": "Are you sure you want to remove this device?",
       "text": "Remove device"
     },
     "error": {
diff --git a/frontend/locales/sv.json b/frontend/locales/sv.json
index f14d4e02d..d480fd28d 100644
--- a/frontend/locales/sv.json
+++ b/frontend/locales/sv.json
@@ -125,6 +125,7 @@
       "heading": "E-postadressen {{email}} är redan i bruk."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Är du säker på att du vill avsluta denna session?",
       "text": "Logga ut"
     },
@@ -391,7 +392,7 @@
     "scope": {
       "edit_profile": "Ändra din profil och kontaktuppgifter",
       "manage_sessions": "Hantera dina enheter och sessioner",
-      "mas_admin": "Administrera valfri användare på matrix-authentication-service",
+      "mas_admin": "Administrera valfri användare på letro-authentication-service",
       "send_messages": "Skicka nya meddelanden för din räkning",
       "synapse_admin": "Administrera Synapse-hemservern",
       "view_messages": "Visa dina befintliga meddelanden och data",
diff --git a/frontend/locales/uk.json b/frontend/locales/uk.json
index 9b8d60e7e..7473ab6d0 100644
--- a/frontend/locales/uk.json
+++ b/frontend/locales/uk.json
@@ -126,6 +126,7 @@
       "heading": "Адреса електронної пошти{{email}} вже використовується."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Ви впевнені, що хочете завершити цей сеанс?",
       "text": "Вилучити пристрій"
     },
diff --git a/frontend/locales/uz.json b/frontend/locales/uz.json
index 773b949d2..55ac122e8 100644
--- a/frontend/locales/uz.json
+++ b/frontend/locales/uz.json
@@ -125,6 +125,7 @@
       "heading": "The email address {{email}} is already in use."
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "Haqiqatan ham bu seansni tugatmoqchimisiz?",
       "text": "Qurilmani olib tashlash"
     },
diff --git a/frontend/locales/zh-Hans.json b/frontend/locales/zh-Hans.json
index 9335c994e..6d4f42828 100644
--- a/frontend/locales/zh-Hans.json
+++ b/frontend/locales/zh-Hans.json
@@ -124,6 +124,7 @@
       "heading": "此邮件地址 {{email}} 已被使用。"
     },
     "end_session_button": {
+      "confirmation_modal_body_text": "Make sure you always have access to another verified device or your recovery key to avoid losing your encrypted chat history.",
       "confirmation_modal_title": "你确定要结束这个会话吗？",
       "text": "移除设备"
     },
@@ -388,7 +389,7 @@
     "scope": {
       "edit_profile": "编辑个人资料和联系方式",
       "manage_sessions": "管理设备和会话",
-      "mas_admin": "管理 matrix-authentication-service 上的用户",
+      "mas_admin": "管理 letro-authentication-service 上的用户",
       "send_messages": "以你的名义发送新消息",
       "synapse_admin": "管理 Synapse 服务器",
       "view_messages": "查看现有信息和数据",
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index b1f66f73a..f39fea201 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -12,18 +12,18 @@
         "@fontsource/inter": "^5.2.8",
         "@radix-ui/react-collapsible": "^1.1.12",
         "@radix-ui/react-dialog": "^1.1.15",
-        "@tanstack/react-query": "^5.90.21",
-        "@tanstack/react-router": "^1.167.4",
+        "@tanstack/react-query": "^5.97.0",
+        "@tanstack/react-router": "^1.168.10",
         "@vector-im/compound-design-tokens": "6.10.1",
         "@vector-im/compound-web": "^8.3.5",
         "@zxcvbn-ts/core": "^3.0.4",
         "@zxcvbn-ts/language-common": "^3.0.4",
         "classnames": "^2.5.1",
         "date-fns": "^4.1.0",
-        "i18next": "^25.8.18",
+        "i18next": "^26.0.4",
         "react": "^19.2.4",
         "react-dom": "^19.2.4",
-        "react-i18next": "^16.5.8",
+        "react-i18next": "^17.0.2",
         "swagger-ui-dist": "^5.31.0",
         "valibot": "^1.2.0",
         "vaul": "^1.1.2"
@@ -36,11 +36,11 @@
         "@graphql-codegen/cli": "^6.2.1",
         "@graphql-codegen/client-preset": "^5.2.3",
         "@graphql-codegen/typescript-msw": "^4.0.0",
-        "@storybook/addon-docs": "^10.3.3",
-        "@storybook/react-vite": "^10.3.3",
-        "@tanstack/react-query-devtools": "^5.91.3",
-        "@tanstack/react-router-devtools": "^1.166.9",
-        "@tanstack/router-plugin": "^1.166.13",
+        "@storybook/addon-docs": "^10.3.5",
+        "@storybook/react-vite": "^10.3.5",
+        "@tanstack/react-query-devtools": "^5.97.0",
+        "@tanstack/react-router-devtools": "^1.166.11",
+        "@tanstack/router-plugin": "^1.167.12",
         "@testing-library/jest-dom": "^6.9.1",
         "@testing-library/react": "^16.3.1",
         "@testing-library/user-event": "^14.6.1",
@@ -49,12 +49,12 @@
         "@types/react-dom": "19.2.3",
         "@types/swagger-ui-dist": "^3.30.6",
         "@vitejs/plugin-react": "^6.0.1",
-        "@vitest/coverage-v8": "^4.1.1",
+        "@vitest/coverage-v8": "^4.1.3",
         "autoprefixer": "^10.4.23",
         "browserslist-to-esbuild": "^2.1.1",
         "graphql": "^16.12.0",
         "happy-dom": "^20.8.9",
-        "i18next-cli": "^1.50.3",
+        "i18next-cli": "^1.51.7",
         "knip": "^5.81.0",
         "msw": "^2.12.8",
         "msw-storybook-addon": "^2.0.6",
@@ -2493,6 +2493,26 @@
         }
       }
     },
+    "node_modules/@joshwooding/vite-plugin-react-docgen-typescript": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/@joshwooding/vite-plugin-react-docgen-typescript/-/vite-plugin-react-docgen-typescript-0.7.0.tgz",
+      "integrity": "sha512-qvsTEwEFefhdirGOPnu9Wp6ChfIwy2dBCRuETU3uE+4cC+PFoxMSiiEhxk4lOluA34eARHA0OxqsEUYDqRMgeQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "glob": "^13.0.1",
+        "react-docgen-typescript": "^2.2.2"
+      },
+      "peerDependencies": {
+        "typescript": ">= 4.3.x",
+        "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
@@ -4111,16 +4131,16 @@
       "license": "MIT"
     },
     "node_modules/@storybook/addon-docs": {
-      "version": "10.3.3",
-      "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.3.3.tgz",
-      "integrity": "sha512-trJQTpOtuOEuNv1Rn8X2Sopp5hSPpb0u0soEJ71BZAbxe4d2Y1d/1MYcxBdRKwncum6sCTsnxTpqQ/qvSJKlTQ==",
+      "version": "10.3.5",
+      "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.3.5.tgz",
+      "integrity": "sha512-WuHbxia/o5TX4Rg/IFD0641K5qId/Nk0dxhmAUNoFs5L0+yfZUwh65XOBbzXqrkYmYmcVID4v7cgDRmzstQNkA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@mdx-js/react": "^3.0.0",
-        "@storybook/csf-plugin": "10.3.3",
+        "@storybook/csf-plugin": "10.3.5",
         "@storybook/icons": "^2.0.1",
-        "@storybook/react-dom-shim": "10.3.3",
+        "@storybook/react-dom-shim": "10.3.5",
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "ts-dedent": "^2.0.0"
@@ -4130,17 +4150,17 @@
         "url": "https://opencollective.com/storybook"
       },
       "peerDependencies": {
-        "storybook": "^10.3.3"
+        "storybook": "^10.3.5"
       }
     },
     "node_modules/@storybook/builder-vite": {
-      "version": "10.3.3",
-      "resolved": "https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-10.3.3.tgz",
-      "integrity": "sha512-awspKCTZvXyeV3KabL0id62mFbxR5u/5yyGQultwCiSb2/yVgBfip2MAqLyS850pvTiB6QFVM9deOyd2/G/bEA==",
+      "version": "10.3.5",
+      "resolved": "https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-10.3.5.tgz",
+      "integrity": "sha512-i4KwCOKbhtlbQIbhm53+Kk7bMnxa0cwTn1pxmtA/x5wm1Qu7FrrBQV0V0DNjkUqzcSKo1CjspASJV/HlY0zYlw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@storybook/csf-plugin": "10.3.3",
+        "@storybook/csf-plugin": "10.3.5",
         "ts-dedent": "^2.0.0"
       },
       "funding": {
@@ -4148,14 +4168,14 @@
         "url": "https://opencollective.com/storybook"
       },
       "peerDependencies": {
-        "storybook": "^10.3.3",
+        "storybook": "^10.3.5",
         "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
       }
     },
     "node_modules/@storybook/csf-plugin": {
-      "version": "10.3.3",
-      "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.3.3.tgz",
-      "integrity": "sha512-Utlh7zubm+4iOzBBfzLW4F4vD99UBtl2Do4edlzK2F7krQIcFvR2ontjAE8S1FQVLZAC3WHalCOS+Ch8zf3knA==",
+      "version": "10.3.5",
+      "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.3.5.tgz",
+      "integrity": "sha512-qlEzNKxOjq86pvrbuMwiGD/bylnsXk1dg7ve0j77YFjEEchqtl7qTlrXvFdNaLA89GhW6D/EV6eOCu/eobPDgw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4168,7 +4188,7 @@
       "peerDependencies": {
         "esbuild": "*",
         "rollup": "*",
-        "storybook": "^10.3.3",
+        "storybook": "^10.3.5",
         "vite": "*",
         "webpack": "*"
       },
@@ -4206,14 +4226,14 @@
       }
     },
     "node_modules/@storybook/react": {
-      "version": "10.3.3",
-      "resolved": "https://registry.npmjs.org/@storybook/react/-/react-10.3.3.tgz",
-      "integrity": "sha512-cGG5TbR8Tdx9zwlpsWyBEfWrejm5iWdYF26EwIhwuKq9GFUTAVrQzo0Rs7Tqc3ZyVhRS/YfsRiWSEH+zmq2JiQ==",
+      "version": "10.3.5",
+      "resolved": "https://registry.npmjs.org/@storybook/react/-/react-10.3.5.tgz",
+      "integrity": "sha512-tpLTLaVGoA6fLK3ReyGzZUricq7lyPaV2hLPpj5wqdXLV/LpRtAHClUpNoPDYSBjlnSjL81hMZijbkGC3mA+gw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@storybook/global": "^5.0.0",
-        "@storybook/react-dom-shim": "10.3.3",
+        "@storybook/react-dom-shim": "10.3.5",
         "react-docgen": "^8.0.2",
         "react-docgen-typescript": "^2.2.2"
       },
@@ -4224,7 +4244,7 @@
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.3.3",
+        "storybook": "^10.3.5",
         "typescript": ">= 4.9.x"
       },
       "peerDependenciesMeta": {
@@ -4234,9 +4254,9 @@
       }
     },
     "node_modules/@storybook/react-dom-shim": {
-      "version": "10.3.3",
-      "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.3.3.tgz",
-      "integrity": "sha512-lkhuh4G3UTreU9M3Iz5Dt32c6U+l/4XuvqLtbe1sDHENZH6aPj7y0b5FwnfHyvuTvYRhtbo29xZrF5Bp9kCC0w==",
+      "version": "10.3.5",
+      "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.3.5.tgz",
+      "integrity": "sha512-Gw8R7XZm0zSUH0XAuxlQJhmizsLzyD6x00KOlP6l7oW9eQHXGfxg3seNDG3WrSAcW07iP1/P422kuiriQlOv7g==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -4246,20 +4266,20 @@
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.3.3"
+        "storybook": "^10.3.5"
       }
     },
     "node_modules/@storybook/react-vite": {
-      "version": "10.3.3",
-      "resolved": "https://registry.npmjs.org/@storybook/react-vite/-/react-vite-10.3.3.tgz",
-      "integrity": "sha512-qHdlBe1hjqFAGXa8JL7bWTLbP/gDqXbWDm+SYCB646NHh5yvVDkZLwigP5Y+UL7M2ASfqFtosnroUK9tcCM2dw==",
+      "version": "10.3.5",
+      "resolved": "https://registry.npmjs.org/@storybook/react-vite/-/react-vite-10.3.5.tgz",
+      "integrity": "sha512-UB5sJHeh26bfd8sNMx2YPGYRYmErIdTRaLOT28m4bykQIa1l9IgVktsYg/geW7KsJU0lXd3oTbnUjLD+enpi3w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@joshwooding/vite-plugin-react-docgen-typescript": "^0.6.4",
+        "@joshwooding/vite-plugin-react-docgen-typescript": "^0.7.0",
         "@rollup/pluginutils": "^5.0.2",
-        "@storybook/builder-vite": "10.3.3",
-        "@storybook/react": "10.3.3",
+        "@storybook/builder-vite": "10.3.5",
+        "@storybook/react": "10.3.5",
         "empathic": "^2.0.0",
         "magic-string": "^0.30.0",
         "react-docgen": "^8.0.0",
@@ -4273,40 +4293,20 @@
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.3.3",
+        "storybook": "^10.3.5",
         "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
       }
     },
-    "node_modules/@storybook/react-vite/node_modules/@joshwooding/vite-plugin-react-docgen-typescript": {
-      "version": "0.6.4",
-      "resolved": "https://registry.npmjs.org/@joshwooding/vite-plugin-react-docgen-typescript/-/vite-plugin-react-docgen-typescript-0.6.4.tgz",
-      "integrity": "sha512-6PyZBYKnnVNqOSB0YFly+62R7dmov8segT27A+RVTBVd4iAE6kbW9QBJGlyR2yG4D4ohzhZSTIu7BK1UTtmFFA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "glob": "^13.0.1",
-        "react-docgen-typescript": "^2.2.2"
-      },
-      "peerDependencies": {
-        "typescript": ">= 4.3.x",
-        "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@swc/core": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.18.tgz",
-      "integrity": "sha512-z87aF9GphWp//fnkRsqvtY+inMVPgYW3zSlXH1kJFvRT5H/wiAn+G32qW5l3oEk63KSF1x3Ov0BfHCObAmT8RA==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.24.tgz",
+      "integrity": "sha512-5Hj8aNasue7yusUt8LGCUe/AjM7RMAce8ZoyDyiFwx7Al+GbYKL+yE7g4sJk8vEr1dKIkTRARkNIJENc4CjkBQ==",
       "dev": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@swc/counter": "^0.1.3",
-        "@swc/types": "^0.1.25"
+        "@swc/types": "^0.1.26"
       },
       "engines": {
         "node": ">=10"
@@ -4316,16 +4316,18 @@
         "url": "https://opencollective.com/swc"
       },
       "optionalDependencies": {
-        "@swc/core-darwin-arm64": "1.15.18",
-        "@swc/core-darwin-x64": "1.15.18",
-        "@swc/core-linux-arm-gnueabihf": "1.15.18",
-        "@swc/core-linux-arm64-gnu": "1.15.18",
-        "@swc/core-linux-arm64-musl": "1.15.18",
-        "@swc/core-linux-x64-gnu": "1.15.18",
-        "@swc/core-linux-x64-musl": "1.15.18",
-        "@swc/core-win32-arm64-msvc": "1.15.18",
-        "@swc/core-win32-ia32-msvc": "1.15.18",
-        "@swc/core-win32-x64-msvc": "1.15.18"
+        "@swc/core-darwin-arm64": "1.15.24",
+        "@swc/core-darwin-x64": "1.15.24",
+        "@swc/core-linux-arm-gnueabihf": "1.15.24",
+        "@swc/core-linux-arm64-gnu": "1.15.24",
+        "@swc/core-linux-arm64-musl": "1.15.24",
+        "@swc/core-linux-ppc64-gnu": "1.15.24",
+        "@swc/core-linux-s390x-gnu": "1.15.24",
+        "@swc/core-linux-x64-gnu": "1.15.24",
+        "@swc/core-linux-x64-musl": "1.15.24",
+        "@swc/core-win32-arm64-msvc": "1.15.24",
+        "@swc/core-win32-ia32-msvc": "1.15.24",
+        "@swc/core-win32-x64-msvc": "1.15.24"
       },
       "peerDependencies": {
         "@swc/helpers": ">=0.5.17"
@@ -4337,9 +4339,9 @@
       }
     },
     "node_modules/@swc/core-darwin-arm64": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.18.tgz",
-      "integrity": "sha512-+mIv7uBuSaywN3C9LNuWaX1jJJ3SKfiJuE6Lr3bd+/1Iv8oMU7oLBjYMluX1UrEPzwN2qCdY6Io0yVicABoCwQ==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.24.tgz",
+      "integrity": "sha512-uM5ZGfFXjtvtJ+fe448PVBEbn/CSxS3UAyLj3O9xOqKIWy3S6hPTXSPbszxkSsGDYKi+YFhzAsR4r/eXLxEQ0g==",
       "cpu": [
         "arm64"
       ],
@@ -4354,9 +4356,9 @@
       }
     },
     "node_modules/@swc/core-darwin-x64": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.18.tgz",
-      "integrity": "sha512-wZle0eaQhnzxWX5V/2kEOI6Z9vl/lTFEC6V4EWcn+5pDjhemCpQv9e/TDJ0GIoiClX8EDWRvuZwh+Z3dhL1NAg==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.24.tgz",
+      "integrity": "sha512-fMIb/Zfn929pw25VMBhV7Ji2Dl+lCWtUPNdYJQYOke+00E5fcQ9ynxtP8+qhUo/HZc+mYQb1gJxwHM9vty+lXg==",
       "cpu": [
         "x64"
       ],
@@ -4371,9 +4373,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm-gnueabihf": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.18.tgz",
-      "integrity": "sha512-ao61HGXVqrJFHAcPtF4/DegmwEkVCo4HApnotLU8ognfmU8x589z7+tcf3hU+qBiU1WOXV5fQX6W9Nzs6hjxDw==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.24.tgz",
+      "integrity": "sha512-vOkjsyjjxnoYx3hMEWcGxQrMgnNrRm6WAegBXrN8foHtDAR+zpdhpGF5a4lj1bNPgXAvmysjui8cM1ov/Clkaw==",
       "cpu": [
         "arm"
       ],
@@ -4388,9 +4390,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm64-gnu": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.18.tgz",
-      "integrity": "sha512-3xnctOBLIq3kj8PxOCgPrGjBLP/kNOddr6f5gukYt/1IZxsITQaU9TDyjeX6jG+FiCIHjCuWuffsyQDL5Ew1bg==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.24.tgz",
+      "integrity": "sha512-h/oNu+upkXJ6Cicnq7YGVj9PkdfarLCdQa8l/FlHYvfv8CEiMaeeTnpLU7gSBH/rGxosM6Qkfa/J9mThGF9CLA==",
       "cpu": [
         "arm64"
       ],
@@ -4405,9 +4407,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm64-musl": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.18.tgz",
-      "integrity": "sha512-0a+Lix+FSSHBSBOA0XznCcHo5/1nA6oLLjcnocvzXeqtdjnPb+SvchItHI+lfeiuj1sClYPDvPMLSLyXFaiIKw==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.24.tgz",
+      "integrity": "sha512-ZpF/pRe1guk6sKzQI9D1jAORtjTdNlyeXn9GDz8ophof/w2WhojRblvSDJaGe7rJjcPN8AaOkhwdRUh7q8oYIg==",
       "cpu": [
         "arm64"
       ],
@@ -4421,10 +4423,44 @@
         "node": ">=10"
       }
     },
+    "node_modules/@swc/core-linux-ppc64-gnu": {
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.24.tgz",
+      "integrity": "sha512-QZEsZfisHTSJlmyChgDFNmKPb3W6Lhbfo/O76HhIngfEdnQNmukS38/VSe1feho+xkV5A5hETyCbx3sALBZKAQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-s390x-gnu": {
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.24.tgz",
+      "integrity": "sha512-DLdJKVsJgglqQrJBuoUYNmzm3leI7kUZhLbZGHv42onfKsGf6JDS3+bzCUQfte/XOqDjh/tmmn1DR/CF/tCJFw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/@swc/core-linux-x64-gnu": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.18.tgz",
-      "integrity": "sha512-wG9J8vReUlpaHz4KOD/5UE1AUgirimU4UFT9oZmupUDEofxJKYb1mTA/DrMj0s78bkBiNI+7Fo2EgPuvOJfuAA==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.24.tgz",
+      "integrity": "sha512-IpLYfposPA/XLxYOKpRfeccl1p5dDa3+okZDHHTchBkXEaVCnq5MADPmIWwIYj1tudt7hORsEHccG5no6IUQRw==",
       "cpu": [
         "x64"
       ],
@@ -4439,9 +4475,9 @@
       }
     },
     "node_modules/@swc/core-linux-x64-musl": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.18.tgz",
-      "integrity": "sha512-4nwbVvCphKzicwNWRmvD5iBaZj8JYsRGa4xOxJmOyHlMDpsvvJ2OR2cODlvWyGFH6BYL1MfIAK3qph3hp0Az6g==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.24.tgz",
+      "integrity": "sha512-JHy3fMSc0t/EPWgo74+OK5TGr51aElnzqfUPaiRf2qJ/BfX5CUCfMiWVBuhI7qmVMBnk1jTRnL/xZnOSHDPLYg==",
       "cpu": [
         "x64"
       ],
@@ -4456,9 +4492,9 @@
       }
     },
     "node_modules/@swc/core-win32-arm64-msvc": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.18.tgz",
-      "integrity": "sha512-zk0RYO+LjiBCat2RTMHzAWaMky0cra9loH4oRrLKLLNuL+jarxKLFDA8xTZWEkCPLjUTwlRN7d28eDLLMgtUcQ==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.24.tgz",
+      "integrity": "sha512-Txj+qUH1z2bUd1P3JvwByfjKFti3cptlAxhWgmunBUUxy/IW3CXLZ6l6Gk4liANadKkU71nIU1X30Z5vpMT3BA==",
       "cpu": [
         "arm64"
       ],
@@ -4473,9 +4509,9 @@
       }
     },
     "node_modules/@swc/core-win32-ia32-msvc": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.18.tgz",
-      "integrity": "sha512-yVuTrZ0RccD5+PEkpcLOBAuPbYBXS6rslENvIXfvJGXSdX5QGi1ehC4BjAMl5FkKLiam4kJECUI0l7Hq7T1vwg==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.24.tgz",
+      "integrity": "sha512-15D/nl3XwrhFpMv+MADFOiVwv3FvH9j8c6Rf8EXBT3Q5LoMh8YnDnSgPYqw1JzPnksvsBX6QPXLiPqmcR/Z4qQ==",
       "cpu": [
         "ia32"
       ],
@@ -4490,9 +4526,9 @@
       }
     },
     "node_modules/@swc/core-win32-x64-msvc": {
-      "version": "1.15.18",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.18.tgz",
-      "integrity": "sha512-7NRmE4hmUQNCbYU3Hn9Tz57mK9Qq4c97ZS+YlamlK6qG9Fb5g/BB3gPDe0iLlJkns/sYv2VWSkm8c3NmbEGjbg==",
+      "version": "1.15.24",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.24.tgz",
+      "integrity": "sha512-PR0PlTlPra2JbaDphrOAzm6s0v9rA0F17YzB+XbWD95B4g2cWcZY9LAeTa4xll70VLw9Jr7xBrlohqlQmelMFQ==",
       "cpu": [
         "x64"
       ],
@@ -4514,9 +4550,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/@swc/types": {
-      "version": "0.1.25",
-      "resolved": "https://registry.npmjs.org/@swc/types/-/types-0.1.25.tgz",
-      "integrity": "sha512-iAoY/qRhNH8a/hBvm3zKj9qQ4oc2+3w1unPJa2XvTK3XjeLXtzcCingVPw/9e5mn1+0yPqxcBGp9Jf0pkfMb1g==",
+      "version": "0.1.26",
+      "resolved": "https://registry.npmjs.org/@swc/types/-/types-0.1.26.tgz",
+      "integrity": "sha512-lyMwd7WGgG79RS7EERZV3T8wMdmPq3xwyg+1nmAM64kIhx5yl+juO2PYIHb7vTiPgPCj8LYjsNV2T5wiQHUEaw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -4537,9 +4573,9 @@
       }
     },
     "node_modules/@tanstack/query-core": {
-      "version": "5.90.20",
-      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.90.20.tgz",
-      "integrity": "sha512-OMD2HLpNouXEfZJWcKeVKUgQ5n+n3A2JFmBaScpNDUqSrQSjiveC7dKMe53uJUg1nDG16ttFPz2xfilz6i2uVg==",
+      "version": "5.97.0",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.97.0.tgz",
+      "integrity": "sha512-QdpLP5VzVMgo4VtaPppRA2W04UFjIqX+bxke/ZJhE5cfd5UPkRzqIAJQt9uXkQJjqE8LBOMbKv7f8HCsZltXlg==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -4547,9 +4583,9 @@
       }
     },
     "node_modules/@tanstack/query-devtools": {
-      "version": "5.93.0",
-      "resolved": "https://registry.npmjs.org/@tanstack/query-devtools/-/query-devtools-5.93.0.tgz",
-      "integrity": "sha512-+kpsx1NQnOFTZsw6HAFCW3HkKg0+2cepGtAWXjiiSOJJ1CtQpt72EE2nyZb+AjAbLRPoeRmPJ8MtQd8r8gsPdg==",
+      "version": "5.97.0",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-devtools/-/query-devtools-5.97.0.tgz",
+      "integrity": "sha512-ZMjAuYhQCKwKLKFMrD+HJDehHwWBVTGOuWBf4vEjR9unO+UGUjQ1mw2TuVbQKoLN/eRwB7qtlPsWBqobBoRBMQ==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -4558,12 +4594,12 @@
       }
     },
     "node_modules/@tanstack/react-query": {
-      "version": "5.90.21",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.90.21.tgz",
-      "integrity": "sha512-0Lu6y5t+tvlTJMTO7oh5NSpJfpg/5D41LlThfepTixPYkJ0sE2Jj0m0f6yYqujBwIXlId87e234+MxG3D3g7kg==",
+      "version": "5.97.0",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.97.0.tgz",
+      "integrity": "sha512-y4So4eGcQoK2WVMAcDNZE9ofB/p5v1OlKvtc1F3uqHwrtifobT7q+ZnXk2mRkc8E84HKYSlAE9z6HXl2V0+ySQ==",
       "license": "MIT",
       "dependencies": {
-        "@tanstack/query-core": "5.90.20"
+        "@tanstack/query-core": "5.97.0"
       },
       "funding": {
         "type": "github",
@@ -4574,35 +4610,33 @@
       }
     },
     "node_modules/@tanstack/react-query-devtools": {
-      "version": "5.91.3",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-query-devtools/-/react-query-devtools-5.91.3.tgz",
-      "integrity": "sha512-nlahjMtd/J1h7IzOOfqeyDh5LNfG0eULwlltPEonYy0QL+nqrBB+nyzJfULV+moL7sZyxc2sHdNJki+vLA9BSA==",
+      "version": "5.97.0",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query-devtools/-/react-query-devtools-5.97.0.tgz",
+      "integrity": "sha512-X4/VZKCbBIRj8cVD/oZCKTwwPmFXrY1VOfwUT5qI/+/JZYAUS+8vGNMqwBXbaAu1ZsVzzDzkT/wtBE/5OtQYGg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@tanstack/query-devtools": "5.93.0"
+        "@tanstack/query-devtools": "5.97.0"
       },
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/tannerlinsley"
       },
       "peerDependencies": {
-        "@tanstack/react-query": "^5.90.20",
+        "@tanstack/react-query": "^5.97.0",
         "react": "^18 || ^19"
       }
     },
     "node_modules/@tanstack/react-router": {
-      "version": "1.167.4",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-router/-/react-router-1.167.4.tgz",
-      "integrity": "sha512-VpbZh382zX3WF4+X2Z+EUyd8eJhJyjg9C6ByYwrVZiWbhgbMK4+zQQIG2+lCAlIlDi7SV8fDcGL09NA8Z2kpGQ==",
+      "version": "1.168.10",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-router/-/react-router-1.168.10.tgz",
+      "integrity": "sha512-/RmDlOwDkCug609KdPB3U+U1zmrtadJpvsmRg2zEn8TRCKRNri7dYZIjQZbNg8PgUiRL4T6njrZBV1ChzblNaA==",
       "license": "MIT",
       "dependencies": {
         "@tanstack/history": "1.161.6",
-        "@tanstack/react-store": "^0.9.1",
-        "@tanstack/router-core": "1.167.4",
-        "isbot": "^5.1.22",
-        "tiny-invariant": "^1.3.3",
-        "tiny-warning": "^1.0.3"
+        "@tanstack/react-store": "^0.9.3",
+        "@tanstack/router-core": "1.168.9",
+        "isbot": "^5.1.22"
       },
       "engines": {
         "node": ">=20.19"
@@ -4617,13 +4651,13 @@
       }
     },
     "node_modules/@tanstack/react-router-devtools": {
-      "version": "1.166.9",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-router-devtools/-/react-router-devtools-1.166.9.tgz",
-      "integrity": "sha512-O49eZmaeEKB5YnKH/qd61AbxV/lW8ICm4stfZ4GNQNpzQQ6rhPIB0p3PMZDIgX+6DoMivdNvLRmXAOOpzpIpDg==",
+      "version": "1.166.11",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-router-devtools/-/react-router-devtools-1.166.11.tgz",
+      "integrity": "sha512-WYR3q4Xui5yPT/5PXtQh8i03iUA7q8dONBjWpV3nsGdM8Cs1FxpfhLstW0wZO1dOvSyElscwTRCJ6nO5N8r3Lg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@tanstack/router-devtools-core": "1.166.9"
+        "@tanstack/router-devtools-core": "1.167.1"
       },
       "engines": {
         "node": ">=20.19"
@@ -4633,8 +4667,8 @@
         "url": "https://github.com/sponsors/tannerlinsley"
       },
       "peerDependencies": {
-        "@tanstack/react-router": "^1.167.2",
-        "@tanstack/router-core": "^1.167.2",
+        "@tanstack/react-router": "^1.168.2",
+        "@tanstack/router-core": "^1.168.2",
         "react": ">=18.0.0 || >=19.0.0",
         "react-dom": ">=18.0.0 || >=19.0.0"
       },
@@ -4645,12 +4679,12 @@
       }
     },
     "node_modules/@tanstack/react-store": {
-      "version": "0.9.2",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-store/-/react-store-0.9.2.tgz",
-      "integrity": "sha512-Vt5usJE5sHG/cMechQfmwvwne6ktGCELe89Lmvoxe3LKRoFrhPa8OCKWs0NliG8HTJElEIj7PLtaBQIcux5pAQ==",
+      "version": "0.9.3",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-store/-/react-store-0.9.3.tgz",
+      "integrity": "sha512-y2iHd/N9OkoQbFJLUX1T9vbc2O9tjH0pQRgTcx1/Nz4IlwLvkgpuglXUx+mXt0g5ZDFrEeDnONPqkbfxXJKwRg==",
       "license": "MIT",
       "dependencies": {
-        "@tanstack/store": "0.9.2",
+        "@tanstack/store": "0.9.3",
         "use-sync-external-store": "^1.6.0"
       },
       "funding": {
@@ -4663,18 +4697,15 @@
       }
     },
     "node_modules/@tanstack/router-core": {
-      "version": "1.167.4",
-      "resolved": "https://registry.npmjs.org/@tanstack/router-core/-/router-core-1.167.4.tgz",
-      "integrity": "sha512-Gk5V9Zr5JFJ4SbLyCheQLJ3MnXddccENPA+DJRz+9g3QxtN8DJB8w8KCUCgDeYlWp4LvmO4nX3fy3tupqVP2Pw==",
+      "version": "1.168.9",
+      "resolved": "https://registry.npmjs.org/@tanstack/router-core/-/router-core-1.168.9.tgz",
+      "integrity": "sha512-18oeEwEDyXOIuO1VBP9ACaK7tYHZUjynGDCoUh/5c/BNhia9vCJCp9O0LfhZXOorDc/PmLSgvmweFhVmIxF10g==",
       "license": "MIT",
       "dependencies": {
         "@tanstack/history": "1.161.6",
-        "@tanstack/store": "^0.9.1",
         "cookie-es": "^2.0.0",
         "seroval": "^1.4.2",
-        "seroval-plugins": "^1.4.2",
-        "tiny-invariant": "^1.3.3",
-        "tiny-warning": "^1.0.3"
+        "seroval-plugins": "^1.4.2"
       },
       "bin": {
         "intent": "bin/intent.js"
@@ -4688,15 +4719,14 @@
       }
     },
     "node_modules/@tanstack/router-devtools-core": {
-      "version": "1.166.9",
-      "resolved": "https://registry.npmjs.org/@tanstack/router-devtools-core/-/router-devtools-core-1.166.9.tgz",
-      "integrity": "sha512-PNlA7GmOUX9wY7LUG709Pk3Lg33dfHBztQwzjzrOiOsuf4ggp2R6bwarF8nYGNjG79z/MaB5PN+5yvkCVk8jGw==",
+      "version": "1.167.1",
+      "resolved": "https://registry.npmjs.org/@tanstack/router-devtools-core/-/router-devtools-core-1.167.1.tgz",
+      "integrity": "sha512-ECMM47J4KmifUvJguGituSiBpfN8SyCUEoxQks5RY09hpIBfR2eswCv2e6cJimjkKwBQXOVTPkTUk/yRvER+9w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "clsx": "^2.1.1",
-        "goober": "^2.1.16",
-        "tiny-invariant": "^1.3.3"
+        "goober": "^2.1.16"
       },
       "engines": {
         "node": ">=20.19"
@@ -4706,7 +4736,7 @@
         "url": "https://github.com/sponsors/tannerlinsley"
       },
       "peerDependencies": {
-        "@tanstack/router-core": "^1.167.2",
+        "@tanstack/router-core": "^1.168.2",
         "csstype": "^3.0.10"
       },
       "peerDependenciesMeta": {
@@ -4716,13 +4746,13 @@
       }
     },
     "node_modules/@tanstack/router-generator": {
-      "version": "1.166.12",
-      "resolved": "https://registry.npmjs.org/@tanstack/router-generator/-/router-generator-1.166.12.tgz",
-      "integrity": "sha512-2HdxSTbCkbU9JeYogKVigIlXoLtIJE1x5rbEov+ZLTPjGCO9kicNQuljqg9Js+u2/ahtWewNrE5u1QCAyxmpIg==",
+      "version": "1.166.24",
+      "resolved": "https://registry.npmjs.org/@tanstack/router-generator/-/router-generator-1.166.24.tgz",
+      "integrity": "sha512-vdaGKwuH+r+DPe6R1mjk+TDDmDH6NTG7QqwxHqGEvOH4aGf9sPjhmRKNJZqQr8cPIbfp6u5lXyZ1TeDcSNMVEA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@tanstack/router-core": "1.167.4",
+        "@tanstack/router-core": "1.168.9",
         "@tanstack/router-utils": "1.161.6",
         "@tanstack/virtual-file-routes": "1.161.7",
         "prettier": "^3.5.0",
@@ -4740,9 +4770,9 @@
       }
     },
     "node_modules/@tanstack/router-plugin": {
-      "version": "1.166.13",
-      "resolved": "https://registry.npmjs.org/@tanstack/router-plugin/-/router-plugin-1.166.13.tgz",
-      "integrity": "sha512-xG3ND3AlMe6DN9PihJAYUbQJevqJvVdzN1QpZbfU1/jkHurL97ynP2yXfmMTh8Qgi1K+SWRko4bi7iZlYP9SUw==",
+      "version": "1.167.12",
+      "resolved": "https://registry.npmjs.org/@tanstack/router-plugin/-/router-plugin-1.167.12.tgz",
+      "integrity": "sha512-StEHcctCuFI5taSjO+lhR/yQ+EK63BdyYa+ne6FoNQPB3MMrOUrz2ZVnbqILRLkh2b+p2EfBKt65sgAKdKygPQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4752,8 +4782,8 @@
         "@babel/template": "^7.27.2",
         "@babel/traverse": "^7.28.5",
         "@babel/types": "^7.28.5",
-        "@tanstack/router-core": "1.167.4",
-        "@tanstack/router-generator": "1.166.12",
+        "@tanstack/router-core": "1.168.9",
+        "@tanstack/router-generator": "1.166.24",
         "@tanstack/router-utils": "1.161.6",
         "@tanstack/virtual-file-routes": "1.161.7",
         "chokidar": "^3.6.0",
@@ -4772,7 +4802,7 @@
       },
       "peerDependencies": {
         "@rsbuild/core": ">=1.0.2",
-        "@tanstack/react-router": "^1.167.4",
+        "@tanstack/react-router": "^1.168.10",
         "vite": ">=5.0.0 || >=6.0.0 || >=7.0.0",
         "vite-plugin-solid": "^2.11.10",
         "webpack": ">=5.92.0"
@@ -4821,9 +4851,9 @@
       }
     },
     "node_modules/@tanstack/store": {
-      "version": "0.9.2",
-      "resolved": "https://registry.npmjs.org/@tanstack/store/-/store-0.9.2.tgz",
-      "integrity": "sha512-K013lUJEFJK2ofFQ/hZKJUmCnpcV00ebLyOyFOWQvyQHUOZp/iYO84BM6aOGiV81JzwbX0APTVmW8YI7yiG5oA==",
+      "version": "0.9.3",
+      "resolved": "https://registry.npmjs.org/@tanstack/store/-/store-0.9.3.tgz",
+      "integrity": "sha512-8reSzl/qGWGGVKhBoxXPMWzATSbZLZFWhwBAFO9NAyp0TxzfBP0mIrGb8CP8KrQTmvzXlR/vFPPUrHTLBGyFyw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -5182,14 +5212,14 @@
       }
     },
     "node_modules/@vitest/coverage-v8": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.1.tgz",
-      "integrity": "sha512-nZ4RWwGCoGOQRMmU/Q9wlUY540RVRxJZ9lxFsFfy0QV7Zmo5VVBhB6Sl9Xa0KIp2iIs3zWfPlo9LcY1iqbpzCw==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.3.tgz",
+      "integrity": "sha512-/MBdrkA8t6hbdCWFKs09dPik774xvs4Z6L4bycdCxYNLHM8oZuRyosumQMG19LUlBsB6GeVpL1q4kFFazvyKGA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@bcoe/v8-coverage": "^1.0.2",
-        "@vitest/utils": "4.1.1",
+        "@vitest/utils": "4.1.3",
         "ast-v8-to-istanbul": "^1.0.0",
         "istanbul-lib-coverage": "^3.2.2",
         "istanbul-lib-report": "^3.0.1",
@@ -5197,14 +5227,14 @@
         "magicast": "^0.5.2",
         "obug": "^2.1.1",
         "std-env": "^4.0.0-rc.1",
-        "tinyrainbow": "^3.0.3"
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "@vitest/browser": "4.1.1",
-        "vitest": "4.1.1"
+        "@vitest/browser": "4.1.3",
+        "vitest": "4.1.3"
       },
       "peerDependenciesMeta": {
         "@vitest/browser": {
@@ -5268,13 +5298,13 @@
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.1.tgz",
-      "integrity": "sha512-h3BOylsfsCLPeceuCPAAJ+BvNwSENgJa4hXoXu4im0bs9Lyp4URc4JYK4pWLZ4pG/UQn7AT92K6IByi6rE6g3A==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.3.tgz",
+      "integrity": "sha512-XN3TrycitDQSzGRnec/YWgoofkYRhouyVQj4YNsJ5r/STCUFqMrP4+oxEv3e7ZbLi4og5kIHrZwekDJgw6hcjw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.1.1",
+        "@vitest/spy": "4.1.3",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -5295,9 +5325,9 @@
       }
     },
     "node_modules/@vitest/mocker/node_modules/@vitest/spy": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.1.tgz",
-      "integrity": "sha512-6Ti/KT5OVaiupdIZEuZN7l3CZcR0cxnxt70Z0//3CtwgObwA6jZhmVBA3yrXSVN3gmwjgd7oDNLlsXz526gpRA==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.3.tgz",
+      "integrity": "sha512-ujj5Uwxagg4XUIfAUyRQxAg631BP6e9joRiN99mr48Bg9fRs+5mdUElhOoZ6rP5mBr8Bs3lmrREnkrQWkrsTCw==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -5315,26 +5345,26 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.1.tgz",
-      "integrity": "sha512-GM+TEQN5WhOygr1lp7skeVjdLPqqWMHsfzXrcHAqZJi/lIVh63H0kaRCY8MDhNWikx19zBUK8ceaLB7X5AH9NQ==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.3.tgz",
+      "integrity": "sha512-hYqqwuMbpkkBodpRh4k4cQSOELxXky1NfMmQvOfKvV8zQHz8x8Dla+2wzElkMkBvSAJX5TRGHJAQvK0TcOafwg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "tinyrainbow": "^3.0.3"
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.1.tgz",
-      "integrity": "sha512-f7+FPy75vN91QGWsITueq0gedwUZy1fLtHOCMeQpjs8jTekAHeKP80zfDEnhrleviLHzVSDXIWuCIOFn3D3f8A==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.3.tgz",
+      "integrity": "sha512-VwgOz5MmT0KhlUj40h02LWDpUBVpflZ/b7xZFA25F29AJzIrE+SMuwzFf0b7t4EXdwRNX61C3B6auIXQTR3ttA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.1.1",
+        "@vitest/utils": "4.1.3",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -5342,14 +5372,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.1.tgz",
-      "integrity": "sha512-kMVSgcegWV2FibXEx9p9WIKgje58lcTbXgnJixfcg15iK8nzCXhmalL0ZLtTWLW9PH1+1NEDShiFFedB3tEgWg==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.3.tgz",
+      "integrity": "sha512-9l+k/J9KG5wPJDX9BcFFzhhwNjwkRb8RsnYhaT1vPY7OufxmQFc9sZzScRCPTiETzl37mrIWVY9zxzmdVeJwDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.1",
-        "@vitest/utils": "4.1.1",
+        "@vitest/pretty-format": "4.1.3",
+        "@vitest/utils": "4.1.3",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -5371,20 +5401,27 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.1.tgz",
-      "integrity": "sha512-cNxAlaB3sHoCdL6pj6yyUXv9Gry1NHNg0kFTXdvSIZXLHsqKH7chiWOkwJ5s5+d/oMwcoG9T0bKU38JZWKusrQ==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.3.tgz",
+      "integrity": "sha512-Pc/Oexse/khOWsGB+w3q4yzA4te7W4gpZZAvk+fr8qXfTURZUMj5i7kuxsNK5mP/dEB6ao3jfr0rs17fHhbHdw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.1",
+        "@vitest/pretty-format": "4.1.3",
         "convert-source-map": "^2.0.0",
-        "tinyrainbow": "^3.0.3"
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       }
     },
+    "node_modules/@webcontainer/env": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@webcontainer/env/-/env-1.1.1.tgz",
+      "integrity": "sha512-6aN99yL695Hi9SuIk1oC88l9o0gmxL1nGWWQ/kNy81HigJ0FoaoTXpytCj6ItzgyCEwA9kF1wixsTuv5cjsgng==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@whatwg-node/disposablestack": {
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/@whatwg-node/disposablestack/-/disposablestack-0.0.6.tgz",
@@ -5717,6 +5754,16 @@
         "@babel/types": "^7.23.6"
       }
     },
+    "node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/baseline-browser-mapping": {
       "version": "2.9.8",
       "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.8.tgz",
@@ -5740,6 +5787,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/brace-expansion": {
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/braces": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
@@ -6502,9 +6562,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/diff": {
-      "version": "8.0.3",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.3.tgz",
-      "integrity": "sha512-qejHi7bcSD4hQAZE0tNAawRK1ZtafHDmMTMkrrIGgSLl7hTnQHmKCeB45xAcbfTqK2zowkM3j3bHt/4b/ARbYQ==",
+      "version": "8.0.4",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.4.tgz",
+      "integrity": "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -7304,29 +7364,29 @@
       }
     },
     "node_modules/i18next": {
-      "version": "25.8.18",
-      "resolved": "https://registry.npmjs.org/i18next/-/i18next-25.8.18.tgz",
-      "integrity": "sha512-lzY5X83BiL5AP77+9DydbrqkQHFN9hUzWGjqjLpPcp5ZOzuu1aSoKaU3xbBLSjWx9dAzW431y+d+aogxOZaKRA==",
+      "version": "26.0.4",
+      "resolved": "https://registry.npmjs.org/i18next/-/i18next-26.0.4.tgz",
+      "integrity": "sha512-gXF7U9bfioXPLv7mw8Qt2nfO7vij5MyINvPgVv99pX3fL1Y01pw2mKBFrlYpRxRCl2wz3ISenj6VsMJT2isfuA==",
       "funding": [
         {
           "type": "individual",
-          "url": "https://locize.com"
+          "url": "https://www.locize.com/i18next"
         },
         {
           "type": "individual",
-          "url": "https://locize.com/i18next.html"
+          "url": "https://www.i18next.com/how-to/faq#i18next-is-awesome.-how-can-i-support-the-project"
         },
         {
           "type": "individual",
-          "url": "https://www.i18next.com/how-to/faq#i18next-is-awesome.-how-can-i-support-the-project"
+          "url": "https://www.locize.com"
         }
       ],
       "license": "MIT",
       "dependencies": {
-        "@babel/runtime": "^7.28.6"
+        "@babel/runtime": "^7.29.2"
       },
       "peerDependencies": {
-        "typescript": "^5"
+        "typescript": "^5 || ^6"
       },
       "peerDependenciesMeta": {
         "typescript": {
@@ -7335,14 +7395,14 @@
       }
     },
     "node_modules/i18next-cli": {
-      "version": "1.50.3",
-      "resolved": "https://registry.npmjs.org/i18next-cli/-/i18next-cli-1.50.3.tgz",
-      "integrity": "sha512-sXyEydTInPfWDGzbGEpSTIrIe0vNl0aLd4qw6lqk+g21CNImZ9t+eTPSkDRRBReBUOdgGC+TS2myqxZmwCPYIA==",
+      "version": "1.51.7",
+      "resolved": "https://registry.npmjs.org/i18next-cli/-/i18next-cli-1.51.7.tgz",
+      "integrity": "sha512-Mf9cjzVqCTJLNFwRBYDzico1LydEbdFaYKmR8yoGegBeYhDPtMZrPYFtFnPHaUOnW91cyVB617QTzJL8v44goA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@croct/json5-parser": "^0.2.2",
-        "@swc/core": "^1.15.18",
+        "@swc/core": "^1.15.21",
         "chokidar": "^5.0.0",
         "commander": "^14.0.3",
         "execa": "^9.6.1",
@@ -7352,11 +7412,11 @@
         "jiti": "^2.6.1",
         "jsonc-parser": "^3.3.1",
         "magic-string": "^0.30.21",
-        "minimatch": "^10.2.4",
+        "minimatch": "^10.2.5",
         "ora": "^9.3.0",
         "react": "^19.2.4",
-        "react-i18next": "^16.5.8",
-        "yaml": "^2.8.2"
+        "react-i18next": "^17.0.2",
+        "yaml": "^2.8.3"
       },
       "bin": {
         "i18next-cli": "dist/esm/cli.js"
@@ -9080,13 +9140,13 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -9095,29 +9155,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/minimatch/node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/minimatch/node_modules/brace-expansion": {
-      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
-      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
     "node_modules/minimist": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -10097,19 +10134,19 @@
       }
     },
     "node_modules/react-i18next": {
-      "version": "16.5.8",
-      "resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-16.5.8.tgz",
-      "integrity": "sha512-2ABeHHlakxVY+LSirD+OiERxFL6+zip0PaHo979bgwzeHg27Sqc82xxXWIrSFmfWX0ZkrvXMHwhsi/NGUf5VQg==",
+      "version": "17.0.2",
+      "resolved": "https://registry.npmjs.org/react-i18next/-/react-i18next-17.0.2.tgz",
+      "integrity": "sha512-shBftH2vaTWK2Bsp7FiL+cevx3xFJlvFxmsDFQSrJc+6twHkP0tv/bGa01VVWzpreUVVwU+3Hev5iFqRg65RwA==",
       "license": "MIT",
       "dependencies": {
-        "@babel/runtime": "^7.28.4",
+        "@babel/runtime": "^7.29.2",
         "html-parse-stringify": "^3.0.1",
         "use-sync-external-store": "^1.6.0"
       },
       "peerDependencies": {
-        "i18next": ">= 25.6.2",
+        "i18next": ">= 26.0.1",
         "react": ">= 16.8.0",
-        "typescript": "^5"
+        "typescript": "^5 || ^6"
       },
       "peerDependenciesMeta": {
         "react-dom": {
@@ -10769,9 +10806,9 @@
       }
     },
     "node_modules/storybook": {
-      "version": "10.3.3",
-      "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.3.3.tgz",
-      "integrity": "sha512-tMoRAts9EVqf+mEMPLC6z1DPyHbcPe+CV1MhLN55IKsl0HxNjvVGK44rVPSePbltPE6vIsn4bdRj6CCUt8SJwQ==",
+      "version": "10.3.5",
+      "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.3.5.tgz",
+      "integrity": "sha512-uBSZu/GZa9aEIW3QMGvdQPMZWhGxSe4dyRWU8B3/Vd47Gy/XLC7tsBxRr13txmmPOEDHZR94uLuq0H50fvuqBw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10781,6 +10818,7 @@
         "@testing-library/user-event": "^14.6.1",
         "@vitest/expect": "3.2.4",
         "@vitest/spy": "3.2.4",
+        "@webcontainer/env": "^1.1.1",
         "esbuild": "^0.18.0 || ^0.19.0 || ^0.20.0 || ^0.21.0 || ^0.22.0 || ^0.23.0 || ^0.24.0 || ^0.25.0 || ^0.26.0 || ^0.27.0",
         "open": "^10.2.0",
         "recast": "^0.23.5",
@@ -11180,12 +11218,7 @@
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
       "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
-      "license": "MIT"
-    },
-    "node_modules/tiny-warning": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/tiny-warning/-/tiny-warning-1.0.3.tgz",
-      "integrity": "sha512-lBN9zLN/oAf68o3zNXYrdCt1kP8WsiGW8Oo2ka41b2IM5JL/S1CTyX1rW0mb/zSuJun0ZUrDxx4sqvYS2FWzPA==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/tinybench": {
@@ -11223,9 +11256,9 @@
       }
     },
     "node_modules/tinyrainbow": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.0.3.tgz",
-      "integrity": "sha512-PSkbLUoxOFRzJYjjxHJt9xro7D+iilgMX/C9lawzVuYiIdcihh9DXmVibBe8lmcFrRi/VzlPjBxbN7rH24q8/Q==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz",
+      "integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11711,19 +11744,19 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.1.tgz",
-      "integrity": "sha512-yF+o4POL41rpAzj5KVILUxm1GCjKnELvaqmU9TLLUbMfDzuN0UpUR9uaDs+mCtjPe+uYPksXDRLQGGPvj1cTmA==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.3.tgz",
+      "integrity": "sha512-DBc4Tx0MPNsqb9isoyOq00lHftVx/KIU44QOm2q59npZyLUkENn8TMFsuzuO+4U2FUa9rgbbPt3udrP25GcjXw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.1.1",
-        "@vitest/mocker": "4.1.1",
-        "@vitest/pretty-format": "4.1.1",
-        "@vitest/runner": "4.1.1",
-        "@vitest/snapshot": "4.1.1",
-        "@vitest/spy": "4.1.1",
-        "@vitest/utils": "4.1.1",
+        "@vitest/expect": "4.1.3",
+        "@vitest/mocker": "4.1.3",
+        "@vitest/pretty-format": "4.1.3",
+        "@vitest/runner": "4.1.3",
+        "@vitest/snapshot": "4.1.3",
+        "@vitest/spy": "4.1.3",
+        "@vitest/utils": "4.1.3",
         "es-module-lexer": "^2.0.0",
         "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
@@ -11734,7 +11767,7 @@
         "tinybench": "^2.9.0",
         "tinyexec": "^1.0.2",
         "tinyglobby": "^0.2.15",
-        "tinyrainbow": "^3.0.3",
+        "tinyrainbow": "^3.1.0",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
         "why-is-node-running": "^2.3.0"
       },
@@ -11751,10 +11784,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.1",
-        "@vitest/browser-preview": "4.1.1",
-        "@vitest/browser-webdriverio": "4.1.1",
-        "@vitest/ui": "4.1.1",
+        "@vitest/browser-playwright": "4.1.3",
+        "@vitest/browser-preview": "4.1.3",
+        "@vitest/browser-webdriverio": "4.1.3",
+        "@vitest/coverage-istanbul": "4.1.3",
+        "@vitest/coverage-v8": "4.1.3",
+        "@vitest/ui": "4.1.3",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
@@ -11778,6 +11813,12 @@
         "@vitest/browser-webdriverio": {
           "optional": true
         },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
         "@vitest/ui": {
           "optional": true
         },
@@ -11793,27 +11834,27 @@
       }
     },
     "node_modules/vitest/node_modules/@vitest/expect": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.1.tgz",
-      "integrity": "sha512-xAV0fqBTk44Rn6SjJReEQkHP3RrqbJo6JQ4zZ7/uVOiJZRarBtblzrOfFIZeYUrukp2YD6snZG6IBqhOoHTm+A==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.3.tgz",
+      "integrity": "sha512-CW8Q9KMtXDGHj0vCsqui0M5KqRsu0zm0GNDW7Gd3U7nZ2RFpPKSCpeCXoT+/+5zr1TNlsoQRDEz+LzZUyq6gnQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.1",
-        "@vitest/utils": "4.1.1",
+        "@vitest/spy": "4.1.3",
+        "@vitest/utils": "4.1.3",
         "chai": "^6.2.2",
-        "tinyrainbow": "^3.0.3"
+        "tinyrainbow": "^3.1.0"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       }
     },
     "node_modules/vitest/node_modules/@vitest/spy": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.1.tgz",
-      "integrity": "sha512-6Ti/KT5OVaiupdIZEuZN7l3CZcR0cxnxt70Z0//3CtwgObwA6jZhmVBA3yrXSVN3gmwjgd7oDNLlsXz526gpRA==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.3.tgz",
+      "integrity": "sha512-ujj5Uwxagg4XUIfAUyRQxAg631BP6e9joRiN99mr48Bg9fRs+5mdUElhOoZ6rP5mBr8Bs3lmrREnkrQWkrsTCw==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -12025,9 +12066,9 @@
       "license": "ISC"
     },
     "node_modules/yaml": {
-      "version": "2.8.2",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz",
-      "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
+      "version": "2.8.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
       "dev": true,
       "license": "ISC",
       "bin": {
diff --git a/frontend/package.json b/frontend/package.json
index 000375632..2c868ec56 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -22,18 +22,18 @@
     "@fontsource/inter": "^5.2.8",
     "@radix-ui/react-collapsible": "^1.1.12",
     "@radix-ui/react-dialog": "^1.1.15",
-    "@tanstack/react-query": "^5.90.21",
-    "@tanstack/react-router": "^1.167.4",
+    "@tanstack/react-query": "^5.97.0",
+    "@tanstack/react-router": "^1.168.10",
     "@vector-im/compound-design-tokens": "6.10.1",
     "@vector-im/compound-web": "^8.3.5",
     "@zxcvbn-ts/core": "^3.0.4",
     "@zxcvbn-ts/language-common": "^3.0.4",
     "classnames": "^2.5.1",
     "date-fns": "^4.1.0",
-    "i18next": "^25.8.18",
+    "i18next": "^26.0.4",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
-    "react-i18next": "^16.5.8",
+    "react-i18next": "^17.0.2",
     "swagger-ui-dist": "^5.31.0",
     "valibot": "^1.2.0",
     "vaul": "^1.1.2"
@@ -46,11 +46,11 @@
     "@graphql-codegen/cli": "^6.2.1",
     "@graphql-codegen/client-preset": "^5.2.3",
     "@graphql-codegen/typescript-msw": "^4.0.0",
-    "@storybook/addon-docs": "^10.3.3",
-    "@storybook/react-vite": "^10.3.3",
-    "@tanstack/react-query-devtools": "^5.91.3",
-    "@tanstack/react-router-devtools": "^1.166.9",
-    "@tanstack/router-plugin": "^1.166.13",
+    "@storybook/addon-docs": "^10.3.5",
+    "@storybook/react-vite": "^10.3.5",
+    "@tanstack/react-query-devtools": "^5.97.0",
+    "@tanstack/react-router-devtools": "^1.166.11",
+    "@tanstack/router-plugin": "^1.167.12",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",
     "@testing-library/user-event": "^14.6.1",
@@ -59,12 +59,12 @@
     "@types/react-dom": "19.2.3",
     "@types/swagger-ui-dist": "^3.30.6",
     "@vitejs/plugin-react": "^6.0.1",
-    "@vitest/coverage-v8": "^4.1.1",
+    "@vitest/coverage-v8": "^4.1.3",
     "autoprefixer": "^10.4.23",
     "browserslist-to-esbuild": "^2.1.1",
     "graphql": "^16.12.0",
     "happy-dom": "^20.8.9",
-    "i18next-cli": "^1.50.3",
+    "i18next-cli": "^1.51.7",
     "knip": "^5.81.0",
     "msw": "^2.12.8",
     "msw-storybook-addon": "^2.0.6",
diff --git a/frontend/src/components/PageHeading/PageHeading.module.css b/frontend/src/components/PageHeading/PageHeading.module.css
index 42e0b4774..75ce0bb18 100644
--- a/frontend/src/components/PageHeading/PageHeading.module.css
+++ b/frontend/src/components/PageHeading/PageHeading.module.css
@@ -48,6 +48,19 @@
     }
   }
 
+  & .brand-logo {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    align-self: center;
+    margin-block-end: var(--cpd-space-1x);
+
+    & svg {
+      display: block;
+      block-size: auto;
+    }
+  }
+
   & .header {
     display: flex;
     flex-direction: column;
@@ -78,5 +91,9 @@
 @media screen and (min-width: 768px) {
   .page-heading {
     margin-block-start: var(--cpd-space-8x);
+
+    & .brand-logo {
+      margin-block-end: var(--cpd-space-2x);
+    }
   }
 }
diff --git a/frontend/src/entrypoints/templates.css b/frontend/src/entrypoints/templates.css
index 4afbc729f..50a23ebd4 100644
--- a/frontend/src/entrypoints/templates.css
+++ b/frontend/src/entrypoints/templates.css
@@ -17,6 +17,7 @@
 @import "../components/Layout/Layout.module.css";
 @import "../components/Footer/Footer.module.css";
 @import "../components/PageHeading/PageHeading.module.css";
+@import "../styles/brand-theme.css";
 
 .cpd-text-body-lg-regular {
   font: var(--cpd-font-body-lg-regular);
diff --git a/frontend/src/entrypoints/templates.ts b/frontend/src/entrypoints/templates.ts
index 77587ee58..4fb18ac37 100644
--- a/frontend/src/entrypoints/templates.ts
+++ b/frontend/src/entrypoints/templates.ts
@@ -10,7 +10,7 @@
 // Ideally later on we could find a way to hydrate full React components instead
 // of doing this, as this can very quickly get out of hands.
 
-const VALID_USERNAME_RE = /^\s*([a-z0-9.=_/+-]+|@[a-z0-9.=_/+-]+(:.*)?)\s*$/g;
+const VALID_USERNAME_RE = /^\s*([a-z0-9]+|@[a-z0-9]+(:.*)?)\s*$/g;
 
 /** Grab the nearest error message inserted by the templates by error kind and code */
 function grabErrorMessage(
@@ -96,3 +96,26 @@ for (const element of document.querySelectorAll<HTMLInputElement>(
 )) {
   patchUsernameInput(element);
 }
+
+function patchDisableSubmitUntilValid(formElement: HTMLFormElement) {
+  const submitButton = formElement.querySelector<HTMLButtonElement>(
+    '.cpd-button[data-kind="primary"][type="submit"]',
+  );
+
+  if (!submitButton) return;
+
+  const syncDisabledState = () => {
+    submitButton.disabled = !formElement.checkValidity();
+  };
+
+  syncDisabledState();
+
+  formElement.addEventListener("input", syncDisabledState);
+  formElement.addEventListener("change", syncDisabledState);
+}
+
+for (const formElement of document.querySelectorAll<HTMLFormElement>(
+  "form[data-disable-submit-until-valid]",
+)) {
+  patchDisableSubmitUntilValid(formElement);
+}
diff --git a/frontend/src/routeTree.gen.ts b/frontend/src/routeTree.gen.ts
index bd0bdbc7f..4338a8008 100644
--- a/frontend/src/routeTree.gen.ts
+++ b/frontend/src/routeTree.gen.ts
@@ -117,22 +117,22 @@ const AccountSessionsBrowsersRoute = AccountSessionsBrowsersRouteImport.update({
 } as any)
 
 export interface FileRoutesByFullPath {
-  '/': typeof AccountIndexRoute
   '/reset-cross-signing': typeof ResetCrossSigningRouteWithChildren
   '/clients/$id': typeof ClientsIdRoute
   '/devices/$': typeof DevicesSplatRoute
   '/reset-cross-signing/cancelled': typeof ResetCrossSigningCancelledRoute
   '/reset-cross-signing/success': typeof ResetCrossSigningSuccessRoute
   '/sessions/$id': typeof SessionsIdRoute
+  '/': typeof AccountIndexRoute
   '/reset-cross-signing/': typeof ResetCrossSigningIndexRoute
   '/sessions/browsers': typeof AccountSessionsBrowsersRoute
   '/emails/$id/in-use': typeof EmailsIdInUseRoute
   '/emails/$id/verify': typeof EmailsIdVerifyRoute
   '/password/change/success': typeof PasswordChangeSuccessRoute
-  '/plan/': typeof AccountPlanIndexRoute
-  '/sessions/': typeof AccountSessionsIndexRoute
-  '/password/change/': typeof PasswordChangeIndexRoute
-  '/password/recovery/': typeof PasswordRecoveryIndexRoute
+  '/plan': typeof AccountPlanIndexRoute
+  '/sessions': typeof AccountSessionsIndexRoute
+  '/password/change': typeof PasswordChangeIndexRoute
+  '/password/recovery': typeof PasswordRecoveryIndexRoute
 }
 export interface FileRoutesByTo {
   '/clients/$id': typeof ClientsIdRoute
@@ -174,22 +174,22 @@ export interface FileRoutesById {
 export interface FileRouteTypes {
   fileRoutesByFullPath: FileRoutesByFullPath
   fullPaths:
-    | '/'
     | '/reset-cross-signing'
     | '/clients/$id'
     | '/devices/$'
     | '/reset-cross-signing/cancelled'
     | '/reset-cross-signing/success'
     | '/sessions/$id'
+    | '/'
     | '/reset-cross-signing/'
     | '/sessions/browsers'
     | '/emails/$id/in-use'
     | '/emails/$id/verify'
     | '/password/change/success'
-    | '/plan/'
-    | '/sessions/'
-    | '/password/change/'
-    | '/password/recovery/'
+    | '/plan'
+    | '/sessions'
+    | '/password/change'
+    | '/password/recovery'
   fileRoutesByTo: FileRoutesByTo
   to:
     | '/clients/$id'
@@ -253,7 +253,7 @@ declare module '@tanstack/react-router' {
     '/_account': {
       id: '/_account'
       path: ''
-      fullPath: '/'
+      fullPath: ''
       preLoaderRoute: typeof AccountRouteImport
       parentRoute: typeof rootRouteImport
     }
@@ -309,28 +309,28 @@ declare module '@tanstack/react-router' {
     '/password/recovery/': {
       id: '/password/recovery/'
       path: '/password/recovery'
-      fullPath: '/password/recovery/'
+      fullPath: '/password/recovery'
       preLoaderRoute: typeof PasswordRecoveryIndexRouteImport
       parentRoute: typeof rootRouteImport
     }
     '/password/change/': {
       id: '/password/change/'
       path: '/password/change'
-      fullPath: '/password/change/'
+      fullPath: '/password/change'
       preLoaderRoute: typeof PasswordChangeIndexRouteImport
       parentRoute: typeof rootRouteImport
     }
     '/_account/sessions/': {
       id: '/_account/sessions/'
       path: '/sessions'
-      fullPath: '/sessions/'
+      fullPath: '/sessions'
       preLoaderRoute: typeof AccountSessionsIndexRouteImport
       parentRoute: typeof AccountRoute
     }
     '/_account/plan/': {
       id: '/_account/plan/'
       path: '/plan'
-      fullPath: '/plan/'
+      fullPath: '/plan'
       preLoaderRoute: typeof AccountPlanIndexRouteImport
       parentRoute: typeof AccountRoute
     }
diff --git a/frontend/src/styles/brand-theme.css b/frontend/src/styles/brand-theme.css
new file mode 100644
index 000000000..0c085ad28
--- /dev/null
+++ b/frontend/src/styles/brand-theme.css
@@ -0,0 +1,107 @@
+/* Copyright 2026 New Vector Ltd.
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+ * Please see LICENSE files in the repository root for full details.
+ */
+
+:root {
+  --brand-color-accent: #d51c0b;
+  --brand-input-background: #f4f4f4;
+  --brand-input-background-autofill: #eef3fa;
+  --brand-link-muted: #696b7799;
+  --brand-link-muted-hover: #55565e;
+  --brand-link-muted-active: #292a2d;
+  --brand-primary-gradient: linear-gradient(
+    45deg,
+    #c20000 6.43%,
+    #c30300 19.99%,
+    #c60e00 32.57%,
+    #cb2000 45.16%,
+    #d33900 56.78%,
+    #dd5a00 67.43%,
+    #e98200 79.04%,
+    #f7b000 89.69%,
+    #ffc800 94.53%
+  );
+}
+
+.cpd-text-control {
+  background: var(--brand-input-background);
+  border-color: transparent;
+}
+
+.cpd-text-control:-webkit-autofill,
+.cpd-text-control:-webkit-autofill:hover,
+.cpd-text-control:-webkit-autofill:focus,
+.cpd-text-control:-webkit-autofill:active {
+  -webkit-text-fill-color: var(--cpd-color-text-primary);
+  -webkit-box-shadow: 0 0 0 1000px var(--brand-input-background-autofill) inset;
+  box-shadow: 0 0 0 1000px var(--brand-input-background-autofill) inset;
+  background-color: var(--brand-input-background-autofill);
+  border-color: transparent;
+  transition: background-color 99999s ease-out 0s;
+}
+
+.cpd-text-control:-webkit-autofill:not(:hover):not(:focus):not(:active) {
+  border-color: transparent;
+}
+
+@media (hover) {
+  .cpd-text-control:hover {
+    border-color: var(--brand-color-accent);
+  }
+}
+
+.cpd-text-control:active {
+  border-color: var(--brand-color-accent);
+}
+
+.cpd-text-control:focus,
+.cpd-text-control:focus-visible {
+  outline: 2px solid color-mix(in srgb, var(--brand-color-accent) 20%, white);
+  outline-offset: 0;
+  border-color: var(--brand-color-accent);
+}
+
+.cpd-button[data-kind="primary"]:not(.destructive) {
+  background: var(--brand-primary-gradient);
+  border-width: 0;
+}
+
+@media (hover) {
+  .cpd-button[data-kind="primary"]:not(.destructive):hover {
+    filter: brightness(1.03);
+  }
+}
+
+.cpd-button[data-kind="primary"]:not(.destructive):active,
+.cpd-button[data-kind="primary"]:not(.destructive)[aria-expanded="true"] {
+  filter: brightness(0.96);
+}
+
+.cpd-button[data-kind="primary"]:not(.destructive)[disabled] {
+  filter: none;
+}
+
+.login-page .cpd-link[data-kind="primary"] {
+  color: var(--brand-link-muted);
+}
+
+@media (hover) {
+  .login-page .cpd-link[data-kind="primary"]:hover {
+    color: var(--brand-link-muted-hover);
+    background: transparent;
+  }
+}
+
+.login-page .cpd-link[data-kind="primary"]:active {
+  color: var(--brand-link-muted-active);
+  background: transparent;
+}
+
+[data-disable-submit-until-valid]
+  .cpd-button[type="submit"][data-kind="primary"][disabled] {
+  cursor: not-allowed;
+  filter: grayscale(0.2);
+  opacity: 0.55;
+}
diff --git a/mocks/mock-google-oidc/.gitignore b/mocks/mock-google-oidc/.gitignore
new file mode 100644
index 000000000..504afef81
--- /dev/null
+++ b/mocks/mock-google-oidc/.gitignore
@@ -0,0 +1,2 @@
+node_modules/
+package-lock.json
diff --git a/mocks/mock-google-oidc/README.md b/mocks/mock-google-oidc/README.md
new file mode 100644
index 000000000..dc5b23b1c
--- /dev/null
+++ b/mocks/mock-google-oidc/README.md
@@ -0,0 +1,73 @@
+# Mock Google OIDC Provider
+
+A lightweight mock OpenID Connect provider that simulates Google login for local MAS development. It lets you test the upstream OAuth2 / "Sign in with Google" flow without needing real Google credentials.
+
+## Prerequisites
+
+- Node.js 18+
+- MAS configured with an upstream OAuth2 provider pointing to this mock
+
+## Quick start
+
+```sh
+cd mocks/mock-google-oidc
+npm install
+npm start
+```
+
+The server starts at `http://localhost:5556`.
+
+## How it works
+
+The mock uses [`oidc-provider`](https://github.com/panva/node-oidc-provider) to run a standards-compliant OIDC server with dev interactions enabled. When MAS redirects to the mock for login, you'll see a simple form where you can enter any email-like value (e.g. `taylor@gmail.com`). The mock will return that as the authenticated user with synthetic profile claims.
+
+## MAS configuration
+
+Add an upstream OAuth2 provider entry in your MAS `config.yaml`:
+
+```yaml
+upstream_oauth2:
+  providers:
+    - id: "01JQ0FAKEG00G1E0D1CPR0V1D3"
+      human_name: "Google"
+      issuer: "http://localhost:5556"
+      client_id: "mas-dev"
+      client_secret: "mas-dev-secret"
+      token_endpoint_auth_method: "client_secret_post"
+      scope: "openid email profile"
+      claims_imports:
+        localpart:
+          action: suggest
+          template: "{{ user.preferred_username }}"
+        displayname:
+          action: suggest
+          template: "{{ user.name }}"
+        email:
+          action: suggest
+          template: "{{ user.email }}"
+          set_email_verification: always
+```
+
+## Environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `MOCK_OIDC_ISSUER` | `http://localhost:5556` | The issuer URL |
+| `MAS_PROVIDER_ID` | `01JQ0FAKEG00G1E0D1CPR0V1D3` | The upstream provider ID configured in MAS |
+| `MOCK_OIDC_CLIENT_ID` | `mas-dev` | OAuth2 client ID |
+| `MOCK_OIDC_CLIENT_SECRET` | `mas-dev-secret` | OAuth2 client secret |
+
+## Running with the full dev stack
+
+```sh
+# Terminal 1: Mock Synapse (handles homeserver API calls)
+python3 mocks/mock_synapse.py
+
+# Terminal 2: Mock Google OIDC
+cd mocks/mock-google-oidc && npm start
+
+# Terminal 3: MAS
+cargo run -- server -c config.yaml
+```
+
+Then visit `http://[::]:8080/login` and click "Sign in with Google".
diff --git a/mocks/mock-google-oidc/package.json b/mocks/mock-google-oidc/package.json
new file mode 100644
index 000000000..a17d78baa
--- /dev/null
+++ b/mocks/mock-google-oidc/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "mock-google-oidc",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "start": "node server.mjs"
+  },
+  "dependencies": {
+    "jose": "^6.0.11",
+    "oidc-provider": "^9.5.1"
+  }
+}
diff --git a/mocks/mock-google-oidc/server.mjs b/mocks/mock-google-oidc/server.mjs
new file mode 100644
index 000000000..a8b8efeca
--- /dev/null
+++ b/mocks/mock-google-oidc/server.mjs
@@ -0,0 +1,77 @@
+import { exportJWK, generateKeyPair } from 'jose';
+import { Provider } from 'oidc-provider';
+
+const ISSUER = process.env.MOCK_OIDC_ISSUER ?? 'http://localhost:5556';
+const PROVIDER_ID =
+  process.env.MAS_PROVIDER_ID ?? '01JQ0FAKEG00G1E0D1CPR0V1D3';
+const CLIENT_ID = process.env.MOCK_OIDC_CLIENT_ID ?? 'mas-dev';
+const CLIENT_SECRET =
+  process.env.MOCK_OIDC_CLIENT_SECRET ?? 'mas-dev-secret';
+
+const redirectUris = [
+  `http://localhost:8080/upstream/callback/${PROVIDER_ID}`,
+  `http://127.0.0.1:8080/upstream/callback/${PROVIDER_ID}`,
+  `http://[::]:8080/upstream/callback/${PROVIDER_ID}`,
+];
+
+const { privateKey } = await generateKeyPair('RS256', { extractable: true });
+const jwk = await exportJWK(privateKey);
+jwk.use = 'sig';
+jwk.alg = 'RS256';
+jwk.kid = 'mock-google-rs256';
+
+const configuration = {
+  clients: [
+    {
+      client_id: CLIENT_ID,
+      client_secret: CLIENT_SECRET,
+      redirect_uris: redirectUris,
+      response_types: ['code'],
+      grant_types: ['authorization_code'],
+      token_endpoint_auth_method: 'client_secret_post',
+    },
+  ],
+  jwks: { keys: [jwk] },
+  claims: {
+    openid: ['sub'],
+    email: ['email', 'email_verified'],
+    profile: ['name', 'preferred_username', 'picture'],
+  },
+  cookies: {
+    keys: ['mock-google-oidc-dev-key-1', 'mock-google-oidc-dev-key-2'],
+  },
+  features: {
+    devInteractions: { enabled: true },
+    rpInitiatedLogout: { enabled: false },
+  },
+  async findAccount(_ctx, sub) {
+    const email = sub.includes('@') ? sub : `${sub}@gmail.com`;
+    const preferredUsername = email.split('@')[0];
+
+    return {
+      accountId: sub,
+      async claims(_use, _scope) {
+        return {
+          sub,
+          email,
+          email_verified: true,
+          name: 'Taylor Google User',
+          preferred_username: preferredUsername,
+          picture:
+            'https://www.gstatic.com/images/branding/product/1x/avatar_circle_blue_512dp.png',
+        };
+      },
+    };
+  },
+};
+
+const provider = new Provider(ISSUER, configuration);
+
+provider.listen(5556, () => {
+  console.log(`Mock Google OIDC running at ${ISSUER}`);
+  console.log('Configured redirect URIs:');
+  for (const uri of redirectUris) {
+    console.log(`  - ${uri}`);
+  }
+  console.log('Use any email-like value in the dev interaction login form.');
+});
diff --git a/mocks/mock_synapse.py b/mocks/mock_synapse.py
new file mode 100644
index 000000000..37763f4a0
--- /dev/null
+++ b/mocks/mock_synapse.py
@@ -0,0 +1,266 @@
+#!/usr/bin/env python3
+"""
+Mock Synapse server for testing MAS UI without a real homeserver.
+
+Handles both Modern (_synapse/mas/...) and Legacy (_synapse/admin/...)
+API endpoints that MAS calls on Synapse.
+
+Usage:
+    python3 mocks/mock_synapse.py
+
+Then start MAS normally:
+    cargo run -- server -c config.yaml
+"""
+
+from http.server import HTTPServer, BaseHTTPRequestHandler
+from urllib.parse import urlparse, parse_qs
+import json
+import sys
+
+
+# In-memory store of provisioned users: localpart -> user data
+provisioned_users = {}
+
+
+class MockSynapseHandler(BaseHTTPRequestHandler):
+
+    def _send_json(self, data, status=200):
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.end_headers()
+        self.wfile.write(json.dumps(data).encode())
+
+    def _read_body(self):
+        length = int(self.headers.get("Content-Length", 0))
+        if length:
+            return json.loads(self.rfile.read(length))
+        return {}
+
+    # ── GET endpoints ──────────────────────────────────────────────
+
+    def do_GET(self):
+        parsed = urlparse(self.path)
+        path = parsed.path.rstrip("/")
+        qs = parse_qs(parsed.query)
+
+        # Modern: check if localpart is available
+        if path == "/_synapse/mas/is_localpart_available":
+            localpart = qs.get("localpart", [""])[0]
+            if localpart in provisioned_users:
+                print(f"  [mock] is_localpart_available: {localpart} → in use")
+                self._send_json({"errcode": "M_USER_IN_USE", "error": "User ID already taken"}, 409)
+            else:
+                print(f"  [mock] is_localpart_available: {localpart} → available")
+                self._send_json({})  # 200 = available
+            return
+
+        # Modern: query user info
+        if path == "/_synapse/mas/query_user":
+            localpart = qs.get("localpart", [""])[0]
+            if localpart in provisioned_users:
+                user = provisioned_users[localpart]
+                print(f"  [mock] query_user: {localpart} → found")
+                self._send_json({
+                    "user_id": f"@{localpart}:localhost:8008",
+                    "display_name": user.get("display_name"),
+                    "avatar_url": user.get("avatar_url"),
+                    "is_suspended": False,
+                    "is_deactivated": False,
+                })
+            else:
+                print(f"  [mock] query_user: {localpart} → not found (404)")
+                self._send_json({"errcode": "M_NOT_FOUND", "error": "User not found"}, 404)
+            return
+
+        # Legacy: username available
+        if path == "/_synapse/admin/v1/username_available":
+            username = qs.get("username", [""])[0]
+            print(f"  [mock] username_available: {username} → available=true")
+            self._send_json({"available": True})
+            return
+
+        # Legacy: get user info
+        if "/_synapse/admin/v2/users/" in path and "/devices" not in path:
+            print(f"  [mock] get user → not found (404)")
+            self._send_json({"errcode": "M_NOT_FOUND", "error": "User not found"}, 404)
+            return
+
+        # Legacy: list devices
+        if "/_synapse/admin/v2/users/" in path and path.endswith("/devices"):
+            print(f"  [mock] list devices → empty")
+            self._send_json({"devices": []})
+            return
+
+        # Matrix client versions
+        if path == "/_matrix/client/versions":
+            self._send_json({"versions": ["v1.1", "v1.2", "v1.3"]})
+            return
+
+        # Catch-all
+        print(f"  [mock] Unhandled GET: {self.path}")
+        self._send_json({})
+
+    # ── POST endpoints ─────────────────────────────────────────────
+
+    def do_POST(self):
+        parsed = urlparse(self.path)
+        path = parsed.path.rstrip("/")
+        body = self._read_body()
+
+        # Modern: provision user
+        if path == "/_synapse/mas/provision_user":
+            localpart = body.get("localpart", "?")
+            is_new = localpart not in provisioned_users
+            provisioned_users[localpart] = {
+                "display_name": body.get("set_displayname"),
+                "avatar_url": body.get("set_avatar_url"),
+                "emails": body.get("set_emails", []),
+            }
+            status = 201 if is_new else 200
+            print(f"  [mock] provision_user: {localpart} → {status} {'created' if is_new else 'updated'}")
+            self._send_json({}, status)
+            return
+
+        # Modern: upsert device
+        if path == "/_synapse/mas/upsert_device":
+            print(f"  [mock] upsert_device: {body.get('device_id', '?')} → ok")
+            self._send_json({})
+            return
+
+        # Modern: update device display name
+        if path == "/_synapse/mas/update_device_display_name":
+            print(f"  [mock] update_device_display_name → ok")
+            self._send_json({})
+            return
+
+        # Modern: delete device
+        if path == "/_synapse/mas/delete_device":
+            print(f"  [mock] delete_device → ok")
+            self._send_json({})
+            return
+
+        # Modern: sync devices
+        if path == "/_synapse/mas/sync_devices":
+            print(f"  [mock] sync_devices → ok")
+            self._send_json({})
+            return
+
+        # Modern: delete user
+        if path == "/_synapse/mas/delete_user":
+            print(f"  [mock] delete_user → ok")
+            self._send_json({})
+            return
+
+        # Modern: reactivate user
+        if path == "/_synapse/mas/reactivate_user":
+            print(f"  [mock] reactivate_user → ok")
+            self._send_json({})
+            return
+
+        # Modern: set displayname
+        if path == "/_synapse/mas/set_displayname":
+            localpart = body.get("localpart", "?")
+            if localpart in provisioned_users:
+                provisioned_users[localpart]["display_name"] = body.get("displayname")
+            print(f"  [mock] set_displayname: {localpart} → ok")
+            self._send_json({})
+            return
+
+        # Modern: unset displayname
+        if path == "/_synapse/mas/unset_displayname":
+            localpart = body.get("localpart", "?")
+            if localpart in provisioned_users:
+                provisioned_users[localpart]["display_name"] = None
+            print(f"  [mock] unset_displayname: {localpart} → ok")
+            self._send_json({})
+            return
+
+        # Modern: allow cross-signing reset
+        if path == "/_synapse/mas/allow_cross_signing_reset":
+            print(f"  [mock] allow_cross_signing_reset → ok")
+            self._send_json({})
+            return
+
+        # Legacy: create device
+        if "/_synapse/admin/v2/users/" in path and path.endswith("/devices"):
+            print(f"  [mock] legacy create device → 201")
+            self._send_json({}, 201)
+            return
+
+        # Legacy: bulk delete devices
+        if "/_synapse/admin/v2/users/" in path and "delete_devices" in path:
+            print(f"  [mock] legacy bulk delete devices → ok")
+            self._send_json({})
+            return
+
+        # Legacy: deactivate user
+        if "/_synapse/admin/v1/deactivate/" in path:
+            print(f"  [mock] legacy deactivate → ok")
+            self._send_json({})
+            return
+
+        # Legacy: allow cross-signing reset
+        if "_allow_cross_signing_replacement_without_uia" in path:
+            print(f"  [mock] legacy allow cross-signing reset → ok")
+            self._send_json({})
+            return
+
+        # Catch-all
+        print(f"  [mock] Unhandled POST: {path} body={body}")
+        self._send_json({})
+
+    # ── PUT endpoints ──────────────────────────────────────────────
+
+    def do_PUT(self):
+        parsed = urlparse(self.path)
+        path = parsed.path.rstrip("/")
+        body = self._read_body()
+
+        # Legacy: create/update user
+        if "/_synapse/admin/v2/users/" in path and "/devices/" not in path:
+            print(f"  [mock] legacy put user → 201 created")
+            self._send_json({}, 201)
+            return
+
+        # Legacy: update device display name
+        if "/_synapse/admin/v2/users/" in path and "/devices/" in path:
+            print(f"  [mock] legacy update device display name → ok")
+            self._send_json({})
+            return
+
+        # Client API: set displayname
+        if "/_matrix/client/v3/profile/" in path and "/displayname" in path:
+            print(f"  [mock] set profile displayname → ok")
+            self._send_json({})
+            return
+
+        # Catch-all
+        print(f"  [mock] Unhandled PUT: {path} body={body}")
+        self._send_json({})
+
+    # ── DELETE endpoints ───────────────────────────────────────────
+
+    def do_DELETE(self):
+        parsed = urlparse(self.path)
+        path = parsed.path.rstrip("/")
+
+        # Legacy: delete device
+        if "/_synapse/admin/v2/users/" in path and "/devices/" in path:
+            print(f"  [mock] legacy delete device → ok")
+            self._send_json({})
+            return
+
+        # Catch-all
+        print(f"  [mock] Unhandled DELETE: {path}")
+        self._send_json({})
+
+
+if __name__ == "__main__":
+    port = int(sys.argv[1]) if len(sys.argv) > 1 else 8008
+    server = HTTPServer(("localhost", port), MockSynapseHandler)
+    print(f"Mock Synapse running on http://localhost:{port}")
+    print("Press Ctrl+C to stop\n")
+    try:
+        server.serve_forever()
+    except KeyboardInterrupt:
+        print("\nStopped.")
diff --git a/policies/register/register.rego b/policies/register/register.rego
index 93ef86a0d..02a2d58e9 100644
--- a/policies/register/register.rego
+++ b/policies/register/register.rego
@@ -49,7 +49,7 @@ violation contains {
 	"field": "username", "code": "username-invalid-chars",
 	"msg": "username contains invalid characters",
 } if {
-	not regex.match(`^[a-z0-9.=_/+-]+$`, input.username)
+	not regex.match(`^[a-z0-9]+$`, input.username)
 }
 
 violation contains {
diff --git a/templates/app.html b/templates/app.html
index d43416f9a..bfa317104 100644
--- a/templates/app.html
+++ b/templates/app.html
@@ -10,7 +10,7 @@ Please see LICENSE files in the repository root for full details.
 {% set _ = translator(lang) %}
 
 <!DOCTYPE html>
-<html lang="{{ lang }}">
+<html lang="{{ lang }}" class="cpd-theme-light">
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
diff --git a/templates/base.html b/templates/base.html
index cfa191ff2..53ebde38c 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -18,7 +18,7 @@ Please see LICENSE files in the repository root for full details.
 {% import "components/captcha.html" as captcha %}
 
 <!DOCTYPE html>
-<html lang="{{ lang }}">
+<html lang="{{ lang }}" class="cpd-theme-light">
   <head>
     <meta charset="utf-8">
     <title>{% block title %}{{ _("app.name") }}{% endblock title %}</title>
diff --git a/templates/components/brand_logo.html b/templates/components/brand_logo.html
new file mode 100644
index 000000000..f362b9085
--- /dev/null
+++ b/templates/components/brand_logo.html
@@ -0,0 +1,141 @@
+{#
+Copyright 2026 New Vector Ltd.
+
+SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
+Please see LICENSE files in the repository root for full details.
+-#}
+
+{# Internal: icon shape paths in 0-44 coordinate space #}
+{% macro _icon_paths(prefix) %}
+    <path d="M1.82529 0H27.3794C27.8635 0 28.3278 0.193154 28.6701 0.536971C29.0124 0.880788 29.2047 1.3471 29.2047 1.83333V29.3333H0V1.83333C0 1.3471 0.192307 0.880788 0.534616 0.536971C0.876925 0.193154 1.3412 0 1.82529 0Z" fill="url(#{{ prefix }}_0)"/>
+    <path d="M14.6023 14.667L0 29.3337H14.6023V14.667Z" fill="url(#{{ prefix }}_1)"/>
+    <path d="M14.6016 14.667H41.981C42.4651 14.667 42.9293 14.8601 43.2716 15.204C43.614 15.5478 43.8063 16.0141 43.8063 16.5003V42.167C43.8063 42.6532 43.614 43.1195 43.2716 43.4634C42.9293 43.8072 42.4651 44.0003 41.981 44.0003H16.4269C15.9428 44.0003 15.4785 43.8072 15.1362 43.4634C14.7939 43.1195 14.6016 42.6532 14.6016 42.167V14.667Z" fill="url(#{{ prefix }}_2)"/>
+{% endmacro %}
+
+{# Internal: default gradient defs (red/yellow scheme, 0-44 coords) #}
+{% macro _icon_defs_default(prefix) %}
+      <linearGradient id="{{ prefix }}_0" x1="0.264667" y1="29.5992" x2="29.066" y2="0.93325" gradientUnits="userSpaceOnUse">
+        <stop offset="0.4" stop-color="#D51C0B"/>
+        <stop offset="0.52" stop-color="#D61F0B"/>
+        <stop offset="0.61" stop-color="#D8290C"/>
+        <stop offset="0.7" stop-color="#DC3A0D"/>
+        <stop offset="0.78" stop-color="#E1520E"/>
+        <stop offset="0.86" stop-color="#E87110"/>
+        <stop offset="0.94" stop-color="#F09613"/>
+        <stop offset="1" stop-color="#F9BC15"/>
+      </linearGradient>
+      <linearGradient id="{{ prefix }}_1" x1="3.65059" y1="33.0003" x2="18.3171" y2="18.3981" gradientUnits="userSpaceOnUse">
+        <stop/>
+        <stop offset="1" stop-color="#645A5A"/>
+      </linearGradient>
+      <linearGradient id="{{ prefix }}_2" x1="14.8693" y1="43.1937" x2="43.1268" y2="15.0601" gradientUnits="userSpaceOnUse">
+        <stop offset="0.4" stop-color="#D51C0B"/>
+        <stop offset="1" stop-color="#F9BC15"/>
+      </linearGradient>
+{% endmacro %}
+
+{# Internal: letro gradient defs (dark red/gold scheme, 0-44 coords) #}
+{% macro _icon_defs_letro(prefix) %}
+      <linearGradient id="{{ prefix }}_0" x1="-1.03125" y1="30.37375" x2="31.83125" y2="-2.48875" gradientUnits="userSpaceOnUse">
+        <stop offset="0.05" stop-color="#BA0000"/>
+        <stop offset="0.23" stop-color="#BA0200"/>
+        <stop offset="0.36" stop-color="#BE0B00"/>
+        <stop offset="0.47" stop-color="#C31B00"/>
+        <stop offset="0.57" stop-color="#CA3000"/>
+        <stop offset="0.66" stop-color="#D44C00"/>
+        <stop offset="0.75" stop-color="#E06F00"/>
+        <stop offset="0.83" stop-color="#EE9700"/>
+        <stop offset="0.91" stop-color="#FEC500"/>
+        <stop offset="0.92" stop-color="#FFC800"/>
+      </linearGradient>
+      <linearGradient id="{{ prefix }}_1" x1="3.16239" y1="33.77028" x2="38.87111" y2="11.45397" gradientUnits="userSpaceOnUse">
+        <stop/>
+        <stop offset="0.07" stop-color="#0E0E0E"/>
+        <stop offset="0.37" stop-color="#494949"/>
+        <stop offset="0.6" stop-color="#6E6E6E"/>
+        <stop offset="0.72" stop-color="#7D7D7D"/>
+      </linearGradient>
+      <linearGradient id="{{ prefix }}_2" x1="14.90486" y1="43.29861" x2="43.29861" y2="14.90486" gradientUnits="userSpaceOnUse">
+        <stop offset="0.05" stop-color="#C20000"/>
+        <stop offset="0.19" stop-color="#C30300"/>
+        <stop offset="0.32" stop-color="#C60E00"/>
+        <stop offset="0.45" stop-color="#CB2000"/>
+        <stop offset="0.57" stop-color="#D33900"/>
+        <stop offset="0.68" stop-color="#DD5A00"/>
+        <stop offset="0.80" stop-color="#E98200"/>
+        <stop offset="0.91" stop-color="#F7B000"/>
+        <stop offset="0.96" stop-color="#FFC800"/>
+      </linearGradient>
+{% endmacro %}
+
+{% macro logo_icon() %}
+  <svg width="44" height="44" viewBox="0 0 44 44" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false">
+    {{ _icon_paths("li") }}
+    <defs>
+      {{ _icon_defs_default("li") }}
+    </defs>
+  </svg>
+{% endmacro %}
+
+{# Internal: PostNumber text paths (in 0-175 × 0-44 coordinate space) #}
+{% macro _postnumber_text_paths() %}
+    <path d="M76.9986 6.17509C76.677 5.44887 76.1752 4.81765 75.5414 4.34175C74.8721 3.87406 74.1158 3.54671 73.3176 3.37925C72.3956 3.16804 71.4523 3.0655 70.5067 3.0737H62.4176L58.2285 23.3656H62.6427L64.1638 16.0904H69.6396C70.6602 16.0973 71.6748 15.9341 72.6423 15.6076C73.5555 15.3049 74.4038 14.8322 75.1429 14.2143C75.8737 13.6064 76.4643 12.8464 76.8739 11.9868C77.3074 11.0473 77.5237 10.0215 77.5067 8.9862C77.5411 8.02333 77.3678 7.06438 76.9986 6.17509ZM72.1007 11.7576C71.4467 12.3381 70.5584 12.6254 69.4297 12.6254H64.9061L66.1533 6.54786H69.9408C70.326 6.54477 70.7105 6.58266 71.0877 6.66092C71.442 6.7282 71.7818 6.85748 72.0916 7.04286C72.3979 7.22429 72.6469 7.48914 72.8096 7.80675C73.0033 8.19921 73.0963 8.63402 73.0803 9.07175C73.0803 10.2848 72.7579 11.1801 72.1007 11.7576ZM92.179 11.7576C91.8716 11.0124 91.3919 10.3515 90.7796 9.82953C90.1452 9.30015 89.4088 8.90799 88.6166 8.67759C87.7212 8.41138 86.7911 8.2816 85.8574 8.29259C84.65 8.27493 83.4532 8.52098 82.3498 9.0137C81.339 9.47855 80.4372 10.1522 79.7031 10.9906C78.9662 11.8463 78.3993 12.8358 78.0329 13.9056C77.6506 15.036 77.4593 16.2227 77.4671 17.4165C77.4671 19.5187 78.0755 21.0964 79.2924 22.1495C80.0076 22.7601 80.8543 23.1952 81.7657 23.4206C82.5512 23.6324 83.3618 23.7352 84.1751 23.7262C84.6986 23.728 85.2215 23.6882 85.7387 23.607C86.4337 23.4969 87.1104 23.2913 87.7496 22.9959C88.7702 22.5441 89.6821 21.8772 90.4237 21.0404C91.1751 20.1827 91.7472 19.182 92.106 18.0979C92.501 16.9302 92.6975 15.7041 92.687 14.4709C92.7018 13.5363 92.529 12.6084 92.179 11.7423V11.7576ZM88.4067 16.5884C88.2436 17.2895 87.9813 17.9634 87.6279 18.5898C87.3381 19.1089 86.9579 19.5715 86.5054 19.9556C86.4384 20.0168 86.3654 20.0748 86.2954 20.1268C85.7361 20.5409 85.0553 20.7559 84.3606 20.7379C83.9293 20.7472 83.502 20.654 83.1134 20.4659C82.8678 20.3377 82.6423 20.174 82.4441 19.9801C82.3624 19.901 82.2852 19.8173 82.2129 19.7295C81.9647 19.4158 81.7769 19.0583 81.6592 18.6754C81.5372 18.2711 81.4747 17.8511 81.4736 17.4287C81.4795 16.7515 81.5663 16.0776 81.7322 15.4212C81.8948 14.7291 82.1539 14.0636 82.5019 13.4443C82.8293 12.8487 83.277 12.3283 83.8161 11.9165C84.3675 11.5073 85.038 11.2925 85.7235 11.3054C86.7984 11.3054 87.559 11.5997 88.0051 12.1884C88.4776 12.8804 88.7096 13.7095 88.6653 14.5473C88.6584 15.2299 88.5747 15.9095 88.4158 16.5731L88.4067 16.5884ZM105.747 16.0048C105.385 15.667 104.975 15.3858 104.53 15.1706C104.042 14.9233 103.533 14.7189 103.009 14.5595L101.001 13.9026C100.489 13.7773 100.006 13.5543 99.5775 13.2456C99.4515 13.1502 99.3496 13.0263 99.2798 12.8841C99.2101 12.7419 99.1745 12.5853 99.1759 12.4268C99.1628 12.1893 99.2237 11.9537 99.3502 11.7527C99.4767 11.5516 99.6625 11.3953 99.8817 11.3054C100.44 11.067 101.043 10.9543 101.649 10.9754C102.444 10.9754 103.016 11.1516 103.365 11.504C103.732 11.9004 103.929 12.4263 103.913 12.9676H107.648C107.695 12.1648 107.541 11.3631 107.198 10.6362C106.89 10.0466 106.431 9.54986 105.869 9.19703C105.274 8.83706 104.618 8.59245 103.934 8.47592C103.176 8.34227 102.407 8.27581 101.637 8.27731C100.9 8.28118 100.166 8.36311 99.4467 8.52175C98.7073 8.67236 97.9967 8.94055 97.3415 9.3162C96.7163 9.66741 96.1794 10.1576 95.7718 10.7493C95.3478 11.3974 95.1352 12.162 95.1633 12.937C95.1472 13.4375 95.2182 13.937 95.3732 14.4129C95.5014 14.7945 95.7088 15.1444 95.9817 15.4395C96.2678 15.7316 96.6024 15.9715 96.9704 16.1484C97.4085 16.3546 97.8585 16.5342 98.318 16.6862L101.4 17.6793C101.776 17.8005 102.13 17.9843 102.446 18.2231C102.592 18.3601 102.703 18.5291 102.772 18.7169C102.841 18.9046 102.866 19.1058 102.845 19.3048C102.854 19.6001 102.774 19.8912 102.614 20.139C102.455 20.3646 102.247 20.5506 102.005 20.6829C101.75 20.8277 101.474 20.9309 101.187 20.9884C100.886 21.043 100.58 21.0716 100.274 21.074C99.9252 21.0723 99.5777 21.0272 99.2398 20.9395C98.9125 20.865 98.5985 20.7403 98.3089 20.5698C98.0436 20.4195 97.8157 20.2105 97.6427 19.9587C97.4665 19.7 97.3761 19.392 97.3841 19.0787V18.5898H93.7335V19.1856C93.7051 19.9531 93.9053 20.7117 94.3085 21.3643C94.6779 21.9356 95.1747 22.4127 95.7596 22.7576C96.3804 23.1157 97.0556 23.3686 97.7583 23.5062C98.4745 23.6581 99.2044 23.736 99.9365 23.7384C100.782 23.7392 101.625 23.6522 102.452 23.4787C103.241 23.3242 103.997 23.0348 104.688 22.6231C105.329 22.24 105.873 21.7128 106.276 21.0831C106.699 20.3859 106.911 19.58 106.885 18.764C106.893 18.218 106.79 17.676 106.581 17.172C106.388 16.7289 106.113 16.3273 105.768 15.9895L105.747 16.0048ZM114.39 18.6906L115.908 11.3726H118.764L119.391 8.67453H116.516L117.429 4.21342H113.395L112.482 8.67453H109.909L109.3 11.3726H111.932L110.28 19.2498C110.222 19.5156 110.173 19.7662 110.143 20.0076C110.105 20.2174 110.085 20.43 110.082 20.6431C110.045 21.1539 110.15 21.6651 110.386 22.119C110.594 22.4901 110.897 22.7991 111.262 23.0143C111.648 23.2399 112.07 23.3951 112.51 23.4726C112.811 23.5267 113.116 23.5624 113.422 23.5795C113.587 23.5795 113.754 23.5979 113.918 23.5979C114.353 23.5979 114.776 23.5979 115.19 23.5581L116.206 23.4787L116.431 23.4604L117.112 20.359C116.635 20.4169 116.154 20.4455 115.674 20.4445C115.521 20.4445 115.369 20.4445 115.205 20.4445C115.049 20.4376 114.897 20.3948 114.761 20.3193C114.627 20.2387 114.516 20.1251 114.438 19.9893C114.344 19.8003 114.301 19.5894 114.314 19.3781C114.316 19.2869 114.325 19.196 114.341 19.1062C114.357 18.9614 114.38 18.8176 114.411 18.6754L114.39 18.6906Z" fill="#1D1D1B"/>
+    <path d="M83.8278 25.8289C83.0145 25.8395 82.2037 25.7367 81.4185 25.5234L79.5932 34.6901H79.5354L74.0351 20.2617H69.4567L65.2129 40.5537H69.3381L72.2281 26.3209H72.2798L77.8287 40.5537H82.2703L85.3915 25.7098C84.8742 25.7909 84.3514 25.8308 83.8278 25.8289ZM98.8165 25.8626L97.1738 33.6756C97.0597 34.1919 96.8946 34.6956 96.6809 35.1789C96.4757 35.654 96.1998 36.095 95.8626 36.4867C95.5279 36.8657 95.1242 37.1768 94.6731 37.4034C94.1765 37.6474 93.6287 37.7679 93.076 37.7548C92.6032 37.7568 92.142 37.6081 91.7587 37.3301C91.5743 37.2172 91.4216 37.0588 91.3151 36.8701C91.2086 36.6813 91.1519 36.4684 91.1503 36.2514C91.1503 36.1567 91.1503 36.0314 91.1503 35.8664C91.1503 35.7014 91.1777 35.5426 91.2111 35.3684C91.2446 35.1942 91.2629 35.0323 91.2963 34.8734C91.3187 34.7334 91.3522 34.5954 91.3967 34.4609L93.1764 25.8534H89.1699L87.3628 34.4609C87.3233 34.5953 87.2776 34.7664 87.232 34.9864C87.1864 35.2064 87.1377 35.4356 87.0921 35.6801C87.0464 35.9245 87.0069 36.172 86.9795 36.4103C86.9522 36.6037 86.9369 36.7986 86.9339 36.9939C86.9339 39.6034 88.3596 40.9091 91.2111 40.9112C92.193 40.9386 93.1676 40.7346 94.0567 40.3154C94.9459 39.8962 95.7248 39.2735 96.3311 38.4973H96.3828L95.9356 40.5445H99.7809L102.823 25.8534L98.8165 25.8626ZM127.388 27.5401C127.155 27.0775 126.815 26.6775 126.397 26.3728C125.967 26.0609 125.485 25.83 124.973 25.6914C124.433 25.5397 123.875 25.4637 123.315 25.4653C122.832 25.4648 122.352 25.5275 121.885 25.6517C121.411 25.771 120.952 25.9464 120.519 26.1742C120.087 26.4006 119.68 26.6709 119.302 26.9809C118.947 27.2797 118.64 27.631 118.39 28.0228C118.339 27.6274 118.204 27.2476 117.994 26.9091C117.784 26.5707 117.504 26.2815 117.173 26.0612C116.774 25.817 116.334 25.6482 115.874 25.5631C115.539 25.4969 115.199 25.4642 114.858 25.4653C114.263 25.4608 113.67 25.5275 113.09 25.6639C112.696 25.7599 112.312 25.8929 111.943 26.0612C111.053 26.4752 110.291 27.1235 109.738 27.9373H109.68L110.133 25.8626H106.261L103.219 40.5537H107.204L108.847 32.6826C108.948 32.2028 109.101 31.7356 109.303 31.2892C109.5 30.8233 109.762 30.388 110.082 29.9967C110.39 29.6077 110.768 29.2793 111.195 29.0281C111.625 28.7677 112.12 28.6343 112.622 28.6431C113.085 28.6266 113.536 28.7909 113.881 29.1014C114.041 29.2381 114.168 29.4082 114.255 29.5999C114.342 29.7916 114.386 30.0001 114.383 30.2106C114.378 30.5617 114.34 30.9115 114.271 31.2556L112.342 40.5537H116.394L118.034 32.6948C118.135 32.2151 118.288 31.7479 118.49 31.3014C118.684 30.834 118.94 30.3951 119.251 29.9967C119.56 29.6096 119.936 29.2815 120.361 29.0281C120.79 28.7678 121.284 28.6344 121.785 28.6431C122.248 28.625 122.7 28.7895 123.044 29.1014C123.203 29.2378 123.33 29.4076 123.415 29.5988C123.501 29.79 123.544 29.9979 123.54 30.2076C123.539 30.5589 123.501 30.9091 123.428 31.2526L121.508 40.5506H125.521L127.346 31.9095C127.44 31.4726 127.531 31.0295 127.629 30.5651C127.721 30.1115 127.768 29.6499 127.769 29.187C127.777 28.6152 127.646 28.05 127.388 27.5401ZM144.972 29.3031C144.795 28.5852 144.478 27.9094 144.041 27.3139C143.609 26.7455 143.051 26.2862 142.411 25.9726C141.659 25.6233 140.838 25.4539 140.01 25.4776C139.174 25.4501 138.343 25.6109 137.577 25.9481C136.855 26.3131 136.21 26.8153 135.678 27.427H135.617L137.117 20.2617H133.102L128.891 40.5537H132.566L133.047 38.2467H133.102C133.237 38.7056 133.468 39.1305 133.778 39.4938C134.089 39.8571 134.472 40.1506 134.903 40.3551C135.78 40.7413 136.729 40.9341 137.686 40.9203C138.83 40.9454 139.96 40.6706 140.966 40.1228C141.896 39.6044 142.706 38.893 143.342 38.0359C144 37.1484 144.49 36.1468 144.787 35.0812C145.106 33.9896 145.268 32.8577 145.267 31.7201C145.273 30.905 145.174 30.0926 144.972 29.3031ZM141.017 33.7887C140.863 34.4903 140.606 35.1648 140.254 35.7901C139.923 36.3868 139.471 36.9072 138.927 37.3178C138.353 37.7256 137.662 37.9347 136.959 37.9137C136.559 37.9358 136.159 37.8696 135.788 37.7197C135.416 37.5697 135.082 37.3397 134.808 37.0459C134.281 36.4255 134.008 35.6271 134.045 34.8123C134.051 34.1142 134.13 33.4188 134.282 32.7376C134.435 32.0232 134.693 31.3354 135.046 30.6964C135.381 30.0864 135.84 29.5535 136.393 29.132C136.975 28.7099 137.681 28.4948 138.398 28.5209C139.435 28.5209 140.175 28.8264 140.61 29.4559C141.059 30.1489 141.284 30.9641 141.255 31.7903C141.245 32.4633 141.164 33.1333 141.011 33.7887H141.017ZM150.618 34.4456C150.62 34.358 150.631 34.2709 150.652 34.1859H161.424C161.572 33.4278 161.649 32.6575 161.655 31.8851C161.672 30.9294 161.503 29.9796 161.156 29.0892C160.85 28.3206 160.376 27.6305 159.769 27.0695C159.156 26.5121 158.429 26.095 157.64 25.8473C156.735 25.5726 155.795 25.4387 154.85 25.4501C153.685 25.4314 152.532 25.69 151.485 26.2048C150.509 26.6889 149.645 27.3751 148.951 28.2184C148.253 29.0816 147.712 30.0623 147.354 31.1151C146.967 32.2111 146.767 33.3651 146.764 34.5281C146.747 35.4771 146.906 36.4209 147.232 37.3117C147.52 38.0673 147.968 38.7505 148.547 39.3131C149.134 39.8615 149.836 40.2726 150.6 40.517C151.464 40.7922 152.365 40.9274 153.271 40.9173C154.21 40.9343 155.147 40.8316 156.061 40.6117C157.544 40.2446 158.842 39.3459 159.711 38.0848C160.175 37.4025 160.554 36.6657 160.84 35.8909H156.84C156.687 36.1231 156.535 36.3553 156.347 36.6089C156.166 36.851 155.956 37.0688 155.72 37.2567C155.473 37.4551 155.197 37.6138 154.902 37.7273C154.562 37.8573 154.2 37.9205 153.837 37.9137C152.742 37.9137 151.933 37.6478 151.403 37.1192C151.139 36.8451 150.932 36.5199 150.796 36.1633C150.66 35.8067 150.598 35.4261 150.612 35.0445L150.618 34.4456ZM151.628 30.4337C152.057 29.6658 152.741 29.0732 153.56 28.7592C154.042 28.5795 154.553 28.4935 155.066 28.5056C155.55 28.486 156.033 28.5769 156.478 28.7714C156.806 28.9371 157.082 29.1896 157.278 29.5017C157.471 29.8078 157.601 30.1496 157.661 30.507C157.725 30.8773 157.758 31.2525 157.758 31.6284H151.066C151.214 31.2139 151.401 30.814 151.622 30.4337H151.628ZM173.763 25.4653C172.716 25.456 171.685 25.7259 170.776 26.2476C169.858 26.7722 169.136 27.5847 168.722 28.5606L168.671 28.5056L169.279 25.8626H165.437L162.395 40.5537H166.404L167.764 34.0453C167.892 33.4301 168.066 32.8254 168.284 32.2364C168.493 31.6825 168.789 31.1665 169.163 30.7087C169.53 30.2519 169.993 29.8834 170.52 29.6301C171.136 29.3409 171.809 29.1987 172.488 29.2145C172.772 29.214 173.054 29.2437 173.331 29.3031C173.617 29.3551 173.9 29.4131 174.183 29.4681L175.001 25.5509C174.589 25.4921 174.173 25.4635 173.757 25.4653H173.763Z" fill="#1D1D1B"/>
+{% endmacro %}
+
+{% macro postnumber_logo_text() %}
+  <svg width="117" height="44" viewBox="58 0 117 44" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false">
+    {{ _postnumber_text_paths() }}
+  </svg>
+{% endmacro %}
+
+{# Internal: LETRO text paths (in 0-70 × 0-17 coordinate space) #}
+{% macro _letro_text_paths() %}
+    <path d="M0 15.6898V0.339844H3.33V15.6898H0ZM0.670002 15.6898V12.8798H9.83V15.6898H0.670002Z" fill="#333333"/>
+    <path d="M11.8809 15.6898V0.339844H15.2309V15.6898H11.8809ZM14.1809 3.03984V0.339844H23.6509V3.03984H14.1809ZM14.1809 9.17984V6.68984H22.5509V9.17984H14.1809ZM14.1809 15.6898V12.9698H23.7209V15.6898H14.1809Z" fill="#333333"/>
+    <path d="M25.1699 3.14984V0.339844H37.6099V3.14984H25.1699ZM29.7099 15.6898V0.339844H33.0599V15.6898H29.7099Z" fill="#333333"/>
+    <path d="M39.7305 15.6898V0.339844H45.9605C46.8005 0.339844 47.5605 0.409844 48.2505 0.539844C48.9405 0.669844 49.5505 0.869843 50.0805 1.11984C50.6105 1.36984 51.0505 1.67984 51.4205 2.03984C51.7805 2.39984 52.0605 2.80984 52.2305 3.27984C52.4105 3.74984 52.5005 4.27984 52.5005 4.86984C52.5005 5.39984 52.4205 5.87984 52.2605 6.31984C52.1005 6.75984 51.8405 7.14984 51.5005 7.46984C51.1605 7.79984 50.7205 8.05984 50.2005 8.25984C49.6705 8.45984 49.0805 8.61984 48.4105 8.72984V9.04984C49.2205 9.13984 49.8505 9.32984 50.3205 9.60984C50.7905 9.88984 51.1505 10.2698 51.4305 10.7498C51.7005 11.2298 51.9405 11.8298 52.1405 12.5398L53.0705 15.6798H49.3705L48.6705 12.7998C48.5205 12.1798 48.3105 11.6898 48.0405 11.3298C47.7705 10.9698 47.4405 10.7198 47.0405 10.5698C46.6405 10.4198 46.1505 10.3498 45.5705 10.3498H43.0605V15.6798H39.7305V15.6898ZM43.0605 7.84984H45.7605C46.8105 7.84984 47.6205 7.64984 48.1905 7.23984C48.7605 6.83984 49.0405 6.21984 49.0405 5.37984C49.0405 4.53984 48.7805 3.89984 48.2505 3.49984C47.7205 3.09984 46.9205 2.88984 45.8305 2.88984H43.0605V7.83984V7.84984Z" fill="#333333"/>
+    <path d="M61.9693 16.01C60.8493 16.01 59.8493 15.84 58.9593 15.49C58.0693 15.14 57.3093 14.63 56.6893 13.95C56.0693 13.28 55.5993 12.45 55.2693 11.47C54.9493 10.49 54.7793 9.36 54.7793 8.07C54.7793 6.26 55.0893 4.76 55.7093 3.57C56.3293 2.38 57.1993 1.49 58.2993 0.900001C59.4093 0.300001 60.6693 0 62.0793 0C63.1593 0 64.1493 0.17 65.0293 0.52C65.9093 0.87 66.6693 1.38 67.2993 2.06C67.9293 2.74 68.4093 3.57 68.7493 4.57C69.0893 5.57 69.2593 6.71 69.2593 8C69.2593 9.29 69.0893 10.47 68.7393 11.47C68.3893 12.46 67.8993 13.3 67.2593 13.97C66.6193 14.64 65.8593 15.15 64.9593 15.49C64.0593 15.83 63.0593 16 61.9593 16L61.9693 16.01ZM62.0593 13.36C62.8793 13.36 63.5693 13.16 64.1293 12.76C64.6893 12.36 65.1093 11.77 65.4093 11C65.6993 10.23 65.8493 9.3 65.8493 8.2C65.8493 7.1 65.6993 6.08 65.4093 5.27C65.1093 4.46 64.6793 3.85 64.0993 3.42C63.5193 2.99 62.8193 2.78 61.9993 2.78C61.1793 2.78 60.5093 2.99 59.9393 3.4C59.3693 3.81 58.9393 4.41 58.6393 5.19C58.3393 5.97 58.1893 6.93 58.1893 8.06C58.1893 8.91 58.2793 9.67 58.4593 10.33C58.6393 10.99 58.8893 11.54 59.1993 11.98C59.5193 12.42 59.9193 12.76 60.4093 13C60.8993 13.24 61.4493 13.36 62.0693 13.36H62.0593Z" fill="#333333"/>
+{% endmacro %}
+
+{% macro letro_logo_text() %}
+  <svg width="70" height="17" viewBox="0 0 70 17" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false">
+    {{ _letro_text_paths() }}
+  </svg>
+{% endmacro %}
+
+{% macro postnumber_logo() %}
+  <svg width="175" height="44" viewBox="0 0 175 44" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false">
+    {{ _postnumber_text_paths() }}
+    {{ _icon_paths("pn") }}
+    <defs>
+      {{ _icon_defs_default("pn") }}
+    </defs>
+  </svg>
+{% endmacro %}
+
+{% macro letro_logo() %}
+  <svg width="112" height="32" viewBox="0 0 112 32" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false">
+    <svg x="0" y="0" width="32" height="32" viewBox="0 0 44 44">
+      {{ _icon_paths("lt") }}
+      <defs>
+        {{ _icon_defs_letro("lt") }}
+      </defs>
+    </svg>
+    <svg x="42.6699" y="7.99" width="70" height="17" viewBox="0 0 70 17">
+      {{ _letro_text_paths() }}
+    </svg>
+  </svg>
+{% endmacro %}
+
+{% macro framed_logo() %}
+  <svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false">
+    <rect width="64" height="64" rx="8" fill="#696B77" fill-opacity="0.08"/>
+    <svg x="10.5" y="10" width="44" height="44" viewBox="0 0 44 44">
+      {{ _icon_paths("fr") }}
+      <defs>
+        {{ _icon_defs_default("fr") }}
+      </defs>
+    </svg>
+  </svg>
+{% endmacro %}
\ No newline at end of file
diff --git a/templates/components/field.html b/templates/components/field.html
index f69abe40a..2ce161e5b 100644
--- a/templates/components/field.html
+++ b/templates/components/field.html
@@ -40,6 +40,8 @@ Please see LICENSE files in the repository root for full details.
         {{ _("mas.errors.username_banned") }}
       {% elif error.code == "username-not-allowed" %}
         {{ _("mas.errors.username_not_allowed") }}
+      {% elif error.code == "postnumber-reserved" %}
+        {{ _("mas.errors.postnumber_reserved") }}
       {% elif error.code == "email-domain-not-allowed" %}
         {{ _("mas.errors.email_domain_not_allowed") }}
       {% elif error.code == "email-domain-banned" %}
diff --git a/templates/pages/device_link.html b/templates/pages/device_link.html
index 851b1bf96..bb55eb295 100644
--- a/templates/pages/device_link.html
+++ b/templates/pages/device_link.html
@@ -8,10 +8,12 @@ Please see LICENSE files in the repository root for full details.
 
 {% extends "base.html" %}
 
+{% import "components/brand_logo.html" as brand_logo %}
+
 {% block content %}
   <header class="page-heading">
-    <div class="icon">
-      {{ icon.link() }}
+    <div class="brand-logo">
+      {{ brand_logo.postnumber_logo() }}
     </div>
 
     <div class="header">
diff --git a/templates/pages/login.html b/templates/pages/login.html
index 57bccd03e..c3cbdf050 100644
--- a/templates/pages/login.html
+++ b/templates/pages/login.html
@@ -8,13 +8,14 @@ Please see LICENSE files in the repository root for full details.
 
 {% extends "base.html" %}
 
+{% import "components/brand_logo.html" as brand_logo %}
 {% from "components/idp_brand.html" import logo %}
 
 {% block content %}
-  <form method="POST" class="flex flex-col gap-10">
+  <form method="POST" class="login-page flex flex-col gap-10" data-disable-submit-until-valid>
     <header class="page-heading">
-      <div class="icon">
-        {{ icon.user_profile_solid() }}
+      <div class="brand-logo">
+        {{ brand_logo.postnumber_logo() }}
       </div>
 
       {% if next and next.kind == "link_upstream" %}
diff --git a/templates/pages/reauth.html b/templates/pages/reauth.html
index ddebaa595..a0b347989 100644
--- a/templates/pages/reauth.html
+++ b/templates/pages/reauth.html
@@ -8,10 +8,12 @@ Please see LICENSE files in the repository root for full details.
 
 {% extends "base.html" %}
 
+{% import "components/brand_logo.html" as brand_logo %}
+
 {% block content %}
   <header class="page-heading">
-    <div class="icon">
-      {{ icon.lock() }}
+    <div class="brand-logo">
+      {{ brand_logo.postnumber_logo() }}
     </div>
 
     <div class="header">
diff --git a/templates/pages/register/index.html b/templates/pages/register/index.html
index dc9fd61ec..530760fbc 100644
--- a/templates/pages/register/index.html
+++ b/templates/pages/register/index.html
@@ -8,13 +8,14 @@ Please see LICENSE files in the repository root for full details.
 
 {% extends "base.html" %}
 
+{% import "components/brand_logo.html" as brand_logo %}
 {% from "components/idp_brand.html" import logo %}
 
 {% block content %}
-  <form method="GET" class="flex flex-col gap-10" action="{{ '/register/password' | prefix_url }}">
+  <form method="POST" class="flex flex-col gap-10" action="{{ '/register' | prefix_url }}">
     <header class="page-heading">
-      <div class="icon">
-        {{ icon.user_profile_solid() }}
+      <div class="brand-logo">
+        {{ brand_logo.letro_logo() }}
       </div>
 
       <div class="header">
@@ -27,8 +28,12 @@ Please see LICENSE files in the repository root for full details.
     </header>
 
     {% if features.password_registration %}
+      <input type="hidden" name="csrf" value="{{ csrf_token }}" />
+
       {% call(f) field.field(label=_("common.username"), name="username", form_state=form) %}
         <input {{ field.attributes(f) }} class="cpd-text-control" type="text" autocomplete="username" autocorrect="off" autocapitalize="off" data-choose-username />
+        {{ field.error(error={"kind": "policy", "code": "username-invalid-chars"}, hidden=true) }}
+        {{ field.error(error={"kind": "policy", "code": "postnumber-reserved"}, hidden=true) }}
         <div class="cpd-form-message cpd-form-help-message" id="{{ f.id }}-help">
           @username:{{ branding.server_name }}
         </div>
@@ -36,6 +41,12 @@ Please see LICENSE files in the repository root for full details.
     {% endif %}
 
     <div class="cpd-form-root">
+      {% for error in form.errors %}
+        <div class="text-critical font-medium">
+          {{ errors.form_error_message(error=error) }}
+        </div>
+      {% endfor %}
+
       {% for key, value in next["params"] | default({}) | items %}
         <input type="hidden" name="{{ key }}" value="{{ value }}" />
       {% endfor %}
diff --git a/templates/pages/register/password.html b/templates/pages/register/password.html
index f1a77efad..dd5db3259 100644
--- a/templates/pages/register/password.html
+++ b/templates/pages/register/password.html
@@ -8,10 +8,12 @@ Please see LICENSE files in the repository root for full details.
 
 {% extends "base.html" %}
 
+{% import "components/brand_logo.html" as brand_logo %}
+
 {% block content %}
   <header class="page-heading">
-    <div class="icon">
-      {{ icon.user_profile_solid() }}
+    <div class="brand-logo">
+      {{ brand_logo.letro_logo() }}
     </div>
 
     <div class="header">
@@ -34,6 +36,7 @@ Please see LICENSE files in the repository root for full details.
     {% call(f) field.field(label=_("common.username"), name="username", form_state=form) %}
       <input {{ field.attributes(f) }} class="cpd-text-control" type="text" autocomplete="username" autocorrect="off" autocapitalize="none" required data-choose-username />
       {{ field.error(error={"kind": "policy", "code": "username-invalid-chars"}, hidden=true) }}
+      {{ field.error(error={"kind": "policy", "code": "postnumber-reserved"}, hidden=true) }}
     {% endcall %}
 
     {% if features.password_registration_email_required %}
diff --git a/templates/pages/upstream_oauth2/do_register.html b/templates/pages/upstream_oauth2/do_register.html
index bab1d340e..e66c583ce 100644
--- a/templates/pages/upstream_oauth2/do_register.html
+++ b/templates/pages/upstream_oauth2/do_register.html
@@ -8,13 +8,14 @@ Please see LICENSE files in the repository root for full details.
 
 {% extends "base.html" %}
 
+{% import "components/brand_logo.html" as brand_logo %}
 {% from "components/idp_brand.html" import logo %}
 
 {% block content %}
   {% if force_localpart %}
     <header class="page-heading">
-      <div class="icon">
-        {{ icon.download() }}
+      <div class="brand-logo">
+        {{ brand_logo.framed_logo() }}
       </div>
 
       <div class="header">
@@ -28,8 +29,8 @@ Please see LICENSE files in the repository root for full details.
     </header>
   {% elif upstream_oauth_provider.human_name is not none %}
     <header class="page-heading">
-      <div class="icon">
-        {{ icon.user_profile_solid() }}
+      <div class="brand-logo">
+        {{ brand_logo.framed_logo() }}
       </div>
 
       <div class="header">
@@ -40,8 +41,8 @@ Please see LICENSE files in the repository root for full details.
     </header>
   {% else %}
     <header class="page-heading">
-      <div class="icon">
-        {{ icon.mention() }}
+      <div class="brand-logo">
+        {{ brand_logo.framed_logo() }}
       </div>
 
       <div class="header">
@@ -101,6 +102,7 @@ Please see LICENSE files in the repository root for full details.
       {% call(f) field.field(label=_("common.username"), name="username", form_state=form_state) %}
         <input {{ field.attributes(f) }} class="cpd-text-control" type="text" autocomplete="username" autocorrect="off" autocapitalize="none" value="{{ imported_localpart or '' }}" aria-describedby="{{ f.id }}-help" data-choose-username />
         {{ field.error(error={"kind": "policy", "code": "username-invalid-chars"}, hidden=true) }}
+        {{ field.error(error={"kind": "policy", "code": "postnumber-reserved"}, hidden=true) }}
 
         {% if f.errors is empty %}
           <div class="cpd-form-message cpd-form-help-message" id="{{ f.id }}-help">
diff --git a/templates/pages/upstream_oauth2/suggest_link.html b/templates/pages/upstream_oauth2/suggest_link.html
index 2dd2bb0ec..b359adbd1 100644
--- a/templates/pages/upstream_oauth2/suggest_link.html
+++ b/templates/pages/upstream_oauth2/suggest_link.html
@@ -8,10 +8,12 @@ Please see LICENSE files in the repository root for full details.
 
 {% extends "base.html" %}
 
+{% import "components/brand_logo.html" as brand_logo %}
+
 {% block content %}
   <header class="page-heading">
-    <div class="icon">
-      {{ icon.link() }}
+    <div class="brand-logo">
+      {{ brand_logo.postnumber_logo() }}
     </div>
 
     <div class="header">
diff --git a/translations/cs.json b/translations/cs.json
index e21b0e83c..d0a131b00 100644
--- a/translations/cs.json
+++ b/translations/cs.json
@@ -11,8 +11,8 @@
     "submit": "Odeslat"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "Dokument o zjišťování služby OpenID Connect: <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix ID",
     "password": "Heslo",
     "password_confirm": "Potvrďte heslo",
-    "username": "Uživatelské jméno"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Neočekávaná chyba"
@@ -142,13 +142,14 @@
       "invalid_credentials": "Neplatné přihlašovací údaje",
       "password_mismatch": "Pole hesla se neshodují",
       "rate_limit_exceeded": "V krátké době jste podali příliš mnoho žádostí. Počkejte prosím několik minut a zkuste to znovu.",
-      "username_all_numeric": "Uživatelské jméno se nemůže skládat pouze z čísel",
-      "username_banned": "Uživatelské jméno je zakázáno zásadami serveru",
-      "username_invalid_chars": "Uživatelské jméno obsahuje neplatné znaky. Používejte pouze malá písmena, číslice, pomlčky a podtržítka.",
-      "username_not_allowed": "Uživatelské jméno není povoleno zásadami serveru",
-      "username_taken": "Toto uživatelské jméno je již obsazeno",
-      "username_too_long": "Uživatelské jméno je příliš dlouhé",
-      "username_too_short": "Uživatelské jméno je příliš krátké"
+      "username_all_numeric": "PostNumber se nemůže skládat pouze z čísel",
+      "username_banned": "PostNumber je zakázáno zásadami serveru",
+      "username_invalid_chars": "PostNumber obsahuje neplatné znaky. Používejte pouze malá písmena a číslice.",
+      "username_not_allowed": "PostNumber není povoleno zásadami serveru",
+      "postnumber_reserved": "Toto PostNumber je rezervováno a nelze ho použít k registraci",
+      "username_taken": "Toto PostNumber je již obsazeno",
+      "username_too_long": "PostNumber je příliš dlouhé",
+      "username_too_short": "PostNumber je příliš krátké"
     },
     "legacy_consent": {
       "this_will_setup": "Tím se nastaví <span>%(client_name)s</span> s vaším účtem <span>%(server_name)s</span>."
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "Ještě nemáte účet?",
       "continue_with_provider": "Pokračovat s %(provider)s",
-      "description": "Pro pokračování se prosím přihlaste:",
+      "description": "Unikátní digitální identita pro komunikaci",
       "forgot_password": "Zapomněli jste heslo?",
-      "headline": "Přihlásit se",
+      "headline": "Přihlásit se pomocí PostNumber",
       "link": {
         "description": "Propojení účtu <span class=\"break-keep text-links\">%(provider)s</span> ",
         "headline": "Přihlaste se k odkazu"
       },
       "no_login_methods": "Nejsou k dispozici žádné metody přihlášení.",
       "separator": "Nebo",
-      "username_or_email": "Uživatelské jméno nebo e-mail"
+      "username_or_email": "PostNumber / E-mail"
     },
     "navbar": {
       "my_account": "Můj účet",
@@ -220,7 +221,7 @@
       "continue_with_email": "Pokračujte e-mailovou adresou",
       "continue_with_password": "Pokračovat s heslem",
       "create_account": {
-        "description": "Pokračujte výběrem uživatelského jména.",
+        "description": "Pokračujte výběrem PostNumber.",
         "heading": "Vytvořte si účet"
       },
       "sign_in_instead": "Místo toho se přihlaste",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "Pokračovat",
-        "description": "Pro toto uživatelské jméno existuje účet (%(username)s), který bude propojen s tímto upstream účtem.",
+        "description": "Pro toto PostNumber existuje účet (%(username)s), který bude propojen s tímto upstream účtem.",
         "heading": "Propojení s vaším stávajícím účtem"
       },
       "register": {
         "choose_username": {
           "description": "To nelze později změnit.",
-          "heading": "Zvolte své uživatelské jméno"
+          "heading": "Zvolte své PostNumber"
         },
         "create_account": "Vytvořte nový účet",
         "enforced_by_policy": "Vynuceno zásadami serveru",
         "forced_display_name": "Použije následující zobrazované jméno",
         "forced_email": "Použije následující e-mailovou adresu",
-        "forced_localpart": "Použije následující uživatelské jméno",
+        "forced_localpart": "Použije následující PostNumber",
         "import_data": {
           "description": "Potvrďte informace, které budou propojeny s vaším novým účtem %(server_name)s.",
           "heading": "Importujte svá data"
@@ -286,4 +287,4 @@
       "headline": "Ověřte svůj e-mail"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/da.json b/translations/da.json
index dc7fede98..265201aca 100644
--- a/translations/da.json
+++ b/translations/da.json
@@ -11,8 +11,8 @@
     "submit": "Indsend"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "OpenID Connect opdagelsesdokument: <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix ID",
     "password": "Adgangskode",
     "password_confirm": "Bekræft adgangskode",
-    "username": "Brugernavn"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Uventet fejl"
@@ -137,27 +137,28 @@
       "invalid_credentials": "Ugyldig legitimation",
       "password_mismatch": "Adgangskoderne stemmer ikke overens",
       "rate_limit_exceeded": "Du har indsendt for mange anmodninger på kort tid. Vent et par minutter, og prøv igen.",
-      "username_all_numeric": "Brugernavnet kan ikke udelukkende bestå af tal",
-      "username_banned": "Brugernavnet er forbudt af serverpolitikken",
-      "username_invalid_chars": "Brugernavnet indeholder ugyldige tegn. Brug kun små bogstaver, tal, bindestreger og underscores.",
-      "username_not_allowed": "Brugernavnet er ikke tilladt af serverpolitikken",
-      "username_taken": "Dette brugernavn er allerede taget",
-      "username_too_long": "Brugernavnet er for langt",
-      "username_too_short": "Brugernavnet er for kort"
+      "username_all_numeric": "PostNumber kan ikke udelukkende bestå af tal",
+      "username_banned": "PostNumber er forbudt af serverpolitikken",
+      "username_invalid_chars": "PostNumber indeholder ugyldige tegn. Brug kun små bogstaver og tal.",
+      "username_not_allowed": "PostNumber er ikke tilladt af serverpolitikken",
+      "postnumber_reserved": "Dette PostNumber er reserveret og kan ikke bruges til registrering",
+      "username_taken": "Dette PostNumber er allerede taget",
+      "username_too_long": "PostNumber er for langt",
+      "username_too_short": "PostNumber er for kort"
     },
     "login": {
       "call_to_register": "Har du ikke en konto endnu?",
       "continue_with_provider": "Fortsæt med %(provider)s",
-      "description": "Log ind for at fortsætte:",
+      "description": "Unik digital identitet til kommunikation",
       "forgot_password": "Har du glemt din adgangskode?",
-      "headline": "Log ind",
+      "headline": "Log ind med PostNumber",
       "link": {
         "description": "Forbinder din <span class=\"break-keep text-links\">%(provider)s</span> konto",
         "headline": "Log ind for at forbinde"
       },
       "no_login_methods": "Ingen tilgængelige login metoder.",
       "separator": "Eller",
-      "username_or_email": "Brugernavn eller e-mail"
+      "username_or_email": "PostNumber / E-mail"
     },
     "navbar": {
       "my_account": "Min konto",
@@ -212,7 +213,7 @@
       "continue_with_email": "Fortsæt med e-mailadresse",
       "continue_with_password": "Fortsæt med adgangskode",
       "create_account": {
-        "description": "Vælg et brugernavn for at fortsætte.",
+        "description": "Vælg et PostNumber for at fortsætte.",
         "heading": "Opret en konto"
       },
       "sign_in_instead": "Log ind i stedet",
@@ -226,7 +227,7 @@
     "scope": {
       "edit_profile": "Rediger din profil og dine kontaktoplysninger",
       "manage_sessions": "Administrer dine enheder og sessioner",
-      "mas_admin": "Administrer enhver bruger på matrix-authentication-service",
+      "mas_admin": "Administrer enhver bruger på letro-authentication-service",
       "send_messages": "Send nye beskeder på dine vegne",
       "synapse_admin": "Administrer Synapse hjemmeserveren",
       "view_messages": "Se dine eksisterende beskeder og data",
@@ -238,19 +239,19 @@
       },
       "login_link": {
         "action": "Fortsæt",
-        "description": "Der findes allerede en konto med dette brugernavn (%(username)s), den vil blive forbundet til denne upstream-konto.",
+        "description": "Der findes allerede en konto med dette PostNumber (%(username)s), den vil blive forbundet til denne upstream-konto.",
         "heading": "Forbind til din eksisterende konto"
       },
       "register": {
         "choose_username": {
           "description": "Dette kan ikke ændres senere.",
-          "heading": "Vælg dit brugernavn"
+          "heading": "Vælg dit PostNumber"
         },
         "create_account": "Opret en ny konto",
         "enforced_by_policy": "Håndhæves af serverpolitik",
         "forced_display_name": "Bruger følgende visningsnavn",
         "forced_email": "Bruger følgende e-mail-adresse",
-        "forced_localpart": "Bruger følgende brugernavn",
+        "forced_localpart": "Bruger følgende PostNumber",
         "import_data": {
           "description": "Bekræft de oplysninger, der vil blive knyttet til din nye %(server_name)s konto.",
           "heading": "Importér dine data"
@@ -278,4 +279,4 @@
       "headline": "Bekræft din e-mail"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/de.json b/translations/de.json
index c397fab9f..b0dde964f 100644
--- a/translations/de.json
+++ b/translations/de.json
@@ -11,8 +11,8 @@
     "submit": "Absenden"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "OpenID Connect discovery document: <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix-ID",
     "password": "Passwort",
     "password_confirm": "Passwort wiederholen",
-    "username": "Benutzername"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Unerwarteter Fehler"
@@ -142,13 +142,14 @@
       "invalid_credentials": "Ungültige Anmeldeinformationen",
       "password_mismatch": "Die Passwortfelder stimmen nicht überein",
       "rate_limit_exceeded": "Du hast in kurzer Zeit zu viele Anfragen gestellt. Warte bitte ein paar Minuten und versuch's nochmal.",
-      "username_all_numeric": "Der Benutzername darf nicht nur aus Zahlen bestehen",
-      "username_banned": "Der Benutzername ist durch die Serverrichtlinie gesperrt",
-      "username_invalid_chars": "Der Nutzername enthält ungültige Zeichen. Verwende nur Kleinbuchstaben, Zahlen, Bindestriche und Unterstriche.",
-      "username_not_allowed": "Der Benutzername ist gemäß der Serverrichtlinie nicht zulässig",
-      "username_taken": "Dieser Benutzername ist bereits vergeben",
-      "username_too_long": "Der Benutzername ist zu lang",
-      "username_too_short": "Der Benutzername ist zu kurz"
+      "username_all_numeric": "PostNumber darf nicht nur aus Zahlen bestehen",
+      "username_banned": "PostNumber ist durch die Serverrichtlinie gesperrt",
+      "username_invalid_chars": "PostNumber enthält ungültige Zeichen. Verwende nur Kleinbuchstaben und Zahlen.",
+      "username_not_allowed": "PostNumber ist gemäß der Serverrichtlinie nicht zulässig",
+      "postnumber_reserved": "Diese PostNumber ist reserviert und kann nicht zur Registrierung verwendet werden",
+      "username_taken": "Dieser PostNumber ist bereits vergeben",
+      "username_too_long": "PostNumber ist zu lang",
+      "username_too_short": "PostNumber ist zu kurz"
     },
     "legacy_consent": {
       "this_will_setup": "Dadurch wird <span>%(client_name)s</span> mit deinem <span>%(server_name)s</span> Konto eingerichtet."
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "Du hast noch kein Konto?",
       "continue_with_provider": "Weiter mit %(provider)s",
-      "description": "Bitte melde dich an, um fortzufahren:",
+      "description": "Einzigartige digitale Identität für Kommunikation",
       "forgot_password": "Passwort vergessen?",
-      "headline": "Anmelden",
+      "headline": "Anmelden mit PostNumber",
       "link": {
         "description": "Dein <span class=\"break-keep text-links\">%(provider)s</span> Konto verknüpfen",
         "headline": "Melde dich zum Verbinden an"
       },
       "no_login_methods": "Keine Anmeldemethoden verfügbar.",
       "separator": "Oder",
-      "username_or_email": "Benutzername oder E-Mail-Adresse"
+      "username_or_email": "PostNumber / E-Mail"
     },
     "navbar": {
       "my_account": "Mein Konto",
@@ -220,7 +221,7 @@
       "continue_with_email": "Mit E-Mail-Adresse fortfahren",
       "continue_with_password": "Weiter mit Passwort",
       "create_account": {
-        "description": "Wähle einen Nutzernamen, um fortzufahren.",
+        "description": "Wähle einen PostNumber, um fortzufahren.",
         "heading": "Konto erstellen"
       },
       "sign_in_instead": "Stattdessen anmelden",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "Weiter",
-        "description": "Für diesen Nutzernamen (%(username)s) gibt es schon ein Konto. Es wird mit diesem Upstream-Konto verknüpft.",
+        "description": "Für diesen PostNumber (%(username)s) gibt es schon ein Konto. Es wird mit diesem Upstream-Konto verknüpft.",
         "heading": "Verknüpfe mit deinem bestehenden Konto"
       },
       "register": {
         "choose_username": {
           "description": "Dies kann später nicht mehr geändert werden.",
-          "heading": "Wähle einen Nutzernamen"
+          "heading": "Wähle einen PostNumber"
         },
         "create_account": "Neues Konto erstellen",
         "enforced_by_policy": "Erzwungen durch Server-Richtlinie",
         "forced_display_name": "Verwendet den folgenden Anzeigenamen",
         "forced_email": "Verwendet die folgende E-Mail-Adresse",
-        "forced_localpart": "Verwendet den folgenden Benutzernamen",
+        "forced_localpart": "Verwendet den folgenden PostNumber",
         "import_data": {
           "description": "Bestätige die Informationen, die mit dem neuen %(server_name)s Konto verknüpft werden.",
           "heading": "Deine Daten importieren"
@@ -286,4 +287,4 @@
       "headline": "Bestätige deine E-Mail"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/en.json b/translations/en.json
index 53ac7ad3d..0ca73b9c3 100644
--- a/translations/en.json
+++ b/translations/en.json
@@ -10,11 +10,11 @@
     },
     "continue": "Continue",
     "@continue": {
-      "context": "form_post.html:25:28-48, pages/consent.html:67:28-48, pages/device_consent.html:133:13-33, pages/device_link.html:40:26-46, pages/login.html:68:30-50, pages/reauth.html:32:28-48, pages/recovery/start.html:38:26-46, pages/register/password.html:77:26-46, pages/register/steps/display_name.html:43:28-48, pages/register/steps/registration_token.html:41:28-48, pages/register/steps/verify_email.html:51:26-46, pages/sso.html:50:28-48"
+      "context": "form_post.html:25:28-48, pages/consent.html:67:28-48, pages/device_consent.html:133:13-33, pages/device_link.html:42:26-46, pages/login.html:69:30-50, pages/reauth.html:34:28-48, pages/recovery/start.html:38:26-46, pages/register/password.html:79:26-46, pages/register/steps/display_name.html:43:28-48, pages/register/steps/registration_token.html:41:28-48, pages/register/steps/verify_email.html:51:26-46, pages/sso.html:50:28-48"
     },
     "create_account": "Create Account",
     "@create_account": {
-      "context": "pages/login.html:94:33-59, pages/upstream_oauth2/do_register.html:192:26-52"
+      "context": "pages/login.html:95:33-59, pages/upstream_oauth2/do_register.html:193:26-52"
     },
     "sign_in": "Sign in",
     "@sign_in": {
@@ -22,7 +22,7 @@
     },
     "sign_out": "Sign out",
     "@sign_out": {
-      "context": "pages/account/logged_out.html:22:28-48, pages/compat_login_policy_violation.html:28:28-48, pages/index.html:28:28-48, pages/policy_violation.html:38:28-48, pages/upstream_oauth2/link_mismatch.html:24:24-44, pages/upstream_oauth2/suggest_link.html:32:26-46"
+      "context": "pages/account/logged_out.html:22:28-48, pages/compat_login_policy_violation.html:28:28-48, pages/index.html:28:28-48, pages/policy_violation.html:38:28-48, pages/upstream_oauth2/link_mismatch.html:24:24-44, pages/upstream_oauth2/suggest_link.html:34:26-46"
     },
     "skip": "Skip",
     "@skip": {
@@ -34,12 +34,12 @@
     }
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
+    "human_name": "Letro",
     "@human_name": {
       "context": "pages/index.html:15:29-48",
       "description": "Human readable name of the application"
     },
-    "name": "matrix-authentication-service",
+    "name": "letro authentication service",
     "@name": {
       "context": "app.html:17:14-27, base.html:24:31-44",
       "description": "Name of the application"
@@ -75,11 +75,11 @@
   "common": {
     "display_name": "Display Name",
     "@display_name": {
-      "context": "pages/register/steps/display_name.html:34:35-59, pages/upstream_oauth2/do_register.html:147:37-61"
+      "context": "pages/register/steps/display_name.html:34:35-59, pages/upstream_oauth2/do_register.html:148:37-61"
     },
     "email_address": "Email address",
     "@email_address": {
-      "context": "pages/recovery/start.html:34:33-58, pages/register/password.html:40:35-60, pages/upstream_oauth2/do_register.html:115:37-62"
+      "context": "pages/recovery/start.html:34:33-58, pages/register/password.html:42:35-60, pages/upstream_oauth2/do_register.html:116:37-62"
     },
     "loading": "Loading…",
     "@loading": {
@@ -87,19 +87,19 @@
     },
     "mxid": "Matrix ID",
     "@mxid": {
-      "context": "pages/upstream_oauth2/do_register.html:93:35-51"
+      "context": "pages/upstream_oauth2/do_register.html:94:35-51"
     },
     "password": "Password",
     "@password": {
-      "context": "pages/login.html:56:37-57, pages/reauth.html:28:35-55, pages/register/password.html:45:33-53"
+      "context": "pages/login.html:57:37-57, pages/reauth.html:30:35-55, pages/register/password.html:47:33-53"
     },
     "password_confirm": "Confirm password",
     "@password_confirm": {
-      "context": "pages/register/password.html:49:33-61"
+      "context": "pages/register/password.html:51:33-61"
     },
-    "username": "Username",
+    "username": "PostNumber",
     "@username": {
-      "context": "pages/login.html:50:37-57, pages/register/index.html:30:35-55, pages/register/password.html:34:33-53, pages/upstream_oauth2/do_register.html:101:35-55, pages/upstream_oauth2/do_register.html:107:39-59"
+      "context": "pages/login.html:51:37-57, pages/register/index.html:31:35-55, pages/register/password.html:36:33-53, pages/upstream_oauth2/do_register.html:102:35-55, pages/upstream_oauth2/do_register.html:108:39-59"
     }
   },
   "error": {
@@ -225,11 +225,11 @@
     "device_code_link": {
       "description": "Link a device",
       "@description": {
-        "context": "pages/device_link.html:19:25-62"
+        "context": "pages/device_link.html:21:25-62"
       },
       "headline": "Enter the code displayed on your device",
       "@headline": {
-        "context": "pages/device_link.html:18:27-61"
+        "context": "pages/device_link.html:20:27-61"
       }
     },
     "device_consent": {
@@ -379,33 +379,38 @@
       "@rate_limit_exceeded": {
         "context": "components/errors.html:15:7-42, pages/recovery/progress.html:26:11-46"
       },
-      "username_all_numeric": "Username cannot consist solely of numbers",
+      "username_all_numeric": "PostNumber cannot consist solely of numbers",
       "@username_all_numeric": {
         "context": "components/field.html:38:11-47"
       },
-      "username_banned": "Username is banned by the server policy",
+      "username_banned": "PostNumber is banned by the server policy",
       "@username_banned": {
         "context": "components/field.html:40:11-42",
-        "description": "Error message shown on registration, when the username matches a pattern that is banned by the server policy."
+        "description": "Error message shown on registration, when the postNumber matches a pattern that is banned by the server policy."
       },
-      "username_invalid_chars": "Username contains invalid characters. Use lowercase letters, numbers, dashes and underscores only.",
+      "username_invalid_chars": "PostNumber contains invalid characters. Use lowercase letters and numbers only.",
       "@username_invalid_chars": {
         "context": "components/field.html:36:11-49"
       },
-      "username_not_allowed": "Username is not allowed by the server policy",
+      "username_not_allowed": "PostNumber is not allowed by the server policy",
       "@username_not_allowed": {
         "context": "components/field.html:42:11-47",
-        "description": "Error message shown on registration, when the username *does not match* any of the patterns that are allowed by the server policy."
+        "description": "Error message shown on registration, when the postNumber *does not match* any of the patterns that are allowed by the server policy."
       },
-      "username_taken": "This username is already taken",
+      "postnumber_reserved": "This PostNumber is reserved and cannot be used for registration",
+      "@postnumber_reserved": {
+        "context": "components/field.html:44:11-47",
+        "description": "Error message shown on registration, when the postNumber is reserved by the postnumber resolver."
+      },
+      "username_taken": "This postNumber is already taken",
       "@username_taken": {
         "context": "components/field.html:29:9-39"
       },
-      "username_too_long": "Username is too long",
+      "username_too_long": "PostNumber is too long",
       "@username_too_long": {
         "context": "components/field.html:34:11-44"
       },
-      "username_too_short": "Username is too short",
+      "username_too_short": "PostNumber is too short",
       "@username_too_short": {
         "context": "components/field.html:32:11-45"
       }
@@ -419,43 +424,43 @@
     "login": {
       "call_to_register": "Don't have an account yet?",
       "@call_to_register": {
-        "context": "pages/login.html:90:13-44"
+        "context": "pages/login.html:91:13-44"
       },
       "continue_with_provider": "Continue with %(provider)s",
       "@continue_with_provider": {
-        "context": "pages/login.html:81:15-67, pages/register/index.html:57:15-67",
+        "context": "pages/login.html:82:15-67, pages/register/index.html:58:15-67",
         "description": "Button to log in with an upstream provider"
       },
-      "description": "Please sign in to continue:",
+      "description": "Unique digital identity for communication",
       "@description": {
-        "context": "pages/login.html:29:29-55"
+        "context": "pages/login.html:30:29-55"
       },
       "forgot_password": "Forgot password?",
       "@forgot_password": {
-        "context": "pages/login.html:61:35-65",
+        "context": "pages/login.html:62:35-65",
         "description": "On the login page, link to the account recovery process"
       },
-      "headline": "Sign in",
+      "headline": "Login with PostNumber",
       "@headline": {
-        "context": "pages/login.html:28:31-54"
+        "context": "pages/login.html:29:31-54"
       },
       "link": {
         "description": "Linking your <span class=\"break-keep text-links\">%(provider)s</span> account",
         "@description": {
-          "context": "pages/login.html:24:29-75"
+          "context": "pages/login.html:25:29-75"
         },
         "headline": "Sign in to link",
         "@headline": {
-          "context": "pages/login.html:22:31-59"
+          "context": "pages/login.html:23:31-59"
         }
       },
       "no_login_methods": "No login methods available.",
       "@no_login_methods": {
-        "context": "pages/login.html:100:11-42"
+        "context": "pages/login.html:101:11-42"
       },
-      "username_or_email": "Username or Email",
+      "username_or_email": "PostNumber / Email",
       "@username_or_email": {
-        "context": "pages/login.html:46:37-69"
+        "context": "pages/login.html:47:37-69"
       }
     },
     "navbar": {
@@ -612,30 +617,30 @@
     "register": {
       "call_to_login": "Already have an account?",
       "@call_to_login": {
-        "context": "pages/register/index.html:63:35-66, pages/register/password.html:80:33-64",
+        "context": "pages/register/index.html:64:35-66, pages/register/password.html:82:33-64",
         "description": "Displayed on the registration page to suggest to log in instead"
       },
       "continue_with_email": "Continue with email address",
       "@continue_with_email": {
-        "context": "pages/register/index.html:45:32-69"
+        "context": "pages/register/index.html:46:32-69"
       },
       "continue_with_password": "Continue with password",
       "@continue_with_password": {
-        "context": "pages/register/index.html:47:32-72"
+        "context": "pages/register/index.html:48:32-72"
       },
       "create_account": {
-        "description": "Choose a username to continue.",
+        "description": "Choose a postNumber to continue.",
         "@description": {
-          "context": "pages/register/index.html:24:29-73"
+          "context": "pages/register/index.html:25:29-73"
         },
         "heading": "Create an account",
         "@heading": {
-          "context": "pages/register/index.html:21:29-69, pages/register/password.html:18:27-67"
+          "context": "pages/register/index.html:22:29-69, pages/register/password.html:20:27-67"
         }
       },
       "terms_of_service": "I agree to the <a href=\"%s\" data-kind=\"primary\" class=\"cpd-link\">Terms and Conditions</a>",
       "@terms_of_service": {
-        "context": "pages/register/password.html:54:35-95, pages/upstream_oauth2/do_register.html:180:35-95"
+        "context": "pages/register/password.html:56:35-95, pages/upstream_oauth2/do_register.html:181:35-95"
       }
     },
     "registration_token": {
@@ -700,21 +705,21 @@
         "choose_username": {
           "description": "This cannot be changed later.",
           "@description": {
-            "context": "pages/upstream_oauth2/do_register.html:52:13-74"
+            "context": "pages/upstream_oauth2/do_register.html:53:13-74"
           },
-          "heading": "Choose your username",
+          "heading": "Choose your postNumber",
           "@heading": {
-            "context": "pages/upstream_oauth2/do_register.html:49:13-70",
-            "description": "Displayed when creating a new account from an SSO login, and the username is not forced"
+            "context": "pages/upstream_oauth2/do_register.html:50:13-70",
+            "description": "Displayed when creating a new account from an SSO login, and the postNumber is not forced"
           }
         },
         "create_account": "Create a new account",
         "@create_account": {
-          "description": "Displayed when creating a new account from an SSO login, and the username is pre-filled and forced"
+          "description": "Displayed when creating a new account from an SSO login, and the postNumber is pre-filled and forced"
         },
         "enforced_by_policy": "Enforced by server policy",
         "@enforced_by_policy": {
-          "context": "pages/upstream_oauth2/do_register.html:97:14-66"
+          "context": "pages/upstream_oauth2/do_register.html:98:14-66"
         },
         "forced_display_name": "Will use the following display name",
         "@forced_display_name": {
@@ -724,27 +729,27 @@
         "@forced_email": {
           "description": "Tells the user which email address will be imported"
         },
-        "forced_localpart": "Will use the following username",
+        "forced_localpart": "Will use the following postNumber",
         "@forced_localpart": {
-          "description": "Tells the user which username will be used"
+          "description": "Tells the user which postNumber will be used"
         },
         "import_data": {
           "description": "Confirm the information that will be linked to your new %(server_name)s account.",
           "@description": {
-            "context": "pages/upstream_oauth2/do_register.html:25:13-104"
+            "context": "pages/upstream_oauth2/do_register.html:26:13-104"
           },
           "heading": "Import your data",
           "@heading": {
-            "context": "pages/upstream_oauth2/do_register.html:22:13-66"
+            "context": "pages/upstream_oauth2/do_register.html:23:13-66"
           }
         },
         "imported_from_upstream": "Imported from your upstream account",
         "@imported_from_upstream": {
-          "context": "pages/upstream_oauth2/do_register.html:122:18-74, pages/upstream_oauth2/do_register.html:154:18-74"
+          "context": "pages/upstream_oauth2/do_register.html:123:18-74, pages/upstream_oauth2/do_register.html:155:18-74"
         },
         "imported_from_upstream_with_name": "Imported from your %(human_name)s account",
         "@imported_from_upstream_with_name": {
-          "context": "pages/upstream_oauth2/do_register.html:120:18-131, pages/upstream_oauth2/do_register.html:152:18-131"
+          "context": "pages/upstream_oauth2/do_register.html:121:18-131, pages/upstream_oauth2/do_register.html:153:18-131"
         },
         "link_existing": "Link to an existing account",
         "@link_existing": {
@@ -752,12 +757,12 @@
         },
         "provider_name": "%(human_name)s account",
         "@provider_name": {
-          "context": "pages/upstream_oauth2/do_register.html:68:14-108"
+          "context": "pages/upstream_oauth2/do_register.html:69:14-108"
         },
         "signup_with_upstream": {
           "heading": "Continue signing up with your %(human_name)s account",
           "@heading": {
-            "context": "pages/upstream_oauth2/do_register.html:37:13-122"
+            "context": "pages/upstream_oauth2/do_register.html:38:13-122"
           }
         },
         "suggested_display_name": "Import display name",
@@ -770,17 +775,17 @@
         },
         "use": "Use",
         "@use": {
-          "context": "pages/upstream_oauth2/do_register.html:138:18-55, pages/upstream_oauth2/do_register.html:171:20-57"
+          "context": "pages/upstream_oauth2/do_register.html:139:18-55, pages/upstream_oauth2/do_register.html:172:20-57"
         }
       },
       "suggest_link": {
         "action": "Link",
         "@action": {
-          "context": "pages/upstream_oauth2/suggest_link.html:27:28-72"
+          "context": "pages/upstream_oauth2/suggest_link.html:29:28-72"
         },
         "heading": "Link to your existing account",
         "@heading": {
-          "context": "pages/upstream_oauth2/suggest_link.html:18:27-72"
+          "context": "pages/upstream_oauth2/suggest_link.html:20:27-72"
         }
       }
     },
diff --git a/translations/et.json b/translations/et.json
index 66f957dac..1fa28477f 100644
--- a/translations/et.json
+++ b/translations/et.json
@@ -11,8 +11,8 @@
     "submit": "Saada"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "OpenID Connect teenuse tuvastusdokument: <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrixi kasutajatunnus",
     "password": "Salasõna",
     "password_confirm": "Korda salasõna",
-    "username": "Kasutajanimi"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Ootamatu viga"
@@ -142,13 +142,14 @@
       "invalid_credentials": "Vigased kasutajatunnused",
       "password_mismatch": "Salasõnad ei klapi omavahel",
       "rate_limit_exceeded": "Sa oled lühikese aja jooksul teinud liiga palju päringuid. Palun oota paar minutit ja proovi uuesti.",
-      "username_all_numeric": "Kasutajanimi ei tohi koosneda vaid numbritest",
-      "username_banned": "Kasutajanimi on serverireeglite alusel keelatud",
-      "username_invalid_chars": "Kasutajanimes on keelatud tähemärke. Palun kasuta vaid väiketähti, numbreid, sidekriipsu ja alakriipsu.",
-      "username_not_allowed": "Kasutajanimi pole serveri reeglite alusel lubatud",
-      "username_taken": "Selline kasutajanimi on juba olemas",
-      "username_too_long": "Kasutajanimi on liiga pikk",
-      "username_too_short": "Kasutajanimi on liiga lühike"
+      "username_all_numeric": "PostNumber ei tohi koosneda vaid numbritest",
+      "username_banned": "PostNumber on serverireeglite alusel keelatud",
+      "username_invalid_chars": "PostNumber sisaldab keelatud tähemärke. Palun kasuta vaid väiketähti ja numbreid.",
+      "username_not_allowed": "PostNumber pole serveri reeglite alusel lubatud",
+      "postnumber_reserved": "See PostNumber on reserveeritud ja seda ei saa registreerimiseks kasutada",
+      "username_taken": "Selline PostNumber on juba olemas",
+      "username_too_long": "PostNumber on liiga pikk",
+      "username_too_short": "PostNumber on liiga lühike"
     },
     "legacy_consent": {
       "this_will_setup": "Sellega seadistad <span>%(client_name)s</span> kliendi kasutama oma <span>%(server_name)s</span> kontot."
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "Sul veel pole kasutajakontot?",
       "continue_with_provider": "Jätka teenusepakkujaga %(provider)s",
-      "description": "Jätkamaks palun logi sisse:",
+      "description": "Unikaalne digitaalne identiteet suhtluseks",
       "forgot_password": "Kas unustasid salasõna?",
-      "headline": "Logi sisse",
+      "headline": "Logi sisse PostNumber-iga",
       "link": {
         "description": "Seome sinu <span class=\"break-keep text-links\">%(provider)s</span> teenusepakkuja kasutajakontot",
         "headline": "Konto sidumiseks logi sisse"
       },
       "no_login_methods": "Ühtegi sisselogimisvõimalust pole saadaval.",
       "separator": "või",
-      "username_or_email": "Kasutajanimi või e-posti aadress"
+      "username_or_email": "PostNumber / E-post"
     },
     "navbar": {
       "my_account": "Minu kasutajakonto",
@@ -220,7 +221,7 @@
       "continue_with_email": "Jätka e-posti aadressiga",
       "continue_with_password": "Jätka salasõnaga",
       "create_account": {
-        "description": "Jätkamiseks vali kasutajanimi.",
+        "description": "Jätkamiseks vali PostNumber.",
         "heading": "Loo kasutajakonto"
       },
       "sign_in_instead": "Siis logi sisse",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "Jätka",
-        "description": "Selle kasutajanime (%(username)s) jaoks on konto olemas, ta saab olemas seotud kasutatava teenuse kontoga.",
+        "description": "Selle PostNumber (%(username)s) jaoks on konto olemas, ta saab olemas seotud kasutatava teenuse kontoga.",
         "heading": "Seo oma olemasoleva kasutajakontoga"
       },
       "register": {
         "choose_username": {
           "description": "Seda ei saa hiljem muuta.",
-          "heading": "Vali oma kasutajanimi"
+          "heading": "Vali oma PostNumber"
         },
         "create_account": "Loo uus kasutajakonto",
         "enforced_by_policy": "Seda rakendatakse serveri reeglite alusel",
         "forced_display_name": "Kasutab järgnevat kuvatavat nime",
         "forced_email": "Kasutab järgnevat e-posti aadressi",
-        "forced_localpart": "Kasutab järgnevat kasutajanime",
+        "forced_localpart": "Kasutab järgnevat PostNumber",
         "import_data": {
           "description": "Kinnita teave, mis seotakse sinu uue kasutajakontoga serveris %(server_name)s.",
           "heading": "Impordi oma andmed"
@@ -286,4 +287,4 @@
       "headline": "Kinnita oma e-posti aadressi õigsust"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/fi.json b/translations/fi.json
index 2eea7d9a1..90936cf62 100644
--- a/translations/fi.json
+++ b/translations/fi.json
@@ -11,8 +11,8 @@
     "submit": "Lähetä"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "OpenID Connect -metatietoasiakirja: <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix tunnus",
     "password": "Salasana",
     "password_confirm": "Vahvista salasana",
-    "username": "Käyttäjänimi"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Odottamaton virhe"
@@ -142,13 +142,14 @@
       "invalid_credentials": "Virheelliset kirjautumistiedot",
       "password_mismatch": "Salasanakentät eivät täsmää",
       "rate_limit_exceeded": "Olet tehnyt liian monta pyyntöä lyhyessä ajassa. Odota muutama minuutti ja yritä uudelleen.",
-      "username_all_numeric": "Käyttäjänimi ei voi koostua pelkästään numeroista",
-      "username_banned": "Palvelinkäytäntö kieltää käyttäjänimen",
-      "username_invalid_chars": "Käyttäjänimi sisältää virheellisiä merkkejä. Käytä vain pieniä kirjaimia, numeroita, viivoja ja alaviivoja.",
-      "username_not_allowed": "Palvelinkäytäntö ei salli käyttäjänimeä",
-      "username_taken": "Tämä käyttäjänimi on jo käytössä.",
-      "username_too_long": "Käyttäjänimi on liian pitkä",
-      "username_too_short": "Käyttäjänimi on liian lyhyt"
+      "username_all_numeric": "PostNumber ei voi koostua pelkästään numeroista",
+      "username_banned": "Palvelinkäytäntö kieltää tämän PostNumber-tunnuksen",
+      "username_invalid_chars": "PostNumber sisältää virheellisiä merkkejä. Käytä vain pieniä kirjaimia ja numeroita.",
+      "username_not_allowed": "Palvelinkäytäntö ei salli tätä PostNumber-tunnusta",
+      "postnumber_reserved": "Tämä PostNumber on varattu eikä sitä voi käyttää rekisteröitymiseen",
+      "username_taken": "Tämä PostNumber on jo käytössä.",
+      "username_too_long": "PostNumber on liian pitkä",
+      "username_too_short": "PostNumber on liian lyhyt"
     },
     "legacy_consent": {
       "this_will_setup": "Tämä yhdistää <span>%(client_name)s</span> -sovelluksen <span>%(server_name)s</span> tiliisi."
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "Eikö sinulla ole vielä tiliä?",
       "continue_with_provider": "Jatka %(provider)s -tilillä",
-      "description": "Kirjaudu sisään jatkaaksesi:",
+      "description": "Ainutlaatuinen digitaalinen identiteetti viestintään",
       "forgot_password": "Unohditko salasanasi?",
-      "headline": "Kirjaudu sisään",
+      "headline": "Kirjaudu sisään PostNumber-tunnuksella",
       "link": {
         "description": "Yhdistetään <span class=\"break-keep text-links\">%(provider)s</span> -tiliäsi",
         "headline": "Kirjaudu sisään yhdistääksesi tilit"
       },
       "no_login_methods": "Kirjautumistapoja ei ole käytettävissä.",
       "separator": "Tai",
-      "username_or_email": "Käyttäjänimi tai Sähköpostiosoite"
+      "username_or_email": "PostNumber / Sähköposti"
     },
     "navbar": {
       "my_account": "Oma tili",
@@ -220,7 +221,7 @@
       "continue_with_email": "Jatka sähköpostiosoitteella",
       "continue_with_password": "Jatka salasanalla",
       "create_account": {
-        "description": "Valitse käyttäjänimi jatkaaksesi.",
+        "description": "Valitse PostNumber jatkaaksesi.",
         "heading": "Luo tili"
       },
       "sign_in_instead": "Kirjaudu sisään sen sijaan",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "Jatka",
-        "description": "Tälle käyttäjänimelle (%(username)s) on jo olemassa tili, joka yhdistetään tähän tiliin.",
+        "description": "Tälle PostNumber-tunnukselle (%(username)s) on jo olemassa tili, joka yhdistetään tähän tiliin.",
         "heading": "Yhdistä olemassa olevaan tiliisi"
       },
       "register": {
         "choose_username": {
           "description": "Tätä ei voi muuttaa myöhemmin.",
-          "heading": "Valitse käyttäjänimesi"
+          "heading": "Valitse PostNumber"
         },
         "create_account": "Luo uusi tili",
         "enforced_by_policy": "Palvelinkäytännön pakottama",
         "forced_display_name": "Käytetään seuraavaa näyttönimeä",
         "forced_email": "Käytetään seuraavaa sähköpostiosoitetta",
-        "forced_localpart": "Käytetään seuraavaa käyttäjänimeä",
+        "forced_localpart": "Käytetään seuraavaa PostNumber-tunnusta",
         "import_data": {
           "description": "Vahvista tiedot, jotka liitetään uuteen %(server_name)s -tiliisi.",
           "heading": "Tuo tietosi"
@@ -286,4 +287,4 @@
       "headline": "Vahvista sähköpostiosoitteesi"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/fr.json b/translations/fr.json
index e084bb929..22745b0b7 100644
--- a/translations/fr.json
+++ b/translations/fr.json
@@ -11,8 +11,8 @@
     "submit": "Soumettre"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "Document de découverte OpenID Connect : <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix ID",
     "password": "Mot de passe",
     "password_confirm": "Confirmer le mot de passe",
-    "username": "Nom d’utilisateur"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Erreur inattendue"
@@ -142,13 +142,14 @@
       "invalid_credentials": "Identifiants invalides",
       "password_mismatch": "Les champs du mot de passe ne correspondent pas.",
       "rate_limit_exceeded": "Vous avez effectué trop de requêtes sur une courte période. Veuillez patienter quelques minutes et réessayer.",
-      "username_all_numeric": "Le nom d'utilisateur ne peut pas être composé uniquement de chiffres",
-      "username_banned": "Ce nom d'utilisateur est interdit par la politique du serveur",
-      "username_invalid_chars": "Le nom d'utilisateur contient des caractères non valides. Utilisez uniquement des lettres minuscules, des chiffres, des tirets et des traits de soulignement.",
-      "username_not_allowed": "Ce nom d'utilisateur n'est pas autorisé par la politique du serveur",
-      "username_taken": "Ce nom d'utilisateur est déjà utilisé",
-      "username_too_long": "Le nom d'utilisateur est trop long",
-      "username_too_short": "Le nom d'utilisateur est trop court"
+      "username_all_numeric": "PostNumber ne peut pas être composé uniquement de chiffres",
+      "username_banned": "Ce PostNumber est interdit par la politique du serveur",
+      "username_invalid_chars": "PostNumber contient des caractères non valides. Utilisez uniquement des lettres minuscules et des chiffres.",
+      "username_not_allowed": "Ce PostNumber n'est pas autorisé par la politique du serveur",
+      "postnumber_reserved": "Ce PostNumber est réservé et ne peut pas être utilisé pour l'inscription",
+      "username_taken": "Ce PostNumber est déjà utilisé",
+      "username_too_long": "PostNumber est trop long",
+      "username_too_short": "PostNumber est trop court"
     },
     "legacy_consent": {
       "this_will_setup": "Continuer connectera <span>%(client_name)s</span> avec votre compte <span>%(server_name)s</span>."
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "Vous n’avez pas encore de compte ?",
       "continue_with_provider": "Poursuivre avec %(provider)s",
-      "description": "Veuillez vous connecter pour continuer :",
+      "description": "Identité numérique unique pour la communication",
       "forgot_password": "Mot de passe oublié ?",
-      "headline": "Se connecter",
+      "headline": "Se connecter avec PostNumber",
       "link": {
         "description": "Associer votre compte <span class=\"break-keep text-links\">%(provider)s</span>",
         "headline": "Se connecter pour associer"
       },
       "no_login_methods": "Aucune méthode de connexion n'est disponible.",
       "separator": "Ou",
-      "username_or_email": "Nom d'utilisateur ou adresse email"
+      "username_or_email": "PostNumber / E-mail"
     },
     "navbar": {
       "my_account": "Mon compte",
@@ -220,7 +221,7 @@
       "continue_with_email": "Continuer avec une adresse e-mail",
       "continue_with_password": "Continuer avec un mot de passe",
       "create_account": {
-        "description": "Choisissez un nom d'utilisateur pour continuer.",
+        "description": "Choisissez un PostNumber pour continuer.",
         "heading": "Créer un compte"
       },
       "sign_in_instead": "Se connecter",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "Continuer",
-        "description": "Un compte existe pour ce nom d'utilisateur (%(username)s), il sera associé à ce compte en amont.",
+        "description": "Un compte existe pour ce PostNumber (%(username)s), il sera associé à ce compte en amont.",
         "heading": "Associer votre compte existant"
       },
       "register": {
         "choose_username": {
           "description": "Cela ne peut pas être modifié ultérieurement.",
-          "heading": "Choisissez votre nom d'utilisateur"
+          "heading": "Choisissez votre PostNumber"
         },
         "create_account": "Créer un nouveau compte",
         "enforced_by_policy": "Importé selon la politique du serveur",
         "forced_display_name": "Utilisera le pseudonyme suivant",
         "forced_email": "Utilisera l’adresse e-mail suivante",
-        "forced_localpart": "Utilisera le nom d'utilisateur suivant",
+        "forced_localpart": "Utilisera le PostNumber suivant",
         "import_data": {
           "description": "Confirmez les informations qui seront associées à votre nouveau compte %(server_name)s.",
           "heading": "Importez vos données"
@@ -286,4 +287,4 @@
       "headline": "Vérifiez votre adresse e-mail"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/hu.json b/translations/hu.json
index dd1857f59..178f2ed31 100644
--- a/translations/hu.json
+++ b/translations/hu.json
@@ -11,8 +11,8 @@
     "submit": "Elküldés"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "OpenID Connect felfedezési dokumentum: <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix-azonosító",
     "password": "Jelszó",
     "password_confirm": "Jelszó megerősítése",
-    "username": "Felhasználói név"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Váratlan hiba"
@@ -142,13 +142,14 @@
       "invalid_credentials": "Érvénytelen hitelesítő adatok",
       "password_mismatch": "A jelszómezők nem egyeznek",
       "rate_limit_exceeded": "Túl sok kérést adott fel egy rövid időszak alatt. Várjon néhány percet, és próbálja újra.",
-      "username_all_numeric": "A felhasználónév nem állhat pusztán számokból",
-      "username_banned": "A felhasználónevet a kiszolgáló-házirend tiltja",
-      "username_invalid_chars": "A felhasználónév érvénytelen karaktereket tartalmaz. Csak kisbetűket, számokat, kötőjeleket és aláhúzásokat használjon.",
-      "username_not_allowed": "A felhasználónevet nem engedélyezi a kiszolgáló-házirend",
-      "username_taken": "A felhasználónév már foglalt",
-      "username_too_long": "A felhasználónév túl hosszú",
-      "username_too_short": "A felhasználónév túl rövid"
+      "username_all_numeric": "PostNumber nem állhat pusztán számokból",
+      "username_banned": "A PostNumber-t a kiszolgáló-házirend tiltja",
+      "username_invalid_chars": "PostNumber érvénytelen karaktereket tartalmaz. Csak kisbetűket és számokat használjon.",
+      "username_not_allowed": "A PostNumber-t nem engedélyezi a kiszolgáló-házirend",
+      "postnumber_reserved": "Ez a PostNumber foglalt és nem használható regisztrációhoz",
+      "username_taken": "PostNumber már foglalt",
+      "username_too_long": "PostNumber túl hosszú",
+      "username_too_short": "PostNumber túl rövid"
     },
     "legacy_consent": {
       "this_will_setup": "Egy beállítja a(z) <span>%(client_name)s</span> klienst a(z) <span>%(server_name)s</span> fiókjával."
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "Még nincs fiókja?",
       "continue_with_provider": "Folytatás ezzel a szolgáltatóval: %(provider)s",
-      "description": "Jelentkezzen be a folytatáshoz:",
+      "description": "Egyedi digitális azonosító a kommunikációhoz",
       "forgot_password": "Elfelejtette a jelszavát?",
-      "headline": "Bejelentkezés",
+      "headline": "Bejelentkezés PostNumber-rel",
       "link": {
         "description": "A(z) <span class=\"break-keep text-links\">%(provider)s</span> fiókjának összekötése",
         "headline": "Bejelentkezés az összekötéshez"
       },
       "no_login_methods": "Nem érhetőek el bejelentkezési módok.",
       "separator": "Vagy",
-      "username_or_email": "Felhasználónév vagy e-mail-cím"
+      "username_or_email": "PostNumber / E-mail"
     },
     "navbar": {
       "my_account": "Saját fiók",
@@ -220,7 +221,7 @@
       "continue_with_email": "Folytatás az e-mail-címével",
       "continue_with_password": "Folytatás jelszóval",
       "create_account": {
-        "description": "A folytatáshoz válasszon felhasználónevet.",
+        "description": "A folytatáshoz válasszon PostNumber-t.",
         "heading": "Fiók létrehozása"
       },
       "sign_in_instead": "Bejelentkezés",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "Folytatás",
-        "description": "A felhasználónévhez (%(username)s) már létezik fiók, amely ehhez a felülről érkező fiókhoz lesz kötve.",
+        "description": "Ehhez a PostNumber-hez (%(username)s) már létezik fiók, amely ehhez a felülről érkező fiókhoz lesz kötve.",
         "heading": "Meglévő fiók összekötése"
       },
       "register": {
         "choose_username": {
           "description": "Ez később nem változtatható meg.",
-          "heading": "Válasszon felhasználónevet"
+          "heading": "Válasszon PostNumber-t"
         },
         "create_account": "Új fiók létrehozása",
         "enforced_by_policy": "Kiszolgáló-házirend által betartatva",
         "forced_display_name": "A következő megjelenítési név fogja használni",
         "forced_email": "A következő e-mail-címet fogja használni",
-        "forced_localpart": "A következő felhasználónevet fogja használni",
+        "forced_localpart": "A következő PostNumber-t fogja használni",
         "import_data": {
           "description": "Erősítse meg az információkat, melyek a(z) %(server_name)s fiókjához lesznek kapcsolva.",
           "heading": "Saját adatok importálása"
@@ -286,4 +287,4 @@
       "headline": "E-mail-cím ellenőrzése"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/nb-NO.json b/translations/nb-NO.json
index e2a8bde58..3526ffbad 100644
--- a/translations/nb-NO.json
+++ b/translations/nb-NO.json
@@ -11,8 +11,8 @@
     "submit": "Send"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "OpenID Connect oppdagelsesdokument: <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix ID",
     "password": "Passord",
     "password_confirm": "Bekreft passord",
-    "username": "Brukernavn"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Uventet feil"
@@ -142,13 +142,14 @@
       "invalid_credentials": "Ugyldig legitimasjon",
       "password_mismatch": "Passordfeltene stemmer ikke overens",
       "rate_limit_exceeded": "Du har kommet med for mange forespørsler på kort tid. Vent noen minutter og prøv igjen.",
-      "username_all_numeric": "Brukernavn kan ikke bare bestå av tall",
-      "username_banned": "Brukernavn er utestengt av serverpolicyen",
-      "username_invalid_chars": "Brukernavnet inneholder ugyldige tegn. Bruk bare små bokstaver, tall, bindestrek og understrek.",
-      "username_not_allowed": "Brukernavnet er ikke tillatt av serverpolicyen",
-      "username_taken": "Dette brukernavnet er allerede tatt",
-      "username_too_long": "Brukernavnet er for langt",
-      "username_too_short": "Brukernavnet er for kort"
+      "username_all_numeric": "PostNumber kan ikke bare bestå av tall",
+      "username_banned": "PostNumber er utestengt av serverpolicyen",
+      "username_invalid_chars": "PostNumber inneholder ugyldige tegn. Bruk bare små bokstaver og tall.",
+      "username_not_allowed": "PostNumber er ikke tillatt av serverpolicyen",
+      "postnumber_reserved": "Dette PostNumber er reservert og kan ikke brukes til registrering",
+      "username_taken": "Dette PostNumber er allerede tatt",
+      "username_too_long": "PostNumber er for langt",
+      "username_too_short": "PostNumber er for kort"
     },
     "legacy_consent": {
       "this_will_setup": "Dette vil konfigurere <span>%(client_name)s</span> med din <span>%(server_name)s</span> konto."
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "Har du ikke en konto ennå?",
       "continue_with_provider": "Fortsett med %(provider)s",
-      "description": "Logg på for å fortsette:",
+      "description": "Unik digital identitet for kommunikasjon",
       "forgot_password": "Glemt passordet?",
-      "headline": "Logg inn",
+      "headline": "Logg inn med PostNumber",
       "link": {
         "description": "Kobler din <span class=\"break-keep text-links\">%(provider)s</span> konto",
         "headline": "Logg inn for å koble"
       },
       "no_login_methods": "Ingen påloggingsmetoder tilgjengelig.",
       "separator": "Eller",
-      "username_or_email": "Brukernavn eller e-postadresse"
+      "username_or_email": "PostNumber / E-post"
     },
     "navbar": {
       "my_account": "Min konto",
@@ -220,7 +221,7 @@
       "continue_with_email": "Fortsett med e-postadresse",
       "continue_with_password": "Fortsett med passord",
       "create_account": {
-        "description": "Velg et brukernavn for å fortsette.",
+        "description": "Velg et PostNumber for å fortsette.",
         "heading": "Opprett en konto"
       },
       "sign_in_instead": "Logg på i stedet",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "Fortsett",
-        "description": "Det finnes en konto for dette brukernavnet (%(username)s). Den vil bli lenket til denne oppstrømskontoen.",
+        "description": "Det finnes en konto for dette PostNumber (%(username)s). Den vil bli lenket til denne oppstrømskontoen.",
         "heading": "Koble til din eksisterende konto"
       },
       "register": {
         "choose_username": {
           "description": "Dette kan ikke endres senere.",
-          "heading": "Velg ditt brukernavn"
+          "heading": "Velg ditt PostNumber"
         },
         "create_account": "Opprett en ny konto",
         "enforced_by_policy": "Håndhevet av serverpolicy",
         "forced_display_name": "Vil bruke følgende visningsnavn",
         "forced_email": "Vil bruke følgende e-postadresse",
-        "forced_localpart": "Vil bruke følgende brukernavn",
+        "forced_localpart": "Vil bruke følgende PostNumber",
         "import_data": {
           "description": "Bekreft informasjonen som vil bli knyttet til din nye %(server_name)s konto.",
           "heading": "Importer dataene dine"
@@ -286,4 +287,4 @@
       "headline": "Bekreft e-postadressen din"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/nl.json b/translations/nl.json
index 44f7989e6..b56b409ae 100644
--- a/translations/nl.json
+++ b/translations/nl.json
@@ -10,8 +10,8 @@
     "submit": "Bevestigen"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service"
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service"
   },
   "branding": {
     "privacy_policy": {
@@ -30,7 +30,7 @@
     "mxid": "Matrix ID",
     "password": "Wachtwoord",
     "password_confirm": "Bevestig wachtwoord",
-    "username": "Gebruikersnaam"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Onverwachte fout"
@@ -49,7 +49,7 @@
     },
     "login": {
       "continue_with_provider": "Doorgaan met %(provider)s",
-      "headline": "Inloggen",
+      "headline": "Inloggen met PostNumber",
       "separator": "Of"
     },
     "navbar": {
@@ -62,11 +62,11 @@
       },
       "register": {
         "choose_username": {
-          "heading": "Kies uw gebruikersnaam"
+          "heading": "Kies uw PostNumber"
         },
         "create_account": "Nieuw account aanmaken",
         "forced_email": "De volgende e-mailadres zal worden gebruikt",
-        "forced_localpart": "De volgende gebruikersnaam zal worden gebruikt",
+        "forced_localpart": "De volgende PostNumber zal worden gebruikt",
         "import_data": {
           "heading": "Importeer uw data"
         },
@@ -81,4 +81,4 @@
       "headline": "Verifieer uw e-mailadres"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/pl.json b/translations/pl.json
index 96107ac2f..c25a36b71 100644
--- a/translations/pl.json
+++ b/translations/pl.json
@@ -11,8 +11,8 @@
     "submit": "Wyślij"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "Dokument odkrywania OpenID Connect:<a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix ID",
     "password": "Hasło",
     "password_confirm": "Potwierdź hasło",
-    "username": "Nazwa użytkownika"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Nieoczekiwany błąd"
@@ -142,13 +142,14 @@
       "invalid_credentials": "Nieprawidłowe dane uwierzytelniające",
       "password_mismatch": "Pola hasła nie pasują do siebie",
       "rate_limit_exceeded": "W krótkim czasie wysłałeś zbyt wiele żądań. Poczekaj kilka minut i spróbuj ponownie.",
-      "username_all_numeric": "Nazwa użytkownika nie może składać się wyłącznie z cyfr",
-      "username_banned": "Nazwa użytkownika jest zablokowana przez politykę serwera",
-      "username_invalid_chars": "Nazwa użytkownika zawiera nieprawidłowe znaki. Używaj tylko małych liter, cyfr, myślników i podkreśleń.",
-      "username_not_allowed": "Nazwa użytkownika nie jest dozwolona przez politykę serwera",
-      "username_taken": "Ta nazwa użytkownika jest już zajęta",
-      "username_too_long": "Nazwa użytkownika jest za długa",
-      "username_too_short": "Nazwa użytkownika jest za krótka"
+      "username_all_numeric": "PostNumber nie może składać się wyłącznie z cyfr",
+      "username_banned": "PostNumber jest zablokowany przez politykę serwera",
+      "username_invalid_chars": "PostNumber zawiera nieprawidłowe znaki. Używaj tylko małych liter i cyfr.",
+      "username_not_allowed": "PostNumber nie jest dozwolony przez politykę serwera",
+      "postnumber_reserved": "Ten PostNumber jest zarezerwowany i nie może być użyty do rejestracji",
+      "username_taken": "Ten PostNumber jest już zajęty",
+      "username_too_long": "PostNumber jest za długi",
+      "username_too_short": "PostNumber jest za krótki"
     },
     "legacy_consent": {
       "this_will_setup": "Spowoduje to skonfigurowanie <span>%(client_name)s</span> z kontem <span>%(server_name)s</span>."
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "Nie masz jeszcze konta?",
       "continue_with_provider": "Kontynuuj z %(provider)s",
-      "description": "Zaloguj się aby kontynuować:",
+      "description": "Unikalna tożsamość cyfrowa do komunikacji",
       "forgot_password": "Zapomniałeś hasła?",
-      "headline": "Zaloguj się",
+      "headline": "Zaloguj się z PostNumber",
       "link": {
         "description": "Łączenie twojego <span class=\"break-keep text-links\">%(provider)s</span> konta",
         "headline": "Zaloguj się, aby połączyć"
       },
       "no_login_methods": "Brak dostępnych metod logowania.",
       "separator": "Lub",
-      "username_or_email": "Nazwa użytkownika lub adres e-mail"
+      "username_or_email": "PostNumber / E-mail"
     },
     "navbar": {
       "my_account": "Moje konto",
@@ -220,7 +221,7 @@
       "continue_with_email": "Kontynuuj z adresem e-mail",
       "continue_with_password": "Kontynuuj z hasłem",
       "create_account": {
-        "description": "Wybierz nazwę użytkownika, aby kontynuować.",
+        "description": "Wybierz PostNumber, aby kontynuować.",
         "heading": "Utwórz konto"
       },
       "sign_in_instead": "Zamiast tego zaloguj się",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "Kontynuuj",
-        "description": "Istnieje konto o tej nazwie użytkownika (%(username)s), zostanie ono powiązane z tym kontem nadrzędnym.",
+        "description": "Istnieje konto o tym PostNumber (%(username)s), zostanie ono powiązane z tym kontem nadrzędnym.",
         "heading": "Połącz z istniejącym kontem"
       },
       "register": {
         "choose_username": {
           "description": "Tego ustawienia nie można później zmienić.",
-          "heading": "Wybierz swoją nazwę użytkownika"
+          "heading": "Wybierz swój PostNumber"
         },
         "create_account": "Utwórz nowe konto",
         "enforced_by_policy": "Wymuszane przez politykę serwera",
         "forced_display_name": "Zostanie użyta następująca nazwa wyświetlana",
         "forced_email": "Będzie używany następujący adres e-mail",
-        "forced_localpart": "Będzie używana następująca nazwa użytkownika",
+        "forced_localpart": "Będzie używany następujący PostNumber",
         "import_data": {
           "description": "Potwierdź informacje, które zostaną powiązane z Twoim nowym kontem %(server_name)s.",
           "heading": "Importuj swoje dane"
@@ -286,4 +287,4 @@
       "headline": "Zweryfikuj swój adres e-mail"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/pt.json b/translations/pt.json
index f25dc4089..af1981538 100644
--- a/translations/pt.json
+++ b/translations/pt.json
@@ -11,8 +11,8 @@
     "submit": "Enviar"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "Documento de descoberta do OpenID Connect: <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "ID do Matrix",
     "password": "Palavra-passe",
     "password_confirm": "Confirmar palavra-passe",
-    "username": "Nome de utilizador"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Erro inesperado"
@@ -137,27 +137,28 @@
       "invalid_credentials": "Credenciais inválidas",
       "password_mismatch": "Os campos de palavra-passe não correspondem",
       "rate_limit_exceeded": "Efetuou demasiadas solicitações num curto espaço de tempo. Aguarde alguns minutos e tente novamente.",
-      "username_all_numeric": "O nome de utilizador não pode ser constituído apenas por números",
-      "username_banned": "O nome de utilizador é proibido pela política do servidor",
-      "username_invalid_chars": "O nome de utilizador contém carateres inválidos. Utilize apenas letras minúsculas, números, traços e sublinhados.",
-      "username_not_allowed": "O nome de utilizador não é permitido pela política do servidor",
-      "username_taken": "Este nome de utilizador já foi utilizado",
-      "username_too_long": "O nome de utilizador é demasiado longo",
-      "username_too_short": "O nome de utilizador é demasiado curto"
+      "username_all_numeric": "O PostNumber não pode ser constituído apenas por números",
+      "username_banned": "O PostNumber é proibido pela política do servidor",
+      "username_invalid_chars": "O PostNumber contém carateres inválidos. Utilize apenas letras minúsculas e números.",
+      "username_not_allowed": "O PostNumber não é permitido pela política do servidor",
+      "postnumber_reserved": "Este PostNumber está reservado e não pode ser utilizado para registo",
+      "username_taken": "Este PostNumber já foi utilizado",
+      "username_too_long": "O PostNumber é demasiado longo",
+      "username_too_short": "O PostNumber é demasiado curto"
     },
     "login": {
       "call_to_register": "Ainda não tem uma conta?",
       "continue_with_provider": "Continue com %(provider)s",
-      "description": "Inicie sessão para continuar:",
+      "description": "Identidade digital única para comunicação",
       "forgot_password": "Esqueceu-se da palavra-passe?",
-      "headline": "Iniciar sessão",
+      "headline": "Iniciar sessão com PostNumber",
       "link": {
         "description": "Vinculando sua conta <span class=\"break-keep text-links\">%(provider)s</span>",
         "headline": "Faça login para vincular"
       },
       "no_login_methods": "Não há métodos de login disponíveis.",
       "separator": "Ou",
-      "username_or_email": "Nome de utilizador ou e-mail"
+      "username_or_email": "PostNumber / E-mail"
     },
     "navbar": {
       "my_account": "A minha conta",
@@ -211,7 +212,7 @@
       "call_to_login": "Já tem uma conta?",
       "continue_with_email": "Continuar com endereço de e-mail",
       "create_account": {
-        "description": "Escolha um nome de utilizador para continuar.",
+        "description": "Escolha um PostNumber para continuar.",
         "heading": "Criar uma conta"
       },
       "sign_in_instead": "Em vez disso, inicie sessão",
@@ -225,7 +226,7 @@
     "scope": {
       "edit_profile": "Editar o seu perfil e detalhes de contacto",
       "manage_sessions": "Gerir os seus dispositivos e sessões",
-      "mas_admin": "Administrar qualquer usuário no matrix-authentication-service",
+      "mas_admin": "Administrar qualquer usuário no letro-authentication-service",
       "send_messages": "Envie novas mensagens em seu nome",
       "synapse_admin": "Administrar o servidor Synapse",
       "view_messages": "Ver as mensagens e os dados existentes",
@@ -242,13 +243,13 @@
       "register": {
         "choose_username": {
           "description": "Isto não pode ser alterado posteriormente.",
-          "heading": "Escolha o seu nome de utilizador"
+          "heading": "Escolha o seu PostNumber"
         },
         "create_account": "Criar uma nova conta",
         "enforced_by_policy": "Imposto pela política do servidor",
         "forced_display_name": "Utilizará o seguinte nome de exibição",
         "forced_email": "Usará o seguinte endereço de e-mail",
-        "forced_localpart": "Utilizará o seguinte nome de utilizador",
+        "forced_localpart": "Utilizará o seguinte PostNumber",
         "import_data": {
           "description": "Confirme as informações que serão vinculadas à sua nova conta %(server_name)s.",
           "heading": "Importe os seus dados"
@@ -276,4 +277,4 @@
       "headline": "Verifique o seu e-mail"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/ru.json b/translations/ru.json
index 8721623cf..0b49cd97f 100644
--- a/translations/ru.json
+++ b/translations/ru.json
@@ -11,8 +11,8 @@
     "submit": "Отправить"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "OpenID Connect документ обнаружения: <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\"> %(discovery_url)s </a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix ID",
     "password": "Пароль",
     "password_confirm": "Подтверждение пароля",
-    "username": "Псевдоним"
+    "username": "ПостНамбер"
   },
   "error": {
     "unexpected": "Непредвиденная ошибка"
@@ -142,13 +142,14 @@
       "invalid_credentials": "Неверные учётные данные",
       "password_mismatch": "Поля пароля не совпадают",
       "rate_limit_exceeded": "Вы делаете запросы слишком часто. Пожалуйста, подождите несколько минут и повторите попытку.",
-      "username_all_numeric": "Имя пользователя не может состоять только из цифр",
-      "username_banned": "Имя пользователя запрещено политикой сервера",
-      "username_invalid_chars": "Имя пользователя содержит недопустимые символы. Используйте только строчные буквы латиницы, цифры, тире и символы подчеркивания.",
-      "username_not_allowed": "Имя пользователя не разрешено политикой сервера",
-      "username_taken": "Это имя пользователя уже занято",
-      "username_too_long": "Имя пользователя слишком длинное",
-      "username_too_short": "Имя пользователя слишком короткое"
+      "username_all_numeric": "ПостНамбер не может состоять только из цифр",
+      "username_banned": "ПостНамбер запрещён политикой сервера",
+      "username_invalid_chars": "ПостНамбер содержит недопустимые символы. Используйте только строчные буквы латиницы и цифры.",
+      "username_not_allowed": "ПостНамбер не разрешён политикой сервера",
+      "postnumber_reserved": "Этот ПостНамбер зарезервирован и не может быть использован для регистрации",
+      "username_taken": "Этот ПостНамбер уже занят",
+      "username_too_long": "ПостНамбер слишком длинный",
+      "username_too_short": "ПостНамбер слишком короткий"
     },
     "legacy_consent": {
       "this_will_setup": "Это свяжет <span>%(client_name)s</span> с вашей учётной записью на <span>%(server_name)s</span>"
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "Ещё нет аккаунта?",
       "continue_with_provider": "Продолжить с %(provider)s",
-      "description": "Пожалуйста, войдите, чтобы продолжить:",
+      "description": "Уникальная цифровая идентичность для общения",
       "forgot_password": "Забыли пароль?",
-      "headline": "Войти",
+      "headline": "Войти через ПостНамбер",
       "link": {
         "description": "Привязка учетной записи <span class=\"break-keep text-links\">%(provider)s</span>",
         "headline": "Войдите, чтобы перейти по ссылке"
       },
       "no_login_methods": "Нет доступных методов входа.",
       "separator": "Или",
-      "username_or_email": "Имя пользователя или электронная почта"
+      "username_or_email": "ПостНамбер / Эл. почта"
     },
     "navbar": {
       "my_account": "Моя учётная запись",
@@ -220,7 +221,7 @@
       "continue_with_email": "Продолжить с адресом электронной почты",
       "continue_with_password": "Продолжить с паролем",
       "create_account": {
-        "description": "Выберите имя пользователя, чтобы продолжить.",
+        "description": "Выберите ПостНамбер, чтобы продолжить.",
         "heading": "Создать учётную запись"
       },
       "sign_in_instead": "Вместо этого войдите",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "Продолжить",
-        "description": "Для этого имени пользователя (%(username)s) существует учетная запись, она будет связана с этой учетной записью.",
+        "description": "Для этого ПостНамбера (%(username)s) существует учётная запись, она будет связана с этой учётной записью.",
         "heading": "Связать с существующим аккаунтом"
       },
       "register": {
         "choose_username": {
           "description": "Это нельзя будет изменить позже.",
-          "heading": "Выберите имя пользователя"
+          "heading": "Выберите ПостНамбер"
         },
         "create_account": "Создать новую учётную запись",
         "enforced_by_policy": "Применяемая политикой сервера",
         "forced_display_name": "Будет использоваться следующее отображаемое имя",
         "forced_email": "Будет использоваться следующий адрес электронной почты",
-        "forced_localpart": "Будет использоваться следующее имя пользователя",
+        "forced_localpart": "Будет использоваться следующий ПостНамбер",
         "import_data": {
           "description": "Подтвердите информацию, которая будет привязана к вашей новой учетной записи на %(server_name)s.",
           "heading": "Импортируйте данные"
@@ -286,4 +287,4 @@
       "headline": "Подтвердите электронную почту"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/sv.json b/translations/sv.json
index cea9c41a0..9dabf04f2 100644
--- a/translations/sv.json
+++ b/translations/sv.json
@@ -11,8 +11,8 @@
     "submit": "Skicka in"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "Dokument för OpenID Connect-identifiering: <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix ID",
     "password": "Lösenord",
     "password_confirm": "Bekräfta lösenordet",
-    "username": "Användarnamn"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "Oväntat fel"
@@ -118,18 +118,19 @@
       "invalid_credentials": "Ogiltiga autentiseringsuppgifter",
       "password_mismatch": "Lösenordsfälten matchar inte",
       "rate_limit_exceeded": "Du har gjort för många förfrågningar under en kort period. Vänta några minuter och försök igen.",
-      "username_all_numeric": "Användarnamn kan inte enbart bestå av siffror",
-      "username_invalid_chars": "Användarnamnet innehåller ogiltiga tecken. Använd endast små bokstäver, siffror, streck och understreck.",
-      "username_taken": "Detta användarnamn är redan upptaget",
-      "username_too_long": "Användarnamnet är för långt",
-      "username_too_short": "Användarnamnet är för kort"
+      "username_all_numeric": "PostNumber kan inte enbart bestå av siffror",
+      "username_invalid_chars": "PostNumber innehåller ogiltiga tecken. Använd endast små bokstäver och siffror.",
+      "postnumber_reserved": "Detta PostNumber är reserverat och kan inte användas för registrering",
+      "username_taken": "Detta PostNumber är redan upptaget",
+      "username_too_long": "PostNumber är för långt",
+      "username_too_short": "PostNumber är för kort"
     },
     "login": {
       "call_to_register": "Har du inget konto ännu?",
       "continue_with_provider": "Fortsätt med %(provider)s",
-      "description": "Logga in för att fortsätta:",
+      "description": "Unik digital identitet för kommunikation",
       "forgot_password": "Glömt ditt lösenord?",
-      "headline": "Logga in",
+      "headline": "Logga in med PostNumber",
       "link": {
         "description": "Länka ditt <span class=\"break-keep text-links\">%(provider)s</span> konto",
         "headline": "Logga in för att länka"
@@ -189,7 +190,7 @@
       "call_to_login": "Har redan ett konto",
       "continue_with_email": "Fortsätt med e-postadress",
       "create_account": {
-        "description": "Välj ett användarnamn för att fortsätta.",
+        "description": "Välj ett PostNumber för att fortsätta.",
         "heading": "Skapa ett konto"
       },
       "sign_in_instead": "Logga in istället",
@@ -198,7 +199,7 @@
     "scope": {
       "edit_profile": "Ändra din profil och kontaktuppgifter",
       "manage_sessions": "Hantera dina enheter och sessioner",
-      "mas_admin": "Administrera valfri användare på matrix-authentication-service",
+      "mas_admin": "Administrera valfri användare på letro-authentication-service",
       "send_messages": "Skicka nya meddelanden för din räkning",
       "synapse_admin": "Administrera Synapse-hemservern",
       "view_messages": "Visa dina befintliga meddelanden och data",
@@ -215,13 +216,13 @@
       "register": {
         "choose_username": {
           "description": "Detta kan inte ändras senare.",
-          "heading": "Välj ditt användarnamn"
+          "heading": "Välj ditt PostNumber"
         },
         "create_account": "Skapa ett nytt konto",
         "enforced_by_policy": "Framtvingad av serverprincip",
         "forced_display_name": "Kommer att använda följande visningsnamn",
         "forced_email": "Kommer att använda följande e-postadress",
-        "forced_localpart": "Kommer att använda följande användarnamn",
+        "forced_localpart": "Kommer att använda följande PostNumber",
         "import_data": {
           "description": "Bekräfta informationen som kommer att länkas till ditt nya %(server_name)s konto.",
           "heading": "Importera dina data"
@@ -249,4 +250,4 @@
       "headline": "Verifiera din e-postadress"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/uk.json b/translations/uk.json
index 703ed83aa..6d77db91d 100644
--- a/translations/uk.json
+++ b/translations/uk.json
@@ -11,8 +11,8 @@
     "submit": "Надіслати"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "Документ виявлення OpenID Connect: \n<a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">\n%(discovery_url)s\n</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix ID",
     "password": "Пароль",
     "password_confirm": "Підтвердити пароль",
-    "username": "Ім'я користувача"
+    "username": "ПостНамбер"
   },
   "error": {
     "unexpected": "Неочікувана помилка"
@@ -142,13 +142,14 @@
       "invalid_credentials": "Недійсні облікові дані",
       "password_mismatch": "Поля пароля не збігаються",
       "rate_limit_exceeded": "Ви зробили забагато запитів за короткий проміжок часу. Зачекайте кілька хвилин і повторіть спробу.",
-      "username_all_numeric": "Ім'я користувача не може складатися тільки з цифр",
-      "username_banned": "Ім'я користувача заборонено політикою сервера",
-      "username_invalid_chars": "Ім'я користувача містить неприпустимі символи. Використовуйте лише малі букви, цифри, тире та підкреслення.",
-      "username_not_allowed": "Ім'я користувача не дозволено політикою сервера",
-      "username_taken": "Це ім'я користувача вже зайнято",
-      "username_too_long": "Ім'я користувача задовге",
-      "username_too_short": "Ім'я користувача закоротке"
+      "username_all_numeric": "ПостНамбер не може складатися тільки з цифр",
+      "username_banned": "ПостНамбер заборонений політикою сервера",
+      "username_invalid_chars": "ПостНамбер містить неприпустимі символи. Використовуйте лише малі букви та цифри.",
+      "username_not_allowed": "ПостНамбер не дозволений політикою сервера",
+      "postnumber_reserved": "Цей ПостНамбер зарезервований і не може бути використаний для реєстрації",
+      "username_taken": "Цей ПостНамбер вже зайнятий",
+      "username_too_long": "ПостНамбер задовгий",
+      "username_too_short": "ПостНамбер закороткий"
     },
     "legacy_consent": {
       "this_will_setup": "Це налаштує <span>%(client_name)s</span> з вашим обліковим записом <span>%(server_name)s</span>."
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "У вас ще немає облікового запису?",
       "continue_with_provider": "Продовжити з %(provider)s",
-      "description": "Увійдіть, щоб продовжити:",
+      "description": "Унікальна цифрова ідентичність для спілкування",
       "forgot_password": "Забули пароль?",
-      "headline": "Увійти",
+      "headline": "Увійти через ПостНамбер",
       "link": {
         "description": "Пов’язування вашого облікового запису <span class=\"break-keep text-links\">%(provider)s</span>",
         "headline": "Увійдіть, щоб повʼязати"
       },
       "no_login_methods": "Немає доступних методів входу.",
       "separator": "або",
-      "username_or_email": "Ім'я користувача або адреса е-пошти"
+      "username_or_email": "ПостНамбер / Е-пошта"
     },
     "navbar": {
       "my_account": "Мій обліковий запис",
@@ -220,7 +221,7 @@
       "continue_with_email": "Продовжити за допомогою е-пошти",
       "continue_with_password": "Продовжити з паролем",
       "create_account": {
-        "description": "Виберіть ім'я користувача, щоб продовжити.",
+        "description": "Виберіть ПостНамбер, щоб продовжити.",
         "heading": "Створити обліковий запис"
       },
       "sign_in_instead": "Натомість увійти",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "Продовжити",
-        "description": "Для цього імені користувача існує обліковий запис (%(username)s), він буде привʼязаний до цього облікового запису.",
+        "description": "Для цього ПостНамбера існує обліковий запис (%(username)s), він буде привʼязаний до цього облікового запису.",
         "heading": "Посилання на ваш наявний обліковий запис"
       },
       "register": {
         "choose_username": {
           "description": "Це неможливо змінити пізніше.",
-          "heading": "Виберіть ім'я користувача"
+          "heading": "Виберіть ПостНамбер"
         },
         "create_account": "Створити новий обліковий запис",
         "enforced_by_policy": "Застосовується політикою сервера",
         "forced_display_name": "Використовуватиме такий псевдонім",
         "forced_email": "Буде використано цю електронну адресу",
-        "forced_localpart": "Буде використовувати це ім'я користувача",
+        "forced_localpart": "Буде використовуватися цей ПостНамбер",
         "import_data": {
           "description": "Підтвердьте інформацію, яка буде прив'язана до вашого нового %(server_name)s облікового запису.",
           "heading": "Імпортуйте свої дані"
@@ -286,4 +287,4 @@
       "headline": "Підтвердьте свою електронну адресу"
     }
   }
-}
\ No newline at end of file
+}
diff --git a/translations/zh-Hans.json b/translations/zh-Hans.json
index 1dd0dcdfc..bc21cfb21 100644
--- a/translations/zh-Hans.json
+++ b/translations/zh-Hans.json
@@ -11,8 +11,8 @@
     "submit": "提交"
   },
   "app": {
-    "human_name": "Matrix Authentication Service",
-    "name": "matrix-authentication-service",
+    "human_name": "Letro Authentication Service",
+    "name": "letro-authentication-service",
     "technical_description": "OpenID Connect 发现文档： <a class=\"cpd-link\" data-kind=\"primary\" href=\"%(discovery_url)s\">%(discovery_url)s</a>"
   },
   "branding": {
@@ -32,7 +32,7 @@
     "mxid": "Matrix ID",
     "password": "密码",
     "password_confirm": "确认密码",
-    "username": "用户名"
+    "username": "PostNumber"
   },
   "error": {
     "unexpected": "意外错误"
@@ -142,13 +142,14 @@
       "invalid_credentials": "无效的凭据",
       "password_mismatch": "密码字段不匹配",
       "rate_limit_exceeded": "你在短时间内发出了过多请求。请于几分钟后重试。",
-      "username_all_numeric": "用户名不能仅由数字组成",
-      "username_banned": "由于服务器策略，用户名已被禁止",
-      "username_invalid_chars": "用户名包含无效字符。仅能使用小写字母、数字、短横线或下划线。",
-      "username_not_allowed": "由于服务器策略，用户名不被允许",
-      "username_taken": "此用户名已被使用",
-      "username_too_long": "用户名太长",
-      "username_too_short": "用户名太短"
+      "username_all_numeric": "PostNumber不能仅由数字组成",
+      "username_banned": "由于服务器策略，PostNumber已被禁止",
+      "username_invalid_chars": "PostNumber包含无效字符。仅能使用小写字母和数字。",
+      "username_not_allowed": "由于服务器策略，PostNumber不被允许",
+      "postnumber_reserved": "此PostNumber已被保留，无法用于注册",
+      "username_taken": "此PostNumber已被使用",
+      "username_too_long": "PostNumber太长",
+      "username_too_short": "PostNumber太短"
     },
     "legacy_consent": {
       "this_will_setup": "这将设置你位于 <span>%(server_name)s</span> 上的账户：<span>%(client_name)s</span>。"
@@ -156,16 +157,16 @@
     "login": {
       "call_to_register": "还没有账户？",
       "continue_with_provider": "以 %(provider)s 继续",
-      "description": "请登录以继续：",
+      "description": "用于通信的唯一数字身份",
       "forgot_password": "忘记密码？",
-      "headline": "登录",
+      "headline": "使用 PostNumber 登录",
       "link": {
         "description": "正在链接您的<span class=\"break-keep text-links\">%(provider)s</span>账户",
         "headline": "登录以链接"
       },
       "no_login_methods": "没有可用的登录途径。",
       "separator": "或",
-      "username_or_email": "用户名或邮件地址"
+      "username_or_email": "PostNumber / 邮箱"
     },
     "navbar": {
       "my_account": "我的账户",
@@ -220,7 +221,7 @@
       "continue_with_email": "使用邮件地址继续",
       "continue_with_password": "使用密码继续",
       "create_account": {
-        "description": "选择一个用户名以继续。",
+        "description": "选择一个 PostNumber 以继续。",
         "heading": "创建账户"
       },
       "sign_in_instead": "去登录",
@@ -234,7 +235,7 @@
     "scope": {
       "edit_profile": "编辑个人资料和联系方式",
       "manage_sessions": "管理设备和会话",
-      "mas_admin": "管理 matrix-authentication-service 上的用户",
+      "mas_admin": "管理 letro-authentication-service 上的用户",
       "send_messages": "以你的名义发送新消息",
       "synapse_admin": "管理 Synapse 服务器",
       "view_messages": "查看现有信息和数据",
@@ -246,19 +247,19 @@
       },
       "login_link": {
         "action": "继续",
-        "description": "此用户名（%(username)s）已存在于一个账户，它将与该上游账户关联。",
+        "description": "此 PostNumber（%(username)s）已存在于一个账户，它将与该上游账户关联。",
         "heading": "链接到现有账户"
       },
       "register": {
         "choose_username": {
           "description": "以后无法更改。",
-          "heading": "选择用户名"
+          "heading": "选择 PostNumber"
         },
         "create_account": "创建新账户",
         "enforced_by_policy": "由服务器策略强制执行",
         "forced_display_name": "将使用以下显示名称",
         "forced_email": "将使用以下电子邮件地址",
-        "forced_localpart": "将使用以下用户名",
+        "forced_localpart": "将使用以下 PostNumber",
         "import_data": {
           "description": "确认将链接到新%(server_name)s 账户的信息。",
           "heading": "导入数据"
@@ -286,4 +287,4 @@
       "headline": "验证邮件地址"
     }
   }
-}
\ No newline at end of file
+}