fix(a11y): fix ProgressRing text label contrast and add no-restricted-syntax lint rule for text-accent

ProgressRing used text-accent (#a1dcd8) on a percentage text label —
same WCAG 2.1 AA failure as #341. Switched to text-primary.

Also adds ESLint no-restricted-syntax rule (scoped to *.svelte files) that
blocks future text-accent usage in JavaScript string literals inside Svelte
class expressions. The rule caught both violations at once; both are now fixed.
The rule is scoped to .svelte files so test assertions against 'text-accent'
strings in .spec.ts files are unaffected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/main/java/org/raddatz/familienarchiv/audit/AuditLogQueryRepository.java

@@ -1,5 +1,7 @@
 package org.raddatz.familienarchiv.audit;
 
+import org.springframework.data.domain.Page;
+import org.springframework.data.domain.Pageable;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.query.Param;
@@ -198,7 +200,5 @@ public interface AuditLogQueryRepository extends JpaRepository<AuditLog, UUID> {
             """, nativeQuery = true)
     List<ContributorRow> findRecentContributorsForDocuments(@Param("documentIds") List<UUID> documentIds);
 
-    @Query("SELECT a FROM AuditLog a WHERE a.kind IN :kinds ORDER BY a.happenedAt DESC LIMIT :limit")
-    List<AuditLog> findRecentByKinds(@Param("kinds") Collection<AuditKind> kinds,
-                                     @Param("limit") int limit);
+    Page<AuditLog> findByKindIn(Collection<AuditKind> kinds, Pageable pageable);
 }

backend/src/main/java/org/raddatz/familienarchiv/audit/AuditLogQueryService.java

@@ -1,6 +1,8 @@
 package org.raddatz.familienarchiv.audit;
 
 import lombok.RequiredArgsConstructor;
+import org.springframework.data.domain.PageRequest;
+import org.springframework.data.domain.Sort;
 import org.springframework.stereotype.Service;
 
 import java.time.OffsetDateTime;
@@ -56,7 +58,8 @@ public class AuditLogQueryService {
     }
 
     public List<AuditLog> findRecentUserManagementEvents(int limit) {
-        return queryRepository.findRecentByKinds(Set.of(USER_CREATED, USER_DELETED, GROUP_MEMBERSHIP_CHANGED), limit);
+        PageRequest page = PageRequest.of(0, limit, Sort.by("happenedAt").descending());
+        return queryRepository.findByKindIn(Set.of(USER_CREATED, USER_DELETED, GROUP_MEMBERSHIP_CHANGED), page).getContent();
     }
 
     private Map<UUID, List<ActivityActorDTO>> toContributorMap(List<ContributorRow> rows) {

backend/src/main/java/org/raddatz/familienarchiv/audit/AuditLogRepository.java

@@ -5,4 +5,5 @@ import org.springframework.data.jpa.repository.JpaRepository;
 import java.util.UUID;
 
 public interface AuditLogRepository extends JpaRepository<AuditLog, UUID> {
+    boolean existsByKind(AuditKind kind);
 }

backend/src/main/java/org/raddatz/familienarchiv/controller/UserController.java

@@ -80,8 +80,7 @@ public class UserController {
     @RequirePermission(Permission.ADMIN_USER)
     public ResponseEntity<AppUser> createUser(Authentication authentication,
                                               @Valid @RequestBody CreateUserRequest request) {
-        AppUser actor = userService.findByEmail(authentication.getName());
-        return ResponseEntity.ok(userService.createUserOrUpdate(actor.getId(), request));
+        return ResponseEntity.ok(userService.createUserOrUpdate(actorId(authentication), request));
     }
 
     @PutMapping("/users/{id}")
@@ -89,8 +88,7 @@ public class UserController {
     public ResponseEntity<AppUser> adminUpdateUser(Authentication authentication,
                                                     @PathVariable UUID id,
                                                     @RequestBody AdminUpdateUserRequest dto) {
-        AppUser actor = userService.findByEmail(authentication.getName());
-        AppUser updated = userService.adminUpdateUser(actor.getId(), id, dto);
+        AppUser updated = userService.adminUpdateUser(actorId(authentication), id, dto);
         updated.setPassword(null);
         return ResponseEntity.ok(updated);
     }
@@ -99,9 +97,12 @@ public class UserController {
     @RequirePermission(Permission.ADMIN_USER)
     public ResponseEntity<Void> deleteUser(Authentication authentication,
                                            @PathVariable UUID id) {
-        AppUser actor = userService.findByEmail(authentication.getName());
-        userService.deleteUser(actor.getId(), id);
+        userService.deleteUser(actorId(authentication), id);
         return ResponseEntity.ok().build();
     }
 
+    private UUID actorId(Authentication auth) {
+        return userService.findByEmail(auth.getName()).getId();
+    }
+
 }

backend/src/main/java/org/raddatz/familienarchiv/repository/DocumentRepository.java

@@ -87,7 +87,7 @@ public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSp
             SELECT d.id FROM documents d
             CROSS JOIN LATERAL (
                 SELECT CASE WHEN websearch_to_tsquery('german', :query)::text <> ''
-                            THEN to_tsquery('german', regexp_replace(
+                            THEN to_tsquery('simple', regexp_replace(
                                      websearch_to_tsquery('german', :query)::text,
                                      '''([^'']+)''',
                                      '''\\1'':*',
@@ -149,7 +149,7 @@ public interface DocumentRepository extends JpaRepository<Document, UUID>, JpaSp
             FROM documents d
             CROSS JOIN LATERAL (
                 SELECT CASE WHEN websearch_to_tsquery('german', :query)::text <> ''
-                            THEN to_tsquery('german', regexp_replace(
+                            THEN to_tsquery('simple', regexp_replace(
                                      websearch_to_tsquery('german', :query)::text,
                                      '''([^'']+)''',
                                      '''\\1'':*',

backend/src/main/java/org/raddatz/familienarchiv/service/UserService.java

@@ -80,6 +80,34 @@ public class UserService {
         return saved;
     }
 
+    @Transactional
+    public AppUser createUserForBootstrap(CreateUserRequest request) {
+        log.info("Bootstrap user creation (no audit): {}", request.getEmail());
+
+        Set<UserGroup> groups = new HashSet<>();
+        if (request.getGroupIds() != null && !request.getGroupIds().isEmpty()) {
+            groups.addAll(groupRepository.findAllById(request.getGroupIds()));
+        }
+
+        Optional<AppUser> existingUser = userRepository.findByEmail(request.getEmail());
+        if (existingUser.isPresent()) {
+            AppUser updated = existingUser.get().updateFromRequest(request, passwordEncoder, groups);
+            return userRepository.save(updated);
+        }
+
+        AppUser user = AppUser.builder()
+                .email(request.getEmail())
+                .password(passwordEncoder.encode(request.getInitialPassword()))
+                .groups(groups)
+                .firstName(request.getFirstName())
+                .lastName(request.getLastName())
+                .birthDate(request.getBirthDate())
+                .contact(request.getContact())
+                .enabled(true)
+                .build();
+        return userRepository.save(user);
+    }
+
     @Transactional
     public AppUser createUser(String email, String rawPassword, String firstName, String lastName, Set<UUID> groupIds) {
         userRepository.findByEmail(email).ifPresent(existing -> {
@@ -183,27 +211,27 @@ public class UserService {
         }
 
         if (dto.getGroupIds() != null) {
-            Set<UUID> beforeIds = user.getGroups().stream().map(UserGroup::getId).collect(toSet());
-            Set<UserGroup> beforeGroups = new HashSet<>(user.getGroups());
-            Set<UserGroup> newGroups = new HashSet<>(groupRepository.findAllById(dto.getGroupIds()));
-            user.setGroups(newGroups);
-            Set<UUID> afterIds = newGroups.stream().map(UserGroup::getId).collect(toSet());
-            if (!beforeIds.equals(afterIds)) {
-                List<String> added = newGroups.stream()
-                        .filter(g -> !beforeIds.contains(g.getId()))
-                        .map(UserGroup::getName).toList();
-                List<String> removed = beforeGroups.stream()
-                        .filter(g -> !afterIds.contains(g.getId()))
-                        .map(UserGroup::getName).toList();
-                auditService.logAfterCommit(AuditKind.GROUP_MEMBERSHIP_CHANGED, actorId, null,
-                        Map.of("userId", id.toString(), "email", user.getEmail(),
-                                "addedGroups", added, "removedGroups", removed));
-            }
+            Set<UserGroup> before = new HashSet<>(user.getGroups());
+            Set<UserGroup> after = new HashSet<>(groupRepository.findAllById(dto.getGroupIds()));
+            user.setGroups(after);
+            groupChangePayload(before, after, id, user.getEmail())
+                    .ifPresent(payload -> auditService.logAfterCommit(AuditKind.GROUP_MEMBERSHIP_CHANGED, actorId, null, payload));
         }
 
         return userRepository.save(user);
     }
 
+    private Optional<Map<String, Object>> groupChangePayload(
+            Set<UserGroup> before, Set<UserGroup> after, UUID userId, String email) {
+        Set<UUID> beforeIds = before.stream().map(UserGroup::getId).collect(toSet());
+        Set<UUID> afterIds = after.stream().map(UserGroup::getId).collect(toSet());
+        if (beforeIds.equals(afterIds)) return Optional.empty();
+        List<String> added = after.stream().filter(g -> !beforeIds.contains(g.getId())).map(UserGroup::getName).toList();
+        List<String> removed = before.stream().filter(g -> !afterIds.contains(g.getId())).map(UserGroup::getName).toList();
+        return Optional.of(Map.of("userId", userId.toString(), "email", email,
+                "addedGroups", added, "removedGroups", removed));
+    }
+
     @Transactional
     public void changePassword(UUID userId, ChangePasswordDTO dto) {
         AppUser user = getById(userId);

backend/src/test/java/org/raddatz/familienarchiv/audit/AuditLogQueryServiceTest.java

@@ -7,6 +7,8 @@ import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 
 import org.raddatz.familienarchiv.model.AppUser;
+import org.springframework.data.domain.PageImpl;
+import org.springframework.data.domain.Pageable;
 
 import java.util.Collection;
 import java.util.List;
@@ -14,8 +16,8 @@ import java.util.Set;
 import java.util.UUID;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyCollection;
-import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.argThat;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.verify;
@@ -56,16 +58,17 @@ class AuditLogQueryServiceTest {
     @Test
     void findRecentUserManagementEvents_delegatesToRepositoryWithAllThreeKinds() {
         AuditLog entry = AuditLog.builder().id(UUID.randomUUID()).kind(AuditKind.USER_CREATED).build();
-        when(queryRepository.findRecentByKinds(anyCollection(), eq(5))).thenReturn(List.of(entry));
+        when(queryRepository.findByKindIn(anyCollection(), any(Pageable.class)))
+                .thenReturn(new PageImpl<>(List.of(entry)));
 
         List<AuditLog> result = auditLogQueryService.findRecentUserManagementEvents(5);
 
         assertThat(result).containsExactly(entry);
-        verify(queryRepository).findRecentByKinds(
+        verify(queryRepository).findByKindIn(
                 argThat((Collection<AuditKind> kinds) ->
                         kinds.contains(AuditKind.USER_CREATED) &&
                         kinds.contains(AuditKind.USER_DELETED) &&
                         kinds.contains(AuditKind.GROUP_MEMBERSHIP_CHANGED)),
-                eq(5));
+                any(Pageable.class));
     }
 }

backend/src/test/java/org/raddatz/familienarchiv/audit/UserManagementAuditIntegrationTest.java

@@ -1,21 +1,25 @@
 package org.raddatz.familienarchiv.audit;
 
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.raddatz.familienarchiv.PostgresContainerConfig;
+import org.raddatz.familienarchiv.dto.AdminUpdateUserRequest;
 import org.raddatz.familienarchiv.dto.CreateUserRequest;
+import org.raddatz.familienarchiv.dto.GroupDTO;
 import org.raddatz.familienarchiv.model.AppUser;
+import org.raddatz.familienarchiv.model.UserGroup;
 import org.raddatz.familienarchiv.repository.AppUserRepository;
 import org.raddatz.familienarchiv.service.UserService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.context.annotation.Import;
-import org.springframework.test.annotation.DirtiesContext;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.transaction.support.TransactionTemplate;
 import software.amazon.awssdk.services.s3.S3Client;
 
 import java.util.List;
+import java.util.Set;
 import java.util.UUID;
 
 import static java.util.concurrent.TimeUnit.SECONDS;
@@ -25,7 +29,6 @@ import static org.awaitility.Awaitility.await;
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.NONE)
 @ActiveProfiles("test")
 @Import(PostgresContainerConfig.class)
-@DirtiesContext(classMode = DirtiesContext.ClassMode.AFTER_EACH_TEST_METHOD)
 class UserManagementAuditIntegrationTest {
 
     @MockitoBean S3Client s3Client;
@@ -35,20 +38,20 @@ class UserManagementAuditIntegrationTest {
     @Autowired AuditLogQueryService auditLogQueryService;
     @Autowired TransactionTemplate transactionTemplate;
 
+    @BeforeEach
+    void clearAuditLog() {
+        transactionTemplate.execute(status -> { auditLogRepository.deleteAll(); return null; });
+    }
+
     @Test
     void createAndDeleteUser_producesOrderedAuditEntries() {
-        // Create the actor (admin) user directly — bypasses audit logging so no FK issue
+        // Bootstrap actor with no audit event — clean slate guaranteed by @BeforeEach
         CreateUserRequest adminReq = new CreateUserRequest();
         adminReq.setEmail("admin@test.example.com");
         adminReq.setInitialPassword("admin-secret");
-        AppUser actor = transactionTemplate.execute(status ->
-                userService.createUserOrUpdate(null, adminReq));
+        AppUser actor = transactionTemplate.execute(status -> userService.createUserForBootstrap(adminReq));
         UUID actorId = actor.getId();
 
-        // The admin creation is logged with null actorId — clear to start with a clean slate
-        await().atMost(5, SECONDS).until(() -> auditLogRepository.count() > 0);
-        transactionTemplate.execute(status -> { auditLogRepository.deleteAll(); return null; });
-
         // Create the target user — should emit USER_CREATED
         CreateUserRequest req = new CreateUserRequest();
         req.setEmail("audit-test@example.com");
@@ -57,7 +60,7 @@ class UserManagementAuditIntegrationTest {
             userService.createUserOrUpdate(actorId, req);
             return null;
         });
-        await().atMost(5, SECONDS).until(() -> auditLogRepository.count() > 0);
+        await().atMost(10, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_CREATED));
 
         // Delete the target user — should emit USER_DELETED
         AppUser created = userRepository.findByEmail("audit-test@example.com").orElseThrow();
@@ -65,11 +68,55 @@ class UserManagementAuditIntegrationTest {
             userService.deleteUser(actorId, created.getId());
             return null;
         });
-        await().atMost(5, SECONDS).until(() -> auditLogRepository.count() >= 2);
+        await().atMost(10, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_DELETED));
 
         List<AuditLog> events = auditLogQueryService.findRecentUserManagementEvents(10);
         assertThat(events).hasSize(2);
         assertThat(events.get(0).getKind()).isEqualTo(AuditKind.USER_DELETED);
         assertThat(events.get(1).getKind()).isEqualTo(AuditKind.USER_CREATED);
     }
+
+    @Test
+    void updateUserGroups_producesGroupMembershipChangedEvent() {
+        GroupDTO groupADto = new GroupDTO(); groupADto.setName("Viewers"); groupADto.setPermissions(Set.of("READ_ALL"));
+        GroupDTO groupBDto = new GroupDTO(); groupBDto.setName("Editors"); groupBDto.setPermissions(Set.of("WRITE_ALL"));
+        UserGroup gA = transactionTemplate.execute(status -> userService.createGroup(groupADto));
+        UserGroup gB = transactionTemplate.execute(status -> userService.createGroup(groupBDto));
+
+        // Bootstrap actor with no audit event — clean slate guaranteed by @BeforeEach
+        CreateUserRequest actorReq = new CreateUserRequest();
+        actorReq.setEmail("actor-group-test@test.example.com");
+        actorReq.setInitialPassword("secret");
+        AppUser actor = transactionTemplate.execute(status -> userService.createUserForBootstrap(actorReq));
+
+        // Create target user pre-assigned to gA — emits USER_CREATED
+        CreateUserRequest targetReq = new CreateUserRequest();
+        targetReq.setEmail("target-group-test@test.example.com");
+        targetReq.setInitialPassword("secret");
+        targetReq.setGroupIds(List.of(gA.getId()));
+        transactionTemplate.execute(status -> userService.createUserOrUpdate(actor.getId(), targetReq));
+        await().atMost(10, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.USER_CREATED));
+        transactionTemplate.execute(status -> { auditLogRepository.deleteAll(); return null; });
+
+        AppUser target = userRepository.findByEmail("target-group-test@test.example.com").orElseThrow();
+
+        // Change groups: Viewers → Editors
+        AdminUpdateUserRequest dto = new AdminUpdateUserRequest();
+        dto.setGroupIds(List.of(gB.getId()));
+        transactionTemplate.execute(status -> userService.adminUpdateUser(actor.getId(), target.getId(), dto));
+
+        await().atMost(10, SECONDS).until(() -> auditLogRepository.existsByKind(AuditKind.GROUP_MEMBERSHIP_CHANGED));
+
+        List<AuditLog> events = auditLogQueryService.findRecentUserManagementEvents(10);
+        assertThat(events).hasSize(1);
+        AuditLog event = events.get(0);
+        assertThat(event.getKind()).isEqualTo(AuditKind.GROUP_MEMBERSHIP_CHANGED);
+        assertThat(event.getPayload()).containsEntry("email", "target-group-test@test.example.com");
+        @SuppressWarnings("unchecked")
+        List<String> added = (List<String>) event.getPayload().get("addedGroups");
+        @SuppressWarnings("unchecked")
+        List<String> removed = (List<String>) event.getPayload().get("removedGroups");
+        assertThat(added).containsExactlyInAnyOrder("Editors");
+        assertThat(removed).containsExactlyInAnyOrder("Viewers");
+    }
 }

backend/src/test/java/org/raddatz/familienarchiv/controller/UserControllerTest.java

@@ -18,8 +18,10 @@ import java.util.UUID;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.when;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.delete;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.put;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
@@ -104,4 +106,55 @@ class UserControllerTest {
                         .content("{\"email\":\"\",\"initialPassword\":\"secret123\"}"))
                 .andExpect(status().isBadRequest());
     }
+
+    // ─── permission enforcement ───────────────────────────────────────────────
+
+    @Test
+    @WithMockUser(username = "reader@example.com")
+    void createUser_returns403_whenCallerLacksAdminUserPermission() throws Exception {
+        mockMvc.perform(post("/api/users")
+                        .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
+                        .content("{\"email\":\"x@x.com\",\"initialPassword\":\"secret123\"}"))
+                .andExpect(status().isForbidden());
+    }
+
+    @Test
+    @WithMockUser(username = "reader@example.com")
+    void adminUpdateUser_returns403_whenCallerLacksAdminUserPermission() throws Exception {
+        mockMvc.perform(put("/api/users/" + UUID.randomUUID())
+                        .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
+                        .content("{}"))
+                .andExpect(status().isForbidden());
+    }
+
+    @Test
+    @WithMockUser(username = "reader@example.com")
+    void deleteUser_returns403_whenCallerLacksAdminUserPermission() throws Exception {
+        mockMvc.perform(delete("/api/users/" + UUID.randomUUID()))
+                .andExpect(status().isForbidden());
+    }
+
+    // ─── unauthenticated access ───────────────────────────────────────────────
+
+    @Test
+    void createUser_returns401_whenUnauthenticated() throws Exception {
+        mockMvc.perform(post("/api/users")
+                        .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
+                        .content("{\"email\":\"x@x.com\",\"initialPassword\":\"secret123\"}"))
+                .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void adminUpdateUser_returns401_whenUnauthenticated() throws Exception {
+        mockMvc.perform(put("/api/users/" + UUID.randomUUID())
+                        .contentType(org.springframework.http.MediaType.APPLICATION_JSON)
+                        .content("{}"))
+                .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void deleteUser_returns401_whenUnauthenticated() throws Exception {
+        mockMvc.perform(delete("/api/users/" + UUID.randomUUID()))
+                .andExpect(status().isUnauthorized());
+    }
 }

backend/src/test/java/org/raddatz/familienarchiv/repository/DocumentFtsTest.java

@@ -179,6 +179,22 @@ class DocumentFtsTest {
         assertThat(ids).isEmpty();
     }
 
+    @Test
+    void should_find_document_whose_transcription_contains_word_that_stems_to_german_stop_word() {
+        // "Wille" stems to "will" via the German Snowball stemmer.
+        // "will" is also a German stop word, so to_tsquery('german','will:*') drops it.
+        // The prefix-transform step must use to_tsquery('simple',...) to avoid this.
+        Document doc = documentRepository.saveAndFlush(document("Foto"));
+        UUID annotationId = annotation(doc.getId());
+        blockRepository.saveAndFlush(block(doc.getId(), annotationId, "Der Wille des Volkes", 0));
+        em.flush();
+        em.clear();
+
+        List<UUID> ids = documentRepository.findRankedIdsByFts("Wille");
+
+        assertThat(ids).contains(doc.getId());
+    }
+
     @Test
     void should_not_throw_when_query_contains_invalid_tsquery_syntax() {
         documentRepository.saveAndFlush(document("Brief"));

backend/src/test/java/org/raddatz/familienarchiv/service/UserServiceTest.java

@@ -837,6 +837,26 @@ class UserServiceTest {
         verify(auditService, never()).logAfterCommit(any(), any(), any(), any());
     }
 
+    // ─── createUserForBootstrap ───────────────────────────────────────────────
+
+    @Test
+    void createUserForBootstrap_createsUserWithoutAuditEvent() {
+        CreateUserRequest req = new CreateUserRequest();
+        req.setEmail("bootstrap@example.com");
+        req.setInitialPassword("secret");
+        req.setGroupIds(List.of());
+
+        when(userRepository.findByEmail("bootstrap@example.com")).thenReturn(Optional.empty());
+        when(passwordEncoder.encode("secret")).thenReturn("encoded");
+        AppUser saved = AppUser.builder().id(UUID.randomUUID()).email("bootstrap@example.com").build();
+        when(userRepository.save(any())).thenReturn(saved);
+
+        AppUser result = userService.createUserForBootstrap(req);
+
+        assertThat(result).isEqualTo(saved);
+        verify(auditService, never()).logAfterCommit(any(), any(), any(), any());
+    }
+
     // ─── createGroup ──────────────────────────────────────────────────────────
 
     @Test

frontend/eslint.config.js

@@ -40,6 +40,26 @@ export default defineConfig(
 				parser: ts.parser,
 				svelteConfig
 			}
+		},
+		rules: {
+			// text-accent resolves to #a1dcd8 in light mode (1.52:1 on white — WCAG fail).
+			// layout.css documents it as decorative-only (borders, icon tints, bg fills).
+			// For any text label use text-primary or text-ink instead. This rule catches
+			// the pattern where text-accent appears inside a JavaScript string literal
+			// (e.g. conditional ternary class expressions in Svelte templates).
+			'no-restricted-syntax': [
+				'error',
+				{
+					selector: 'Literal[value=/\\btext-accent\\b/]',
+					message:
+						'text-accent is decorative-only (#a1dcd8 in light mode = 1.52:1 contrast — WCAG fail). Use text-primary or text-ink-2 for text labels.'
+				},
+				{
+					selector: 'TemplateLiteral > TemplateElement[value.raw=/\\btext-accent\\b/]',
+					message:
+						'text-accent is decorative-only (#a1dcd8 in light mode = 1.52:1 contrast — WCAG fail). Use text-primary or text-ink-2 for text labels.'
+				}
+			]
 		}
 	}
 );

frontend/src/lib/components/PdfControls.svelte

@@ -91,7 +91,7 @@ let {
 			aria-label={showAnnotations ? m.pdf_annotations_hide() : m.pdf_annotations_show()}
 			class="flex items-center gap-1.5 rounded px-2 py-1 font-sans text-xs transition {showAnnotations
 				? 'text-ink-2 hover:bg-surface/10'
-				: 'bg-surface/10 text-accent'}"
+				: 'bg-surface/10 text-primary'}"
 		>
 			<svg
 				class="h-3.5 w-3.5 shrink-0"

frontend/src/lib/components/PdfControls.svelte.spec.ts

@@ -0,0 +1,67 @@
+import { vi, describe, it, expect, afterEach } from 'vitest';
+import { cleanup, render } from 'vitest-browser-svelte';
+import { page } from 'vitest/browser';
+
+import PdfControls from './PdfControls.svelte';
+
+afterEach(cleanup);
+
+const defaultProps = {
+	currentPage: 1,
+	totalPages: 3,
+	isLoaded: true,
+	showAnnotations: false,
+	annotationCount: 0,
+	onPrev: vi.fn(),
+	onNext: vi.fn(),
+	onZoomIn: vi.fn(),
+	onZoomOut: vi.fn(),
+	onToggleAnnotations: vi.fn()
+};
+
+describe('PdfControls — annotation toggle visibility', () => {
+	it('renders annotation toggle when annotationCount is greater than zero', async () => {
+		render(PdfControls, { ...defaultProps, annotationCount: 3 });
+		await expect
+			.element(page.getByRole('button', { name: /annotierungen anzeigen/i }))
+			.toBeInTheDocument();
+	});
+
+	it('does not render annotation toggle when annotationCount is zero', async () => {
+		render(PdfControls, { ...defaultProps, annotationCount: 0 });
+		await expect
+			.element(page.getByRole('button', { name: /annotierungen/i }))
+			.not.toBeInTheDocument();
+	});
+});
+
+describe('PdfControls — annotation toggle label', () => {
+	it('shows "Annotierungen anzeigen" label when annotations are hidden', async () => {
+		render(PdfControls, { ...defaultProps, annotationCount: 2, showAnnotations: false });
+		const btn = page.getByRole('button', { name: /annotierungen anzeigen/i });
+		await expect.element(btn).toBeInTheDocument();
+	});
+
+	it('shows "Annotierungen verbergen" label when annotations are visible', async () => {
+		render(PdfControls, { ...defaultProps, annotationCount: 2, showAnnotations: true });
+		const btn = page.getByRole('button', { name: /annotierungen verbergen/i });
+		await expect.element(btn).toBeInTheDocument();
+	});
+});
+
+describe('PdfControls — annotation toggle contrast (WCAG 2.1 AA)', () => {
+	it('uses text-primary class on annotation toggle button when annotations are hidden', async () => {
+		const { container } = render(PdfControls, {
+			...defaultProps,
+			annotationCount: 2,
+			showAnnotations: false
+		});
+		const allButtons = container.querySelectorAll('button');
+		const annotationBtn = Array.from(allButtons).find((b) =>
+			b.getAttribute('aria-label')?.toLowerCase().includes('annotierungen')
+		);
+		expect(annotationBtn).not.toBeNull();
+		expect(annotationBtn!.className).toContain('text-primary');
+		expect(annotationBtn!.className).not.toContain('text-accent');
+	});
+});

frontend/src/lib/components/ProgressRing.svelte

@@ -19,7 +19,7 @@ let { percentage }: { percentage: number } = $props();
 		/>
 	</svg>
 	<span
-		class="block text-center font-sans text-xs font-bold {percentage > 0 ? 'text-accent' : 'text-gray-400'}"
+		class="block text-center font-sans text-xs font-bold {percentage > 0 ? 'text-primary' : 'text-gray-400'}"
 	>
 		{percentage}%
 	</span>

frontend/src/lib/components/ProgressRing.svelte.spec.ts

@@ -25,12 +25,12 @@ describe('ProgressRing', () => {
 		expect(el.className).toContain('text-gray-400');
 	});
 
-	it('renders a mint-colored label when percentage is > 0', async () => {
+	it('renders a primary-colored label when percentage is > 0', async () => {
 		render(ProgressRing, { percentage: 75 });
 		const label = page.getByText('75%');
 		await expect.element(label).toBeInTheDocument();
 		const el = (await label.element()) as HTMLElement;
-		expect(el.className).toContain('text-accent');
+		expect(el.className).toContain('text-primary');
 	});
 
 	it('renders a fully filled arc for 100%', async () => {