chore: merge upstream/main into admin-frontend-domain preserving custom domain and branding features

src/locales/de/translation.json

@@ -148,6 +148,10 @@
     "Loading": "Laden",
     "Services": "Services",
     "DashboardOriginalHost": "Agent Verbindungsadresse [Domainname/IP:port]",
+    "DashboardHost": "Dashboard-Host für OAuth2-Callback [Domainname/IP:port]",
+    "DashboardHostHint": "Der öffentliche Host des Dashboards zum Erstellen der OAuth2-Callback-URL. Setzen Sie diesen Wert, wenn das Dashboard über eine andere Domain als die Agent-Verbindungsadresse erreichbar ist. Leer lassen, um dem Request-Host unverändert zu vertrauen.",
+    "ReservedHosts": "Reservierte Hosts (kommagetrennt; öffentliche/Reverse-Proxy-Domains, die Mitglieder nicht als NAT-Domain nutzen dürfen)",
+    "ReservedHostsHint": "Hinter einem Reverse-Proxy sieht das Dashboard seine eigene öffentliche Domain nicht und ist daher nicht automatisch geschützt. Tragen Sie hier jeden öffentlichen Eingangs-Hostnamen ein, sonst könnte ein Mitglied ihn als NAT-Domain registrieren und das Dashboard-Routing übernehmen.",
     "NavigateTo": "Navigieren",
     "Offline": "Offline",
     "Interval": "Intervall",
@@ -161,7 +165,6 @@
     "Login": "Anmelden",
     "NewPassword": "Neues Passwort",
     "FileManager": "Pseudo File Manager",
-    "ShowInService": "Zeige in Service",
     "CommunityThemeDescription": "Dieses Design wird von der Community bereitgestellt, Benutzung auf eigene Gefahr",
     "Language": "Sprache",
     "FullIPNotification": "Vollständige IP-Adresse in Benachrichtigung anzeigen",
@@ -180,5 +183,30 @@
     "EmptyNote": "Du hast noch keine Notizen.",
     "BackToHome": "Zurück zur Startseite",
     "OnAlert": "Server mit Warnung",
-    "EmptyText": "Text ist leer"
+    "EmptyText": "Text ist leer",
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copy": "Copy",
+    "Copied": "Copied to clipboard",
+    "Scopes": "Scopes"
 }

src/locales/en/translation.json

@@ -83,7 +83,6 @@
     "Confirm": "Confirm",
     "ConfirmDeletion": "Confirm Deletion?",
     "Services": "Services",
-    "ShowInService": "Show in Service",
     "Coverages": {
         "Excludes": "Excludes Specific Servers",
         "Only": "Only Specific Servers",
@@ -136,9 +135,16 @@
     "EditServerGroup": "Edit Server Group",
     "CreateServerGroup": "Create Server Group",
     "User": "User",
+    "Owner": "Owner",
+    "GlobalAgent": "Global Agent",
+    "UnknownUser": "Unknown user (#{{id}})",
     "WAF": "Web Application Firewall",
     "SiteName": "Site Name",
     "DashboardOriginalHost": "Agent connecting address [domain name/IP:port]",
+    "DashboardHost": "Dashboard host for OAuth2 callback [domain name/IP:port]",
+    "DashboardHostHint": "The dashboard's public host used to build the OAuth2 callback URL. Set this when the dashboard is reached on a different domain than the agent connecting address. Leave empty to trust the request Host as-is.",
+    "ReservedHosts": "Reserved hosts (comma-separated; public/reverse-proxy domains members cannot use as NAT domains)",
+    "ReservedHostsHint": "Behind a reverse proxy the dashboard cannot see its own public domain, so it is not auto-protected. List every public entry hostname here, or a member could register it as a NAT domain and hijack dashboard routing.",
     "ConfigTLS": "Use TLS to connect Agent",
     "LoginFailed": "Login Failed",
     "BruteForceAttackingToken": "Brute Force Attacking Token",
@@ -157,6 +163,7 @@
     "DomainNotificationDays": "Domain Notification Days",
     "ServerNotificationDays": "Server Notification Days",
     "FullIPNotification": "Show Full IP Address in Notification Messages",
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
     "EditService": "Edit Service",
     "CreateService": "Create Service",
     "EditTask": "Edit Task",
@@ -260,5 +267,60 @@
     "ClipboardWriteFailed": "Clipboard write failed",
     "PastedFromClipboard": "Pasted from clipboard",
     "ClipboardReadFailed": "Clipboard read failed",
-    "FormatMetricUnits": "Format Metric Units"
+    "FormatMetricUnits": "Format Metric Units",
+    "Status": "Status",
+    "ServerID": "Server ID",
+    "CreatedAt": "Created At",
+    "BatchMoveServer": "Batch Move Server Owner",
+    "Servers": "Servers",
+    "ToUser": "To User",
+    "Move": "Move",
+    "Transfer": {
+        "Title": "Server Transfers",
+        "PageHint": "Tracks ownership transfers initiated from the batch-move action. Pending entries can be cancelled; terminal entries can be retried.",
+        "From": "From",
+        "To": "To",
+        "Initiator": "Initiator",
+        "LastError": "Last Error",
+        "Retry": "Retry",
+        "CancelRequested": "Cancellation requested",
+        "RetryRequested": "Retry requested",
+        "BatchSubmitted": "Batch transfer submitted",
+        "PendingCount": "{{count}} pending",
+        "PermissionDeniedCount": "{{count}} permission denied",
+        "AlreadyTransferringCount": "{{count}} already transferring",
+        "ServerNotFoundCount": "{{count}} not found",
+        "SameOwnerCount": "{{count}} already owned by target",
+        "AgentTooOldCount": "{{count}} agent too old (upgrade required)",
+        "StatusPending": "Pending",
+        "StatusVerified": "Verified",
+        "StatusFailed": "Failed",
+        "StatusTimeout": "Timeout",
+        "StatusCancelled": "Cancelled"
+    },
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copy": "Copy",
+    "Copied": "Copied to clipboard",
+    "Done": "Done",
+    "Scopes": "Scopes"
 }

src/locales/es/translation.json

@@ -51,7 +51,6 @@
     "Coverage": "Cobertura",
     "LocalService": "Servicio local",
     "InstallCommands": "Comando de instalación",
-    "ShowInService": "Mostrar en servicio",
     "Coverages": {
         "Alarmed": "Ejecutado en el servidor que activó la alarma",
         "Excludes": "Excluir servidores específicos",
@@ -158,6 +157,10 @@
     "RequestType": "Tipo de solicitud",
     "RequestBody": "Cuerpo de la solicitud",
     "DashboardOriginalHost": "Dirección de conexión del Agent [nombre de dominio/IP:puerto]",
+    "DashboardHost": "Host del panel para el callback de OAuth2 [nombre de dominio/IP:puerto]",
+    "DashboardHostHint": "Host público del panel usado para construir la URL de callback de OAuth2. Configúralo cuando se acceda al panel en un dominio distinto al de la dirección de conexión del Agent. Déjalo vacío para confiar en el Host de la petición tal cual.",
+    "ReservedHosts": "Hosts reservados (separados por comas; dominios públicos/proxy inverso que los miembros no pueden usar como dominio NAT)",
+    "ReservedHostsHint": "Detrás de un proxy inverso, el panel no ve su propio dominio público, por lo que no se protege automáticamente. Indique aquí todos los nombres de host de entrada públicos; de lo contrario, un miembro podría registrarlo como dominio NAT y secuestrar el enrutamiento del panel.",
     "ConfigTLS": "Usar TLS para conectar el Agent",
     "CustomCodes": "Códigos personalizados (Style y Script)",
     "CustomCodesDashboard": "Códigos personalizados para el Dashboard",
@@ -254,5 +257,29 @@
     "CopiedToClipboard": "Copiar al portapapeles",
     "ClipboardWriteFailed": "Error al escribir en el portapapeles",
     "PastedFromClipboard": "Pegado del portapapeles",
-    "ClipboardReadFailed": "Falló la lectura del portapapeles"
+    "ClipboardReadFailed": "Falló la lectura del portapapeles",
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copied": "Copied to clipboard",
+    "Scopes": "Scopes"
 }

src/locales/fr/translation.json

@@ -64,7 +64,6 @@
     "Confirm": "Confirmer",
     "ConfirmDeletion": "Confirmer la suppression ?",
     "Services": "Services",
-    "ShowInService": "Montrer en service",
     "MaximumLatency": "Délai maximum (ms)",
     "MinimumLatency": "Délai minimum (millisecondes)",
     "Command": "Commande",
@@ -92,5 +91,30 @@
     "UserInvalid": "L’utilisateur est invalide",
     "BlockByUser": "Bloqué par un administrateur",
     "OnlineUser": "Utilisateur en ligne",
-    "UserId": "ID utilisateur"
+    "UserId": "ID utilisateur",
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copy": "Copy",
+    "Copied": "Copied to clipboard",
+    "Scopes": "Scopes"
 }

src/locales/gl/translation.json

@@ -21,5 +21,31 @@
         "NoRowsAreSelected": "Non hai filas seleccionadas",
         "ThisOperationIsUnrecoverable": "A operación non se pode desfacer!",
         "TaskTriggeredSuccessfully": "A tarefa desencadeouse correctamente"
-    }
+    },
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copy": "Copy",
+    "Copied": "Copied to clipboard",
+    "Done": "Done",
+    "Scopes": "Scopes"
 }

src/locales/id/translation.json

@@ -83,7 +83,6 @@
     "Confirm": "Konfirmasi",
     "ConfirmDeletion": "Konfirmasi Penghapusan?",
     "Services": "Layanan",
-    "ShowInService": "Tampilkan di Layanan",
     "Coverages": {
         "Excludes": "Kecualikan Server Tertentu",
         "Only": "Hanya Server Tertentu",
@@ -139,6 +138,10 @@
     "WAF": "Firewall Aplikasi Web",
     "SiteName": "Nama Situs",
     "DashboardOriginalHost": "Alamat koneksi Agen [nama domain/IP:port]",
+    "DashboardHost": "Host dashboard untuk callback OAuth2 [nama domain/IP:port]",
+    "DashboardHostHint": "Host publik dashboard yang dipakai untuk membangun URL callback OAuth2. Atur ini bila dashboard diakses pada domain yang berbeda dari alamat koneksi Agen. Kosongkan untuk mempercayai Host permintaan apa adanya.",
+    "ReservedHosts": "Host khusus (dipisahkan koma; domain publik/reverse-proxy yang tidak boleh dipakai anggota sebagai domain NAT)",
+    "ReservedHostsHint": "Di belakang reverse proxy, dasbor tidak melihat domain publiknya sendiri sehingga tidak terlindungi otomatis. Cantumkan setiap host entri publik di sini, atau anggota bisa mendaftarkannya sebagai domain NAT dan membajak perutean dasbor.",
     "ConfigTLS": "Gunakan TLS untuk menghubungkan Agen",
     "LoginFailed": "Gagal Masuk",
     "BruteForceAttackingToken": "Token Serangan Brute Force",
@@ -255,5 +258,62 @@
     "ClipboardWriteFailed": "Gagal menulis ke papan klip",
     "PastedFromClipboard": "Ditempel dari papan klip",
     "ClipboardReadFailed": "Gagal membaca papan klip",
-    "FormatMetricUnits": "Format Satuan Metrik"
+    "FormatMetricUnits": "Format Satuan Metrik",
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copied": "Copied to clipboard",
+    "Scopes": "Scopes",
+    "Owner": "Pemilik",
+    "GlobalAgent": "Agen Global",
+    "UnknownUser": "Pengguna tidak dikenal (#{{id}})",
+    "Status": "Status",
+    "ServerID": "ID Server",
+    "CreatedAt": "Dibuat Pada",
+    "BatchMoveServer": "Pindahkan Pemilik Server Secara Batch",
+    "Servers": "Server",
+    "ToUser": "Ke Pengguna",
+    "Move": "Pindahkan",
+    "Transfer": {
+        "Title": "Transfer Server",
+        "PageHint": "Melacak transfer kepemilikan yang dimulai dari tindakan pindah batch. Entri yang masih tertunda dapat dibatalkan; entri terminal dapat dicoba lagi.",
+        "From": "Dari",
+        "To": "Ke",
+        "Initiator": "Pemrakarsa",
+        "LastError": "Kesalahan Terakhir",
+        "Retry": "Coba Lagi",
+        "CancelRequested": "Permintaan pembatalan dikirim",
+        "RetryRequested": "Permintaan coba lagi dikirim",
+        "BatchSubmitted": "Transfer batch dikirim",
+        "PendingCount": "{{count}} tertunda",
+        "PermissionDeniedCount": "{{count}} izin ditolak",
+        "AlreadyTransferringCount": "{{count}} sudah dalam proses transfer",
+        "ServerNotFoundCount": "{{count}} tidak ditemukan",
+        "SameOwnerCount": "{{count}} sudah dimiliki oleh target",
+        "AgentTooOldCount": "{{count}} agen terlalu lama versinya (perlu upgrade)",
+        "StatusPending": "Tertunda",
+        "StatusVerified": "Terverifikasi",
+        "StatusFailed": "Gagal",
+        "StatusTimeout": "Batas waktu habis",
+        "StatusCancelled": "Dibatalkan"
+    }
 }

src/locales/it/translation.json

@@ -73,7 +73,6 @@
     "Confirm": "Confermo",
     "ConfirmDeletion": "Confermi l'eliminazione?",
     "Services": "Servizi",
-    "ShowInService": "Mostra in servizio",
     "Coverages": {
         "Only": "Solo server specifici",
         "Excludes": "Escludi server specifici",
@@ -142,6 +141,10 @@
     "CustomCodes": "Codice personalizzato (stili e script)",
     "CustomCodesDashboard": "Codice personalizzato per dashboard",
     "DashboardOriginalHost": "Indirizzo di ancoraggio dell'agente [nome dominio/IP:porta]",
+    "DashboardHost": "Host della dashboard per il callback OAuth2 [nome dominio/IP:porta]",
+    "DashboardHostHint": "Host pubblico della dashboard usato per costruire l'URL di callback OAuth2. Impostalo quando la dashboard è raggiungibile su un dominio diverso dall'indirizzo di connessione dell'agente. Lascia vuoto per fidarti dell'Host della richiesta così com'è.",
+    "ReservedHosts": "Host riservati (separati da virgola; domini pubblici/reverse-proxy che i membri non possono usare come dominio NAT)",
+    "ReservedHostsHint": "Dietro un reverse proxy il pannello non vede il proprio dominio pubblico, quindi non è protetto automaticamente. Elenca qui ogni hostname di ingresso pubblico, altrimenti un membro potrebbe registrarlo come dominio NAT e dirottare il routing del pannello.",
     "ConfigTLS": "Usa TLS per connettere Agent",
     "CustomPublicDNSNameserversforDDNS": "Server dei nomi DNS pubblici personalizzati per DDNS",
     "WebRealIPHeader": "Intestazione della richiesta IP reale del frontend",
@@ -175,5 +178,30 @@
     "OnlineUser": "Utente online",
     "BlockIdentifier": "Identificatore del blocco",
     "UserId": "ID utente",
-    "ConnectedAt": "Connesso alle"
+    "ConnectedAt": "Connesso alle",
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copy": "Copy",
+    "Copied": "Copied to clipboard",
+    "Scopes": "Scopes"
 }

src/locales/ja/translation.json

@@ -1 +1,28 @@
-{}
+{
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copy": "Copy",
+    "Copied": "Copied to clipboard",
+    "Done": "Done",
+    "Scopes": "Scopes"
+}

src/locales/pt-BR/translation.json

@@ -0,0 +1,3 @@
+{
+    "nezha": "Nezha Monitoramento"
+}

src/locales/ro/translation.json

@@ -0,0 +1,314 @@
+{
+    "nezha": "Monitor-ul Nezha",
+    "theme": {
+        "light": "Mod luminos",
+        "dark": "Mod întunecat",
+        "system": "Monitorizeaza sistem-ul"
+    },
+    "Username": "Nume de utilizator",
+    "Password": "Parolă",
+    "InvalidUsernameOrPassword": "Nume de utilizator sau parolă incorectă",
+    "NetworkError": "Problemă cu rețeaua",
+    "LoginFirst": "Autentificati-vă, pentru a continua",
+    "CurrentTime": "Ora actuală",
+    "Results": {
+        "UsernameMin": "Numele de utilizator trebuie să conține cel puțin {{number}} de caractere lung.",
+        "PasswordRequired": "Parola nu poate fii goală.",
+        "ErrorFetchingResource": "Error Fetching Resource: {{error}}",
+        "SelectAtLeastOneServer": "Alege-ți cel puțin un server.",
+        "UnExpectedError": "Eroare neașteptată, verificați consola pentru mai multe informații.",
+        "ForceUpdate": "Upgradare forțată:",
+        "NoRowsAreSelected": "Nu este niciun rând selectat",
+        "ThisOperationIsUnrecoverable": "Această acțiune este ireversibilă!",
+        "TaskTriggeredSuccessfully": "Sarcina a fost declanșată cu succes",
+        "TheServerDoesNotOnline": "Server-ul nu exista sau nu a fost incă connectat",
+        "InstallHostRequired": "Adresa de connectare a agentului nu a fost incă completată in setări.",
+        "UnknownIdentifier": "Identificator necunoscut"
+    },
+    "Login": "Autentificare",
+    "Server": "Server",
+    "Service": "Service",
+    "Task": "Sarcină",
+    "Notification": "Notificare",
+    "DDNS": "DNS dinamic",
+    "NATT": "Traversare NAT",
+    "Group": "Grupă",
+    "Profile": "Profil",
+    "Settings": "Setări sistem",
+    "BackToHome": "Spre pagina principală",
+    "Logout": "Deconectare",
+    "NavigateTo": "Spre",
+    "SelectAPageToNavigateTo": "Du-te la pagina",
+    "Close": "Închide",
+    "Error": "Eroare",
+    "Name": "Nume",
+    "Version": "Versiune",
+    "Unknown": "Necunoscut",
+    "Enable": "Permite",
+    "HideForGuest": "Ascuns de vizitatori",
+    "InstallCommands": "Comanda de instalare",
+    "Terminal": "Terminal",
+    "Config": "Config",
+    "Note": "Notiță",
+    "Success": "Succes",
+    "Done": "Finalizat",
+    "Offline": "Offline",
+    "Failure": "Eșuare",
+    "Loading": "Se incarcă",
+    "NoResults": "Niciun resultat",
+    "Actions": "Acțiuni",
+    "EditServer": "Editează server-ul",
+    "Weight": "Greutate (cu căt mai mare este numărul, cu atâta de sus este afișat)",
+    "DDNSProfiles": "ID-urile de profil DDNS",
+    "SeparateWithComma": "(Separă cu virgulă)",
+    "Public": "Public",
+    "Private": "Privat",
+    "Submit": "Trimite",
+    "Target": "Obiectiv",
+    "Coverage": "Acoperire",
+    "CoverAll": "Acoperă-le pe toate",
+    "IgnoreAll": "Ignoră tot",
+    "OnAlert": "Server-ele alarmate",
+    "SpecificServers": "Server specific",
+    "Type": "Tip",
+    "Interval": "Interval",
+    "NotifierGroupID": "Notifier Group ID",
+    "Trigger": "La declanșare",
+    "TasksToTriggerOnAlert": "Sarcini, care sa fie declanșate la alerta",
+    "TasksToTriggerAfterRecovery": "Sarcini, care sa fie declanșate după recuperare",
+    "Add": "Adaugă",
+    "Delete": "Sterge",
+    "AdvancedJSON": "JSON avansat",
+    "Save": "Salvează",
+    "Confirm": "Confirmă",
+    "ConfirmDeletion": "Confirmă stergerea?",
+    "Services": "Servicii",
+    "ShowInService": "Deschide in servicii",
+    "Coverages": {
+        "Excludes": "Exclude servere specifice",
+        "Only": "Numai servere specifice",
+        "Alarmed": "Executate pe server-ul care declanșeaza alarma"
+    },
+    "EnableFailureNotification": "Activează notificare la eșec",
+    "MaximumLatency": "Delay-ul maximal (ms)",
+    "MinimumLatency": "Delay-ul minimal (ms)",
+    "EnableLatencyNotification": "Activează notificare de latență",
+    "EnableTriggerTask": "Activează sarcină de declanșare",
+    "CronExpression": "Expresii Cron",
+    "Command": "Commandă",
+    "NotifierGroup": "Grupa, care sa fie informată",
+    "SendSuccessNotification": "Trimite notificare de succes",
+    "LastExecution": "Ultima execuție",
+    "Result": "Rezultatul",
+    "Scheduled": "Sarcină programată",
+    "AlertRule": "Reguli de alertă",
+    "VerifyTLS": "Verifică TLS-ul",
+    "TriggerMode": "Modul de declanșare",
+    "Rules": "Reguli",
+    "RequestMethod": "Metoda de request",
+    "RequestHeader": "Header-ul de request",
+    "DoNotSendTestMessage": "Nu trimite mesaj de test",
+    "Always": "Mereu",
+    "Once": "Odată",
+    "Provider": "Furnizor",
+    "Domains": "Domenii",
+    "MaximumRetryAttempts": "Durata maximă pentru încercările de reluare",
+    "Refresh": "Reincarcă",
+    "CopyPath": "Copiază calea",
+    "Goto": "Accesează",
+    "UpdateProfile": "Actualizează profil-ul",
+    "NewUsername": "Nume de utilizator nou",
+    "OriginalPassword": "Parola originală",
+    "NewPassword": "Parola noua",
+    "EditDDNS": "Modifică DDNS-ul",
+    "CreateDDNS": "Crează un DDNS",
+    "RequestType": "Tip-ul de request",
+    "RequestBody": "Request Body",
+    "FileManager": "Pseudo manager de fișiere",
+    "Downloading": "Se descarcă",
+    "Uploading": "Se încarcă",
+    "EditNAT": "Modifică configurarea NAT",
+    "CreateNAT": "Crează o configurare NAT",
+    "LocalService": "Serviciu local",
+    "BindHostname": "Leagă numele de domeniu",
+    "EditServerGroup": "Modifică grupa de servere",
+    "CreateServerGroup": "Crează o grupă de servere",
+    "User": "Utilizator",
+    "Owner": "Propietar",
+    "GlobalAgent": "Agent global",
+    "UnknownUser": "Utilizator necunoscut (#{{id}})",
+    "WAF": "Web Application Firewall",
+    "SiteName": "Numele site-ului",
+    "DashboardOriginalHost": "Adresa de conectare a agentului [numele domeniului/IP:port]",
+    "DashboardHost": "Host-ul panoului pentru callback-ul OAuth2 [numele domeniului/IP:port]",
+    "DashboardHostHint": "Host-ul public al panoului folosit pentru a construi URL-ul de callback OAuth2. Setați-l când panoul este accesat pe un domeniu diferit de adresa de conectare a agentului. Lăsați gol pentru a avea încredere în Host-ul cererii ca atare.",
+    "ReservedHosts": "Host-uri reservate (separate prin virgulă; domeniile publice sau ale reverse proxy-urilor nu pot fi utilizate ca domenii NAT)",
+    "ReservedHostsHint": "În spatele unui reverse proxy, dashboard-ul nu își poate vedea propriul domeniu public, prin urmare nu este protejat automat. Trebuie să menționați aici toate hostname-urile ale intrărilor publice; în caz contrar, un membru ar putea să le înregistreze ca domenii NAT și să deturneze rutarea către dashboard.",
+    "ConfigTLS": "Folosește TLS pentru a conecta agentul",
+    "LoginFailed": "Autentificarea a eșuat",
+    "BruteForceAttackingToken": "Brute force atacează token-ul",
+    "BruteForceAttackingAgentSecret": "Brute force atacează agentul secret",
+    "Language": "Limbă",
+    "CustomCodes": "Cod custom (Style și script)",
+    "CustomCodesDashboard": "Cod custom pentru dashboard",
+    "CustomPublicDNSNameserversforDDNS": "Servere de nume DNS publice personalizate pentru DDNS",
+    "WebRealIPHeader": "adresa reală IP frontend request header",
+    "AgentRealIPHeader": "adresa reală IP a agentului request header",
+    "UseDirectConnectingIP": "Folosește conexiune IP directă",
+    "IPChangeNotification": "Notificare la schimbare de adresa IP",
+    "FullIPNotification": "Afișează intreaga adresa IP in notificări",
+    "EnableMCP": "Activează endpoint-uri MCP (implicit dezactivate; Verificați mai întâi domeniile de aplicare ale tokenurilor API și lista de servere permise)",
+    "EditService": "Modifică serviciul",
+    "CreateService": "Creează un serviciu",
+    "EditTask": "Modifică sarcina",
+    "CreateTask": "Creează sarcină",
+    "CreateNotifier": "Creează un notificator",
+    "EditNotifier": "Modifică notificatorul",
+    "EditAlertRule": "Modifică regurile de alertare",
+    "CreateAlertRule": "Creează reguli de alertare",
+    "EditNotifierGroup": "Modifică grupa, care va fii notificată",
+    "CreateNotifierGroup": "Creează o grupă de notificare",
+    "NewUser": "Utilizator nou",
+    "Count": "Numără",
+    "LastBlockReason": "Motivul ultimului block",
+    "LastBlockTime": "Ultima perioadă de ban",
+    "Theme": "Temă",
+    "Author": "Autor",
+    "Repository": "Repository",
+    "Community": "Comunitate",
+    "Official": "Oficial",
+    "CommunityThemeWarning": "Utilizezi momentan o temă creată de către comunitate",
+    "CommunityThemeDescription": "Această temă este dezvoltată de către comunitate, o folosiți pe propria răspundere",
+    "Cancel": "Anulare",
+    "EnableDDNS": "Activează DDNS",
+    "PushSuccessful": "Push dacă a fost cu sucess",
+    "GrpcAuthFailed": "Autentificarea gRPC a eșuat",
+    "APITokenInvalid": "Token-ul API este invalid",
+    "UserInvalid": "Utilizator-ul este invalid",
+    "BlockByUser": "Blocat de către administrator",
+    "BlockIdentifier": "Identificator de block",
+    "UserId": "User ID",
+    "ConnectedAt": "Ultima dată conectat pe",
+    "OnlineUser": "Utilizator activ",
+    "Total": "Total",
+    "ConfirmBlock": "Confirmă blocarea",
+    "RejectPassword": "Respinge logarea cu parolă",
+    "EmptyText": "Text este gol",
+    "EmptyNote": "Nu ai nici-o notiță.",
+    "OverrideDDNSDomains": "Suprascriere domenii DDNS (per configurație)",
+    "EditServerConfig": "Modifică configurarea server-ului",
+    "Option": "Optiune",
+    "Value": "Valoare",
+    "Preview": "Previzualizare",
+    "PublicNote": {
+        "Label": "Notiță publică",
+        "Billing": "Facturare",
+        "Plan": "Tarif",
+        "StartDate": "Data de incepere",
+        "EndDate": "Date de finalizare",
+        "AutoRenewal": "Reînnoire automată",
+        "Cycle": "Ciclu",
+        "Amount": "Sumă",
+        "Bandwidth": "Bandwidth",
+        "TrafficVolume": "Volumul traficului",
+        "TrafficType": "Tipul traficului",
+        "IPv4": "IPv4",
+        "IPv6": "IPv6",
+        "NetworkRoute": "Rută network",
+        "Extra": "Extra",
+        "Enabled": "Activat",
+        "Disabled": "Dezactivat",
+        "Inbound": "Detaliat",
+        "Both": "Amândouă",
+        "Day": "Zi",
+        "Week": "Săptămână",
+        "Month": "Lună",
+        "Year": "An",
+        "NoExpiry": "Nici-o expirare",
+        "SetNoExpiry": "Setează nici-o expirare",
+        "CancelNoExpiry": "Anulează nici-o expirare",
+        "Free": "Liber",
+        "PayAsYouGo": "Plătești pe măsură ce consumi (Pay as you go)",
+        "CommaSeparated": "Separă mai multe obiecte cu virgulă",
+        "Has": "Are",
+        "None": "Nimica",
+        "CustomFields": "Câmpuri personalizate",
+        "ClearDate": "Sterge data",
+        "Clear": "Curăță",
+        "RawText": "Raw Text"
+    },
+    "Validation": {
+        "InvalidDate": "Dată invalidă",
+        "MustBe0Or1": "Trebuie să fie 0 sau 1",
+        "MustBeDayWeekMonthYear": "Trebuie să fie Zi/Săptămână/Lună/An",
+        "MustBe1Or2": "Trebuie să fie 1 sau 2",
+        "DigitsOnly": "Doar cifre",
+        "InvalidForm": "Formular invalid",
+        "InvalidJSON": "JSON invalid"
+    },
+    "AlertRules": {
+        "CoverAllServers": "Monitorizează toate server-ele",
+        "IgnoreAllSelectSpecific": "Ignoră totul, selectează server specifice",
+        "IgnoreHint": "{{server}} ID: adevărat/fals",
+        "IgnoreExample": "de exemplu, {\"1\": true, \"2\": false}"
+    },
+    "Search": "Caută...",
+    "Format": "Formatează",
+    "Formatted": "Formatat",
+    "Copy": "Copiază",
+    "Paste": "Lipește",
+    "CopiedToClipboard": "Copiat in clipboard",
+    "ClipboardWriteFailed": "Eșec la scrierea în clipboard",
+    "PastedFromClipboard": "Lipit din clipboard",
+    "ClipboardReadFailed": "Eșec la citirea clipboard-ului",
+    "FormatMetricUnits": "Format unități metrice",
+    "Status": "Status",
+    "ServerID": "ID-ul server-ului",
+    "CreatedAt": "Creat la",
+    "BatchMoveServer": "Mutarea în bloc a proprietarului serverului",
+    "Servers": "Servere",
+    "ToUser": "Spre utilizator",
+    "Move": "Transferă",
+    "Transfer": {
+        "Title": "Transfere de server",
+        "PageHint": "Urmărește transferurile de proprietate inițiate prin acțiunea de mutare în bloc. Înregistrările în așteptare pot fi anulate, iar cele finalizate pot fi reluate.",
+        "From": "De la",
+        "To": "Pentru",
+        "Initiator": "Inițiator",
+        "LastError": "Ultima eroare",
+        "Retry": "Reîncearcă",
+        "CancelRequested": "Anularea a fost solicitată",
+        "RetryRequested": "Reîncercarea a fost solicitată",
+        "BatchSubmitted": "Transferul în bloc a fost trimis",
+        "PendingCount": "{{count}} în așteptare",
+        "PermissionDeniedCount": "{{count}} a fost refuzat accesul",
+        "AlreadyTransferringCount": "{{count}} se transferă deja",
+        "ServerNotFoundCount": "{{count}} nu au fost găsite",
+        "SameOwnerCount": "{{count}} sunt deja deținute de destinatar",
+        "AgentTooOldCount": "{{count}} agenți sunt prea vechi (este necesară o actualizare)",
+        "StatusPending": "În așteptare",
+        "StatusVerified": "Verificat",
+        "StatusFailed": "A eșuat",
+        "StatusTimeout": "Timeout",
+        "StatusCancelled": "Anulat"
+    },
+    "ApiTokens": "Token-uri API",
+    "CreateApiToken": "Creează un token API",
+    "CreateApiTokenDescription": "Tokenurile autentifică MCP și clienții externi în numele dumneavoastră. Acestea nu pot depăși limitele permisiunilor dumneavoastră.",
+    "ConfirmDeleteApiToken": "Revocă API token-ul '{{name}}'? Această acțiune eset ireversibilă.",
+    "ApiTokenRevoked": "API token-ul a fost revocat.",
+    "ApiTokenCreated": "API token-ul a fost creat",
+    "ApiTokenRevealOnce": "Copiază acest token acum. Nu va mai fi afișat niciodată.",
+    "ApiTokenStoreSafely": "Tratează acest token ca pe o parolă. Oricine îl deține poate acționa în numele tău în limitele de aplicare ale acestuia.",
+    "ApiTokenServers": "Servere",
+    "ApiTokenAllServers": "Toate permise",
+    "ApiTokenNever": "Niciodată",
+    "ApiTokenExpiresAt": "Expiră",
+    "ApiTokenLastUsed": "Ultima dată utilizat",
+    "ApiTokenServerIDs": "Limitare la ID-urile serverelor (opțional)",
+    "ApiTokenServerIDsPlaceholder": "separate prin virgulă, de exemplu 1,2,3",
+    "ApiTokenExpiresInDays": "Expiră in (zile, 0=niciodată)",
+    "Revoke": "Revocă",
+    "Copied": "Copiat în clipboard",
+    "Scopes": "Scope-uri"
+}

src/locales/ru/translation.json

@@ -42,6 +42,10 @@
     "Credential": "Учетные данные",
     "CommunityThemeDescription": "Эта тема предоставлена сообществом, используйте на свой страх и риск",
     "DashboardOriginalHost": "Адрес подключения агента [домен/IP:порт]",
+    "DashboardHost": "Хост панели для OAuth2 callback [домен/IP:порт]",
+    "DashboardHostHint": "Публичный хост панели, используемый для формирования URL обратного вызова OAuth2. Укажите его, если панель доступна на домене, отличном от адреса подключения агента. Оставьте пустым, чтобы доверять Host из запроса как есть.",
+    "ReservedHosts": "Зарезервированные хосты (через запятую; публичные/реверс-прокси домены, которые участники не могут использовать как NAT-домен)",
+    "ReservedHostsHint": "За реверс-прокси панель не видит собственный публичный домен и не защищается автоматически. Укажите здесь все публичные входные хосты, иначе участник сможет зарегистрировать такой домен как NAT-домен и перехватить маршрутизацию панели.",
     "Error": "Ошибка",
     "TriggerMode": "Режим срабатывания",
     "Once": "Один раз",
@@ -176,7 +180,6 @@
     "Language": "Язык",
     "ConfirmDeletion": "Подтвердить удаление?",
     "OriginalPassword": "Старый пароль",
-    "ShowInService": "Показывать в Сервисе",
     "EnableFailureNotification": "Включить уведомления об ошибках",
     "CreateNAT": "Создать NAT-конфигурацию",
     "Scheduled": "Запланированные задачи",
@@ -185,5 +188,30 @@
     "IPChangeNotification": "Уведомление об изменении IP",
     "CreateAlertRule": "Создать правила оповещений",
     "UserId": "ID пользователя",
-    "NewUser": "Новый пользователь"
+    "NewUser": "Новый пользователь",
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copy": "Copy",
+    "Copied": "Copied to clipboard",
+    "Scopes": "Scopes"
 }

src/locales/ta/translation.json

@@ -25,7 +25,6 @@
     },
     "ConfirmDeletion": "நீக்குதலை உறுதிப்படுத்தவா?",
     "Services": "சேவைகள்",
-    "ShowInService": "சேவையில் காட்டு",
     "Coverages": {
         "Excludes": "குறிப்பிட்ட சேவையகங்களை விலக்குகிறது",
         "Only": "குறிப்பிட்ட சேவையகங்கள் மட்டுமே",
@@ -135,6 +134,10 @@
     "WAF": "வலை பயன்பாடு ஃபயர்வால்",
     "SiteName": "தளத்தின் பெயர்",
     "DashboardOriginalHost": "முகவரியை இணைக்கும் முகவரி [டொமைன் பெயர்/ஐபி: போர்ட்]",
+    "DashboardHost": "OAuth2 கால்பேக்கிற்கான டாஷ்போர்டு ஹோஸ்ட் [டொமைன் பெயர்/ஐபி: போர்ட்]",
+    "DashboardHostHint": "OAuth2 கால்பேக் URL-ஐ உருவாக்கப் பயன்படும் டாஷ்போர்டின் பொது ஹோஸ்ட். ஏஜெண்ட் இணைப்பு முகவரியிலிருந்து வேறுபட்ட டொமைனில் டாஷ்போர்டு அணுகப்பட்டால் இதை அமைக்கவும். கோரிக்கையின் Host-ஐ அப்படியே நம்ப காலியாக விடவும்.",
+    "ReservedHosts": "ஒதுக்கப்பட்ட ஹோஸ்ட்கள் (கமாவால் பிரிக்கப்பட்டது; உறுப்பினர்கள் NAT டொமைனாகப் பயன்படுத்த முடியாத பொது/ரிவர்ஸ்-ப்ராக்ஸி டொமைன்கள்)",
+    "ReservedHostsHint": "ரிவர்ஸ்-ப்ராக்ஸிக்குப் பின்னால் டாஷ்போர்டு அதன் சொந்த பொது டொமைனைப் பார்க்க முடியாது, எனவே அது தானாகப் பாதுகாக்கப்படாது. அனைத்து பொது நுழைவு ஹோஸ்ட்களையும் இங்கே பட்டியலிடுங்கள்; இல்லையெனில் ஒரு உறுப்பினர் அதை NAT டொமைனாகப் பதிவுசெய்து டாஷ்போர்டு வழித்தடத்தைக் கடத்தலாம்.",
     "ConfigTLS": "முகவரை இணைக்க TLS ஐப் பயன்படுத்தவும்",
     "LoginFailed": "உள்நுழைவு தோல்வியடைந்தது",
     "BruteForceAttackingToken": "மிருகத்தனமான ஆற்றல் டோக்கனைத் தாக்குகிறது",
@@ -180,5 +183,30 @@
     "ConfirmBlock": "தொகுதி உறுதிப்படுத்தவும்",
     "RejectPassword": "கடவுச்சொல் உள்நுழைவை நிராகரிக்கவும்",
     "EmptyText": "உரை காலியாக உள்ளது",
-    "EmptyNote": "உங்களிடம் எந்த குறிப்பும் இல்லை."
+    "EmptyNote": "உங்களிடம் எந்த குறிப்பும் இல்லை.",
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copy": "Copy",
+    "Copied": "Copied to clipboard",
+    "Scopes": "Scopes"
 }

src/locales/uk/translation.json

@@ -83,7 +83,6 @@
     "Confirm": "Підтвердити",
     "ConfirmDeletion": "Підтвердити видалення?",
     "Services": "Сервіси",
-    "ShowInService": "Показувати у Сервісі",
     "Coverages": {
         "Excludes": "Виключити певні сервери",
         "Only": "Тільки певні сервери",
@@ -127,5 +126,30 @@
     "RequestType": "Тип запиту",
     "RequestBody": "Тіло запиту",
     "FileManager": "Псевдо Менеджер файлів",
-    "Downloading": "Завантаження"
+    "Downloading": "Завантаження",
+    "EnableMCP": "Enable MCP endpoint (off by default; review API token scopes and server allow-list first)",
+    "ApiTokens": "API Tokens",
+    "CreateApiToken": "Create API token",
+    "CreateApiTokenDescription": "Tokens authenticate MCP and external clients on your behalf. They cannot exceed your own permissions.",
+    "ConfirmDeleteApiToken": "Revoke API token '{{name}}'? This cannot be undone.",
+    "ApiTokenRevoked": "API token revoked.",
+    "ApiTokenCreated": "API token created",
+    "ApiTokenRevealOnce": "Copy this token now. It will never be shown again.",
+    "ApiTokenStoreSafely": "Treat this token like a password. Anyone with it can act on your behalf within its scopes.",
+    "ApiTokenServers": "Servers",
+    "ApiTokenAllServers": "all permitted",
+    "ApiTokenNever": "never",
+    "ApiTokenExpiresAt": "Expires",
+    "ApiTokenLastUsed": "Last used",
+    "ApiTokenServerIDs": "Restrict to server IDs (optional)",
+    "ApiTokenServerIDsPlaceholder": "comma-separated, e.g. 1,2,3",
+    "ApiTokenExpiresInDays": "Expires in (days, 0 = never)",
+    "ApiTokenScopeRequired": "At least one scope is required.",
+    "ApiTokenServersInvalid": "Server IDs must be positive integers.",
+    "ApiTokenExpiryInvalid": "Days must be between 0 and 3650.",
+    "NameRequired": "Name is required.",
+    "Revoke": "Revoke",
+    "Copy": "Copy",
+    "Copied": "Copied to clipboard",
+    "Scopes": "Scopes"
 }

src/locales/zh-CN/translation.json

@@ -83,7 +83,6 @@
     "Confirm": "确认",
     "ConfirmDeletion": "确认删除？",
     "Services": "服务",
-    "ShowInService": "服务中显示",
     "Coverages": {
         "Excludes": "排除特定服务器",
         "Only": "仅特定服务器",
@@ -146,12 +145,19 @@
     "EditNotifierGroup": "编辑通知分组",
     "CreateNotifierGroup": "创建通知分组",
     "User": "用户",
+    "Owner": "所属用户",
+    "GlobalAgent": "全局 Agent",
+    "UnknownUser": "未知用户 (#{{id}})",
     "WAF": "Web应用防火墙",
     "SiteName": "站点名称",
     "Language": "语言",
     "CustomCodes": "自定义代码（样式和脚本）",
     "CustomCodesDashboard": "仪表板的自定义代码",
     "DashboardOriginalHost": "Agent对接地址【域名/IP:端口】",
+    "DashboardHost": "面板 OAuth2 回调域名【域名/IP:端口】",
+    "DashboardHostHint": "用于生成 OAuth2 回调地址的面板对外域名。当面板访问域名与 Agent 对接地址不同时设置此项。留空则信任请求 Host，不做强制重写。",
+    "ReservedHosts": "保留 Host（逗号分隔；反代/公网域名，成员不可注册为 NAT 域名）",
+    "ReservedHostsHint": "反代部署下面板看不到自身的对外域名，无法自动保护。请在此列出所有公网入口域名，否则成员可将其注册为 NAT 域名抢占面板路由。",
     "ConfigTLS": "Agent 使用 TLS 连接",
     "CustomPublicDNSNameserversforDDNS": "DDNS 的自定义公共 DNS 名称服务器",
     "WebRealIPHeader": "前端真实IP请求头",
@@ -164,6 +170,7 @@
     "DomainNotificationDays": "域名到期提醒天数",
     "ServerNotificationDays": "VPS到期提醒天数",
     "FullIPNotification": "在通知消息中显示完整的 IP 地址",
+    "EnableMCP": "启用 MCP 接入（默认关闭；启用前请确认已审阅 API 令牌 scope 与服务器白名单）",
     "LoginFailed": "登录失败",
     "BruteForceAttackingToken": "暴力攻击令牌",
     "BruteForceAttackingAgentSecret": "暴力攻击代理秘密",
@@ -260,5 +267,58 @@
     "ClipboardWriteFailed": "无法写入剪贴板",
     "PastedFromClipboard": "已从剪贴板粘贴",
     "ClipboardReadFailed": "无法读取剪贴板",
-    "FormatMetricUnits": "格式化数据单位"
+    "FormatMetricUnits": "格式化数据单位",
+    "Status": "状态",
+    "ServerID": "服务器 ID",
+    "CreatedAt": "创建时间",
+    "BatchMoveServer": "批量转移服务器所有者",
+    "Servers": "服务器",
+    "ToUser": "目标用户",
+    "Move": "转移",
+    "Transfer": {
+        "Title": "服务器转移",
+        "PageHint": "跟踪由批量转移操作发起的所有权转移。待处理条目可以取消；已终止条目可以重试。",
+        "From": "源用户",
+        "To": "目标用户",
+        "Initiator": "发起者",
+        "LastError": "最近错误",
+        "Retry": "重试",
+        "CancelRequested": "已请求取消",
+        "RetryRequested": "已请求重试",
+        "BatchSubmitted": "批量转移已提交",
+        "PendingCount": "{{count}} 个待处理",
+        "PermissionDeniedCount": "{{count}} 个权限不足",
+        "AlreadyTransferringCount": "{{count}} 个正在转移中",
+        "ServerNotFoundCount": "{{count}} 个未找到",
+        "SameOwnerCount": "{{count}} 个已属于目标用户",
+        "AgentTooOldCount": "{{count}} 个 agent 版本过低（需升级）",
+        "StatusPending": "待处理",
+        "StatusVerified": "已验证",
+        "StatusFailed": "已失败",
+        "StatusTimeout": "已超时",
+        "StatusCancelled": "已取消"
+    },
+    "ApiTokens": "API 令牌",
+    "CreateApiToken": "创建 API 令牌",
+    "CreateApiTokenDescription": "令牌用于 MCP 和外部客户端以你的身份调用 API，权限不能超过你本人。",
+    "ConfirmDeleteApiToken": "确定吊销 API 令牌 '{{name}}'？此操作不可撤销。",
+    "ApiTokenRevoked": "API 令牌已吊销。",
+    "ApiTokenCreated": "API 令牌已创建",
+    "ApiTokenRevealOnce": "请立即复制此令牌，离开后将无法再次查看。",
+    "ApiTokenStoreSafely": "请像密码一样妥善保管。任何持有者都可在 scope 内以你的身份操作。",
+    "ApiTokenServers": "服务器",
+    "ApiTokenAllServers": "全部可访问",
+    "ApiTokenNever": "永不",
+    "ApiTokenExpiresAt": "过期时间",
+    "ApiTokenLastUsed": "最近使用",
+    "ApiTokenServerIDs": "限定服务器 ID（可选）",
+    "ApiTokenServerIDsPlaceholder": "逗号分隔，例如 1,2,3",
+    "ApiTokenExpiresInDays": "有效期（天，0 = 永不过期）",
+    "ApiTokenScopeRequired": "至少选择一个 scope。",
+    "ApiTokenServersInvalid": "服务器 ID 必须为正整数。",
+    "ApiTokenExpiryInvalid": "天数必须在 0 到 3650 之间。",
+    "NameRequired": "名称必填。",
+    "Revoke": "吊销",
+    "Copied": "已复制到剪贴板",
+    "Scopes": "权限"
 }

src/locales/zh-TW/translation.json

@@ -75,7 +75,6 @@
     "Confirm": "確認",
     "ConfirmDeletion": "確認刪除？",
     "Services": "服務",
-    "ShowInService": "服務中顯示",
     "Coverages": {
         "Only": "僅特定伺服器",
         "Excludes": "排除特定伺服器",
@@ -138,12 +137,19 @@
     "EditNotifierGroup": "編輯通知分組",
     "CreateNotifierGroup": "建立通知分組",
     "User": "使用者",
+    "Owner": "所屬使用者",
+    "GlobalAgent": "全域 Agent",
+    "UnknownUser": "未知使用者 (#{{id}})",
     "WAF": "Web應用防火牆",
     "SiteName": "網站名稱",
     "Language": "語言",
     "CustomCodes": "自訂程式碼（樣式和腳本）",
     "CustomCodesDashboard": "儀表板的自訂程式碼",
     "DashboardOriginalHost": "Agent對接位址【網域名稱/IP:連接埠】",
+    "DashboardHost": "面板 OAuth2 回呼網域【網域名稱/IP:連接埠】",
+    "DashboardHostHint": "用於產生 OAuth2 回呼位址的面板對外網域。當面板存取網域與 Agent 對接位址不同時設定此項。留空則信任請求 Host，不做強制重寫。",
+    "ReservedHosts": "保留 Host（逗號分隔；反代/公網網域，成員不可註冊為 NAT 網域）",
+    "ReservedHostsHint": "反代部署下面板看不到自身的對外網域，無法自動保護。請在此列出所有公網入口網域，否則成員可將其註冊為 NAT 網域搶佔面板路由。",
     "ConfigTLS": "Agent 使用 TLS 連線",
     "CustomPublicDNSNameserversforDDNS": "DDNS 的自訂公共 DNS 名稱伺服器",
     "WebRealIPHeader": "前端真實IP請求頭",
@@ -186,5 +192,62 @@
     "Option": "選項",
     "Value": "值",
     "Preview": "預覽",
-    "FormatMetricUnits": "格式化資料單位"
+    "FormatMetricUnits": "格式化資料單位",
+    "Status": "狀態",
+    "ServerID": "伺服器 ID",
+    "CreatedAt": "建立時間",
+    "BatchMoveServer": "批次轉移伺服器擁有者",
+    "Servers": "伺服器",
+    "ToUser": "目標使用者",
+    "Move": "轉移",
+    "Transfer": {
+        "Title": "伺服器轉移",
+        "PageHint": "追蹤由批次轉移操作發起的擁有權轉移。待處理項目可以取消；已終止項目可以重試。",
+        "From": "來源使用者",
+        "To": "目標使用者",
+        "Initiator": "發起者",
+        "LastError": "最近錯誤",
+        "Retry": "重試",
+        "CancelRequested": "已請求取消",
+        "RetryRequested": "已請求重試",
+        "BatchSubmitted": "批次轉移已提交",
+        "PendingCount": "{{count}} 個待處理",
+        "PermissionDeniedCount": "{{count}} 個權限不足",
+        "AlreadyTransferringCount": "{{count}} 個正在轉移中",
+        "ServerNotFoundCount": "{{count}} 個未找到",
+        "SameOwnerCount": "{{count}} 個已屬於目標使用者",
+        "AgentTooOldCount": "{{count}} 個 agent 版本過舊（需升級）",
+        "StatusPending": "待處理",
+        "StatusVerified": "已驗證",
+        "StatusFailed": "已失敗",
+        "StatusTimeout": "已逾時",
+        "StatusCancelled": "已取消"
+    },
+    "EnableMCP": "啟用 MCP 端點（預設關閉；啟用前請先檢查 API token 範圍與伺服器允許清單）",
+    "ApiTokens": "API Token",
+    "CreateApiToken": "建立 API token",
+    "CreateApiTokenDescription": "Token 會代表你對 MCP 與外部用戶端進行驗證，其權限不會超過你本身的權限。",
+    "ConfirmDeleteApiToken": "撤銷 API token「{{name}}」？此操作無法復原。",
+    "ApiTokenRevoked": "API token 已撤銷。",
+    "ApiTokenCreated": "API token 已建立",
+    "ApiTokenRevealOnce": "請立即複製此 token，之後將不再顯示。",
+    "ApiTokenStoreSafely": "請將此 token 視為密碼。任何持有者都能在其範圍內代表你操作。",
+    "ApiTokenServers": "伺服器",
+    "ApiTokenAllServers": "全部允許",
+    "ApiTokenNever": "永不",
+    "ApiTokenExpiresAt": "到期時間",
+    "ApiTokenLastUsed": "最後使用",
+    "ApiTokenServerIDs": "限制伺服器 ID（選填）",
+    "ApiTokenServerIDsPlaceholder": "以逗號分隔，例如 1,2,3",
+    "ApiTokenExpiresInDays": "有效天數（0 = 永不過期）",
+    "ApiTokenScopeRequired": "至少需要一個範圍。",
+    "ApiTokenServersInvalid": "伺服器 ID 必須為正整數。",
+    "ApiTokenExpiryInvalid": "天數必須介於 0 到 3650 之間。",
+    "NameRequired": "名稱為必填。",
+    "Revoke": "撤銷",
+    "Copy": "複製",
+    "Copied": "已複製到剪貼簿",
+    "Scopes": "範圍",
+    "InvalidUsernameOrPassword": "使用者名稱或密碼無效",
+    "NetworkError": "網路錯誤"
 }