Booking flow: required terms and privacy checkbox with i18n

Also includes admin, dashboard, and API updates; PWA icon assets; and
assorted layout and utility changes on dev.

backend/src/routes/tickets.ts

@@ -1394,6 +1394,142 @@ ticketsRouter.post('/admin/manual', requireAuth(['admin', 'organizer', 'staff'])
   }, 201);
 });
 
+// Admin invite guest ticket (free, confirmed, not counted in revenue)
+ticketsRouter.post('/admin/guest', requireAuth(['admin', 'organizer', 'staff']), zValidator('json', z.object({
+  eventId: z.string(),
+  firstName: z.string().min(1),
+  lastName: z.string().optional().or(z.literal('')),
+  email: z.string().email().optional().or(z.literal('')),
+  phone: z.string().optional().or(z.literal('')),
+  preferredLanguage: z.enum(['en', 'es']).optional(),
+  adminNote: z.string().max(1000).optional(),
+})), async (c) => {
+  const data = c.req.valid('json');
+
+  const event = await dbGet<any>(
+    (db as any).select().from(events).where(eq((events as any).id, data.eventId))
+  );
+  if (!event) {
+    return c.json({ error: 'Event not found' }, 404);
+  }
+
+  const now = getNow();
+  const adminUser = (c as any).get('user');
+
+  // Find or create user (use placeholder email if none provided)
+  const attendeeEmail = data.email && data.email.trim()
+    ? data.email.trim()
+    : `guest-${generateId()}@guestinvite.local`;
+
+  const fullName = data.lastName && data.lastName.trim()
+    ? `${data.firstName} ${data.lastName}`.trim()
+    : data.firstName;
+
+  let user = await dbGet<any>(
+    (db as any).select().from(users).where(eq((users as any).email, attendeeEmail))
+  );
+
+  if (!user) {
+    const userId = generateId();
+    user = {
+      id: userId,
+      email: attendeeEmail,
+      password: '',
+      name: fullName,
+      phone: data.phone || null,
+      role: 'user',
+      languagePreference: null,
+      createdAt: now,
+      updatedAt: now,
+    };
+    await (db as any).insert(users).values(user);
+  }
+
+  // Check for existing active ticket (only for real emails, not placeholder)
+  if (data.email && data.email.trim()) {
+    const existingTicket = await dbGet<any>(
+      (db as any)
+        .select()
+        .from(tickets)
+        .where(
+          and(
+            eq((tickets as any).userId, user.id),
+            eq((tickets as any).eventId, data.eventId)
+          )
+        )
+    );
+    if (existingTicket && existingTicket.status !== 'cancelled') {
+      return c.json({ error: 'This person already has a ticket for this event' }, 400);
+    }
+  }
+
+  const ticketId = generateId();
+  const qrCode = generateTicketCode();
+
+  const newTicket = {
+    id: ticketId,
+    userId: user.id,
+    eventId: data.eventId,
+    attendeeFirstName: data.firstName,
+    attendeeLastName: data.lastName && data.lastName.trim() ? data.lastName.trim() : null,
+    attendeeEmail: data.email && data.email.trim() ? data.email.trim() : null,
+    attendeePhone: data.phone && data.phone.trim() ? data.phone.trim() : null,
+    preferredLanguage: data.preferredLanguage || null,
+    status: 'confirmed',
+    isGuest: true,
+    qrCode,
+    checkinAt: null,
+    adminNote: data.adminNote || null,
+    createdAt: now,
+  };
+
+  await (db as any).insert(tickets).values(newTicket);
+
+  // Create a $0 payment record to track the invite
+  const paymentId = generateId();
+  const newPayment = {
+    id: paymentId,
+    ticketId,
+    provider: 'cash',
+    amount: 0,
+    currency: event.currency,
+    status: 'paid',
+    reference: 'Guest invite',
+    paidAt: now,
+    paidByAdminId: adminUser?.id || null,
+    createdAt: now,
+    updatedAt: now,
+  };
+
+  await (db as any).insert(payments).values(newPayment);
+
+  // Send booking confirmation email if a real email was provided
+  if (data.email && data.email.trim()) {
+    emailService.sendBookingConfirmation(ticketId).then(result => {
+      if (result.success) {
+        console.log(`[Email] Booking confirmation sent for guest ticket ${ticketId}`);
+      } else {
+        console.error(`[Email] Failed to send booking confirmation for guest ticket ${ticketId}:`, result.error);
+      }
+    }).catch(err => {
+      console.error('[Email] Exception sending booking confirmation for guest ticket:', err);
+    });
+  }
+
+  return c.json({
+    ticket: {
+      ...newTicket,
+      event: {
+        title: event.title,
+        startDatetime: event.startDatetime,
+        location: event.location,
+      },
+    },
+    payment: newPayment,
+    message: 'Guest ticket created successfully',
+  }, 201);
+});
+
 // Get all tickets (admin) - includes payment for each ticket
 ticketsRouter.get('/', requireAuth(['admin', 'organizer']), async (c) => {
   const eventId = c.req.query('eventId');