diff --git a/.forgejo/workflows/cd-macmini.yml b/.forgejo/workflows/cd-macmini.yml
new file mode 100644
index 000000000..7700d3a3f
--- /dev/null
+++ b/.forgejo/workflows/cd-macmini.yml
@@ -0,0 +1,415 @@
+# CD Pipeline: Auto-deploy to Mac Mini on push to main
+#
+# Requires a self-hosted Forgejo Actions runner on the Mac Mini.
+# Setup: see docs/MAC_MINI_RUNNER_SETUP.md
+#
+# Flow:
+#   Push → main : Detects changed services → rebuilds & restarts only those containers
+
+name: CD Mac Mini
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      service:
+        description: 'Service to deploy (or "all" for everything)'
+        required: false
+        default: 'all'
+        type: choice
+        options:
+          - all
+          - matrix-web
+          - mana-auth
+          - mana-sync
+          - mana-media
+          - mana-notify
+          - mana-api-gateway
+          - mana-crawler
+          - mana-credits
+          - mana-search
+          - mana-matrix-bot
+          - chat-backend
+          - chat-web
+          - todo-backend
+          - todo-web
+          - calendar-backend
+          - calendar-web
+          - clock-web
+          - contacts-backend
+          - contacts-web
+          - mukke-backend
+          - mukke-web
+          - storage-backend
+          - storage-web
+
+concurrency:
+  group: cd-macmini
+  cancel-in-progress: false  # Don't cancel in-progress deploys
+
+env:
+  PROJECT_DIR: /Users/mana/projects/manacore-monorepo
+  COMPOSE_FILE: docker-compose.macmini.yml
+  ENV_FILE: .env.macmini
+  DEPLOY_NOTIFY_ROOM_ID: ${{ secrets.DEPLOY_NOTIFY_ROOM_ID }}
+  DEPLOY_NOTIFY_BOT_TOKEN: ${{ secrets.DEPLOY_NOTIFY_BOT_TOKEN }}
+  DOCKER_BUILDKIT: 1
+  PATH: /usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin
+
+jobs:
+  # ===========================================
+  # Detect what changed
+  # ===========================================
+  detect-changes:
+    name: Detect Changes
+    runs-on: self-hosted
+    if: github.event_name == 'push'
+    outputs:
+      matrix-web: ${{ steps.changes.outputs.matrix-web }}
+      mana-auth: ${{ steps.changes.outputs.mana-auth }}
+      mana-sync: ${{ steps.changes.outputs.mana-sync }}
+      mana-media: ${{ steps.changes.outputs.mana-media }}
+      mana-notify: ${{ steps.changes.outputs.mana-notify }}
+      mana-api-gateway: ${{ steps.changes.outputs.mana-api-gateway }}
+      mana-crawler: ${{ steps.changes.outputs.mana-crawler }}
+      mana-credits: ${{ steps.changes.outputs.mana-credits }}
+      mana-search: ${{ steps.changes.outputs.mana-search }}
+      chat-backend: ${{ steps.changes.outputs.chat-backend }}
+      chat-web: ${{ steps.changes.outputs.chat-web }}
+      todo-backend: ${{ steps.changes.outputs.todo-backend }}
+      todo-web: ${{ steps.changes.outputs.todo-web }}
+      calendar-backend: ${{ steps.changes.outputs.calendar-backend }}
+      calendar-web: ${{ steps.changes.outputs.calendar-web }}
+      clock-web: ${{ steps.changes.outputs.clock-web }}
+      contacts-backend: ${{ steps.changes.outputs.contacts-backend }}
+      contacts-web: ${{ steps.changes.outputs.contacts-web }}
+      mukke-backend: ${{ steps.changes.outputs.mukke-backend }}
+      mukke-web: ${{ steps.changes.outputs.mukke-web }}
+      storage-backend: ${{ steps.changes.outputs.storage-backend }}
+      storage-web: ${{ steps.changes.outputs.storage-web }}
+      mana-matrix-bot: ${{ steps.changes.outputs.mana-matrix-bot }}
+      any-changes: ${{ steps.changes.outputs.any-changes }}
+    steps:
+      - name: Check for changes
+        id: changes
+        run: |
+          cd "${{ env.PROJECT_DIR }}"
+
+          CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || echo "")
+
+          SHARED_CHANGED="false"
+          if echo "$CHANGED" | grep -qE "^packages/(shared-ui|shared-theme|shared-icons|shared-tailwind|shared-auth|shared-branding|shared-i18n|shared-utils|shared-types)/"; then
+            SHARED_CHANGED="true"
+          fi
+
+          check_changes() {
+            local name=$1
+            shift
+            local result="false"
+            for path in "$@"; do
+              if echo "$CHANGED" | grep -q "^$path"; then
+                result="true"
+                break
+              fi
+            done
+            if [ "$SHARED_CHANGED" == "true" ]; then
+              result="true"
+            fi
+            echo "$name=$result" >> $GITHUB_OUTPUT
+          }
+
+          echo "Changed files:"
+          echo "$CHANGED" | head -20
+          echo "Shared packages changed: $SHARED_CHANGED"
+
+          check_changes "matrix-web"       "apps/matrix/apps/web/" "apps/matrix/packages/"
+          check_changes "mana-auth"          "services/mana-auth/"
+          check_changes "mana-sync"          "services/mana-sync/" "packages/shared-go/"
+          check_changes "mana-media"         "services/mana-media/"
+          check_changes "mana-notify"        "services/mana-notify/" "packages/shared-go/"
+          check_changes "mana-api-gateway"   "services/mana-api-gateway/" "packages/shared-go/"
+          check_changes "mana-crawler"       "services/mana-crawler/" "packages/shared-go/"
+          check_changes "mana-credits"       "services/mana-credits/"
+          check_changes "mana-search"        "services/mana-search/" "packages/shared-go/"
+          check_changes "chat-backend"      "apps/chat/apps/backend/" "apps/chat/packages/"
+          check_changes "chat-web"          "apps/chat/apps/web/" "apps/chat/packages/"
+          check_changes "todo-backend"      "apps/todo/apps/backend/" "apps/todo/packages/"
+          check_changes "todo-web"          "apps/todo/apps/web/" "apps/todo/packages/"
+          check_changes "calendar-backend"  "apps/calendar/apps/backend/" "apps/calendar/packages/"
+          check_changes "calendar-web"      "apps/calendar/apps/web/" "apps/calendar/packages/"
+          check_changes "clock-web"         "apps/clock/apps/web/" "apps/clock/packages/"
+          check_changes "contacts-backend"  "apps/contacts/apps/backend/" "apps/contacts/packages/"
+          check_changes "contacts-web"      "apps/contacts/apps/web/" "apps/contacts/packages/"
+          check_changes "mukke-backend"     "apps/mukke/apps/backend/" "apps/mukke/packages/"
+          check_changes "mukke-web"         "apps/mukke/apps/web/" "apps/mukke/packages/"
+          check_changes "storage-backend"   "apps/storage/apps/backend/" "apps/storage/packages/"
+          check_changes "storage-web"       "apps/storage/apps/web/" "apps/storage/packages/"
+          check_changes "mana-matrix-bot"   "services/mana-matrix-bot/"
+          check_changes "mana-landing-builder" "services/mana-landing-builder/"
+
+          ANY="false"
+          for svc in matrix-web mana-auth mana-sync mana-media mana-notify mana-api-gateway mana-crawler mana-credits mana-search chat-backend chat-web todo-backend todo-web calendar-backend calendar-web clock-web contacts-backend contacts-web mukke-backend mukke-web storage-backend storage-web mana-matrix-bot mana-landing-builder; do
+            val=$(grep "^$svc=" $GITHUB_OUTPUT | tail -1 | cut -d= -f2)
+            if [ "$val" == "true" ]; then
+              ANY="true"
+              break
+            fi
+          done
+          echo "any-changes=$ANY" >> $GITHUB_OUTPUT
+
+  # ===========================================
+  # Deploy changed services
+  # ===========================================
+  deploy:
+    name: Deploy
+    runs-on: self-hosted
+    needs: [detect-changes]
+    if: |
+      always() &&
+      (needs.detect-changes.result == 'success' && needs.detect-changes.outputs.any-changes == 'true') ||
+      github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Pull latest code
+        run: |
+          cd "${{ env.PROJECT_DIR }}"
+          git pull origin main
+
+      - name: Init deploy tracking
+        id: init
+        run: |
+          cd "${{ env.PROJECT_DIR }}"
+          source scripts/deploy-metrics.sh
+          deploy_timer_start
+          echo "start_epoch=$DEPLOY_START_EPOCH" >> $GITHUB_OUTPUT
+          ensure_deploy_schema
+
+      - name: Ensure env vars exist
+        run: |
+          cd "${{ env.PROJECT_DIR }}"
+          if ! grep -q "CALENDAR_ENCRYPTION_KEY" "${{ env.ENV_FILE }}" 2>/dev/null; then
+            echo "CALENDAR_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> "${{ env.ENV_FILE }}"
+          fi
+
+      - name: Determine services to deploy
+        id: services
+        run: |
+          cd "${{ env.PROJECT_DIR }}"
+          SERVICES=""
+
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            INPUT="${{ inputs.service }}"
+            if [ "$INPUT" == "all" ]; then
+              echo "deploy-all=true" >> $GITHUB_OUTPUT
+              exit 0
+            else
+              SERVICES="$INPUT"
+            fi
+          else
+            if [ "${{ needs.detect-changes.outputs.matrix-web }}" == "true" ]; then SERVICES="$SERVICES matrix-web"; fi
+            if [ "${{ needs.detect-changes.outputs.mana-auth }}" == "true" ]; then SERVICES="$SERVICES mana-auth"; fi
+            if [ "${{ needs.detect-changes.outputs.mana-sync }}" == "true" ]; then SERVICES="$SERVICES mana-sync"; fi
+            if [ "${{ needs.detect-changes.outputs.mana-media }}" == "true" ]; then SERVICES="$SERVICES mana-media"; fi
+            if [ "${{ needs.detect-changes.outputs.mana-notify }}" == "true" ]; then SERVICES="$SERVICES mana-notify"; fi
+            if [ "${{ needs.detect-changes.outputs.mana-api-gateway }}" == "true" ]; then SERVICES="$SERVICES mana-api-gateway"; fi
+            if [ "${{ needs.detect-changes.outputs.mana-crawler }}" == "true" ]; then SERVICES="$SERVICES mana-crawler"; fi
+            if [ "${{ needs.detect-changes.outputs.mana-credits }}" == "true" ]; then SERVICES="$SERVICES mana-credits"; fi
+            if [ "${{ needs.detect-changes.outputs.mana-search }}" == "true" ]; then SERVICES="$SERVICES mana-search"; fi
+            if [ "${{ needs.detect-changes.outputs.chat-backend }}" == "true" ]; then SERVICES="$SERVICES chat-backend"; fi
+            if [ "${{ needs.detect-changes.outputs.chat-web }}" == "true" ]; then SERVICES="$SERVICES chat-web"; fi
+            if [ "${{ needs.detect-changes.outputs.todo-backend }}" == "true" ]; then SERVICES="$SERVICES todo-backend"; fi
+            if [ "${{ needs.detect-changes.outputs.todo-web }}" == "true" ]; then SERVICES="$SERVICES todo-web"; fi
+            if [ "${{ needs.detect-changes.outputs.calendar-backend }}" == "true" ]; then SERVICES="$SERVICES calendar-backend"; fi
+            if [ "${{ needs.detect-changes.outputs.calendar-web }}" == "true" ]; then SERVICES="$SERVICES calendar-web"; fi
+            if [ "${{ needs.detect-changes.outputs.clock-web }}" == "true" ]; then SERVICES="$SERVICES clock-web"; fi
+            if [ "${{ needs.detect-changes.outputs.contacts-backend }}" == "true" ]; then SERVICES="$SERVICES contacts-backend"; fi
+            if [ "${{ needs.detect-changes.outputs.contacts-web }}" == "true" ]; then SERVICES="$SERVICES contacts-web"; fi
+            if [ "${{ needs.detect-changes.outputs.mukke-backend }}" == "true" ]; then SERVICES="$SERVICES mukke-backend"; fi
+            if [ "${{ needs.detect-changes.outputs.mukke-web }}" == "true" ]; then SERVICES="$SERVICES mukke-web"; fi
+            if [ "${{ needs.detect-changes.outputs.storage-backend }}" == "true" ]; then SERVICES="$SERVICES storage-backend"; fi
+            if [ "${{ needs.detect-changes.outputs.storage-web }}" == "true" ]; then SERVICES="$SERVICES storage-web"; fi
+            if [ "${{ needs.detect-changes.outputs.mana-matrix-bot }}" == "true" ]; then SERVICES="$SERVICES mana-matrix-bot"; fi
+            if [ "${{ needs.detect-changes.outputs.mana-landing-builder }}" == "true" ]; then SERVICES="$SERVICES mana-landing-builder"; fi
+          fi
+
+          echo "services=$SERVICES" >> $GITHUB_OUTPUT
+          echo "deploy-all=false" >> $GITHUB_OUTPUT
+          echo "Services to deploy: $SERVICES"
+
+      - name: Build shared base images
+        run: |
+          cd "${{ env.PROJECT_DIR }}"
+          SERVICES="${{ steps.services.outputs.services }}"
+          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
+
+          NEEDS_BASE=false
+          NEEDS_WEB_BASE=false
+          if [ "$DEPLOY_ALL" == "true" ]; then
+            NEEDS_BASE=true; NEEDS_WEB_BASE=true
+          else
+            for svc in $SERVICES; do
+              case "$svc" in *-backend) NEEDS_BASE=true ;; *-web) NEEDS_WEB_BASE=true ;; esac
+            done
+          fi
+
+          if [ "$NEEDS_BASE" == "true" ]; then
+            docker build -f docker/Dockerfile.nestjs-base -t nestjs-base:local . 2>&1 | tail -5
+          fi
+          if [ "$NEEDS_WEB_BASE" == "true" ]; then
+            docker build -f docker/Dockerfile.sveltekit-base -t sveltekit-base:local . 2>&1 | tail -5
+          fi
+
+      - name: Build and deploy services
+        id: build
+        run: |
+          cd "${{ env.PROJECT_DIR }}"
+          source scripts/deploy-metrics.sh
+
+          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
+          SERVICES="${{ steps.services.outputs.services }}"
+
+          if [ "$DEPLOY_ALL" == "true" ]; then
+            SERVICES=$(docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" config --services | tr '\n' ' ')
+          elif [ -z "$SERVICES" ]; then
+            echo "No services to deploy"
+            echo "build-times=" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          echo "=== Rebuilding: $SERVICES ==="
+          BUILD_TIMES=""
+          for svc in $SERVICES; do
+            build_start=$(date +%s)
+            docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" build "$svc" 2>&1 || true
+            build_end=$(date +%s)
+            BUILD_TIMES="$BUILD_TIMES $svc:$(( build_end - build_start ))"
+          done
+
+          if [ "$DEPLOY_ALL" == "true" ]; then
+            docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d
+          else
+            docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d --no-deps $SERVICES
+          fi
+          sleep 10
+
+          echo "build-times=$BUILD_TIMES" >> $GITHUB_OUTPUT
+
+      - name: Health checks
+        id: health
+        run: |
+          cd "${{ env.PROJECT_DIR }}"
+          source scripts/deploy-metrics.sh
+
+          health_url_for() {
+            case "$1" in
+              mana-auth)         echo "http://localhost:3001/health" ;;
+              matrix-web)        echo "http://localhost:5180/health" ;;
+              chat-backend)      echo "http://localhost:3030/health" ;;
+              chat-web)          echo "http://localhost:5010/health" ;;
+              todo-backend)      echo "http://localhost:3031/health" ;;
+              todo-web)          echo "http://localhost:5011/health" ;;
+              calendar-backend)  echo "http://localhost:3032/health" ;;
+              calendar-web)      echo "http://localhost:5012/health" ;;
+              clock-web)         echo "http://localhost:5013/health" ;;
+              contacts-backend)  echo "http://localhost:3034/health" ;;
+              contacts-web)      echo "http://localhost:5014/health" ;;
+              mukke-backend)     echo "http://localhost:3010/health" ;;
+              mukke-web)         echo "http://localhost:5180/health" ;;
+              storage-backend)   echo "http://localhost:3035/api/v1/health" ;;
+              storage-web)       echo "http://localhost:5015/health" ;;
+              *)                 echo "" ;;
+            esac
+          }
+
+          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
+          SERVICES="${{ steps.services.outputs.services }}"
+          if [ "$DEPLOY_ALL" == "true" ]; then
+            SERVICES="mana-auth chat-backend chat-web todo-backend todo-web calendar-backend calendar-web clock-web contacts-backend contacts-web storage-backend storage-web"
+          fi
+
+          HEALTH_RESULTS=""
+          for svc in $SERVICES; do
+            url=$(health_url_for "$svc")
+            if [ -z "$url" ]; then
+              HEALTH_RESULTS="$HEALTH_RESULTS $svc:skipped:0:0"
+              continue
+            fi
+            result=$(check_health_timed "$svc" "$url" 2>/dev/null) || true
+            status=$(echo "$result" | awk '{print $1}')
+            elapsed=$(echo "$result" | awk '{print $2}')
+            http_code=$(echo "$result" | awk '{print $3}')
+            HEALTH_RESULTS="$HEALTH_RESULTS $svc:${status:-skipped}:${http_code:-0}:${elapsed:-0}"
+            [ "$status" = "ok" ] && echo "  ✓ $svc" || echo "  ✗ $svc ($status)"
+          done
+
+          echo "health-results=$HEALTH_RESULTS" >> $GITHUB_OUTPUT
+
+      - name: Record deploy metrics
+        if: always()
+        run: |
+          cd "${{ env.PROJECT_DIR }}"
+          source scripts/deploy-metrics.sh
+
+          START_EPOCH="${{ steps.init.outputs.start_epoch }}"
+          DURATION=$(( $(date +%s) - START_EPOCH ))
+          STATUS="success"
+          [ "${{ job.status }}" != "success" ] && STATUS="failure"
+
+          DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
+          SERVICES="${{ steps.services.outputs.services }}"
+          [ "$DEPLOY_ALL" == "true" ] && SERVICES_CSV="all" || SERVICES_CSV=$(echo "$SERVICES" | tr ' ' ',')
+
+          COMMIT_MSG=$(git log -1 --pretty=%s 2>/dev/null | head -c 200 || echo "unknown")
+          RUN_URL="https://git.mana.how/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
+          DEPLOY_ID=$(insert_deployment \
+            "${{ github.run_id }}" "${{ github.run_attempt }}" \
+            "${{ github.sha }}" "$COMMIT_MSG" \
+            "${{ github.ref_name }}" "${{ github.event_name }}" \
+            "${{ github.actor }}" "$SERVICES_CSV" "$STATUS" 2>/dev/null) || DEPLOY_ID=""
+
+          if [ -n "$DEPLOY_ID" ]; then
+            finalise_deployment "$DEPLOY_ID" "$STATUS" "$DURATION" 2>/dev/null || true
+            BUILD_TIMES="${{ steps.build.outputs.build-times }}"
+            HEALTH_RESULTS="${{ steps.health.outputs.health-results }}"
+            ALL_SVCS=$(echo "$BUILD_TIMES $HEALTH_RESULTS" | tr ' ' '\n' | cut -d: -f1 | sort -u | tr '\n' ' ')
+            for svc in $ALL_SVCS; do
+              [ -z "$svc" ] && continue
+              build_dur=$(echo "$BUILD_TIMES" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f2 || echo "0")
+              startup=$(echo "$HEALTH_RESULTS" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f4 || echo "0")
+              health=$(echo "$HEALTH_RESULTS" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f2 || echo "skipped")
+              http_code=$(echo "$HEALTH_RESULTS" | tr ' ' '\n' | grep "^$svc:" | cut -d: -f3 || echo "0")
+              img_mb=$(get_image_size_mb "$svc" 2>/dev/null || echo "0")
+              insert_deploy_service "$DEPLOY_ID" "$svc" "${build_dur:-0}" "$img_mb" "${startup:-0}" "${health:-skipped}" "${http_code:-0}" 2>/dev/null || true
+              push_service_metrics "$svc" "${build_dur:-0}" "$img_mb" "$health" 2>/dev/null || true
+            done
+          fi
+          push_deploy_metrics "$STATUS" "$DURATION" "${{ github.ref_name }}" 2>/dev/null || true
+
+      - name: Notify on failure
+        if: failure()
+        run: |
+          cd "${{ env.PROJECT_DIR }}"
+          SERVICES="${{ steps.services.outputs.services }}"
+          [ "${{ steps.services.outputs.deploy-all }}" == "true" ] && SERVICES="all"
+          COMMIT_MSG=$(git log -1 --pretty=%s 2>/dev/null | head -c 100)
+          RUN_URL="https://git.mana.how/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          MSG="⚠️ **Deploy failed**\n\n**Services:** ${SERVICES}\n**Commit:** ${COMMIT_MSG}\n**By:** ${{ github.actor }}\n**[View logs](${RUN_URL})**"
+
+          ROOM_ID="${DEPLOY_NOTIFY_ROOM_ID:-}"
+          BOT_TOKEN="${DEPLOY_NOTIFY_BOT_TOKEN:-}"
+          if [ -n "$ROOM_ID" ] && [ -n "$BOT_TOKEN" ]; then
+            TXN_ID="deploy-$(date +%s)"
+            curl -s -X PUT \
+              "http://localhost:8008/_matrix/client/v3/rooms/${ROOM_ID}/send/m.room.message/${TXN_ID}" \
+              -H "Authorization: Bearer ${BOT_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "{\"msgtype\":\"m.text\",\"body\":\"Deploy failed: ${SERVICES}\"}" || true
+          fi
+
+      - name: Cleanup old images
+        if: always()
+        run: |
+          docker image prune -f 2>/dev/null || true
+          docker image prune -a -f --filter "until=168h" 2>/dev/null || true
diff --git a/docker-compose.macmini.yml b/docker-compose.macmini.yml
index 02cd6c5a2..9acbf9abc 100644
--- a/docker-compose.macmini.yml
+++ b/docker-compose.macmini.yml
@@ -231,7 +231,7 @@ services:
       - /Volumes/ManaData/forgejo:/data
     ports:
       - "3041:3000"
-      - "2222:2222"
+      - "2222:22"
     healthcheck:
       test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/api/v1/version"]
       interval: 120s