Add Docker multistep build (#475)

.github/workflows/build-docker.yml

@@ -22,23 +22,32 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY_IMAGE: ghcr.io/cleanuparr/cleanuparr
+
 jobs:
-  build_app:
+  # Compute tags, version, and push decision for downstream jobs
+  prepare:
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    outputs:
+      tags: ${{ steps.build-info.outputs.tags }}
+      version: ${{ steps.build-info.outputs.version }}
+      version_docker_tag: ${{ steps.build-info.outputs.version_docker_tag }}
+      branch: ${{ steps.build-info.outputs.branch }}
+      push: ${{ steps.build-info.outputs.push }}
+      github_sha: ${{ github.sha }}
     steps:
-
-      - name: Set github context
-        timeout-minutes: 1
-        run: |
-          echo 'githubRepository=${{ github.repository }}' >> $GITHUB_ENV
-          echo 'githubSha=${{ github.sha }}' >> $GITHUB_ENV
-          echo 'githubRef=${{ github.ref }}' >> $GITHUB_ENV
-          echo 'githubHeadRef=${{ github.head_ref }}' >> $GITHUB_ENV
-
       - name: Initialize build info
+        id: build-info
         timeout-minutes: 1
         run: |
-          githubHeadRef=${{ env.githubHeadRef }}
+          githubHeadRef="${{ github.head_ref }}"
+          githubRef="${{ github.ref }}"
           inputVersion="${{ inputs.app_version }}"
           latestDockerTag=""
           versionDockerTag=""
@@ -71,10 +80,8 @@ jobs:
               minorVersionDockerTag="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
             fi
           else
-            # Determine if this run is for the main branch or another branch
             if [[ -z "$githubHeadRef" ]]; then
               # Main branch
-              githubRef=${{ env.githubRef }}
               branch=${githubRef##*/}
               versionDockerTag="$branch"
             else
@@ -85,25 +92,45 @@ jobs:
           fi
 
           githubTags=""
-
           if [ -n "$latestDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$latestDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$latestDockerTag"
           fi
           if [ -n "$versionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$versionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$versionDockerTag"
           fi
           if [ -n "$minorVersionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$minorVersionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$minorVersionDockerTag"
           fi
           if [ -n "$majorVersionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$majorVersionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$majorVersionDockerTag"
           fi
 
-          # set env vars
-          echo "branch=$branch" >> $GITHUB_ENV
-          echo "githubTags=$githubTags" >> $GITHUB_ENV
-          echo "versionDockerTag=$versionDockerTag" >> $GITHUB_ENV
-          echo "version=$version" >> $GITHUB_ENV
+          githubTags="${githubTags#,}"
+
+          # Determine push decision
+          push="${{ github.event_name == 'pull_request' || inputs.push_docker == true }}"
+
+          echo "tags=$githubTags" >> $GITHUB_OUTPUT
+          echo "version=$version" >> $GITHUB_OUTPUT
+          echo "version_docker_tag=$versionDockerTag" >> $GITHUB_OUTPUT
+          echo "branch=$branch" >> $GITHUB_OUTPUT
+          echo "push=$push" >> $GITHUB_OUTPUT
+
+  # Build each platform in parallel
+  build:
+    runs-on: ubuntu-latest
+    needs: [prepare]
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+    steps:
+      - name: Prepare platform pair
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Get vault secrets
         uses: hashicorp/vault-action@v2
@@ -113,8 +140,6 @@ jobs:
           roleId: ${{ secrets.VAULT_ROLE_ID }}
           secretId: ${{ secrets.VAULT_SECRET_ID }}
           secrets:
-            secrets/data/docker username | DOCKER_USERNAME;
-            secrets/data/docker password | DOCKER_PASSWORD;
             secrets/data/github repo_readonly_pat | REPO_READONLY_PAT;
             secrets/data/github packages_pat | PACKAGES_PAT
 
@@ -122,16 +147,97 @@ jobs:
         uses: actions/checkout@v4
         timeout-minutes: 1
         with:
-          repository: ${{ env.githubRepository }}
-          ref: ${{ env.branch }}
+          repository: ${{ github.repository }}
+          ref: ${{ needs.prepare.outputs.branch }}
           token: ${{ env.REPO_READONLY_PAT }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         timeout-minutes: 5
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Login to GitHub Container Registry
+        if: needs.prepare.outputs.push == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push by digest
+        if: needs.prepare.outputs.push == 'true'
+        id: build-push
+        timeout-minutes: 30
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ github.workspace }}/code
+          file: ${{ github.workspace }}/code/Dockerfile
+          provenance: false
+          labels: |
+            commit=sha-${{ needs.prepare.outputs.github_sha }}
+            version=${{ needs.prepare.outputs.version_docker_tag }}
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
+            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
+          platforms: ${{ matrix.platform }}
+          outputs: type=image,"name=${{ env.REGISTRY_IMAGE }}",push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=build-${{ env.PLATFORM_PAIR }}
+          cache-to: type=gha,scope=build-${{ env.PLATFORM_PAIR }},mode=max
+
+      - name: Build (no push)
+        if: needs.prepare.outputs.push != 'true'
+        timeout-minutes: 30
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ github.workspace }}/code
+          file: ${{ github.workspace }}/code/Dockerfile
+          provenance: false
+          labels: |
+            commit=sha-${{ needs.prepare.outputs.github_sha }}
+            version=${{ needs.prepare.outputs.version_docker_tag }}
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
+            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
+          platforms: ${{ matrix.platform }}
+          push: false
+          cache-from: type=gha,scope=build-${{ env.PLATFORM_PAIR }}
+          cache-to: type=gha,scope=build-${{ env.PLATFORM_PAIR }},mode=max
+
+      - name: Export digest
+        if: needs.prepare.outputs.push == 'true'
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build-push.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        if: needs.prepare.outputs.push == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ env.PLATFORM_PAIR }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  # Create multi-platform manifest and push with final tags
+  merge:
+    runs-on: ubuntu-latest
+    needs: [prepare, build]
+    if: needs.prepare.outputs.push == 'true'
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
@@ -140,27 +246,25 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push docker image
-        id: docker-build
-        timeout-minutes: 15
-        uses: docker/build-push-action@v6
-        with:
-          context: ${{ github.workspace }}/code
-          file: ${{ github.workspace }}/code/Dockerfile
-          provenance: false
-          labels: |
-            commit=sha-${{ env.githubSha }}
-            version=${{ env.versionDockerTag }}
-          build-args: |
-            VERSION=${{ env.version }}
-            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
-            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
-          platforms: |
-            linux/amd64
-            linux/arm64
-          push: ${{ github.event_name == 'pull_request' || inputs.push_docker == true }}
-          tags: |
-            ${{ env.githubTags }}
-          # Enable BuildKit cache for faster builds
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Create manifest list and push
+        timeout-minutes: 5
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          tags="${{ needs.prepare.outputs.tags }}"
+          tag_args=""
+          IFS=',' read -ra TAG_ARRAY <<< "$tags"
+          for tag in "${TAG_ARRAY[@]}"; do
+            tag=$(echo "$tag" | xargs)
+            if [ -n "$tag" ]; then
+              tag_args="$tag_args -t $tag"
+            fi
+          done
+
+          docker buildx imagetools create $tag_args \
+            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
+
+      - name: Inspect image
+        run: |
+          tags="${{ needs.prepare.outputs.tags }}"
+          first_tag=$(echo "$tags" | tr ',' '\n' | grep -v '^$' | head -1 | xargs)
+          docker buildx imagetools inspect "$first_tag"

README.md

@@ -101,14 +101,6 @@ We welcome contributions from the community! Whether it's bug fixes, new feature
 - **[Feature Requests](https://github.com/Cleanuparr/Cleanuparr/issues/new/choose)** - Share your ideas for new features
 - **[Help Test Features](https://discord.gg/SCtMCgtsc4)** - Join Discord to test pre-release features and provide feedback
 
-# <img style="vertical-align: middle;" width="24px" src="./Logo/256.png" alt="Cleanuparr"> <span style="vertical-align: middle;">Cleanuparr</span> <img src="https://raw.githubusercontent.com/FortAwesome/Font-Awesome/6.x/svgs/solid/x.svg" height="24px" width="30px" style="vertical-align: middle;"> <span style="vertical-align: middle;">Huntarr</span> <img style="vertical-align: middle;" width="24px" src="https://github.com/plexguide/Huntarr.io/blob/main/frontend/static/logo/512.png?raw=true" alt Huntarr></img>
-
-Think of **Cleanuparr** as the janitor of your server; it keeps your download queue spotless, removes clutter, and blocks malicious files. Now imagine combining that with **Huntarr**, the compulsive librarian who finds missing and upgradable media to complete your collection
-
-While **Huntarr** fills in the blanks and improves what you already have, **Cleanuparr** makes sure that only clean downloads get through. If you're aiming for a reliable and self-sufficient setup, **Cleanuparr** and **Huntarr** will take your automated media stack to another level.
-
-<span style="font-size:24px"> ➡️ [**Huntarr**](https://github.com/plexguide/Huntarr.io) <span style="vertical-align: middle">![Huntarr](https://img.shields.io/github/stars/plexguide/Huntarr.io?style=social)</span></span> 
-
 # Credits
 Special thanks for inspiration go to:
 - [ThijmenGThN/swaparr](https://github.com/ThijmenGThN/swaparr)

code/Makefile

@@ -15,6 +15,12 @@ ifndef name
 endif
 	dotnet ef migrations add $(name) --context EventsContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Events
 
+migrate-users:
+ifndef name
+	$(error name is required. Usage: make migrate-users name=YourMigrationName)
+endif
+	dotnet ef migrations add $(name) --context UsersContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Users
+
 docker-build:
 ifndef tag
 	$(error tag is required. Usage: make docker-build tag=latest version=1.0.0 user=... pat=...)

code/backend/Cleanuparr.Api.Tests/Cleanuparr.Api.Tests.csproj

@@ -0,0 +1,27 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Shouldly" Version="4.3.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Cleanuparr.Api\Cleanuparr.Api.csproj" />
+  </ItemGroup>
+
+</Project>

code/backend/Cleanuparr.Api.Tests/CustomWebApplicationFactory.cs

@@ -0,0 +1,61 @@
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Cleanuparr.Api.Tests;
+
+/// <summary>
+/// Custom WebApplicationFactory that uses an isolated SQLite database for each test fixture.
+/// The database file is created in a temp directory so both DI and static contexts share the same data.
+/// </summary>
+public class CustomWebApplicationFactory : WebApplicationFactory<Program>
+{
+    private readonly string _tempDir;
+
+    public CustomWebApplicationFactory()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), $"cleanuparr-test-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(_tempDir);
+    }
+
+    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    {
+        builder.UseEnvironment("Testing");
+
+        builder.ConfigureServices(services =>
+        {
+            // Remove the existing UsersContext registration
+            var descriptor = services.SingleOrDefault(d => d.ServiceType == typeof(DbContextOptions<UsersContext>));
+            if (descriptor != null) services.Remove(descriptor);
+
+            // Also remove the DbContext registration itself
+            var contextDescriptor = services.SingleOrDefault(d => d.ServiceType == typeof(UsersContext));
+            if (contextDescriptor != null) services.Remove(contextDescriptor);
+
+            var dbPath = Path.Combine(_tempDir, "users.db");
+
+            services.AddDbContext<UsersContext>(options =>
+            {
+                options.UseSqlite($"Data Source={dbPath}");
+            });
+
+            // Ensure DB is created
+            var sp = services.BuildServiceProvider();
+            using var scope = sp.CreateScope();
+            var db = scope.ServiceProvider.GetRequiredService<UsersContext>();
+            db.Database.EnsureCreated();
+        });
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        base.Dispose(disposing);
+
+        if (disposing && Directory.Exists(_tempDir))
+        {
+            try { Directory.Delete(_tempDir, true); } catch { /* best effort cleanup */ }
+        }
+    }
+}

code/backend/Cleanuparr.Api.Tests/Features/Auth/AuthControllerTests.cs

@@ -0,0 +1,287 @@
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Integration tests for the authentication flow.
+/// Uses a single shared factory to avoid static state conflicts.
+/// Tests are ordered to build on each other: setup → login → protected endpoints.
+/// </summary>
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class AuthControllerTests : IClassFixture<CustomWebApplicationFactory>
+{
+    private readonly HttpClient _client;
+
+    public AuthControllerTests(CustomWebApplicationFactory factory)
+    {
+        _client = factory.CreateClient();
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task GetStatus_BeforeSetup_ReturnsNotCompleted()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("setupCompleted").GetBoolean().ShouldBeFalse();
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task Setup_CreateAccount_ReturnsCreated()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("userId").GetString().ShouldNotBeNullOrEmpty();
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task Setup_CreateDuplicateAccount_ReturnsConflict()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "another",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Conflict);
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task Setup_Generate2FA_ReturnsSecretAndRecoveryCodes()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("secret").GetString().ShouldNotBeNullOrEmpty();
+        body.GetProperty("qrCodeUri").GetString().ShouldNotBeNullOrEmpty();
+        body.GetProperty("recoveryCodes").GetArrayLength().ShouldBeGreaterThan(0);
+
+        // Store the secret for the next test
+        _totpSecret = body.GetProperty("secret").GetString()!;
+    }
+
+    [Fact, TestPriority(4)]
+    public async Task Setup_Verify2FA_WithValidCode_Succeeds()
+    {
+        // If we don't have the secret from the previous test, generate it again
+        if (string.IsNullOrEmpty(_totpSecret))
+        {
+            var genResponse = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+            var genBody = await genResponse.Content.ReadFromJsonAsync<JsonElement>();
+            _totpSecret = genBody.GetProperty("secret").GetString()!;
+        }
+
+        var code = GenerateTotpCode(_totpSecret);
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/verify", new { code });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(5)]
+    public async Task Setup_Complete_Succeeds()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(6)]
+    public async Task Login_ValidCredentials_RequiresTwoFactor()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("requiresTwoFactor").GetBoolean().ShouldBeTrue();
+        body.GetProperty("loginToken").GetString().ShouldNotBeNullOrEmpty();
+    }
+
+    [Fact, TestPriority(7)]
+    public async Task Login_InvalidCredentials_ReturnsUnauthorized()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "WrongPassword!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    [Fact, TestPriority(8)]
+    public async Task Login_BruteForce_ReturnsRetryAfter()
+    {
+        // Make multiple failed attempts
+        for (int i = 0; i < 3; i++)
+        {
+            await _client.PostAsJsonAsync("/api/auth/login", new
+            {
+                username = "admin",
+                password = "WrongPassword!"
+            });
+        }
+
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "WrongPassword!"
+        });
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+
+        if (response.StatusCode == HttpStatusCode.TooManyRequests)
+        {
+            body.GetProperty("retryAfterSeconds").GetInt32().ShouldBeGreaterThan(0);
+        }
+        else
+        {
+            response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+            body.TryGetProperty("retryAfterSeconds", out var retry).ShouldBeTrue();
+            retry.GetInt32().ShouldBeGreaterThan(0);
+        }
+    }
+
+    [Fact, TestPriority(9)]
+    public async Task ProtectedEndpoint_WithoutAuth_DeniesAccess()
+    {
+        var response = await _client.GetAsync("/api/account");
+
+        // 401 (FallbackPolicy) or 403 (SetupGuardMiddleware) - both deny unauthenticated access
+        new[] { HttpStatusCode.Unauthorized, HttpStatusCode.Forbidden }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(10)]
+    public async Task HealthEndpoint_WithoutAuth_Returns200()
+    {
+        var response = await _client.GetAsync("/health");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(11)]
+    public async Task Setup_2FAGenerate_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(12)]
+    public async Task Setup_PlexPin_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsync("/api/auth/setup/plex/pin", null);
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(13)]
+    public async Task Setup_Complete_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(14)]
+    public async Task Login_NotBlockedByMiddleware_AfterSetupEndpointsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        // Login endpoint must NOT be blocked by the middleware (403).
+        // It may return OK (200) or TooManyRequests (429) due to brute force lockout from earlier tests.
+        response.StatusCode.ShouldNotBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(15)]
+    public async Task AuthStatus_StillWorks_AfterSetupEndpointsBlocked()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("setupCompleted").GetBoolean().ShouldBeTrue();
+    }
+
+    #region TOTP helpers
+
+    private static string _totpSecret = "";
+
+    private static string GenerateTotpCode(string base32Secret)
+    {
+        var key = Base32Decode(base32Secret);
+        var timestep = (long)(DateTime.UtcNow - DateTime.UnixEpoch).TotalSeconds / 30;
+        var timestepBytes = BitConverter.GetBytes(timestep);
+
+        if (BitConverter.IsLittleEndian)
+            Array.Reverse(timestepBytes);
+
+        using var hmac = new System.Security.Cryptography.HMACSHA1(key);
+        var hash = hmac.ComputeHash(timestepBytes);
+
+        var offset = hash[^1] & 0x0F;
+        var binaryCode =
+            ((hash[offset] & 0x7F) << 24) |
+            ((hash[offset + 1] & 0xFF) << 16) |
+            ((hash[offset + 2] & 0xFF) << 8) |
+            (hash[offset + 3] & 0xFF);
+
+        return (binaryCode % 1_000_000).ToString("D6");
+    }
+
+    private static byte[] Base32Decode(string base32)
+    {
+        const string alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+        base32 = base32.ToUpperInvariant().TrimEnd('=');
+
+        var bits = new List<byte>();
+        foreach (var c in base32)
+        {
+            var val = alphabet.IndexOf(c);
+            if (val < 0) continue;
+            for (var i = 4; i >= 0; i--)
+                bits.Add((byte)((val >> i) & 1));
+        }
+
+        var bytes = new byte[bits.Count / 8];
+        for (var i = 0; i < bytes.Length; i++)
+        {
+            for (var j = 0; j < 8; j++)
+                bytes[i] = (byte)((bytes[i] << 1) | bits[i * 8 + j]);
+        }
+
+        return bytes;
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/PriorityOrderer.cs

@@ -0,0 +1,37 @@
+using Xunit.Abstractions;
+using Xunit.Sdk;
+
+namespace Cleanuparr.Api.Tests;
+
+public sealed class PriorityOrderer : ITestCaseOrderer
+{
+    public IEnumerable<TTestCase> OrderTestCases<TTestCase>(IEnumerable<TTestCase> testCases)
+        where TTestCase : ITestCase
+    {
+        var sortedMethods = new SortedDictionary<int, List<TTestCase>>();
+
+        foreach (var testCase in testCases)
+        {
+            var priority = testCase.TestMethod.Method
+                .GetCustomAttributes(typeof(TestPriorityAttribute).AssemblyQualifiedName)
+                .FirstOrDefault()
+                ?.GetNamedArgument<int>("Priority") ?? 0;
+
+            if (!sortedMethods.TryGetValue(priority, out var list))
+            {
+                list = [];
+                sortedMethods[priority] = list;
+            }
+
+            list.Add(testCase);
+        }
+
+        foreach (var list in sortedMethods.Values)
+        {
+            foreach (var testCase in list)
+            {
+                yield return testCase;
+            }
+        }
+    }
+}

code/backend/Cleanuparr.Api.Tests/TestPriorityAttribute.cs

@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Tests;
+
+[AttributeUsage(AttributeTargets.Method)]
+public sealed class TestPriorityAttribute : Attribute
+{
+    public int Priority { get; }
+
+    public TestPriorityAttribute(int priority)
+    {
+        Priority = priority;
+    }
+}

code/backend/Cleanuparr.Api/Auth/ApiKeyAuthenticationHandler.cs

@@ -0,0 +1,69 @@
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Cleanuparr.Api.Auth;
+
+public static class ApiKeyAuthenticationDefaults
+{
+    public const string AuthenticationScheme = "ApiKey";
+    public const string HeaderName = "X-Api-Key";
+    public const string QueryParameterName = "apikey";
+}
+
+public class ApiKeyAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public ApiKeyAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        // Try header first, then query string
+        string? apiKey = null;
+
+        if (Request.Headers.TryGetValue(ApiKeyAuthenticationDefaults.HeaderName, out var headerValue))
+        {
+            apiKey = headerValue.ToString();
+        }
+        else if (Request.Query.TryGetValue(ApiKeyAuthenticationDefaults.QueryParameterName, out var queryValue))
+        {
+            apiKey = queryValue.ToString();
+        }
+
+        if (string.IsNullOrWhiteSpace(apiKey))
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users
+            .AsNoTracking()
+            .FirstOrDefaultAsync(u => u.ApiKey == apiKey && u.SetupCompleted);
+
+        if (user is null)
+        {
+            return AuthenticateResult.Fail("Invalid API key");
+        }
+
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim("auth_method", "apikey")
+        };
+
+        var identity = new ClaimsIdentity(claims, ApiKeyAuthenticationDefaults.AuthenticationScheme);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, ApiKeyAuthenticationDefaults.AuthenticationScheme);
+
+        return AuthenticateResult.Success(ticket);
+    }
+}

code/backend/Cleanuparr.Api/Auth/TrustedNetworkAuthenticationHandler.cs

@@ -0,0 +1,192 @@
+using System.Net;
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Cleanuparr.Infrastructure.Extensions;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Cleanuparr.Api.Auth;
+
+public static class TrustedNetworkAuthenticationDefaults
+{
+    public const string AuthenticationScheme = "TrustedNetwork";
+}
+
+public class TrustedNetworkAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public TrustedNetworkAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        // Load auth config from database
+        await using var dataContext = DataContext.CreateStaticInstance();
+        var config = await dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+
+        if (config is null || !config.Auth.DisableAuthForLocalAddresses)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Determine client IP
+        var clientIp = GetClientIp(config.Auth.TrustForwardedHeaders);
+        if (clientIp is null)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Check if the client IP is trusted
+        if (!IsTrustedAddress(clientIp, config.Auth.TrustedNetworks))
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Load the admin user
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users
+            .AsNoTracking()
+            .FirstOrDefaultAsync(u => u.SetupCompleted);
+
+        if (user is null)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim("auth_method", "trusted_network")
+        };
+
+        var identity = new ClaimsIdentity(claims, TrustedNetworkAuthenticationDefaults.AuthenticationScheme);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, TrustedNetworkAuthenticationDefaults.AuthenticationScheme);
+
+        return AuthenticateResult.Success(ticket);
+    }
+
+    private IPAddress? GetClientIp(bool trustForwardedHeaders) =>
+        ResolveClientIp(Context, trustForwardedHeaders);
+
+    public static IPAddress? ResolveClientIp(HttpContext httpContext, bool trustForwardedHeaders)
+    {
+        var remoteIp = httpContext.Connection.RemoteIpAddress;
+        if (remoteIp is null)
+        {
+            return null;
+        }
+
+        // Only trust forwarded headers if the direct connection is from a local address
+        if (trustForwardedHeaders && remoteIp.IsLocalAddress())
+        {
+            // Check X-Forwarded-For first, then X-Real-IP
+            var forwardedFor = httpContext.Request.Headers["X-Forwarded-For"].FirstOrDefault();
+            if (!string.IsNullOrEmpty(forwardedFor))
+            {
+                // X-Forwarded-For can contain multiple IPs: client, proxy1, proxy2
+                // The first one is the original client
+                var firstIp = forwardedFor.Split(',')[0].Trim();
+                if (IPAddress.TryParse(firstIp, out var parsedIp))
+                {
+                    return parsedIp;
+                }
+            }
+
+            var realIp = httpContext.Request.Headers["X-Real-IP"].FirstOrDefault();
+            if (!string.IsNullOrEmpty(realIp) && IPAddress.TryParse(realIp, out var realParsedIp))
+            {
+                return realParsedIp;
+            }
+        }
+
+        return remoteIp;
+    }
+
+    public static bool IsTrustedAddress(IPAddress clientIp, List<string> trustedNetworks)
+    {
+        // Normalize IPv4-mapped IPv6 addresses
+        if (clientIp.IsIPv4MappedToIPv6)
+        {
+            clientIp = clientIp.MapToIPv4();
+        }
+
+        // Check if it's a local address (built-in ranges)
+        if (clientIp.IsLocalAddress())
+        {
+            return true;
+        }
+
+        // Check against custom trusted networks
+        foreach (var network in trustedNetworks)
+        {
+            if (MatchesCidr(clientIp, network))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public static bool MatchesCidr(IPAddress address, string cidr)
+    {
+        if (cidr.Contains('/'))
+        {
+            var parts = cidr.Split('/');
+            if (!IPAddress.TryParse(parts[0], out var networkAddress) ||
+                !int.TryParse(parts[1], out var prefixLength))
+            {
+                return false;
+            }
+
+            // Normalize both addresses
+            if (networkAddress.IsIPv4MappedToIPv6)
+                networkAddress = networkAddress.MapToIPv4();
+            if (address.IsIPv4MappedToIPv6)
+                address = address.MapToIPv4();
+
+            // Must be same address family
+            if (address.AddressFamily != networkAddress.AddressFamily)
+                return false;
+
+            var addressBytes = address.GetAddressBytes();
+            var networkBytes = networkAddress.GetAddressBytes();
+
+            // Compare bytes up to prefix length
+            var fullBytes = prefixLength / 8;
+            var remainingBits = prefixLength % 8;
+
+            for (var i = 0; i < fullBytes && i < addressBytes.Length; i++)
+            {
+                if (addressBytes[i] != networkBytes[i])
+                    return false;
+            }
+
+            if (remainingBits > 0 && fullBytes < addressBytes.Length)
+            {
+                var mask = (byte)(0xFF << (8 - remainingBits));
+                if ((addressBytes[fullBytes] & mask) != (networkBytes[fullBytes] & mask))
+                    return false;
+            }
+
+            return true;
+        }
+
+        // Plain IP match
+        if (!IPAddress.TryParse(cidr, out var singleIp))
+            return false;
+
+        if (singleIp.IsIPv4MappedToIPv6)
+            singleIp = singleIp.MapToIPv4();
+
+        return address.Equals(singleIp);
+    }
+}

code/backend/Cleanuparr.Api/Cleanuparr.Api.csproj

@@ -24,6 +24,7 @@
 
     <ItemGroup>
         <PackageReference Include="MassTransit" Version="8.5.7" />
+        <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.1" />
         <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.1">
           <PrivateAssets>all</PrivateAssets>
           <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

code/backend/Cleanuparr.Api/Controllers/EventsController.cs

@@ -29,12 +29,24 @@ public class EventsController : ControllerBase
         [FromQuery] string? eventType = null,
         [FromQuery] DateTime? fromDate = null,
         [FromQuery] DateTime? toDate = null,
-        [FromQuery] string? search = null)
+        [FromQuery] string? search = null,
+        [FromQuery] string? jobRunId = null)
     {
         // Validate pagination parameters
-        if (page < 1) page = 1;
-        if (pageSize < 1) pageSize = 100;
-        if (pageSize > 1000) pageSize = 1000; // Cap at 1000 for performance
+        if (page < 1)
+        {
+            page = 1;
+        }
+
+        if (pageSize < 1)
+        {
+            pageSize = 100;
+        }
+        
+        if (pageSize > 1000)
+        {
+            pageSize = 1000; // Cap at 1000 for performance
+        }
         
         var query = _context.Events.AsQueryable();
 
@@ -62,6 +74,12 @@ public class EventsController : ControllerBase
             query = query.Where(e => e.Timestamp <= toDate.Value);
         }
 
+        // Apply job run ID exact-match filter
+        if (!string.IsNullOrWhiteSpace(jobRunId) && Guid.TryParse(jobRunId, out var jobRunGuid))
+        {
+            query = query.Where(e => e.JobRunId == jobRunGuid);
+        }
+
         // Apply search filter if provided
         if (!string.IsNullOrWhiteSpace(search))
         {
@@ -69,7 +87,10 @@ public class EventsController : ControllerBase
             query = query.Where(e =>
                 EF.Functions.Like(e.Message, pattern) ||
                 EF.Functions.Like(e.Data, pattern) ||
-                EF.Functions.Like(e.TrackingId.ToString(), pattern)
+                EF.Functions.Like(e.TrackingId.ToString(), pattern) ||
+                EF.Functions.Like(e.InstanceUrl, pattern) ||
+                EF.Functions.Like(e.DownloadClientName, pattern) ||
+                EF.Functions.Like(e.JobRunId.ToString(), pattern)
             );
         }
 
@@ -128,33 +149,6 @@ public class EventsController : ControllerBase
         return Ok(events);
     }
 
-    /// <summary>
-    /// Gets event statistics
-    /// </summary>
-    [HttpGet("stats")]
-    public async Task<ActionResult<object>> GetEventStats()
-    {
-        var stats = new
-        {
-            TotalEvents = await _context.Events.CountAsync(),
-            EventsBySeverity = await _context.Events
-                .GroupBy(e => e.Severity)
-                .Select(g => new { Severity = g.Key.ToString(), Count = g.Count() })
-                .ToListAsync(),
-            EventsByType = await _context.Events
-                .GroupBy(e => e.EventType)
-                .Select(g => new { EventType = g.Key.ToString(), Count = g.Count() })
-                .OrderByDescending(x => x.Count)
-                .Take(10)
-                .ToListAsync(),
-            RecentEventsCount = await _context.Events
-                .Where(e => e.Timestamp > DateTime.UtcNow.AddHours(-24))
-                .CountAsync()
-        };
-
-        return Ok(stats);
-    }
-
     /// <summary>
     /// Manually triggers cleanup of old events
     /// </summary>

code/backend/Cleanuparr.Api/Controllers/JobsController.cs

@@ -1,4 +1,5 @@
 using Cleanuparr.Api.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;

code/backend/Cleanuparr.Api/Controllers/ManualEventsController.cs

@@ -66,7 +66,9 @@ public class ManualEventsController : ControllerBase
             string pattern = EventsContext.GetLikePattern(search);
             query = query.Where(e =>
                 EF.Functions.Like(e.Message, pattern) ||
-                EF.Functions.Like(e.Data, pattern)
+                EF.Functions.Like(e.Data, pattern) ||
+                EF.Functions.Like(e.InstanceUrl, pattern) ||
+                EF.Functions.Like(e.DownloadClientName, pattern)
             );
         }
 

code/backend/Cleanuparr.Api/Controllers/StatsController.cs

@@ -0,0 +1,51 @@
+using Cleanuparr.Infrastructure.Stats;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Cleanuparr.Api.Controllers;
+
+/// <summary>
+/// Aggregated statistics endpoint for dashboard integrations
+/// </summary>
+[ApiController]
+[Route("api/[controller]")]
+public class StatsController : ControllerBase
+{
+    private readonly ILogger<StatsController> _logger;
+    private readonly IStatsService _statsService;
+
+    public StatsController(
+        ILogger<StatsController> logger,
+        IStatsService statsService)
+    {
+        _logger = logger;
+        _statsService = statsService;
+    }
+
+    /// <summary>
+    /// Gets aggregated application statistics for the specified timeframe
+    /// </summary>
+    /// <param name="hours">Timeframe in hours (default 24, range 1-720)</param>
+    /// <param name="includeEvents">Number of recent events to include (0 = none, max 100)</param>
+    /// <param name="includeStrikes">Number of recent strikes to include (0 = none, max 100)</param>
+    [HttpGet]
+    public async Task<IActionResult> GetStats(
+        [FromQuery] int hours = 24,
+        [FromQuery] int includeEvents = 0,
+        [FromQuery] int includeStrikes = 0)
+    {
+        try
+        {
+            hours = Math.Clamp(hours, 1, 720);
+            includeEvents = Math.Clamp(includeEvents, 0, 100);
+            includeStrikes = Math.Clamp(includeStrikes, 0, 100);
+
+            var stats = await _statsService.GetStatsAsync(hours, includeEvents, includeStrikes);
+            return Ok(stats);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Error retrieving stats");
+            return StatusCode(500, new { Error = "An error occurred while retrieving stats" });
+        }
+    }
+}

code/backend/Cleanuparr.Api/Controllers/StrikesController.cs

@@ -0,0 +1,189 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.State;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class StrikesController : ControllerBase
+{
+    private readonly EventsContext _context;
+
+    public StrikesController(EventsContext context)
+    {
+        _context = context;
+    }
+
+    /// <summary>
+    /// Gets download items with their strikes (grouped), with pagination and filtering
+    /// </summary>
+    [HttpGet]
+    public async Task<ActionResult<PaginatedResult<DownloadItemStrikesDto>>> GetStrikes(
+        [FromQuery] int page = 1,
+        [FromQuery] int pageSize = 50,
+        [FromQuery] string? search = null,
+        [FromQuery] string? type = null)
+    {
+        if (page < 1) page = 1;
+        if (pageSize < 1) pageSize = 50;
+        if (pageSize > 100) pageSize = 100;
+
+        var query = _context.DownloadItems
+            .Include(d => d.Strikes)
+            .Where(d => d.Strikes.Any());
+
+        // Filter by strike type: only show items that have strikes of this type
+        if (!string.IsNullOrWhiteSpace(type))
+        {
+            if (Enum.TryParse<StrikeType>(type, true, out var strikeType))
+                query = query.Where(d => d.Strikes.Any(s => s.Type == strikeType));
+        }
+
+        // Apply search filter on title or download hash
+        if (!string.IsNullOrWhiteSpace(search))
+        {
+            string pattern = EventsContext.GetLikePattern(search);
+            query = query.Where(d =>
+                EF.Functions.Like(d.Title, pattern) ||
+                EF.Functions.Like(d.DownloadId, pattern));
+        }
+
+        var totalCount = await query.CountAsync();
+        var totalPages = (int)Math.Ceiling(totalCount / (double)pageSize);
+        var skip = (page - 1) * pageSize;
+
+        var items = await query
+            .OrderByDescending(d => d.Strikes.Max(s => s.CreatedAt))
+            .Skip(skip)
+            .Take(pageSize)
+            .ToListAsync();
+
+        var dtos = items.Select(d => new DownloadItemStrikesDto
+        {
+            DownloadItemId = d.Id,
+            DownloadId = d.DownloadId,
+            Title = d.Title,
+            TotalStrikes = d.Strikes.Count,
+            StrikesByType = d.Strikes
+                .GroupBy(s => s.Type)
+                .ToDictionary(g => g.Key.ToString(), g => g.Count()),
+            LatestStrikeAt = d.Strikes.Max(s => s.CreatedAt),
+            FirstStrikeAt = d.Strikes.Min(s => s.CreatedAt),
+            IsMarkedForRemoval = d.IsMarkedForRemoval,
+            IsRemoved = d.IsRemoved,
+            IsReturning = d.IsReturning,
+            Strikes = d.Strikes
+                .OrderByDescending(s => s.CreatedAt)
+                .Select(s => new StrikeDetailDto
+                {
+                    Id = s.Id,
+                    Type = s.Type.ToString(),
+                    CreatedAt = s.CreatedAt,
+                    LastDownloadedBytes = s.LastDownloadedBytes,
+                    JobRunId = s.JobRunId,
+                }).ToList(),
+        }).ToList();
+
+        return Ok(new PaginatedResult<DownloadItemStrikesDto>
+        {
+            Items = dtos,
+            Page = page,
+            PageSize = pageSize,
+            TotalCount = totalCount,
+            TotalPages = totalPages,
+        });
+    }
+
+    /// <summary>
+    /// Gets the most recent individual strikes with download item info (for dashboard)
+    /// </summary>
+    [HttpGet("recent")]
+    public async Task<ActionResult<List<RecentStrikeDto>>> GetRecentStrikes(
+        [FromQuery] int count = 5)
+    {
+        if (count < 1) count = 1;
+        if (count > 50) count = 50;
+
+        var strikes = await _context.Strikes
+            .Include(s => s.DownloadItem)
+            .OrderByDescending(s => s.CreatedAt)
+            .Take(count)
+            .Select(s => new RecentStrikeDto
+            {
+                Id = s.Id,
+                Type = s.Type.ToString(),
+                CreatedAt = s.CreatedAt,
+                DownloadId = s.DownloadItem.DownloadId,
+                Title = s.DownloadItem.Title,
+            })
+            .ToListAsync();
+
+        return Ok(strikes);
+    }
+
+    /// <summary>
+    /// Gets all available strike types
+    /// </summary>
+    [HttpGet("types")]
+    public ActionResult<List<string>> GetStrikeTypes()
+    {
+        var types = Enum.GetNames(typeof(StrikeType)).ToList();
+        return Ok(types);
+    }
+
+    /// <summary>
+    /// Deletes all strikes for a specific download item
+    /// </summary>
+    [HttpDelete("{downloadItemId:guid}")]
+    public async Task<IActionResult> DeleteStrikesForItem(Guid downloadItemId)
+    {
+        var item = await _context.DownloadItems
+            .Include(d => d.Strikes)
+            .FirstOrDefaultAsync(d => d.Id == downloadItemId);
+
+        if (item == null)
+            return NotFound();
+
+        _context.Strikes.RemoveRange(item.Strikes);
+        _context.DownloadItems.Remove(item);
+        await _context.SaveChangesAsync();
+
+        return NoContent();
+    }
+}
+
+public class DownloadItemStrikesDto
+{
+    public Guid DownloadItemId { get; set; }
+    public string DownloadId { get; set; } = string.Empty;
+    public string Title { get; set; } = string.Empty;
+    public int TotalStrikes { get; set; }
+    public Dictionary<string, int> StrikesByType { get; set; } = new();
+    public DateTime LatestStrikeAt { get; set; }
+    public DateTime FirstStrikeAt { get; set; }
+    public bool IsMarkedForRemoval { get; set; }
+    public bool IsRemoved { get; set; }
+    public bool IsReturning { get; set; }
+    public List<StrikeDetailDto> Strikes { get; set; } = [];
+}
+
+public class StrikeDetailDto
+{
+    public Guid Id { get; set; }
+    public string Type { get; set; } = string.Empty;
+    public DateTime CreatedAt { get; set; }
+    public long? LastDownloadedBytes { get; set; }
+    public Guid JobRunId { get; set; }
+}
+
+public class RecentStrikeDto
+{
+    public Guid Id { get; set; }
+    public string Type { get; set; } = string.Empty;
+    public DateTime CreatedAt { get; set; }
+    public string DownloadId { get; set; } = string.Empty;
+    public string Title { get; set; } = string.Empty;
+}

code/backend/Cleanuparr.Api/DependencyInjection/ApiDI.cs

@@ -65,9 +65,13 @@ public static class ApiDI
         // Add the global exception handling middleware first
         app.UseMiddleware<ExceptionMiddleware>();
 
+        // Block non-auth requests until setup is complete
+        app.UseMiddleware<SetupGuardMiddleware>();
+
         app.UseCors("Any");
         app.UseRouting();
 
+        app.UseAuthentication();
         app.UseAuthorization();
         app.MapControllers();
         
@@ -108,11 +112,11 @@ public static class ApiDI
             
             context.Response.ContentType = "text/html";
             await context.Response.WriteAsync(indexContent, Encoding.UTF8);
-        });
+        }).AllowAnonymous();
         
         // Map SignalR hubs
-        app.MapHub<HealthStatusHub>("/api/hubs/health");
-        app.MapHub<AppHub>("/api/hubs/app");
+        app.MapHub<HealthStatusHub>("/api/hubs/health").RequireAuthorization();
+        app.MapHub<AppHub>("/api/hubs/app").RequireAuthorization();
         
         app.MapGet("/manifest.webmanifest", (HttpContext context) =>
         {
@@ -124,12 +128,18 @@ public static class ApiDI
             {
                 name = "Cleanuparr",
                 short_name = "Cleanuparr",
+                description = "Automated cleanup for *arr applications and download clients",
                 start_url = basePath,
                 display = "standalone",
-                background_color = "#ffffff",
-                theme_color = "#ffffff",
+                background_color = "#0e0a1a",
+                theme_color = "#1a1135",
                 icons = new[]
                 {
+                    new {
+                        src = "icons/128.png",
+                        sizes = "128x128",
+                        type = "image/png"
+                    },
                     new {
                         src = "icons/icon-192x192.png",
                         sizes = "192x192",
@@ -144,7 +154,7 @@ public static class ApiDI
             };
 
             return Results.Json(manifest, contentType: "application/manifest+json");
-        });
+        }).AllowAnonymous();
 
         return app;
     }

code/backend/Cleanuparr.Api/DependencyInjection/AuthDI.cs

@@ -0,0 +1,92 @@
+using Cleanuparr.Api.Auth;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Cleanuparr.Api.DependencyInjection;
+
+public static class AuthDI
+{
+    private const string SmartScheme = "Smart";
+
+    public static IServiceCollection AddAuthServices(this IServiceCollection services)
+    {
+        // Get the signing key from the JwtService
+        var jwtService = new JwtService();
+        var signingKey = jwtService.GetOrCreateSigningKey();
+
+        services
+            .AddAuthentication(SmartScheme)
+            .AddPolicyScheme(SmartScheme, "JWT or API Key", options =>
+            {
+                // Route to the correct auth handler based on the request
+                options.ForwardDefaultSelector = context =>
+                {
+                    if (context.Request.Headers.ContainsKey(ApiKeyAuthenticationDefaults.HeaderName) ||
+                        context.Request.Query.ContainsKey(ApiKeyAuthenticationDefaults.QueryParameterName))
+                    {
+                        return ApiKeyAuthenticationDefaults.AuthenticationScheme;
+                    }
+
+                    // Check for Bearer token or SignalR access_token
+                    if (context.Request.Headers.ContainsKey("Authorization") ||
+                        (context.Request.Path.StartsWithSegments("/api/hubs") &&
+                         context.Request.Query.ContainsKey("access_token")))
+                    {
+                        return JwtBearerDefaults.AuthenticationScheme;
+                    }
+
+                    // Fall through to trusted network handler (returns NoResult if disabled)
+                    return TrustedNetworkAuthenticationDefaults.AuthenticationScheme;
+                };
+            })
+            .AddJwtBearer(options =>
+            {
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = true,
+                    ValidIssuer = "Cleanuparr",
+                    ValidateAudience = true,
+                    ValidAudience = "Cleanuparr",
+                    ValidateLifetime = true,
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = new SymmetricSecurityKey(signingKey),
+                    ClockSkew = TimeSpan.FromSeconds(30)
+                };
+
+                // Support SignalR token via query string
+                options.Events = new JwtBearerEvents
+                {
+                    OnMessageReceived = context =>
+                    {
+                        var accessToken = context.Request.Query["access_token"];
+                        var path = context.HttpContext.Request.Path;
+
+                        if (!string.IsNullOrEmpty(accessToken) && path.StartsWithSegments("/api/hubs"))
+                        {
+                            context.Token = accessToken;
+                        }
+
+                        return Task.CompletedTask;
+                    }
+                };
+            })
+            .AddScheme<AuthenticationSchemeOptions, ApiKeyAuthenticationHandler>(
+                ApiKeyAuthenticationDefaults.AuthenticationScheme, _ => { })
+            .AddScheme<AuthenticationSchemeOptions, TrustedNetworkAuthenticationHandler>(
+                TrustedNetworkAuthenticationDefaults.AuthenticationScheme, _ => { });
+
+        services.AddAuthorization(options =>
+        {
+            var defaultPolicy = new Microsoft.AspNetCore.Authorization.AuthorizationPolicyBuilder()
+                .RequireAuthenticatedUser()
+                .Build();
+
+            options.DefaultPolicy = defaultPolicy;
+            options.FallbackPolicy = defaultPolicy;
+        });
+
+        return services;
+    }
+}

code/backend/Cleanuparr.Api/DependencyInjection/MainDI.cs

@@ -56,8 +56,8 @@ public static class MainDI
                     {
                         e.ConfigureConsumer<DownloadRemoverConsumer<SearchItem>>(context);
                         e.ConfigureConsumer<DownloadRemoverConsumer<SeriesSearchItem>>(context);
-                        e.ConcurrentMessageLimit = 2;
-                        e.PrefetchCount = 2;
+                        e.ConcurrentMessageLimit = 1;
+                        e.PrefetchCount = 1;
                     });
                     
                     cfg.ReceiveEndpoint("download-hunter-queue", e =>
@@ -87,10 +87,13 @@ public static class MainDI
     {
         // Add the dynamic HTTP client system - this replaces all the previous static configurations
         services.AddDynamicHttpClients();
-        
+
         // Add the dynamic HTTP client provider that uses the new system
         services.AddSingleton<IDynamicHttpClientProvider, DynamicHttpClientProvider>();
-        
+
+        // Add HTTP client for Plex authentication
+        services.AddHttpClient("PlexAuth");
+
         return services;
     }
 

code/backend/Cleanuparr.Api/DependencyInjection/ServicesDI.cs

@@ -2,6 +2,7 @@ using Cleanuparr.Infrastructure.Events;
 using Cleanuparr.Infrastructure.Events.Interfaces;
 using Cleanuparr.Infrastructure.Features.Arr;
 using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
+using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Infrastructure.Features.BlacklistSync;
 using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Features.DownloadHunter;
@@ -16,6 +17,7 @@ using Cleanuparr.Infrastructure.Helpers;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Infrastructure.Stats;
 using Cleanuparr.Persistence;
 
 namespace Cleanuparr.Api.DependencyInjection;
@@ -26,6 +28,11 @@ public static class ServicesDI
         services
             .AddScoped<EventsContext>()
             .AddScoped<DataContext>()
+            .AddScoped<UsersContext>()
+            .AddSingleton<IJwtService, JwtService>()
+            .AddSingleton<IPasswordService, PasswordService>()
+            .AddSingleton<ITotpService, TotpService>()
+            .AddScoped<IPlexAuthService, PlexAuthService>()
             .AddScoped<IEventPublisher, EventPublisher>()
             .AddHostedService<EventCleanupService>()
             .AddScoped<IDryRunInterceptor, DryRunInterceptor>()
@@ -54,6 +61,7 @@ public static class ServicesDI
             .AddScoped<IRuleManager, RuleManager>()
             .AddScoped<IRuleEvaluator, RuleEvaluator>()
             .AddScoped<IRuleIntervalValidator, RuleIntervalValidator>()
+            .AddScoped<IStatsService, StatsService>()
             .AddSingleton<IJobManagementService, JobManagementService>()
             .AddSingleton<IBlocklistProvider, BlocklistProvider>()
             .AddSingleton(TimeProvider.System)

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/ChangePasswordRequest.cs

@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record ChangePasswordRequest
+{
+    [Required]
+    public required string CurrentPassword { get; init; }
+
+    [Required]
+    [MinLength(8)]
+    [MaxLength(128)]
+    public required string NewPassword { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/CreateAccountRequest.cs

@@ -0,0 +1,16 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record CreateAccountRequest
+{
+    [Required]
+    [MinLength(3)]
+    [MaxLength(50)]
+    public required string Username { get; init; }
+
+    [Required]
+    [MinLength(8)]
+    [MaxLength(128)]
+    public required string Password { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Disable2faRequest.cs

@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Disable2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string TotpCode { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Enable2faRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Enable2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/LoginRequest.cs

@@ -0,0 +1,12 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record LoginRequest
+{
+    [Required]
+    public required string Username { get; init; }
+
+    [Required]
+    public required string Password { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/PlexPinRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record PlexPinRequest
+{
+    [Required]
+    public required int PinId { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/RefreshTokenRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record RefreshTokenRequest
+{
+    [Required]
+    public required string RefreshToken { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Regenerate2faRequest.cs

@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Regenerate2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string TotpCode { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/TwoFactorRequest.cs

@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record TwoFactorRequest
+{
+    [Required]
+    public required string LoginToken { get; init; }
+
+    [Required]
+    public required string Code { get; init; }
+
+    public bool IsRecoveryCode { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/VerifyTotpRequest.cs

@@ -0,0 +1,10 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record VerifyTotpRequest
+{
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string Code { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/AccountInfoResponse.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record AccountInfoResponse
+{
+    public required string Username { get; init; }
+    public required bool PlexLinked { get; init; }
+    public string? PlexUsername { get; init; }
+    public required bool TwoFactorEnabled { get; init; }
+    public required string ApiKeyPreview { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/AuthStatusResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record AuthStatusResponse
+{
+    public required bool SetupCompleted { get; init; }
+    public bool PlexLinked { get; init; }
+    public bool AuthBypassActive { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/LoginResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record LoginResponse
+{
+    public required bool RequiresTwoFactor { get; init; }
+    public string? LoginToken { get; init; }
+    public TokenResponse? Tokens { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/PlexPinResponse.cs

@@ -0,0 +1,13 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record PlexPinStatusResponse
+{
+    public required int PinId { get; init; }
+    public required string AuthUrl { get; init; }
+}
+
+public sealed record PlexVerifyResponse
+{
+    public required bool Completed { get; init; }
+    public TokenResponse? Tokens { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/TokenResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record TokenResponse
+{
+    public required string AccessToken { get; init; }
+    public required string RefreshToken { get; init; }
+    public required int ExpiresIn { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/TotpSetupResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record TotpSetupResponse
+{
+    public required string Secret { get; init; }
+    public required string QrCodeUri { get; init; }
+    public required List<string> RecoveryCodes { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Controllers/AccountController.cs

@@ -0,0 +1,404 @@
+using System.Security.Claims;
+using System.Security.Cryptography;
+using Cleanuparr.Api.Features.Auth.Contracts.Requests;
+using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Auth.Controllers;
+
+[ApiController]
+[Route("api/account")]
+[Authorize]
+public sealed class AccountController : ControllerBase
+{
+    private readonly UsersContext _usersContext;
+    private readonly IPasswordService _passwordService;
+    private readonly ITotpService _totpService;
+    private readonly IPlexAuthService _plexAuthService;
+    private readonly ILogger<AccountController> _logger;
+
+    public AccountController(
+        UsersContext usersContext,
+        IPasswordService passwordService,
+        ITotpService totpService,
+        IPlexAuthService plexAuthService,
+        ILogger<AccountController> logger)
+    {
+        _usersContext = usersContext;
+        _passwordService = passwordService;
+        _totpService = totpService;
+        _plexAuthService = plexAuthService;
+        _logger = logger;
+    }
+
+    [HttpGet]
+    public async Task<IActionResult> GetAccountInfo()
+    {
+        var user = await GetCurrentUser();
+        if (user is null) return Unauthorized();
+
+        return Ok(new AccountInfoResponse
+        {
+            Username = user.Username,
+            PlexLinked = user.PlexAccountId is not null,
+            PlexUsername = user.PlexUsername,
+            TwoFactorEnabled = user.TotpEnabled,
+            ApiKeyPreview = user.ApiKey[..8] + "..."
+        });
+    }
+
+    [HttpPut("password")]
+    public async Task<IActionResult> ChangePassword([FromBody] ChangePasswordRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            if (!_passwordService.VerifyPassword(request.CurrentPassword, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Current password is incorrect" });
+            }
+
+            user.PasswordHash = _passwordService.HashPassword(request.NewPassword);
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Password changed for user {Username}", user.Username);
+
+            return Ok(new { message = "Password changed" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/regenerate")]
+    public async Task<IActionResult> Regenerate2fa([FromBody] Regenerate2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            // Verify current credentials
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
+            {
+                return BadRequest(new { error = "Invalid 2FA code" });
+            }
+
+            // Generate new TOTP
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Replace recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA regenerated for user {Username}", user.Username);
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/enable")]
+    public async Task<IActionResult> Enable2fa([FromBody] Enable2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            if (user.TotpEnabled)
+            {
+                return Conflict(new { error = "2FA is already enabled" });
+            }
+
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            // Generate new TOTP
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Replace any existing recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA setup generated for user {Username}", user.Username);
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/enable/verify")]
+    public async Task<IActionResult> VerifyEnable2fa([FromBody] VerifyTotpRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            if (user.TotpEnabled)
+            {
+                return Conflict(new { error = "2FA is already enabled" });
+            }
+
+            if (string.IsNullOrEmpty(user.TotpSecret))
+            {
+                return BadRequest(new { error = "Generate 2FA setup first" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
+            {
+                return BadRequest(new { error = "Invalid verification code" });
+            }
+
+            user.TotpEnabled = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA enabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA enabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/disable")]
+    public async Task<IActionResult> Disable2fa([FromBody] Disable2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            if (!user.TotpEnabled)
+            {
+                return BadRequest(new { error = "2FA is not enabled" });
+            }
+
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
+            {
+                return BadRequest(new { error = "Invalid 2FA code" });
+            }
+
+            user.TotpEnabled = false;
+            user.TotpSecret = string.Empty;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Remove all recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA disabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA disabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpGet("api-key")]
+    public async Task<IActionResult> GetApiKey()
+    {
+        var user = await GetCurrentUser();
+        if (user is null) return Unauthorized();
+
+        return Ok(new { apiKey = user.ApiKey });
+    }
+
+    [HttpPost("api-key/regenerate")]
+    public async Task<IActionResult> RegenerateApiKey()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            var bytes = new byte[32];
+            using var rng = RandomNumberGenerator.Create();
+            rng.GetBytes(bytes);
+
+            user.ApiKey = Convert.ToHexString(bytes).ToLowerInvariant();
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("API key regenerated for user {Username}", user.Username);
+
+            return Ok(new { apiKey = user.ApiKey });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("plex/link")]
+    public async Task<IActionResult> StartPlexLink()
+    {
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new { pinId = pin.PinId, authUrl = pin.AuthUrl });
+    }
+
+    [HttpPost("plex/link/verify")]
+    public async Task<IActionResult> VerifyPlexLink([FromBody] PlexPinRequest request)
+    {
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new { completed = false });
+        }
+
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            user.PlexAccountId = plexAccount.AccountId;
+            user.PlexUsername = plexAccount.Username;
+            user.PlexEmail = plexAccount.Email;
+            user.PlexAuthToken = pinResult.AuthToken;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account linked for user {Username}: {PlexUsername}",
+                user.Username, plexAccount.Username);
+
+            return Ok(new { completed = true, plexUsername = plexAccount.Username });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpDelete("plex/link")]
+    public async Task<IActionResult> UnlinkPlex()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            user.PlexAccountId = null;
+            user.PlexUsername = null;
+            user.PlexEmail = null;
+            user.PlexAuthToken = null;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account unlinked for user {Username}", user.Username);
+
+            return Ok(new { message = "Plex account unlinked" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task<User?> GetCurrentUser(bool includeRecoveryCodes = false)
+    {
+        var userIdClaim = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        if (userIdClaim is null || !Guid.TryParse(userIdClaim, out var userId))
+        {
+            return null;
+        }
+
+        var query = _usersContext.Users.AsQueryable();
+
+        if (includeRecoveryCodes)
+        {
+            query = query.Include(u => u.RecoveryCodes);
+        }
+
+        return await query.FirstOrDefaultAsync(u => u.Id == userId);
+    }
+}

code/backend/Cleanuparr.Api/Features/Auth/Controllers/AuthController.cs

@@ -0,0 +1,611 @@
+using System.Security.Cryptography;
+using Cleanuparr.Api.Auth;
+using Cleanuparr.Api.Features.Auth.Contracts.Requests;
+using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Auth.Controllers;
+
+[ApiController]
+[Route("api/auth")]
+[AllowAnonymous]
+public sealed class AuthController : ControllerBase
+{
+    private readonly UsersContext _usersContext;
+    private readonly IJwtService _jwtService;
+    private readonly IPasswordService _passwordService;
+    private readonly ITotpService _totpService;
+    private readonly IPlexAuthService _plexAuthService;
+    private readonly ILogger<AuthController> _logger;
+
+    public AuthController(
+        UsersContext usersContext,
+        IJwtService jwtService,
+        IPasswordService passwordService,
+        ITotpService totpService,
+        IPlexAuthService plexAuthService,
+        ILogger<AuthController> logger)
+    {
+        _usersContext = usersContext;
+        _jwtService = jwtService;
+        _passwordService = passwordService;
+        _totpService = totpService;
+        _plexAuthService = plexAuthService;
+        _logger = logger;
+    }
+
+    [HttpGet("status")]
+    public async Task<IActionResult> GetStatus()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        var authBypass = false;
+        await using var dataContext = DataContext.CreateStaticInstance();
+        var generalConfig = await dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+        if (generalConfig is { Auth.DisableAuthForLocalAddresses: true })
+        {
+            var clientIp = TrustedNetworkAuthenticationHandler.ResolveClientIp(
+                HttpContext, generalConfig.Auth.TrustForwardedHeaders);
+            if (clientIp is not null)
+            {
+                authBypass = TrustedNetworkAuthenticationHandler.IsTrustedAddress(
+                    clientIp, generalConfig.Auth.TrustedNetworks);
+            }
+        }
+
+        return Ok(new AuthStatusResponse
+        {
+            SetupCompleted = user is { SetupCompleted: true },
+            PlexLinked = user?.PlexAccountId is not null,
+            AuthBypassActive = authBypass
+        });
+    }
+
+    [HttpPost("setup/account")]
+    public async Task<IActionResult> CreateAccount([FromBody] CreateAccountRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var existingUser = await _usersContext.Users.FirstOrDefaultAsync();
+            if (existingUser is not null)
+            {
+                return Conflict(new { error = "Account already exists" });
+            }
+
+            var user = new User
+            {
+                Id = Guid.NewGuid(),
+                Username = request.Username,
+                PasswordHash = _passwordService.HashPassword(request.Password),
+                TotpSecret = string.Empty,
+                TotpEnabled = false,
+                ApiKey = GenerateApiKey(),
+                SetupCompleted = false,
+                CreatedAt = DateTime.UtcNow,
+                UpdatedAt = DateTime.UtcNow
+            };
+
+            _usersContext.Users.Add(user);
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Admin account created for user {Username}", request.Username);
+
+            return Created("", new { userId = user.Id });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/2fa/generate")]
+    public async Task<IActionResult> GenerateTotpSetup()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users
+                .Include(u => u.RecoveryCodes)
+                .FirstOrDefaultAsync();
+
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage 2FA." });
+            }
+
+            // Generate new TOTP secret
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+
+            // Generate recovery codes
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            // Store secret (will be finalized on verify)
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Remove old recovery codes and add new ones
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/2fa/verify")]
+    public async Task<IActionResult> VerifyTotpSetup([FromBody] VerifyTotpRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage 2FA." });
+            }
+
+            if (string.IsNullOrEmpty(user.TotpSecret))
+            {
+                return BadRequest(new { error = "Generate 2FA setup first" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
+            {
+                return Unauthorized(new { error = "Invalid verification code" });
+            }
+
+            user.TotpEnabled = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA enabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA verified and enabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/complete")]
+    public async Task<IActionResult> CompleteSetup()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed" });
+            }
+
+            user.SetupCompleted = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Setup completed for user {Username}", user.Username);
+
+            return Ok(new { message = "Setup complete" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("login")]
+    public async Task<IActionResult> Login([FromBody] LoginRequest request)
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        if (user is null || !user.SetupCompleted)
+        {
+            return Unauthorized(new { error = "Invalid credentials" });
+        }
+
+        // Check lockout
+        if (user.LockoutEnd.HasValue && user.LockoutEnd.Value > DateTime.UtcNow)
+        {
+            var remaining = (int)(user.LockoutEnd.Value - DateTime.UtcNow).TotalSeconds;
+            return StatusCode(429, new { error = "Account is locked", retryAfterSeconds = remaining });
+        }
+
+        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash) ||
+            !string.Equals(user.Username, request.Username, StringComparison.OrdinalIgnoreCase))
+        {
+            var retryAfterSeconds = await IncrementFailedAttempts(user.Id);
+            return Unauthorized(new { error = "Invalid credentials", retryAfterSeconds });
+        }
+
+        // Reset failed attempts on successful password verification
+        await ResetFailedAttempts(user.Id);
+
+        // If 2FA is not enabled, issue tokens directly
+        if (!user.TotpEnabled)
+        {
+            // Re-fetch with tracking since the query above used AsNoTracking
+            var trackedUser = await _usersContext.Users.FirstAsync(u => u.Id == user.Id);
+            var tokenResponse = await GenerateTokenResponse(trackedUser);
+
+            _logger.LogInformation("User {Username} logged in (2FA disabled)", user.Username);
+
+            return Ok(new LoginResponse
+            {
+                RequiresTwoFactor = false,
+                Tokens = tokenResponse
+            });
+        }
+
+        // Password valid - require 2FA
+        var loginToken = _jwtService.GenerateLoginToken(user.Id);
+
+        return Ok(new LoginResponse
+        {
+            RequiresTwoFactor = true,
+            LoginToken = loginToken
+        });
+    }
+
+    [HttpPost("login/2fa")]
+    public async Task<IActionResult> VerifyTwoFactor([FromBody] TwoFactorRequest request)
+    {
+        var userId = _jwtService.ValidateLoginToken(request.LoginToken);
+        if (userId is null)
+        {
+            return Unauthorized(new { error = "Invalid or expired login token" });
+        }
+
+        var user = await _usersContext.Users
+            .Include(u => u.RecoveryCodes)
+            .FirstOrDefaultAsync(u => u.Id == userId.Value);
+
+        if (user is null)
+        {
+            return Unauthorized(new { error = "Invalid login token" });
+        }
+
+        bool codeValid;
+
+        if (request.IsRecoveryCode)
+        {
+            codeValid = await TryUseRecoveryCode(user, request.Code);
+        }
+        else
+        {
+            codeValid = _totpService.ValidateCode(user.TotpSecret, request.Code);
+        }
+
+        if (!codeValid)
+        {
+            return Unauthorized(new { error = "Invalid verification code" });
+        }
+
+        return Ok(await GenerateTokenResponse(user));
+    }
+
+    [HttpPost("refresh")]
+    public async Task<IActionResult> RefreshToken([FromBody] RefreshTokenRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var tokenHash = HashRefreshToken(request.RefreshToken);
+
+            var storedToken = await _usersContext.RefreshTokens
+                .Include(r => r.User)
+                .FirstOrDefaultAsync(r => r.TokenHash == tokenHash && r.RevokedAt == null);
+
+            if (storedToken is null || storedToken.ExpiresAt < DateTime.UtcNow)
+            {
+                return Unauthorized(new { error = "Invalid or expired refresh token" });
+            }
+
+            // Revoke the old token (rotation)
+            storedToken.RevokedAt = DateTime.UtcNow;
+
+            // Generate new tokens
+            var response = await GenerateTokenResponse(storedToken.User);
+            await _usersContext.SaveChangesAsync();
+
+            return Ok(response);
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("logout")]
+    public async Task<IActionResult> Logout([FromBody] RefreshTokenRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var tokenHash = HashRefreshToken(request.RefreshToken);
+
+            var storedToken = await _usersContext.RefreshTokens
+                .FirstOrDefaultAsync(r => r.TokenHash == tokenHash && r.RevokedAt == null);
+
+            if (storedToken is not null)
+            {
+                storedToken.RevokedAt = DateTime.UtcNow;
+                await _usersContext.SaveChangesAsync();
+            }
+
+            return Ok(new { message = "Logged out" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/plex/pin")]
+    public async Task<IActionResult> RequestSetupPlexPin()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        if (user is null)
+        {
+            return BadRequest(new { error = "Create an account first" });
+        }
+
+        if (user.SetupCompleted)
+        {
+            return Conflict(new { error = "Setup already completed. Use account settings to manage Plex." });
+        }
+
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new PlexPinStatusResponse
+        {
+            PinId = pin.PinId,
+            AuthUrl = pin.AuthUrl
+        });
+    }
+
+    [HttpPost("setup/plex/verify")]
+    public async Task<IActionResult> VerifySetupPlexLink([FromBody] PlexPinRequest request)
+    {
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new PlexVerifyResponse { Completed = false });
+        }
+
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage Plex." });
+            }
+
+            user.PlexAccountId = plexAccount.AccountId;
+            user.PlexUsername = plexAccount.Username;
+            user.PlexEmail = plexAccount.Email;
+            user.PlexAuthToken = pinResult.AuthToken;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account linked during setup for user {Username}: {PlexUsername}",
+                user.Username, plexAccount.Username);
+
+            return Ok(new PlexVerifyResponse { Completed = true });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("login/plex/pin")]
+    public async Task<IActionResult> RequestPlexPin()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        if (user is null || !user.SetupCompleted || user.PlexAccountId is null)
+        {
+            return BadRequest(new { error = "Plex login is not available" });
+        }
+
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new PlexPinStatusResponse
+        {
+            PinId = pin.PinId,
+            AuthUrl = pin.AuthUrl
+        });
+    }
+
+    [HttpPost("login/plex/verify")]
+    public async Task<IActionResult> VerifyPlexLogin([FromBody] PlexPinRequest request)
+    {
+        var user = await _usersContext.Users.FirstOrDefaultAsync();
+        if (user is null || !user.SetupCompleted || user.PlexAccountId is null)
+        {
+            return BadRequest(new { error = "Plex login is not available" });
+        }
+
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new PlexVerifyResponse { Completed = false });
+        }
+
+        // Verify the Plex account matches the linked one
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        if (plexAccount.AccountId != user.PlexAccountId)
+        {
+            return Unauthorized(new { error = "Plex account does not match the linked account" });
+        }
+
+        // Plex OAuth acts as a trusted identity provider — the user explicitly linked their
+        // Plex account during setup or via account settings (both require authentication).
+        // Since Plex login verifies the exact same Plex account ID that was linked,
+        // 2FA is not required for Plex login.
+        _logger.LogInformation("User {Username} logged in via Plex", user.Username);
+
+        var tokenResponse = await GenerateTokenResponse(user);
+
+        return Ok(new PlexVerifyResponse
+        {
+            Completed = true,
+            Tokens = tokenResponse
+        });
+    }
+
+    private async Task<TokenResponse> GenerateTokenResponse(User user)
+    {
+        var accessToken = _jwtService.GenerateAccessToken(user);
+        var refreshToken = _jwtService.GenerateRefreshToken();
+
+        _usersContext.RefreshTokens.Add(new RefreshToken
+        {
+            Id = Guid.NewGuid(),
+            UserId = user.Id,
+            TokenHash = HashRefreshToken(refreshToken),
+            ExpiresAt = DateTime.UtcNow.AddDays(7),
+            CreatedAt = DateTime.UtcNow
+        });
+
+        await _usersContext.SaveChangesAsync();
+
+        return new TokenResponse
+        {
+            AccessToken = accessToken,
+            RefreshToken = refreshToken,
+            ExpiresIn = 3600 // seconds
+        };
+    }
+
+    private async Task<bool> TryUseRecoveryCode(User user, string code)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            foreach (var recoveryCode in user.RecoveryCodes.Where(r => !r.IsUsed))
+            {
+                if (_totpService.VerifyRecoveryCode(code, recoveryCode.CodeHash))
+                {
+                    recoveryCode.IsUsed = true;
+                    recoveryCode.UsedAt = DateTime.UtcNow;
+                    await _usersContext.SaveChangesAsync();
+
+                    _logger.LogWarning("Recovery code used for user {Username}", user.Username);
+                    return true;
+                }
+            }
+
+            return false;
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task<int> IncrementFailedAttempts(Guid userId)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstAsync(u => u.Id == userId);
+            user.FailedLoginAttempts++;
+            user.LockoutEnd = DateTime.UtcNow.AddSeconds(user.FailedLoginAttempts * 2);
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogWarning("Failed login attempt {Attempts} for user {Username}, locked for {Seconds}s",
+                user.FailedLoginAttempts, user.Username, user.FailedLoginAttempts * 2);
+
+            return user.FailedLoginAttempts * 2;
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task ResetFailedAttempts(Guid userId)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstAsync(u => u.Id == userId);
+            user.FailedLoginAttempts = 0;
+            user.LockoutEnd = null;
+            await _usersContext.SaveChangesAsync();
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private static string GenerateApiKey()
+    {
+        var bytes = new byte[32];
+        using var rng = RandomNumberGenerator.Create();
+        rng.GetBytes(bytes);
+        return Convert.ToHexString(bytes).ToLowerInvariant();
+    }
+
+    private static string HashRefreshToken(string token)
+    {
+        var bytes = System.Text.Encoding.UTF8.GetBytes(token);
+        var hash = SHA256.HashData(bytes);
+        return Convert.ToBase64String(hash);
+    }
+}

code/backend/Cleanuparr.Api/Features/BlacklistSync/Controllers/BlacklistSyncConfigController.cs

@@ -2,7 +2,7 @@ using System;
 using System.Threading.Tasks;
 
 using Cleanuparr.Api.Features.BlacklistSync.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.BlacklistSync;

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Contracts/Requests/SeedingRuleRequest.cs

@@ -1,4 +1,5 @@
 using System.ComponentModel.DataAnnotations;
+using Cleanuparr.Domain.Enums;
 
 namespace Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
 
@@ -6,7 +7,12 @@ public record SeedingRuleRequest
 {
     [Required]
     public string Name { get; init; } = string.Empty;
-    
+
+    /// <summary>
+    /// Which torrent privacy types this rule applies to.
+    /// </summary>
+    public TorrentPrivacyType PrivacyType { get; init; } = TorrentPrivacyType.Public;
+
     /// <summary>
     /// Max ratio before removing a download.
     /// </summary>

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Contracts/Requests/UpdateDownloadCleanerConfigRequest.cs

@@ -13,8 +13,6 @@ public sealed record UpdateDownloadCleanerConfigRequest
 
     public List<SeedingRuleRequest> Categories { get; init; } = [];
 
-    public bool DeletePrivate { get; init; }
-    
     /// <summary>
     /// Indicates whether unlinked download handling is enabled.
     /// </summary>

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Controllers/DownloadCleanerConfigController.cs

@@ -3,7 +3,7 @@ using System.IO;
 using System.Linq;
 
 using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
@@ -76,7 +76,6 @@ public sealed class DownloadCleanerConfigController : ControllerBase
             oldConfig.Enabled = newConfigDto.Enabled;
             oldConfig.CronExpression = newConfigDto.CronExpression;
             oldConfig.UseAdvancedScheduling = newConfigDto.UseAdvancedScheduling;
-            oldConfig.DeletePrivate = newConfigDto.DeletePrivate;
             oldConfig.UnlinkedEnabled = newConfigDto.UnlinkedEnabled;
             oldConfig.UnlinkedTargetCategory = newConfigDto.UnlinkedTargetCategory;
             oldConfig.UnlinkedUseTag = newConfigDto.UnlinkedUseTag;
@@ -93,6 +92,7 @@ public sealed class DownloadCleanerConfigController : ControllerBase
                 _dataContext.SeedingRules.Add(new SeedingRule
                 {
                     Name = categoryDto.Name,
+                    PrivacyType = categoryDto.PrivacyType,
                     MaxRatio = categoryDto.MaxRatio,
                     MinSeedTime = categoryDto.MinSeedTime,
                     MaxSeedTime = categoryDto.MaxSeedTime,

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/CreateDownloadClientRequest.cs

@@ -16,7 +16,7 @@ public sealed record CreateDownloadClientRequest
 
     public DownloadClientType Type { get; init; }
 
-    public Uri? Host { get; init; }
+    public string? Host { get; init; }
 
     public string? Username { get; init; }
 
@@ -24,7 +24,7 @@ public sealed record CreateDownloadClientRequest
 
     public string? UrlBase { get; init; }
 
-    public Uri? ExternalUrl { get; init; }
+    public string? ExternalUrl { get; init; }
 
     public void Validate()
     {
@@ -33,10 +33,20 @@ public sealed record CreateDownloadClientRequest
             throw new ValidationException("Client name cannot be empty");
         }
 
-        if (Host is null)
+        if (string.IsNullOrWhiteSpace(Host))
         {
             throw new ValidationException("Host cannot be empty");
         }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
+
+        if (!string.IsNullOrWhiteSpace(ExternalUrl) && !Uri.TryCreate(ExternalUrl, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("External URL is not a valid URL");
+        }
     }
 
     public DownloadClientConfig ToEntity() => new()
@@ -45,10 +55,10 @@ public sealed record CreateDownloadClientRequest
         Name = Name,
         TypeName = TypeName,
         Type = Type,
-        Host = Host,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
         Username = Username,
         Password = Password,
         UrlBase = UrlBase,
-        ExternalUrl = ExternalUrl,
+        ExternalUrl = !string.IsNullOrWhiteSpace(ExternalUrl) ? new Uri(ExternalUrl, UriKind.RelativeOrAbsolute) : null,
     };
 }

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/TestDownloadClientRequest.cs

@@ -12,7 +12,7 @@ public sealed record TestDownloadClientRequest
 
     public DownloadClientType Type { get; init; }
 
-    public Uri? Host { get; init; }
+    public string? Host { get; init; }
 
     public string? Username { get; init; }
 
@@ -22,10 +22,15 @@ public sealed record TestDownloadClientRequest
 
     public void Validate()
     {
-        if (Host is null)
+        if (string.IsNullOrWhiteSpace(Host))
         {
             throw new ValidationException("Host cannot be empty");
         }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
     }
 
     public DownloadClientConfig ToTestConfig() => new()
@@ -35,7 +40,7 @@ public sealed record TestDownloadClientRequest
         Name = "Test Client",
         TypeName = TypeName,
         Type = Type,
-        Host = Host,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
         Username = Username,
         Password = Password,
         UrlBase = UrlBase,

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/UpdateDownloadClientRequest.cs

@@ -16,7 +16,7 @@ public sealed record UpdateDownloadClientRequest
 
     public DownloadClientType Type { get; init; }
 
-    public Uri? Host { get; init; }
+    public string? Host { get; init; }
 
     public string? Username { get; init; }
 
@@ -24,7 +24,7 @@ public sealed record UpdateDownloadClientRequest
 
     public string? UrlBase { get; init; }
 
-    public Uri? ExternalUrl { get; init; }
+    public string? ExternalUrl { get; init; }
 
     public void Validate()
     {
@@ -33,10 +33,20 @@ public sealed record UpdateDownloadClientRequest
             throw new ValidationException("Client name cannot be empty");
         }
 
-        if (Host is null)
+        if (string.IsNullOrWhiteSpace(Host))
         {
             throw new ValidationException("Host cannot be empty");
         }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
+
+        if (!string.IsNullOrWhiteSpace(ExternalUrl) && !Uri.TryCreate(ExternalUrl, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("External URL is not a valid URL");
+        }
     }
 
     public DownloadClientConfig ApplyTo(DownloadClientConfig existing) => existing with
@@ -45,10 +55,10 @@ public sealed record UpdateDownloadClientRequest
         Name = Name,
         TypeName = TypeName,
         Type = Type,
-        Host = Host,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
         Username = Username,
         Password = Password,
         UrlBase = UrlBase,
-        ExternalUrl = ExternalUrl,
+        ExternalUrl = !string.IsNullOrWhiteSpace(ExternalUrl) ? new Uri(ExternalUrl, UriKind.RelativeOrAbsolute) : null,
     };
 }

code/backend/Cleanuparr.Api/Features/DownloadClient/Controllers/DownloadClientController.cs

@@ -5,10 +5,8 @@ using Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
 using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Http.DynamicHttpClientSystem;
 using Cleanuparr.Persistence;
-using Cleanuparr.Persistence.Models.Configuration;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Logging;
 
 namespace Cleanuparr.Api.Features.DownloadClient.Controllers;
 

code/backend/Cleanuparr.Api/Features/General/Contracts/Requests/UpdateGeneralConfigRequest.cs

@@ -30,8 +30,12 @@ public sealed record UpdateGeneralConfigRequest
 
     public List<string> IgnoredDownloads { get; init; } = [];
 
+    public ushort StrikeInactivityWindowHours { get; init; } = 24;
+
     public UpdateLoggingConfigRequest Log { get; init; } = new();
 
+    public UpdateAuthConfigRequest Auth { get; init; } = new();
+
     public GeneralConfig ApplyTo(GeneralConfig existingConfig, IServiceProvider services, ILogger logger)
     {
         existingConfig.DisplaySupportBanner = DisplaySupportBanner;
@@ -44,8 +48,10 @@ public sealed record UpdateGeneralConfigRequest
         existingConfig.StatusCheckEnabled = StatusCheckEnabled;
         existingConfig.EncryptionKey = EncryptionKey;
         existingConfig.IgnoredDownloads = IgnoredDownloads;
+        existingConfig.StrikeInactivityWindowHours = StrikeInactivityWindowHours;
 
         bool loggingChanged = Log.ApplyTo(existingConfig.Log);
+        Auth.ApplyTo(existingConfig.Auth);
 
         Validate(existingConfig);
 
@@ -61,7 +67,18 @@ public sealed record UpdateGeneralConfigRequest
             throw new ValidationException("HTTP_TIMEOUT must be greater than 0");
         }
 
+        if (config.StrikeInactivityWindowHours is 0)
+        {
+            throw new ValidationException("STRIKE_INACTIVITY_WINDOW_HOURS must be greater than 0");
+        }
+
+        if (config.StrikeInactivityWindowHours > 168)
+        {
+            throw new ValidationException("STRIKE_INACTIVITY_WINDOW_HOURS must be less than or equal to 168");
+        }
+
         config.Log.Validate();
+        config.Auth.Validate();
     }
 
     private void ApplySideEffects(GeneralConfig config, IServiceProvider services, ILogger logger, bool loggingChanged)
@@ -132,3 +149,19 @@ public sealed record UpdateLoggingConfigRequest
 
     public bool LevelOnlyChange { get; private set; }
 }
+
+public sealed record UpdateAuthConfigRequest
+{
+    public bool DisableAuthForLocalAddresses { get; init; }
+
+    public bool TrustForwardedHeaders { get; init; }
+
+    public List<string> TrustedNetworks { get; init; } = [];
+
+    public void ApplyTo(AuthConfig existingConfig)
+    {
+        existingConfig.DisableAuthForLocalAddresses = DisableAuthForLocalAddresses;
+        existingConfig.TrustForwardedHeaders = TrustForwardedHeaders;
+        existingConfig.TrustedNetworks = TrustedNetworks;
+    }
+}

code/backend/Cleanuparr.Api/Features/General/Controllers/GeneralConfigController.cs

@@ -3,12 +3,9 @@ using System.Linq;
 using System.Threading.Tasks;
 
 using Cleanuparr.Api.Features.General.Contracts.Requests;
-using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
-using Cleanuparr.Persistence.Models.Configuration.General;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 
 namespace Cleanuparr.Api.Features.General.Controllers;
@@ -19,16 +16,13 @@ public sealed class GeneralConfigController : ControllerBase
 {
     private readonly ILogger<GeneralConfigController> _logger;
     private readonly DataContext _dataContext;
-    private readonly MemoryCache _cache;
 
     public GeneralConfigController(
         ILogger<GeneralConfigController> logger,
-        DataContext dataContext,
-        MemoryCache cache)
+        DataContext dataContext)
     {
         _logger = logger;
         _dataContext = dataContext;
-        _cache = cache;
     }
 
     [HttpGet("general")]
@@ -49,7 +43,9 @@ public sealed class GeneralConfigController : ControllerBase
     }
 
     [HttpPut("general")]
-    public async Task<IActionResult> UpdateGeneralConfig([FromBody] UpdateGeneralConfigRequest request)
+    public async Task<IActionResult> UpdateGeneralConfig(
+        [FromBody] UpdateGeneralConfigRequest request,
+        [FromServices] EventsContext eventsContext)
     {
         await DataContext.Lock.WaitAsync();
         try
@@ -63,7 +59,17 @@ public sealed class GeneralConfigController : ControllerBase
 
             await _dataContext.SaveChangesAsync();
 
-            ClearStrikesCacheIfNeeded(wasDryRun, config.DryRun);
+            if (wasDryRun && !config.DryRun)
+            {
+                var deletedStrikes = await eventsContext.Strikes.ExecuteDeleteAsync();
+                var deletedItems = await eventsContext.DownloadItems
+                    .Where(d => !d.Strikes.Any())
+                    .ExecuteDeleteAsync();
+
+                _logger.LogWarning(
+                    "Dry run disabled — purged all strikes: {Strikes} strikes, {Items} download items removed",
+                    deletedStrikes, deletedItems);
+            }
 
             return Ok(new { Message = "General configuration updated successfully" });
         }
@@ -78,38 +84,18 @@ public sealed class GeneralConfigController : ControllerBase
         }
     }
 
-    private void ClearStrikesCacheIfNeeded(bool wasDryRun, bool isDryRun)
+    [HttpPost("strikes/purge")]
+    public async Task<IActionResult> PurgeAllStrikes(
+        [FromServices] EventsContext eventsContext)
     {
-        if (!wasDryRun || isDryRun)
-        {
-            return;
-        }
+        var deletedStrikes = await eventsContext.Strikes.ExecuteDeleteAsync();
+        var deletedItems = await eventsContext.DownloadItems
+            .Where(d => !d.Strikes.Any())
+            .ExecuteDeleteAsync();
 
-        List<object> keys;
+        _logger.LogWarning("Purged all strikes: {strikes} strikes, {items} download items removed",
+            deletedStrikes, deletedItems);
 
-        // Remove strikes
-        foreach (string strikeType in Enum.GetNames(typeof(StrikeType)))
-        {
-            keys = _cache.Keys
-                .Where(key => key.ToString()?.StartsWith(strikeType, StringComparison.InvariantCultureIgnoreCase) is true)
-                .ToList();
-
-            foreach (object key in keys)
-            {
-                _cache.Remove(key);
-            }
-
-            _logger.LogTrace("Removed all cache entries for strike type: {StrikeType}", strikeType);
-        }
-
-        // Remove strike cache items
-        keys = _cache.Keys
-            .Where(key => key.ToString()?.StartsWith("item_", StringComparison.InvariantCultureIgnoreCase) is true)
-            .ToList();
-        
-        foreach (object key in keys)
-        {
-            _cache.Remove(key);
-        }
+        return Ok(new { DeletedStrikes = deletedStrikes, DeletedItems = deletedItems });
     }
 }

code/backend/Cleanuparr.Api/Features/MalwareBlocker/Controllers/MalwareBlockerConfigController.cs

@@ -2,7 +2,7 @@ using System.ComponentModel.DataAnnotations;
 using System.Threading.Tasks;
 
 using Cleanuparr.Api.Features.MalwareBlocker.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;

code/backend/Cleanuparr.Api/Features/QueueCleaner/Controllers/QueueCleanerConfigController.cs

@@ -1,7 +1,7 @@
 using System.ComponentModel.DataAnnotations;
 
 using Cleanuparr.Api.Features.QueueCleaner.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;

code/backend/Cleanuparr.Api/HostExtensions.cs

@@ -63,7 +63,14 @@ public static class HostExtensions
         {
             await configContext.Database.MigrateAsync();
         }
-        
+
+        // Apply users db migrations
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        if ((await usersContext.Database.GetPendingMigrationsAsync()).Any())
+        {
+            await usersContext.Database.MigrateAsync();
+        }
+
         return builder;
     }
 }

code/backend/Cleanuparr.Api/Jobs/GenericJob.cs

@@ -1,7 +1,12 @@
-using Cleanuparr.Infrastructure.Features.Jobs;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Context;
+using Cleanuparr.Infrastructure.Features.Jobs;
+using Cleanuparr.Infrastructure.Helpers;
 using Cleanuparr.Infrastructure.Hubs;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.State;
 using Microsoft.AspNetCore.SignalR;
 using Quartz;
 using Serilog.Context;
@@ -14,48 +19,73 @@ public sealed class GenericJob<T> : IJob
 {
     private readonly ILogger<GenericJob<T>> _logger;
     private readonly IServiceScopeFactory _scopeFactory;
-    
+
     public GenericJob(ILogger<GenericJob<T>> logger, IServiceScopeFactory scopeFactory)
     {
         _logger = logger;
         _scopeFactory = scopeFactory;
     }
-    
+
     public async Task Execute(IJobExecutionContext context)
     {
         using var _ = LogContext.PushProperty("JobName", typeof(T).Name);
-        
+
+        Guid jobRunId = Guid.CreateVersion7();
+        JobType jobType = Enum.Parse<JobType>(typeof(T).Name);
+        JobRunStatus? status = null;
+
         try
         {
             await using var scope = _scopeFactory.CreateAsyncScope();
+            var eventsContext = scope.ServiceProvider.GetRequiredService<EventsContext>();
             var hubContext = scope.ServiceProvider.GetRequiredService<IHubContext<AppHub>>();
             var jobManagementService = scope.ServiceProvider.GetRequiredService<IJobManagementService>();
-            
-            await BroadcastJobStatus(hubContext, jobManagementService, false);
-            
+
+            var jobRun = new JobRun { Id = jobRunId, Type = jobType };
+            eventsContext.JobRuns.Add(jobRun);
+            await eventsContext.SaveChangesAsync();
+
+            ContextProvider.SetJobRunId(jobRunId);
+            using var __ = LogContext.PushProperty(LogProperties.JobRunId, jobRunId.ToString());
+
+            await BroadcastJobStatus(hubContext, jobManagementService, jobType, false);
+
             var handler = scope.ServiceProvider.GetRequiredService<T>();
             await handler.ExecuteAsync();
-            
-            await BroadcastJobStatus(hubContext, jobManagementService, true);
+
+            status = JobRunStatus.Completed;
+            await BroadcastJobStatus(hubContext, jobManagementService, jobType, true);
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "{name} failed", typeof(T).Name);
+            status = JobRunStatus.Failed;
+        }
+        finally
+        {
+            await using var finalScope = _scopeFactory.CreateAsyncScope();
+            var eventsContext = finalScope.ServiceProvider.GetRequiredService<EventsContext>();
+            var jobRun = await eventsContext.JobRuns.FindAsync(jobRunId);
+            if (jobRun is not null)
+            {
+                jobRun.CompletedAt = DateTime.UtcNow;
+                jobRun.Status = status;
+                await eventsContext.SaveChangesAsync();
+            }
         }
     }
-    
-    private async Task BroadcastJobStatus(IHubContext<AppHub> hubContext, IJobManagementService jobManagementService, bool isFinished)
+
+    private async Task BroadcastJobStatus(IHubContext<AppHub> hubContext, IJobManagementService jobManagementService, JobType jobType, bool isFinished)
     {
         try
         {
-            JobType jobType = Enum.Parse<JobType>(typeof(T).Name);
             JobInfo jobInfo = await jobManagementService.GetJob(jobType);
 
             if (isFinished)
             {
                 jobInfo.Status = "Scheduled";
             }
-            
+
             await hubContext.Clients.All.SendAsync("JobStatusUpdate", jobInfo);
         }
         catch (Exception ex)

code/backend/Cleanuparr.Api/Middleware/SetupGuardMiddleware.cs

@@ -0,0 +1,89 @@
+using Cleanuparr.Persistence;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Middleware;
+
+public class SetupGuardMiddleware
+{
+    private readonly RequestDelegate _next;
+    private volatile bool _setupCompleted;
+
+    public SetupGuardMiddleware(RequestDelegate next)
+    {
+        _next = next;
+    }
+
+    public async Task InvokeAsync(HttpContext context)
+    {
+        string path = context.Request.Path.Value?.ToLowerInvariant() ?? "";
+
+        // Always allow health checks and non-API paths (static files, SPA, etc.)
+        if (path.StartsWith("/health") || !path.StartsWith("/api/"))
+        {
+            await _next(context);
+            return;
+        }
+
+        // Setup-only paths (/api/auth/setup/*) require setup to NOT be complete
+        if (IsSetupOnlyPath(path))
+        {
+            if (await IsSetupCompleted())
+            {
+                context.Response.StatusCode = StatusCodes.Status403Forbidden;
+                context.Response.ContentType = "application/json";
+                await context.Response.WriteAsJsonAsync(new { error = "Setup already completed" });
+                return;
+            }
+
+            await _next(context);
+            return;
+        }
+
+        // Non-setup auth paths (login, refresh, logout, status) are always allowed
+        if (path.StartsWith("/api/auth/") || path == "/api/auth")
+        {
+            await _next(context);
+            return;
+        }
+
+        // All other API paths require setup to be complete
+        if (!await IsSetupCompleted())
+        {
+            context.Response.StatusCode = StatusCodes.Status403Forbidden;
+            context.Response.ContentType = "application/json";
+            await context.Response.WriteAsJsonAsync(new { error = "Setup required" });
+            return;
+        }
+
+        await _next(context);
+    }
+
+    public void ResetSetupState()
+    {
+        _setupCompleted = false;
+    }
+
+    private async Task<bool> IsSetupCompleted()
+    {
+        if (_setupCompleted)
+        {
+            return true;
+        }
+
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        if (user is { SetupCompleted: true })
+        {
+            _setupCompleted = true;
+            return true;
+        }
+
+        return false;
+    }
+
+    private static bool IsSetupOnlyPath(string path)
+    {
+        return path.StartsWith("/api/auth/setup/") || path == "/api/auth/setup";
+    }
+}

code/backend/Cleanuparr.Api/Program.cs

@@ -3,6 +3,7 @@ using System.Runtime.InteropServices;
 using System.Text.Json.Serialization;
 using Cleanuparr.Api;
 using Cleanuparr.Api.DependencyInjection;
+using Microsoft.AspNetCore.DataProtection;
 using Cleanuparr.Infrastructure.Hubs;
 using Cleanuparr.Infrastructure.Logging;
 using Cleanuparr.Shared.Helpers;
@@ -70,12 +71,19 @@ builder.Services.ConfigureHttpJsonOptions(options =>
 // Add services to the container
 builder.Services
     .AddInfrastructure(builder.Configuration)
-    .AddApiServices();
+    .AddApiServices()
+    .AddAuthServices();
+
+// Persist Data Protection keys to the config directory
+builder.Services
+    .AddDataProtection()
+    .PersistKeysToFileSystem(new DirectoryInfo(Path.Combine(ConfigurationPathProvider.GetConfigPath(), "DataProtection-Keys")))
+    .SetApplicationName("Cleanuparr");
 
 // Add CORS before SignalR
-builder.Services.AddCors(options => 
+builder.Services.AddCors(options =>
 {
-    options.AddPolicy("Any", policy => 
+    options.AddPolicy("Any", policy =>
     {
         policy
             // https://github.com/dotnet/aspnetcore/issues/4457#issuecomment-465669576
@@ -123,6 +131,13 @@ if (basePath is not null)
         {
             if (!string.IsNullOrEmpty(basePath) && !context.Request.Path.StartsWithSegments(basePath, StringComparison.OrdinalIgnoreCase))
             {
+                // Redirect root to the base path for convenience
+                if (!context.Request.Path.HasValue || context.Request.Path.Value == "/")
+                {
+                    context.Response.Redirect(basePath + "/");
+                    return;
+                }
+
                 context.Response.StatusCode = StatusCodes.Status404NotFound;
                 return;
             }
@@ -146,14 +161,14 @@ app.Init();
 var appHub = app.Services.GetRequiredService<IHubContext<AppHub>>();
 SignalRLogSink.Instance.SetAppHubContext(appHub);
 
-// Configure health check endpoints before the API configuration
-app.MapHealthChecks("/health", new HealthCheckOptions
+// Configure health check endpoints as middleware (before auth pipeline) so they don't require authentication
+app.UseHealthChecks("/health", new HealthCheckOptions
 {
     Predicate = registration => registration.Tags.Contains("liveness"),
     ResponseWriter = HealthCheckResponseWriter.WriteMinimalPlaintext
 });
 
-app.MapHealthChecks("/health/ready", new HealthCheckOptions
+app.UseHealthChecks("/health/ready", new HealthCheckOptions
 {
     Predicate = registration => registration.Tags.Contains("readiness"),
     ResponseWriter = HealthCheckResponseWriter.WriteMinimalPlaintext
@@ -166,4 +181,4 @@ await app.RunAsync();
 await Log.CloseAndFlushAsync();
 
 // Make Program class accessible for testing
-public partial class Program { }
+public partial class Program { }

code/backend/Cleanuparr.Domain/Entities/HealthCheck/HealthCheckResult.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Domain.Entities.HealthCheck;
+
+public sealed record HealthCheckResult
+{
+    public bool IsHealthy { get; set; }
+    
+    public string? ErrorMessage { get; set; }
+    
+    public TimeSpan ResponseTime { get; set; }
+}

code/backend/Cleanuparr.Domain/Entities/ITorrentItemWrapper.cs

@@ -27,6 +27,8 @@ public interface ITorrentItemWrapper
     long SeedingTimeSeconds { get; }
 
     string? Category { get; set; }
+    
+    string SavePath { get; }
 
     bool IsDownloading();
     

code/backend/Cleanuparr.Domain/Entities/RTorrent/Response/RTorrentFile.cs

@@ -0,0 +1,37 @@
+namespace Cleanuparr.Domain.Entities.RTorrent.Response;
+
+/// <summary>
+/// Represents a file within a torrent from rTorrent's XML-RPC f.multicall response
+/// </summary>
+public sealed record RTorrentFile
+{
+    /// <summary>
+    /// File index within the torrent (0-based)
+    /// </summary>
+    public int Index { get; init; }
+
+    /// <summary>
+    /// File path relative to the torrent base directory
+    /// </summary>
+    public required string Path { get; init; }
+
+    /// <summary>
+    /// File size in bytes
+    /// </summary>
+    public long SizeBytes { get; init; }
+
+    /// <summary>
+    /// Download priority: 0 = skip/don't download, 1 = normal, 2 = high
+    /// </summary>
+    public int Priority { get; init; }
+
+    /// <summary>
+    /// Number of completed chunks for this file
+    /// </summary>
+    public long CompletedChunks { get; init; }
+
+    /// <summary>
+    /// Total number of chunks for this file
+    /// </summary>
+    public long SizeChunks { get; init; }
+}

code/backend/Cleanuparr.Domain/Entities/RTorrent/Response/RTorrentTorrent.cs

@@ -0,0 +1,72 @@
+namespace Cleanuparr.Domain.Entities.RTorrent.Response;
+
+/// <summary>
+/// Represents a torrent from rTorrent's XML-RPC multicall response
+/// </summary>
+public sealed record RTorrentTorrent
+{
+    /// <summary>
+    /// Torrent info hash (40-character hex string, uppercase)
+    /// </summary>
+    public required string Hash { get; init; }
+
+    /// <summary>
+    /// Torrent name
+    /// </summary>
+    public required string Name { get; init; }
+
+    /// <summary>
+    /// Whether the torrent is from a private tracker (0 or 1)
+    /// </summary>
+    public int IsPrivate { get; init; }
+
+    /// <summary>
+    /// Total size of the torrent in bytes
+    /// </summary>
+    public long SizeBytes { get; init; }
+
+    /// <summary>
+    /// Number of bytes completed/downloaded
+    /// </summary>
+    public long CompletedBytes { get; init; }
+
+    /// <summary>
+    /// Current download rate in bytes per second
+    /// </summary>
+    public long DownRate { get; init; }
+
+    /// <summary>
+    /// Upload/download ratio multiplied by 1000 (e.g., 1500 = 1.5 ratio)
+    /// </summary>
+    public long Ratio { get; init; }
+
+    /// <summary>
+    /// Torrent state: 0 = stopped, 1 = started
+    /// </summary>
+    public int State { get; init; }
+
+    /// <summary>
+    /// Completion status: 0 = incomplete, 1 = complete
+    /// </summary>
+    public int Complete { get; init; }
+
+    /// <summary>
+    /// Unix timestamp when the torrent finished downloading (0 if not finished)
+    /// </summary>
+    public long TimestampFinished { get; init; }
+
+    /// <summary>
+    /// Label/category from d.custom1 (commonly used by ruTorrent for labels)
+    /// </summary>
+    public string? Label { get; init; }
+
+    /// <summary>
+    /// Base path where the torrent data is stored
+    /// </summary>
+    public string? BasePath { get; init; }
+
+    /// <summary>
+    /// List of tracker URLs for this torrent
+    /// </summary>
+    public IReadOnlyList<string>? Trackers { get; init; }
+}

code/backend/Cleanuparr.Domain/Enums/DownloadClientTypeName.cs

@@ -6,4 +6,5 @@ public enum DownloadClientTypeName
     Deluge,
     Transmission,
     uTorrent,
+    rTorrent,
 }

code/backend/Cleanuparr.Domain/Enums/JobRunStatus.cs

@@ -0,0 +1,7 @@
+namespace Cleanuparr.Domain.Enums;
+
+public enum JobRunStatus
+{
+    Completed,
+    Failed
+}

code/backend/Cleanuparr.Domain/Enums/JobType.cs

@@ -0,0 +1,9 @@
+namespace Cleanuparr.Domain.Enums;
+
+public enum JobType
+{
+    QueueCleaner,
+    MalwareBlocker,
+    DownloadCleaner,
+    BlacklistSynchronizer,
+}

code/backend/Cleanuparr.Domain/Exceptions/RTorrentClientException.cs

@@ -0,0 +1,12 @@
+namespace Cleanuparr.Domain.Exceptions;
+
+public class RTorrentClientException : Exception
+{
+    public RTorrentClientException(string message) : base(message)
+    {
+    }
+
+    public RTorrentClientException(string message, Exception innerException) : base(message, innerException)
+    {
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Events/EventPublisherTests.cs

@@ -65,6 +65,9 @@ public class EventPublisherTests : IDisposable
             _loggerMock.Object,
             _notificationPublisherMock.Object,
             _dryRunInterceptorMock.Object);
+
+        // Setup JobRunId in context for tests
+        ContextProvider.SetJobRunId(Guid.NewGuid());
     }
 
     public void Dispose()
@@ -339,7 +342,7 @@ public class EventPublisherTests : IDisposable
     public async Task PublishQueueItemDeleted_SavesEventWithContextData()
     {
         // Arrange
-        ContextProvider.Set(ContextProvider.Keys.DownloadName, "Test Download");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test Download");
         ContextProvider.Set(ContextProvider.Keys.Hash, "abc123");
 
         // Act
@@ -360,7 +363,7 @@ public class EventPublisherTests : IDisposable
     public async Task PublishQueueItemDeleted_SendsNotification()
     {
         // Arrange
-        ContextProvider.Set(ContextProvider.Keys.DownloadName, "Test Download");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test Download");
         ContextProvider.Set(ContextProvider.Keys.Hash, "abc123");
 
         // Act
@@ -378,7 +381,7 @@ public class EventPublisherTests : IDisposable
     public async Task PublishDownloadCleaned_SavesEventWithContextData()
     {
         // Arrange
-        ContextProvider.Set(ContextProvider.Keys.DownloadName, "Cleaned Download");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Cleaned Download");
         ContextProvider.Set(ContextProvider.Keys.Hash, "def456");
 
         // Act
@@ -404,7 +407,7 @@ public class EventPublisherTests : IDisposable
     public async Task PublishDownloadCleaned_SendsNotification()
     {
         // Arrange
-        ContextProvider.Set(ContextProvider.Keys.DownloadName, "Test");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test");
         ContextProvider.Set(ContextProvider.Keys.Hash, "xyz");
 
         var ratio = 1.5;
@@ -475,7 +478,7 @@ public class EventPublisherTests : IDisposable
     public async Task PublishCategoryChanged_SavesEventWithContextData()
     {
         // Arrange
-        ContextProvider.Set(ContextProvider.Keys.DownloadName, "Category Test");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Category Test");
         ContextProvider.Set(ContextProvider.Keys.Hash, "cat123");
 
         // Act
@@ -493,7 +496,7 @@ public class EventPublisherTests : IDisposable
     public async Task PublishCategoryChanged_WithTag_SavesCorrectMessage()
     {
         // Arrange
-        ContextProvider.Set(ContextProvider.Keys.DownloadName, "Tag Test");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Tag Test");
         ContextProvider.Set(ContextProvider.Keys.Hash, "tag123");
 
         // Act
@@ -509,7 +512,7 @@ public class EventPublisherTests : IDisposable
     public async Task PublishCategoryChanged_SendsNotification()
     {
         // Arrange
-        ContextProvider.Set(ContextProvider.Keys.DownloadName, "Test");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test");
         ContextProvider.Set(ContextProvider.Keys.Hash, "xyz");
 
         // Act

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/DelugeServiceDCTests.cs

@@ -1,3 +1,4 @@
+using Cleanuparr.Domain.Entities;
 using Cleanuparr.Domain.Entities.Deluge.Response;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Context;
@@ -340,13 +341,15 @@ public class DelugeServiceDCTests : IClassFixture<DelugeServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "TEST-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.DeleteTorrents(It.Is<List<string>>(h => h.Contains("test-hash")), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -360,13 +363,15 @@ public class DelugeServiceDCTests : IClassFixture<DelugeServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "UPPERCASE-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.DeleteTorrents(It.IsAny<List<string>>(), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -380,13 +385,15 @@ public class DelugeServiceDCTests : IClassFixture<DelugeServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "TEST-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.DeleteTorrents(It.Is<List<string>>(h => h.Contains("test-hash")), false))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, false);
+            await sut.DeleteDownload(mockTorrent.Object, false);
 
             // Assert
             _fixture.ClientWrapper.Verify(

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/DelugeServiceFixture.cs

@@ -6,9 +6,7 @@ using Cleanuparr.Infrastructure.Features.MalwareBlocker;
 using Cleanuparr.Infrastructure.Http;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services.Interfaces;
-using Cleanuparr.Infrastructure.Tests.Features.DownloadClient.TestHelpers;
 using Cleanuparr.Persistence.Models.Configuration;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using Moq;
 
@@ -17,14 +15,13 @@ namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
 public class DelugeServiceFixture : IDisposable
 {
     public Mock<ILogger<DelugeService>> Logger { get; }
-    public MemoryCache Cache { get; }
     public Mock<IFilenameEvaluator> FilenameEvaluator { get; }
     public Mock<IStriker> Striker { get; }
     public Mock<IDryRunInterceptor> DryRunInterceptor { get; }
     public Mock<IHardLinkFileService> HardLinkFileService { get; }
     public Mock<IDynamicHttpClientProvider> HttpClientProvider { get; }
     public Mock<IEventPublisher> EventPublisher { get; }
-    public BlocklistProvider BlocklistProvider { get; }
+    public Mock<IBlocklistProvider> BlocklistProvider { get; }
     public Mock<IRuleEvaluator> RuleEvaluator { get; }
     public Mock<IRuleManager> RuleManager { get; }
     public Mock<IDelugeClientWrapper> ClientWrapper { get; }
@@ -32,14 +29,13 @@ public class DelugeServiceFixture : IDisposable
     public DelugeServiceFixture()
     {
         Logger = new Mock<ILogger<DelugeService>>();
-        Cache = new MemoryCache(new MemoryCacheOptions());
         FilenameEvaluator = new Mock<IFilenameEvaluator>();
         Striker = new Mock<IStriker>();
         DryRunInterceptor = new Mock<IDryRunInterceptor>();
         HardLinkFileService = new Mock<IHardLinkFileService>();
         HttpClientProvider = new Mock<IDynamicHttpClientProvider>();
         EventPublisher = new Mock<IEventPublisher>();
-        BlocklistProvider = TestBlocklistProviderFactory.Create();
+        BlocklistProvider = new Mock<IBlocklistProvider>();
         RuleEvaluator = new Mock<IRuleEvaluator>();
         RuleManager = new Mock<IRuleManager>();
         ClientWrapper = new Mock<IDelugeClientWrapper>();
@@ -74,14 +70,13 @@ public class DelugeServiceFixture : IDisposable
 
         return new DelugeService(
             Logger.Object,
-            Cache,
             FilenameEvaluator.Object,
             Striker.Object,
             DryRunInterceptor.Object,
             HardLinkFileService.Object,
             HttpClientProvider.Object,
             EventPublisher.Object,
-            BlocklistProvider,
+            BlocklistProvider.Object,
             config,
             RuleEvaluator.Object,
             RuleManager.Object,
@@ -112,7 +107,6 @@ public class DelugeServiceFixture : IDisposable
 
     public void Dispose()
     {
-        Cache.Dispose();
         GC.SuppressFinalize(this);
     }
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/QBitServiceDCTests.cs

@@ -1,3 +1,4 @@
+using Cleanuparr.Domain.Entities;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Context;
 using Cleanuparr.Infrastructure.Features.DownloadClient.QBittorrent;
@@ -302,6 +303,203 @@ public class QBitServiceDCTests : IClassFixture<QBitServiceFixture>
         }
     }
 
+    public class CleanDownloadsAsync_Tests : QBitServiceDCTests
+    {
+        public CleanDownloadsAsync_Tests(QBitServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        private static QBitItemWrapper CreateTorrent(string hash, string category, bool isPrivate) =>
+            new(new TorrentInfo
+            {
+                Hash = hash,
+                Name = $"Test {hash}",
+                Category = category,
+                Ratio = 2.0,
+                SeedingTime = TimeSpan.FromHours(10)
+            }, Array.Empty<TorrentTracker>(), isPrivate);
+
+        private static SeedingRule CreateRule(string name, TorrentPrivacyType privacyType) =>
+            new()
+            {
+                Name = name,
+                PrivacyType = privacyType,
+                MaxRatio = 0,
+                MinSeedTime = 0,
+                MaxSeedTime = -1,
+                DeleteSourceFiles = false
+            };
+
+        private void SetupDeleteMock()
+        {
+            _fixture.ClientWrapper
+                .Setup(x => x.DeleteAsync(It.IsAny<IEnumerable<string>>(), It.IsAny<bool>()))
+                .Returns(Task.CompletedTask);
+        }
+
+        [Fact]
+        public async Task SkipsPrivateTorrent_WhenRuleIsPublicOnly()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: true)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Public) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.IsAny<IEnumerable<string>>(), It.IsAny<bool>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task CleansPublicTorrent_WhenRuleIsPublicOnly()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: false)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Public) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("hash1")), false),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task SkipsPublicTorrent_WhenRuleIsPrivateOnly()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: false)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Private) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.IsAny<IEnumerable<string>>(), It.IsAny<bool>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task CleansPrivateTorrent_WhenRuleIsPrivateOnly()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: true)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Private) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("hash1")), false),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task CleansPublicTorrent_WhenRuleIsBoth()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: false)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Both) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("hash1")), false),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task CleansPrivateTorrent_WhenRuleIsBoth()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: true)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Both) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("hash1")), false),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task MatchesCorrectRule_WhenMultipleRulesForSameCategory()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("public-hash", "movies", isPrivate: false),
+                CreateTorrent("private-hash", "movies", isPrivate: true)
+            };
+            var rules = new List<SeedingRule>
+            {
+                CreateRule("movies", TorrentPrivacyType.Public),
+                CreateRule("movies", TorrentPrivacyType.Private)
+            };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert - both torrents should be cleaned, each matching their respective rule
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("public-hash")), false),
+                Times.Once);
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("private-hash")), false),
+                Times.Once);
+        }
+    }
+
     public class FilterDownloadsToChangeCategoryAsync_Tests : QBitServiceDCTests
     {
         public FilterDownloadsToChangeCategoryAsync_Tests(QBitServiceFixture fixture) : base(fixture)
@@ -503,13 +701,15 @@ public class QBitServiceDCTests : IClassFixture<QBitServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "test-hash";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains(hash)), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -523,13 +723,15 @@ public class QBitServiceDCTests : IClassFixture<QBitServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "test-hash";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.DeleteAsync(It.IsAny<IEnumerable<string>>(), It.IsAny<bool>()))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/QBitServiceFixture.cs

@@ -6,9 +6,7 @@ using Cleanuparr.Infrastructure.Features.MalwareBlocker;
 using Cleanuparr.Infrastructure.Http;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services.Interfaces;
-using Cleanuparr.Infrastructure.Tests.Features.DownloadClient.TestHelpers;
 using Cleanuparr.Persistence.Models.Configuration;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using Moq;
 
@@ -17,14 +15,13 @@ namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
 public class QBitServiceFixture : IDisposable
 {
     public Mock<ILogger<QBitService>> Logger { get; }
-    public MemoryCache Cache { get; }
     public Mock<IFilenameEvaluator> FilenameEvaluator { get; }
     public Mock<IStriker> Striker { get; }
     public Mock<IDryRunInterceptor> DryRunInterceptor { get; }
     public Mock<IHardLinkFileService> HardLinkFileService { get; }
     public Mock<IDynamicHttpClientProvider> HttpClientProvider { get; }
     public Mock<IEventPublisher> EventPublisher { get; }
-    public BlocklistProvider BlocklistProvider { get; }
+    public Mock<IBlocklistProvider> BlocklistProvider { get; }
     public Mock<IRuleEvaluator> RuleEvaluator { get; }
     public Mock<IRuleManager> RuleManager { get; }
     public Mock<IQBittorrentClientWrapper> ClientWrapper { get; }
@@ -32,14 +29,13 @@ public class QBitServiceFixture : IDisposable
     public QBitServiceFixture()
     {
         Logger = new Mock<ILogger<QBitService>>();
-        Cache = new MemoryCache(new MemoryCacheOptions());
         FilenameEvaluator = new Mock<IFilenameEvaluator>();
         Striker = new Mock<IStriker>();
         DryRunInterceptor = new Mock<IDryRunInterceptor>();
         HardLinkFileService = new Mock<IHardLinkFileService>();
         HttpClientProvider = new Mock<IDynamicHttpClientProvider>();
         EventPublisher = new Mock<IEventPublisher>();
-        BlocklistProvider = TestBlocklistProviderFactory.Create();
+        BlocklistProvider =new Mock<IBlocklistProvider>();
         RuleEvaluator = new Mock<IRuleEvaluator>();
         RuleManager = new Mock<IRuleManager>();
         ClientWrapper = new Mock<IQBittorrentClientWrapper>();
@@ -76,14 +72,13 @@ public class QBitServiceFixture : IDisposable
 
         return new QBitService(
             Logger.Object,
-            Cache,
             FilenameEvaluator.Object,
             Striker.Object,
             DryRunInterceptor.Object,
             HardLinkFileService.Object,
             HttpClientProvider.Object,
             EventPublisher.Object,
-            BlocklistProvider,
+            BlocklistProvider.Object,
             config,
             RuleEvaluator.Object,
             RuleManager.Object,
@@ -115,7 +110,6 @@ public class QBitServiceFixture : IDisposable
 
     public void Dispose()
     {
-        Cache.Dispose();
         GC.SuppressFinalize(this);
     }
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/QBitServiceTests.cs

@@ -470,7 +470,7 @@ public class QBitServiceTests : IClassFixture<QBitServiceFixture>
                 });
 
             _fixture.Striker
-                .Setup(x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata))
+                .Setup(x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata, It.IsAny<long?>()))
                 .ReturnsAsync(false);
 
             // Act
@@ -479,7 +479,7 @@ public class QBitServiceTests : IClassFixture<QBitServiceFixture>
             // Assert
             Assert.False(result.ShouldRemove);
             _fixture.Striker.Verify(
-                x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata),
+                x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata, It.IsAny<long?>()),
                 Times.Once);
         }
 
@@ -533,7 +533,7 @@ public class QBitServiceTests : IClassFixture<QBitServiceFixture>
                 });
 
             _fixture.Striker
-                .Setup(x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata))
+                .Setup(x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata, It.IsAny<long?>()))
                 .ReturnsAsync(true); // Strike limit exceeded
 
             // Act
@@ -600,7 +600,7 @@ public class QBitServiceTests : IClassFixture<QBitServiceFixture>
             // Assert
             Assert.False(result.ShouldRemove);
             _fixture.Striker.Verify(
-                x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), It.IsAny<StrikeType>()),
+                x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), It.IsAny<StrikeType>(), It.IsAny<long?>()),
                 Times.Never);
         }
     }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/RTorrentItemWrapperTests.cs

@@ -0,0 +1,582 @@
+using Cleanuparr.Domain.Entities.RTorrent.Response;
+using Cleanuparr.Infrastructure.Features.DownloadClient.RTorrent;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
+
+public class RTorrentItemWrapperTests
+{
+    public class PropertyMapping_Tests
+    {
+        [Fact]
+        public void MapsHash()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "ABC123DEF456", Name = "Test" };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal("ABC123DEF456", wrapper.Hash);
+        }
+
+        [Fact]
+        public void MapsName()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test Torrent Name" };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal("Test Torrent Name", wrapper.Name);
+        }
+
+        [Fact]
+        public void MapsIsPrivate_True()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", IsPrivate = 1 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.True(wrapper.IsPrivate);
+        }
+
+        [Fact]
+        public void MapsIsPrivate_False()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", IsPrivate = 0 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.False(wrapper.IsPrivate);
+        }
+
+        [Fact]
+        public void MapsSize()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", SizeBytes = 1024000 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(1024000, wrapper.Size);
+        }
+
+        [Fact]
+        public void MapsDownloadSpeed()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", DownRate = 500000 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(500000, wrapper.DownloadSpeed);
+        }
+
+        [Fact]
+        public void MapsDownloadedBytes()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", CompletedBytes = 750000 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(750000, wrapper.DownloadedBytes);
+        }
+
+        [Fact]
+        public void MapsCategory()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies" };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal("movies", wrapper.Category);
+        }
+
+        [Fact]
+        public void CategoryIsSettable()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies" };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            wrapper.Category = "tv";
+
+            // Assert
+            Assert.Equal("tv", wrapper.Category);
+        }
+    }
+
+    public class Ratio_Tests
+    {
+        [Fact]
+        public void ConvertsRatioFromRTorrentFormat()
+        {
+            // rTorrent returns ratio * 1000, so 1500 = 1.5 ratio
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Ratio = 1500 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(1.5, wrapper.Ratio);
+        }
+
+        [Fact]
+        public void HandlesZeroRatio()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Ratio = 0 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0, wrapper.Ratio);
+        }
+
+        [Fact]
+        public void HandlesHighRatio()
+        {
+            // Arrange - 10.0 ratio = 10000 in rTorrent
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Ratio = 10000 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(10.0, wrapper.Ratio);
+        }
+    }
+
+    public class CompletionPercentage_Tests
+    {
+        [Fact]
+        public void CalculatesCorrectPercentage()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(50.0, wrapper.CompletionPercentage);
+        }
+
+        [Fact]
+        public void ReturnsZero_WhenSizeIsZero()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 0,
+                CompletedBytes = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0.0, wrapper.CompletionPercentage);
+        }
+
+        [Fact]
+        public void ReturnsHundred_WhenComplete()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 1000,
+                CompletedBytes = 1000
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(100.0, wrapper.CompletionPercentage);
+        }
+    }
+
+    public class IsDownloading_Tests
+    {
+        [Fact]
+        public void ReturnsTrue_WhenStateIsStartedAndNotComplete()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 1,  // Started
+                Complete = 0  // Not complete
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.True(wrapper.IsDownloading());
+        }
+
+        [Fact]
+        public void ReturnsFalse_WhenStopped()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 0,  // Stopped
+                Complete = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.False(wrapper.IsDownloading());
+        }
+
+        [Fact]
+        public void ReturnsFalse_WhenComplete()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 1,  // Started
+                Complete = 1  // Complete (seeding)
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.False(wrapper.IsDownloading());
+        }
+    }
+
+    public class IsStalled_Tests
+    {
+        [Fact]
+        public void ReturnsTrue_WhenDownloadingWithNoSpeed()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 1,
+                Complete = 0,
+                DownRate = 0,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.True(wrapper.IsStalled());
+        }
+
+        [Fact]
+        public void ReturnsFalse_WhenDownloadingWithSpeed()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 1,
+                Complete = 0,
+                DownRate = 100000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.False(wrapper.IsStalled());
+        }
+
+        [Fact]
+        public void ReturnsFalse_WhenNotDownloading()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 0,  // Stopped
+                Complete = 0,
+                DownRate = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.False(wrapper.IsStalled());
+        }
+    }
+
+    public class SeedingTime_Tests
+    {
+        [Fact]
+        public void ReturnsZero_WhenNotComplete()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                Complete = 0,
+                TimestampFinished = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0, wrapper.SeedingTimeSeconds);
+        }
+
+        [Fact]
+        public void ReturnsZero_WhenNoFinishTimestamp()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                Complete = 1,
+                TimestampFinished = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0, wrapper.SeedingTimeSeconds);
+        }
+
+        [Fact]
+        public void CalculatesSeedingTime_WhenComplete()
+        {
+            // Arrange
+            var finishedTime = DateTimeOffset.UtcNow.AddHours(-2).ToUnixTimeSeconds();
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                Complete = 1,
+                TimestampFinished = finishedTime
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert - should be approximately 2 hours (7200 seconds)
+            Assert.True(wrapper.SeedingTimeSeconds >= 7190 && wrapper.SeedingTimeSeconds <= 7210);
+        }
+    }
+
+    public class Eta_Tests
+    {
+        [Fact]
+        public void ReturnsZero_WhenNoDownloadSpeed()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 1000,
+                CompletedBytes = 500,
+                DownRate = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0, wrapper.Eta);
+        }
+
+        [Fact]
+        public void CalculatesEta_WhenDownloading()
+        {
+            // Arrange - 500 bytes remaining at 100 bytes/sec = 5 seconds ETA
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 1000,
+                CompletedBytes = 500,
+                DownRate = 100
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(5, wrapper.Eta);
+        }
+
+        [Fact]
+        public void ReturnsZero_WhenComplete()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 1000,
+                CompletedBytes = 1000,
+                DownRate = 100
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0, wrapper.Eta);
+        }
+    }
+
+    public class IsIgnored_Tests
+    {
+        [Fact]
+        public void ReturnsFalse_WhenEmptyIgnoreList()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies" };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string>());
+
+            // Assert
+            Assert.False(result);
+        }
+
+        [Fact]
+        public void ReturnsTrue_WhenHashMatches()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "ABC123", Name = "Test", Label = "movies" };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string> { "ABC123" });
+
+            // Assert
+            Assert.True(result);
+        }
+
+        [Fact]
+        public void ReturnsTrue_WhenHashMatchesCaseInsensitive()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "ABC123", Name = "Test", Label = "movies" };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string> { "abc123" });
+
+            // Assert
+            Assert.True(result);
+        }
+
+        [Fact]
+        public void ReturnsTrue_WhenCategoryMatches()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies" };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string> { "movies" });
+
+            // Assert
+            Assert.True(result);
+        }
+
+        [Fact]
+        public void ReturnsTrue_WhenTrackerDomainMatches()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                Label = "movies",
+                Trackers = new List<string> { "https://tracker.example.com/announce" }
+            };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string> { "example.com" });
+
+            // Assert
+            Assert.True(result);
+        }
+
+        [Fact]
+        public void ReturnsFalse_WhenNoMatch()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                Label = "movies",
+                Trackers = new List<string> { "https://tracker.example.com/announce" }
+            };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string> { "other.com", "tv", "HASH2" });
+
+            // Assert
+            Assert.False(result);
+        }
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/RTorrentServiceDCTests.cs

@@ -0,0 +1,689 @@
+using Cleanuparr.Domain.Entities;
+using Cleanuparr.Domain.Entities.RTorrent.Response;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Context;
+using Cleanuparr.Infrastructure.Features.DownloadClient.RTorrent;
+using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Moq;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
+
+public class RTorrentServiceDCTests : IClassFixture<RTorrentServiceFixture>
+{
+    private readonly RTorrentServiceFixture _fixture;
+
+    public RTorrentServiceDCTests(RTorrentServiceFixture fixture)
+    {
+        _fixture = fixture;
+        _fixture.ResetMocks();
+    }
+
+    public class GetSeedingDownloads_Tests : RTorrentServiceDCTests
+    {
+        public GetSeedingDownloads_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task FiltersSeedingState()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<RTorrentTorrent>
+            {
+                new RTorrentTorrent { Hash = "HASH1", Name = "Torrent 1", State = 1, Complete = 1, IsPrivate = 0, Label = "" },
+                new RTorrentTorrent { Hash = "HASH2", Name = "Torrent 2", State = 1, Complete = 0, IsPrivate = 0, Label = "" }, // Downloading, not seeding
+                new RTorrentTorrent { Hash = "HASH3", Name = "Torrent 3", State = 1, Complete = 1, IsPrivate = 0, Label = "" },
+                new RTorrentTorrent { Hash = "HASH4", Name = "Torrent 4", State = 0, Complete = 1, IsPrivate = 0, Label = "" } // Stopped, not seeding
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetAllTorrentsAsync())
+                .ReturnsAsync(downloads);
+
+            // Act
+            var result = await sut.GetSeedingDownloads();
+
+            // Assert - only torrents with State=1 AND Complete=1 should be returned
+            Assert.Equal(2, result.Count);
+            Assert.All(result, item => Assert.NotNull(item.Hash));
+        }
+
+        [Fact]
+        public async Task ReturnsEmptyList_WhenNoTorrents()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetAllTorrentsAsync())
+                .ReturnsAsync(new List<RTorrentTorrent>());
+
+            // Act
+            var result = await sut.GetSeedingDownloads();
+
+            // Assert
+            Assert.Empty(result);
+        }
+
+        [Fact]
+        public async Task SkipsTorrentsWithEmptyHash()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<RTorrentTorrent>
+            {
+                new RTorrentTorrent { Hash = "", Name = "No Hash", State = 1, Complete = 1, IsPrivate = 0, Label = "" },
+                new RTorrentTorrent { Hash = "HASH1", Name = "Valid Hash", State = 1, Complete = 1, IsPrivate = 0, Label = "" }
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetAllTorrentsAsync())
+                .ReturnsAsync(downloads);
+
+            // Act
+            var result = await sut.GetSeedingDownloads();
+
+            // Assert
+            Assert.Single(result);
+            Assert.Equal("HASH1", result[0].Hash);
+        }
+    }
+
+    public class FilterDownloadsToBeCleanedAsync_Tests : RTorrentServiceDCTests
+    {
+        public FilterDownloadsToBeCleanedAsync_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public void MatchesCategories()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Torrent 1", Label = "movies" }),
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH2", Name = "Torrent 2", Label = "tv" }),
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH3", Name = "Torrent 3", Label = "music" })
+            };
+
+            var categories = new List<SeedingRule>
+            {
+                new SeedingRule { Name = "movies", MaxRatio = -1, MinSeedTime = 0, MaxSeedTime = -1, DeleteSourceFiles = true },
+                new SeedingRule { Name = "tv", MaxRatio = -1, MinSeedTime = 0, MaxSeedTime = -1, DeleteSourceFiles = true }
+            };
+
+            // Act
+            var result = sut.FilterDownloadsToBeCleanedAsync(downloads, categories);
+
+            // Assert
+            Assert.NotNull(result);
+            Assert.Equal(2, result.Count);
+            Assert.Contains(result, x => x.Category == "movies");
+            Assert.Contains(result, x => x.Category == "tv");
+        }
+
+        [Fact]
+        public void IsCaseInsensitive()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Torrent 1", Label = "Movies" })
+            };
+
+            var categories = new List<SeedingRule>
+            {
+                new SeedingRule { Name = "movies", MaxRatio = -1, MinSeedTime = 0, MaxSeedTime = -1, DeleteSourceFiles = true }
+            };
+
+            // Act
+            var result = sut.FilterDownloadsToBeCleanedAsync(downloads, categories);
+
+            // Assert
+            Assert.NotNull(result);
+            Assert.Single(result);
+        }
+
+        [Fact]
+        public void ReturnsEmptyList_WhenNoMatches()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Torrent 1", Label = "music" })
+            };
+
+            var categories = new List<SeedingRule>
+            {
+                new SeedingRule { Name = "movies", MaxRatio = -1, MinSeedTime = 0, MaxSeedTime = -1, DeleteSourceFiles = true }
+            };
+
+            // Act
+            var result = sut.FilterDownloadsToBeCleanedAsync(downloads, categories);
+
+            // Assert
+            Assert.NotNull(result);
+            Assert.Empty(result);
+        }
+
+        [Fact]
+        public void ReturnsNull_WhenDownloadsNull()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var categories = new List<SeedingRule>
+            {
+                new SeedingRule { Name = "movies", MaxRatio = -1, MinSeedTime = 0, MaxSeedTime = -1, DeleteSourceFiles = true }
+            };
+
+            // Act
+            var result = sut.FilterDownloadsToBeCleanedAsync(null, categories);
+
+            // Assert
+            Assert.Null(result);
+        }
+    }
+
+    public class FilterDownloadsToChangeCategoryAsync_Tests : RTorrentServiceDCTests
+    {
+        public FilterDownloadsToChangeCategoryAsync_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public void MatchesCategories()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Torrent 1", Label = "movies" }),
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH2", Name = "Torrent 2", Label = "tv" }),
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH3", Name = "Torrent 3", Label = "music" })
+            };
+
+            var categories = new List<string> { "movies", "tv" };
+
+            // Act
+            var result = sut.FilterDownloadsToChangeCategoryAsync(downloads, categories);
+
+            // Assert
+            Assert.NotNull(result);
+            Assert.Equal(2, result.Count);
+        }
+
+        [Fact]
+        public void SkipsEmptyHashes()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "", Name = "No Hash", Label = "movies" }),
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Valid Hash", Label = "movies" })
+            };
+
+            var categories = new List<string> { "movies" };
+
+            // Act
+            var result = sut.FilterDownloadsToChangeCategoryAsync(downloads, categories);
+
+            // Assert
+            Assert.NotNull(result);
+            Assert.Single(result);
+            Assert.Equal("HASH1", result[0].Hash);
+        }
+    }
+
+    public class DeleteDownload_Tests : RTorrentServiceDCTests
+    {
+        public DeleteDownload_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+
+        [Fact]
+        public async Task NormalizesHashToUppercase()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            var hash = "lowercase";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
+            mockTorrent.Setup(x => x.SavePath).Returns("/test/path");
+
+            _fixture.ClientWrapper
+                .Setup(x => x.DeleteTorrentAsync("LOWERCASE"))
+                .Returns(Task.CompletedTask);
+
+            // Act
+            await sut.DeleteDownload(mockTorrent.Object, deleteSourceFiles: false);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteTorrentAsync("LOWERCASE"),
+                Times.Once);
+        }
+    }
+
+    public class CreateCategoryAsync_Tests : RTorrentServiceDCTests
+    {
+        public CreateCategoryAsync_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task IsNoOp_BecauseRTorrentDoesNotSupportCategories()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            // Act
+            await sut.CreateCategoryAsync("test-category");
+
+            // Assert - no client calls should be made
+            _fixture.ClientWrapper.VerifyNoOtherCalls();
+        }
+    }
+
+    public class ChangeCategoryForNoHardLinksAsync_Tests : RTorrentServiceDCTests
+    {
+        public ChangeCategoryForNoHardLinksAsync_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task NullDownloads_DoesNothing()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(null);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task EmptyDownloads_DoesNothing()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(new List<ITorrentItemWrapper>());
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task MissingHash_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task MissingName_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "", Label = "movies", BasePath = "/downloads" })
+            };
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task MissingCategory_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "", BasePath = "/downloads" })
+            };
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task GetFilesThrows_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ThrowsAsync(new Exception("XML-RPC error"));
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task SkippedFiles_IgnoredInCheck()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 0 }, // Skipped
+                    new RTorrentFile { Index = 1, Path = "file2.mkv", Priority = 1 }  // Active
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(0);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert - only called for file2.mkv (the active file)
+            _fixture.HardLinkFileService.Verify(
+                x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task NoHardlinks_ChangesLabel()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 1 }
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(0);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert - rTorrent uses SetLabelAsync (not SetTorrentCategoryAsync)
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync("HASH1", "unlinked"),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task HasHardlinks_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 1 }
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(2); // Has hardlinks
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task FileNotFound_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 1 }
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(-1); // Error / file not found
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task PublishesCategoryChangedEvent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 1 }
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(0);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.EventPublisher.Verify(
+                x => x.PublishCategoryChanged("movies", "unlinked", false),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task UpdatesCategoryOnWrapper()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var wrapper = new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" });
+            var downloads = new List<ITorrentItemWrapper> { wrapper };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 1 }
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(0);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            Assert.Equal("unlinked", wrapper.Category);
+        }
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/RTorrentServiceFixture.cs

@@ -0,0 +1,112 @@
+using Cleanuparr.Infrastructure.Events.Interfaces;
+using Cleanuparr.Infrastructure.Features.DownloadClient.RTorrent;
+using Cleanuparr.Infrastructure.Features.Files;
+using Cleanuparr.Infrastructure.Features.ItemStriker;
+using Cleanuparr.Infrastructure.Features.MalwareBlocker;
+using Cleanuparr.Infrastructure.Http;
+using Cleanuparr.Infrastructure.Interceptors;
+using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence.Models.Configuration;
+using Microsoft.Extensions.Logging;
+using Moq;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
+
+public class RTorrentServiceFixture : IDisposable
+{
+    public Mock<ILogger<RTorrentService>> Logger { get; }
+    public Mock<IFilenameEvaluator> FilenameEvaluator { get; }
+    public Mock<IStriker> Striker { get; }
+    public Mock<IDryRunInterceptor> DryRunInterceptor { get; }
+    public Mock<IHardLinkFileService> HardLinkFileService { get; }
+    public Mock<IDynamicHttpClientProvider> HttpClientProvider { get; }
+    public Mock<IEventPublisher> EventPublisher { get; }
+    public Mock<IBlocklistProvider> BlocklistProvider { get; }
+    public Mock<IRuleEvaluator> RuleEvaluator { get; }
+    public Mock<IRuleManager> RuleManager { get; }
+    public Mock<IRTorrentClientWrapper> ClientWrapper { get; }
+
+    public RTorrentServiceFixture()
+    {
+        Logger = new Mock<ILogger<RTorrentService>>();
+        FilenameEvaluator = new Mock<IFilenameEvaluator>();
+        Striker = new Mock<IStriker>();
+        DryRunInterceptor = new Mock<IDryRunInterceptor>();
+        HardLinkFileService = new Mock<IHardLinkFileService>();
+        HttpClientProvider = new Mock<IDynamicHttpClientProvider>();
+        EventPublisher = new Mock<IEventPublisher>();
+        BlocklistProvider = new Mock<IBlocklistProvider>();
+        RuleEvaluator = new Mock<IRuleEvaluator>();
+        RuleManager = new Mock<IRuleManager>();
+        ClientWrapper = new Mock<IRTorrentClientWrapper>();
+
+        DryRunInterceptor
+            .Setup(x => x.InterceptAsync(It.IsAny<Delegate>(), It.IsAny<object[]>()))
+            .Returns((Delegate action, object[] parameters) =>
+            {
+                return (Task)(action.DynamicInvoke(parameters) ?? Task.CompletedTask);
+            });
+    }
+
+    public RTorrentService CreateSut(DownloadClientConfig? config = null)
+    {
+        config ??= new DownloadClientConfig
+        {
+            Id = Guid.NewGuid(),
+            Name = "Test rTorrent Client",
+            TypeName = Domain.Enums.DownloadClientTypeName.rTorrent,
+            Type = Domain.Enums.DownloadClientType.Torrent,
+            Enabled = true,
+            Host = new Uri("http://localhost/RPC2"),
+            Username = "admin",
+            Password = "admin",
+            UrlBase = ""
+        };
+
+        var httpClient = new HttpClient();
+        HttpClientProvider
+            .Setup(x => x.CreateClient(It.IsAny<DownloadClientConfig>()))
+            .Returns(httpClient);
+
+        return new RTorrentService(
+            Logger.Object,
+            FilenameEvaluator.Object,
+            Striker.Object,
+            DryRunInterceptor.Object,
+            HardLinkFileService.Object,
+            HttpClientProvider.Object,
+            EventPublisher.Object,
+            BlocklistProvider.Object,
+            config,
+            RuleEvaluator.Object,
+            RuleManager.Object,
+            ClientWrapper.Object
+        );
+    }
+
+    public void ResetMocks()
+    {
+        Logger.Reset();
+        FilenameEvaluator.Reset();
+        Striker.Reset();
+        DryRunInterceptor.Reset();
+        HardLinkFileService.Reset();
+        HttpClientProvider.Reset();
+        EventPublisher.Reset();
+        RuleEvaluator.Reset();
+        RuleManager.Reset();
+        ClientWrapper.Reset();
+
+        DryRunInterceptor
+            .Setup(x => x.InterceptAsync(It.IsAny<Delegate>(), It.IsAny<object[]>()))
+            .Returns((Delegate action, object[] parameters) =>
+            {
+                return (Task)(action.DynamicInvoke(parameters) ?? Task.CompletedTask);
+            });
+    }
+
+    public void Dispose()
+    {
+        GC.SuppressFinalize(this);
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/RTorrentServiceTests.cs

@@ -0,0 +1,725 @@
+using Cleanuparr.Domain.Entities.RTorrent.Response;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.DownloadClient.RTorrent;
+using Moq;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
+
+public class RTorrentServiceTests : IClassFixture<RTorrentServiceFixture>
+{
+    private readonly RTorrentServiceFixture _fixture;
+
+    public RTorrentServiceTests(RTorrentServiceFixture fixture)
+    {
+        _fixture = fixture;
+        _fixture.ResetMocks();
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_BasicScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_BasicScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task TorrentNotFound_ReturnsEmptyResult()
+        {
+            // Arrange
+            const string hash = "nonexistent";
+            var sut = _fixture.CreateSut();
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash.ToUpperInvariant()))
+                .ReturnsAsync((RTorrentTorrent?)null);
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.Found);
+            Assert.False(result.ShouldRemove);
+            Assert.Equal(DeleteReason.None, result.DeleteReason);
+        }
+
+        [Fact]
+        public async Task TorrentWithEmptyHash_ReturnsEmptyResult()
+        {
+            // Arrange
+            const string hash = "test-hash";
+            var sut = _fixture.CreateSut();
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash.ToUpperInvariant()))
+                .ReturnsAsync(new RTorrentTorrent { Hash = "", Name = "Test" });
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.Found);
+            Assert.False(result.ShouldRemove);
+        }
+
+        [Fact]
+        public async Task TorrentIsIgnored_ReturnsEmptyResult_WithFound()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                Label = "ignored-category",
+                State = 1,
+                Complete = 0
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, new[] { "ignored-category" });
+
+            // Assert
+            Assert.True(result.Found);
+            Assert.False(result.ShouldRemove);
+        }
+
+        [Fact]
+        public async Task TorrentFound_SetsIsPrivateCorrectly_WhenPrivate()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 1,
+                State = 1,
+                Complete = 0,
+                DownRate = 1000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.Found);
+            Assert.True(result.IsPrivate);
+        }
+
+        [Fact]
+        public async Task TorrentFound_SetsIsPrivateCorrectly_WhenPublic()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 1000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.Found);
+            Assert.False(result.IsPrivate);
+        }
+
+        [Fact]
+        public async Task NormalizesHashToUppercase()
+        {
+            // Arrange
+            const string hash = "lowercase-hash";
+            var sut = _fixture.CreateSut();
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync("LOWERCASE-HASH"))
+                .ReturnsAsync((RTorrentTorrent?)null);
+
+            // Act
+            await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.GetTorrentAsync("LOWERCASE-HASH"),
+                Times.Once);
+        }
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_AllFilesSkippedScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_AllFilesSkippedScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task AllFilesSkipped_DeletesFromClient()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 0 },
+                    new RTorrentFile { Index = 1, Path = "file2.mkv", Priority = 0 }
+                });
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.ShouldRemove);
+            Assert.Equal(DeleteReason.AllFilesSkipped, result.DeleteReason);
+            Assert.True(result.DeleteFromClient);
+        }
+
+        [Fact]
+        public async Task SomeFilesWanted_DoesNotRemove()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 1000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 0 },
+                    new RTorrentFile { Index = 1, Path = "file2.mkv", Priority = 1 } // At least one wanted
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.ShouldRemove);
+        }
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_FileErrorScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_FileErrorScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task GetTorrentFilesThrows_ReturnsEmptyResult()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ThrowsAsync(new Exception("XML-RPC error"));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.Found);
+            Assert.False(result.ShouldRemove);
+            Assert.Equal(DeleteReason.None, result.DeleteReason);
+        }
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_SlowDownloadScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_SlowDownloadScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task SlowDownload_NotInDownloadingState_SkipsCheck()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=1 means seeding (not downloading)
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 1,
+                DownRate = 100
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.ShouldRemove);
+            _fixture.RuleEvaluator.Verify(
+                x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task SlowDownload_ZeroSpeed_SkipsCheck()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=0 means downloading; DownRate=0 means zero speed
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 0,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.ShouldRemove);
+            _fixture.RuleEvaluator.Verify(
+                x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task SlowDownload_MatchesRule_RemovesFromQueue()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=0 means downloading; DownRate > 0 means some speed
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 1000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((true, DeleteReason.SlowSpeed, true));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.ShouldRemove);
+            Assert.Equal(DeleteReason.SlowSpeed, result.DeleteReason);
+            Assert.True(result.DeleteFromClient);
+        }
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_StalledDownloadScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_StalledDownloadScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task StalledDownload_NotInStalledState_SkipsCheck()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=0, DownRate > 0 = downloading with speed (not stalled)
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 5000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.ShouldRemove);
+            _fixture.RuleEvaluator.Verify(
+                x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task StalledDownload_MatchesRule_RemovesFromQueue()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=0, DownRate=0 = stalled (downloading with no speed)
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 0,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((true, DeleteReason.Stalled, true));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.ShouldRemove);
+            Assert.Equal(DeleteReason.Stalled, result.DeleteReason);
+            Assert.True(result.DeleteFromClient);
+        }
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_IntegrationScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_IntegrationScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task SlowCheckPasses_ButStalledCheckFails_RemovesFromQueue()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=0, DownRate=0 = stalled (not downloading, so slow check skipped)
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 0,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            // Slow check is skipped because speed is 0
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((true, DeleteReason.Stalled, true));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.ShouldRemove);
+            Assert.Equal(DeleteReason.Stalled, result.DeleteReason);
+            _fixture.RuleEvaluator.Verify(
+                x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()),
+                Times.Never); // Skipped
+            _fixture.RuleEvaluator.Verify(
+                x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task BothChecksPass_DoesNotRemove()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 5000000, // Good speed
+                SizeBytes = 10000000,
+                CompletedBytes = 5000000
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.ShouldRemove);
+            Assert.Equal(DeleteReason.None, result.DeleteReason);
+        }
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/TestHelpers/TestBlocklistProvider.cs

@@ -1,25 +0,0 @@
-using System.Collections.Concurrent;
-using System.Text.RegularExpressions;
-using Cleanuparr.Domain.Enums;
-using Cleanuparr.Infrastructure.Features.MalwareBlocker;
-using Microsoft.Extensions.Caching.Memory;
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Logging;
-using Moq;
-
-namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient.TestHelpers;
-
-/// <summary>
-/// Test implementation of BlocklistProvider for testing purposes
-/// </summary>
-public static class TestBlocklistProviderFactory
-{
-    public static BlocklistProvider Create()
-    {
-        var logger = new Mock<ILogger<BlocklistProvider>>().Object;
-        var scopeFactory = new Mock<IServiceScopeFactory>().Object;
-        var cache = new MemoryCache(new MemoryCacheOptions());
-
-        return new BlocklistProvider(logger, scopeFactory, cache);
-    }
-}

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/TransmissionServiceDCTests.cs

@@ -303,44 +303,15 @@ public class TransmissionServiceDCTests : IClassFixture<TransmissionServiceFixtu
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "test-hash";
-
-            var fields = new[]
-            {
-                TorrentFields.FILES,
-                TorrentFields.FILE_STATS,
-                TorrentFields.HASH_STRING,
-                TorrentFields.ID,
-                TorrentFields.ETA,
-                TorrentFields.NAME,
-                TorrentFields.STATUS,
-                TorrentFields.IS_PRIVATE,
-                TorrentFields.DOWNLOADED_EVER,
-                TorrentFields.DOWNLOAD_DIR,
-                TorrentFields.SECONDS_SEEDING,
-                TorrentFields.UPLOAD_RATIO,
-                TorrentFields.TRACKERS,
-                TorrentFields.RATE_DOWNLOAD,
-                TorrentFields.TOTAL_SIZE
-            };
-
-            var torrents = new TransmissionTorrents
-            {
-                Torrents = new[]
-                {
-                    new TorrentInfo { Id = 123, HashString = hash }
-                }
-            };
-
-            _fixture.ClientWrapper
-                .Setup(x => x.TorrentGetAsync(fields, hash))
-                .ReturnsAsync(torrents);
+            var torrentInfo = new TorrentInfo { Id = 123, HashString = hash };
+            var torrentWrapper = new TransmissionItemWrapper(torrentInfo);
 
             _fixture.ClientWrapper
                 .Setup(x => x.TorrentRemoveAsync(It.Is<long[]>(ids => ids.Contains(123)), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(torrentWrapper, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -354,37 +325,20 @@ public class TransmissionServiceDCTests : IClassFixture<TransmissionServiceFixtu
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "nonexistent-hash";
-
-            var fields = new[]
-            {
-                TorrentFields.FILES,
-                TorrentFields.FILE_STATS,
-                TorrentFields.HASH_STRING,
-                TorrentFields.ID,
-                TorrentFields.ETA,
-                TorrentFields.NAME,
-                TorrentFields.STATUS,
-                TorrentFields.IS_PRIVATE,
-                TorrentFields.DOWNLOADED_EVER,
-                TorrentFields.DOWNLOAD_DIR,
-                TorrentFields.SECONDS_SEEDING,
-                TorrentFields.UPLOAD_RATIO,
-                TorrentFields.TRACKERS,
-                TorrentFields.RATE_DOWNLOAD,
-                TorrentFields.TOTAL_SIZE
-            };
+            var torrentInfo = new TorrentInfo { Id = 456, HashString = hash };
+            var torrentWrapper = new TransmissionItemWrapper(torrentInfo);
 
             _fixture.ClientWrapper
-                .Setup(x => x.TorrentGetAsync(fields, hash))
-                .ReturnsAsync((TransmissionTorrents?)null);
+                .Setup(x => x.TorrentRemoveAsync(It.Is<long[]>(ids => ids.Contains(456)), true))
+                .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(torrentWrapper, true);
 
-            // Assert - no exception thrown
+            // Assert
             _fixture.ClientWrapper.Verify(
-                x => x.TorrentRemoveAsync(It.IsAny<long[]>(), It.IsAny<bool>()),
-                Times.Never);
+                x => x.TorrentRemoveAsync(It.Is<long[]>(ids => ids.Contains(456)), true),
+                Times.Once);
         }
 
         [Fact]
@@ -393,40 +347,15 @@ public class TransmissionServiceDCTests : IClassFixture<TransmissionServiceFixtu
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "test-hash";
-
-            var fields = new[]
-            {
-                TorrentFields.FILES,
-                TorrentFields.FILE_STATS,
-                TorrentFields.HASH_STRING,
-                TorrentFields.ID,
-                TorrentFields.ETA,
-                TorrentFields.NAME,
-                TorrentFields.STATUS,
-                TorrentFields.IS_PRIVATE,
-                TorrentFields.DOWNLOADED_EVER,
-                TorrentFields.DOWNLOAD_DIR,
-                TorrentFields.SECONDS_SEEDING,
-                TorrentFields.UPLOAD_RATIO,
-                TorrentFields.TRACKERS,
-                TorrentFields.RATE_DOWNLOAD,
-                TorrentFields.TOTAL_SIZE
-            };
-
-            var torrents = new TransmissionTorrents
-            {
-                Torrents = new[]
-                {
-                    new TorrentInfo { Id = 123, HashString = hash }
-                }
-            };
+            var torrentInfo = new TorrentInfo { Id = 123, HashString = hash };
+            var torrentWrapper = new TransmissionItemWrapper(torrentInfo);
 
             _fixture.ClientWrapper
-                .Setup(x => x.TorrentGetAsync(fields, hash))
-                .ReturnsAsync(torrents);
+                .Setup(x => x.TorrentRemoveAsync(It.IsAny<long[]>(), true))
+                .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(torrentWrapper, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/TransmissionServiceFixture.cs

@@ -6,9 +6,7 @@ using Cleanuparr.Infrastructure.Features.MalwareBlocker;
 using Cleanuparr.Infrastructure.Http;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services.Interfaces;
-using Cleanuparr.Infrastructure.Tests.Features.DownloadClient.TestHelpers;
 using Cleanuparr.Persistence.Models.Configuration;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using Moq;
 
@@ -17,14 +15,13 @@ namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
 public class TransmissionServiceFixture : IDisposable
 {
     public Mock<ILogger<TransmissionService>> Logger { get; }
-    public MemoryCache Cache { get; }
     public Mock<IFilenameEvaluator> FilenameEvaluator { get; }
     public Mock<IStriker> Striker { get; }
     public Mock<IDryRunInterceptor> DryRunInterceptor { get; }
     public Mock<IHardLinkFileService> HardLinkFileService { get; }
     public Mock<IDynamicHttpClientProvider> HttpClientProvider { get; }
     public Mock<IEventPublisher> EventPublisher { get; }
-    public BlocklistProvider BlocklistProvider { get; }
+    public Mock<IBlocklistProvider> BlocklistProvider { get; }
     public Mock<IRuleEvaluator> RuleEvaluator { get; }
     public Mock<IRuleManager> RuleManager { get; }
     public Mock<ITransmissionClientWrapper> ClientWrapper { get; }
@@ -32,14 +29,13 @@ public class TransmissionServiceFixture : IDisposable
     public TransmissionServiceFixture()
     {
         Logger = new Mock<ILogger<TransmissionService>>();
-        Cache = new MemoryCache(new MemoryCacheOptions());
         FilenameEvaluator = new Mock<IFilenameEvaluator>();
         Striker = new Mock<IStriker>();
         DryRunInterceptor = new Mock<IDryRunInterceptor>();
         HardLinkFileService = new Mock<IHardLinkFileService>();
         HttpClientProvider = new Mock<IDynamicHttpClientProvider>();
         EventPublisher = new Mock<IEventPublisher>();
-        BlocklistProvider = TestBlocklistProviderFactory.Create();
+        BlocklistProvider = new Mock<IBlocklistProvider>();
         RuleEvaluator = new Mock<IRuleEvaluator>();
         RuleManager = new Mock<IRuleManager>();
         ClientWrapper = new Mock<ITransmissionClientWrapper>();
@@ -74,14 +70,13 @@ public class TransmissionServiceFixture : IDisposable
 
         return new TransmissionService(
             Logger.Object,
-            Cache,
             FilenameEvaluator.Object,
             Striker.Object,
             DryRunInterceptor.Object,
             HardLinkFileService.Object,
             HttpClientProvider.Object,
             EventPublisher.Object,
-            BlocklistProvider,
+            BlocklistProvider.Object,
             config,
             RuleEvaluator.Object,
             RuleManager.Object,
@@ -112,7 +107,6 @@ public class TransmissionServiceFixture : IDisposable
 
     public void Dispose()
     {
-        Cache.Dispose();
         GC.SuppressFinalize(this);
     }
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/UTorrentServiceDCTests.cs

@@ -1,3 +1,4 @@
+using Cleanuparr.Domain.Entities;
 using Cleanuparr.Domain.Entities.UTorrent.Response;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Context;
@@ -290,13 +291,15 @@ public class UTorrentServiceDCTests : IClassFixture<UTorrentServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "TEST-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.RemoveTorrentsAsync(It.Is<List<string>>(h => h.Contains("test-hash")), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -310,13 +313,15 @@ public class UTorrentServiceDCTests : IClassFixture<UTorrentServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "UPPERCASE-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.RemoveTorrentsAsync(It.IsAny<List<string>>(), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -330,13 +335,15 @@ public class UTorrentServiceDCTests : IClassFixture<UTorrentServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "TEST-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.RemoveTorrentsAsync(It.Is<List<string>>(h => h.Contains("test-hash")), false))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, false);
+            await sut.DeleteDownload(mockTorrent.Object, false);
 
             // Assert
             _fixture.ClientWrapper.Verify(

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/UTorrentServiceFixture.cs

@@ -6,9 +6,7 @@ using Cleanuparr.Infrastructure.Features.MalwareBlocker;
 using Cleanuparr.Infrastructure.Http;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services.Interfaces;
-using Cleanuparr.Infrastructure.Tests.Features.DownloadClient.TestHelpers;
 using Cleanuparr.Persistence.Models.Configuration;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using Moq;
 
@@ -17,14 +15,13 @@ namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
 public class UTorrentServiceFixture : IDisposable
 {
     public Mock<ILogger<UTorrentService>> Logger { get; }
-    public MemoryCache Cache { get; }
     public Mock<IFilenameEvaluator> FilenameEvaluator { get; }
     public Mock<IStriker> Striker { get; }
     public Mock<IDryRunInterceptor> DryRunInterceptor { get; }
     public Mock<IHardLinkFileService> HardLinkFileService { get; }
     public Mock<IDynamicHttpClientProvider> HttpClientProvider { get; }
     public Mock<IEventPublisher> EventPublisher { get; }
-    public BlocklistProvider BlocklistProvider { get; }
+    public Mock<IBlocklistProvider> BlocklistProvider { get; }
     public Mock<IRuleEvaluator> RuleEvaluator { get; }
     public Mock<IRuleManager> RuleManager { get; }
     public Mock<IUTorrentClientWrapper> ClientWrapper { get; }
@@ -32,14 +29,13 @@ public class UTorrentServiceFixture : IDisposable
     public UTorrentServiceFixture()
     {
         Logger = new Mock<ILogger<UTorrentService>>();
-        Cache = new MemoryCache(new MemoryCacheOptions());
         FilenameEvaluator = new Mock<IFilenameEvaluator>();
         Striker = new Mock<IStriker>();
         DryRunInterceptor = new Mock<IDryRunInterceptor>();
         HardLinkFileService = new Mock<IHardLinkFileService>();
         HttpClientProvider = new Mock<IDynamicHttpClientProvider>();
         EventPublisher = new Mock<IEventPublisher>();
-        BlocklistProvider = TestBlocklistProviderFactory.Create();
+        BlocklistProvider = new Mock<IBlocklistProvider>();
         RuleEvaluator = new Mock<IRuleEvaluator>();
         RuleManager = new Mock<IRuleManager>();
         ClientWrapper = new Mock<IUTorrentClientWrapper>();
@@ -74,14 +70,13 @@ public class UTorrentServiceFixture : IDisposable
 
         return new UTorrentService(
             Logger.Object,
-            Cache,
             FilenameEvaluator.Object,
             Striker.Object,
             DryRunInterceptor.Object,
             HardLinkFileService.Object,
             HttpClientProvider.Object,
             EventPublisher.Object,
-            BlocklistProvider,
+            BlocklistProvider.Object,
             config,
             RuleEvaluator.Object,
             RuleManager.Object,
@@ -112,7 +107,6 @@ public class UTorrentServiceFixture : IDisposable
 
     public void Dispose()
     {
-        Cache.Dispose();
         GC.SuppressFinalize(this);
     }
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadHunter/Consumers/DownloadHunterConsumerTests.cs

@@ -101,7 +101,8 @@ public class DownloadHunterConsumerTests
             InstanceType = InstanceType.Lidarr,
             Instance = CreateArrInstance(),
             SearchItem = new SearchItem { Id = 999 },
-            Record = CreateQueueRecord()
+            Record = CreateQueueRecord(),
+            JobRunId = Guid.NewGuid()
         };
         var contextMock = CreateConsumeContextMock(request);
 
@@ -128,7 +129,8 @@ public class DownloadHunterConsumerTests
             InstanceType = InstanceType.Radarr,
             Instance = CreateArrInstance(),
             SearchItem = new SearchItem { Id = 123 },
-            Record = CreateQueueRecord()
+            Record = CreateQueueRecord(),
+            JobRunId = Guid.NewGuid()
         };
     }
 

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadHunter/DownloadHunterTests.cs

@@ -282,7 +282,8 @@ public class DownloadHunterTests : IDisposable
             InstanceType = instanceType,
             Instance = CreateArrInstance(),
             SearchItem = new SearchItem { Id = 123 },
-            Record = CreateQueueRecord()
+            Record = CreateQueueRecord(),
+            JobRunId = Guid.NewGuid()
         };
     }
 

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadRemover/Consumers/DownloadRemoverConsumerTests.cs

@@ -105,7 +105,8 @@ public class DownloadRemoverConsumerTests
             SearchItem = new SearchItem { Id = 456 },
             Record = CreateQueueRecord(),
             RemoveFromClient = true,
-            DeleteReason = DeleteReason.Stalled
+            DeleteReason = DeleteReason.Stalled,
+            JobRunId = Guid.NewGuid()
         };
         var contextMock = CreateConsumeContextMock(request);
 
@@ -134,7 +135,8 @@ public class DownloadRemoverConsumerTests
             SearchItem = new SearchItem { Id = 789 },
             Record = CreateQueueRecord(),
             RemoveFromClient = false,
-            DeleteReason = DeleteReason.FailedImport
+            DeleteReason = DeleteReason.FailedImport,
+            JobRunId = Guid.NewGuid()
         };
         var contextMock = CreateConsumeContextMock(request);
 
@@ -162,7 +164,8 @@ public class DownloadRemoverConsumerTests
             SearchItem = new SearchItem { Id = 111 },
             Record = CreateQueueRecord(),
             RemoveFromClient = true,
-            DeleteReason = DeleteReason.SlowSpeed
+            DeleteReason = DeleteReason.SlowSpeed,
+            JobRunId = Guid.NewGuid()
         };
         var contextMock = CreateConsumeContextMock(request);
 
@@ -191,7 +194,8 @@ public class DownloadRemoverConsumerTests
             SearchItem = new SearchItem { Id = 123 },
             Record = CreateQueueRecord(),
             RemoveFromClient = true,
-            DeleteReason = DeleteReason.Stalled
+            DeleteReason = DeleteReason.Stalled,
+            JobRunId = Guid.NewGuid()
         };
     }
 

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadRemover/QueueItemRemoverTests.cs

@@ -10,12 +10,12 @@ using Cleanuparr.Infrastructure.Features.ItemStriker;
 using Cleanuparr.Infrastructure.Features.Notifications;
 using Cleanuparr.Infrastructure.Hubs;
 using Cleanuparr.Infrastructure.Interceptors;
+using Cleanuparr.Infrastructure.Tests.Features.Jobs.TestHelpers;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.Arr;
 using Data.Models.Arr;
 using MassTransit;
 using Microsoft.AspNetCore.SignalR;
-using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -48,10 +48,7 @@ public class QueueItemRemoverTests : IDisposable
             .Returns(_arrClientMock.Object);
 
         // Create real EventPublisher with mocked dependencies
-        var eventsContextOptions = new DbContextOptionsBuilder<EventsContext>()
-            .UseInMemoryDatabase(databaseName: Guid.NewGuid().ToString())
-            .Options;
-        _eventsContext = new EventsContext(eventsContextOptions);
+        _eventsContext = TestEventsContextFactory.Create();
 
         var hubContextMock = new Mock<IHubContext<AppHub>>();
         var clientsMock = new Mock<IHubClients>();
@@ -59,18 +56,10 @@ public class QueueItemRemoverTests : IDisposable
         hubContextMock.Setup(h => h.Clients).Returns(clientsMock.Object);
 
         var dryRunInterceptorMock = new Mock<IDryRunInterceptor>();
-        // Setup interceptor to execute the action with params using DynamicInvoke
+        // Setup interceptor to skip actual database saves (these tests verify QueueItemRemover, not EventPublisher)
         dryRunInterceptorMock
             .Setup(d => d.InterceptAsync(It.IsAny<Delegate>(), It.IsAny<object[]>()))
-            .Returns((Delegate action, object[] parameters) =>
-            {
-                var result = action.DynamicInvoke(parameters);
-                if (result is Task task)
-                {
-                    return task;
-                }
-                return Task.CompletedTask;
-            });
+            .Returns(Task.CompletedTask);
 
         _eventPublisher = new EventPublisher(
             _eventsContext,
@@ -84,7 +73,8 @@ public class QueueItemRemoverTests : IDisposable
             _busMock.Object,
             _memoryCache,
             _arrClientFactoryMock.Object,
-            _eventPublisher
+            _eventPublisher,
+            _eventsContext
         );
 
         // Clear static RecurringHashes before each test
@@ -455,7 +445,8 @@ public class QueueItemRemoverTests : IDisposable
             SearchItem = new SearchItem { Id = 123 },
             Record = CreateQueueRecord(),
             RemoveFromClient = removeFromClient,
-            DeleteReason = deleteReason
+            DeleteReason = deleteReason,
+            JobRunId = Guid.NewGuid()
         };
     }
 

code/backend/Cleanuparr.Infrastructure.Tests/Features/Jobs/TestHelpers/JobHandlerFixture.cs

@@ -45,6 +45,9 @@ public class JobHandlerFixture : IDisposable
 
         // Setup default behaviors
         SetupDefaultBehaviors();
+
+        // Setup JobRunId in context for tests
+        ContextProvider.SetJobRunId(Guid.NewGuid());
     }
 
     private void SetupDefaultBehaviors()
@@ -56,6 +59,7 @@ public class JobHandlerFixture : IDisposable
                 It.IsAny<string>(),
                 It.IsAny<Domain.Enums.EventSeverity>(),
                 It.IsAny<object?>(),
+                It.IsAny<Guid?>(),
                 It.IsAny<Guid?>()))
             .Returns(Task.CompletedTask);
     }
@@ -123,6 +127,9 @@ public class JobHandlerFixture : IDisposable
         TimeProvider = new FakeTimeProvider();
 
         SetupDefaultBehaviors();
+
+        // Setup fresh JobRunId for each test
+        ContextProvider.SetJobRunId(Guid.NewGuid());
     }
 
     public void Dispose()

code/backend/Cleanuparr.Infrastructure.Tests/Features/Jobs/TestHelpers/TestDataContextFactory.cs

@@ -314,7 +314,8 @@ public static class TestDataContextFactory
         string name = "completed",
         double maxRatio = 1.0,
         double minSeedTime = 1.0,
-        double maxSeedTime = -1)
+        double maxSeedTime = -1,
+        TorrentPrivacyType privacyType = TorrentPrivacyType.Both)
     {
         var config = context.DownloadCleanerConfigs.Include(x => x.Categories).First();
         var category = new SeedingRule
@@ -324,6 +325,7 @@ public static class TestDataContextFactory
             MaxRatio = maxRatio,
             MinSeedTime = minSeedTime,
             MaxSeedTime = maxSeedTime,
+            PrivacyType = privacyType,
             DeleteSourceFiles = true,
             DownloadCleanerConfigId = config.Id
         };

code/backend/Cleanuparr.Infrastructure.Tests/Features/Jobs/TestHelpers/TestEventsContextFactory.cs

@@ -0,0 +1,31 @@
+using Cleanuparr.Persistence;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.Jobs.TestHelpers;
+
+/// <summary>
+/// Factory for creating SQLite in-memory EventsContext instances for testing.
+/// SQLite in-memory supports ExecuteUpdateAsync, ExecuteDeleteAsync, and EF.Functions.Like,
+/// unlike the EF Core InMemory provider.
+/// </summary>
+public static class TestEventsContextFactory
+{
+    /// <summary>
+    /// Creates a new SQLite in-memory EventsContext with schema initialized
+    /// </summary>
+    public static EventsContext Create()
+    {
+        var connection = new SqliteConnection("DataSource=:memory:");
+        connection.Open();
+
+        var options = new DbContextOptionsBuilder<EventsContext>()
+            .UseSqlite(connection)
+            .Options;
+
+        var context = new EventsContext(options);
+        context.Database.EnsureCreated();
+
+        return context;
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/Notifications/NotificationPublisherTests.cs

@@ -65,7 +65,7 @@ public class NotificationPublisherTests
 
     private void SetupDownloadCleanerContext()
     {
-        ContextProvider.Set(ContextProvider.Keys.DownloadName, "Test Download");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test Download");
         ContextProvider.Set(ContextProvider.Keys.DownloadClientUrl, new Uri("http://downloadclient.local"));
         ContextProvider.Set(ContextProvider.Keys.Hash, "HASH123");
     }

code/backend/Cleanuparr.Infrastructure.Tests/Services/JobManagementServiceTests.cs

@@ -1,3 +1,4 @@
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Hubs;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services;

code/backend/Cleanuparr.Infrastructure.Tests/Services/RuleEvaluatorTests.cs

@@ -7,25 +7,48 @@ using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Features.ItemStriker;
 using Cleanuparr.Infrastructure.Services;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
-using Microsoft.Extensions.Caching.Memory;
+using Cleanuparr.Persistence.Models.State;
+using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Moq;
 using Xunit;
 
 namespace Cleanuparr.Infrastructure.Tests.Services;
 
-public class RuleEvaluatorTests
+public class RuleEvaluatorTests : IDisposable
 {
+    private readonly EventsContext _context;
+
+    public RuleEvaluatorTests()
+    {
+        _context = CreateInMemoryEventsContext();
+    }
+
+    public void Dispose()
+    {
+        _context.Dispose();
+    }
+
+    private static EventsContext CreateInMemoryEventsContext()
+    {
+        var options = new DbContextOptionsBuilder<EventsContext>()
+            .UseInMemoryDatabase(databaseName: Guid.NewGuid().ToString())
+            .Options;
+        return new EventsContext(options);
+    }
+
     [Fact]
     public async Task ResetStrikes_ShouldRespectMinimumProgressThreshold()
     {
+        // Arrange
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var stallRule = new StallRule
         {
@@ -47,7 +70,7 @@ public class RuleEvaluatorTests
             .Returns(stallRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()))
             .ReturnsAsync(false);
 
         strikerMock
@@ -64,9 +87,14 @@ public class RuleEvaluatorTests
         torrentMock.SetupGet(t => t.CompletionPercentage).Returns(50);
         torrentMock.SetupGet(t => t.DownloadedBytes).Returns(() => downloadedBytes);
 
-        // Seed cache with initial observation (no reset expected)
-        await evaluator.EvaluateStallRulesAsync(torrentMock.Object);
-        strikerMock.Verify(x => x.ResetStrikeAsync(It.IsAny<string>(), It.IsAny<string>(), StrikeType.Stalled), Times.Never);
+        // Seed database with a DownloadItem and initial strike (simulating first observation at 0 bytes)
+        var downloadItem = new DownloadItem { DownloadId = "hash", Title = "Example Torrent" };
+        context.DownloadItems.Add(downloadItem);
+        await context.SaveChangesAsync();
+
+        var initialStrike = new Strike { DownloadItemId = downloadItem.Id, Type = StrikeType.Stalled, LastDownloadedBytes = 0 };
+        context.Strikes.Add(initialStrike);
+        await context.SaveChangesAsync();
 
         // Progress below threshold should not reset strikes
         downloadedBytes = ByteSize.Parse("1 MB").Bytes;
@@ -84,10 +112,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         ruleManagerMock
             .Setup(x => x.GetMatchingStallRule(It.IsAny<ITorrentItemWrapper>()))
@@ -98,7 +126,7 @@ public class RuleEvaluatorTests
         var result = await evaluator.EvaluateStallRulesAsync(torrentMock.Object);
         Assert.False(result.ShouldRemove);
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled), Times.Never);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()), Times.Never);
     }
 
     [Fact]
@@ -106,10 +134,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var stallRule = CreateStallRule("Stall Apply", resetOnProgress: false, maxStrikes: 5);
 
@@ -118,7 +146,7 @@ public class RuleEvaluatorTests
             .Returns(stallRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()))
             .ReturnsAsync(false);
 
         var torrentMock = CreateTorrentMock();
@@ -126,7 +154,7 @@ public class RuleEvaluatorTests
         var result = await evaluator.EvaluateStallRulesAsync(torrentMock.Object);
         Assert.False(result.ShouldRemove);
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)stallRule.MaxStrikes, StrikeType.Stalled), Times.Once);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)stallRule.MaxStrikes, StrikeType.Stalled, It.IsAny<long?>()), Times.Once);
         strikerMock.Verify(x => x.ResetStrikeAsync(It.IsAny<string>(), It.IsAny<string>(), StrikeType.Stalled), Times.Never);
     }
 
@@ -135,10 +163,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var stallRule = CreateStallRule("Stall Remove", resetOnProgress: false, maxStrikes: 6);
 
@@ -147,7 +175,7 @@ public class RuleEvaluatorTests
             .Returns(stallRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()))
             .ReturnsAsync(true);
 
         var torrentMock = CreateTorrentMock();
@@ -155,7 +183,7 @@ public class RuleEvaluatorTests
         var result = await evaluator.EvaluateStallRulesAsync(torrentMock.Object);
         Assert.True(result.ShouldRemove);
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)stallRule.MaxStrikes, StrikeType.Stalled), Times.Once);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)stallRule.MaxStrikes, StrikeType.Stalled, It.IsAny<long?>()), Times.Once);
     }
 
     [Fact]
@@ -163,10 +191,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var failingRule = CreateStallRule("Failing", resetOnProgress: false, maxStrikes: 4);
 
@@ -175,14 +203,14 @@ public class RuleEvaluatorTests
             .Returns(failingRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()))
             .ThrowsAsync(new InvalidOperationException("boom"));
 
         var torrentMock = CreateTorrentMock();
 
         await Assert.ThrowsAsync<InvalidOperationException>(() => evaluator.EvaluateStallRulesAsync(torrentMock.Object));
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled), Times.Once);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()), Times.Once);
     }
 
     [Fact]
@@ -190,10 +218,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         ruleManagerMock
             .Setup(x => x.GetMatchingSlowRule(It.IsAny<ITorrentItemWrapper>()))
@@ -204,7 +232,7 @@ public class RuleEvaluatorTests
         var result = await evaluator.EvaluateSlowRulesAsync(torrentMock.Object);
         Assert.False(result.ShouldRemove);
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime), Times.Never);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime, It.IsAny<long?>()), Times.Never);
     }
 
     [Fact]
@@ -212,10 +240,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule("Slow Apply", resetOnProgress: false, maxStrikes: 3);
 
@@ -224,7 +252,7 @@ public class RuleEvaluatorTests
             .Returns(slowRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime, It.IsAny<long?>()))
             .ReturnsAsync(false);
 
         var torrentMock = CreateTorrentMock();
@@ -232,7 +260,7 @@ public class RuleEvaluatorTests
         var result = await evaluator.EvaluateSlowRulesAsync(torrentMock.Object);
         Assert.False(result.ShouldRemove);
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)slowRule.MaxStrikes, StrikeType.SlowTime), Times.Once);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)slowRule.MaxStrikes, StrikeType.SlowTime, It.IsAny<long?>()), Times.Once);
     }
 
     [Fact]
@@ -240,10 +268,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule("Slow Remove", resetOnProgress: false, maxStrikes: 8);
 
@@ -252,7 +280,7 @@ public class RuleEvaluatorTests
             .Returns(slowRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime, It.IsAny<long?>()))
             .ReturnsAsync(true);
 
         var torrentMock = CreateTorrentMock();
@@ -260,7 +288,7 @@ public class RuleEvaluatorTests
         var result = await evaluator.EvaluateSlowRulesAsync(torrentMock.Object);
         Assert.True(result.ShouldRemove);
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)slowRule.MaxStrikes, StrikeType.SlowTime), Times.Once);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)slowRule.MaxStrikes, StrikeType.SlowTime, It.IsAny<long?>()), Times.Once);
     }
 
     [Fact]
@@ -268,10 +296,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule("Slow Progress", resetOnProgress: true, maxStrikes: 4);
 
@@ -295,10 +323,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var failingRule = CreateSlowRule("Failing Slow", resetOnProgress: false, maxStrikes: 4);
 
@@ -307,14 +335,14 @@ public class RuleEvaluatorTests
             .Returns(failingRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime, It.IsAny<long?>()))
             .ThrowsAsync(new InvalidOperationException("slow fail"));
 
         var torrentMock = CreateTorrentMock();
 
         await Assert.ThrowsAsync<InvalidOperationException>(() => evaluator.EvaluateSlowRulesAsync(torrentMock.Object));
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime), Times.Once);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime, It.IsAny<long?>()), Times.Once);
     }
 
     [Fact]
@@ -322,10 +350,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule(
             name: "Speed Rule",
@@ -339,7 +367,7 @@ public class RuleEvaluatorTests
             .Returns(slowRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowSpeed))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowSpeed, It.IsAny<long?>()))
             .ReturnsAsync(true);
 
         var torrentMock = CreateTorrentMock();
@@ -348,7 +376,7 @@ public class RuleEvaluatorTests
         Assert.True(result.ShouldRemove);
 
         strikerMock.Verify(
-            x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)slowRule.MaxStrikes, StrikeType.SlowSpeed),
+            x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)slowRule.MaxStrikes, StrikeType.SlowSpeed, It.IsAny<long?>()),
             Times.Once);
         strikerMock.Verify(
             x => x.ResetStrikeAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<StrikeType>()),
@@ -360,10 +388,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule(
             name: "Both Rule",
@@ -377,7 +405,7 @@ public class RuleEvaluatorTests
             .Returns(slowRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowSpeed))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowSpeed, It.IsAny<long?>()))
             .ReturnsAsync(true);
 
         var torrentMock = CreateTorrentMock();
@@ -385,7 +413,7 @@ public class RuleEvaluatorTests
         var result = await evaluator.EvaluateSlowRulesAsync(torrentMock.Object);
         Assert.True(result.ShouldRemove);
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)slowRule.MaxStrikes, StrikeType.SlowSpeed), Times.Once);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", (ushort)slowRule.MaxStrikes, StrikeType.SlowSpeed, It.IsAny<long?>()), Times.Once);
     }
 
     [Fact]
@@ -393,10 +421,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         // Neither minSpeed nor maxTime set (maxTimeHours = 0, minSpeed = null)
         var slowRule = CreateSlowRule(
@@ -415,7 +443,7 @@ public class RuleEvaluatorTests
         var result = await evaluator.EvaluateSlowRulesAsync(torrentMock.Object);
         Assert.False(result.ShouldRemove);
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), It.IsAny<StrikeType>()), Times.Never);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), It.IsAny<StrikeType>(), It.IsAny<long?>()), Times.Never);
     }
 
     [Fact]
@@ -423,10 +451,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule(
             name: "Speed Reset",
@@ -455,10 +483,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule(
             name: "Speed No Reset",
@@ -483,10 +511,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule(
             name: "Time No Reset",
@@ -511,10 +539,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule(
             name: "Speed Strike",
@@ -528,7 +556,7 @@ public class RuleEvaluatorTests
             .Returns(slowRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowSpeed))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowSpeed, It.IsAny<long?>()))
             .ReturnsAsync(false);
 
         var torrentMock = CreateTorrentMock();
@@ -537,7 +565,7 @@ public class RuleEvaluatorTests
         var result = await evaluator.EvaluateSlowRulesAsync(torrentMock.Object);
         Assert.False(result.ShouldRemove);
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", 3, StrikeType.SlowSpeed), Times.Once);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", 3, StrikeType.SlowSpeed, It.IsAny<long?>()), Times.Once);
     }
 
     [Fact]
@@ -545,10 +573,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule(
             name: "Time Strike",
@@ -562,7 +590,7 @@ public class RuleEvaluatorTests
             .Returns(slowRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime, It.IsAny<long?>()))
             .ReturnsAsync(false);
 
         var torrentMock = CreateTorrentMock();
@@ -571,7 +599,7 @@ public class RuleEvaluatorTests
         var result = await evaluator.EvaluateSlowRulesAsync(torrentMock.Object);
         Assert.False(result.ShouldRemove);
 
-        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", 5, StrikeType.SlowTime), Times.Once);
+        strikerMock.Verify(x => x.StrikeAndCheckLimit("hash", "Example Torrent", 5, StrikeType.SlowTime, It.IsAny<long?>()), Times.Once);
     }
 
     [Fact]
@@ -579,10 +607,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var stallRule = CreateStallRule("No Reset", resetOnProgress: false, maxStrikes: 3);
 
@@ -591,7 +619,7 @@ public class RuleEvaluatorTests
             .Returns(stallRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()))
             .ReturnsAsync(false);
 
         long downloadedBytes = ByteSize.Parse("50 MB").Bytes;
@@ -609,12 +637,22 @@ public class RuleEvaluatorTests
     [Fact]
     public async Task EvaluateStallRulesAsync_WithProgressAndNoMinimumThreshold_ShouldReset()
     {
+        // Arrange
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        // Seed database with a DownloadItem and initial strike (simulating first observation at 0 bytes)
+        var downloadItem = new DownloadItem { DownloadId = "hash", Title = "Example Torrent" };
+        context.DownloadItems.Add(downloadItem);
+        await context.SaveChangesAsync();
+
+        var initialStrike = new Strike { DownloadItemId = downloadItem.Id, Type = StrikeType.Stalled, LastDownloadedBytes = 0 };
+        context.Strikes.Add(initialStrike);
+        await context.SaveChangesAsync();
+
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var stallRule = CreateStallRule("Reset No Minimum", resetOnProgress: true, maxStrikes: 3, minimumProgress: null);
 
@@ -623,23 +661,19 @@ public class RuleEvaluatorTests
             .Returns(stallRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()))
             .ReturnsAsync(false);
 
         strikerMock
             .Setup(x => x.ResetStrikeAsync(It.IsAny<string>(), It.IsAny<string>(), StrikeType.Stalled))
             .Returns(Task.CompletedTask);
 
-        long downloadedBytes = 0;
+        // Act - Any progress should trigger reset when no minimum is set
+        long downloadedBytes = ByteSize.Parse("1 KB").Bytes;
         var torrentMock = CreateTorrentMock(downloadedBytesFactory: () => downloadedBytes);
-
-        // Seed cache
         await evaluator.EvaluateStallRulesAsync(torrentMock.Object);
-        strikerMock.Verify(x => x.ResetStrikeAsync(It.IsAny<string>(), It.IsAny<string>(), StrikeType.Stalled), Times.Never);
 
-        // Any progress should trigger reset when no minimum is set
-        downloadedBytes = ByteSize.Parse("1 KB").Bytes;
-        await evaluator.EvaluateStallRulesAsync(torrentMock.Object);
+        // Assert
         strikerMock.Verify(x => x.ResetStrikeAsync("hash", "Example Torrent", StrikeType.Stalled), Times.Once);
     }
 
@@ -712,10 +746,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         ruleManagerMock
             .Setup(x => x.GetMatchingStallRule(It.IsAny<ITorrentItemWrapper>()))
@@ -735,10 +769,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var stallRule = CreateStallRule("Test Rule", resetOnProgress: false, maxStrikes: 3, deletePrivateTorrentsFromClient: true);
 
@@ -747,7 +781,7 @@ public class RuleEvaluatorTests
             .Returns(stallRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()))
             .ReturnsAsync(false);
 
         var torrentMock = CreateTorrentMock();
@@ -764,10 +798,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var stallRule = CreateStallRule("Delete True Rule", resetOnProgress: false, maxStrikes: 3, deletePrivateTorrentsFromClient: true);
 
@@ -776,7 +810,7 @@ public class RuleEvaluatorTests
             .Returns(stallRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()))
             .ReturnsAsync(true);
 
         var torrentMock = CreateTorrentMock();
@@ -793,10 +827,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var stallRule = CreateStallRule("Delete False Rule", resetOnProgress: false, maxStrikes: 3, deletePrivateTorrentsFromClient: false);
 
@@ -805,7 +839,7 @@ public class RuleEvaluatorTests
             .Returns(stallRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.Stalled, It.IsAny<long?>()))
             .ReturnsAsync(true);
 
         var torrentMock = CreateTorrentMock();
@@ -822,10 +856,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         ruleManagerMock
             .Setup(x => x.GetMatchingSlowRule(It.IsAny<ITorrentItemWrapper>()))
@@ -845,10 +879,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule("Slow Delete True", resetOnProgress: false, maxStrikes: 3, maxTimeHours: 1, deletePrivateTorrentsFromClient: true);
 
@@ -857,7 +891,7 @@ public class RuleEvaluatorTests
             .Returns(slowRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime, It.IsAny<long?>()))
             .ReturnsAsync(true);
 
         var torrentMock = CreateTorrentMock();
@@ -874,10 +908,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule("Slow Delete False", resetOnProgress: false, maxStrikes: 3, maxTimeHours: 1, deletePrivateTorrentsFromClient: false);
 
@@ -886,7 +920,7 @@ public class RuleEvaluatorTests
             .Returns(slowRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime, It.IsAny<long?>()))
             .ReturnsAsync(true);
 
         var torrentMock = CreateTorrentMock();
@@ -903,10 +937,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule(
             "Speed Delete True",
@@ -921,7 +955,7 @@ public class RuleEvaluatorTests
             .Returns(slowRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowSpeed))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowSpeed, It.IsAny<long?>()))
             .ReturnsAsync(true);
 
         var torrentMock = CreateTorrentMock();
@@ -939,10 +973,10 @@ public class RuleEvaluatorTests
     {
         var ruleManagerMock = new Mock<IRuleManager>();
         var strikerMock = new Mock<IStriker>();
-        using var memoryCache = new MemoryCache(new MemoryCacheOptions());
         var loggerMock = new Mock<ILogger<RuleEvaluator>>();
+        var context = CreateInMemoryEventsContext();
 
-        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, memoryCache, loggerMock.Object);
+        var evaluator = new RuleEvaluator(ruleManagerMock.Object, strikerMock.Object, context, loggerMock.Object);
 
         var slowRule = CreateSlowRule("Test Slow Rule", resetOnProgress: false, maxStrikes: 3, maxTimeHours: 1, deletePrivateTorrentsFromClient: true);
 
@@ -951,7 +985,7 @@ public class RuleEvaluatorTests
             .Returns(slowRule);
 
         strikerMock
-            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime))
+            .Setup(x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), StrikeType.SlowTime, It.IsAny<long?>()))
             .ReturnsAsync(false);
 
         var torrentMock = CreateTorrentMock();

code/backend/Cleanuparr.Infrastructure.Tests/Services/StrikerTests.cs

@@ -9,7 +9,6 @@ using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Persistence;
 using Microsoft.AspNetCore.SignalR;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using NSubstitute;
 using Shouldly;
@@ -19,18 +18,18 @@ namespace Cleanuparr.Infrastructure.Tests.Services;
 
 public class StrikerTests : IDisposable
 {
-    private readonly IMemoryCache _cache;
+    private readonly EventsContext _strikerContext;
     private readonly ILogger<Striker> _logger;
     private readonly EventPublisher _eventPublisher;
     private readonly Striker _striker;
 
     public StrikerTests()
     {
-        _cache = new MemoryCache(new MemoryCacheOptions());
+        _strikerContext = CreateInMemoryEventsContext();
         _logger = Substitute.For<ILogger<Striker>>();
 
         // Create EventPublisher with mocked dependencies
-        var eventsContext = CreateMockEventsContext();
+        var eventsContext = CreateInMemoryEventsContext();
         var hubContext = Substitute.For<IHubContext<AppHub>>();
         var hubClients = Substitute.For<IHubClients>();
         var clientProxy = Substitute.For<IClientProxy>();
@@ -53,11 +52,14 @@ public class StrikerTests : IDisposable
             notificationPublisher,
             dryRunInterceptor);
 
-        _striker = new Striker(_logger, _cache, _eventPublisher);
+        _striker = new Striker(_logger, _strikerContext, _eventPublisher);
 
         // Clear static state before each test
         Striker.RecurringHashes.Clear();
 
+        // Set up required JobRunId for tests
+        ContextProvider.SetJobRunId(Guid.NewGuid());
+
         // Set up required context for recurring item events and FailedImport strikes
         ContextProvider.Set(nameof(InstanceType), (object)InstanceType.Sonarr);
         ContextProvider.Set(ContextProvider.Keys.ArrInstanceUrl, new Uri("http://localhost:8989"));
@@ -71,7 +73,7 @@ public class StrikerTests : IDisposable
         });
     }
 
-    private static EventsContext CreateMockEventsContext()
+    private static EventsContext CreateInMemoryEventsContext()
     {
         var options = new DbContextOptionsBuilder<EventsContext>()
             .UseInMemoryDatabase(databaseName: Guid.NewGuid().ToString())
@@ -81,7 +83,7 @@ public class StrikerTests : IDisposable
 
     public void Dispose()
     {
-        _cache.Dispose();
+        _strikerContext.Dispose();
         Striker.RecurringHashes.Clear();
     }
 
@@ -336,4 +338,64 @@ public class StrikerTests : IDisposable
         Striker.RecurringHashes.Count.ShouldBe(1);
         Striker.RecurringHashes.ShouldContainKey(hash.ToLowerInvariant());
     }
+
+    [Fact]
+    public async Task StrikeAndCheckLimit_CreatesNewStrikeRowForEachStrike()
+    {
+        // Arrange
+        const string hash = "strike-rows-test";
+        const string itemName = "Test Item";
+        const ushort maxStrikes = 5;
+
+        // Act - Strike 3 times
+        await _striker.StrikeAndCheckLimit(hash, itemName, maxStrikes, StrikeType.Stalled);
+        await _striker.StrikeAndCheckLimit(hash, itemName, maxStrikes, StrikeType.Stalled);
+        await _striker.StrikeAndCheckLimit(hash, itemName, maxStrikes, StrikeType.Stalled);
+
+        // Assert - Should have 3 strike rows
+        var downloadItem = await _strikerContext.DownloadItems.FirstOrDefaultAsync(d => d.DownloadId == hash);
+        downloadItem.ShouldNotBeNull();
+
+        var strikeCount = await _strikerContext.Strikes
+            .CountAsync(s => s.DownloadItemId == downloadItem.Id && s.Type == StrikeType.Stalled);
+        strikeCount.ShouldBe(3);
+    }
+
+    [Fact]
+    public async Task StrikeAndCheckLimit_StoresTitleOnDownloadItem()
+    {
+        // Arrange
+        const string hash = "title-test";
+        const string itemName = "My Movie Title 2024";
+        const ushort maxStrikes = 3;
+
+        // Act
+        await _striker.StrikeAndCheckLimit(hash, itemName, maxStrikes, StrikeType.Stalled);
+
+        // Assert
+        var downloadItem = await _strikerContext.DownloadItems.FirstOrDefaultAsync(d => d.DownloadId == hash);
+        downloadItem.ShouldNotBeNull();
+        downloadItem.Title.ShouldBe(itemName);
+    }
+
+    [Fact]
+    public async Task StrikeAndCheckLimit_UpdatesTitleOnDownloadItem_WhenTitleChanges()
+    {
+        // Arrange
+        const string hash = "title-update-test";
+        const string initialTitle = "Initial Title";
+        const string updatedTitle = "Updated Title";
+        const ushort maxStrikes = 5;
+
+        // Act - Strike with initial title
+        await _striker.StrikeAndCheckLimit(hash, initialTitle, maxStrikes, StrikeType.Stalled);
+
+        // Strike with updated title
+        await _striker.StrikeAndCheckLimit(hash, updatedTitle, maxStrikes, StrikeType.Stalled);
+
+        // Assert - Title should be updated
+        var downloadItem = await _strikerContext.DownloadItems.FirstOrDefaultAsync(d => d.DownloadId == hash);
+        downloadItem.ShouldNotBeNull();
+        downloadItem.Title.ShouldBe(updatedTitle);
+    }
 }

code/backend/Cleanuparr.Infrastructure.Tests/Utilities/CronValidationHelperTests.cs

@@ -1,5 +1,5 @@
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
-using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Utilities;
 using Shouldly;
 using Xunit;

code/backend/Cleanuparr.Infrastructure.Tests/Verticals/DownloadClient/DownloadServiceFixture.cs

@@ -1,80 +0,0 @@
-// using Data.Models.Configuration.ContentBlocker;
-// using Data.Models.Configuration.DownloadCleaner;
-// using Data.Models.Configuration.QueueCleaner;
-// using Infrastructure.Interceptors;
-// using Infrastructure.Verticals.ContentBlocker;
-// using Infrastructure.Verticals.DownloadClient;
-// using Infrastructure.Verticals.Files;
-// using Infrastructure.Verticals.ItemStriker;
-// using Infrastructure.Verticals.Notifications;
-// using Microsoft.Extensions.Caching.Memory;
-// using Microsoft.Extensions.Logging;
-// using Microsoft.Extensions.Options;
-// using NSubstitute;
-//
-// namespace Infrastructure.Tests.Verticals.DownloadClient;
-//
-// public class DownloadServiceFixture : IDisposable
-// {
-//     public ILogger<DownloadService> Logger { get; set; }
-//     public IMemoryCache Cache { get; set; }
-//     public IStriker Striker { get; set; }
-//
-//     public DownloadServiceFixture()
-//     {
-//         Logger = Substitute.For<ILogger<DownloadService>>();
-//         Cache = Substitute.For<IMemoryCache>();
-//         Striker = Substitute.For<IStriker>();
-//     }
-//
-//     public TestDownloadService CreateSut(
-//         QueueCleanerConfig? queueCleanerConfig = null,
-//         ContentBlockerConfig? contentBlockerConfig = null
-//     )
-//     {
-//         queueCleanerConfig ??= new QueueCleanerConfig
-//         {
-//             Enabled = true,
-//             RunSequentially = true,
-//             StalledResetStrikesOnProgress = true,
-//             StalledMaxStrikes = 3
-//         };
-//
-//         var queueCleanerOptions = Substitute.For<IOptions<QueueCleanerConfig>>();
-//         queueCleanerOptions.Value.Returns(queueCleanerConfig);
-//
-//         contentBlockerConfig ??= new ContentBlockerConfig
-//         {
-//             Enabled = true
-//         };
-//         
-//         var contentBlockerOptions = Substitute.For<IOptions<ContentBlockerConfig>>();
-//         contentBlockerOptions.Value.Returns(contentBlockerConfig);
-//
-//         var downloadCleanerOptions = Substitute.For<IOptions<DownloadCleanerConfig>>();
-//         downloadCleanerOptions.Value.Returns(new DownloadCleanerConfig());
-//
-//         var filenameEvaluator = Substitute.For<IFilenameEvaluator>();
-//         var notifier = Substitute.For<INotificationPublisher>();
-//         var dryRunInterceptor = Substitute.For<IDryRunInterceptor>();
-//         var hardlinkFileService = Substitute.For<IHardLinkFileService>();
-//
-//         return new TestDownloadService(
-//             Logger,
-//             queueCleanerOptions,
-//             contentBlockerOptions,
-//             downloadCleanerOptions,
-//             Cache,
-//             filenameEvaluator,
-//             Striker,
-//             notifier,
-//             dryRunInterceptor,
-//             hardlinkFileService
-//         );
-//     }
-//
-//     public void Dispose()
-//     {
-//         // Cleanup if needed
-//     }
-// }

code/backend/Cleanuparr.Infrastructure.Tests/Verticals/DownloadClient/DownloadServiceTests.cs

@@ -1,214 +0,0 @@
-// using Data.Models.Configuration.DownloadCleaner;
-// using Data.Enums;
-// using Data.Models.Cache;
-// using Infrastructure.Helpers;
-// using Infrastructure.Verticals.Context;
-// using Infrastructure.Verticals.DownloadClient;
-// using NSubstitute;
-// using NSubstitute.ClearExtensions;
-// using Shouldly;
-//
-// namespace Infrastructure.Tests.Verticals.DownloadClient;
-//
-// public class DownloadServiceTests : IClassFixture<DownloadServiceFixture>
-// {
-//     private readonly DownloadServiceFixture _fixture;
-//
-//     public DownloadServiceTests(DownloadServiceFixture fixture)
-//     {
-//         _fixture = fixture;
-//         _fixture.Cache.ClearSubstitute();
-//         _fixture.Striker.ClearSubstitute();
-//     }
-//
-//     public class ResetStrikesOnProgressTests : DownloadServiceTests
-//     {
-//         public ResetStrikesOnProgressTests(DownloadServiceFixture fixture) : base(fixture)
-//         {
-//         }
-//
-//         [Fact]
-//         public void WhenStalledStrikeDisabled_ShouldNotResetStrikes()
-//         {
-//             // Arrange
-//             TestDownloadService sut = _fixture.CreateSut(queueCleanerConfig: new()
-//             {
-//                 Enabled = true,
-//                 RunSequentially = true,
-//                 StalledResetStrikesOnProgress = false,
-//             });
-//
-//             // Act
-//             sut.ResetStalledStrikesOnProgress("test-hash", 100);
-//
-//             // Assert
-//             _fixture.Cache.ReceivedCalls().ShouldBeEmpty();
-//         }
-//         
-//         [Fact]
-//         public void WhenProgressMade_ShouldResetStrikes()
-//         {
-//             // Arrange
-//             const string hash = "test-hash";
-//             StalledCacheItem stalledCacheItem = new StalledCacheItem { Downloaded = 100 };
-//             
-//             _fixture.Cache.TryGetValue(Arg.Any<object>(), out Arg.Any<object?>())
-//                 .Returns(x =>
-//                 {
-//                     x[1] = stalledCacheItem;
-//                     return true;
-//                 });
-//             
-//             TestDownloadService sut = _fixture.CreateSut();
-//
-//             // Act
-//             sut.ResetStalledStrikesOnProgress(hash, 200);
-//
-//             // Assert
-//             _fixture.Cache.Received(1).Remove(CacheKeys.Strike(StrikeType.Stalled, hash));
-//         }
-//
-//         [Fact]
-//         public void WhenNoProgress_ShouldNotResetStrikes()
-//         {
-//             // Arrange
-//             const string hash = "test-hash";
-//             StalledCacheItem stalledCacheItem = new StalledCacheItem { Downloaded = 200 };
-//             
-//             _fixture.Cache
-//                 .TryGetValue(Arg.Any<object>(), out Arg.Any<object?>())
-//                 .Returns(x =>
-//                 {
-//                     x[1] = stalledCacheItem;
-//                     return true;
-//                 });
-//             
-//             TestDownloadService sut = _fixture.CreateSut();
-//
-//             // Act
-//             sut.ResetStalledStrikesOnProgress(hash, 100);
-//
-//             // Assert
-//             _fixture.Cache.DidNotReceive().Remove(Arg.Any<object>());
-//         }
-//     }
-//
-//     public class StrikeAndCheckLimitTests : DownloadServiceTests
-//     {
-//         public StrikeAndCheckLimitTests(DownloadServiceFixture fixture) : base(fixture)
-//         {
-//         }
-//     }
-//
-//     public class ShouldCleanDownloadTests : DownloadServiceTests
-//     {
-//         public ShouldCleanDownloadTests(DownloadServiceFixture fixture) : base(fixture) 
-//         {
-//             ContextProvider.Set(ContextProvider.Keys.DownloadName, "test-download");
-//         }
-//
-//         [Fact]
-//         public void WhenRatioAndMinSeedTimeReached_ShouldReturnTrue()
-//         {
-//             // Arrange
-//             CleanCategory category = new()
-//             {
-//                 Name = "test",
-//                 MaxRatio = 1.0,
-//                 MinSeedTime = 1,
-//                 MaxSeedTime = -1
-//             };
-//             const double ratio = 1.5;
-//             TimeSpan seedingTime = TimeSpan.FromHours(2);
-//             
-//             TestDownloadService sut = _fixture.CreateSut();
-//
-//             // Act
-//             var result = sut.ShouldCleanDownload(ratio, seedingTime, category);
-//
-//             // Assert
-//             result.ShouldSatisfyAllConditions(
-//                 () => result.ShouldClean.ShouldBeTrue(),
-//                 () => result.Reason.ShouldBe(CleanReason.MaxRatioReached)
-//             );
-//         }
-//
-//         [Fact]
-//         public void WhenRatioReachedAndMinSeedTimeNotReached_ShouldReturnFalse()
-//         {
-//             // Arrange
-//             CleanCategory category = new()
-//             {
-//                 Name = "test",
-//                 MaxRatio = 1.0,
-//                 MinSeedTime = 3,
-//                 MaxSeedTime = -1
-//             };
-//             const double ratio = 1.5;
-//             TimeSpan seedingTime = TimeSpan.FromHours(2);
-//             
-//             TestDownloadService sut = _fixture.CreateSut();
-//
-//             // Act
-//             var result = sut.ShouldCleanDownload(ratio, seedingTime, category);
-//
-//             // Assert
-//             result.ShouldSatisfyAllConditions(
-//                 () => result.ShouldClean.ShouldBeFalse(),
-//                 () => result.Reason.ShouldBe(CleanReason.None)
-//             );
-//         }
-//
-//         [Fact]
-//         public void WhenMaxSeedTimeReached_ShouldReturnTrue()
-//         {
-//             // Arrange
-//             CleanCategory category = new()
-//             {
-//                 Name = "test",
-//                 MaxRatio = -1,
-//                 MinSeedTime = 0,
-//                 MaxSeedTime = 1
-//             };
-//             const double ratio = 0.5;
-//             TimeSpan seedingTime = TimeSpan.FromHours(2);
-//             
-//             TestDownloadService sut = _fixture.CreateSut();
-//
-//             // Act
-//             SeedingCheckResult result = sut.ShouldCleanDownload(ratio, seedingTime, category);
-//
-//             // Assert
-//             result.ShouldSatisfyAllConditions(
-//                 () => result.ShouldClean.ShouldBeTrue(),
-//                 () => result.Reason.ShouldBe(CleanReason.MaxSeedTimeReached)
-//             );
-//         }
-//
-//         [Fact]
-//         public void WhenNeitherConditionMet_ShouldReturnFalse()
-//         {
-//             // Arrange
-//             CleanCategory category = new()
-//             {
-//                 Name = "test",
-//                 MaxRatio = 2.0,
-//                 MinSeedTime = 0,
-//                 MaxSeedTime = 3
-//             };
-//             const double ratio = 1.0;
-//             TimeSpan seedingTime = TimeSpan.FromHours(1);
-//             
-//             TestDownloadService sut = _fixture.CreateSut();
-//
-//             // Act
-//             var result = sut.ShouldCleanDownload(ratio, seedingTime, category);
-//
-//             // Assert
-//             result.ShouldSatisfyAllConditions(
-//                 () => result.ShouldClean.ShouldBeFalse(),
-//                 () => result.Reason.ShouldBe(CleanReason.None)
-//             );
-//         }
-//     }
-// }

code/backend/Cleanuparr.Infrastructure/Cleanuparr.Infrastructure.csproj

@@ -7,12 +7,16 @@
     </PropertyGroup>
 
     <ItemGroup>
+      <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
       <PackageReference Include="CliWrap" Version="3.10.0" />
+      <PackageReference Include="Otp.NET" Version="1.4.0" />
       <PackageReference Include="FLM.QBittorrent" Version="1.0.2" />
       <PackageReference Include="FLM.Transmission" Version="1.0.3" />
       <PackageReference Include="Mapster" Version="7.4.0" />
       <PackageReference Include="MassTransit.Abstractions" Version="8.5.7" />
       <PackageReference Include="Microsoft.AspNetCore.SignalR" Version="1.2.0" />
+      <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="8.7.0" />
+      <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.7.0" />
       <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.1" />
       <PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="10.0.1" />
       <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.1" />

code/backend/Cleanuparr.Infrastructure/Events/EventCleanupService.cs

@@ -14,7 +14,7 @@ public class EventCleanupService : BackgroundService
     private readonly ILogger<EventCleanupService> _logger;
     private readonly IServiceScopeFactory _scopeFactory;
     private readonly TimeSpan _cleanupInterval = TimeSpan.FromHours(4); // Run every 4 hours
-    private readonly int _retentionDays = 30; // Keep events for 30 days
+    private readonly int _eventRetentionDays = 30; // Keep events for 30 days
 
     public EventCleanupService(ILogger<EventCleanupService> logger, IServiceScopeFactory scopeFactory)
     {
@@ -25,7 +25,7 @@ public class EventCleanupService : BackgroundService
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
     {
         _logger.LogInformation("Event cleanup service started. Interval: {interval}, Retention: {retention} days", 
-            _cleanupInterval, _retentionDays);
+            _cleanupInterval, _eventRetentionDays);
 
         while (!stoppingToken.IsCancellationRequested)
         {
@@ -59,16 +59,19 @@ public class EventCleanupService : BackgroundService
         try
         {
             await using var scope = _scopeFactory.CreateAsyncScope();
-            var context = scope.ServiceProvider.GetRequiredService<EventsContext>();
+            var eventsContext = scope.ServiceProvider.GetRequiredService<EventsContext>();
+            var dataContext = scope.ServiceProvider.GetRequiredService<DataContext>();
 
-            var cutoffDate = DateTime.UtcNow.AddDays(-_retentionDays);
-            await context.Events
+            var cutoffDate = DateTime.UtcNow.AddDays(-_eventRetentionDays);
+            await eventsContext.Events
                 .Where(e => e.Timestamp < cutoffDate)
                 .ExecuteDeleteAsync();
-            await context.ManualEvents
+            await eventsContext.ManualEvents
                 .Where(e => e.Timestamp < cutoffDate)
                 .Where(e => e.IsResolved)
                 .ExecuteDeleteAsync();
+
+            await CleanupStrikesAsync(eventsContext, dataContext);
         }
         catch (Exception ex)
         {
@@ -76,6 +79,48 @@ public class EventCleanupService : BackgroundService
         }
     }
 
+    private async Task CleanupStrikesAsync(EventsContext eventsContext, DataContext dataContext)
+    {
+        var config = await dataContext.GeneralConfigs
+            .AsNoTracking()
+            .FirstAsync();
+
+        var inactivityWindowHours = config.StrikeInactivityWindowHours;
+        var cutoffDate = DateTime.UtcNow.AddHours(-inactivityWindowHours);
+
+        // Sliding window: find items whose most recent strike is older than the inactivity window.
+        // As long as a download keeps receiving new strikes, all its strikes are preserved.
+        var inactiveItemIds = await eventsContext.Strikes
+            .GroupBy(s => s.DownloadItemId)
+            .Where(g => g.Max(s => s.CreatedAt) < cutoffDate)
+            .Select(g => g.Key)
+            .ToListAsync();
+
+        if (inactiveItemIds.Count > 0)
+        {
+            var deletedStrikesCount = await eventsContext.Strikes
+                .Where(s => inactiveItemIds.Contains(s.DownloadItemId))
+                .ExecuteDeleteAsync();
+
+            if (deletedStrikesCount > 0)
+            {
+                _logger.LogInformation(
+                    "Cleaned up {count} strikes from {items} inactive items (no new strikes for {hours} hours)",
+                    deletedStrikesCount, inactiveItemIds.Count, inactivityWindowHours);
+            }
+        }
+
+        // Clean up orphaned DownloadItems (those with no strikes)
+        int deletedDownloadItemsCount = await eventsContext.DownloadItems
+            .Where(d => !d.Strikes.Any())
+            .ExecuteDeleteAsync();
+
+        if (deletedDownloadItemsCount > 0)
+        {
+            _logger.LogTrace("Cleaned up {count} download items with 0 strikes", deletedDownloadItemsCount);
+        }
+    }
+
     public override async Task StopAsync(CancellationToken cancellationToken)
     {
         _logger.LogInformation("Event cleanup service stopping...");

code/backend/Cleanuparr.Infrastructure/Events/EventPublisher.cs

@@ -43,7 +43,7 @@ public class EventPublisher : IEventPublisher
     /// <summary>
     /// Generic method for publishing events to database and SignalR clients
     /// </summary>
-    public async Task PublishAsync(EventType eventType, string message, EventSeverity severity, object? data = null, Guid? trackingId = null)
+    public async Task PublishAsync(EventType eventType, string message, EventSeverity severity, object? data = null, Guid? trackingId = null, Guid? strikeId = null)
     {
         AppEvent eventEntity = new()
         {
@@ -54,7 +54,13 @@ public class EventPublisher : IEventPublisher
             {
                 Converters = { new JsonStringEnumConverter() }
             }) : null,
-            TrackingId = trackingId
+            TrackingId = trackingId,
+            StrikeId = strikeId,
+            JobRunId = ContextProvider.TryGetJobRunId(),
+            InstanceType = ContextProvider.Get(nameof(InstanceType)) is InstanceType it ? it : null,
+            InstanceUrl = (ContextProvider.Get(ContextProvider.Keys.ArrInstanceUrl) as Uri)?.ToString(),
+            DownloadClientType = ContextProvider.Get(ContextProvider.Keys.DownloadClientType) is DownloadClientTypeName dct ? dct : null,
+            DownloadClientName = ContextProvider.Get(ContextProvider.Keys.DownloadClientName) as string,
         };
 
         // Save to database with dry run interception
@@ -65,7 +71,7 @@ public class EventPublisher : IEventPublisher
 
         _logger.LogTrace("Published event: {eventType}", eventType);
     }
-    
+
     public async Task PublishManualAsync(string message, EventSeverity severity, object? data = null)
     {
         ManualEvent eventEntity = new()
@@ -76,21 +82,26 @@ public class EventPublisher : IEventPublisher
             {
                 Converters = { new JsonStringEnumConverter() }
             }) : null,
+            JobRunId = ContextProvider.TryGetJobRunId(),
+            InstanceType = ContextProvider.Get(nameof(InstanceType)) is InstanceType it ? it : null,
+            InstanceUrl = (ContextProvider.Get(ContextProvider.Keys.ArrInstanceUrl) as Uri)?.ToString(),
+            DownloadClientType = ContextProvider.Get(ContextProvider.Keys.DownloadClientType) is DownloadClientTypeName dct ? dct : null,
+            DownloadClientName = ContextProvider.Get(ContextProvider.Keys.DownloadClientName) as string,
         };
-        
+
         // Save to database with dry run interception
         await _dryRunInterceptor.InterceptAsync(SaveManualEventToDatabase, eventEntity);
-        
+
         // Always send to SignalR clients (not affected by dry run)
         await NotifyClientsAsync(eventEntity);
-        
+
         _logger.LogTrace("Published manual event: {message}", message);
     }
 
     /// <summary>
     /// Publishes a strike event with context data and notifications
     /// </summary>
-    public async Task PublishStrike(StrikeType strikeType, int strikeCount, string hash, string itemName)
+    public async Task PublishStrike(StrikeType strikeType, int strikeCount, string hash, string itemName, Guid? strikeId = null)
     {
         // Determine the appropriate EventType based on StrikeType
         EventType eventType = strikeType switch
@@ -133,7 +144,11 @@ public class EventPublisher : IEventPublisher
             eventType,
             $"Item '{itemName}' has been struck {strikeCount} times for reason '{strikeType}'",
             EventSeverity.Important,
-            data: data);
+            data: data,
+            strikeId: strikeId);
+
+        // Broadcast strike to SignalR clients for real-time dashboard updates
+        await BroadcastStrikeAsync(strikeId, strikeType, hash, itemName);
 
         // Send notification (uses ContextProvider internally)
         await _notificationPublisher.NotifyStrike(strikeType, strikeCount);
@@ -145,7 +160,7 @@ public class EventPublisher : IEventPublisher
     public async Task PublishQueueItemDeleted(bool removeFromClient, DeleteReason deleteReason)
     {
         // Get context data for the event
-        string downloadName = ContextProvider.Get<string>(ContextProvider.Keys.DownloadName);
+        string itemName = ContextProvider.Get<string>(ContextProvider.Keys.ItemName);
         string hash = ContextProvider.Get<string>(ContextProvider.Keys.Hash);
 
         // Publish the event
@@ -153,7 +168,7 @@ public class EventPublisher : IEventPublisher
             EventType.QueueItemDeleted,
             $"Deleting item from queue with reason: {deleteReason}",
             EventSeverity.Important,
-            data: new { downloadName, hash, removeFromClient, deleteReason });
+            data: new { itemName, hash, removeFromClient, deleteReason });
 
         // Send notification (uses ContextProvider internally)
         await _notificationPublisher.NotifyQueueItemDeleted(removeFromClient, deleteReason);
@@ -165,7 +180,7 @@ public class EventPublisher : IEventPublisher
     public async Task PublishDownloadCleaned(double ratio, TimeSpan seedingTime, string categoryName, CleanReason reason)
     {
         // Get context data for the event
-        string downloadName = ContextProvider.Get<string>(ContextProvider.Keys.DownloadName);
+        string itemName = ContextProvider.Get<string>(ContextProvider.Keys.ItemName);
         string hash = ContextProvider.Get<string>(ContextProvider.Keys.Hash);
 
         // Publish the event
@@ -173,7 +188,7 @@ public class EventPublisher : IEventPublisher
             EventType.DownloadCleaned,
             $"Cleaned item from download client with reason: {reason}",
             EventSeverity.Important,
-            data: new { downloadName, hash, categoryName, ratio, seedingTime = seedingTime.TotalHours, reason });
+            data: new { itemName, hash, categoryName, ratio, seedingTime = seedingTime.TotalHours, reason });
 
         // Send notification (uses ContextProvider internally)
         await _notificationPublisher.NotifyDownloadCleaned(ratio, seedingTime, categoryName, reason);
@@ -185,7 +200,7 @@ public class EventPublisher : IEventPublisher
     public async Task PublishCategoryChanged(string oldCategory, string newCategory, bool isTag = false)
     {
         // Get context data for the event
-        string downloadName = ContextProvider.Get<string>(ContextProvider.Keys.DownloadName);
+        string itemName = ContextProvider.Get<string>(ContextProvider.Keys.ItemName);
         string hash = ContextProvider.Get<string>(ContextProvider.Keys.Hash);
 
         // Publish the event
@@ -193,7 +208,7 @@ public class EventPublisher : IEventPublisher
             EventType.CategoryChanged,
             isTag ? $"Tag '{newCategory}' added to download" : $"Category changed from '{oldCategory}' to '{newCategory}'",
             EventSeverity.Information,
-            data: new { downloadName, hash, oldCategory, newCategory, isTag });
+            data: new { itemName, hash, oldCategory, newCategory, isTag });
 
         // Send notification (uses ContextProvider internally)
         await _notificationPublisher.NotifyCategoryChanged(oldCategory, newCategory, isTag);
@@ -204,14 +219,10 @@ public class EventPublisher : IEventPublisher
     /// </summary>
     public async Task PublishRecurringItem(string hash, string itemName, int strikeCount)
     {
-        var instanceType = (InstanceType)ContextProvider.Get<object>(nameof(InstanceType));
-        var instanceUrl = ContextProvider.Get<Uri>(ContextProvider.Keys.ArrInstanceUrl);
-        
-        // Publish the event
         await PublishManualAsync(
             "Download keeps coming back after deletion\nTo prevent further issues, please consult the prerequisites: https://cleanuparr.github.io/Cleanuparr/docs/installation/",
             EventSeverity.Important,
-            data: new { itemName, hash, strikeCount, instanceType, instanceUrl }
+            data: new { itemName, hash, strikeCount }
         );
     }
 
@@ -220,13 +231,10 @@ public class EventPublisher : IEventPublisher
     /// </summary>
     public async Task PublishSearchNotTriggered(string hash, string itemName)
     {
-        var instanceType = (InstanceType)ContextProvider.Get<object>(nameof(InstanceType));
-        var instanceUrl = ContextProvider.Get<Uri>(ContextProvider.Keys.ArrInstanceUrl);
-        
         await PublishManualAsync(
             "Replacement search was not triggered after removal because the item keeps coming back\nPlease trigger a manual search if needed",
             EventSeverity.Warning,
-            data: new { itemName, hash, instanceType, instanceUrl }
+            data: new { itemName, hash }
         );
     }
 
@@ -267,4 +275,24 @@ public class EventPublisher : IEventPublisher
             _logger.LogError(ex, "Failed to send event {eventId} to SignalR clients", appEventEntity.Id);
         }
     }
+
+    private async Task BroadcastStrikeAsync(Guid? strikeId, StrikeType strikeType, string hash, string itemName)
+    {
+        try
+        {
+            var strike = new
+            {
+                Id = strikeId ?? Guid.Empty,
+                Type = strikeType.ToString(),
+                CreatedAt = DateTime.UtcNow,
+                DownloadId = hash,
+                Title = itemName,
+            };
+            await _appHubContext.Clients.All.SendAsync("StrikeReceived", strike);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to send strike to SignalR clients");
+        }
+    }
 } 

code/backend/Cleanuparr.Infrastructure/Events/Interfaces/IEventPublisher.cs

@@ -4,11 +4,11 @@ namespace Cleanuparr.Infrastructure.Events.Interfaces;
 
 public interface IEventPublisher
 {
-    Task PublishAsync(EventType eventType, string message, EventSeverity severity, object? data = null, Guid? trackingId = null);
+    Task PublishAsync(EventType eventType, string message, EventSeverity severity, object? data = null, Guid? trackingId = null, Guid? strikeId = null);
 
     Task PublishManualAsync(string message, EventSeverity severity, object? data = null);
 
-    Task PublishStrike(StrikeType strikeType, int strikeCount, string hash, string itemName);
+    Task PublishStrike(StrikeType strikeType, int strikeCount, string hash, string itemName, Guid? strikeId = null);
 
     Task PublishQueueItemDeleted(bool removeFromClient, DeleteReason deleteReason);
 

code/backend/Cleanuparr.Infrastructure/Features/Auth/IJwtService.cs

@@ -0,0 +1,14 @@
+using System.Security.Claims;
+using Cleanuparr.Persistence.Models.Auth;
+
+namespace Cleanuparr.Infrastructure.Features.Auth;
+
+public interface IJwtService
+{
+    string GenerateAccessToken(User user);
+    string GenerateLoginToken(Guid userId);
+    string GenerateRefreshToken();
+    ClaimsPrincipal? ValidateAccessToken(string token);
+    Guid? ValidateLoginToken(string token);
+    byte[] GetOrCreateSigningKey();
+}

code/backend/Cleanuparr.Infrastructure/Features/Auth/IPasswordService.cs

@@ -0,0 +1,7 @@
+namespace Cleanuparr.Infrastructure.Features.Auth;
+
+public interface IPasswordService
+{
+    string HashPassword(string password);
+    bool VerifyPassword(string password, string hash);
+}

code/backend/Cleanuparr.Infrastructure/Features/Auth/IPlexAuthService.cs

@@ -0,0 +1,28 @@
+namespace Cleanuparr.Infrastructure.Features.Auth;
+
+public sealed record PlexPinResult
+{
+    public required int PinId { get; init; }
+    public required string PinCode { get; init; }
+    public required string AuthUrl { get; init; }
+}
+
+public sealed record PlexPinCheckResult
+{
+    public required bool Completed { get; init; }
+    public string? AuthToken { get; init; }
+}
+
+public sealed record PlexAccountInfo
+{
+    public required string AccountId { get; init; }
+    public required string Username { get; init; }
+    public string? Email { get; init; }
+}
+
+public interface IPlexAuthService
+{
+    Task<PlexPinResult> RequestPin();
+    Task<PlexPinCheckResult> CheckPin(int pinId);
+    Task<PlexAccountInfo> GetAccount(string authToken);
+}

code/backend/Cleanuparr.Infrastructure/Features/Auth/ITotpService.cs

@@ -0,0 +1,11 @@
+namespace Cleanuparr.Infrastructure.Features.Auth;
+
+public interface ITotpService
+{
+    string GenerateSecret();
+    string GetQrCodeUri(string secret, string username);
+    bool ValidateCode(string secret, string code);
+    List<string> GenerateRecoveryCodes(int count = 10);
+    string HashRecoveryCode(string code);
+    bool VerifyRecoveryCode(string code, string hash);
+}

code/backend/Cleanuparr.Infrastructure/Features/Auth/JwtService.cs

@@ -0,0 +1,138 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Security.Cryptography;
+using Cleanuparr.Persistence.Models.Auth;
+using Cleanuparr.Shared.Helpers;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Cleanuparr.Infrastructure.Features.Auth;
+
+public sealed class JwtService : IJwtService
+{
+    private const string Issuer = "Cleanuparr";
+    private const string Audience = "Cleanuparr";
+    private static readonly TimeSpan AccessTokenLifetime = TimeSpan.FromHours(1);
+    private static readonly TimeSpan LoginTokenLifetime = TimeSpan.FromMinutes(5);
+
+    private readonly byte[] _signingKey;
+
+    public JwtService()
+    {
+        _signingKey = GetOrCreateSigningKey();
+    }
+
+    public string GenerateAccessToken(User user)
+    {
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim("token_type", "access")
+        };
+
+        return GenerateToken(claims, AccessTokenLifetime);
+    }
+
+    public string GenerateLoginToken(Guid userId)
+    {
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, userId.ToString()),
+            new Claim("token_type", "login")
+        };
+
+        return GenerateToken(claims, LoginTokenLifetime);
+    }
+
+    public string GenerateRefreshToken()
+    {
+        var bytes = new byte[32];
+        using var rng = RandomNumberGenerator.Create();
+        rng.GetBytes(bytes);
+        return Convert.ToBase64String(bytes);
+    }
+
+    public ClaimsPrincipal? ValidateAccessToken(string token)
+    {
+        var principal = ValidateToken(token);
+        if (principal is null) return null;
+
+        var tokenType = principal.FindFirst("token_type")?.Value;
+        return tokenType == "access" ? principal : null;
+    }
+
+    public Guid? ValidateLoginToken(string token)
+    {
+        var principal = ValidateToken(token);
+        if (principal is null) return null;
+
+        var tokenType = principal.FindFirst("token_type")?.Value;
+        if (tokenType != "login") return null;
+
+        var userIdClaim = principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        return Guid.TryParse(userIdClaim, out var userId) ? userId : null;
+    }
+
+    public byte[] GetOrCreateSigningKey()
+    {
+        var keyPath = Path.Combine(ConfigurationPathProvider.GetConfigPath(), "jwt-key.bin");
+
+        if (File.Exists(keyPath))
+        {
+            return File.ReadAllBytes(keyPath);
+        }
+
+        var key = new byte[32];
+        using var rng = RandomNumberGenerator.Create();
+        rng.GetBytes(key);
+
+        var directory = Path.GetDirectoryName(keyPath);
+        if (directory is not null && !Directory.Exists(directory))
+        {
+            Directory.CreateDirectory(directory);
+        }
+
+        File.WriteAllBytes(keyPath, key);
+        return key;
+    }
+
+    private string GenerateToken(Claim[] claims, TimeSpan lifetime)
+    {
+        var key = new SymmetricSecurityKey(_signingKey);
+        var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
+
+        var token = new JwtSecurityToken(
+            issuer: Issuer,
+            audience: Audience,
+            claims: claims,
+            expires: DateTime.UtcNow.Add(lifetime),
+            signingCredentials: credentials);
+
+        return new JwtSecurityTokenHandler().WriteToken(token);
+    }
+
+    private ClaimsPrincipal? ValidateToken(string token)
+    {
+        var key = new SymmetricSecurityKey(_signingKey);
+        var handler = new JwtSecurityTokenHandler();
+
+        try
+        {
+            return handler.ValidateToken(token, new TokenValidationParameters
+            {
+                ValidateIssuer = true,
+                ValidIssuer = Issuer,
+                ValidateAudience = true,
+                ValidAudience = Audience,
+                ValidateLifetime = true,
+                ValidateIssuerSigningKey = true,
+                IssuerSigningKey = key,
+                ClockSkew = TimeSpan.FromSeconds(30)
+            }, out _);
+        }
+        catch
+        {
+            return null;
+        }
+    }
+}