From bad55a7d417fd018e1931c7f0dc3a7a6778cde57 Mon Sep 17 00:00:00 2001
From: JiriUhlir <149317995+JiriUhlir@users.noreply.github.com>
Date: Tue, 16 Jun 2026 10:23:43 +0200
Subject: [PATCH] fixes + guest

---
 app/auth.py                       |  17 +++-
 app/db/users.py                   |   4 +-
 app/routes/alerting.py            |  30 +++---
 app/routes/apps.py                | 104 ++++++++++----------
 app/routes/audit.py               |   2 +-
 app/routes/auth.py                |  26 ++++-
 app/routes/deployments.py         |  16 +--
 app/routes/developers.py          |   3 +-
 app/routes/environment.py         |   4 +-
 app/routes/incidents.py           |   2 +-
 app/routes/jobs.py                |  18 ++--
 app/routes/migration_readiness.py |  10 +-
 app/routes/operations.py          |   2 +-
 app/routes/runtime.py             |  10 +-
 app/routes/scheduled_scripts.py   | 157 ++++++++++++++++--------------
 app/routes/users.py               |  13 +--
 app/routes/workers.py             |   6 +-
 app/templates/layout.py           |  80 +++++++++++----
 18 files changed, 295 insertions(+), 209 deletions(-)

diff --git a/app/auth.py b/app/auth.py
index b8b7124..4bb6104 100644
--- a/app/auth.py
+++ b/app/auth.py
@@ -125,7 +125,7 @@ def find_or_create_oauth_user(username: str, display_name: str, email: str) -> d
                 created_at,
                 updated_at
             )
-            VALUES (?, ?, ?, '', 'developer', 1, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+            VALUES (?, ?, ?, '', 'guest', 1, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
             """,
             (username, display_name, email),
         )
@@ -196,7 +196,9 @@ def find_or_create_google_user(email: str, display_name: str, provider_subject:
         created = False
         user_id = row["id"]
     else:
-        role = "admin" if con.execute("SELECT COUNT(*) AS count FROM users").fetchone()["count"] == 0 else "viewer"
+        # První účet v prázdné tabulce je admin (bootstrap), každý další nový účet je guest –
+        # bez přístupu, dokud mu admin nepřidělí vyšší roli.
+        role = "admin" if con.execute("SELECT COUNT(*) AS count FROM users").fetchone()["count"] == 0 else "guest"
         insert_columns = [
             "username",
             "display_name",
@@ -292,6 +294,12 @@ def current_user(request: Request) -> dict[str, Any] | None:
 def require_user(request: Request) -> dict[str, Any]:
     user = current_user(request)
     if user:
+        # Guest nemá přístup nikam – přesměruj ho na stránku s výzvou o přidělení práv.
+        if is_guest(user):
+            raise HTTPException(
+                status_code=status.HTTP_303_SEE_OTHER,
+                headers={"Location": "/portal/guest"},
+            )
         return user
 
     raise HTTPException(
@@ -307,6 +315,11 @@ def require_user(request: Request) -> dict[str, Any]:
 #               variables, resources, metadata). Cannot delete services or access admin areas.
 #   admin     – full access, including deleting services and the Administration / Users area.
 
+def is_guest(user: dict | None) -> bool:
+    """True for the default role assigned to a freshly created account (no access yet)."""
+    return bool(user) and (user.get("role") or "").lower() == "guest"
+
+
 def is_admin(user: dict | None) -> bool:
     return bool(user) and (user.get("role") or "").lower() == "admin"
 
diff --git a/app/db/users.py b/app/db/users.py
index c8d2dbd..5e48e75 100644
--- a/app/db/users.py
+++ b/app/db/users.py
@@ -3,7 +3,9 @@ from typing import Any
 from app.db.database import get_connection
 from app.db.migrations import run_migrations
 
-ROLES = ("admin", "developer", "viewer")
+# Pořadí od nejvyšších práv po nejnižší. "guest" je výchozí role nového účtu –
+# nemá přístup nikam, jen vidí výzvu k přidělení práv administrátorem.
+ROLES = ("admin", "developer", "viewer", "guest")
 
 
 def _table_columns(con, table_name: str) -> set[str]:
diff --git a/app/routes/alerting.py b/app/routes/alerting.py
index c5c00e1..afa4d41 100644
--- a/app/routes/alerting.py
+++ b/app/routes/alerting.py
@@ -196,7 +196,7 @@ def render_rule_form(rule: dict | None, action: str) -> str:
             <label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1"{enabled_checked}> Zapnuto</label>
 
             <div class="form-actions">
-                <button type="submit">Uložit</button>
+                <button type="submit"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Uložit</button>
             </div>
         </form>
     """
@@ -230,7 +230,7 @@ def render_event_rows(events: list[dict], empty_colspan: int = 9, include_rule:
             <td>{render_status(event.get("status"))}</td>
             <td>{job_link}</td>
             <td>{html.escape(event.get("created_at", "") or "")}</td>
-            <td><a class="btn" href="/portal/alerting/events/{event_id}">Detail</a></td>
+            <td><a class="btn" href="/portal/alerting/events/{event_id}"><i class="fa-solid fa-eye" aria-hidden="true"></i> Detail</a></td>
         </tr>
         """
 
@@ -273,7 +273,7 @@ def render_script_editor(rule: dict, user: dict) -> str:
                 <label>Obsah souboru</label>
                 <textarea name="content" rows="22" spellcheck="false">{content}</textarea>
                 <div class="form-actions">
-                    <button type="submit">Uložit skript</button>
+                    <button type="submit"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Uložit skript</button>
                 </div>
             </form>
         </div>
@@ -307,13 +307,13 @@ def alert_rules_page(request: Request, user=Depends(require_user)):
             <td>{last_event}</td>
             <td>{html.escape(rule.get("updated_at", "") or "")}</td>
             <td class="actions-cell service-actions">
-                <a class="btn" href="/portal/alerting/rules/{rule_id}">Detail</a>
-                <a class="btn btn-secondary" href="/portal/alerting/rules/{rule_id}/edit">Upravit</a>
+                <a class="btn" href="/portal/alerting/rules/{rule_id}"><i class="fa-solid fa-eye" aria-hidden="true"></i> Detail</a>
+                <a class="btn btn-secondary" href="/portal/alerting/rules/{rule_id}/edit"><i class="fa-solid fa-pen-to-square" aria-hidden="true"></i> Upravit</a>
                 <form method="post" action="/portal/alerting/rules/{rule_id}/toggle" class="inline-form">
-                    <button type="submit" class="btn btn-secondary">{toggle_label}</button>
+                    <button type="submit" class="btn btn-secondary"><i class="fa-solid fa-power-off" aria-hidden="true"></i> {toggle_label}</button>
                 </form>
                 <form method="post" action="/portal/alerting/rules/{rule_id}/delete" class="inline-form" onsubmit="return confirm('Smazat alert pravidlo?');">
-                    <button type="submit" class="danger">Smazat</button>
+                    <button type="submit" class="danger"><i class="fa-solid fa-trash" aria-hidden="true"></i> Smazat</button>
                 </form>
             </td>
         </tr>
@@ -329,8 +329,8 @@ def alert_rules_page(request: Request, user=Depends(require_user)):
             <h2><i class="fa-solid fa-bell" aria-hidden="true"></i> Alert pravidla</h2>
             <p class="muted">Správa pravidel pro spouštění alert skriptů při událostech incidentů.</p>
             <p>
-                <a class="btn" href="/portal/alerting/rules/new">+ Nové alert pravidlo</a>
-                <a class="btn btn-secondary" href="/portal/alerting/events">Alert eventy</a>
+                <a class="btn" href="/portal/alerting/rules/new"><i class="fa-solid fa-plus" aria-hidden="true"></i> Nové alert pravidlo</a>
+                <a class="btn btn-secondary" href="/portal/alerting/events"><i class="fa-solid fa-bell-concierge" aria-hidden="true"></i> Alert eventy</a>
             </p>
         </div>
 
@@ -415,15 +415,15 @@ def alert_rule_detail(rule_id: int, request: Request, user=Depends(require_user)
             <h2><i class="fa-solid fa-bell" aria-hidden="true"></i> {html.escape(rule.get("name", "") or "")}</h2>
             <p>
                 <a class="btn" href="/portal/alerting/rules">&larr; Zpět na alert pravidla</a>
-                <a class="btn btn-secondary" href="/portal/alerting/rules/{rule_id}/edit">Upravit</a>
-                <a class="btn btn-secondary" href="/portal/alerting/events">Alert eventy</a>
+                <a class="btn btn-secondary" href="/portal/alerting/rules/{rule_id}/edit"><i class="fa-solid fa-pen-to-square" aria-hidden="true"></i> Upravit</a>
+                <a class="btn btn-secondary" href="/portal/alerting/events"><i class="fa-solid fa-bell-concierge" aria-hidden="true"></i> Alert eventy</a>
             </p>
             <div class="inline-form">
                 <form method="post" action="/portal/alerting/rules/{rule_id}/toggle">
-                    <button type="submit" class="btn-secondary">{toggle_label}</button>
+                    <button type="submit" class="btn-secondary"><i class="fa-solid fa-power-off" aria-hidden="true"></i> {toggle_label}</button>
                 </form>
                 <form method="post" action="/portal/alerting/rules/{rule_id}/delete" onsubmit="return confirm('Smazat alert pravidlo?');">
-                    <button type="submit" class="danger">Smazat</button>
+                    <button type="submit" class="danger"><i class="fa-solid fa-trash" aria-hidden="true"></i> Smazat</button>
                 </form>
             </div>
         </div>
@@ -580,7 +580,7 @@ def alert_events_page(request: Request, user=Depends(require_user)):
         <div class="card">
             <h2><i class="fa-solid fa-bell-concierge" aria-hidden="true"></i> Alert eventy</h2>
             <p class="muted">Historie vyvolaných alertů a jejich zpracování.</p>
-            <p><a class="btn" href="/portal/alerting/rules">Alert pravidla</a></p>
+            <p><a class="btn" href="/portal/alerting/rules"><i class="fa-solid fa-bell" aria-hidden="true"></i> Alert pravidla</a></p>
         </div>
 
         <div class="card">
@@ -632,7 +632,7 @@ def alert_event_detail(event_id: int, request: Request, user=Depends(require_use
             <h2><i class="fa-solid fa-bell-concierge" aria-hidden="true"></i> Alert event #{html.escape(str(event_id))}</h2>
             <p>
                 <a class="btn" href="/portal/alerting/events">&larr; Zpět na alert eventy</a>
-                <a class="btn btn-secondary" href="/portal/alerting/rules">Alert pravidla</a>
+                <a class="btn btn-secondary" href="/portal/alerting/rules"><i class="fa-solid fa-bell" aria-hidden="true"></i> Alert pravidla</a>
             </p>
         </div>
 
diff --git a/app/routes/apps.py b/app/routes/apps.py
index a302d53..06af123 100644
--- a/app/routes/apps.py
+++ b/app/routes/apps.py
@@ -144,7 +144,7 @@ def ensure_variable_key_allowed(app_id: str, key: str, variable_id: int | None =
 
 
 def render_template_options(templates: list[dict], selected_template: str, include_blank: bool = True) -> str:
-    options = ['<option value="">Bez &scaron;ablony</option>'] if include_blank else []
+    options = ['<option value="">Bez šablony</option>'] if include_blank else []
     selected_exists = not selected_template
     for template in templates:
         template_id = template.get("id", "") or ""
@@ -164,7 +164,7 @@ def render_template_options(templates: list[dict], selected_template: str, inclu
         )
     if not selected_exists:
         options.append(
-            f'<option value="{html.escape(selected_template)}" selected>Nezn&aacute;m&aacute; &scaron;ablona</option>'
+            f'<option value="{html.escape(selected_template)}" selected>Neznámá šablona</option>'
         )
     return "".join(options)
 
@@ -175,7 +175,7 @@ def render_template_label(templates: list[dict], template_id: str) -> str:
     for template in templates:
         if template.get("id") == template_id:
             return html.escape(template.get("name", "") or template_id)
-    return "Nezn&aacute;m&aacute; &scaron;ablona"
+    return "Neznámá šablona"
 
 
 def render_environment_usage_example(language: str, runtime: str, template: str) -> str:
@@ -361,8 +361,8 @@ def apps_page(
                         <label>CPU</label>
                         <input name="cpus" value="{cpus}" placeholder="např. 0.50, 1.00 nebo prázdné pro výchozí">
                         <div class="modal-actions">
-                            <button type="button" class="btn btn-secondary" onclick="closeResourceModal('{resource_modal_id}')">Zrušit</button>
-                            <button type="submit">Použít</button>
+                            <button type="button" class="btn btn-secondary" onclick="closeResourceModal('{resource_modal_id}')"><i class="fa-solid fa-xmark" aria-hidden="true"></i> Zrušit</button>
+                            <button type="submit"><i class="fa-solid fa-check" aria-hidden="true"></i> Použít</button>
                         </div>
                     </form>
                 </dialog>"""
@@ -377,13 +377,13 @@ def apps_page(
                     <label class="muted">HTTP</label>
                     <div class="cmd-row">
                         <input readonly value="{http_clone}" id="http-{app_id}">
-                        <button type="button" onclick="return copyText(this)">Kopírovat</button>
+                        <button type="button" onclick="return copyText(this)"><i class="fa-solid fa-copy" aria-hidden="true"></i> Kopírovat</button>
                     </div>
 
                     <label class="muted">SSH</label>
                     <div class="cmd-row">
                         <input readonly value="{ssh_clone}" id="ssh-{app_id}">
-                        <button type="button" onclick="return copyText(this)">Kopírovat</button>
+                        <button type="button" onclick="return copyText(this)"><i class="fa-solid fa-copy" aria-hidden="true"></i> Kopírovat</button>
                     </div>
                 </details>"""
         else:
@@ -470,12 +470,12 @@ def apps_page(
         return f"/portal/apps?{urlencode(params)}"
 
     previous_link = (
-        f'<a class="btn btn-secondary" href="{page_url(page_number - 1)}">Předchozí</a>'
+        f'<a class="btn btn-secondary" href="{page_url(page_number - 1)}"><i class="fa-solid fa-chevron-left" aria-hidden="true"></i> Předchozí</a>'
         if page_number > 1
         else ""
     )
     next_link = (
-        f'<a class="btn btn-secondary" href="{page_url(page_number + 1)}">Další</a>'
+        f'<a class="btn btn-secondary" href="{page_url(page_number + 1)}">Další <i class="fa-solid fa-chevron-right" aria-hidden="true"></i></a>'
         if page_number < total_pages
         else ""
     )
@@ -502,7 +502,7 @@ def apps_page(
         """
             <p><a class="btn" href="/portal/new-app"><i class="fa-solid fa-plus" aria-hidden="true"></i> Nová služba</a></p>
             <form method="post" action="/portal/apps/environment/apply-all" class="inline-form">
-                <button type="submit" class="btn-secondary"><i class="fa-solid fa-arrows-rotate" aria-hidden="true"></i> Regenerovat v&scaron;echny .env z datab&aacute;ze</button>
+                <button type="submit" class="btn-secondary"><i class="fa-solid fa-arrows-rotate" aria-hidden="true"></i> Regenerovat všechny .env z databáze</button>
             </form>
         """
         if can_manage
@@ -709,17 +709,17 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
                     <input name="key" value="{variable_key}" required>
                     <input name="value" value="{value_input}"{secret_hint}>
                     <label class="checkbox-label"><input type="checkbox" name="is_secret" value="1"{secret_checked}> Secret</label>
-                    <button type="submit" class="btn btn-compact">Ulo&zcaron;it</button>
+                    <button type="submit" class="btn btn-compact"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Uložit</button>
                 </form>
                 <form method="post" action="/portal/apps/{app_url_id}/variables/{variable_id}/delete" class="inline-form" onsubmit="return confirm('Smazat promennou {variable_key}?');">
-                    <button type="submit" class="btn btn-secondary btn-compact">Smazat</button>
+                    <button type="submit" class="btn btn-secondary btn-compact"><i class="fa-solid fa-trash" aria-hidden="true"></i> Smazat</button>
                 </form>
             </td>
         </tr>
         """
 
     if not variable_rows:
-        variable_rows = '<tr><td colspan="4">Zat&iacute;m nejsou evidovan&eacute; &zcaron;&aacute;dn&eacute; prom&ecaron;nn&eacute;.</td></tr>'
+        variable_rows = '<tr><td colspan="4">Zatím nejsou evidované žádné proměnné.</td></tr>'
 
     def render_method_options(selected: str) -> str:
         selected_upper = (selected or "").upper()
@@ -749,10 +749,10 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
             <td><input name="ip_cidr" value="{rule_ip}" form="{form_id}" required></td>
             <td><select name="methods" form="{form_id}">{render_method_options(rule.get("methods", ""))}</select></td>
             <td><input name="description" value="{rule_desc}" form="{form_id}"></td>
-            <td><label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1" form="{form_id}"{enabled_checked}> Aktivn&iacute;</label></td>
+            <td><label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1" form="{form_id}"{enabled_checked}> Aktivní</label></td>
             <td>
                 <form method="post" action="/portal/apps/{app_url_id}/ip-access-rules/{rid}/update" id="{form_id}" class="inline-form"></form>
-                <button type="submit" form="{form_id}" class="btn btn-compact"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Ulo&zcaron;it</button>
+                <button type="submit" form="{form_id}" class="btn btn-compact"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Uložit</button>
                 <form method="post" action="/portal/apps/{app_url_id}/ip-access-rules/{rid}/delete" class="inline-form" onsubmit="return confirm('Smazat pravidlo {ip_label}?');">
                     <button type="submit" class="btn btn-secondary btn-compact"><i class="fa-solid fa-trash" aria-hidden="true"></i> Smazat</button>
                 </form>
@@ -761,7 +761,7 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
         """
 
     if not ip_access_rule_rows:
-        ip_access_rule_rows = '<tr><td colspan="5">Zat&iacute;m nejsou evidovan&aacute; &zcaron;&aacute;dn&aacute; IP access pravidla.</td></tr>'
+        ip_access_rule_rows = '<tr><td colspan="5">Zatím nejsou evidovaná žádná IP access pravidla.</td></tr>'
 
     notice = ""
     if message:
@@ -774,7 +774,7 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
     redeploy_block = (
         f"""
             <form method="post" action="/portal/apps/{app_url_id}/redeploy" onsubmit="return confirm('Spustit nov\u00e9 nasazen\u00ed slu\u017eby {escaped_app_id}?');">
-                <button type="submit">Nasadit znovu</button>
+                <button type="submit"><i class="fa-solid fa-rotate-right" aria-hidden="true"></i> Nasadit znovu</button>
             </form>
         """
         if can_manage
@@ -783,17 +783,17 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
 
     detail_tabs = (
         """
-        <div class="detail-tabs" aria-label="Sekce detailu slu&zcaron;by">
-            <a class="btn btn-secondary" href="#metadata">Metadata</a>
-            <a class="btn btn-secondary" href="#promenne">Prom&ecaron;nn&eacute;</a>
-            <a class="btn btn-secondary" href="#ip-access">Security / IP Access</a>
-            <a class="btn btn-secondary" href="#historie">Historie</a>
+        <div class="detail-tabs" aria-label="Sekce detailu služby">
+            <a class="btn btn-secondary" href="#metadata"><i class="fa-solid fa-table-list" aria-hidden="true"></i> Metadata</a>
+            <a class="btn btn-secondary" href="#promenne"><i class="fa-solid fa-sliders" aria-hidden="true"></i> Proměnné</a>
+            <a class="btn btn-secondary" href="#ip-access"><i class="fa-solid fa-shield-halved" aria-hidden="true"></i> Security / IP Access</a>
+            <a class="btn btn-secondary" href="#historie"><i class="fa-solid fa-clock-rotate-left" aria-hidden="true"></i> Historie</a>
         </div>
         """
         if can_manage
         else """
-        <div class="detail-tabs" aria-label="Sekce detailu slu&zcaron;by">
-            <a class="btn btn-secondary" href="#historie">Historie</a>
+        <div class="detail-tabs" aria-label="Sekce detailu služby">
+            <a class="btn btn-secondary" href="#historie"><i class="fa-solid fa-clock-rotate-left" aria-hidden="true"></i> Historie</a>
         </div>
         """
     )
@@ -803,13 +803,13 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
         <div class="card" id="metadata">
             <h2>Metadata</h2>
             <form method="post" action="/portal/apps/{app_url_id}/metadata" class="metadata-form">
-                <label>N&aacute;zev</label>
+                <label>Název</label>
                 <input name="name" value="{name}" required>
 
                 <label>Popis</label>
                 <textarea name="description" rows="3">{description}</textarea>
 
-                <label>Vlastn&iacute;k</label>
+                <label>Vlastník</label>
                 <input name="owner" value="{owner}">
 
                 <label>Template</label>
@@ -836,11 +836,11 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
                 <label>Container Port</label>
                 <input name="container_port" value="{container_port}" inputmode="numeric">
 
-                <label class="checkbox-label"><input type="checkbox" name="is_public" value="1"{bool_checked(is_public)}> Ve&rcaron;ejn&aacute; slu&zcaron;ba</label>
-                <label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1"{bool_checked(is_enabled)}> Aktivn&iacute; slu&zcaron;ba</label>
+                <label class="checkbox-label"><input type="checkbox" name="is_public" value="1"{bool_checked(is_public)}> Veřejná služba</label>
+                <label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1"{bool_checked(is_enabled)}> Aktivní služba</label>
 
                 <div class="form-actions">
-                    <button type="submit">Ulo&zcaron;it metadata</button>
+                    <button type="submit"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Uložit metadata</button>
                 </div>
             </form>
         </div>
@@ -852,9 +852,9 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
     variables_card = (
         f"""
         <div class="card" id="promenne">
-            <h2>Prom&ecaron;nn&eacute;</h2>
+            <h2><i class="fa-solid fa-sliders" aria-hidden="true"></i> Proměnné</h2>
             <form method="post" action="/portal/apps/{app_url_id}/environment/apply" class="inline-form">
-                <button type="submit" class="btn-secondary">Regenerovat .env z datab&aacute;ze</button>
+                <button type="submit" class="btn-secondary"><i class="fa-solid fa-rotate" aria-hidden="true"></i> Regenerovat .env z databáze</button>
             </form>
             {environment_usage_example}
             <table>
@@ -868,14 +868,14 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
             </table>
 
             <form method="post" action="/portal/apps/{app_url_id}/variables" class="metadata-form add-variable-form">
-                <h3>P&rcaron;idat prom&ecaron;nnou</h3>
+                <h3>Přidat proměnnou</h3>
                 <label>Key</label>
                 <input name="key" required>
                 <label>Value</label>
                 <input name="value">
                 <label class="checkbox-label"><input type="checkbox" name="is_secret" value="1"> Secret</label>
                 <div class="form-actions">
-                    <button type="submit">P&rcaron;idat prom&ecaron;nnou</button>
+                    <button type="submit"><i class="fa-solid fa-plus" aria-hidden="true"></i> Přidat proměnnou</button>
                 </div>
             </form>
         </div>
@@ -889,9 +889,9 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
         <div class="card" id="ip-access">
             <h2><i class="fa-solid fa-shield-halved" aria-hidden="true"></i> Security / IP Access</h2>
             <p class="muted">
-                Pravidla ur&ccaron;uj&iacute;, z jak&yacute;ch IP/CIDR adres lze volat dan&eacute; HTTP metody.
-                <strong>WRITE</strong> = POST, PUT, PATCH, DELETE; <strong>ALL</strong> = v&scaron;echny b&ecaron;&zcaron;n&eacute; metody v&ccaron;etn&ecaron; GET.
-                Pravidla se zat&iacute;m pouze ukl&aacute;daj&iacute; (Caddy je za&ccaron;ne vynucovat pozd&ecaron;ji).
+                Pravidla určují, z jakých IP/CIDR adres lze volat dané HTTP metody.
+                <strong>WRITE</strong> = POST, PUT, PATCH, DELETE; <strong>ALL</strong> = všechny běžné metody včetně GET.
+                Pravidla se zatím pouze ukládají (Caddy je začne vynucovat později).
             </p>
             <table>
                 <tr>
@@ -905,16 +905,16 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
             </table>
 
             <form method="post" action="/portal/apps/{app_url_id}/ip-access-rules" class="metadata-form add-variable-form">
-                <h3>P&rcaron;idat pravidlo</h3>
+                <h3>Přidat pravidlo</h3>
                 <label>IP/CIDR</label>
-                <input name="ip_cidr" placeholder="nap&rcaron;. 185.10.20.30 nebo 10.0.0.0/24" required>
+                <input name="ip_cidr" placeholder="např. 185.10.20.30 nebo 10.0.0.0/24" required>
                 <label>Methods</label>
                 <select name="methods">{render_method_options("WRITE")}</select>
                 <label>Description</label>
-                <input name="description" placeholder="nap&rcaron;. Office IP">
-                <label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1" checked> Aktivn&iacute;</label>
+                <input name="description" placeholder="např. Office IP">
+                <label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1" checked> Aktivní</label>
                 <div class="form-actions">
-                    <button type="submit"><i class="fa-solid fa-plus" aria-hidden="true"></i> P&rcaron;idat pravidlo</button>
+                    <button type="submit"><i class="fa-solid fa-plus" aria-hidden="true"></i> Přidat pravidlo</button>
                 </div>
             </form>
         </div>
@@ -932,8 +932,8 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
             {notice}
             <p>
                 <a class="btn" href="/portal/apps">&larr; Zpět na služby</a>
-                <a class="btn btn-secondary" href="/portal/deployments?app_id={app_url_id}">Nasazení služby</a>
-                <a class="btn btn-secondary" href="/portal/jobs?target={app_url_id}">Úlohy služby</a>
+                <a class="btn btn-secondary" href="/portal/deployments?app_id={app_url_id}"><i class="fa-solid fa-rocket" aria-hidden="true"></i> Nasazení služby</a>
+                <a class="btn btn-secondary" href="/portal/jobs?target={app_url_id}"><i class="fa-solid fa-list-check" aria-hidden="true"></i> Úlohy služby</a>
             </p>
             {redeploy_block}
         </div>
@@ -952,7 +952,7 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
                 <tr><th>ID</th><td>{escaped_app_id}</td></tr>
                 <tr><th>Název</th><td>{name}</td></tr>
                 <tr><th>Popis</th><td>{description}</td></tr>
-                <tr><th>Vlastn&iacute;k</th><td>{owner}</td></tr>
+                <tr><th>Vlastník</th><td>{owner}</td></tr>
                 <tr><th>Template</th><td>{template_value}</td></tr>
                 <tr><th>Runtime</th><td>{runtime}</td></tr>
                 <tr><th>Repository URL</th><td>{repository_url}</td></tr>
@@ -961,8 +961,8 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
                 <tr><th>Domain</th><td>{domain}</td></tr>
                 <tr><th>Health URL</th><td>{health_url}</td></tr>
                 <tr><th>Container Port</th><td>{container_port}</td></tr>
-                <tr><th>Ve&rcaron;ejn&aacute; slu&zcaron;ba</th><td>{"Ano" if is_public else "Ne"}</td></tr>
-                <tr><th>Aktivn&iacute; slu&zcaron;ba</th><td>{"Ano" if is_enabled else "Ne"}</td></tr>
+                <tr><th>Veřejná služba</th><td>{"Ano" if is_public else "Ne"}</td></tr>
+                <tr><th>Aktivní služba</th><td>{"Ano" if is_enabled else "Ne"}</td></tr>
                 <tr><th>Jazyk</th><td>{language}</td></tr>
                 <tr><th>Verze</th><td>{version}</td></tr>
                 <tr><th>Status</th><td><span class="pill">{status}</span></td></tr>
@@ -998,13 +998,13 @@ def app_detail(app_id: str, request: Request, message: str = "", error: str = ""
         </div>
 
         <div class="card">
-            <h2>Incidenty slu&zcaron;by</h2>
+            <h2>Incidenty služby</h2>
             <table>
                 <tr>
-                    <th>N&aacute;zev</th>
-                    <th>Za&ccaron;&aacute;tek</th>
+                    <th>Název</th>
+                    <th>Začátek</th>
                     <th>Konec</th>
-                    <th>Trv&aacute;n&iacute;</th>
+                    <th>Trvání</th>
                     <th>Stav</th>
                 </tr>
                 {render_incident_history_rows(incidents, include_service=False)}
@@ -1364,10 +1364,10 @@ def new_app_form(request: Request, user=Depends(require_developer)):
                 </p>
 
                 <div class="form-actions">
-                    <button type="submit">Vytvo&rcaron;it slu&zcaron;bu</button>
+                    <button type="submit"><i class="fa-solid fa-circle-plus" aria-hidden="true"></i> Vytvořit službu</button>
                     <span class="form-loader" id="new-app-loader" hidden>
                         <span class="spinner" aria-hidden="true"></span>
-                        Vytv&aacute;&rcaron;&iacute;m slu&zcaron;bu...
+                        Vytvářím službu...
                     </span>
                 </div>
                 <div class="async-status" id="new-app-status" aria-live="polite"></div>
diff --git a/app/routes/audit.py b/app/routes/audit.py
index ceb638b..cbd045a 100644
--- a/app/routes/audit.py
+++ b/app/routes/audit.py
@@ -37,7 +37,7 @@ def audit_page(request: Request, user=Depends(require_user)):
         "Audit",
         f"""
         <div class="card">
-            <h2>Audit</h2>
+            <h2><i class="fa-solid fa-clipboard-list" aria-hidden="true"></i> Audit</h2>
             <p class="muted">Přehled interních akcí provedených v portálu.</p>
         </div>
 
diff --git a/app/routes/auth.py b/app/routes/auth.py
index 4122bf9..e7a4952 100644
--- a/app/routes/auth.py
+++ b/app/routes/auth.py
@@ -259,6 +259,28 @@ def google_callback(request: Request, code: str = "", state: str = "", error: st
         return _render_login("Google login failed.")
 
 
+@router.get("/guest", response_class=HTMLResponse)
+def guest_page(request: Request):
+    user = current_user(request)
+    if not user:
+        return RedirectResponse(url="/portal/login", status_code=303)
+    # Účet s přidělenými právy sem nepatří – pošli ho na běžnou úvodní stránku.
+    if (user.get("role") or "").lower() != "guest":
+        return RedirectResponse(url="/portal/apps", status_code=303)
+
+    return page(
+        "Čekání na schválení",
+        """
+        <div class="card">
+            <h2><i class="fa-solid fa-user-clock" aria-hidden="true"></i> Účet zatím nemá přidělená práva</h2>
+            <p>Požádejte o přidělení práv administrátora.</p>
+            <p class="muted">Jakmile vám administrátor přiřadí roli, obnovte stránku a portál se vám zpřístupní.</p>
+        </div>
+        """,
+        user=user,
+    )
+
+
 @router.post("/logout")
 def logout(request: Request):
     user = current_user(request)
@@ -424,7 +446,7 @@ def _render_login(error: str | None = None) -> str:
                     <input type="password" name="password" autocomplete="current-password" required>
                 </p>
 
-                <button type="submit" class="btn-secondary">Sign in locally</button>
+                <button type="submit" class="btn-secondary"><i class="fa-solid fa-right-to-bracket" aria-hidden="true"></i> Sign in locally</button>
             </form>
         """
 
@@ -464,7 +486,7 @@ def _render_login(error: str | None = None) -> str:
                     <input type="password" name="password" autocomplete="current-password" required>
                 </p>
 
-                <button type="submit" class="btn-secondary">Přihlásit lokálně</button>
+                <button type="submit" class="btn-secondary"><i class="fa-solid fa-right-to-bracket" aria-hidden="true"></i> Přihlásit lokálně</button>
             </form>
         </div>
         """,
diff --git a/app/routes/deployments.py b/app/routes/deployments.py
index 4baca65..454c3f7 100644
--- a/app/routes/deployments.py
+++ b/app/routes/deployments.py
@@ -211,7 +211,7 @@ async def deployments_page(
             <td>{returncode_label}</td>
             <td>{finished_at}</td>
             <td class="actions-cell">
-                <a class="btn" href="/portal/deployments/{deployment_id}">Detail</a>
+                <a class="btn" href="/portal/deployments/{deployment_id}"><i class="fa-solid fa-eye" aria-hidden="true"></i> Detail</a>
             </td>
         </tr>
         """
@@ -226,12 +226,12 @@ async def deployments_page(
     first_item = offset + 1 if total_deployments else 0
     last_item = min(offset + len(deployments), total_deployments)
     previous_link = (
-        f'<a class="btn btn-secondary" href="{pagination_url(page_number - 1, selected_status, selected_app, selected_source)}">Předchozí</a>'
+        f'<a class="btn btn-secondary" href="{pagination_url(page_number - 1, selected_status, selected_app, selected_source)}"><i class="fa-solid fa-chevron-left" aria-hidden="true"></i> Předchozí</a>'
         if page_number > 1
         else ""
     )
     next_link = (
-        f'<a class="btn btn-secondary" href="{pagination_url(page_number + 1, selected_status, selected_app, selected_source)}">Další</a>'
+        f'<a class="btn btn-secondary" href="{pagination_url(page_number + 1, selected_status, selected_app, selected_source)}">Další <i class="fa-solid fa-chevron-right" aria-hidden="true"></i></a>'
         if page_number < total_pages
         else ""
     )
@@ -253,7 +253,7 @@ async def deployments_page(
         f"""
         {refresh}
         <div class="card">
-            <h2>Historie nasazení</h2>
+            <h2><i class="fa-solid fa-rocket" aria-hidden="true"></i> Historie nasazení</h2>
             <p class="muted">Přehled posledních běhů nasazení a jejich výsledků.</p>
             <a class="btn" href="/portal/operations">&larr; Zpět na přehled</a>
         </div>
@@ -272,8 +272,8 @@ async def deployments_page(
                 <select name="app_id">{app_options}</select>
                 <select name="source">{source_options}</select>
                 <input type="hidden" name="page" value="1">
-                <button type="submit">Filtrovat</button>
-                <a class="btn btn-secondary" href="/portal/deployments">Reset</a>
+                <button type="submit"><i class="fa-solid fa-filter" aria-hidden="true"></i> Filtrovat</button>
+                <a class="btn btn-secondary" href="/portal/deployments"><i class="fa-solid fa-arrow-rotate-left" aria-hidden="true"></i> Reset</a>
             </form>
         </div>
 
@@ -361,8 +361,8 @@ async def deployment_detail_page(
             {failed_notice}
             <p>
                 <a class="btn" href="/portal/deployments">&larr; Zpět na nasazení</a>
-                <a class="btn btn-secondary" href="/portal/apps/{app_url_id}">Detail služby</a>
-                <a class="btn btn-secondary" href="/portal/deployments/{html.escape(str(deployment_id))}/logs/raw">Surové logy</a>
+                <a class="btn btn-secondary" href="/portal/apps/{app_url_id}"><i class="fa-solid fa-server" aria-hidden="true"></i> Detail služby</a>
+                <a class="btn btn-secondary" href="/portal/deployments/{html.escape(str(deployment_id))}/logs/raw"><i class="fa-solid fa-file-lines" aria-hidden="true"></i> Surové logy</a>
             </p>
         </div>
 
diff --git a/app/routes/developers.py b/app/routes/developers.py
index 9f564a3..2cae5cc 100644
--- a/app/routes/developers.py
+++ b/app/routes/developers.py
@@ -53,6 +53,7 @@ PUBLIC_ENDPOINTS = [
 
 # Roles model.
 ROLES = [
+    ("guest", "Výchozí role nového účtu po prvním přihlášení. Bez přístupu – vidí jen výzvu požádat administrátora o přidělení práv."),
     ("viewer", "Pouze pro čtení: vidí jaké služby běží a jejich dokumentaci (Swagger). Bez Gitu, úprav, nasazení a mazání."),
     ("developer", "Vše co viewer + provozní workflow služeb: Git/klonování, nasazení, proměnné, prostředky, metadata. Nemůže mazat služby ani do Administrace."),
     ("admin", "Plný přístup: vše co developer + mazání služeb, správa záloh a jejich obnova, správa uživatelů, audit a admin-only operace."),
@@ -120,7 +121,7 @@ def developers_page(user=Depends(require_user)):
                     <strong>Naklonujte repozitář.</strong>
                     <div class="cmd-row">
                         <input readonly value="{clone_cmd}" id="publish-clone">
-                        <button type="button" onclick="return copyText(this)">Kopírovat</button>
+                        <button type="button" onclick="return copyText(this)"><i class="fa-solid fa-copy" aria-hidden="true"></i> Kopírovat</button>
                     </div>
                     <span class="muted">Přesný příkaz pro konkrétní službu (HTTP i SSH) najdete také na stránce
                     <a href="/portal/apps">Služby</a>.</span>
diff --git a/app/routes/environment.py b/app/routes/environment.py
index da8915c..0e255bd 100644
--- a/app/routes/environment.py
+++ b/app/routes/environment.py
@@ -29,7 +29,7 @@ def _render_rows(entries: list[tuple[str, str]]) -> str:
             <td><input name="key" value="{key_html}" class="env-key" readonly></td>
             <td><input name="value" value="{value_html}" class="env-value"></td>
             <td class="actions-cell">
-                <button type="button" class="btn-secondary" onclick="this.closest('tr').remove()">Smazat</button>
+                <button type="button" class="btn-secondary" onclick="this.closest('tr').remove()"><i class="fa-solid fa-trash" aria-hidden="true"></i> Smazat</button>
             </td>
         </tr>
         """
@@ -109,7 +109,7 @@ def _render_page(user: dict, entries: list[tuple[str, str]], message: str = "",
             const tr = document.createElement("tr");
             tr.innerHTML = '<td><input name="key" class="env-key" placeholder="NOVY_KLIC"></td>'
                 + '<td><input name="value" class="env-value" placeholder="hodnota"></td>'
-                + '<td class="actions-cell"><button type="button" class="btn-secondary" onclick="this.closest(\\'tr\\').remove()">Smazat</button></td>';
+                + '<td class="actions-cell"><button type="button" class="btn-secondary" onclick="this.closest(\\'tr\\').remove()"><i class="fa-solid fa-trash" aria-hidden="true"></i> Smazat</button></td>';
             tbody.appendChild(tr);
         }}
         </script>
diff --git a/app/routes/incidents.py b/app/routes/incidents.py
index 0deb907..47d9b2a 100644
--- a/app/routes/incidents.py
+++ b/app/routes/incidents.py
@@ -111,7 +111,7 @@ def incidents_page(request: Request, user=Depends(require_user)):
         "Incidenty",
         f"""
         <div class="card">
-            <h2>Incidenty</h2>
+            <h2><i class="fa-solid fa-triangle-exclamation" aria-hidden="true"></i> Incidenty</h2>
             <p class="muted">P\u0159ehled incident\u016f vytv\u00e1\u0159en\u00fdch a uzav\u00edran\u00fdch monitorem.</p>
         </div>
 
diff --git a/app/routes/jobs.py b/app/routes/jobs.py
index 61e190c..58bf45b 100644
--- a/app/routes/jobs.py
+++ b/app/routes/jobs.py
@@ -198,7 +198,7 @@ def jobs_page(
             <td>{created_at}</td>
             <td>{started_at}</td>
             <td>{finished_at}</td>
-            <td class="actions-cell"><a class="btn" href="/portal/jobs/{job_id}">Detail</a></td>
+            <td class="actions-cell"><a class="btn" href="/portal/jobs/{job_id}"><i class="fa-solid fa-eye" aria-hidden="true"></i> Detail</a></td>
         </tr>
         """
 
@@ -222,12 +222,12 @@ def jobs_page(
         return f"/portal/jobs?{urlencode(params)}"
 
     previous_link = (
-        f'<a class="btn btn-secondary" href="{page_url(page_number - 1)}">Předchozí</a>'
+        f'<a class="btn btn-secondary" href="{page_url(page_number - 1)}"><i class="fa-solid fa-chevron-left" aria-hidden="true"></i> Předchozí</a>'
         if page_number > 1
         else ""
     )
     next_link = (
-        f'<a class="btn btn-secondary" href="{page_url(page_number + 1)}">Další</a>'
+        f'<a class="btn btn-secondary" href="{page_url(page_number + 1)}">Další <i class="fa-solid fa-chevron-right" aria-hidden="true"></i></a>'
         if page_number < total_pages
         else ""
     )
@@ -249,7 +249,7 @@ def jobs_page(
         f"""
         {refresh}
         <div class="card">
-            <h2>Úlohy</h2>
+            <h2><i class="fa-solid fa-list-check" aria-hidden="true"></i> Úlohy</h2>
             <p class="muted">Fronta portálových a webhook úloh připravená pro centrální worker.</p>
         </div>
 
@@ -267,8 +267,8 @@ def jobs_page(
                 <select name="type">{type_options}</select>
                 <input name="target" value="{target_value}" placeholder="Cíl">
                 <input type="hidden" name="page" value="1">
-                <button type="submit">Filtrovat</button>
-                <a class="btn btn-secondary" href="/portal/jobs">Reset</a>
+                <button type="submit"><i class="fa-solid fa-filter" aria-hidden="true"></i> Filtrovat</button>
+                <a class="btn btn-secondary" href="/portal/jobs"><i class="fa-solid fa-arrow-rotate-left" aria-hidden="true"></i> Reset</a>
             </form>
         </div>
 
@@ -335,7 +335,7 @@ def job_detail_page(job_id: int, request: Request, user=Depends(require_user)):
     if status_value == "failed" and can_retry_job(job):
         actions += f"""
                 <form method="post" action="/portal/jobs/{html.escape(str(job_id))}/retry" onsubmit="return confirm('Retry job #{html.escape(str(job_id))}?');">
-                    <button type="submit">Spustit znovu</button>
+                    <button type="submit"><i class="fa-solid fa-rotate-right" aria-hidden="true"></i> Spustit znovu</button>
                 </form>
         """
     elif status_value == "failed" and (job.get("target_id") or "") in IGNORED_RETRY_REPOSITORIES:
@@ -343,7 +343,7 @@ def job_detail_page(job_id: int, request: Request, user=Depends(require_user)):
     if status_value in {"queued", "running"}:
         actions += f"""
                 <form method="post" action="/portal/jobs/{html.escape(str(job_id))}/cancel" onsubmit="return confirm('Cancel job #{html.escape(str(job_id))}?');">
-                    <button type="submit" class="danger">Zrušit úlohu</button>
+                    <button type="submit" class="danger"><i class="fa-solid fa-ban" aria-hidden="true"></i> Zrušit úlohu</button>
                 </form>
         """
     if actions:
@@ -441,7 +441,7 @@ def job_detail_page(job_id: int, request: Request, user=Depends(require_user)):
             <h2>{title}</h2>
             <p>
                 <a class="btn" href="/portal/jobs">&larr; Zpět na úlohy</a>
-                <a class="btn btn-secondary" href="{target_url}">Detail cíle</a>
+                <a class="btn btn-secondary" href="{target_url}"><i class="fa-solid fa-arrow-up-right-from-square" aria-hidden="true"></i> Detail cíle</a>
             </p>
             {retry_blocked_notice}
             {actions}
diff --git a/app/routes/migration_readiness.py b/app/routes/migration_readiness.py
index 3295f30..37c3365 100644
--- a/app/routes/migration_readiness.py
+++ b/app/routes/migration_readiness.py
@@ -157,19 +157,19 @@ def migration_readiness_page(request: Request, user=Depends(require_user)):
         "Migration Readiness",
         f"""
         <div class="card">
-            <h2>Migration Readiness</h2>
+            <h2><i class="fa-solid fa-diagram-project" aria-hidden="true"></i> Migration Readiness</h2>
             <p class="muted">Poslední výsledek maintenance skriptu {html.escape(PREFLIGHT_SCRIPT)} uložený v databázi. Stav READY / NOT READY vychází pouze z return code jobu.</p>
             <div class="inline-form">
                 <form method="post" action="/portal/migration-readiness/run">
-                    <button type="submit">Spustit preflight kontrolu</button>
+                    <button type="submit"><i class="fa-solid fa-play" aria-hidden="true"></i> Spustit preflight kontrolu</button>
                 </form>
                 <form method="post" action="/portal/migration-readiness/bootstrap">
                     <input type="hidden" name="mode" value="check">
-                    <button type="submit" class="btn-secondary">Run Bootstrap Check</button>
+                    <button type="submit" class="btn-secondary"><i class="fa-solid fa-clipboard-check" aria-hidden="true"></i> Run Bootstrap Check</button>
                 </form>
                 <form method="post" action="/portal/migration-readiness/bootstrap" onsubmit="return confirm('Spustit Bootstrap v2 repair? Tato akce opravuje práva přes maintenance job.');">
                     <input type="hidden" name="mode" value="repair">
-                    <button type="submit" class="btn-secondary">Run Bootstrap Repair</button>
+                    <button type="submit" class="btn-secondary"><i class="fa-solid fa-screwdriver-wrench" aria-hidden="true"></i> Run Bootstrap Repair</button>
                 </form>
             </div>
         </div>
@@ -189,7 +189,7 @@ def migration_readiness_page(request: Request, user=Depends(require_user)):
             <p>Režim deploy deployuje core services a může změnit stav systému. Spouštějte ho jen po kontrole dopadu.</p>
             <form method="post" action="/portal/migration-readiness/bootstrap" onsubmit="return confirm('Spustit plný Bootstrap v2 deploy? Tato akce deployuje core services přes maintenance job.');">
                 <input type="hidden" name="mode" value="deploy">
-                <button type="submit" class="danger">Run Bootstrap Deploy</button>
+                <button type="submit" class="danger"><i class="fa-solid fa-rocket" aria-hidden="true"></i> Run Bootstrap Deploy</button>
             </form>
         </div>
 
diff --git a/app/routes/operations.py b/app/routes/operations.py
index 07bb4a5..687522d 100644
--- a/app/routes/operations.py
+++ b/app/routes/operations.py
@@ -182,7 +182,7 @@ def operations_dashboard(request: Request, user=Depends(require_user)):
         "Přehled",
         f"""
         <div class="card">
-            <h2>Přehled systému</h2>
+            <h2><i class="fa-solid fa-gauge-high" aria-hidden="true"></i> Přehled systému</h2>
             <p class="muted">Rychlá odpověď na otázku, zda jsou služby, úlohy a nasazení v pořádku.</p>
         </div>
 
diff --git a/app/routes/runtime.py b/app/routes/runtime.py
index b27376a..9f630de 100644
--- a/app/routes/runtime.py
+++ b/app/routes/runtime.py
@@ -14,10 +14,12 @@ from app.templates.layout import page
 router = APIRouter()
 
 # Portál NEMÁ vlastní deploy logiku. Všechny provozní akce deleguje do existujících shell skriptů
-# v appfactory-tools přes existující job systém (job_type="run_script"; worker spustí scripts/<script>).
-DEPLOY_CORE_SCRIPT = "deploy-core-service.sh"
-CADDY_SCRIPT = "generate-caddyfile.sh"
-ENABLED_APPS_SCRIPT = "redeploy-enabled-apps.sh"
+# v appfactory-tools přes existující job systém (job_type="run_script").
+# Skripty leží v appfactory-tools/scripts/, proto je předáváme i s prefixem scripts/, jinak je
+# worker hledá ve špatné složce a job selže s "skript nenalezen".
+DEPLOY_CORE_SCRIPT = "scripts/deploy-core-service.sh"
+CADDY_SCRIPT = "scripts/generate-caddyfile.sh"
+ENABLED_APPS_SCRIPT = "scripts/redeploy-enabled-apps.sh"
 
 # Skripty považované za "runtime operace" (filtr dashboardu).
 RUNTIME_SCRIPTS = (DEPLOY_CORE_SCRIPT, CADDY_SCRIPT, ENABLED_APPS_SCRIPT)
diff --git a/app/routes/scheduled_scripts.py b/app/routes/scheduled_scripts.py
index ffedcba..3ac3de9 100644
--- a/app/routes/scheduled_scripts.py
+++ b/app/routes/scheduled_scripts.py
@@ -30,10 +30,10 @@ echo "TODO"
 """
 SCHEDULE_TYPES = ("hourly", "daily", "weekly", "monthly")
 SCHEDULE_LABELS = {
-    "hourly": "ka&zcaron;dou hodinu",
-    "daily": "denn&ecaron;",
-    "weekly": "t&yacute;dn&ecaron;",
-    "monthly": "m&ecaron;s&iacute;&ccaron;n&ecaron;",
+    "hourly": "každou hodinu",
+    "daily": "denně",
+    "weekly": "týdně",
+    "monthly": "měsíčně",
 }
 
 
@@ -70,18 +70,18 @@ def render_enabled_pill(value) -> str:
 
 def render_running_pill(value) -> str:
     if value:
-        return '<span class="pill pill-warning">b&ecaron;&zcaron;&iacute;</span>'
-    return '<span class="pill pill-muted">neb&ecaron;&zcaron;&iacute;</span>'
+        return '<span class="pill pill-warning">běží</span>'
+    return '<span class="pill pill-muted">neběží</span>'
 
 
 def validate_script_name(value: str) -> str:
     script_name = clean_optional(value)
     if not script_name:
-        raise HTTPException(status_code=400, detail="N&aacute;zev skriptu je povinn&yacute;")
+        raise HTTPException(status_code=400, detail="Název skriptu je povinný")
     if not script_name.endswith(".sh"):
-        raise HTTPException(status_code=400, detail="N&aacute;zev skriptu mus&iacute; kon&ccaron;it .sh")
+        raise HTTPException(status_code=400, detail="Název skriptu musí končit .sh")
     if "/" in script_name or "\\" in script_name or ".." in script_name:
-        raise HTTPException(status_code=400, detail="N&aacute;zev skriptu nesm&iacute; obsahovat cestu")
+        raise HTTPException(status_code=400, detail="Název skriptu nesmí obsahovat cestu")
     return script_name
 
 
@@ -92,7 +92,7 @@ def script_path(script_name: str) -> Path:
     try:
         path.relative_to(base)
     except ValueError:
-        raise HTTPException(status_code=400, detail="Neplatn&yacute; n&aacute;zev skriptu")
+        raise HTTPException(status_code=400, detail="Neplatný název skriptu")
     return path
 
 
@@ -103,33 +103,33 @@ def read_script_file(script_name: str) -> dict:
             "exists": False,
             "content": DEFAULT_SCRIPT_CONTENT,
             "error": None,
-            "warning": "Soubor zat&iacute;m neexistuje. M&uring;&zcaron;ete ho vytvo&rcaron;it z v&yacute;choz&iacute;ho obsahu.",
+            "warning": "Soubor zatím neexistuje. Můžete ho vytvořit z výchozího obsahu.",
         }
     if not path.is_file():
-        return {"exists": False, "content": "", "error": "Cesta nen&iacute; soubor.", "warning": None}
+        return {"exists": False, "content": "", "error": "Cesta není soubor.", "warning": None}
     try:
         if path.stat().st_size > MAX_SCRIPT_BYTES:
-            return {"exists": True, "content": "", "error": "Soubor je v&ecaron;t&scaron;&iacute; ne&zcaron; 100 KB.", "warning": None}
+            return {"exists": True, "content": "", "error": "Soubor je větší než 100 KB.", "warning": None}
         content = path.read_text(encoding="utf-8")
     except Exception:
-        return {"exists": True, "content": "", "error": "Soubor se nepoda&rcaron;ilo na&ccaron;&iacute;st.", "warning": None}
+        return {"exists": True, "content": "", "error": "Soubor se nepodařilo načíst.", "warning": None}
 
     warning = None
     if not content.startswith("#!/usr/bin/env bash"):
-        warning = "Prvn&iacute; &rcaron;&aacute;dek by m&ecaron;l b&yacute;t #!/usr/bin/env bash."
+        warning = "První řádek by měl být #!/usr/bin/env bash."
     return {"exists": True, "content": content, "error": None, "warning": warning}
 
 
 def normalize_script_content(content: str) -> str:
     value = content.replace("\r\n", "\n").replace("\r", "\n")
     if not value.strip():
-        raise HTTPException(status_code=400, detail="Obsah skriptu nesm&iacute; b&yacute;t pr&aacute;zdn&yacute;")
+        raise HTTPException(status_code=400, detail="Obsah skriptu nesmí být prázdný")
     if len(value.encode("utf-8")) > MAX_SCRIPT_BYTES:
-        raise HTTPException(status_code=400, detail="Obsah skriptu je v&ecaron;t&scaron;&iacute; ne&zcaron; 100 KB")
+        raise HTTPException(status_code=400, detail="Obsah skriptu je větší než 100 KB")
     if not value.startswith("#!/usr/bin/env bash"):
         value = "#!/usr/bin/env bash\n" + value.lstrip("\n")
     if len(value.encode("utf-8")) > MAX_SCRIPT_BYTES:
-        raise HTTPException(status_code=400, detail="Obsah skriptu je v&ecaron;t&scaron;&iacute; ne&zcaron; 100 KB")
+        raise HTTPException(status_code=400, detail="Obsah skriptu je větší než 100 KB")
     return value
 
 
@@ -137,16 +137,23 @@ def save_script_file(script_name: str, content: str) -> None:
     path = script_path(script_name)
     value = normalize_script_content(content)
     try:
+        path.parent.mkdir(parents=True, exist_ok=True)
         path.write_text(value, encoding="utf-8", newline="\n")
+    except OSError as exc:
+        reason = exc.strerror or str(exc)
+        raise HTTPException(status_code=500, detail=f"Soubor se nepodařilo uložit: {reason}")
+    # Spustitelná práva nastavujeme best-effort – soubor už je uložený, takže selhání chmod
+    # (jiný vlastník, FS bez podpory práv) nesmí hlásit chybu uložení.
+    try:
         os.chmod(path, 0o755)
-    except Exception:
-        raise HTTPException(status_code=500, detail="Soubor se nepoda&rcaron;ilo ulo&zcaron;it")
+    except OSError:
+        pass
 
 
 def validate_schedule_type(value: str) -> str:
     schedule_type = clean_optional(value)
     if schedule_type not in SCHEDULE_TYPES:
-        raise HTTPException(status_code=400, detail="Neplatn&aacute; frekvence")
+        raise HTTPException(status_code=400, detail="Neplatná frekvence")
     return schedule_type
 
 
@@ -154,9 +161,9 @@ def validate_timeout(value: str | int) -> int:
     try:
         timeout_seconds = int(value)
     except (TypeError, ValueError):
-        raise HTTPException(status_code=400, detail="Timeout mus&iacute; b&yacute;t &ccaron;&iacute;slo")
+        raise HTTPException(status_code=400, detail="Timeout musí být číslo")
     if timeout_seconds < 10 or timeout_seconds > 3600:
-        raise HTTPException(status_code=400, detail="Timeout mus&iacute; b&yacute;t mezi 10 a 3600 sekundami")
+        raise HTTPException(status_code=400, detail="Timeout musí být mezi 10 a 3600 sekundami")
     return timeout_seconds
 
 
@@ -170,7 +177,7 @@ def form_metadata(
 ) -> dict:
     name_value = clean_optional(name)
     if not name_value:
-        raise HTTPException(status_code=400, detail="N&aacute;zev je povinn&yacute;")
+        raise HTTPException(status_code=400, detail="Název je povinný")
     return {
         "name": name_value,
         "description": clean_optional(description),
@@ -204,7 +211,7 @@ def render_form(script: dict | None, action: str, include_script_name: bool) ->
 
     return f"""
         <form method="post" action="{action}" class="metadata-form">
-            <label>N&aacute;zev</label>
+            <label>Název</label>
             <input name="name" value="{name}" required>
 
             <label>Popis</label>
@@ -215,8 +222,8 @@ def render_form(script: dict | None, action: str, include_script_name: bool) ->
             <label>Frekvence</label>
             <select name="schedule_type">{render_schedule_options(schedule_type)}</select>
 
-            <label>&Ccaron;as</label>
-            <input name="schedule_time" value="{schedule_time}" placeholder="nap&rcaron;. 02:30">
+            <label>Čas</label>
+            <input name="schedule_time" value="{schedule_time}" placeholder="např. 02:30">
 
             <label>Timeout</label>
             <input name="timeout_seconds" value="{timeout_seconds}" inputmode="numeric" required>
@@ -224,7 +231,7 @@ def render_form(script: dict | None, action: str, include_script_name: bool) ->
             <label class="checkbox-label"><input type="checkbox" name="is_enabled" value="1"{enabled_checked}> Zapnuto</label>
 
             <div class="form-actions">
-                <button type="submit">Ulo&zcaron;it</button>
+                <button type="submit"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Uložit</button>
             </div>
         </form>
     """
@@ -239,7 +246,7 @@ def render_script_content_section(script: dict, user: dict) -> str:
         script_file = {
             "exists": False,
             "content": "",
-            "error": "N&aacute;zev skriptu nen&iacute; bezpe&ccaron;n&yacute;.",
+            "error": "Název skriptu není bezpečný.",
             "warning": None,
         }
     content = html.escape(script_file.get("content", "") or "")
@@ -251,7 +258,7 @@ def render_script_content_section(script: dict, user: dict) -> str:
         error = f'<p class="alert alert-danger">{script_file["error"]}</p>'
 
     if not is_admin(user):
-        readonly_hint = '<p class="muted">Obsah skriptu je dostupn&yacute; pouze pro &ccaron;ten&iacute;. Ukl&aacute;dat m&uring;&zcaron;e jen administr&aacute;tor.</p>'
+        readonly_hint = '<p class="muted">Obsah skriptu je dostupný pouze pro čtení. Ukládat může jen administrátor.</p>'
         return f"""
         <div class="card">
             <h2>Obsah skriptu</h2>
@@ -273,7 +280,7 @@ def render_script_content_section(script: dict, user: dict) -> str:
                 <label>Obsah souboru</label>
                 <textarea name="content" rows="22" spellcheck="false">{content}</textarea>
                 <div class="form-actions">
-                    <button type="submit">Ulo&zcaron;it skript</button>
+                    <button type="submit"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Uložit skript</button>
                 </div>
             </form>
         </div>
@@ -295,12 +302,12 @@ def scheduled_scripts_page(request: Request, user=Depends(require_user)):
         last_run_at = html.escape(script.get("last_run_at", "") or "")
         next_run_at = html.escape(script.get("next_run_at", "") or "")
         enabled = bool(script.get("is_enabled"))
-        toggle_label = "Zak&aacute;zat" if enabled else "Povolit"
+        toggle_label = "Zakázat" if enabled else "Povolit"
         delete_button = ""
         if not script.get("is_running"):
             delete_button = f"""
-                <form method="post" action="/portal/scheduled-scripts/{script_id}/delete" class="inline-form" onsubmit="return confirm('Smazat pl&aacute;novan&yacute; skript {name}?');">
-                    <button type="submit" class="danger">Smazat</button>
+                <form method="post" action="/portal/scheduled-scripts/{script_id}/delete" class="inline-form" onsubmit="return confirm('Smazat plánovaný skript {name}?');">
+                    <button type="submit" class="danger"><i class="fa-solid fa-trash" aria-hidden="true"></i> Smazat</button>
                 </form>
             """
 
@@ -316,12 +323,12 @@ def scheduled_scripts_page(request: Request, user=Depends(require_user)):
             <td>{last_run_at}</td>
             <td>{next_run_at}</td>
             <td class="actions-cell service-actions">
-                <a class="btn" href="/portal/scheduled-scripts/{script_id}">Detail</a>
+                <a class="btn" href="/portal/scheduled-scripts/{script_id}"><i class="fa-solid fa-eye" aria-hidden="true"></i> Detail</a>
                 <form method="post" action="/portal/scheduled-scripts/{script_id}/run-now" class="inline-form">
-                    <button type="submit" class="btn btn-secondary">Spustit nyn&iacute;</button>
+                    <button type="submit" class="btn btn-secondary"><i class="fa-solid fa-play" aria-hidden="true"></i> Spustit nyní</button>
                 </form>
                 <form method="post" action="/portal/scheduled-scripts/{script_id}/toggle" class="inline-form">
-                    <button type="submit" class="btn btn-secondary">{toggle_label}</button>
+                    <button type="submit" class="btn btn-secondary"><i class="fa-solid fa-power-off" aria-hidden="true"></i> {toggle_label}</button>
                 </form>
                 {delete_button}
             </td>
@@ -329,30 +336,30 @@ def scheduled_scripts_page(request: Request, user=Depends(require_user)):
         """
 
     if not rows:
-        rows = '<tr><td colspan="10">Zat&iacute;m nejsou evidovan&eacute; &zcaron;&aacute;dn&eacute; pl&aacute;novan&eacute; skripty.</td></tr>'
+        rows = '<tr><td colspan="10">Zatím nejsou evidované žádné plánované skripty.</td></tr>'
 
     return page(
-        "Pl&aacute;novan&eacute; skripty",
+        "Plánované skripty",
         f"""
         <div class="card">
-            <h2><i class="fa-solid fa-calendar-days" aria-hidden="true"></i> Pl&aacute;novan&eacute; skripty</h2>
-            <p class="muted">P&rcaron;ehled skript&uring; spou&scaron;t&ecaron;n&yacute;ch schedulerem nebo ru&ccaron;n&ecaron; z port&aacute;lu.</p>
-            <p><a class="btn" href="/portal/scheduled-scripts/new">+ Nov&yacute; pl&aacute;novan&yacute; skript</a></p>
+            <h2><i class="fa-solid fa-calendar-days" aria-hidden="true"></i> Plánované skripty</h2>
+            <p class="muted">Přehled skriptů spouštěných schedulerem nebo ručně z portálu.</p>
+            <p><a class="btn" href="/portal/scheduled-scripts/new"><i class="fa-solid fa-plus" aria-hidden="true"></i> Nový plánovaný skript</a></p>
         </div>
 
         <div class="card">
             <h2>Seznam</h2>
             <table>
                 <tr>
-                    <th>N&aacute;zev</th>
+                    <th>Název</th>
                     <th>Skript</th>
                     <th>Frekvence</th>
-                    <th>&Ccaron;as</th>
+                    <th>Čas</th>
                     <th>Zapnuto</th>
-                    <th>B&ecaron;&zcaron;&iacute;</th>
-                    <th>Posledn&iacute; stav</th>
-                    <th>Posledn&iacute; b&ecaron;h</th>
-                    <th>Dal&scaron;&iacute; b&ecaron;h</th>
+                    <th>Běží</th>
+                    <th>Poslední stav</th>
+                    <th>Poslední běh</th>
+                    <th>Další běh</th>
                     <th>Akce</th>
                 </tr>
                 {rows}
@@ -366,11 +373,11 @@ def scheduled_scripts_page(request: Request, user=Depends(require_user)):
 @router.get("/scheduled-scripts/new", response_class=HTMLResponse)
 def new_scheduled_script_form(request: Request, user=Depends(require_user)):
     return page(
-        "Nov&yacute; pl&aacute;novan&yacute; skript",
+        "Nový plánovaný skript",
         f"""
         <div class="card">
-            <h2><i class="fa-solid fa-circle-plus" aria-hidden="true"></i> Nov&yacute; pl&aacute;novan&yacute; skript</h2>
-            <p><a class="btn" href="/portal/scheduled-scripts">&larr; Zp&ecaron;t</a></p>
+            <h2><i class="fa-solid fa-circle-plus" aria-hidden="true"></i> Nový plánovaný skript</h2>
+            <p><a class="btn" href="/portal/scheduled-scripts">&larr; Zpět</a></p>
         </div>
         <div class="card">
             {render_form({"is_enabled": True, "timeout_seconds": 300, "schedule_type": "daily"}, "/portal/scheduled-scripts/new", True)}
@@ -397,7 +404,7 @@ def create_scheduled_script_action(
     created_name = metadata["script_name"]
     if not script_path(created_name).exists():
         save_script_file(created_name, DEFAULT_SCRIPT_CONTENT)
-        commit_and_push(f"maintenance/{created_name}", f"Vytvo&rcaron;en skript {created_name}", user)
+        commit_and_push(f"maintenance/{created_name}", f"Vytvořen skript {created_name}", user)
     log_audit_event(
         user,
         action="scheduled_script.created",
@@ -421,31 +428,31 @@ def scheduled_script_detail(script_id: int, request: Request, user=Depends(requi
         last_job = f'<a href="/portal/jobs/{last_job_html}">#{last_job_html}</a>'
 
     enabled = bool(script.get("is_enabled"))
-    toggle_label = "Zak&aacute;zat" if enabled else "Povolit"
+    toggle_label = "Zakázat" if enabled else "Povolit"
     delete_form = ""
     if not script.get("is_running"):
         delete_form = f"""
-            <form method="post" action="/portal/scheduled-scripts/{script_id}/delete" onsubmit="return confirm('Smazat pl&aacute;novan&yacute; skript?');">
-                <button type="submit" class="danger">Smazat</button>
+            <form method="post" action="/portal/scheduled-scripts/{script_id}/delete" onsubmit="return confirm('Smazat plánovaný skript?');">
+                <button type="submit" class="danger"><i class="fa-solid fa-trash" aria-hidden="true"></i> Smazat</button>
             </form>
         """
     script_content_section = render_script_content_section(script, user)
 
     return page(
-        html.escape(script.get("name", "") or "Pl&aacute;novan&yacute; skript"),
+        html.escape(script.get("name", "") or "Plánovaný skript"),
         f"""
         <div class="card">
             <h2><i class="fa-solid fa-calendar-day" aria-hidden="true"></i> {html.escape(script.get("name", "") or "")}</h2>
             <p>
-                <a class="btn" href="/portal/scheduled-scripts">&larr; Zp&ecaron;t na pl&aacute;novan&eacute; skripty</a>
-                <a class="btn btn-secondary" href="/portal/scheduled-scripts/{script_id}/edit">Upravit</a>
+                <a class="btn" href="/portal/scheduled-scripts">&larr; Zpět na plánované skripty</a>
+                <a class="btn btn-secondary" href="/portal/scheduled-scripts/{script_id}/edit"><i class="fa-solid fa-pen-to-square" aria-hidden="true"></i> Upravit</a>
             </p>
             <div class="inline-form">
                 <form method="post" action="/portal/scheduled-scripts/{script_id}/run-now">
-                    <button type="submit">Spustit nyn&iacute;</button>
+                    <button type="submit"><i class="fa-solid fa-play" aria-hidden="true"></i> Spustit nyní</button>
                 </form>
                 <form method="post" action="/portal/scheduled-scripts/{script_id}/toggle">
-                    <button type="submit" class="btn-secondary">{toggle_label}</button>
+                    <button type="submit" class="btn-secondary"><i class="fa-solid fa-power-off" aria-hidden="true"></i> {toggle_label}</button>
                 </form>
                 {delete_form}
             </div>
@@ -454,19 +461,19 @@ def scheduled_script_detail(script_id: int, request: Request, user=Depends(requi
         <div class="card">
             <h2>Souhrn</h2>
             <table>
-                <tr><th>N&aacute;zev</th><td>{html.escape(script.get("name", "") or "")}</td></tr>
+                <tr><th>Název</th><td>{html.escape(script.get("name", "") or "")}</td></tr>
                 <tr><th>Popis</th><td>{html.escape(script.get("description", "") or "")}</td></tr>
                 <tr><th>Skript</th><td>{html.escape(script.get("script_name", "") or "")}</td></tr>
                 <tr><th>Frekvence</th><td>{render_schedule_type(script.get("schedule_type"))}</td></tr>
-                <tr><th>&Ccaron;as</th><td>{html.escape(script.get("schedule_time", "") or "")}</td></tr>
+                <tr><th>Čas</th><td>{html.escape(script.get("schedule_time", "") or "")}</td></tr>
                 <tr><th>Timeout</th><td>{html.escape(str(script.get("timeout_seconds") or ""))}</td></tr>
                 <tr><th>Zapnuto</th><td>{render_bool(script.get("is_enabled"))}</td></tr>
-                <tr><th>B&ecaron;&zcaron;&iacute;</th><td>{render_bool(script.get("is_running"))}</td></tr>
-                <tr><th>Posledn&iacute; stav</th><td>{render_status_pill(script.get("last_status")) if script.get("last_status") else ""}</td></tr>
-                <tr><th>Posledn&iacute; chyba</th><td>{html.escape(script.get("last_error_text", "") or "")}</td></tr>
-                <tr><th>Posledn&iacute; b&ecaron;h</th><td>{html.escape(script.get("last_run_at", "") or "")}</td></tr>
-                <tr><th>Dal&scaron;&iacute; b&ecaron;h</th><td>{html.escape(script.get("next_run_at", "") or "")}</td></tr>
-                <tr><th>Posledn&iacute; &uacute;loha</th><td>{last_job}</td></tr>
+                <tr><th>Běží</th><td>{render_bool(script.get("is_running"))}</td></tr>
+                <tr><th>Poslední stav</th><td>{render_status_pill(script.get("last_status")) if script.get("last_status") else ""}</td></tr>
+                <tr><th>Poslední chyba</th><td>{html.escape(script.get("last_error_text", "") or "")}</td></tr>
+                <tr><th>Poslední běh</th><td>{html.escape(script.get("last_run_at", "") or "")}</td></tr>
+                <tr><th>Další běh</th><td>{html.escape(script.get("next_run_at", "") or "")}</td></tr>
+                <tr><th>Poslední úloha</th><td>{last_job}</td></tr>
             </table>
         </div>
 
@@ -482,11 +489,11 @@ def edit_scheduled_script_form(script_id: int, request: Request, user=Depends(re
     if not script:
         raise HTTPException(status_code=404, detail="Scheduled script not found")
     return page(
-        "Upravit pl&aacute;novan&yacute; skript",
+        "Upravit plánovaný skript",
         f"""
         <div class="card">
-            <h2><i class="fa-solid fa-pen-to-square" aria-hidden="true"></i> Upravit pl&aacute;novan&yacute; skript</h2>
-            <p><a class="btn" href="/portal/scheduled-scripts/{script_id}">&larr; Zp&ecaron;t</a></p>
+            <h2><i class="fa-solid fa-pen-to-square" aria-hidden="true"></i> Upravit plánovaný skript</h2>
+            <p><a class="btn" href="/portal/scheduled-scripts/{script_id}">&larr; Zpět</a></p>
         </div>
         <div class="card">
             {render_form(script, f"/portal/scheduled-scripts/{script_id}/edit", False)}
@@ -556,13 +563,13 @@ def update_scheduled_script_file(
     user=Depends(require_user),
 ):
     if not is_admin(user):
-        raise HTTPException(status_code=403, detail="Skript m&uring;&zcaron;e upravit pouze administr&aacute;tor")
+        raise HTTPException(status_code=403, detail="Skript může upravit pouze administrátor")
     script = get_scheduled_script(script_id)
     if not script:
         raise HTTPException(status_code=404, detail="Scheduled script not found")
     script_name = validate_script_name(script.get("script_name", "") or "")
     save_script_file(script_name, content)
-    commit_and_push(f"maintenance/{script_name}", f"&Uacute;prava skriptu {script_name}", user)
+    commit_and_push(f"maintenance/{script_name}", f"Úprava skriptu {script_name}", user)
     log_audit_event(
         user,
         action="scheduled_script.file_updated",
@@ -599,7 +606,7 @@ def delete_scheduled_script_action(script_id: int, user=Depends(require_user)):
     if not script:
         raise HTTPException(status_code=404, detail="Scheduled script not found")
     if script.get("is_running"):
-        raise HTTPException(status_code=409, detail="B&ecaron;&zcaron;&iacute;c&iacute; skript nelze smazat")
+        raise HTTPException(status_code=409, detail="Běžící skript nelze smazat")
     if not delete_scheduled_script(script_id):
         raise HTTPException(status_code=409, detail="Skript nelze smazat")
     script_name = clean_optional(script.get("script_name"))
@@ -607,7 +614,7 @@ def delete_scheduled_script_action(script_id: int, user=Depends(require_user)):
         path = script_path(script_name)
         if path.exists():
             path.unlink()
-        commit_and_push(f"maintenance/{script_name}", f"Smaz&aacute;n skript {script_name}", user)
+        commit_and_push(f"maintenance/{script_name}", f"Smazán skript {script_name}", user)
     log_audit_event(
         user,
         action="scheduled_script.deleted",
diff --git a/app/routes/users.py b/app/routes/users.py
index cb1d545..26371d5 100644
--- a/app/routes/users.py
+++ b/app/routes/users.py
@@ -47,7 +47,8 @@ def render_role_overview() -> str:
     role_rows = (
         ("admin", "Plný přístup: vše co developer + mazání služeb, správa záloh a jejich obnova, správa uživatelů a rolí, admin-only operace."),
         ("developer", "Vidí běžící služby a dokumentaci jako viewer + provozní workflow služeb: Git/klonování, nasazení, proměnné, prostředky, metadata. Nemůže mazat služby ani do Administrace / Uživatelů."),
-        ("viewer", "Pouze pro čtení: vidí jaké služby běží a jejich dokumentaci (Swagger). Bez Gitu, úprav, nasazení a mazání. Bez přístupu do Administrace / Uživatelů. Výchozí role pro Google přihlášení."),
+        ("viewer", "Pouze pro čtení: vidí jaké služby běží a jejich dokumentaci (Swagger). Bez Gitu, úprav, nasazení a mazání. Bez přístupu do Administrace / Uživatelů."),
+        ("guest", "Výchozí role nového účtu po prvním přihlášení. Nemá přístup nikam – vidí jen výzvu, aby požádal administrátora o přidělení práv."),
     )
     rows = ""
     for role, description in role_rows:
@@ -118,7 +119,7 @@ def users_page(request: Request, message: str = "", error: str = "", user=Depend
             <td>
                 <form method="post" action="/portal/admin/users/{user_id_html}/role" class="inline-form">
                     <select name="role">{render_role_options(role)}</select>
-                    <button type="submit" class="btn-secondary">Save</button>
+                    <button type="submit" class="btn-secondary"><i class="fa-solid fa-floppy-disk" aria-hidden="true"></i> Save</button>
                 </form>
             </td>
             <td>{render_enabled_pill(enabled)}</td>
@@ -127,13 +128,13 @@ def users_page(request: Request, message: str = "", error: str = "", user=Depend
             <td>{last_login_at}</td>
             <td class="actions-cell">
                 <form method="post" action="/portal/admin/users/{user_id_html}/{toggle_action}" class="inline-form">
-                    <button type="submit" class="btn-secondary">{toggle_label}</button>
+                    <button type="submit" class="btn-secondary"><i class="fa-solid fa-power-off" aria-hidden="true"></i> {toggle_label}</button>
                 </form>
                 <form method="post" action="/portal/admin/users/{user_id_html}/sync-gitea" class="inline-form">
-                    <button type="submit" class="btn-secondary">Sync Gitea</button>
+                    <button type="submit" class="btn-secondary"><i class="fa-solid fa-rotate" aria-hidden="true"></i> Sync Gitea</button>
                 </form>
                 <form method="post" action="/portal/admin/users/{user_id_html}/delete" class="inline-form" onsubmit="return confirm('Delete this user? This removes the portal account.');">
-                    <button type="submit" class="btn-secondary">Delete</button>
+                    <button type="submit" class="btn-secondary"><i class="fa-solid fa-trash" aria-hidden="true"></i> Delete</button>
                 </form>
             </td>
         </tr>
@@ -146,7 +147,7 @@ def users_page(request: Request, message: str = "", error: str = "", user=Depend
         "Users",
         f"""
         <div class="card">
-            <h2>Users</h2>
+            <h2><i class="fa-solid fa-users" aria-hidden="true"></i> Users</h2>
             <p class="muted">Administration of portal users and roles.</p>
             {notice}
         </div>
diff --git a/app/routes/workers.py b/app/routes/workers.py
index e5d7138..12ea278 100644
--- a/app/routes/workers.py
+++ b/app/routes/workers.py
@@ -146,7 +146,7 @@ def workers_page(
         "Workery",
         f"""
         <div class="card">
-            <h2>Workery</h2>
+            <h2><i class="fa-solid fa-gears" aria-hidden="true"></i> Workery</h2>
             <p class="muted">Přehled worker procesů obsluhujících úlohy portálu.</p>
         </div>
 
@@ -162,8 +162,8 @@ def workers_page(
                 <select name="status">{status_options}</select>
                 <input name="q" value="{html.escape(query)}" placeholder="ID workeru">
                 <input type="hidden" name="page" value="1">
-                <button type="submit">Filtrovat</button>
-                <a class="btn btn-secondary" href="/portal/workers">Reset</a>
+                <button type="submit"><i class="fa-solid fa-filter" aria-hidden="true"></i> Filtrovat</button>
+                <a class="btn btn-secondary" href="/portal/workers"><i class="fa-solid fa-arrow-rotate-left" aria-hidden="true"></i> Reset</a>
             </form>
         </div>
 
diff --git a/app/templates/layout.py b/app/templates/layout.py
index 1c28b50..cff719f 100644
--- a/app/templates/layout.py
+++ b/app/templates/layout.py
@@ -1,9 +1,37 @@
 import html
+import unicodedata
 
 from ..config import PORTAL_PREFIX
 
 APP_NAME = "CSBot Services Portal"
 
+# Sekce viditelné pouze pro tento e-mail (Migration Readiness, Runtime Management, Environment).
+SUPER_ADMIN_EMAIL = "jiri.uhlir59@gmail.com"
+
+# Admin menu: (popisek, odkaz, FA ikona, super_only). super_only = jen pro SUPER_ADMIN_EMAIL.
+ADMIN_MENU_ITEMS = [
+    ("Alerting", "/portal/alerting/rules", "fa-bell", False),
+    ("Audit", "/portal/audit", "fa-clipboard-list", False),
+    ("Environment", "/portal/admin/environment", "fa-sliders", True),
+    ("Incidenty", "/portal/incidents", "fa-triangle-exclamation", False),
+    ("Migration Readiness", "/portal/migration-readiness", "fa-diagram-project", True),
+    ("Nasazení", "/portal/deployments", "fa-rocket", False),
+    ("Plánované skripty", "/portal/scheduled-scripts", "fa-calendar-days", False),
+    ("Přehled", "/portal/operations", "fa-gauge-high", False),
+    ("Runtime Management", "/portal/admin/runtime", "fa-server", True),
+    ("Služby", "/portal/apps", "fa-server", False),
+    ("Úlohy", "/portal/jobs", "fa-list-check", False),
+    ("Users", "/portal/admin/users", "fa-users", False),
+    ("Workery", "/portal/workers", "fa-gears", False),
+    ("Zálohy", "/portal/backups", "fa-box-archive", False),
+]
+
+
+def _alpha_key(label: str) -> str:
+    """Řadicí klíč bez diakritiky (Plánované < Přehled < Služby < Úlohy ...)."""
+    normalized = unicodedata.normalize("NFKD", label)
+    return "".join(ch for ch in normalized if not unicodedata.combining(ch)).lower()
+
 
 def page(title: str, body: str, user=None) -> str:
     nav = ""
@@ -12,26 +40,40 @@ def page(title: str, body: str, user=None) -> str:
     if user:
         username = html.escape(user.get("username", ""))
         display_name = html.escape(user.get("display_name") or user.get("username", ""))
+        role = (user.get("role") or "").lower()
+        email = (user.get("email") or "").strip().lower()
+        can_operate = role in ("admin", "developer")  # provozní sekce: jen dev nebo admin
+        is_super = email == SUPER_ADMIN_EMAIL
+
+        # Guest nemá přístup nikam – nezobrazujeme mu žádné odkazy, jen odhlášení.
+        is_guest = role == "guest"
+
+        # Hlavní navigace: Služby vidí každý přihlášený uživatel (kromě guesta); Úlohy, Plánované
+        # skripty, Alerting a Pro vývojáře jen developer nebo admin.
+        nav_links = ""
+        if not is_guest:
+            nav_links = '<a class="nav-link" href="/portal/apps"><i class="fa-solid fa-server" aria-hidden="true"></i> Služby</a>'
+        if can_operate:
+            nav_links += (
+                '<a class="nav-link" href="/portal/jobs"><i class="fa-solid fa-list-check" aria-hidden="true"></i> Úlohy</a>'
+                '<a class="nav-link" href="/portal/scheduled-scripts"><i class="fa-solid fa-calendar-days" aria-hidden="true"></i> Plánované skripty</a>'
+                '<a class="nav-link" href="/portal/alerting/rules"><i class="fa-solid fa-bell" aria-hidden="true"></i> Alerting</a>'
+                '<a class="nav-link" href="/portal/developers"><i class="fa-solid fa-code" aria-hidden="true"></i> Pro vývojáře</a>'
+            )
+
         admin_menu = ""
-        if (user.get("role") or "").lower() == "admin":
-            admin_menu = """
+        if role == "admin":
+            visible_items = [item for item in ADMIN_MENU_ITEMS if not item[3] or is_super]
+            visible_items.sort(key=lambda item: _alpha_key(item[0]))
+            admin_links = "".join(
+                f'<a href="{href}"><i class="fa-solid {icon}" aria-hidden="true"></i> {html.escape(label)}</a>'
+                for label, href, icon, _super_only in visible_items
+            )
+            admin_menu = f"""
                 <details class="nav-menu">
                     <summary class="nav-menu-button"><i class="fa-solid fa-screwdriver-wrench" aria-hidden="true"></i> Admin</summary>
                     <div class="nav-menu-panel">
-                        <a href="/portal/operations"><i class="fa-solid fa-gauge-high" aria-hidden="true"></i> Přehled</a>
-                        <a href="/portal/apps"><i class="fa-solid fa-server" aria-hidden="true"></i> Služby</a>
-                        <a href="/portal/jobs"><i class="fa-solid fa-list-check" aria-hidden="true"></i> Úlohy</a>
-                        <a href="/portal/scheduled-scripts"><i class="fa-solid fa-calendar-days" aria-hidden="true"></i> Plánované skripty</a>
-                        <a href="/portal/alerting/rules"><i class="fa-solid fa-bell" aria-hidden="true"></i> Alerting</a>
-                        <a href="/portal/migration-readiness"><i class="fa-solid fa-diagram-project" aria-hidden="true"></i> Migration Readiness</a>
-                        <a href="/portal/deployments"><i class="fa-solid fa-rocket" aria-hidden="true"></i> Nasazení</a>
-                        <a href="/portal/incidents"><i class="fa-solid fa-triangle-exclamation" aria-hidden="true"></i> Incidenty</a>
-                        <a href="/portal/workers"><i class="fa-solid fa-gears" aria-hidden="true"></i> Workery</a>
-                        <a href="/portal/admin/runtime"><i class="fa-solid fa-server" aria-hidden="true"></i> Runtime Management</a>
-                        <a href="/portal/admin/environment"><i class="fa-solid fa-sliders" aria-hidden="true"></i> Environment</a>
-                        <a href="/portal/admin/users"><i class="fa-solid fa-users" aria-hidden="true"></i> Users</a>
-                        <a href="/portal/audit"><i class="fa-solid fa-clipboard-list" aria-hidden="true"></i> Audit</a>
-                        <a href="/portal/backups"><i class="fa-solid fa-box-archive" aria-hidden="true"></i> Zálohy</a>
+                        {admin_links}
                     </div>
                 </details>
             """
@@ -39,11 +81,7 @@ def page(title: str, body: str, user=None) -> str:
             <button type="button" class="nav-toggle" aria-label="Otevřít menu" onclick="togglePortalNav()"><i class="fa-solid fa-bars" aria-hidden="true"></i></button>
             <div class="nav-wrap" id="portal-nav">
                 <nav>
-                    <a class="nav-link" href="/portal/apps"><i class="fa-solid fa-server" aria-hidden="true"></i> Služby</a>
-                    <a class="nav-link" href="/portal/jobs"><i class="fa-solid fa-list-check" aria-hidden="true"></i> Úlohy</a>
-                    <a class="nav-link" href="/portal/scheduled-scripts"><i class="fa-solid fa-calendar-days" aria-hidden="true"></i> Plánované skripty</a>
-                    <a class="nav-link" href="/portal/alerting/rules"><i class="fa-solid fa-bell" aria-hidden="true"></i> Alerting</a>
-                    <a class="nav-link" href="/portal/developers"><i class="fa-solid fa-code" aria-hidden="true"></i> Pro vývojáře</a>
+                    {nav_links}
                     {admin_menu}
                     <div class="user-menu">
                         <span class="user-name">{display_name}</span>