first

2026-06-02 17:35:45 +08:00
commit 4ef99b1f81
148 changed files with 21134 additions and 0 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -0,0 +1,15 @@
+.git
+.github
+node_modules
+npm-debug.log
+storage/app/private
+storage/logs
+storage/framework/cache
+storage/framework/sessions
+storage/framework/views
+.env
+.env.*
+!.env.example
+*.md
+docker/transcription-worker
+tests
--- a/.editorconfig
+++ b/.editorconfig
@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[{compose,docker-compose}.{yml,yaml}]
+indent_size = 4
--- a/.env.example
+++ b/.env.example
@@ -0,0 +1,90 @@
+APP_NAME="Speech2Text MBIP"
+APP_ENV=production
+APP_KEY=
+APP_DEBUG=false
+APP_URL=https://speech2text.mbip.my
+
+APP_LOCALE=ms
+APP_FALLBACK_LOCALE=en
+APP_FAKER_LOCALE=ms_MY
+
+APP_MAINTENANCE_DRIVER=file
+
+BCRYPT_ROUNDS=12
+
+LOG_CHANNEL=stack
+LOG_STACK=single
+LOG_DEPRECATIONS_CHANNEL=null
+LOG_LEVEL=error
+
+DB_CONNECTION=mysql
+DB_HOST=mysql
+DB_PORT=3306
+DB_DATABASE=speech2text
+DB_USERNAME=speech2text
+DB_PASSWORD=
+
+SESSION_DRIVER=redis
+SESSION_LIFETIME=120
+SESSION_ENCRYPT=true
+SESSION_PATH=/
+SESSION_DOMAIN=null
+
+BROADCAST_CONNECTION=log
+FILESYSTEM_DISK=local
+QUEUE_CONNECTION=redis
+
+CACHE_STORE=redis
+
+REDIS_CLIENT=phpredis
+REDIS_HOST=redis
+REDIS_PASSWORD=null
+REDIS_PORT=6379
+
+MAIL_MAILER=log
+MAIL_SCHEME=null
+MAIL_HOST=127.0.0.1
+MAIL_PORT=2525
+MAIL_USERNAME=null
+MAIL_PASSWORD=null
+MAIL_FROM_ADDRESS="noreply@mbip.my"
+MAIL_FROM_NAME="${APP_NAME}"
+
+# ============================================================
+# Storage
+# ============================================================
+PRIVATE_AUDIO_MAX_MB=200
+
+# ============================================================
+# Transcription Engine
+# ============================================================
+TRANSCRIPTION_ENGINE=faster-whisper
+WHISPER_MODEL=small
+WHISPER_LANGUAGE=ms
+WHISPER_DEVICE=cpu
+WHISPER_COMPUTE_TYPE=int8
+TRANSCRIPTION_WORKER_URL=http://transcription-worker:8000
+
+# ============================================================
+# Ollama (optional — local LLM post-processing)
+# Default: disabled. Jangan aktifkan jika tidak diperlukan.
+# ============================================================
+OLLAMA_ENABLED=false
+OLLAMA_BASE_URL=http://ollama:11434
+OLLAMA_MODEL=llama3.1
+
+# ============================================================
+# Admin Default (untuk seeder pertama kali)
+# Tukar password selepas login pertama!
+# ============================================================
+ADMIN_DEFAULT_NAME=
+ADMIN_DEFAULT_EMAIL=
+ADMIN_DEFAULT_PASSWORD=
+
+# ============================================================
+# MySQL Root (untuk Docker)
+# ============================================================
+MYSQL_ROOT_PASSWORD=
+MYSQL_DATABASE=speech2text
+MYSQL_USER=speech2text
+MYSQL_PASSWORD=
--- a/.gitattributes
+++ b/.gitattributes
@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.blade.php diff=html
+*.css diff=css
+*.html diff=html
+*.md diff=markdown
+*.php diff=php
+
+/.github export-ignore
+CHANGELOG.md export-ignore
+.styleci.yml export-ignore
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1,29 @@
+*.log
+.DS_Store
+.env
+.env.*
+!.env.example
+.env.backup
+.env.production
+.phpactor.json
+.phpunit.result.cache
+/.codex
+/.cursor/
+/.idea
+/.nova
+/.phpunit.cache
+/.vscode
+/.zed
+/auth.json
+/node_modules
+/public/build
+/public/fonts-manifest.dev.json
+/public/hot
+/public/storage
+/storage/*.key
+/storage/pail
+/vendor
+_ide_helper.php
+Homestead.json
+Homestead.yaml
+Thumbs.db
--- a/.npmrc
+++ b/.npmrc
@@ -0,0 +1,2 @@
+ignore-scripts=true
+audit=true
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -0,0 +1,245 @@
+# ARCHITECTURE.md — Speech2Text MBIP
+
+## Gambaran Keseluruhan
+
+Sistem Speech-to-Text MBIP ialah aplikasi web dalaman yang membolehkan pengguna jabatan muat naik fail audio dan mendapatkan transkripsi teks Bahasa Melayu secara automatik. Semua pemprosesan berlaku dalam persekitaran Docker yang self-hosted, tanpa hantar data ke cloud luaran.
+
+---
+
+## Stack Teknologi
+
+| Lapisan | Teknologi |
+|---|---|
+| Web Framework | Laravel 11 (PHP 8.3+) |
+| Database | MySQL 8 |
+| Cache / Queue | Redis |
+| Frontend | Bootstrap 5 + jQuery |
+| Web Server | Nginx + PHP-FPM |
+| Queue Worker | Laravel Queue (Redis driver) |
+| Transcription Engine | faster-whisper (Python) via HTTP API |
+| Post-processing (optional) | Ollama (local LLM) |
+| Container | Docker Compose |
+| Storage | Laravel Private Disk (local filesystem) |
+
+---
+
+## Seni Bina Perkhidmatan (Docker Compose)
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                        DOCKER NETWORK                        │
+│                                                             │
+│  ┌───────────┐    ┌───────────┐    ┌──────────────────────┐ │
+│  │   nginx   │───▶│  app      │───▶│  mysql               │ │
+│  │  :80/443  │    │ (php-fpm) │    │  :3306               │ │
+│  └───────────┘    └─────┬─────┘    └──────────────────────┘ │
+│                         │                                    │
+│                    ┌────▼────┐    ┌──────────────────────┐  │
+│                    │  redis  │    │  transcription-worker│  │
+│                    │  :6379  │    │  (Python FastAPI)    │  │
+│                    └─────────┘    │  :8000               │  │
+│                         │        └──────────────────────┘  │
+│              ┌──────────┴───┐    ┌──────────────────────┐  │
+│              │queue-worker  │    │  ollama (optional)   │  │
+│              │(Laravel)     │    │  :11434              │  │
+│              └──────────────┘    └──────────────────────┘  │
+│              ┌──────────────┐                               │
+│              │  scheduler   │                               │
+│              │(Laravel cron)│                               │
+│              └──────────────┘                               │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Perkhidmatan Docker
+
+#### `app` — Laravel PHP-FPM
+- Image: php:8.3-fpm (custom Dockerfile)
+- Mount: `/svr/speech2text/app` → `/var/www/html`
+- Tanggungjawab: serve HTTP request, jalankan Artisan commands
+
+#### `nginx`
+- Image: nginx:alpine
+- Port: 80, 443
+- Proxy pass ke `app:9000`
+
+#### `mysql`
+- Image: mysql:8
+- Volume: data persistent
+- Database: `speech2text`
+
+#### `redis`
+- Image: redis:alpine
+- Digunakan untuk: queue, cache, session
+
+#### `queue-worker`
+- Build dari image `app` yang sama
+- Command: `php artisan queue:work redis --sleep=3 --tries=3 --max-time=3600`
+- Proses job transcription, notification, audit
+
+#### `scheduler`
+- Build dari image `app` yang sama
+- Command: `php artisan schedule:work`
+- Proses scheduled tasks (cleanup, retention policy)
+
+#### `transcription-worker`
+- Image: Python 3.11 + faster-whisper (custom Dockerfile)
+- Port: 8000 (internal sahaja)
+- Expose endpoint `/transcribe` (POST)
+- Tidak accessible dari luar Docker network
+
+#### `ollama` (optional)
+- Image: ollama/ollama
+- Hanya diaktifkan jika `OLLAMA_ENABLED=true`
+- Digunakan untuk post-processing teks selepas transcription
+
+---
+
+## Aliran Data Transcription
+
+```
+User Upload Audio
+      │
+      ▼
+[Laravel Controller]
+  - Validate file (type, size)
+  - Simpan ke storage/app/private/transcriptions/{uuid}/audio/
+  - Cipta rekod TranscriptionProject (status: pending)
+  - Dispatch TranscribeAudioJob ke Redis queue
+      │
+      ▼
+[Queue Worker — TranscribeAudioJob]
+  - Update status: processing
+  - Baca fail audio dari private storage
+  - Hantar ke transcription-worker via HTTP POST
+      │
+      ▼
+[transcription-worker — Python FastAPI]
+  - Terima audio (base64 atau multipart)
+  - Jalankan faster-whisper dengan model yang dikonfig
+  - Return transcript JSON
+      │
+      ▼
+[Queue Worker — callback]
+  - Simpan transcript ke database
+  - Update status: completed / failed
+  - Log audit
+  - (Optional) Dispatch OllamaPostProcessJob
+      │
+      ▼
+[User melihat hasil transcript]
+```
+
+---
+
+## Struktur Direktori Laravel
+
+```
+app/
+├── Actions/                  # Single-purpose action classes
+│   ├── CreateUserAction.php
+│   ├── DeactivateUserAction.php
+│   ├── TransferProjectOwnerAction.php
+│   └── ...
+├── Http/
+│   ├── Controllers/
+│   │   ├── Admin/
+│   │   │   ├── DashboardController.php
+│   │   │   ├── UserController.php
+│   │   │   ├── ProjectMetadataController.php
+│   │   │   ├── TransferOwnershipController.php
+│   │   │   └── AuditLogController.php
+│   │   └── User/
+│   │       ├── DashboardController.php
+│   │       ├── ProjectController.php
+│   │       ├── AudioController.php
+│   │       ├── TranscriptController.php
+│   │       ├── CollaboratorController.php
+│   │       ├── CommentController.php
+│   │       └── TranscriptVersionController.php
+│   ├── Requests/             # Form Request validation
+│   └── Middleware/
+│       ├── EnsureUserIsActive.php
+│       └── EnsureAdminCannotAccessContent.php
+├── Jobs/
+│   ├── TranscribeAudioJob.php
+│   └── OllamaPostProcessJob.php
+├── Models/
+│   ├── User.php
+│   ├── Department.php
+│   ├── TranscriptionProject.php
+│   ├── ProjectCollaborator.php
+│   ├── TranscriptVersion.php
+│   ├── ProjectComment.php
+│   └── AuditLog.php
+├── Policies/
+│   ├── TranscriptionProjectPolicy.php
+│   ├── CommentPolicy.php
+│   ├── TranscriptVersionPolicy.php
+│   └── UserPolicy.php
+├── Services/
+│   ├── TranscriptionService.php
+│   ├── OllamaService.php
+│   ├── AuditLogService.php
+│   └── StorageService.php
+└── ...
+
+resources/
+├── views/
+│   ├── layouts/
+│   │   ├── app.blade.php        # Layout pengguna
+│   │   └── admin.blade.php      # Layout admin
+│   ├── auth/
+│   ├── admin/
+│   │   ├── dashboard.blade.php
+│   │   ├── users/
+│   │   ├── projects/
+│   │   └── audit-logs/
+│   └── user/
+│       ├── dashboard.blade.php
+│       ├── projects/
+│       └── ...
+```
+
+---
+
+## Authorization Model (Ringkas)
+
+```
+Admin:
+  ✓ Urus pengguna (CRUD metadata)
+  ✓ Lihat statistik
+  ✓ Lihat metadata projek sahaja
+  ✓ Transfer ownership dengan justifikasi
+  ✓ Lihat audit log pentadbiran
+  ✗ Dengar / download audio
+  ✗ Baca transcript
+  ✗ Lihat komen
+  ✗ Masuk detail projek (kandungan)
+
+Owner:
+  ✓ Semua akses ke projek sendiri
+  ✓ Urus collaborators
+  ✓ Delete projek / audio / teks
+  ✓ Retry transcription
+
+Collaborator:
+  ✓ Lihat / edit transcript
+  ✓ Dengar audio
+  ✓ Buat komen
+  ✗ Delete projek
+  ✗ Transfer ownership
+  ✗ Urus collaborators lain
+```
+
+---
+
+## Prinsip Reka Bentuk
+
+1. **Thin Controller** — logic dalam Action class atau Service, bukan dalam controller.
+2. **Policy Enforcement** — setiap action semak Policy, bukan hanya UI.
+3. **Private Storage** — tiada fail audio/teks dalam `public/` atau `storage/app/public/`.
+4. **UUID Routes** — gunakan UUID bukan ID integer dalam URL projek.
+5. **Audit Everything** — semua tindakan sensitif direkod dalam `audit_logs`.
+6. **Queue All Transcription** — proses transcription tidak boleh block HTTP request.
+7. **No Cloud Dependency** — semua AI/ML processing dalam Docker network sahaja.
+8. **Local-only Default** — Ollama disabled by default; hanya aktif jika eksplisit dikonfig.
--- a/DATABASE_DESIGN.md
+++ b/DATABASE_DESIGN.md
@@ -0,0 +1,272 @@
+# DATABASE_DESIGN.md — Speech2Text MBIP
+
+## Senarai Jadual
+
+1. `users`
+2. `departments`
+3. `transcription_projects`
+4. `project_collaborators`
+5. `transcript_versions`
+6. `project_comments`
+7. `audit_logs`
+8. `sessions`
+9. `jobs` / `failed_jobs`
+10. `cache`
+
+---
+
+## Skema Jadual
+
+### 1. `users`
+
+```sql
+CREATE TABLE users (
+    id              BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    name            VARCHAR(255) NOT NULL,
+    email           VARCHAR(255) NOT NULL UNIQUE,
+    password        VARCHAR(255) NOT NULL,
+    role            ENUM('admin', 'user') NOT NULL DEFAULT 'user',
+    department_id   BIGINT UNSIGNED NULL,
+    is_active       TINYINT(1) NOT NULL DEFAULT 1,
+    last_login_at   TIMESTAMP NULL,
+    email_verified_at TIMESTAMP NULL,
+    remember_token  VARCHAR(100) NULL,
+    created_at      TIMESTAMP NULL,
+    updated_at      TIMESTAMP NULL,
+    deleted_at      TIMESTAMP NULL,  -- soft delete
+
+    FOREIGN KEY (department_id) REFERENCES departments(id) ON DELETE SET NULL
+);
+```
+
+**Catatan:**
+- `deleted_at` hanya digunakan jika pengguna belum pernah guna aplikasi (tiada projek, tiada audit).
+- Jika pernah guna, hanya `is_active = 0` (deactivate), jangan hard delete.
+- `role` enum mudah diurus; boleh upgrade ke `spatie/laravel-permission` kemudian jika perlu.
+
+---
+
+### 2. `departments`
+
+```sql
+CREATE TABLE departments (
+    id          BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    name        VARCHAR(255) NOT NULL,
+    code        VARCHAR(50) NULL UNIQUE,
+    is_active   TINYINT(1) NOT NULL DEFAULT 1,
+    created_at  TIMESTAMP NULL,
+    updated_at  TIMESTAMP NULL
+);
+```
+
+---
+
+### 3. `transcription_projects`
+
+```sql
+CREATE TABLE transcription_projects (
+    id                      BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    uuid                    CHAR(36) NOT NULL UNIQUE,   -- digunakan dalam URL
+    title                   VARCHAR(255) NOT NULL,
+    description             TEXT NULL,
+    owner_user_id           BIGINT UNSIGNED NOT NULL,
+    original_filename       VARCHAR(500) NOT NULL,
+    stored_audio_path       VARCHAR(1000) NOT NULL,     -- path relatif dalam private disk
+    mime_type               VARCHAR(100) NOT NULL,
+    file_size               BIGINT UNSIGNED NOT NULL,   -- bytes
+    duration_seconds        INT UNSIGNED NULL,
+    language                VARCHAR(10) NOT NULL DEFAULT 'ms',
+    transcription_status    ENUM('pending','processing','completed','failed') NOT NULL DEFAULT 'pending',
+    transcription_engine    VARCHAR(50) NULL,           -- e.g. 'faster-whisper'
+    transcript_text         LONGTEXT NULL,              -- kandungan sensitif
+    transcript_confidence   DECIMAL(5,4) NULL,          -- 0.0000 - 1.0000
+    error_message           TEXT NULL,
+    processed_at            TIMESTAMP NULL,
+    created_at              TIMESTAMP NULL,
+    updated_at              TIMESTAMP NULL,
+    deleted_at              TIMESTAMP NULL,             -- soft delete
+
+    FOREIGN KEY (owner_user_id) REFERENCES users(id) ON DELETE RESTRICT
+);
+```
+
+**Catatan keselamatan:**
+- `stored_audio_path` adalah path dalam private storage, bukan URL awam.
+- `transcript_text` disimpan dalam database. Untuk keselamatan lanjut, boleh encrypt menggunakan Laravel `encrypted` cast.
+- Admin **tidak** boleh SELECT `transcript_text`, `stored_audio_path` melalui policy/query scope.
+
+---
+
+### 4. `project_collaborators`
+
+```sql
+CREATE TABLE project_collaborators (
+    id          BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    project_id  BIGINT UNSIGNED NOT NULL,
+    user_id     BIGINT UNSIGNED NOT NULL,
+    role        ENUM('editor', 'viewer') NOT NULL DEFAULT 'editor',
+    added_by    BIGINT UNSIGNED NOT NULL,
+    created_at  TIMESTAMP NULL,
+    updated_at  TIMESTAMP NULL,
+
+    UNIQUE KEY unique_project_user (project_id, user_id),
+    FOREIGN KEY (project_id) REFERENCES transcription_projects(id) ON DELETE CASCADE,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+    FOREIGN KEY (added_by) REFERENCES users(id) ON DELETE RESTRICT
+);
+```
+
+---
+
+### 5. `transcript_versions`
+
+```sql
+CREATE TABLE transcript_versions (
+    id              BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    project_id      BIGINT UNSIGNED NOT NULL,
+    edited_by       BIGINT UNSIGNED NOT NULL,
+    version_number  INT UNSIGNED NOT NULL,
+    old_text        LONGTEXT NULL,
+    new_text        LONGTEXT NOT NULL,
+    change_summary  VARCHAR(500) NULL,
+    created_at      TIMESTAMP NULL,
+
+    FOREIGN KEY (project_id) REFERENCES transcription_projects(id) ON DELETE CASCADE,
+    FOREIGN KEY (edited_by) REFERENCES users(id) ON DELETE RESTRICT
+);
+```
+
+**Catatan:**
+- `old_text` dan `new_text` adalah snapshot penuh, bukan diff, untuk kemudahan restore.
+- Jangan masukkan `transcript_text` dalam `audit_logs`; gunakan jadual ini sebagai ganti.
+- Admin tidak boleh akses jadual ini.
+
+---
+
+### 6. `project_comments`
+
+```sql
+CREATE TABLE project_comments (
+    id          BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    project_id  BIGINT UNSIGNED NOT NULL,
+    user_id     BIGINT UNSIGNED NOT NULL,
+    message     TEXT NOT NULL,
+    created_at  TIMESTAMP NULL,
+    updated_at  TIMESTAMP NULL,
+    deleted_at  TIMESTAMP NULL,  -- soft delete
+
+    FOREIGN KEY (project_id) REFERENCES transcription_projects(id) ON DELETE CASCADE,
+    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE RESTRICT
+);
+```
+
+---
+
+### 7. `audit_logs`
+
+```sql
+CREATE TABLE audit_logs (
+    id              BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    actor_user_id   BIGINT UNSIGNED NULL,        -- NULL jika sistem/background job
+    actor_role      VARCHAR(50) NULL,
+    action          VARCHAR(100) NOT NULL,        -- e.g. 'user_deactivated'
+    subject_type    VARCHAR(100) NULL,            -- e.g. 'App\Models\User'
+    subject_id      BIGINT UNSIGNED NULL,
+    target_user_id  BIGINT UNSIGNED NULL,
+    project_id      BIGINT UNSIGNED NULL,
+    old_values      JSON NULL,                   -- JANGAN masukkan transcript content
+    new_values      JSON NULL,                   -- JANGAN masukkan transcript content
+    justification   TEXT NULL,
+    ip_address      VARCHAR(45) NULL,            -- support IPv6
+    user_agent      TEXT NULL,
+    created_at      TIMESTAMP NULL,
+
+    INDEX idx_actor (actor_user_id),
+    INDEX idx_action (action),
+    INDEX idx_project (project_id),
+    INDEX idx_created (created_at)
+);
+```
+
+**Tindakan yang diaudit:**
+
+| action | Penerangan |
+|---|---|
+| `user_created` | Admin daftar pengguna baru |
+| `user_deactivated` | Admin deactivate pengguna |
+| `user_reactivated` | Admin aktifkan semula pengguna |
+| `user_deleted` | Admin delete pengguna (hanya jika belum guna) |
+| `user_email_changed` | Admin tukar emel pengguna |
+| `project_created` | Pengguna cipta projek |
+| `audio_uploaded` | Pengguna muat naik audio |
+| `transcription_started` | Queue worker mula proses |
+| `transcription_completed` | Queue worker selesai |
+| `transcription_failed` | Queue worker gagal |
+| `transcript_updated` | Owner/collaborator edit teks |
+| `transcript_version_restored` | Restore versi lama |
+| `collaborator_added` | Owner tambah collaborator |
+| `collaborator_removed` | Owner buang collaborator |
+| `comment_created` | Pengguna buat komen |
+| `project_deleted` | Owner delete projek |
+| `project_owner_transferred` | Admin transfer ownership |
+
+---
+
+## Hubungan Model (Eloquent Relationships)
+
+```
+User
+  ├── hasMany: TranscriptionProject (as owner)
+  ├── belongsToMany: TranscriptionProject (through ProjectCollaborator)
+  ├── hasMany: TranscriptVersion (as editor)
+  ├── hasMany: ProjectComment
+  ├── belongsTo: Department
+  └── hasMany: AuditLog (as actor)
+
+TranscriptionProject
+  ├── belongsTo: User (owner)
+  ├── hasMany: ProjectCollaborator
+  ├── hasMany: TranscriptVersion
+  ├── hasMany: ProjectComment
+  └── belongsToMany: User (collaborators)
+
+Department
+  └── hasMany: User
+```
+
+---
+
+## Indeks Penting
+
+```sql
+-- Cari projek mengikut status (untuk admin dashboard)
+ALTER TABLE transcription_projects ADD INDEX idx_status (transcription_status);
+
+-- Cari projek mengikut owner
+ALTER TABLE transcription_projects ADD INDEX idx_owner (owner_user_id);
+
+-- Cari versi mengikut projek (timeline)
+ALTER TABLE transcript_versions ADD INDEX idx_project_version (project_id, version_number);
+
+-- Audit log search
+ALTER TABLE audit_logs ADD INDEX idx_target_user (target_user_id);
+ALTER TABLE audit_logs ADD INDEX idx_subject (subject_type, subject_id);
+```
+
+---
+
+## Nota Keselamatan Data
+
+1. **`transcript_text`** — Kolum sensitif. Boleh encrypt menggunakan Laravel cast `encrypted`:
+   ```php
+   protected $casts = [
+       'transcript_text' => 'encrypted',
+   ];
+   ```
+   Ini encrypt menggunakan `APP_KEY`. Pastikan `APP_KEY` disimpan dengan selamat.
+
+2. **`stored_audio_path`** — Simpan path relatif sahaja, bukan absolute path. Contoh: `transcriptions/abc-uuid/audio/recording.mp3`.
+
+3. **Audit log** — Jangan masukkan `transcript_text` dalam `old_values` atau `new_values`. Gunakan `transcript_versions` untuk simpan snapshot teks.
+
+4. **Soft delete** — `transcription_projects` dan `project_comments` menggunakan soft delete. Fail audio fizikal dikekalkan dalam private storage sehingga admin jalankan retention cleanup.
--- a/DEPLOYMENT.md
+++ b/DEPLOYMENT.md
@@ -0,0 +1,318 @@
+# DEPLOYMENT.md — Speech2Text MBIP
+
+## Keperluan Server
+
+| Komponen | Minimum | Disyorkan |
+|---|---|---|
+| OS | Ubuntu 22.04 LTS | Ubuntu 24.04 LTS |
+| CPU | 4 core | 8 core |
+| RAM | 8 GB | 16 GB |
+| Storage | 100 GB | 500 GB+ (untuk audio files) |
+| Docker | 24.x | Latest stable |
+| Docker Compose | 2.x | Latest stable |
+
+**Nota:** RAM tambahan diperlukan jika menggunakan Whisper model yang lebih besar (medium/large).
+
+---
+
+## Struktur Direktori Server
+
+```
+/svr/speech2text/
+├── .env                          # environment variables (JANGAN commit ke git)
+├── .env.example                  # template (commit ke git)
+├── docker-compose.yml            # development / staging
+├── docker-compose.prod.yml       # production override
+├── Dockerfile                    # Laravel app image
+├── docker/
+│   ├── nginx/
+│   │   └── default.conf
+│   ├── php/
+│   │   └── php.ini
+│   ├── supervisor/
+│   │   └── supervisord.conf
+│   └── transcription-worker/
+│       └── Dockerfile
+├── app/                          # Laravel source code
+│   ├── storage/
+│   │   └── app/
+│   │       └── private/          # fail audio (tidak accessible web)
+│   └── ...
+└── mysql-data/                   # MySQL data volume (auto-created)
+```
+
+---
+
+## Langkah Deployment Pertama Kali
+
+### 1. Persediaan Server
+
+```bash
+# Update server
+sudo apt update && sudo apt upgrade -y
+
+# Install Docker
+curl -fsSL https://get.docker.com | sh
+sudo usermod -aG docker $USER
+newgrp docker
+
+# Verify
+docker --version
+docker compose version
+```
+
+### 2. Clone Repository
+
+```bash
+sudo mkdir -p /svr/speech2text
+sudo chown $USER:$USER /svr/speech2text
+cd /svr/speech2text
+git clone <repo-url> .
+```
+
+### 3. Konfigurasi Environment
+
+```bash
+cp .env.example .env
+nano .env   # atau gunakan editor pilihan anda
+```
+
+Nilai wajib diisi dalam `.env`:
+
+```
+APP_KEY=                          # akan dijanakan kemudian
+DB_PASSWORD=<password-kuat>
+ADMIN_DEFAULT_NAME=<nama-admin>
+ADMIN_DEFAULT_EMAIL=<email-admin>
+ADMIN_DEFAULT_PASSWORD=<password-admin-kuat>
+```
+
+### 4. Build dan Jalankan Container
+
+```bash
+cd /svr/speech2text
+docker compose up -d --build
+```
+
+### 5. Setup Laravel
+
+```bash
+# Jana APP_KEY
+docker compose exec app php artisan key:generate
+
+# Jalankan migration dan seeder
+docker compose exec app php artisan migrate --seed
+
+# Set permission storage
+docker compose exec app chmod -R 775 storage bootstrap/cache
+docker compose exec app chown -R www-data:www-data storage bootstrap/cache
+```
+
+### 6. Verify Services
+
+```bash
+# Semak semua container berjalan
+docker compose ps
+
+# Semak logs
+docker compose logs -f app
+docker compose logs -f queue-worker
+docker compose logs -f transcription-worker
+
+# Semak queue worker
+docker compose exec app php artisan queue:monitor
+```
+
+---
+
+## Deployment Update (Selepas Push Kod Baru)
+
+```bash
+cd /svr/speech2text
+
+# Pull kod terbaru
+git pull origin main
+
+# Rebuild container jika ada perubahan Dockerfile
+docker compose up -d --build app
+
+# Atau restart tanpa rebuild jika hanya kod PHP berubah
+docker compose restart app queue-worker scheduler
+
+# Jalankan migration baru (jika ada)
+docker compose exec app php artisan migrate --force
+
+# Clear cache
+docker compose exec app php artisan config:cache
+docker compose exec app php artisan route:cache
+docker compose exec app php artisan view:cache
+
+# Restart queue worker untuk ambil kod baru
+docker compose restart queue-worker
+```
+
+---
+
+## Production Override (`docker-compose.prod.yml`)
+
+```bash
+# Jalankan dengan production config
+docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
+```
+
+---
+
+## Konfigurasi Nginx (Luar Docker — jika ada reverse proxy)
+
+Jika server ada Nginx luar Docker sebagai reverse proxy:
+
+```nginx
+server {
+    listen 443 ssl;
+    server_name speech2text.mbip.my;
+
+    ssl_certificate     /etc/ssl/certs/mbip.crt;
+    ssl_certificate_key /etc/ssl/private/mbip.key;
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;  # port Docker nginx
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;
+        client_max_body_size 210M;  # PRIVATE_AUDIO_MAX_MB + buffer
+    }
+}
+
+server {
+    listen 80;
+    server_name speech2text.mbip.my;
+    return 301 https://$host$request_uri;
+}
+```
+
+---
+
+## Backup
+
+### Database Backup
+
+```bash
+# Backup manual
+docker compose exec mysql mysqldump \
+    -u root -p$DB_PASSWORD \
+    speech2text > backup_$(date +%Y%m%d_%H%M%S).sql
+
+# Compress
+gzip backup_*.sql
+```
+
+### Storage Backup
+
+```bash
+# Backup fail audio (private storage)
+tar -czf audio_backup_$(date +%Y%m%d).tar.gz \
+    /svr/speech2text/app/storage/app/private/
+```
+
+### Automated Backup (crontab)
+
+```bash
+# Edit crontab
+crontab -e
+
+# Tambah:
+0 2 * * * cd /svr/speech2text && docker compose exec -T mysql \
+    mysqldump -u root -p$DB_PASSWORD speech2text | \
+    gzip > /backup/db/speech2text_$(date +\%Y\%m\%d).sql.gz
+```
+
+---
+
+## Monitoring
+
+```bash
+# Semak status container
+docker compose ps
+
+# Lihat penggunaan resource
+docker stats
+
+# Lihat logs real-time
+docker compose logs -f
+
+# Logs spesifik service
+docker compose logs -f queue-worker
+docker compose logs -f transcription-worker
+
+# Semak queue jobs pending
+docker compose exec app php artisan queue:monitor
+
+# Semak failed jobs
+docker compose exec app php artisan queue:failed
+```
+
+---
+
+## Troubleshooting
+
+### Container tidak start
+
+```bash
+docker compose logs <service-name>
+docker compose config  # semak syntax docker-compose.yml
+```
+
+### Transcription gagal
+
+```bash
+# Semak transcription worker
+docker compose logs transcription-worker
+
+# Test transcription worker secara manual
+docker compose exec app curl http://transcription-worker:8000/health
+
+# Retry failed jobs
+docker compose exec app php artisan queue:retry all
+```
+
+### Storage permission error
+
+```bash
+docker compose exec app chmod -R 775 storage bootstrap/cache
+docker compose exec app chown -R www-data:www-data storage
+```
+
+### Database migration error
+
+```bash
+# Semak status migration
+docker compose exec app php artisan migrate:status
+
+# Rollback jika perlu
+docker compose exec app php artisan migrate:rollback
+```
+
+---
+
+## Checklist Pre-Production
+
+- [ ] `APP_ENV=production`
+- [ ] `APP_DEBUG=false`
+- [ ] `APP_KEY` telah dijanakan dan disimpan dengan selamat
+- [ ] Database password kuat (minimum 16 karakter, alphanumeric + simbol)
+- [ ] HTTPS/TLS dikonfig
+- [ ] Firewall: hanya port 80/443 terbuka dari internet
+- [ ] Port 3306 (MySQL), 6379 (Redis), 8000 (transcription-worker) TIDAK terbuka dari internet
+- [ ] `.env` dalam `.gitignore`
+- [ ] `storage/app/private/` tidak accessible dari web
+- [ ] Backup berjalan secara automatik
+- [ ] Log rotation dikonfig
+- [ ] Admin default password ditukar selepas login pertama
+- [ ] Rate limiting aktif
+- [ ] Queue worker berjalan
+- [ ] Scheduler berjalan
+- [ ] Test upload audio berjaya
+- [ ] Test transcription berjaya
+- [ ] Test authorization (admin tidak dapat akses kandungan) lulus
--- a/52
+++ b/52
@@ -0,0 +1,52 @@
+FROM php:8.4-fpm
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    libpng-dev \
+    libonig-dev \
+    libxml2-dev \
+    libzip-dev \
+    zip \
+    unzip \
+    ffmpeg \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install PHP extensions
+RUN docker-php-ext-install \
+    pdo_mysql \
+    mbstring \
+    exif \
+    pcntl \
+    bcmath \
+    gd \
+    zip \
+    opcache
+
+# Install Redis extension
+RUN pecl install redis && docker-php-ext-enable redis
+
+# Install Composer
+COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
+
+# Set working directory
+WORKDIR /var/www/html
+
+# Copy application files
+COPY . .
+
+# Install PHP dependencies (production only)
+RUN composer install --optimize-autoloader --no-dev --no-interaction
+
+# Set permissions
+RUN chown -R www-data:www-data /var/www/html \
+    && chmod -R 755 /var/www/html/storage \
+    && chmod -R 755 /var/www/html/bootstrap/cache
+
+# Copy custom php.ini
+COPY docker/php/php.ini /usr/local/etc/php/conf.d/app.ini
+
+EXPOSE 9000
+
+CMD ["php-fpm"]
--- a/README.md
+++ b/README.md
@@ -0,0 +1,58 @@
+<p align="center"><a href="https://laravel.com" target="_blank"><img src="https://raw.githubusercontent.com/laravel/art/master/logo-lockup/5%20SVG/2%20CMYK/1%20Full%20Color/laravel-logolockup-cmyk-red.svg" width="400" alt="Laravel Logo"></a></p>
+
+<p align="center">
+<a href="https://github.com/laravel/framework/actions"><img src="https://github.com/laravel/framework/workflows/tests/badge.svg" alt="Build Status"></a>
+<a href="https://packagist.org/packages/laravel/framework"><img src="https://img.shields.io/packagist/dt/laravel/framework" alt="Total Downloads"></a>
+<a href="https://packagist.org/packages/laravel/framework"><img src="https://img.shields.io/packagist/v/laravel/framework" alt="Latest Stable Version"></a>
+<a href="https://packagist.org/packages/laravel/framework"><img src="https://img.shields.io/packagist/l/laravel/framework" alt="License"></a>
+</p>
+
+## About Laravel
+
+Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable and creative experience to be truly fulfilling. Laravel takes the pain out of development by easing common tasks used in many web projects, such as:
+
+- [Simple, fast routing engine](https://laravel.com/docs/routing).
+- [Powerful dependency injection container](https://laravel.com/docs/container).
+- Multiple back-ends for [session](https://laravel.com/docs/session) and [cache](https://laravel.com/docs/cache) storage.
+- Expressive, intuitive [database ORM](https://laravel.com/docs/eloquent).
+- Database agnostic [schema migrations](https://laravel.com/docs/migrations).
+- [Robust background job processing](https://laravel.com/docs/queues).
+- [Real-time event broadcasting](https://laravel.com/docs/broadcasting).
+
+Laravel is accessible, powerful, and provides tools required for large, robust applications.
+
+## Learning Laravel
+
+Laravel has the most extensive and thorough [documentation](https://laravel.com/docs) and video tutorial library of all modern web application frameworks, making it a breeze to get started with the framework.
+
+In addition, [Laracasts](https://laracasts.com) contains thousands of video tutorials on a range of topics including Laravel, modern PHP, unit testing, and JavaScript. Boost your skills by digging into our comprehensive video library.
+
+You can also watch bite-sized lessons with real-world projects on [Laravel Learn](https://laravel.com/learn), where you will be guided through building a Laravel application from scratch while learning PHP fundamentals.
+
+## Agentic Development
+
+Laravel's predictable structure and conventions make it ideal for AI coding agents like Claude Code, Cursor, and GitHub Copilot. Install [Laravel Boost](https://laravel.com/docs/ai) to supercharge your AI workflow:
+
+```bash
+composer require laravel/boost --dev
+
+php artisan boost:install
+```
+
+Boost provides your agent 15+ tools and skills that help agents build Laravel applications while following best practices.
+
+## Contributing
+
+Thank you for considering contributing to the Laravel framework! The contribution guide can be found in the [Laravel documentation](https://laravel.com/docs/contributions).
+
+## Code of Conduct
+
+In order to ensure that the Laravel community is welcoming to all, please review and abide by the [Code of Conduct](https://laravel.com/docs/contributions#code-of-conduct).
+
+## Security Vulnerabilities
+
+If you discover a security vulnerability within Laravel, please send an e-mail to Taylor Otwell via [taylor@laravel.com](mailto:taylor@laravel.com). All security vulnerabilities will be promptly addressed.
+
+## License
+
+The Laravel framework is open-sourced software licensed under the [MIT license](https://opensource.org/licenses/MIT).
--- a/SECURITY_MODEL.md
+++ b/SECURITY_MODEL.md
@@ -0,0 +1,277 @@
+# SECURITY_MODEL.md — Speech2Text MBIP
+
+## Prinsip Asas Keselamatan
+
+Sistem ini direka untuk menyimpan data sensitif kerajaan/PBT. Prinsip berikut mesti dipatuhi di setiap lapisan:
+
+1. **Privacy by Design** — Admin ialah pentadbir akaun, bukan pentadbir kandungan.
+2. **Defense in Depth** — Authorization dikuatkuasakan di Policy, Controller, Query, dan UI.
+3. **Least Privilege** — Setiap role hanya mendapat akses minimum yang diperlukan.
+4. **Audit Everything** — Semua tindakan sensitif direkodkan dengan lengkap.
+5. **No Cloud Egress** — Data tidak keluar dari Docker network.
+
+---
+
+## Model Kebenaran (Authorization)
+
+### Admin — APA yang BOLEH dan TIDAK BOLEH
+
+| Tindakan | Admin |
+|---|---|
+| Daftar pengguna baru | ✓ |
+| Lihat senarai pengguna | ✓ |
+| Activate/deactivate pengguna | ✓ |
+| Delete pengguna (belum guna) | ✓ |
+| Tukar emel pengguna | ✓ |
+| Lihat statistik penggunaan (tanpa kandungan) | ✓ |
+| Lihat metadata projek (tajuk, owner, status, saiz, tarikh) | ✓ |
+| Transfer ownership projek (dengan justifikasi) | ✓ |
+| Lihat audit log pentadbiran | ✓ |
+| **Dengar / download audio** | ✗ |
+| **Baca transcript** | ✗ |
+| **Lihat komen dalam projek** | ✗ |
+| **Masuk halaman detail projek (kandungan)** | ✗ |
+| **Edit transcript** | ✗ |
+
+### Owner (Pengguna Jabatan — pemilik projek)
+
+| Tindakan | Owner |
+|---|---|
+| Cipta projek | ✓ |
+| Upload audio | ✓ |
+| Lihat / dengar audio sendiri | ✓ |
+| Lihat / edit transcript sendiri | ✓ |
+| Tambah / buang collaborator | ✓ |
+| Delete projek / audio / teks | ✓ |
+| Retry transcription | ✓ |
+| Lihat versi history | ✓ |
+| Restore versi lama | ✓ |
+| Buat komen | ✓ |
+
+### Collaborator (Pengguna yang dikongsi projek)
+
+| Tindakan | Collaborator |
+|---|---|
+| Lihat projek yang dikongsi | ✓ |
+| Dengar audio asal | ✓ |
+| Lihat / edit transcript | ✓ |
+| Buat komen | ✓ |
+| Lihat versi history | ✓ |
+| Restore versi lama | ✓ |
+| **Delete projek / audio / teks** | ✗ |
+| **Transfer ownership** | ✗ |
+| **Urus collaborator lain** | ✗ |
+
+---
+
+## Laravel Policies
+
+### `TranscriptionProjectPolicy`
+
+```php
+// Setiap method semak sama ada user adalah owner ATAU collaborator
+// Admin sengaja TIDAK diberikan akses ke content
+
+view()         → owner ATAU collaborator (bukan admin)
+create()       → user aktif (bukan admin)
+update()       → owner ATAU collaborator
+delete()       → owner sahaja
+viewAudio()    → owner ATAU collaborator
+downloadAudio()→ owner ATAU collaborator
+retryTranscription() → owner sahaja
+manageCollaborators() → owner sahaja
+transferOwner()       → admin sahaja (metadata action, bukan content)
+viewMetadata()        → admin ATAU owner (metadata minimum sahaja untuk admin)
+```
+
+### `CommentPolicy`
+
+```php
+view()   → owner ATAU collaborator (bukan admin)
+create() → owner ATAU collaborator
+delete() → owner komen sendiri ATAU owner projek
+```
+
+### `TranscriptVersionPolicy`
+
+```php
+view()    → owner ATAU collaborator
+restore() → owner ATAU collaborator
+```
+
+### `UserPolicy`
+
+```php
+create()     → admin sahaja
+update()     → admin sahaja
+delete()     → admin sahaja (dengan semak tiada usage)
+activate()   → admin sahaja
+deactivate() → admin sahaja
+changeEmail()→ admin sahaja
+```
+
+---
+
+## Lapisan Keselamatan
+
+### L1: Authentication
+- Laravel Breeze/custom auth dengan session
+- `is_active` check di middleware `EnsureUserIsActive`
+- Rate limit login: 5 percubaan per minit per IP
+- Session expire: dikonfig dalam `.env`
+- CSRF protection aktif untuk semua form
+
+### L2: Authorization (Policy)
+- Setiap controller action wajib panggil `$this->authorize()`
+- Jangan rely pada UI hide/show sahaja
+- Gunakan `abort(403)` jika policy gagal
+
+### L3: Input Validation
+- Semua input melalui Form Request class
+- File upload: validate MIME type dari magic bytes (bukan extension sahaja)
+- Allowed audio types: `audio/mpeg`, `audio/wav`, `audio/mp4`, `audio/x-m4a`, `video/mp4`
+- Max file size: dikonfig `PRIVATE_AUDIO_MAX_MB` dalam `.env`
+- Rate limit upload: 10 upload per jam per user
+
+### L4: Storage Security
+- Fail audio **tidak** disimpan dalam `public/` atau `storage/app/public/`
+- Path simpan: `storage/app/private/transcriptions/{project_uuid}/audio/{filename}`
+- Semua akses audio melalui controller yang semak policy
+- Guna `Storage::disk('private')->get()` untuk stream audio
+- Response header `Content-Disposition: inline` untuk audio player
+- Response header `X-Content-Type-Options: nosniff`
+
+### L5: IDOR Prevention
+- Gunakan UUID dalam URL projek, bukan integer ID
+- Route: `/projects/{project:uuid}` bukan `/projects/{id}`
+- Policy semak ownership/collaborator, bukan hanya URL
+- Semua query pakai `where('owner_user_id', auth()->id())` atau policy scope
+
+### L6: Output Sanitization
+- Escape semua output Blade dengan `{{ }}` (bukan `{!! !!}`)
+- Sanitize comment sebelum display dengan `htmlspecialchars()`
+- Transcript display menggunakan `{{ }}` escape
+- Content-Security-Policy header via middleware
+
+### L7: Audit Trail
+- Semua tindakan sensitif log ke `audit_logs`
+- Log IP address dan user agent
+- Log nilai lama dan nilai baru (kecuali transcript content)
+- Audit log adalah append-only (tiada update/delete pada audit_logs)
+
+### L8: Admin Content Isolation
+```php
+// Middleware atau scope yang enforce admin tidak dapat content
+class AdminProjectScope {
+    public function apply($builder, $model) {
+        if (auth()->user()->role === 'admin') {
+            // Admin hanya dapat metadata sahaja
+            $builder->select([
+                'id', 'uuid', 'title', 'owner_user_id',
+                'transcription_status', 'created_at',
+                'file_size', 'duration_seconds', 'deleted_at'
+                // TIADA transcript_text, stored_audio_path
+            ]);
+        }
+    }
+}
+```
+
+---
+
+## Keselamatan Fail Audio
+
+### Upload Flow
+```
+1. Validate MIME type (magic bytes, bukan extension)
+2. Generate nama fail baru yang random (jangan guna nama asal)
+3. Simpan ke path private: transcriptions/{uuid}/audio/{random_name}.{ext}
+4. Simpan nama asal dalam database (original_filename)
+5. Jangan simpan path dalam session atau cookie
+```
+
+### Serve/Stream Audio
+```php
+// AudioController@stream
+public function stream(TranscriptionProject $project)
+{
+    $this->authorize('viewAudio', $project);
+
+    $path = $project->stored_audio_path;
+
+    // Verify file exists
+    abort_unless(Storage::disk('private')->exists($path), 404);
+
+    return response()->stream(function () use ($path) {
+        $stream = Storage::disk('private')->readStream($path);
+        fpassthru($stream);
+    }, 200, [
+        'Content-Type' => $project->mime_type,
+        'Content-Length' => Storage::disk('private')->size($path),
+        'Content-Disposition' => 'inline',
+        'Cache-Control' => 'no-store, no-cache, private',
+        'X-Content-Type-Options' => 'nosniff',
+    ]);
+}
+```
+
+---
+
+## Konfigurasi Security Header
+
+```php
+// middleware/SecurityHeaders.php
+'X-Frame-Options' => 'DENY',
+'X-XSS-Protection' => '1; mode=block',
+'X-Content-Type-Options' => 'nosniff',
+'Referrer-Policy' => 'strict-origin-when-cross-origin',
+'Content-Security-Policy' => "default-src 'self'; ..."
+```
+
+---
+
+## Enkripsi Data Sensitif
+
+### Transcript Text Encryption
+Gunakan Laravel `encrypted` cast untuk `transcript_text`:
+```php
+// Model TranscriptionProject
+protected $casts = [
+    'transcript_text' => 'encrypted',
+];
+```
+- Data dienkripsi menggunakan `APP_KEY` sebelum simpan dalam database.
+- Decrypt berlaku secara automatik apabila diakses melalui Eloquent.
+- Tanpa `APP_KEY`, data tidak boleh dibaca walaupun database dicuri.
+- **Penting:** Simpan `APP_KEY` dalam `.env` dan jangan commit ke git.
+
+---
+
+## Semakan Keselamatan Deployment
+
+Sebelum production, semak:
+
+- [ ] `APP_DEBUG=false`
+- [ ] `APP_ENV=production`
+- [ ] `.env` tidak dalam git repository (ada dalam `.gitignore`)
+- [ ] `APP_KEY` telah dijanakan (`php artisan key:generate`)
+- [ ] Database password kuat dan berbeza dari default
+- [ ] `storage/app/private/` tidak accessible dari web
+- [ ] Nginx tidak serve `storage/` secara direct
+- [ ] HTTPS/TLS aktif
+- [ ] Rate limiting dikonfig
+- [ ] Fail upload di luar `public_html`
+- [ ] `storage:link` hanya untuk assets (bukan audio/transcript)
+- [ ] Queue worker berjalan dengan user yang restricted
+- [ ] Transcription worker tidak accessible dari internet (internal only)
+- [ ] Ollama tidak accessible dari internet (internal only)
+
+---
+
+## Nota untuk Pentadbir Sistem
+
+1. **Backup `APP_KEY`** — Jika `APP_KEY` hilang, semua `transcript_text` yang dienkripsi tidak boleh dibaca.
+2. **Backup database secara berkala** — Termasuk `transcript_versions` yang menyimpan history.
+3. **Log rotation** — Pastikan `storage/logs/` dirotate supaya tidak penuh.
+4. **Retention policy** — Tentukan berapa lama fail audio disimpan selepas projek deleted.
+5. **Monitor disk space** — Audio files boleh membesar. Tetapkan alert.
--- a/TASK_PLAN.md
+++ b/TASK_PLAN.md
@@ -0,0 +1,342 @@
+# TASK_PLAN.md — Speech2Text MBIP
+
+## Ringkasan Fasa
+
+| Fasa | Fokus | Anggaran |
+|---|---|---|
+| Fasa 1 | Auth, Role, User Management, Docker | Asas wajib |
+| Fasa 2 | Project CRUD, Upload Audio, Collaborator, Policies | Storage + RBAC |
+| Fasa 3 | Queue, Transcription Worker, Status, Retry | AI Integration |
+| Fasa 4 | Transcript Editor, Version History, Comments | Content Features |
+| Fasa 5 | Admin Dashboard, Audit Log, Transfer Ownership | Admin Tools |
+| Fasa 6 | Security Hardening, Tests, README, Production Checklist | Quality |
+
+---
+
+## FASA 1: Asas — Auth, Role, User Management, Docker
+
+### Objektif
+Sistem boleh login, admin boleh urus pengguna, Docker berjalan.
+
+### Checklist Fasa 1
+
+#### 1.1 Struktur Projek Laravel
+- [ ] `laravel new speech2text-mbip` dengan PHP 8.3+
+- [ ] Konfigurasi `.env.example`
+- [ ] Setup `config/filesystems.php` — tambah private disk
+- [ ] Setup `config/auth.php`
+- [ ] Konfigurasi Laravel untuk UUID
+
+#### 1.2 Docker Setup
+- [ ] `Dockerfile` untuk Laravel app (php:8.3-fpm)
+- [ ] `docker-compose.yml` dengan services: app, nginx, mysql, redis, queue-worker, scheduler
+- [ ] `docker/nginx/default.conf`
+- [ ] `docker/php/php.ini`
+- [ ] `.dockerignore`
+- [ ] Test: `docker compose up -d --build`
+
+#### 1.3 Database — Migration Awal
+- [ ] Migration: `departments`
+- [ ] Migration: `users` (dengan `role`, `is_active`, `department_id`, `deleted_at`)
+- [ ] Migration: `audit_logs`
+- [ ] Migration: `sessions` (jika guna database session)
+
+#### 1.4 Models
+- [ ] `User` model (dengan SoftDeletes, role check methods)
+- [ ] `Department` model
+- [ ] `AuditLog` model
+
+#### 1.5 Authentication
+- [ ] Login form (Bootstrap 5)
+- [ ] Logout
+- [ ] Middleware `EnsureUserIsActive` — check `is_active` selepas login
+- [ ] Rate limit login (5 attempts/minute)
+- [ ] Redirect admin ke `/admin/dashboard`, user ke `/dashboard`
+
+#### 1.6 Role Middleware
+- [ ] Middleware `EnsureAdmin` — untuk route `/admin/*`
+- [ ] Middleware `EnsureUser` — untuk route `/dashboard/*`, `/projects/*`
+- [ ] Register middleware dalam `bootstrap/app.php`
+
+#### 1.7 Admin — User Management
+- [ ] `UserPolicy` — CRUD user oleh admin sahaja
+- [ ] `UserController` (Admin) dengan actions:
+  - `index` — senarai semua pengguna
+  - `create` / `store` — daftar pengguna baru
+  - `edit` / `update` — tukar emel pengguna
+  - `activate` — aktifkan pengguna
+  - `deactivate` — deactivate pengguna
+  - `destroy` — delete pengguna (hanya jika tiada usage)
+- [ ] Form Request: `CreateUserRequest`, `UpdateUserEmailRequest`
+- [ ] Views (Bootstrap 5): senarai pengguna, form cipta, form edit emel
+- [ ] Action classes: `CreateUserAction`, `DeactivateUserAction`, `ActivateUserAction`, `DeleteUserAction`, `ChangeUserEmailAction`
+
+#### 1.8 Audit Log Service
+- [ ] `AuditLogService` dengan method `log()`
+- [ ] Panggil AuditLogService dalam setiap action yang relevan
+- [ ] Rekodkan: actor, action, target, old_values, new_values, ip, user_agent, justification
+
+#### 1.9 Seeder
+- [ ] `DepartmentSeeder` — beberapa jabatan contoh
+- [ ] `AdminUserSeeder` — admin dari `.env` variables
+- [ ] `DatabaseSeeder` — panggil semua seeders
+
+#### 1.10 Admin Dashboard (Asas)
+- [ ] Dashboard route `/admin/dashboard`
+- [ ] Layout admin (Bootstrap 5 sidebar)
+- [ ] Papar: jumlah pengguna aktif, jumlah pengguna deactive
+
+### Arahan Test Fasa 1
+
+```bash
+# Build dan jalankan
+cd /svr/speech2text
+docker compose up -d --build
+
+# Setup
+docker compose exec app php artisan key:generate
+docker compose exec app php artisan migrate --seed
+
+# Semak
+docker compose exec app php artisan migrate:status
+docker compose exec app php artisan route:list
+
+# Test manual:
+# 1. Buka browser http://localhost
+# 2. Login sebagai admin (dari .env)
+# 3. Admin redirect ke /admin/dashboard
+# 4. Admin boleh lihat senarai pengguna
+# 5. Admin boleh daftar pengguna baru
+# 6. Admin boleh deactivate pengguna
+# 7. Pengguna deactivated tidak boleh login
+# 8. Admin boleh activate semula
+# 9. Admin boleh tukar emel
+# 10. Semak audit_logs ada rekod untuk setiap tindakan
+# 11. Login sebagai pengguna biasa -> redirect /dashboard
+# 12. Pengguna biasa tidak boleh akses /admin/*
+```
+
+---
+
+## FASA 2: Project CRUD, Upload Audio, Collaborator, Policies
+
+### Checklist Fasa 2
+
+#### 2.1 Migration
+- [ ] `transcription_projects`
+- [ ] `project_collaborators`
+
+#### 2.2 Models & Relationships
+- [ ] `TranscriptionProject` (dengan UUID, SoftDeletes)
+- [ ] `ProjectCollaborator`
+- [ ] Relationships dalam `User` model
+
+#### 2.3 Policies
+- [ ] `TranscriptionProjectPolicy` — view, create, update, delete, viewAudio, manageCollaborators
+- [ ] Register policies dalam `AuthServiceProvider`
+
+#### 2.4 File Upload
+- [ ] Konfigurasi private disk dalam `config/filesystems.php`
+- [ ] Form Request: `UploadAudioRequest` (validate MIME, size)
+- [ ] `StorageService` — handle private file storage
+- [ ] AudioController — stream audio melalui policy check
+
+#### 2.5 Project Controllers
+- [ ] `ProjectController` (User) — CRUD projek
+- [ ] `AudioController` (User) — stream/download audio
+- [ ] `CollaboratorController` (User) — tambah/buang collaborator
+
+#### 2.6 Views
+- [ ] Project list (dashboard)
+- [ ] Create project + upload audio form
+- [ ] Project detail (placeholder transcript area)
+- [ ] Collaborator management panel
+
+### Arahan Test Fasa 2
+
+```bash
+# Test manual:
+# 1. Login sebagai user biasa
+# 2. Cipta projek baru dengan upload audio
+# 3. Semak fail ada dalam storage/app/private/ (bukan public/)
+# 4. Dengar audio dalam browser (via controller stream)
+# 5. Tambah collaborator
+# 6. Login sebagai collaborator — boleh lihat projek
+# 7. Login sebagai user lain (bukan collaborator) — 403
+# 8. Login sebagai admin — tidak boleh dengar audio (403)
+# 9. Admin hanya boleh lihat metadata projek
+```
+
+---
+
+## FASA 3: Queue, Transcription Worker, Status, Retry
+
+### Checklist Fasa 3
+
+#### 3.1 Transcription Worker (Python)
+- [ ] `docker/transcription-worker/Dockerfile` (Python 3.11 + faster-whisper)
+- [ ] `docker/transcription-worker/main.py` (FastAPI endpoint `/transcribe`)
+- [ ] `/health` endpoint untuk monitoring
+- [ ] Tambah service ke `docker-compose.yml`
+
+#### 3.2 Laravel Queue Job
+- [ ] `TranscribeAudioJob` — baca audio, hantar ke Python worker, simpan result
+- [ ] Handle timeout dan retry
+- [ ] Update `transcription_status` di database
+
+#### 3.3 Ollama Integration (Optional)
+- [ ] `OllamaService` — panggil Ollama API untuk post-processing
+- [ ] `OllamaPostProcessJob` — dispatch selepas transcription selesai
+- [ ] Config via `.env`: `OLLAMA_ENABLED`, `OLLAMA_BASE_URL`, `OLLAMA_MODEL`
+
+#### 3.4 UI Status
+- [ ] Status badge dalam project detail (pending/processing/completed/failed)
+- [ ] Auto-refresh status menggunakan polling atau SSE
+- [ ] Retry button untuk failed transcription (owner sahaja)
+
+### Arahan Test Fasa 3
+
+```bash
+# Semak transcription worker
+docker compose logs -f transcription-worker
+docker compose exec app curl http://transcription-worker:8000/health
+
+# Upload audio dan monitor
+docker compose logs -f queue-worker
+docker compose exec app php artisan queue:work --once
+
+# Semak result dalam database
+docker compose exec mysql mysql -u root -p speech2text \
+    -e "SELECT id, title, transcription_status, transcript_text FROM transcription_projects LIMIT 5;"
+```
+
+---
+
+## FASA 4: Transcript Editor, Version History, Comments
+
+### Checklist Fasa 4
+
+#### 4.1 Migration
+- [ ] `transcript_versions`
+- [ ] `project_comments`
+
+#### 4.2 Models
+- [ ] `TranscriptVersion`
+- [ ] `ProjectComment` (dengan SoftDeletes)
+
+#### 4.3 Policies
+- [ ] `TranscriptVersionPolicy`
+- [ ] `CommentPolicy`
+
+#### 4.4 Controllers & Actions
+- [ ] `TranscriptController` — view dan update transcript
+- [ ] `TranscriptVersionController` — lihat history, restore
+- [ ] `CommentController` — CRUD komen
+
+#### 4.5 Views
+- [ ] Transcript editor (textarea, save button)
+- [ ] Version history timeline
+- [ ] Restore version button
+- [ ] Comment/chat panel (sidebar atau bawah transcript)
+
+### Arahan Test Fasa 4
+
+```bash
+# Test:
+# 1. Edit transcript — semak transcript_versions ada rekod baru
+# 2. Edit kedua kali — semak version_number bertambah
+# 3. Restore version lama — semak transcript_text dikemaskini
+# 4. Collaborator boleh edit transcript
+# 5. Admin tidak boleh akses transcript editor (403)
+# 6. Buat komen
+# 7. Admin tidak boleh lihat komen (403)
+```
+
+---
+
+## FASA 5: Admin Dashboard, Audit Log, Transfer Ownership
+
+### Checklist Fasa 5
+
+#### 5.1 Admin Dashboard Lengkap
+- [ ] Statistik pengguna (aktif/deactivate)
+- [ ] Statistik projek (pending/processing/completed/failed)
+- [ ] Statistik storage
+- [ ] Top users by usage
+- [ ] Chart harian/bulanan (jQuery chart library)
+
+#### 5.2 Admin Project Metadata List
+- [ ] Senarai projek dengan metadata sahaja (TANPA transcript_text)
+- [ ] Filter: status, tarikh, owner
+- [ ] Pagination
+
+#### 5.3 Transfer Ownership
+- [ ] Form transfer ownership dengan justification field
+- [ ] `TransferProjectOwnerAction`
+- [ ] Option: jadikan owner lama sebagai collaborator
+- [ ] Audit log untuk transfer
+
+#### 5.4 Audit Log Browser
+- [ ] Senarai audit log dengan filter
+- [ ] Filter: action, actor, tarikh, projek
+- [ ] Pagination
+- [ ] Export CSV (admin sahaja)
+
+### Arahan Test Fasa 5
+
+```bash
+# Test:
+# 1. Admin lihat dashboard dengan statistik
+# 2. Admin transfer ownership — semak audit log ada justifikasi
+# 3. Selepas transfer, owner baru boleh akses projek
+# 4. Owner lama (jika dijadikan collaborator) boleh akses
+# 5. Admin browse audit log — semak semua rekod ada
+```
+
+---
+
+## FASA 6: Security Hardening, Tests, README, Production
+
+### Checklist Fasa 6
+
+#### 6.1 Feature Tests
+- [ ] `AdminCannotViewTranscriptTest`
+- [ ] `AdminCannotDownloadAudioTest`
+- [ ] `OwnerCanAccessOwnProjectTest`
+- [ ] `CollaboratorCanAccessSharedProjectTest`
+- [ ] `NonCollaboratorCannotAccessProjectTest`
+- [ ] `OnlyOwnerCanDeleteProjectTest`
+- [ ] `CollaboratorCanEditTranscriptTest`
+- [ ] `TranscriptEditCreatesVersionHistoryTest`
+- [ ] `AdminTransferOwnershipRequiresJustificationTest`
+- [ ] `DeactivateUserPreventsLoginTest`
+- [ ] `DeleteUnusedUserOnlyAllowedTest`
+- [ ] `EmailChangeCreatesAuditLogTest`
+
+#### 6.2 Security Hardening
+- [ ] Security headers middleware
+- [ ] Rate limiting semua endpoint sensitif
+- [ ] Validate MIME type dari magic bytes
+- [ ] Semak semua `{{ }}` dalam Blade (bukan `{!! !!}`)
+- [ ] Semak CSRF token semua form
+- [ ] Remove debug routes
+
+#### 6.3 Production Checklist
+- [ ] Semua item dalam `DEPLOYMENT.md` production checklist
+- [ ] `APP_DEBUG=false` di production
+- [ ] Config cache, route cache, view cache
+- [ ] Queue supervisor setup
+
+#### 6.4 Documentation
+- [ ] README.md utama
+- [ ] Arahan deployment
+- [ ] Arahan development local
+
+---
+
+## Peringatan Penting
+
+> **Prinsip Privasi:**
+> Admin = pentadbir AKAUN, bukan pentadbir KANDUNGAN.
+> Setiap fasa mesti pastikan admin tidak boleh akses audio, transcript, atau komen.
+> Semak dengan feature test sebelum anggap selesai.
--- a/app/Actions/ActivateUserAction.php
+++ b/app/Actions/ActivateUserAction.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\User;
+use App\Services\AuditLogService;
+
+class ActivateUserAction
+{
+    public function __construct(private readonly AuditLogService $audit) {}
+
+    public function execute(User $user): void
+    {
+        $user->update(['is_active' => true]);
+
+        $this->audit->log('user_reactivated', [
+            'subject_type'   => User::class,
+            'subject_id'     => $user->id,
+            'target_user_id' => $user->id,
+            'old_values'     => ['is_active' => false],
+            'new_values'     => ['is_active' => true],
+        ]);
+    }
+}
--- a/app/Actions/ChangeUserEmailAction.php
+++ b/app/Actions/ChangeUserEmailAction.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\User;
+use App\Services\AuditLogService;
+
+class ChangeUserEmailAction
+{
+    public function __construct(private readonly AuditLogService $audit) {}
+
+    public function execute(User $user, string $newEmail, ?string $justification = null): void
+    {
+        $oldEmail = $user->email;
+
+        $user->update([
+            'email'             => $newEmail,
+            'email_verified_at' => null,
+        ]);
+
+        $this->audit->log('user_email_changed', [
+            'subject_type'   => User::class,
+            'subject_id'     => $user->id,
+            'target_user_id' => $user->id,
+            'old_values'     => ['email' => $oldEmail],
+            'new_values'     => ['email' => $newEmail],
+            'justification'  => $justification,
+        ]);
+    }
+}
--- a/app/Actions/CreateUserAction.php
+++ b/app/Actions/CreateUserAction.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\User;
+use App\Services\AuditLogService;
+
+class CreateUserAction
+{
+    public function __construct(private readonly AuditLogService $audit) {}
+
+    public function execute(array $data): User
+    {
+        $user = User::create([
+            'name'          => $data['name'],
+            'email'         => $data['email'],
+            'password'      => $data['password'],
+            'role'          => $data['role'] ?? 'user',
+            'department_id' => $data['department_id'] ?? null,
+            'is_active'     => true,
+        ]);
+
+        $this->audit->log('user_created', [
+            'subject_type'   => User::class,
+            'subject_id'     => $user->id,
+            'target_user_id' => $user->id,
+            'new_values'     => [
+                'name'          => $user->name,
+                'email'         => $user->email,
+                'role'          => $user->role,
+                'department_id' => $user->department_id,
+            ],
+        ]);
+
+        return $user;
+    }
+}
--- a/app/Actions/DeactivateUserAction.php
+++ b/app/Actions/DeactivateUserAction.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\User;
+use App\Services\AuditLogService;
+
+class DeactivateUserAction
+{
+    public function __construct(private readonly AuditLogService $audit) {}
+
+    public function execute(User $user, ?string $justification = null): void
+    {
+        $user->update(['is_active' => false]);
+
+        // Invalidate all sessions for this user
+        \DB::table('sessions')->where('user_id', $user->id)->delete();
+
+        $this->audit->log('user_deactivated', [
+            'subject_type'   => User::class,
+            'subject_id'     => $user->id,
+            'target_user_id' => $user->id,
+            'old_values'     => ['is_active' => true],
+            'new_values'     => ['is_active' => false],
+            'justification'  => $justification,
+        ]);
+    }
+}
--- a/app/Actions/DeleteUserAction.php
+++ b/app/Actions/DeleteUserAction.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\User;
+use App\Services\AuditLogService;
+use Illuminate\Validation\ValidationException;
+
+class DeleteUserAction
+{
+    public function __construct(private readonly AuditLogService $audit) {}
+
+    public function execute(User $user, ?string $justification = null): void
+    {
+        if ($user->hasUsage()) {
+            throw ValidationException::withMessages([
+                'user' => 'Pengguna ini tidak boleh dipadam kerana telah menggunakan sistem. Gunakan deactivate.',
+            ]);
+        }
+
+        $userData = [
+            'name'  => $user->name,
+            'email' => $user->email,
+            'role'  => $user->role,
+        ];
+
+        $this->audit->log('user_deleted', [
+            'subject_type'   => User::class,
+            'subject_id'     => $user->id,
+            'target_user_id' => $user->id,
+            'old_values'     => $userData,
+            'justification'  => $justification,
+        ]);
+
+        $user->forceDelete();
+    }
+}
--- a/app/Actions/TransferOwnershipAction.php
+++ b/app/Actions/TransferOwnershipAction.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Actions;
+
+use App\Models\TranscriptionProject;
+use App\Models\User;
+use App\Services\AuditLogService;
+
+class TransferOwnershipAction
+{
+    public function __construct(private readonly AuditLogService $audit) {}
+
+    public function execute(TranscriptionProject $project, User $newOwner, string $justification): void
+    {
+        $oldOwner = $project->owner;
+
+        $project->update(['owner_user_id' => $newOwner->id]);
+
+        $this->audit->log('project_ownership_transferred', [
+            'subject_type'   => TranscriptionProject::class,
+            'subject_id'     => $project->id,
+            'project_id'     => $project->id,
+            'target_user_id' => $newOwner->id,
+            'old_values'     => [
+                'owner_user_id' => $oldOwner?->id,
+                'owner_name'    => $oldOwner?->name,
+            ],
+            'new_values'     => [
+                'owner_user_id' => $newOwner->id,
+                'owner_name'    => $newOwner->name,
+            ],
+            'justification'  => $justification,
+        ]);
+    }
+}
--- a/app/Http/Controllers/Admin/AuditLogController.php
+++ b/app/Http/Controllers/Admin/AuditLogController.php
@@ -0,0 +1,89 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
+use App\Models\User;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Illuminate\View\View;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class AuditLogController extends Controller
+{
+    public function index(Request $request): View
+    {
+        $logs = AuditLog::with(['actor', 'targetUser'])
+            ->when($request->action, fn ($q, $a) => $q->where('action', $a))
+            ->when($request->actor_id, fn ($q, $id) => $q->where('actor_user_id', $id))
+            ->when($request->target_id, fn ($q, $id) => $q->where('target_user_id', $id))
+            ->when($request->date_from, fn ($q, $d) => $q->whereDate('created_at', '>=', $d))
+            ->when($request->date_to, fn ($q, $d) => $q->whereDate('created_at', '<=', $d))
+            ->when($request->search, fn ($q, $s) =>
+                $q->where('action', 'like', "%{$s}%")
+                  ->orWhere('justification', 'like', "%{$s}%")
+                  ->orWhere('ip_address', 'like', "%{$s}%")
+            )
+            ->orderByDesc('created_at')
+            ->paginate(30)
+            ->withQueryString();
+
+        $actions = AuditLog::select('action')->distinct()->pluck('action')->sort()->values();
+        $admins  = User::where('role', 'admin')->orderBy('name')->get(['id', 'name']);
+
+        return view('admin.audit-logs.index', compact('logs', 'actions', 'admins'));
+    }
+
+    public function export(Request $request): StreamedResponse
+    {
+        $query = AuditLog::with(['actor', 'targetUser'])
+            ->when($request->action, fn ($q, $a) => $q->where('action', $a))
+            ->when($request->actor_id, fn ($q, $id) => $q->where('actor_user_id', $id))
+            ->when($request->target_id, fn ($q, $id) => $q->where('target_user_id', $id))
+            ->when($request->date_from, fn ($q, $d) => $q->whereDate('created_at', '>=', $d))
+            ->when($request->date_to, fn ($q, $d) => $q->whereDate('created_at', '<=', $d))
+            ->when($request->search, fn ($q, $s) =>
+                $q->where('action', 'like', "%{$s}%")
+                  ->orWhere('justification', 'like', "%{$s}%")
+                  ->orWhere('ip_address', 'like', "%{$s}%")
+            )
+            ->orderByDesc('created_at');
+
+        $filename = 'audit-log-' . now()->format('Ymd-His') . '.csv';
+
+        return response()->streamDownload(function () use ($query) {
+            $handle = fopen('php://output', 'w');
+
+            // UTF-8 BOM untuk Excel
+            fwrite($handle, "\xEF\xBB\xBF");
+
+            fputcsv($handle, [
+                'Masa', 'Oleh', 'Peranan', 'Tindakan',
+                'Sasaran', 'Projek ID', 'IP', 'Justifikasi',
+            ]);
+
+            $query->chunk(500, function ($logs) use ($handle) {
+                foreach ($logs as $log) {
+                    fputcsv($handle, [
+                        $log->created_at?->format('d/m/Y H:i:s'),
+                        $log->actor?->name ?? 'Sistem',
+                        $log->actor_role ?? '',
+                        $log->action,
+                        $log->targetUser?->name ?? ($log->subject_type
+                            ? class_basename($log->subject_type) . '#' . $log->subject_id
+                            : ''),
+                        $log->project_id ?? '',
+                        $log->ip_address ?? '',
+                        $log->justification ?? '',
+                    ]);
+                }
+            });
+
+            fclose($handle);
+        }, $filename, [
+            'Content-Type'        => 'text/csv; charset=UTF-8',
+            'Content-Disposition' => "attachment; filename=\"{$filename}\"",
+        ]);
+    }
+}
--- a/app/Http/Controllers/Admin/DashboardController.php
+++ b/app/Http/Controllers/Admin/DashboardController.php
@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\Department;
+use App\Models\TranscriptionProject;
+use App\Models\User;
+use Illuminate\Support\Facades\DB;
+use Illuminate\View\View;
+
+class DashboardController extends Controller
+{
+    public function index(): View
+    {
+        $stats = [
+            'users_active'            => User::where('is_active', true)->where('role', 'user')->count(),
+            'users_inactive'          => User::where('is_active', false)->where('role', 'user')->count(),
+            'users_total'             => User::where('role', 'user')->count(),
+            'projects_total'          => TranscriptionProject::count(),
+            'projects_pending'        => TranscriptionProject::where('transcription_status', 'pending')->count(),
+            'projects_processing'     => TranscriptionProject::where('transcription_status', 'processing')->count(),
+            'projects_completed'      => TranscriptionProject::where('transcription_status', 'completed')->count(),
+            'projects_failed'         => TranscriptionProject::where('transcription_status', 'failed')->count(),
+            'projects_deleted'        => TranscriptionProject::onlyTrashed()->count(),
+            'projects_last_7'         => TranscriptionProject::where('created_at', '>=', now()->subDays(7))->count(),
+            'projects_last_30'        => TranscriptionProject::where('created_at', '>=', now()->subDays(30))->count(),
+            'storage_bytes'           => (int) TranscriptionProject::sum('file_size'),
+            'storage_completed_bytes' => (int) TranscriptionProject::where('transcription_status', 'completed')->sum('file_size'),
+            'duration_total_seconds'  => (int) TranscriptionProject::whereNotNull('duration_seconds')->sum('duration_seconds'),
+        ];
+
+        // Top 5 pengguna paling aktif (by project count)
+        $topUsers = User::where('role', 'user')
+            ->withCount('ownedProjects')
+            ->orderByDesc('owned_projects_count')
+            ->limit(5)
+            ->get(['id', 'name', 'email']);
+
+        // Trend projek 30 hari lepas (group by date)
+        $trendRaw = TranscriptionProject::select(
+                DB::raw('DATE(created_at) as date'),
+                DB::raw('COUNT(*) as total'),
+                DB::raw('SUM(CASE WHEN transcription_status = "completed" THEN 1 ELSE 0 END) as completed'),
+                DB::raw('SUM(CASE WHEN transcription_status = "failed" THEN 1 ELSE 0 END) as failed')
+            )
+            ->where('created_at', '>=', now()->subDays(29)->startOfDay())
+            ->groupBy(DB::raw('DATE(created_at)'))
+            ->orderBy('date')
+            ->get();
+
+        // Projek mengikut jabatan (metadata sahaja)
+        $deptStats = Department::select('departments.name')
+            ->selectRaw('COUNT(tp.id) as project_count')
+            ->leftJoin('users', 'users.department_id', '=', 'departments.id')
+            ->leftJoin('transcription_projects as tp', 'tp.owner_user_id', '=', 'users.id')
+            ->where('departments.is_active', true)
+            ->groupBy('departments.id', 'departments.name')
+            ->orderByDesc('project_count')
+            ->limit(8)
+            ->get();
+
+        return view('admin.dashboard', compact('stats', 'topUsers', 'trendRaw', 'deptStats'));
+    }
+}
--- a/app/Http/Controllers/Admin/ProjectMetadataController.php
+++ b/app/Http/Controllers/Admin/ProjectMetadataController.php
@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Actions\TransferOwnershipAction;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Admin\TransferOwnershipRequest;
+use App\Models\TranscriptionProject;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+
+class ProjectMetadataController extends Controller
+{
+    public function index(Request $request): View
+    {
+        // Admin hanya mendapat metadata — tiada transcript_text, tiada stored_audio_path
+        $projects = TranscriptionProject::withTrashed()
+            ->with(['owner:id,name,email', 'projectCollaborators'])
+            ->select([
+                'id', 'uuid', 'title', 'owner_user_id',
+                'transcription_status', 'transcription_engine',
+                'file_size', 'duration_seconds',
+                'language',
+                'created_at', 'deleted_at',
+                // Sengaja TIDAK ambil: transcript_text, stored_audio_path
+            ])
+            ->when($request->status, fn ($q, $s) => $q->where('transcription_status', $s))
+            ->when($request->search, fn ($q, $s) =>
+                $q->where('title', 'like', "%{$s}%")
+            )
+            ->when($request->owner_id, fn ($q, $id) => $q->where('owner_user_id', $id))
+            ->orderByDesc('created_at')
+            ->paginate(25)
+            ->withQueryString();
+
+        $owners = User::where('role', 'user')
+            ->where('is_active', true)
+            ->orderBy('name')
+            ->get(['id', 'name']);
+
+        return view('admin.projects.index', compact('projects', 'owners'));
+    }
+
+    public function transferOwner(
+        TransferOwnershipRequest $request,
+        TranscriptionProject $project,
+        TransferOwnershipAction $action
+    ): RedirectResponse {
+        $this->authorize('transferOwner', $project);
+
+        $newOwner = User::findOrFail($request->new_owner_id);
+
+        // Pastikan pemilik baru adalah pengguna aktif (bukan admin)
+        abort_if($newOwner->isAdmin(), 403, 'Admin tidak boleh menjadi pemilik projek.');
+        abort_if(! $newOwner->isActive(), 422, 'Pengguna tidak aktif tidak boleh menerima pemindahan projek.');
+        abort_if($project->owner_user_id === $newOwner->id, 422, 'Projek sudah dimiliki oleh pengguna ini.');
+
+        $action->execute($project, $newOwner, $request->justification);
+
+        return redirect()->route('admin.projects.index')
+            ->with('success', "Pemilikan projek \"{$project->title}\" berjaya dipindahkan kepada {$newOwner->name}.");
+    }
+}
--- a/app/Http/Controllers/Admin/UserController.php
+++ b/app/Http/Controllers/Admin/UserController.php
@@ -0,0 +1,106 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Actions\ActivateUserAction;
+use App\Actions\ChangeUserEmailAction;
+use App\Actions\CreateUserAction;
+use App\Actions\DeactivateUserAction;
+use App\Actions\DeleteUserAction;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Admin\CreateUserRequest;
+use App\Http\Requests\Admin\UpdateUserEmailRequest;
+use App\Models\Department;
+use App\Models\User;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+
+class UserController extends Controller
+{
+    public function index(Request $request): View
+    {
+        $this->authorize('viewAny', User::class);
+
+        $users = User::with('department')
+            ->where('role', 'user')
+            ->when($request->search, fn ($q, $s) =>
+                $q->where('name', 'like', "%{$s}%")
+                  ->orWhere('email', 'like', "%{$s}%")
+            )
+            ->when($request->status, fn ($q, $s) =>
+                $q->where('is_active', $s === 'active')
+            )
+            ->orderBy('name')
+            ->paginate(20)
+            ->withQueryString();
+
+        return view('admin.users.index', compact('users'));
+    }
+
+    public function create(): View
+    {
+        $this->authorize('create', User::class);
+
+        $departments = Department::where('is_active', true)->orderBy('name')->get();
+
+        return view('admin.users.create', compact('departments'));
+    }
+
+    public function store(CreateUserRequest $request, CreateUserAction $action): RedirectResponse
+    {
+        $action->execute($request->validated());
+
+        return redirect()->route('admin.users.index')
+            ->with('success', 'Pengguna berjaya didaftarkan.');
+    }
+
+    public function edit(User $user): View
+    {
+        $this->authorize('changeEmail', $user);
+
+        $departments = Department::where('is_active', true)->orderBy('name')->get();
+
+        return view('admin.users.edit', compact('user', 'departments'));
+    }
+
+    public function updateEmail(UpdateUserEmailRequest $request, User $user, ChangeUserEmailAction $action): RedirectResponse
+    {
+        $this->authorize('changeEmail', $user);
+
+        $action->execute($user, $request->email, $request->justification);
+
+        return redirect()->route('admin.users.index')
+            ->with('success', "E-mel pengguna {$user->name} berjaya dikemaskini.");
+    }
+
+    public function activate(Request $request, User $user, ActivateUserAction $action): RedirectResponse
+    {
+        $this->authorize('activate', $user);
+
+        $action->execute($user);
+
+        return redirect()->route('admin.users.index')
+            ->with('success', "Akaun {$user->name} berjaya diaktifkan.");
+    }
+
+    public function deactivate(Request $request, User $user, DeactivateUserAction $action): RedirectResponse
+    {
+        $this->authorize('deactivate', $user);
+
+        $action->execute($user, $request->justification);
+
+        return redirect()->route('admin.users.index')
+            ->with('success', "Akaun {$user->name} berjaya dinyahaktifkan.");
+    }
+
+    public function destroy(Request $request, User $user, DeleteUserAction $action): RedirectResponse
+    {
+        $this->authorize('delete', $user);
+
+        $action->execute($user, $request->justification);
+
+        return redirect()->route('admin.users.index')
+            ->with('success', "Pengguna {$user->name} berjaya dipadam.");
+    }
+}
--- a/app/Http/Controllers/Auth/AuthenticatedSessionController.php
+++ b/app/Http/Controllers/Auth/AuthenticatedSessionController.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Auth\LoginRequest;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+class AuthenticatedSessionController extends Controller
+{
+    public function create(): View
+    {
+        return view('auth.login');
+    }
+
+    public function store(LoginRequest $request): RedirectResponse
+    {
+        $request->authenticate();
+
+        $request->session()->regenerate();
+
+        $user = Auth::user();
+
+        // Semak is_active selepas login berjaya
+        if (! $user->is_active) {
+            Auth::logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            return back()->withErrors([
+                'email' => 'Akaun anda telah dinyahaktifkan. Sila hubungi pentadbir.',
+            ]);
+        }
+
+        // Update last login
+        $user->update(['last_login_at' => now()]);
+
+        // Redirect mengikut role
+        if ($user->isAdmin()) {
+            return redirect()->intended(route('admin.dashboard'));
+        }
+
+        return redirect()->intended(route('user.dashboard'));
+    }
+
+    public function destroy(Request $request): RedirectResponse
+    {
+        Auth::logout();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('login');
+    }
+}
--- a/app/Http/Controllers/Controller.php
+++ b/app/Http/Controllers/Controller.php
@@ -0,0 +1,13 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Foundation\Bus\DispatchesJobs;
+use Illuminate\Foundation\Validation\ValidatesRequests;
+use Illuminate\Routing\Controller as BaseController;
+
+abstract class Controller extends BaseController
+{
+    use AuthorizesRequests, DispatchesJobs, ValidatesRequests;
+}
--- a/app/Http/Controllers/User/AudioController.php
+++ b/app/Http/Controllers/User/AudioController.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Http\Controllers\User;
+
+use App\Http\Controllers\Controller;
+use App\Models\TranscriptionProject;
+use App\Services\StorageService;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class AudioController extends Controller
+{
+    public function __construct(private readonly StorageService $storage) {}
+
+    public function stream(TranscriptionProject $project): StreamedResponse
+    {
+        $this->authorize('viewAudio', $project);
+
+        $path = $project->stored_audio_path;
+
+        abort_unless($this->storage->exists($path), 404);
+
+        $size     = $this->storage->size($path);
+        $mimeType = $project->mime_type;
+
+        return response()->stream(function () use ($path) {
+            $stream = $this->storage->readStream($path);
+            if ($stream) {
+                fpassthru($stream);
+                fclose($stream);
+            }
+        }, 200, [
+            'Content-Type'        => $mimeType,
+            'Content-Length'      => $size,
+            'Content-Disposition' => 'inline',
+            'Cache-Control'       => 'no-store, no-cache, private, must-revalidate',
+            'X-Content-Type-Options' => 'nosniff',
+            'Accept-Ranges'       => 'bytes',
+        ]);
+    }
+}
--- a/app/Http/Controllers/User/CollaboratorController.php
+++ b/app/Http/Controllers/User/CollaboratorController.php
@@ -0,0 +1,72 @@
+<?php
+
+namespace App\Http\Controllers\User;
+
+use App\Http\Controllers\Controller;
+use App\Models\ProjectCollaborator;
+use App\Models\TranscriptionProject;
+use App\Models\User;
+use App\Services\AuditLogService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+class CollaboratorController extends Controller
+{
+    public function store(Request $request, TranscriptionProject $project, AuditLogService $audit): RedirectResponse
+    {
+        $this->authorize('manageCollaborators', $project);
+
+        $data = $request->validate([
+            'email' => ['required', 'email', 'exists:users,email'],
+            'role'  => ['nullable', 'in:editor,viewer'],
+        ]);
+
+        $user = User::where('email', $data['email'])->where('is_active', true)->firstOrFail();
+
+        // Owner tidak boleh jadi collaborator
+        if ($project->isOwnedBy($user)) {
+            return back()->withErrors(['email' => 'Pengguna ini adalah pemilik projek.']);
+        }
+
+        // Elak duplicate
+        $existing = ProjectCollaborator::where('project_id', $project->id)
+            ->where('user_id', $user->id)
+            ->exists();
+
+        if ($existing) {
+            return back()->withErrors(['email' => 'Pengguna ini sudah menjadi collaborator.']);
+        }
+
+        ProjectCollaborator::create([
+            'project_id' => $project->id,
+            'user_id'    => $user->id,
+            'role'       => $data['role'] ?? 'editor',
+            'added_by'   => auth()->id(),
+        ]);
+
+        $audit->log('collaborator_added', [
+            'project_id'     => $project->id,
+            'target_user_id' => $user->id,
+            'new_values'     => ['email' => $user->email, 'role' => $data['role'] ?? 'editor'],
+        ]);
+
+        return back()->with('success', "{$user->name} berjaya ditambah sebagai collaborator.");
+    }
+
+    public function destroy(TranscriptionProject $project, User $user, AuditLogService $audit): RedirectResponse
+    {
+        $this->authorize('manageCollaborators', $project);
+
+        ProjectCollaborator::where('project_id', $project->id)
+            ->where('user_id', $user->id)
+            ->delete();
+
+        $audit->log('collaborator_removed', [
+            'project_id'     => $project->id,
+            'target_user_id' => $user->id,
+            'old_values'     => ['email' => $user->email],
+        ]);
+
+        return back()->with('success', "{$user->name} telah dibuang daripada collaborator.");
+    }
+}
--- a/app/Http/Controllers/User/CommentController.php
+++ b/app/Http/Controllers/User/CommentController.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Controllers\User;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\User\StoreCommentRequest;
+use App\Models\ProjectComment;
+use App\Models\TranscriptionProject;
+use App\Services\AuditLogService;
+use Illuminate\Http\RedirectResponse;
+
+class CommentController extends Controller
+{
+    public function store(
+        StoreCommentRequest $request,
+        TranscriptionProject $project,
+        AuditLogService $audit
+    ): RedirectResponse {
+        $this->authorize('create', [ProjectComment::class, $project]);
+
+        $comment = $project->comments()->create([
+            'user_id' => auth()->id(),
+            'message' => $request->message,
+        ]);
+
+        $audit->log('comment_added', [
+            'project_id' => $project->id,
+            'new_values' => ['comment_id' => $comment->id],
+        ]);
+
+        return back()->with('success', 'Komen berjaya ditambah.');
+    }
+
+    public function destroy(
+        TranscriptionProject $project,
+        ProjectComment $comment,
+        AuditLogService $audit
+    ): RedirectResponse {
+        abort_if($comment->project_id !== $project->id, 404);
+
+        $this->authorize('delete', $comment);
+
+        $audit->log('comment_deleted', [
+            'project_id' => $project->id,
+            'old_values' => ['comment_id' => $comment->id],
+        ]);
+
+        $comment->delete();
+
+        return back()->with('success', 'Komen berjaya dipadam.');
+    }
+}
--- a/app/Http/Controllers/User/DashboardController.php
+++ b/app/Http/Controllers/User/DashboardController.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Controllers\User;
+
+use App\Http\Controllers\Controller;
+use App\Models\TranscriptionProject;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+class DashboardController extends Controller
+{
+    public function index(): View
+    {
+        $user = Auth::user();
+
+        $ownedProjects = TranscriptionProject::where('owner_user_id', $user->id)
+            ->orderByDesc('created_at')
+            ->paginate(10, ['*'], 'owned');
+
+        $sharedProjects = $user->collaboratingProjects()
+            ->orderByDesc('transcription_projects.created_at')
+            ->paginate(10, ['*'], 'shared');
+
+        return view('user.dashboard', compact('ownedProjects', 'sharedProjects'));
+    }
+}
--- a/app/Http/Controllers/User/ProjectController.php
+++ b/app/Http/Controllers/User/ProjectController.php
@@ -0,0 +1,122 @@
+<?php
+
+namespace App\Http\Controllers\User;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\User\CreateProjectRequest;
+use App\Jobs\TranscribeAudioJob;
+use App\Models\TranscriptionProject;
+use App\Services\AuditLogService;
+use App\Services\StorageService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+class ProjectController extends Controller
+{
+    public function create(): View
+    {
+        $this->authorize('create', TranscriptionProject::class);
+
+        return view('user.projects.create');
+    }
+
+    public function store(CreateProjectRequest $request, StorageService $storage, AuditLogService $audit): RedirectResponse
+    {
+        $this->authorize('create', TranscriptionProject::class);
+
+        $file = $request->file('audio');
+        $uuid = (string) \Illuminate\Support\Str::uuid();
+        $path = $storage->storeAudio($file, $uuid);
+
+        $project = TranscriptionProject::create([
+            'uuid'                 => $uuid,
+            'title'                => $request->title,
+            'description'          => $request->description,
+            'owner_user_id'        => Auth::id(),
+            'original_filename'    => $file->getClientOriginalName(),
+            'stored_audio_path'    => $path,
+            'mime_type'            => $file->getMimeType(),
+            'file_size'            => $file->getSize(),
+            'language'             => $request->language ?? 'ms',
+            'transcription_status' => 'pending',
+            'transcription_engine' => config('speech2text.transcription.engine'),
+        ]);
+
+        $audit->log('project_created', [
+            'project_id' => $project->id,
+            'new_values' => ['title' => $project->title, 'uuid' => $project->uuid],
+        ]);
+
+        $audit->log('audio_uploaded', [
+            'project_id' => $project->id,
+            'new_values' => [
+                'original_filename' => $project->original_filename,
+                'file_size'         => $project->file_size,
+                'mime_type'         => $project->mime_type,
+            ],
+        ]);
+
+        TranscribeAudioJob::dispatch($project);
+
+        return redirect()->route('user.projects.show', $project)
+            ->with('success', 'Projek berjaya dicipta. Audio sedang dalam barisan untuk ditranskripkan.');
+    }
+
+    public function show(TranscriptionProject $project): View
+    {
+        $this->authorize('view', $project);
+
+        $project->load(['owner', 'collaborators.department', 'transcriptVersions.editor', 'comments.user']);
+
+        return view('user.projects.show', compact('project'));
+    }
+
+    // Endpoint polling status — JSON, tidak mendedahkan transcript
+    public function status(TranscriptionProject $project): JsonResponse
+    {
+        $this->authorize('view', $project);
+
+        return response()->json([
+            'status'           => $project->transcription_status,
+            'duration_seconds' => $project->duration_seconds,
+            'processed_at'     => $project->processed_at?->format('d/m/Y H:i'),
+            'error_message'    => $project->isFailed() ? $project->error_message : null,
+        ]);
+    }
+
+    public function retry(TranscriptionProject $project, AuditLogService $audit): RedirectResponse
+    {
+        $this->authorize('retryTranscription', $project);
+
+        $project->update([
+            'transcription_status' => 'pending',
+            'error_message'        => null,
+        ]);
+
+        $audit->log('transcription_started', [
+            'project_id' => $project->id,
+            'new_values' => ['retry' => true],
+        ]);
+
+        TranscribeAudioJob::dispatch($project);
+
+        return back()->with('success', 'Transkripsi sedang dicuba semula.');
+    }
+
+    public function destroy(TranscriptionProject $project, AuditLogService $audit): RedirectResponse
+    {
+        $this->authorize('delete', $project);
+
+        $audit->log('project_deleted', [
+            'project_id' => $project->id,
+            'old_values' => ['title' => $project->title, 'uuid' => $project->uuid],
+        ]);
+
+        $project->delete();
+
+        return redirect()->route('user.dashboard')
+            ->with('success', 'Projek berjaya dipadam.');
+    }
+}
--- a/app/Http/Controllers/User/TranscriptController.php
+++ b/app/Http/Controllers/User/TranscriptController.php
@@ -0,0 +1,112 @@
+<?php
+
+namespace App\Http\Controllers\User;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\User\UpdateTranscriptRequest;
+use App\Http\Requests\User\UploadExternalTranscriptRequest;
+use App\Jobs\OllamaPostProcessJob;
+use App\Models\TranscriptVersion;
+use App\Models\TranscriptionProject;
+use App\Services\AuditLogService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Auth;
+
+class TranscriptController extends Controller
+{
+    /**
+     * Simpan perubahan teks transkripsi dan cipta versi baru.
+     */
+    public function update(
+        UpdateTranscriptRequest $request,
+        TranscriptionProject $project,
+        AuditLogService $audit
+    ): RedirectResponse {
+        $this->authorize('editTranscript', $project);
+
+        $oldText = $project->transcript_text;
+
+        $nextVersion = ($project->transcriptVersions()->max('version_number') ?? 0) + 1;
+
+        TranscriptVersion::create([
+            'project_id'     => $project->id,
+            'edited_by'      => Auth::id(),
+            'version_number' => $nextVersion,
+            'old_text'       => $oldText,
+            'new_text'       => $request->transcript_text,
+            'change_summary' => $request->change_summary ?? 'Dikemaskini oleh pengguna',
+            'created_at'     => now(),
+        ]);
+
+        $project->update([
+            'transcript_text'      => $request->transcript_text,
+            'transcription_status' => 'completed',
+        ]);
+
+        $audit->log('transcript_edited', [
+            'project_id'     => $project->id,
+            'new_values'     => ['version_number' => $nextVersion],
+        ]);
+
+        return back()->with('success', 'Transkripsi berjaya disimpan.');
+    }
+
+    /**
+     * Muat naik fail transkripsi .txt dari luar sistem.
+     */
+    public function uploadExternal(
+        UploadExternalTranscriptRequest $request,
+        TranscriptionProject $project,
+        AuditLogService $audit
+    ): RedirectResponse {
+        $this->authorize('editTranscript', $project);
+
+        $text = file_get_contents($request->file('transcript_file')->getRealPath());
+
+        // Bersihkan BOM dan normalkan line endings
+        $text = preg_replace('/^\xef\xbb\xbf/', '', $text);
+        $text = str_replace(["\r\n", "\r"], "\n", $text);
+        $text = trim($text);
+
+        if ($text === '') {
+            return back()->withErrors(['transcript_file' => 'Fail transkripsi kosong.']);
+        }
+
+        $oldText     = $project->transcript_text;
+        $nextVersion = ($project->transcriptVersions()->max('version_number') ?? 0) + 1;
+
+        TranscriptVersion::create([
+            'project_id'     => $project->id,
+            'edited_by'      => Auth::id(),
+            'version_number' => $nextVersion,
+            'old_text'       => $oldText,
+            'new_text'       => $text,
+            'change_summary' => 'Transkripsi dimuat naik secara manual',
+            'created_at'     => now(),
+        ]);
+
+        $project->update([
+            'transcript_text'      => $text,
+            'transcription_status' => 'completed',
+            'transcription_engine' => 'manual',
+            'processed_at'         => $project->processed_at ?? now(),
+        ]);
+
+        $audit->log('transcript_uploaded_external', [
+            'project_id' => $project->id,
+            'new_values' => ['version_number' => $nextVersion],
+        ]);
+
+        // Hantar ke Ollama jika pengguna minta dan Ollama dikonfigurasi
+        if ($request->boolean('clean_with_ollama') && config('speech2text.ollama.enabled')) {
+            OllamaPostProcessJob::dispatch($project);
+        }
+
+        $msg = 'Transkripsi berjaya dimuat naik.';
+        if ($request->boolean('clean_with_ollama') && config('speech2text.ollama.enabled')) {
+            $msg .= ' Pembersihan Ollama sedang diproses.';
+        }
+
+        return back()->with('success', $msg);
+    }
+}
--- a/app/Http/Controllers/User/TranscriptVersionController.php
+++ b/app/Http/Controllers/User/TranscriptVersionController.php
@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Http\Controllers\User;
+
+use App\Http\Controllers\Controller;
+use App\Models\TranscriptVersion;
+use App\Models\TranscriptionProject;
+use App\Services\AuditLogService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+class TranscriptVersionController extends Controller
+{
+    public function index(TranscriptionProject $project): View
+    {
+        $this->authorize('viewVersionHistory', $project);
+
+        $versions = $project->transcriptVersions()
+            ->with('editor')
+            ->orderByDesc('version_number')
+            ->paginate(20);
+
+        return view('user.projects.versions', compact('project', 'versions'));
+    }
+
+    public function restore(
+        TranscriptionProject $project,
+        TranscriptVersion $version,
+        AuditLogService $audit
+    ): RedirectResponse {
+        $this->authorize('restoreVersion', $project);
+
+        // Pastikan versi ini milik projek ini
+        abort_if($version->project_id !== $project->id, 404);
+
+        $oldText     = $project->transcript_text;
+        $nextVersion = ($project->transcriptVersions()->max('version_number') ?? 0) + 1;
+
+        TranscriptVersion::create([
+            'project_id'     => $project->id,
+            'edited_by'      => Auth::id(),
+            'version_number' => $nextVersion,
+            'old_text'       => $oldText,
+            'new_text'       => $version->new_text,
+            'change_summary' => "Dipulihkan dari versi {$version->version_number}",
+            'created_at'     => now(),
+        ]);
+
+        $project->update([
+            'transcript_text'      => $version->new_text,
+            'transcription_status' => 'completed',
+        ]);
+
+        $audit->log('transcript_version_restored', [
+            'project_id' => $project->id,
+            'new_values' => [
+                'restored_from_version' => $version->version_number,
+                'new_version'           => $nextVersion,
+            ],
+        ]);
+
+        return redirect()
+            ->route('user.projects.show', $project)
+            ->with('success', "Versi {$version->version_number} berjaya dipulihkan.");
+    }
+}
--- a/app/Http/Middleware/EnsureAdmin.php
+++ b/app/Http/Middleware/EnsureAdmin.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureAdmin
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! $request->user() || ! $request->user()->isAdmin()) {
+            abort(403, 'Akses tidak dibenarkan.');
+        }
+
+        return $next($request);
+    }
+}
--- a/app/Http/Middleware/EnsureRegularUser.php
+++ b/app/Http/Middleware/EnsureRegularUser.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureRegularUser
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! $request->user() || ! $request->user()->isUser()) {
+            abort(403, 'Akses tidak dibenarkan.');
+        }
+
+        return $next($request);
+    }
+}
--- a/app/Http/Middleware/EnsureUserIsActive.php
+++ b/app/Http/Middleware/EnsureUserIsActive.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureUserIsActive
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (Auth::check() && ! Auth::user()->is_active) {
+            Auth::logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            return redirect()->route('login')
+                ->withErrors(['email' => 'Akaun anda telah dinyahaktifkan. Sila hubungi pentadbir.']);
+        }
+
+        return $next($request);
+    }
+}
--- a/app/Http/Middleware/SecurityHeaders.php
+++ b/app/Http/Middleware/SecurityHeaders.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class SecurityHeaders
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $response = $next($request);
+
+        $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
+        $response->headers->set('X-Content-Type-Options', 'nosniff');
+        $response->headers->set('X-XSS-Protection', '1; mode=block');
+        $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
+        $response->headers->set('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()');
+        $response->headers->set(
+            'Content-Security-Policy',
+            "default-src 'self'; " .
+            "script-src 'self' 'unsafe-inline'; " .
+            "style-src 'self' 'unsafe-inline'; " .
+            "img-src 'self' data: blob:; " .
+            "font-src 'self'; " .
+            "connect-src 'self'; " .
+            "media-src 'self' blob:; " .
+            "object-src 'none'; " .
+            "base-uri 'self'; " .
+            "form-action 'self'; " .
+            "frame-ancestors 'self';"
+        );
+
+        if ($request->isSecure()) {
+            $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+        }
+
+        return $response;
+    }
+}
--- a/app/Http/Requests/Admin/CreateUserRequest.php
+++ b/app/Http/Requests/Admin/CreateUserRequest.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Requests\Admin;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rules\Password;
+
+class CreateUserRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()->isAdmin();
+    }
+
+    public function rules(): array
+    {
+        return [
+            'name'          => ['required', 'string', 'max:255'],
+            'email'         => ['required', 'email', 'max:255', 'unique:users,email'],
+            'password'      => ['required', 'confirmed', Password::min(8)->mixedCase()->numbers()],
+            'role'          => ['required', 'in:admin,user'],
+            'department_id' => ['nullable', 'exists:departments,id'],
+        ];
+    }
+
+    public function attributes(): array
+    {
+        return [
+            'name'          => 'Nama',
+            'email'         => 'E-mel',
+            'password'      => 'Kata laluan',
+            'role'          => 'Peranan',
+            'department_id' => 'Jabatan',
+        ];
+    }
+}
--- a/app/Http/Requests/Admin/TransferOwnershipRequest.php
+++ b/app/Http/Requests/Admin/TransferOwnershipRequest.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Requests\Admin;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class TransferOwnershipRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()->isAdmin();
+    }
+
+    public function rules(): array
+    {
+        return [
+            'new_owner_id' => ['required', 'integer', 'exists:users,id'],
+            'justification' => ['required', 'string', 'min:10', 'max:1000'],
+        ];
+    }
+
+    public function attributes(): array
+    {
+        return [
+            'new_owner_id'  => 'Pemilik baru',
+            'justification' => 'Justifikasi',
+        ];
+    }
+}
--- a/app/Http/Requests/Admin/UpdateUserEmailRequest.php
+++ b/app/Http/Requests/Admin/UpdateUserEmailRequest.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Requests\Admin;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateUserEmailRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()->isAdmin();
+    }
+
+    public function rules(): array
+    {
+        $userId = $this->route('user')->id;
+
+        return [
+            'email'        => ['required', 'email', 'max:255', Rule::unique('users', 'email')->ignore($userId)],
+            'justification'=> ['nullable', 'string', 'max:500'],
+        ];
+    }
+
+    public function attributes(): array
+    {
+        return [
+            'email'         => 'E-mel baru',
+            'justification' => 'Justifikasi',
+        ];
+    }
+}
--- a/app/Http/Requests/Auth/LoginRequest.php
+++ b/app/Http/Requests/Auth/LoginRequest.php
@@ -0,0 +1,64 @@
+<?php
+
+namespace App\Http\Requests\Auth;
+
+use Illuminate\Auth\Events\Lockout;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+
+class LoginRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'email'    => ['required', 'string', 'email'],
+            'password' => ['required', 'string'],
+        ];
+    }
+
+    public function authenticate(): void
+    {
+        $this->ensureIsNotRateLimited();
+
+        if (! Auth::attempt($this->only('email', 'password'), $this->boolean('remember'))) {
+            RateLimiter::hit($this->throttleKey());
+
+            throw ValidationException::withMessages([
+                'email' => trans('auth.failed'),
+            ]);
+        }
+
+        RateLimiter::clear($this->throttleKey());
+    }
+
+    public function ensureIsNotRateLimited(): void
+    {
+        if (! RateLimiter::tooManyAttempts($this->throttleKey(), 5)) {
+            return;
+        }
+
+        event(new Lockout($this));
+
+        $seconds = RateLimiter::availableIn($this->throttleKey());
+
+        throw ValidationException::withMessages([
+            'email' => trans('auth.throttle', [
+                'seconds' => $seconds,
+                'minutes' => ceil($seconds / 60),
+            ]),
+        ]);
+    }
+
+    public function throttleKey(): string
+    {
+        return Str::transliterate(Str::lower($this->string('email')) . '|' . $this->ip());
+    }
+}
--- a/app/Http/Requests/User/CreateProjectRequest.php
+++ b/app/Http/Requests/User/CreateProjectRequest.php
@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Requests\User;
+
+use App\Rules\ValidAudioMagicBytes;
+use Illuminate\Foundation\Http\FormRequest;
+
+class CreateProjectRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()->isActive();
+    }
+
+    public function rules(): array
+    {
+        $maxKb      = config('speech2text.upload.max_mb', 200) * 1024;
+        $extensions = implode(',', config('speech2text.upload.allowed_extensions'));
+
+        return [
+            'title'       => ['required', 'string', 'max:255'],
+            'description' => ['nullable', 'string', 'max:2000'],
+            'audio'       => [
+                'required',
+                'file',
+                "mimes:{$extensions}",
+                "max:{$maxKb}",
+                new ValidAudioMagicBytes(),
+            ],
+            'language'    => ['nullable', 'string', 'in:ms,en'],
+        ];
+    }
+
+    public function attributes(): array
+    {
+        return [
+            'title'       => 'Tajuk projek',
+            'description' => 'Penerangan',
+            'audio'       => 'Fail audio',
+            'language'    => 'Bahasa',
+        ];
+    }
+
+    public function messages(): array
+    {
+        $maxMb = config('speech2text.upload.max_mb', 200);
+        return [
+            'audio.max'   => "Saiz fail audio melebihi had maksimum {$maxMb}MB.",
+            'audio.mimes' => 'Format fail tidak disokong. Guna: mp3, wav, m4a, mp4, aac, ogg, flac, webm.',
+        ];
+    }
+}
--- a/app/Http/Requests/User/StoreCommentRequest.php
+++ b/app/Http/Requests/User/StoreCommentRequest.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Requests\User;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreCommentRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'message' => ['required', 'string', 'max:2000'],
+        ];
+    }
+
+    public function messages(): array
+    {
+        return [
+            'message.required' => 'Mesej komen tidak boleh kosong.',
+            'message.max'      => 'Mesej terlalu panjang (maks 2,000 aksara).',
+        ];
+    }
+}
--- a/app/Http/Requests/User/UpdateTranscriptRequest.php
+++ b/app/Http/Requests/User/UpdateTranscriptRequest.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Requests\User;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateTranscriptRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true; // Policy diperiksa dalam controller
+    }
+
+    public function rules(): array
+    {
+        return [
+            'transcript_text' => ['required', 'string', 'max:500000'],
+            'change_summary'  => ['nullable', 'string', 'max:500'],
+        ];
+    }
+
+    public function messages(): array
+    {
+        return [
+            'transcript_text.required' => 'Teks transkripsi tidak boleh kosong.',
+            'transcript_text.max'      => 'Teks transkripsi terlalu panjang (maks 500,000 aksara).',
+            'change_summary.max'       => 'Ringkasan perubahan terlalu panjang (maks 500 aksara).',
+        ];
+    }
+}
--- a/app/Http/Requests/User/UploadExternalTranscriptRequest.php
+++ b/app/Http/Requests/User/UploadExternalTranscriptRequest.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Requests\User;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class UploadExternalTranscriptRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        return [
+            'transcript_file'   => ['required', 'file', 'mimetypes:text/plain', 'extensions:txt', 'max:10240'],
+            'clean_with_ollama' => ['nullable', 'boolean'],
+            'confirmed'         => ['nullable', 'boolean'],
+        ];
+    }
+
+    public function messages(): array
+    {
+        return [
+            'transcript_file.required'  => 'Sila pilih fail transkripsi (.txt).',
+            'transcript_file.mimetypes' => 'Fail mesti berformat teks biasa (.txt).',
+            'transcript_file.extensions'=> 'Hanya fail .txt dibenarkan.',
+            'transcript_file.max'       => 'Saiz fail terlalu besar (maks 10 MB).',
+        ];
+    }
+}
--- a/app/Jobs/OllamaPostProcessJob.php
+++ b/app/Jobs/OllamaPostProcessJob.php
@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\AuditLog;
+use App\Models\TranscriptVersion;
+use App\Models\TranscriptionProject;
+use App\Services\OllamaService;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+
+class OllamaPostProcessJob implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $timeout = 180;
+    public int $tries   = 2;
+    public int $backoff = 15;
+
+    public function __construct(private readonly TranscriptionProject $project) {}
+
+    public function handle(OllamaService $ollama): void
+    {
+        $project = $this->project;
+
+        // Reload fresh — status may have changed between dispatch and execution
+        $project->refresh();
+
+        if (! $project->isCompleted() || ! $project->transcript_text) {
+            return;
+        }
+
+        if (! $ollama->isAvailable()) {
+            Log::info("OllamaPostProcessJob: Ollama tidak tersedia, skip projek #{$project->id}");
+            return;
+        }
+
+        $cleaned = $ollama->cleanTranscript($project->transcript_text, $project->language);
+
+        if ($cleaned === null) {
+            Log::warning("OllamaPostProcessJob: hasil null untuk projek #{$project->id}");
+            return;
+        }
+
+        $oldText     = $project->transcript_text;
+        $nextVersion = ($project->transcriptVersions()->max('version_number') ?? 0) + 1;
+
+        TranscriptVersion::create([
+            'project_id'     => $project->id,
+            'edited_by'      => $project->owner_user_id,
+            'version_number' => $nextVersion,
+            'old_text'       => $oldText,
+            'new_text'       => $cleaned,
+            'change_summary' => 'Dibersihkan oleh Ollama',
+            'created_at'     => now(),
+        ]);
+
+        $project->update(['transcript_text' => $cleaned]);
+
+        AuditLog::create([
+            'actor_user_id' => null,
+            'actor_role'    => 'system',
+            'action'        => 'transcript_postprocessed',
+            'project_id'    => $project->id,
+            'new_values'    => [
+                'project_uuid' => $project->uuid,
+                'model'        => config('speech2text.ollama.model'),
+            ],
+            'created_at'    => now(),
+        ]);
+    }
+}
--- a/app/Jobs/TranscribeAudioJob.php
+++ b/app/Jobs/TranscribeAudioJob.php
@@ -0,0 +1,120 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\AuditLog;
+use App\Models\TranscriptionProject;
+use App\Services\StorageService;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+
+class TranscribeAudioJob implements ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $timeout = 600;
+    public int $tries   = 3;
+    public int $backoff = 30;
+
+    public function __construct(private readonly TranscriptionProject $project) {}
+
+    public function handle(StorageService $storage): void
+    {
+        $project = $this->project;
+
+        $project->update(['transcription_status' => 'processing']);
+        $this->auditLog('transcription_started');
+
+        $tmpPath = null;
+
+        try {
+            $path = $project->stored_audio_path;
+
+            abort_unless($storage->exists($path), 500, 'Fail audio tidak dijumpai.');
+
+            // Stream storage → temp file to avoid loading large files into memory
+            $tmpPath = tempnam(sys_get_temp_dir(), 'whisper_');
+            $src     = $storage->readStream($path);
+            $dst     = fopen($tmpPath, 'wb');
+
+            stream_copy_to_stream($src, $dst);
+
+            fclose($src);
+            fclose($dst);
+
+            $workerUrl = rtrim(config('speech2text.transcription.worker_url'), '/');
+
+            $response = Http::timeout(540)
+                ->attach(
+                    'audio',
+                    fopen($tmpPath, 'rb'),
+                    basename($path),
+                    ['Content-Type' => $project->mime_type]
+                )
+                ->post("{$workerUrl}/transcribe");
+
+            if (! $response->successful()) {
+                throw new \RuntimeException("Transcription worker mengembalikan HTTP {$response->status()}");
+            }
+
+            $result = $response->json();
+
+            if (! ($result['success'] ?? false)) {
+                throw new \RuntimeException($result['error'] ?? 'Transcription gagal tanpa mesej ralat.');
+            }
+
+            $project->update([
+                'transcription_status'  => 'completed',
+                'transcript_text'       => $result['transcript'] ?? '',
+                'transcript_confidence' => $result['confidence'] ?? null,
+                'duration_seconds'      => $result['duration_seconds'] ?? null,
+                'error_message'         => null,
+                'processed_at'          => now(),
+            ]);
+
+            $this->auditLog('transcription_completed', [
+                'duration_seconds' => $result['duration_seconds'] ?? null,
+                'engine'           => config('speech2text.transcription.engine'),
+            ]);
+
+            // Optional Ollama post-processing
+            if (config('speech2text.ollama.enabled') && $project->transcript_text) {
+                OllamaPostProcessJob::dispatch($project);
+            }
+
+        } catch (\Throwable $e) {
+            Log::error("TranscribeAudioJob gagal untuk project #{$project->id}: {$e->getMessage()}");
+
+            $project->update([
+                'transcription_status' => 'failed',
+                'error_message'        => $e->getMessage(),
+            ]);
+
+            $this->auditLog('transcription_failed', ['error' => $e->getMessage()]);
+
+            $this->fail($e);
+
+        } finally {
+            if ($tmpPath && file_exists($tmpPath)) {
+                @unlink($tmpPath);
+            }
+        }
+    }
+
+    private function auditLog(string $action, array $extra = []): void
+    {
+        AuditLog::create([
+            'actor_user_id' => null,
+            'actor_role'    => 'system',
+            'action'        => $action,
+            'project_id'    => $this->project->id,
+            'new_values'    => array_merge(['project_uuid' => $this->project->uuid], $extra),
+            'created_at'    => now(),
+        ]);
+    }
+}
--- a/app/Models/AuditLog.php
+++ b/app/Models/AuditLog.php
@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class AuditLog extends Model
+{
+    public $timestamps = false;
+
+    protected $fillable = [
+        'actor_user_id',
+        'actor_role',
+        'action',
+        'subject_type',
+        'subject_id',
+        'target_user_id',
+        'project_id',
+        'old_values',
+        'new_values',
+        'justification',
+        'ip_address',
+        'user_agent',
+        'created_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'old_values' => 'array',
+            'new_values' => 'array',
+            'created_at' => 'datetime',
+        ];
+    }
+
+    public function actor(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'actor_user_id');
+    }
+
+    public function targetUser(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'target_user_id');
+    }
+}
--- a/app/Models/Department.php
+++ b/app/Models/Department.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class Department extends Model
+{
+    use HasFactory;
+
+    protected $fillable = ['name', 'code', 'is_active'];
+
+    protected function casts(): array
+    {
+        return ['is_active' => 'boolean'];
+    }
+
+    public function users(): HasMany
+    {
+        return $this->hasMany(User::class);
+    }
+}
--- a/app/Models/ProjectCollaborator.php
+++ b/app/Models/ProjectCollaborator.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class ProjectCollaborator extends Model
+{
+    protected $fillable = ['project_id', 'user_id', 'role', 'added_by'];
+
+    public function project(): BelongsTo
+    {
+        return $this->belongsTo(TranscriptionProject::class, 'project_id');
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    public function addedByUser(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'added_by');
+    }
+}
--- a/app/Models/ProjectComment.php
+++ b/app/Models/ProjectComment.php
@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\SoftDeletes;
+
+class ProjectComment extends Model
+{
+    use SoftDeletes;
+
+    protected $fillable = ['project_id', 'user_id', 'message'];
+
+    public function project(): BelongsTo
+    {
+        return $this->belongsTo(TranscriptionProject::class, 'project_id');
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}
--- a/app/Models/TranscriptVersion.php
+++ b/app/Models/TranscriptVersion.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class TranscriptVersion extends Model
+{
+    public $timestamps = false;
+
+    protected $fillable = [
+        'project_id',
+        'edited_by',
+        'version_number',
+        'old_text',
+        'new_text',
+        'change_summary',
+        'created_at',
+    ];
+
+    protected function casts(): array
+    {
+        return ['created_at' => 'datetime'];
+    }
+
+    public function project(): BelongsTo
+    {
+        return $this->belongsTo(TranscriptionProject::class, 'project_id');
+    }
+
+    public function editor(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'edited_by');
+    }
+}
--- a/app/Models/TranscriptionProject.php
+++ b/app/Models/TranscriptionProject.php
@@ -0,0 +1,153 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\SoftDeletes;
+use Illuminate\Support\Str;
+
+class TranscriptionProject extends Model
+{
+    use HasFactory, SoftDeletes;
+
+    protected $fillable = [
+        'uuid',
+        'title',
+        'description',
+        'owner_user_id',
+        'original_filename',
+        'stored_audio_path',
+        'mime_type',
+        'file_size',
+        'duration_seconds',
+        'language',
+        'transcription_status',
+        'transcription_engine',
+        'transcript_text',
+        'transcript_confidence',
+        'error_message',
+        'processed_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'transcript_text'       => 'encrypted',  // enkripsi kandungan sensitif
+            'transcript_confidence' => 'float',
+            'processed_at'          => 'datetime',
+            'file_size'             => 'integer',
+            'duration_seconds'      => 'integer',
+        ];
+    }
+
+    protected static function booted(): void
+    {
+        static::creating(function (self $project) {
+            if (empty($project->uuid)) {
+                $project->uuid = (string) Str::uuid();
+            }
+        });
+    }
+
+    // Route model binding gunakan uuid
+    public function getRouteKeyName(): string
+    {
+        return 'uuid';
+    }
+
+    // -------------------------------------------------------
+    // Relationships
+    // -------------------------------------------------------
+
+    public function owner(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'owner_user_id');
+    }
+
+    public function collaborators(): BelongsToMany
+    {
+        return $this->belongsToMany(User::class, 'project_collaborators', 'project_id', 'user_id')
+            ->withPivot('role', 'added_by')
+            ->withTimestamps();
+    }
+
+    public function projectCollaborators(): HasMany
+    {
+        return $this->hasMany(ProjectCollaborator::class, 'project_id');
+    }
+
+    public function transcriptVersions(): HasMany
+    {
+        return $this->hasMany(TranscriptVersion::class, 'project_id')->orderByDesc('version_number');
+    }
+
+    public function comments(): HasMany
+    {
+        return $this->hasMany(ProjectComment::class, 'project_id')->latest();
+    }
+
+    // -------------------------------------------------------
+    // Helpers
+    // -------------------------------------------------------
+
+    public function isOwnedBy(User $user): bool
+    {
+        return $this->owner_user_id === $user->id;
+    }
+
+    public function hasCollaborator(User $user): bool
+    {
+        return $this->collaborators()->where('user_id', $user->id)->exists();
+    }
+
+    public function isAccessibleBy(User $user): bool
+    {
+        return $this->isOwnedBy($user) || $this->hasCollaborator($user);
+    }
+
+    public function isPending(): bool
+    {
+        return $this->transcription_status === 'pending';
+    }
+
+    public function isProcessing(): bool
+    {
+        return $this->transcription_status === 'processing';
+    }
+
+    public function isCompleted(): bool
+    {
+        return $this->transcription_status === 'completed';
+    }
+
+    public function isFailed(): bool
+    {
+        return $this->transcription_status === 'failed';
+    }
+
+    public function fileSizeForHumans(): string
+    {
+        $bytes = $this->file_size;
+        if ($bytes >= 1073741824) {
+            return number_format($bytes / 1073741824, 2) . ' GB';
+        }
+        if ($bytes >= 1048576) {
+            return number_format($bytes / 1048576, 2) . ' MB';
+        }
+        return number_format($bytes / 1024, 2) . ' KB';
+    }
+
+    public function durationForHumans(): ?string
+    {
+        if (! $this->duration_seconds) {
+            return null;
+        }
+        $m = intdiv($this->duration_seconds, 60);
+        $s = $this->duration_seconds % 60;
+        return sprintf('%d:%02d', $m, $s);
+    }
+}
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -0,0 +1,106 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\SoftDeletes;
+use Illuminate\Foundation\Auth\User as Authenticatable;
+use Illuminate\Notifications\Notifiable;
+
+class User extends Authenticatable
+{
+    use HasFactory, Notifiable, SoftDeletes;
+
+    protected $fillable = [
+        'name',
+        'email',
+        'password',
+        'role',
+        'department_id',
+        'is_active',
+        'last_login_at',
+        'email_verified_at',
+    ];
+
+    protected $hidden = [
+        'password',
+        'remember_token',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'email_verified_at' => 'datetime',
+            'last_login_at'     => 'datetime',
+            'password'          => 'hashed',
+            'is_active'         => 'boolean',
+        ];
+    }
+
+    // -------------------------------------------------------
+    // Role helpers
+    // -------------------------------------------------------
+
+    public function isAdmin(): bool
+    {
+        return $this->role === 'admin';
+    }
+
+    public function isUser(): bool
+    {
+        return $this->role === 'user';
+    }
+
+    public function isActive(): bool
+    {
+        return (bool) $this->is_active;
+    }
+
+    // -------------------------------------------------------
+    // Relationships
+    // -------------------------------------------------------
+
+    public function department(): BelongsTo
+    {
+        return $this->belongsTo(Department::class);
+    }
+
+    public function ownedProjects(): HasMany
+    {
+        return $this->hasMany(TranscriptionProject::class, 'owner_user_id');
+    }
+
+    public function collaboratingProjects(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            TranscriptionProject::class,
+            'project_collaborators',
+            'user_id',
+            'project_id'
+        )->withPivot('role', 'added_by')->withTimestamps();
+    }
+
+    public function auditActionsPerformed(): HasMany
+    {
+        return $this->hasMany(AuditLog::class, 'actor_user_id');
+    }
+
+    public function auditActionsTargeted(): HasMany
+    {
+        return $this->hasMany(AuditLog::class, 'target_user_id');
+    }
+
+    // -------------------------------------------------------
+    // Usage check (for safe delete)
+    // -------------------------------------------------------
+
+    public function hasUsage(): bool
+    {
+        return $this->ownedProjects()->withTrashed()->exists()
+            || $this->collaboratingProjects()->exists()
+            || AuditLog::where('actor_user_id', $this->id)->exists();
+    }
+}
--- a/app/Policies/CommentPolicy.php
+++ b/app/Policies/CommentPolicy.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\ProjectComment;
+use App\Models\TranscriptionProject;
+use App\Models\User;
+
+class CommentPolicy
+{
+    public function view(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function create(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function delete(User $user, ProjectComment $comment): bool
+    {
+        $project = $comment->project;
+        return $comment->user_id === $user->id || $project->isOwnedBy($user);
+    }
+}
--- a/app/Policies/TranscriptVersionPolicy.php
+++ b/app/Policies/TranscriptVersionPolicy.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\TranscriptVersion;
+use App\Models\User;
+
+class TranscriptVersionPolicy
+{
+    public function view(User $user, TranscriptVersion $version): bool
+    {
+        return $version->project->isAccessibleBy($user);
+    }
+
+    public function restore(User $user, TranscriptVersion $version): bool
+    {
+        $project = $version->project;
+        if ($project->isOwnedBy($user)) {
+            return true;
+        }
+        return $project->collaborators()
+            ->where('user_id', $user->id)
+            ->wherePivot('role', 'editor')
+            ->exists();
+    }
+}
--- a/app/Policies/TranscriptionProjectPolicy.php
+++ b/app/Policies/TranscriptionProjectPolicy.php
@@ -0,0 +1,90 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\TranscriptionProject;
+use App\Models\User;
+
+class TranscriptionProjectPolicy
+{
+    // Admin TIDAK boleh view detail (kandungan)
+    public function view(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    // Admin TIDAK boleh view metadata content — hanya metadata minimum via viewMetadata
+    public function viewMetadata(User $user, TranscriptionProject $project): bool
+    {
+        return $user->isAdmin() || $project->isAccessibleBy($user);
+    }
+
+    public function create(User $user): bool
+    {
+        // Admin juga kakitangan — boleh cipta projek sendiri
+        return $user->isActive();
+    }
+
+    public function update(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function delete(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isOwnedBy($user);
+    }
+
+    public function viewAudio(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function viewTranscript(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function editTranscript(User $user, TranscriptionProject $project): bool
+    {
+        if ($project->isOwnedBy($user)) {
+            return true;
+        }
+        // Viewer collaborator tidak boleh edit — editor sahaja
+        return $project->collaborators()
+            ->where('user_id', $user->id)
+            ->wherePivot('role', 'editor')
+            ->exists();
+    }
+
+    public function manageCollaborators(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isOwnedBy($user);
+    }
+
+    public function retryTranscription(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isOwnedBy($user) && $project->isFailed();
+    }
+
+    public function transferOwner(User $user, TranscriptionProject $project): bool
+    {
+        return $user->isAdmin();
+    }
+
+    public function viewVersionHistory(User $user, TranscriptionProject $project): bool
+    {
+        return $project->isAccessibleBy($user);
+    }
+
+    public function restoreVersion(User $user, TranscriptionProject $project): bool
+    {
+        if ($project->isOwnedBy($user)) {
+            return true;
+        }
+        return $project->collaborators()
+            ->where('user_id', $user->id)
+            ->wherePivot('role', 'editor')
+            ->exists();
+    }
+}
--- a/app/Policies/UserPolicy.php
+++ b/app/Policies/UserPolicy.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+
+class UserPolicy
+{
+    public function viewAny(User $actor): bool
+    {
+        return $actor->isAdmin();
+    }
+
+    public function create(User $actor): bool
+    {
+        return $actor->isAdmin();
+    }
+
+    public function update(User $actor, User $target): bool
+    {
+        return $actor->isAdmin() && $actor->id !== $target->id;
+    }
+
+    public function delete(User $actor, User $target): bool
+    {
+        return $actor->isAdmin()
+            && $actor->id !== $target->id
+            && ! $target->hasUsage();
+    }
+
+    public function activate(User $actor, User $target): bool
+    {
+        return $actor->isAdmin() && $actor->id !== $target->id;
+    }
+
+    public function deactivate(User $actor, User $target): bool
+    {
+        return $actor->isAdmin() && $actor->id !== $target->id;
+    }
+
+    public function changeEmail(User $actor, User $target): bool
+    {
+        return $actor->isAdmin() && $actor->id !== $target->id;
+    }
+}
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Providers;
+
+use App\Models\ProjectComment;
+use App\Models\TranscriptVersion;
+use App\Models\TranscriptionProject;
+use App\Models\User;
+use App\Policies\CommentPolicy;
+use App\Policies\TranscriptVersionPolicy;
+use App\Policies\TranscriptionProjectPolicy;
+use App\Policies\UserPolicy;
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\ServiceProvider;
+
+class AppServiceProvider extends ServiceProvider
+{
+    public function register(): void {}
+
+    public function boot(): void
+    {
+        // Register Policies
+        Gate::policy(User::class, UserPolicy::class);
+        Gate::policy(TranscriptionProject::class, TranscriptionProjectPolicy::class);
+        Gate::policy(TranscriptVersion::class, TranscriptVersionPolicy::class);
+        Gate::policy(ProjectComment::class, CommentPolicy::class);
+
+        // Rate Limiters
+        RateLimiter::for('login', function (Request $request) {
+            return Limit::perMinute(5)->by($request->input('email') . '|' . $request->ip());
+        });
+
+        RateLimiter::for('upload', function (Request $request) {
+            return Limit::perHour(10)->by($request->user()?->id ?: $request->ip());
+        });
+    }
+}
--- a/app/Rules/ValidAudioMagicBytes.php
+++ b/app/Rules/ValidAudioMagicBytes.php
@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Rules;
+
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Http\UploadedFile;
+
+class ValidAudioMagicBytes implements ValidationRule
+{
+    // Signatures checked at byte offset 0
+    private const SIGNATURES = [
+        [0xFF, 0xFB],             // MP3 MPEG-1 Layer 3
+        [0xFF, 0xF3],             // MP3 MPEG-2 Layer 3
+        [0xFF, 0xF2],             // MP3 MPEG-2.5 Layer 3
+        [0xFF, 0xF1],             // AAC ADTS MPEG-4
+        [0xFF, 0xF9],             // AAC ADTS MPEG-2
+        [0x49, 0x44, 0x33],       // MP3 with ID3v2 tag
+        [0x52, 0x49, 0x46, 0x46], // WAV (RIFF header)
+        [0x4F, 0x67, 0x67, 0x53], // OGG (OggS)
+        [0x66, 0x4C, 0x61, 0x43], // FLAC (fLaC)
+        [0x1A, 0x45, 0xDF, 0xA3], // WebM / MKV
+    ];
+
+    // MP4/M4A: ISO Base Media file — 'ftyp' box starts at byte offset 4
+    private const MP4_SIGNATURE = [0x66, 0x74, 0x79, 0x70]; // 'ftyp'
+    private const MP4_OFFSET    = 4;
+
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if (! ($value instanceof UploadedFile) || ! $value->isValid()) {
+            $fail('Fail audio tidak sah.');
+            return;
+        }
+
+        $handle = @fopen($value->getRealPath(), 'rb');
+        if ($handle === false) {
+            $fail('Fail audio tidak dapat dibaca.');
+            return;
+        }
+
+        $header = fread($handle, 12);
+        fclose($handle);
+
+        if (strlen($header) < 4) {
+            $fail('Fail audio terlalu kecil atau rosak.');
+            return;
+        }
+
+        $bytes = array_values(unpack('C*', $header));
+
+        foreach (self::SIGNATURES as $sig) {
+            if ($this->matchesAt($bytes, $sig, 0)) {
+                return;
+            }
+        }
+
+        // Check MP4/M4A: need at least 8 bytes
+        if (count($bytes) >= self::MP4_OFFSET + count(self::MP4_SIGNATURE)) {
+            if ($this->matchesAt($bytes, self::MP4_SIGNATURE, self::MP4_OFFSET)) {
+                return;
+            }
+        }
+
+        $fail('Format fail audio tidak sah. Kandungan fail tidak menepati format audio yang dibenarkan.');
+    }
+
+    private function matchesAt(array $bytes, array $signature, int $offset): bool
+    {
+        foreach ($signature as $i => $expected) {
+            if (($bytes[$offset + $i] ?? -1) !== $expected) {
+                return false;
+            }
+        }
+        return true;
+    }
+}
--- a/app/Services/AuditLogService.php
+++ b/app/Services/AuditLogService.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\AuditLog;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+
+class AuditLogService
+{
+    public function __construct(private readonly Request $request) {}
+
+    public function log(
+        string $action,
+        array $options = []
+    ): AuditLog {
+        $actor = Auth::user();
+
+        return AuditLog::create([
+            'actor_user_id' => $actor?->id ?? $options['actor_user_id'] ?? null,
+            'actor_role'    => $actor?->role ?? $options['actor_role'] ?? 'system',
+            'action'        => $action,
+            'subject_type'  => $options['subject_type'] ?? null,
+            'subject_id'    => $options['subject_id'] ?? null,
+            'target_user_id'=> $options['target_user_id'] ?? null,
+            'project_id'    => $options['project_id'] ?? null,
+            'old_values'    => $options['old_values'] ?? null,
+            'new_values'    => $options['new_values'] ?? null,
+            'justification' => $options['justification'] ?? null,
+            'ip_address'    => $this->request->ip(),
+            'user_agent'    => $this->request->userAgent(),
+            'created_at'    => now(),
+        ]);
+    }
+}
--- a/app/Services/OllamaService.php
+++ b/app/Services/OllamaService.php
@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+
+class OllamaService
+{
+    private string $baseUrl;
+    private string $model;
+
+    public function __construct()
+    {
+        $this->baseUrl = rtrim(config('speech2text.ollama.base_url'), '/');
+        $this->model   = config('speech2text.ollama.model');
+    }
+
+    /**
+     * Clean and improve raw transcript text using a local Ollama model.
+     * Returns corrected text, or null if Ollama is unavailable.
+     */
+    public function cleanTranscript(string $rawText, string $language = 'ms'): ?string
+    {
+        $langLabel = $language === 'ms' ? 'Bahasa Melayu' : 'English';
+
+        $prompt = <<<PROMPT
+Anda adalah pembantu penyuntingan teks transkripsi automatik dalam {$langLabel}.
+
+Tugas anda:
+1. Betulkan ejaan dan tanda baca
+2. Pisahkan ayat dengan betul
+3. Kekalkan maksud asal — JANGAN tukar kandungan atau tambah maklumat baru
+4. Kembalikan hanya teks yang telah diperbetulkan, tiada penjelasan tambahan
+
+Teks transkripsi:
+{$rawText}
+PROMPT;
+
+        try {
+            $response = Http::timeout(120)
+                ->post("{$this->baseUrl}/api/generate", [
+                    'model'  => $this->model,
+                    'prompt' => $prompt,
+                    'stream' => false,
+                ]);
+
+            if (! $response->successful()) {
+                Log::warning("OllamaService: HTTP {$response->status()} dari {$this->baseUrl}");
+                return null;
+            }
+
+            $text = trim($response->json('response') ?? '');
+
+            return $text !== '' ? $text : null;
+
+        } catch (\Throwable $e) {
+            Log::warning("OllamaService tidak tersedia: {$e->getMessage()}");
+            return null;
+        }
+    }
+
+    public function isAvailable(): bool
+    {
+        try {
+            return Http::timeout(5)->get("{$this->baseUrl}/api/tags")->successful();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+}
--- a/app/Services/StorageService.php
+++ b/app/Services/StorageService.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+
+class StorageService
+{
+    private const DISK = 'private';
+
+    public function storeAudio(UploadedFile $file, string $uuid): string
+    {
+        $ext      = $file->getClientOriginalExtension();
+        $filename = Str::random(40) . '.' . strtolower($ext);
+        $dir      = "transcriptions/{$uuid}/audio";
+
+        Storage::disk(self::DISK)->putFileAs($dir, $file, $filename);
+
+        return "{$dir}/{$filename}";
+    }
+
+    public function delete(string $path): void
+    {
+        if (Storage::disk(self::DISK)->exists($path)) {
+            Storage::disk(self::DISK)->delete($path);
+        }
+    }
+
+    public function exists(string $path): bool
+    {
+        return Storage::disk(self::DISK)->exists($path);
+    }
+
+    public function size(string $path): int
+    {
+        return Storage::disk(self::DISK)->size($path);
+    }
+
+    public function readStream(string $path)
+    {
+        return Storage::disk(self::DISK)->readStream($path);
+    }
+}
--- a/18
+++ b/18
@@ -0,0 +1,18 @@
+#!/usr/bin/env php
+<?php
+
+use Illuminate\Foundation\Application;
+use Symfony\Component\Console\Input\ArgvInput;
+
+define('LARAVEL_START', microtime(true));
+
+// Register the Composer autoloader...
+require __DIR__.'/vendor/autoload.php';
+
+// Bootstrap Laravel and handle the command...
+/** @var Application $app */
+$app = require_once __DIR__.'/bootstrap/app.php';
+
+$status = $app->handleCommand(new ArgvInput);
+
+exit($status);
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -0,0 +1,31 @@
+<?php
+
+use App\Http\Middleware\EnsureAdmin;
+use App\Http\Middleware\EnsureRegularUser;
+use App\Http\Middleware\EnsureUserIsActive;
+use App\Http\Middleware\SecurityHeaders;
+use Illuminate\Foundation\Application;
+use Illuminate\Foundation\Configuration\Exceptions;
+use Illuminate\Foundation\Configuration\Middleware;
+
+return Application::configure(basePath: dirname(__DIR__))
+    ->withRouting(
+        web: __DIR__.'/../routes/web.php',
+        commands: __DIR__.'/../routes/console.php',
+        health: '/up',
+    )
+    ->withMiddleware(function (Middleware $middleware): void {
+        $middleware->alias([
+            'active'     => EnsureUserIsActive::class,
+            'admin'      => EnsureAdmin::class,
+            'user.role'  => EnsureRegularUser::class,
+        ]);
+
+        $middleware->web(append: [
+            SecurityHeaders::class,
+            EnsureUserIsActive::class,
+        ]);
+    })
+    ->withExceptions(function (Exceptions $exceptions): void {
+        //
+    })->create();
--- a/bootstrap/cache/.gitignore
+++ b/bootstrap/cache/.gitignore
@@ -0,0 +1,2 @@
+*
+!.gitignore
--- a/bootstrap/providers.php
+++ b/bootstrap/providers.php
@@ -0,0 +1,7 @@
+<?php
+
+use App\Providers\AppServiceProvider;
+
+return [
+    AppServiceProvider::class,
+];
--- a/composer.json
+++ b/composer.json
@@ -0,0 +1,86 @@
+{
+    "$schema": "https://getcomposer.org/schema.json",
+    "name": "laravel/laravel",
+    "type": "project",
+    "description": "The skeleton application for the Laravel framework.",
+    "keywords": ["laravel", "framework"],
+    "license": "MIT",
+    "require": {
+        "php": "^8.3",
+        "laravel/framework": "^13.8",
+        "laravel/tinker": "^3.0"
+    },
+    "require-dev": {
+        "fakerphp/faker": "^1.23",
+        "laravel/pail": "^1.2.5",
+        "laravel/pao": "^1.0.6",
+        "laravel/pint": "^1.27",
+        "mockery/mockery": "^1.6",
+        "nunomaduro/collision": "^8.6",
+        "phpunit/phpunit": "^12.5.12"
+    },
+    "autoload": {
+        "psr-4": {
+            "App\\": "app/",
+            "Database\\Factories\\": "database/factories/",
+            "Database\\Seeders\\": "database/seeders/"
+        }
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "Tests\\": "tests/"
+        }
+    },
+    "scripts": {
+        "setup": [
+            "composer install",
+            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\"",
+            "@php artisan key:generate",
+            "@php artisan migrate --force",
+            "npm install --ignore-scripts",
+            "npm run build"
+        ],
+        "dev": [
+            "Composer\\Config::disableProcessTimeout",
+            "npx concurrently -c \"#93c5fd,#c4b5fd,#fb7185,#fdba74\" \"php artisan serve\" \"php artisan queue:listen --tries=1 --timeout=0\" \"php artisan pail --timeout=0\" \"npm run dev\" --names=server,queue,logs,vite --kill-others"
+        ],
+        "test": [
+            "@php artisan config:clear --ansi @no_additional_args",
+            "@php artisan test"
+        ],
+        "post-autoload-dump": [
+            "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
+            "@php artisan package:discover --ansi"
+        ],
+        "post-update-cmd": [
+            "@php artisan vendor:publish --tag=laravel-assets --ansi --force"
+        ],
+        "post-root-package-install": [
+            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
+        ],
+        "post-create-project-cmd": [
+            "@php artisan key:generate --ansi",
+            "@php -r \"file_exists('database/database.sqlite') || touch('database/database.sqlite');\"",
+            "@php artisan migrate --graceful --ansi"
+        ],
+        "pre-package-uninstall": [
+            "Illuminate\\Foundation\\ComposerScripts::prePackageUninstall"
+        ]
+    },
+    "extra": {
+        "laravel": {
+            "dont-discover": []
+        }
+    },
+    "config": {
+        "optimize-autoloader": true,
+        "preferred-install": "dist",
+        "sort-packages": true,
+        "allow-plugins": {
+            "pestphp/pest-plugin": true,
+            "php-http/discovery": true
+        }
+    },
+    "minimum-stability": "stable",
+    "prefer-stable": true
+}
--- a/composer.lock
+++ b/composer.lock
--- a/config/app.php
+++ b/config/app.php
@@ -0,0 +1,126 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application Name
+    |--------------------------------------------------------------------------
+    |
+    | This value is the name of your application, which will be used when the
+    | framework needs to place the application's name in a notification or
+    | other UI elements where an application name needs to be displayed.
+    |
+    */
+
+    'name' => env('APP_NAME', 'Laravel'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application Environment
+    |--------------------------------------------------------------------------
+    |
+    | This value determines the "environment" your application is currently
+    | running in. This may determine how you prefer to configure various
+    | services the application utilizes. Set this in your ".env" file.
+    |
+    */
+
+    'env' => env('APP_ENV', 'production'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application Debug Mode
+    |--------------------------------------------------------------------------
+    |
+    | When your application is in debug mode, detailed error messages with
+    | stack traces will be shown on every error that occurs within your
+    | application. If disabled, a simple generic error page is shown.
+    |
+    */
+
+    'debug' => (bool) env('APP_DEBUG', false),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application URL
+    |--------------------------------------------------------------------------
+    |
+    | This URL is used by the console to properly generate URLs when using
+    | the Artisan command line tool. You should set this to the root of
+    | the application so that it's available within Artisan commands.
+    |
+    */
+
+    'url' => env('APP_URL', 'http://localhost'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application Timezone
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify the default timezone for your application, which
+    | will be used by the PHP date and date-time functions. The timezone
+    | is set to "UTC" by default as it is suitable for most use cases.
+    |
+    */
+
+    'timezone' => 'UTC',
+
+    /*
+    |--------------------------------------------------------------------------
+    | Application Locale Configuration
+    |--------------------------------------------------------------------------
+    |
+    | The application locale determines the default locale that will be used
+    | by Laravel's translation / localization methods. This option can be
+    | set to any locale for which you plan to have translation strings.
+    |
+    */
+
+    'locale' => env('APP_LOCALE', 'en'),
+
+    'fallback_locale' => env('APP_FALLBACK_LOCALE', 'en'),
+
+    'faker_locale' => env('APP_FAKER_LOCALE', 'en_US'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Encryption Key
+    |--------------------------------------------------------------------------
+    |
+    | This key is utilized by Laravel's encryption services and should be set
+    | to a random, 32 character string to ensure that all encrypted values
+    | are secure. You should do this prior to deploying the application.
+    |
+    */
+
+    'cipher' => 'AES-256-CBC',
+
+    'key' => env('APP_KEY'),
+
+    'previous_keys' => [
+        ...array_filter(
+            explode(',', (string) env('APP_PREVIOUS_KEYS', ''))
+        ),
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Maintenance Mode Driver
+    |--------------------------------------------------------------------------
+    |
+    | These configuration options determine the driver used to determine and
+    | manage Laravel's "maintenance mode" status. The "cache" driver will
+    | allow maintenance mode to be controlled across multiple machines.
+    |
+    | Supported drivers: "file", "cache"
+    |
+    */
+
+    'maintenance' => [
+        'driver' => env('APP_MAINTENANCE_DRIVER', 'file'),
+        'store' => env('APP_MAINTENANCE_STORE', 'database'),
+    ],
+
+];
--- a/config/auth.php
+++ b/config/auth.php
@@ -0,0 +1,117 @@
+<?php
+
+use App\Models\User;
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Authentication Defaults
+    |--------------------------------------------------------------------------
+    |
+    | This option defines the default authentication "guard" and password
+    | reset "broker" for your application. You may change these values
+    | as required, but they're a perfect start for most applications.
+    |
+    */
+
+    'defaults' => [
+        'guard' => env('AUTH_GUARD', 'web'),
+        'passwords' => env('AUTH_PASSWORD_BROKER', 'users'),
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Authentication Guards
+    |--------------------------------------------------------------------------
+    |
+    | Next, you may define every authentication guard for your application.
+    | Of course, a great default configuration has been defined for you
+    | which utilizes session storage plus the Eloquent user provider.
+    |
+    | All authentication guards have a user provider, which defines how the
+    | users are actually retrieved out of your database or other storage
+    | system used by the application. Typically, Eloquent is utilized.
+    |
+    | Supported: "session"
+    |
+    */
+
+    'guards' => [
+        'web' => [
+            'driver' => 'session',
+            'provider' => 'users',
+        ],
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | User Providers
+    |--------------------------------------------------------------------------
+    |
+    | All authentication guards have a user provider, which defines how the
+    | users are actually retrieved out of your database or other storage
+    | system used by the application. Typically, Eloquent is utilized.
+    |
+    | If you have multiple user tables or models you may configure multiple
+    | providers to represent the model / table. These providers may then
+    | be assigned to any extra authentication guards you have defined.
+    |
+    | Supported: "database", "eloquent"
+    |
+    */
+
+    'providers' => [
+        'users' => [
+            'driver' => 'eloquent',
+            'model' => env('AUTH_MODEL', User::class),
+        ],
+
+        // 'users' => [
+        //     'driver' => 'database',
+        //     'table' => 'users',
+        // ],
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Resetting Passwords
+    |--------------------------------------------------------------------------
+    |
+    | These configuration options specify the behavior of Laravel's password
+    | reset functionality, including the table utilized for token storage
+    | and the user provider that is invoked to actually retrieve users.
+    |
+    | The expiry time is the number of minutes that each reset token will be
+    | considered valid. This security feature keeps tokens short-lived so
+    | they have less time to be guessed. You may change this as needed.
+    |
+    | The throttle setting is the number of seconds a user must wait before
+    | generating more password reset tokens. This prevents the user from
+    | quickly generating a very large amount of password reset tokens.
+    |
+    */
+
+    'passwords' => [
+        'users' => [
+            'provider' => 'users',
+            'table' => env('AUTH_PASSWORD_RESET_TOKEN_TABLE', 'password_reset_tokens'),
+            'expire' => 60,
+            'throttle' => 60,
+        ],
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Password Confirmation Timeout
+    |--------------------------------------------------------------------------
+    |
+    | Here you may define the number of seconds before a password confirmation
+    | window expires and users are asked to re-enter their password via the
+    | confirmation screen. By default, the timeout lasts for three hours.
+    |
+    */
+
+    'password_timeout' => env('AUTH_PASSWORD_TIMEOUT', 10800),
+
+];
--- a/config/cache.php
+++ b/config/cache.php
@@ -0,0 +1,136 @@
+<?php
+
+use Illuminate\Support\Str;
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Default Cache Store
+    |--------------------------------------------------------------------------
+    |
+    | This option controls the default cache store that will be used by the
+    | framework. This connection is utilized if another isn't explicitly
+    | specified when running a cache operation inside the application.
+    |
+    */
+
+    'default' => env('CACHE_STORE', 'database'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Cache Stores
+    |--------------------------------------------------------------------------
+    |
+    | Here you may define all of the cache "stores" for your application as
+    | well as their drivers. You may even define multiple stores for the
+    | same cache driver to group types of items stored in your caches.
+    |
+    | Supported drivers: "array", "database", "file", "memcached",
+    |                    "redis", "dynamodb", "storage", "octane",
+    |                    "session", "failover", "null"
+    |
+    */
+
+    'stores' => [
+
+        'array' => [
+            'driver' => 'array',
+            'serialize' => false,
+        ],
+
+        'database' => [
+            'driver' => 'database',
+            'connection' => env('DB_CACHE_CONNECTION'),
+            'table' => env('DB_CACHE_TABLE', 'cache'),
+            'lock_connection' => env('DB_CACHE_LOCK_CONNECTION'),
+            'lock_table' => env('DB_CACHE_LOCK_TABLE'),
+        ],
+
+        'file' => [
+            'driver' => 'file',
+            'path' => storage_path('framework/cache/data'),
+            'lock_path' => storage_path('framework/cache/data'),
+        ],
+
+        'storage' => [
+            'driver' => 'storage',
+            'disk' => env('CACHE_STORAGE_DISK'),
+            'path' => env('CACHE_STORAGE_PATH', 'framework/cache/data'),
+        ],
+
+        'memcached' => [
+            'driver' => 'memcached',
+            'persistent_id' => env('MEMCACHED_PERSISTENT_ID'),
+            'sasl' => [
+                env('MEMCACHED_USERNAME'),
+                env('MEMCACHED_PASSWORD'),
+            ],
+            'options' => [
+                // Memcached::OPT_CONNECT_TIMEOUT => 2000,
+            ],
+            'servers' => [
+                [
+                    'host' => env('MEMCACHED_HOST', '127.0.0.1'),
+                    'port' => env('MEMCACHED_PORT', 11211),
+                    'weight' => 100,
+                ],
+            ],
+        ],
+
+        'redis' => [
+            'driver' => 'redis',
+            'connection' => env('REDIS_CACHE_CONNECTION', 'cache'),
+            'lock_connection' => env('REDIS_CACHE_LOCK_CONNECTION', 'default'),
+        ],
+
+        'dynamodb' => [
+            'driver' => 'dynamodb',
+            'key' => env('AWS_ACCESS_KEY_ID'),
+            'secret' => env('AWS_SECRET_ACCESS_KEY'),
+            'region' => env('AWS_DEFAULT_REGION', 'us-east-1'),
+            'table' => env('DYNAMODB_CACHE_TABLE', 'cache'),
+            'endpoint' => env('DYNAMODB_ENDPOINT'),
+        ],
+
+        'octane' => [
+            'driver' => 'octane',
+        ],
+
+        'failover' => [
+            'driver' => 'failover',
+            'stores' => [
+                'database',
+                'array',
+            ],
+        ],
+
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Cache Key Prefix
+    |--------------------------------------------------------------------------
+    |
+    | When utilizing the APC, database, memcached, Redis, and DynamoDB cache
+    | stores, there might be other applications using the same cache. For
+    | that reason, you may prefix every cache key to avoid collisions.
+    |
+    */
+
+    'prefix' => env('CACHE_PREFIX', Str::slug((string) env('APP_NAME', 'laravel')).'-cache-'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Serializable Classes
+    |--------------------------------------------------------------------------
+    |
+    | This value determines the classes that can be unserialized from cache
+    | storage. By default, no PHP classes will be unserialized from your
+    | cache to prevent gadget chain attacks if your APP_KEY is leaked.
+    |
+    */
+
+    'serializable_classes' => false,
+
+];
--- a/config/database.php
+++ b/config/database.php
@@ -0,0 +1,184 @@
+<?php
+
+use Illuminate\Support\Str;
+use Pdo\Mysql;
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Default Database Connection Name
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify which of the database connections below you wish
+    | to use as your default connection for database operations. This is
+    | the connection which will be utilized unless another connection
+    | is explicitly specified when you execute a query / statement.
+    |
+    */
+
+    'default' => env('DB_CONNECTION', 'sqlite'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Database Connections
+    |--------------------------------------------------------------------------
+    |
+    | Below are all of the database connections defined for your application.
+    | An example configuration is provided for each database system which
+    | is supported by Laravel. You're free to add / remove connections.
+    |
+    */
+
+    'connections' => [
+
+        'sqlite' => [
+            'driver' => 'sqlite',
+            'url' => env('DB_URL'),
+            'database' => env('DB_DATABASE', database_path('database.sqlite')),
+            'prefix' => '',
+            'foreign_key_constraints' => env('DB_FOREIGN_KEYS', true),
+            'busy_timeout' => null,
+            'journal_mode' => null,
+            'synchronous' => null,
+            'transaction_mode' => 'DEFERRED',
+        ],
+
+        'mysql' => [
+            'driver' => 'mysql',
+            'url' => env('DB_URL'),
+            'host' => env('DB_HOST', '127.0.0.1'),
+            'port' => env('DB_PORT', '3306'),
+            'database' => env('DB_DATABASE', 'laravel'),
+            'username' => env('DB_USERNAME', 'root'),
+            'password' => env('DB_PASSWORD', ''),
+            'unix_socket' => env('DB_SOCKET', ''),
+            'charset' => env('DB_CHARSET', 'utf8mb4'),
+            'collation' => env('DB_COLLATION', 'utf8mb4_unicode_ci'),
+            'prefix' => '',
+            'prefix_indexes' => true,
+            'strict' => true,
+            'engine' => null,
+            'options' => extension_loaded('pdo_mysql') ? array_filter([
+                Mysql::ATTR_SSL_CA => env('MYSQL_ATTR_SSL_CA'),
+            ]) : [],
+        ],
+
+        'mariadb' => [
+            'driver' => 'mariadb',
+            'url' => env('DB_URL'),
+            'host' => env('DB_HOST', '127.0.0.1'),
+            'port' => env('DB_PORT', '3306'),
+            'database' => env('DB_DATABASE', 'laravel'),
+            'username' => env('DB_USERNAME', 'root'),
+            'password' => env('DB_PASSWORD', ''),
+            'unix_socket' => env('DB_SOCKET', ''),
+            'charset' => env('DB_CHARSET', 'utf8mb4'),
+            'collation' => env('DB_COLLATION', 'utf8mb4_unicode_ci'),
+            'prefix' => '',
+            'prefix_indexes' => true,
+            'strict' => true,
+            'engine' => null,
+            'options' => extension_loaded('pdo_mysql') ? array_filter([
+                Mysql::ATTR_SSL_CA => env('MYSQL_ATTR_SSL_CA'),
+            ]) : [],
+        ],
+
+        'pgsql' => [
+            'driver' => 'pgsql',
+            'url' => env('DB_URL'),
+            'host' => env('DB_HOST', '127.0.0.1'),
+            'port' => env('DB_PORT', '5432'),
+            'database' => env('DB_DATABASE', 'laravel'),
+            'username' => env('DB_USERNAME', 'root'),
+            'password' => env('DB_PASSWORD', ''),
+            'charset' => env('DB_CHARSET', 'utf8'),
+            'prefix' => '',
+            'prefix_indexes' => true,
+            'search_path' => 'public',
+            'sslmode' => env('DB_SSLMODE', 'prefer'),
+        ],
+
+        'sqlsrv' => [
+            'driver' => 'sqlsrv',
+            'url' => env('DB_URL'),
+            'host' => env('DB_HOST', 'localhost'),
+            'port' => env('DB_PORT', '1433'),
+            'database' => env('DB_DATABASE', 'laravel'),
+            'username' => env('DB_USERNAME', 'root'),
+            'password' => env('DB_PASSWORD', ''),
+            'charset' => env('DB_CHARSET', 'utf8'),
+            'prefix' => '',
+            'prefix_indexes' => true,
+            // 'encrypt' => env('DB_ENCRYPT', 'yes'),
+            // 'trust_server_certificate' => env('DB_TRUST_SERVER_CERTIFICATE', 'false'),
+        ],
+
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Migration Repository Table
+    |--------------------------------------------------------------------------
+    |
+    | This table keeps track of all the migrations that have already run for
+    | your application. Using this information, we can determine which of
+    | the migrations on disk haven't actually been run on the database.
+    |
+    */
+
+    'migrations' => [
+        'table' => 'migrations',
+        'update_date_on_publish' => true,
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Redis Databases
+    |--------------------------------------------------------------------------
+    |
+    | Redis is an open source, fast, and advanced key-value store that also
+    | provides a richer body of commands than a typical key-value system
+    | such as Memcached. You may define your connection settings here.
+    |
+    */
+
+    'redis' => [
+
+        'client' => env('REDIS_CLIENT', 'phpredis'),
+
+        'options' => [
+            'cluster' => env('REDIS_CLUSTER', 'redis'),
+            'prefix' => env('REDIS_PREFIX', Str::slug((string) env('APP_NAME', 'laravel')).'-database-'),
+            'persistent' => env('REDIS_PERSISTENT', false),
+        ],
+
+        'default' => [
+            'url' => env('REDIS_URL'),
+            'host' => env('REDIS_HOST', '127.0.0.1'),
+            'username' => env('REDIS_USERNAME'),
+            'password' => env('REDIS_PASSWORD'),
+            'port' => env('REDIS_PORT', '6379'),
+            'database' => env('REDIS_DB', '0'),
+            'max_retries' => env('REDIS_MAX_RETRIES', 3),
+            'backoff_algorithm' => env('REDIS_BACKOFF_ALGORITHM', 'decorrelated_jitter'),
+            'backoff_base' => env('REDIS_BACKOFF_BASE', 100),
+            'backoff_cap' => env('REDIS_BACKOFF_CAP', 1000),
+        ],
+
+        'cache' => [
+            'url' => env('REDIS_URL'),
+            'host' => env('REDIS_HOST', '127.0.0.1'),
+            'username' => env('REDIS_USERNAME'),
+            'password' => env('REDIS_PASSWORD'),
+            'port' => env('REDIS_PORT', '6379'),
+            'database' => env('REDIS_CACHE_DB', '1'),
+            'max_retries' => env('REDIS_MAX_RETRIES', 3),
+            'backoff_algorithm' => env('REDIS_BACKOFF_ALGORITHM', 'decorrelated_jitter'),
+            'backoff_base' => env('REDIS_BACKOFF_BASE', 100),
+            'backoff_cap' => env('REDIS_BACKOFF_CAP', 1000),
+        ],
+
+    ],
+
+];
--- a/config/filesystems.php
+++ b/config/filesystems.php
@@ -0,0 +1,89 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Default Filesystem Disk
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify the default filesystem disk that should be used
+    | by the framework. The "local" disk, as well as a variety of cloud
+    | based disks are available to your application for file storage.
+    |
+    */
+
+    'default' => env('FILESYSTEM_DISK', 'local'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Filesystem Disks
+    |--------------------------------------------------------------------------
+    |
+    | Below you may configure as many filesystem disks as necessary, and you
+    | may even configure multiple disks for the same driver. Examples for
+    | most supported storage drivers are configured here for reference.
+    |
+    | Supported drivers: "local", "ftp", "sftp", "s3"
+    |
+    */
+
+    'disks' => [
+
+        'local' => [
+            'driver' => 'local',
+            'root' => storage_path('app/private'),
+            'serve' => false,  // jangan serve direct — mesti melalui controller
+            'throw' => false,
+            'report' => false,
+        ],
+
+        // Disk khas untuk audio dan transcript (private, tidak accessible web)
+        'private' => [
+            'driver' => 'local',
+            'root' => storage_path('app/private'),
+            'serve' => false,
+            'throw' => true,
+            'report' => true,
+        ],
+
+        'public' => [
+            'driver' => 'local',
+            'root' => storage_path('app/public'),
+            'url' => rtrim(env('APP_URL', 'http://localhost'), '/').'/storage',
+            'visibility' => 'public',
+            'throw' => false,
+            'report' => false,
+        ],
+
+        's3' => [
+            'driver' => 's3',
+            'key' => env('AWS_ACCESS_KEY_ID'),
+            'secret' => env('AWS_SECRET_ACCESS_KEY'),
+            'region' => env('AWS_DEFAULT_REGION'),
+            'bucket' => env('AWS_BUCKET'),
+            'url' => env('AWS_URL'),
+            'endpoint' => env('AWS_ENDPOINT'),
+            'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
+            'throw' => false,
+            'report' => false,
+        ],
+
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Symbolic Links
+    |--------------------------------------------------------------------------
+    |
+    | Here you may configure the symbolic links that will be created when the
+    | `storage:link` Artisan command is executed. The array keys should be
+    | the locations of the links and the values should be their targets.
+    |
+    */
+
+    'links' => [
+        public_path('storage') => storage_path('app/public'),
+    ],
+
+];
--- a/config/logging.php
+++ b/config/logging.php
@@ -0,0 +1,132 @@
+<?php
+
+use Monolog\Handler\NullHandler;
+use Monolog\Handler\StreamHandler;
+use Monolog\Handler\SyslogUdpHandler;
+use Monolog\Processor\PsrLogMessageProcessor;
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Default Log Channel
+    |--------------------------------------------------------------------------
+    |
+    | This option defines the default log channel that is utilized to write
+    | messages to your logs. The value provided here should match one of
+    | the channels present in the list of "channels" configured below.
+    |
+    */
+
+    'default' => env('LOG_CHANNEL', 'stack'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Deprecations Log Channel
+    |--------------------------------------------------------------------------
+    |
+    | This option controls the log channel that should be used to log warnings
+    | regarding deprecated PHP and library features. This allows you to get
+    | your application ready for upcoming major versions of dependencies.
+    |
+    */
+
+    'deprecations' => [
+        'channel' => env('LOG_DEPRECATIONS_CHANNEL', 'null'),
+        'trace' => env('LOG_DEPRECATIONS_TRACE', false),
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Log Channels
+    |--------------------------------------------------------------------------
+    |
+    | Here you may configure the log channels for your application. Laravel
+    | utilizes the Monolog PHP logging library, which includes a variety
+    | of powerful log handlers and formatters that you're free to use.
+    |
+    | Available drivers: "single", "daily", "slack", "syslog",
+    |                    "errorlog", "monolog", "custom", "stack"
+    |
+    */
+
+    'channels' => [
+
+        'stack' => [
+            'driver' => 'stack',
+            'channels' => explode(',', (string) env('LOG_STACK', 'single')),
+            'ignore_exceptions' => false,
+        ],
+
+        'single' => [
+            'driver' => 'single',
+            'path' => storage_path('logs/laravel.log'),
+            'level' => env('LOG_LEVEL', 'debug'),
+            'replace_placeholders' => true,
+        ],
+
+        'daily' => [
+            'driver' => 'daily',
+            'path' => storage_path('logs/laravel.log'),
+            'level' => env('LOG_LEVEL', 'debug'),
+            'days' => env('LOG_DAILY_DAYS', 14),
+            'replace_placeholders' => true,
+        ],
+
+        'slack' => [
+            'driver' => 'slack',
+            'url' => env('LOG_SLACK_WEBHOOK_URL'),
+            'username' => env('LOG_SLACK_USERNAME', env('APP_NAME', 'Laravel')),
+            'emoji' => env('LOG_SLACK_EMOJI', ':boom:'),
+            'level' => env('LOG_LEVEL', 'critical'),
+            'replace_placeholders' => true,
+        ],
+
+        'papertrail' => [
+            'driver' => 'monolog',
+            'level' => env('LOG_LEVEL', 'debug'),
+            'handler' => env('LOG_PAPERTRAIL_HANDLER', SyslogUdpHandler::class),
+            'handler_with' => [
+                'host' => env('PAPERTRAIL_URL'),
+                'port' => env('PAPERTRAIL_PORT'),
+                'connectionString' => 'tls://'.env('PAPERTRAIL_URL').':'.env('PAPERTRAIL_PORT'),
+            ],
+            'processors' => [PsrLogMessageProcessor::class],
+        ],
+
+        'stderr' => [
+            'driver' => 'monolog',
+            'level' => env('LOG_LEVEL', 'debug'),
+            'handler' => StreamHandler::class,
+            'handler_with' => [
+                'stream' => 'php://stderr',
+            ],
+            'formatter' => env('LOG_STDERR_FORMATTER'),
+            'processors' => [PsrLogMessageProcessor::class],
+        ],
+
+        'syslog' => [
+            'driver' => 'syslog',
+            'level' => env('LOG_LEVEL', 'debug'),
+            'facility' => env('LOG_SYSLOG_FACILITY', LOG_USER),
+            'replace_placeholders' => true,
+        ],
+
+        'errorlog' => [
+            'driver' => 'errorlog',
+            'level' => env('LOG_LEVEL', 'debug'),
+            'replace_placeholders' => true,
+        ],
+
+        'null' => [
+            'driver' => 'monolog',
+            'handler' => NullHandler::class,
+        ],
+
+        'emergency' => [
+            'path' => storage_path('logs/laravel.log'),
+        ],
+
+    ],
+
+];
--- a/config/mail.php
+++ b/config/mail.php
@@ -0,0 +1,118 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Default Mailer
+    |--------------------------------------------------------------------------
+    |
+    | This option controls the default mailer that is used to send all email
+    | messages unless another mailer is explicitly specified when sending
+    | the message. All additional mailers can be configured within the
+    | "mailers" array. Examples of each type of mailer are provided.
+    |
+    */
+
+    'default' => env('MAIL_MAILER', 'log'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Mailer Configurations
+    |--------------------------------------------------------------------------
+    |
+    | Here you may configure all of the mailers used by your application plus
+    | their respective settings. Several examples have been configured for
+    | you and you are free to add your own as your application requires.
+    |
+    | Laravel supports a variety of mail "transport" drivers that can be used
+    | when delivering an email. You may specify which one you're using for
+    | your mailers below. You may also add additional mailers if needed.
+    |
+    | Supported: "smtp", "sendmail", "mailgun", "ses", "ses-v2",
+    |            "postmark", "resend", "log", "array",
+    |            "failover", "roundrobin"
+    |
+    */
+
+    'mailers' => [
+
+        'smtp' => [
+            'transport' => 'smtp',
+            'scheme' => env('MAIL_SCHEME'),
+            'url' => env('MAIL_URL'),
+            'host' => env('MAIL_HOST', '127.0.0.1'),
+            'port' => env('MAIL_PORT', 2525),
+            'username' => env('MAIL_USERNAME'),
+            'password' => env('MAIL_PASSWORD'),
+            'timeout' => null,
+            'local_domain' => env('MAIL_EHLO_DOMAIN', parse_url((string) env('APP_URL', 'http://localhost'), PHP_URL_HOST)),
+        ],
+
+        'ses' => [
+            'transport' => 'ses',
+        ],
+
+        'postmark' => [
+            'transport' => 'postmark',
+            // 'message_stream_id' => env('POSTMARK_MESSAGE_STREAM_ID'),
+            // 'client' => [
+            //     'timeout' => 5,
+            // ],
+        ],
+
+        'resend' => [
+            'transport' => 'resend',
+        ],
+
+        'sendmail' => [
+            'transport' => 'sendmail',
+            'path' => env('MAIL_SENDMAIL_PATH', '/usr/sbin/sendmail -bs -i'),
+        ],
+
+        'log' => [
+            'transport' => 'log',
+            'channel' => env('MAIL_LOG_CHANNEL'),
+        ],
+
+        'array' => [
+            'transport' => 'array',
+        ],
+
+        'failover' => [
+            'transport' => 'failover',
+            'mailers' => [
+                'smtp',
+                'log',
+            ],
+            'retry_after' => 60,
+        ],
+
+        'roundrobin' => [
+            'transport' => 'roundrobin',
+            'mailers' => [
+                'ses',
+                'postmark',
+            ],
+            'retry_after' => 60,
+        ],
+
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Global "From" Address
+    |--------------------------------------------------------------------------
+    |
+    | You may wish for all emails sent by your application to be sent from
+    | the same address. Here you may specify a name and address that is
+    | used globally for all emails that are sent by your application.
+    |
+    */
+
+    'from' => [
+        'address' => env('MAIL_FROM_ADDRESS', 'hello@example.com'),
+        'name' => env('MAIL_FROM_NAME', env('APP_NAME', 'Laravel')),
+    ],
+
+];
--- a/config/queue.php
+++ b/config/queue.php
@@ -0,0 +1,129 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Default Queue Connection Name
+    |--------------------------------------------------------------------------
+    |
+    | Laravel's queue supports a variety of backends via a single, unified
+    | API, giving you convenient access to each backend using identical
+    | syntax for each. The default queue connection is defined below.
+    |
+    */
+
+    'default' => env('QUEUE_CONNECTION', 'database'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Queue Connections
+    |--------------------------------------------------------------------------
+    |
+    | Here you may configure the connection options for every queue backend
+    | used by your application. An example configuration is provided for
+    | each backend supported by Laravel. You're also free to add more.
+    |
+    | Drivers: "sync", "database", "beanstalkd", "sqs", "redis",
+    |          "deferred", "background", "failover", "null"
+    |
+    */
+
+    'connections' => [
+
+        'sync' => [
+            'driver' => 'sync',
+        ],
+
+        'database' => [
+            'driver' => 'database',
+            'connection' => env('DB_QUEUE_CONNECTION'),
+            'table' => env('DB_QUEUE_TABLE', 'jobs'),
+            'queue' => env('DB_QUEUE', 'default'),
+            'retry_after' => (int) env('DB_QUEUE_RETRY_AFTER', 90),
+            'after_commit' => false,
+        ],
+
+        'beanstalkd' => [
+            'driver' => 'beanstalkd',
+            'host' => env('BEANSTALKD_QUEUE_HOST', 'localhost'),
+            'queue' => env('BEANSTALKD_QUEUE', 'default'),
+            'retry_after' => (int) env('BEANSTALKD_QUEUE_RETRY_AFTER', 90),
+            'block_for' => 0,
+            'after_commit' => false,
+        ],
+
+        'sqs' => [
+            'driver' => 'sqs',
+            'key' => env('AWS_ACCESS_KEY_ID'),
+            'secret' => env('AWS_SECRET_ACCESS_KEY'),
+            'prefix' => env('SQS_PREFIX', 'https://sqs.us-east-1.amazonaws.com/your-account-id'),
+            'queue' => env('SQS_QUEUE', 'default'),
+            'suffix' => env('SQS_SUFFIX'),
+            'region' => env('AWS_DEFAULT_REGION', 'us-east-1'),
+            'after_commit' => false,
+        ],
+
+        'redis' => [
+            'driver' => 'redis',
+            'connection' => env('REDIS_QUEUE_CONNECTION', 'default'),
+            'queue' => env('REDIS_QUEUE', 'default'),
+            'retry_after' => (int) env('REDIS_QUEUE_RETRY_AFTER', 90),
+            'block_for' => null,
+            'after_commit' => false,
+        ],
+
+        'deferred' => [
+            'driver' => 'deferred',
+        ],
+
+        'background' => [
+            'driver' => 'background',
+        ],
+
+        'failover' => [
+            'driver' => 'failover',
+            'connections' => [
+                'database',
+                'deferred',
+            ],
+        ],
+
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Job Batching
+    |--------------------------------------------------------------------------
+    |
+    | The following options configure the database and table that store job
+    | batching information. These options can be updated to any database
+    | connection and table which has been defined by your application.
+    |
+    */
+
+    'batching' => [
+        'database' => env('DB_CONNECTION', 'sqlite'),
+        'table' => 'job_batches',
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Failed Queue Jobs
+    |--------------------------------------------------------------------------
+    |
+    | These options configure the behavior of failed queue job logging so you
+    | can control how and where failed jobs are stored. Laravel ships with
+    | support for storing failed jobs in a simple file or in a database.
+    |
+    | Supported drivers: "database-uuids", "dynamodb", "file", "null"
+    |
+    */
+
+    'failed' => [
+        'driver' => env('QUEUE_FAILED_DRIVER', 'database-uuids'),
+        'database' => env('DB_CONNECTION', 'sqlite'),
+        'table' => 'failed_jobs',
+    ],
+
+];
--- a/config/services.php
+++ b/config/services.php
@@ -0,0 +1,38 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Third Party Services
+    |--------------------------------------------------------------------------
+    |
+    | This file is for storing the credentials for third party services such
+    | as Mailgun, Postmark, AWS and more. This file provides the de facto
+    | location for this type of information, allowing packages to have
+    | a conventional file to locate the various service credentials.
+    |
+    */
+
+    'postmark' => [
+        'key' => env('POSTMARK_API_KEY'),
+    ],
+
+    'resend' => [
+        'key' => env('RESEND_API_KEY'),
+    ],
+
+    'ses' => [
+        'key' => env('AWS_ACCESS_KEY_ID'),
+        'secret' => env('AWS_SECRET_ACCESS_KEY'),
+        'region' => env('AWS_DEFAULT_REGION', 'us-east-1'),
+    ],
+
+    'slack' => [
+        'notifications' => [
+            'bot_user_oauth_token' => env('SLACK_BOT_USER_OAUTH_TOKEN'),
+            'channel' => env('SLACK_BOT_USER_DEFAULT_CHANNEL'),
+        ],
+    ],
+
+];
--- a/config/session.php
+++ b/config/session.php
@@ -0,0 +1,233 @@
+<?php
+
+use Illuminate\Support\Str;
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Default Session Driver
+    |--------------------------------------------------------------------------
+    |
+    | This option determines the default session driver that is utilized for
+    | incoming requests. Laravel supports a variety of storage options to
+    | persist session data. Database storage is a great default choice.
+    |
+    | Supported: "file", "cookie", "database", "memcached",
+    |            "redis", "dynamodb", "array"
+    |
+    */
+
+    'driver' => env('SESSION_DRIVER', 'database'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Lifetime
+    |--------------------------------------------------------------------------
+    |
+    | Here you may specify the number of minutes that you wish the session
+    | to be allowed to remain idle before it expires. If you want them
+    | to expire immediately when the browser is closed then you may
+    | indicate that via the expire_on_close configuration option.
+    |
+    */
+
+    'lifetime' => (int) env('SESSION_LIFETIME', 120),
+
+    'expire_on_close' => env('SESSION_EXPIRE_ON_CLOSE', false),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Encryption
+    |--------------------------------------------------------------------------
+    |
+    | This option allows you to easily specify that all of your session data
+    | should be encrypted before it's stored. All encryption is performed
+    | automatically by Laravel and you may use the session like normal.
+    |
+    */
+
+    'encrypt' => env('SESSION_ENCRYPT', false),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session File Location
+    |--------------------------------------------------------------------------
+    |
+    | When utilizing the "file" session driver, the session files are placed
+    | on disk. The default storage location is defined here; however, you
+    | are free to provide another location where they should be stored.
+    |
+    */
+
+    'files' => storage_path('framework/sessions'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Database Connection
+    |--------------------------------------------------------------------------
+    |
+    | When using the "database" or "redis" session drivers, you may specify a
+    | connection that should be used to manage these sessions. This should
+    | correspond to a connection in your database configuration options.
+    |
+    */
+
+    'connection' => env('SESSION_CONNECTION'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Database Table
+    |--------------------------------------------------------------------------
+    |
+    | When using the "database" session driver, you may specify the table to
+    | be used to store sessions. Of course, a sensible default is defined
+    | for you; however, you're welcome to change this to another table.
+    |
+    */
+
+    'table' => env('SESSION_TABLE', 'sessions'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Cache Store
+    |--------------------------------------------------------------------------
+    |
+    | When using one of the framework's cache driven session backends, you may
+    | define the cache store which should be used to store the session data
+    | between requests. This must match one of your defined cache stores.
+    |
+    | Affects: "dynamodb", "memcached", "redis"
+    |
+    */
+
+    'store' => env('SESSION_STORE'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Sweeping Lottery
+    |--------------------------------------------------------------------------
+    |
+    | Some session drivers must manually sweep their storage location to get
+    | rid of old sessions from storage. Here are the chances that it will
+    | happen on a given request. By default, the odds are 2 out of 100.
+    |
+    */
+
+    'lottery' => [2, 100],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Cookie Name
+    |--------------------------------------------------------------------------
+    |
+    | Here you may change the name of the session cookie that is created by
+    | the framework. Typically, you should not need to change this value
+    | since doing so does not grant a meaningful security improvement.
+    |
+    */
+
+    'cookie' => env(
+        'SESSION_COOKIE',
+        Str::slug((string) env('APP_NAME', 'laravel')).'-session'
+    ),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Cookie Path
+    |--------------------------------------------------------------------------
+    |
+    | The session cookie path determines the path for which the cookie will
+    | be regarded as available. Typically, this will be the root path of
+    | your application, but you're free to change this when necessary.
+    |
+    */
+
+    'path' => env('SESSION_PATH', '/'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Cookie Domain
+    |--------------------------------------------------------------------------
+    |
+    | This value determines the domain and subdomains the session cookie is
+    | available to. By default, the cookie will be available to the root
+    | domain without subdomains. Typically, this shouldn't be changed.
+    |
+    */
+
+    'domain' => env('SESSION_DOMAIN'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | HTTPS Only Cookies
+    |--------------------------------------------------------------------------
+    |
+    | By setting this option to true, session cookies will only be sent back
+    | to the server if the browser has a HTTPS connection. This will keep
+    | the cookie from being sent to you when it can't be done securely.
+    |
+    */
+
+    'secure' => env('SESSION_SECURE_COOKIE'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | HTTP Access Only
+    |--------------------------------------------------------------------------
+    |
+    | Setting this value to true will prevent JavaScript from accessing the
+    | value of the cookie and the cookie will only be accessible through
+    | the HTTP protocol. It's unlikely you should disable this option.
+    |
+    */
+
+    'http_only' => env('SESSION_HTTP_ONLY', true),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Same-Site Cookies
+    |--------------------------------------------------------------------------
+    |
+    | This option determines how your cookies behave when cross-site requests
+    | take place, and can be used to mitigate CSRF attacks. By default, we
+    | will set this value to "lax" to permit secure cross-site requests.
+    |
+    | See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value
+    |
+    | Supported: "lax", "strict", "none", null
+    |
+    */
+
+    'same_site' => env('SESSION_SAME_SITE', 'lax'),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Partitioned Cookies
+    |--------------------------------------------------------------------------
+    |
+    | Setting this value to true will tie the cookie to the top-level site for
+    | a cross-site context. Partitioned cookies are accepted by the browser
+    | when flagged "secure" and the Same-Site attribute is set to "none".
+    |
+    */
+
+    'partitioned' => env('SESSION_PARTITIONED_COOKIE', false),
+
+    /*
+    |--------------------------------------------------------------------------
+    | Session Serialization
+    |--------------------------------------------------------------------------
+    |
+    | This value controls the serialization strategy for session data, which
+    | is JSON by default. Setting this to "php" allows the storage of PHP
+    | objects in the session but can make an application vulnerable to
+    | "gadget chain" serialization attacks if the APP_KEY is leaked.
+    |
+    | Supported: "json", "php"
+    |
+    */
+
+    'serialization' => 'json',
+
+];
--- a/config/speech2text.php
+++ b/config/speech2text.php
@@ -0,0 +1,60 @@
+<?php
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Transcription Engine
+    |--------------------------------------------------------------------------
+    */
+    'transcription' => [
+        'engine'    => env('TRANSCRIPTION_ENGINE', 'faster-whisper'),
+        'worker_url' => env('TRANSCRIPTION_WORKER_URL', 'http://transcription-worker:8000'),
+        'model'     => env('WHISPER_MODEL', 'small'),
+        'language'  => env('WHISPER_LANGUAGE', 'ms'),
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Upload Limits
+    |--------------------------------------------------------------------------
+    */
+    'upload' => [
+        'max_mb'       => (int) env('PRIVATE_AUDIO_MAX_MB', 200),
+        'allowed_mimes' => [
+            'audio/mpeg',
+            'audio/mp3',
+            'audio/wav',
+            'audio/x-wav',
+            'audio/mp4',
+            'audio/x-m4a',
+            'audio/aac',
+            'video/mp4',
+            'audio/ogg',
+            'audio/flac',
+            'audio/webm',
+        ],
+        'allowed_extensions' => ['mp3', 'wav', 'm4a', 'mp4', 'aac', 'ogg', 'flac', 'webm'],
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Ollama — Optional Post-processing
+    |--------------------------------------------------------------------------
+    */
+    'ollama' => [
+        'enabled'  => env('OLLAMA_ENABLED', false),
+        'base_url' => env('OLLAMA_BASE_URL', 'http://ollama:11434'),
+        'model'    => env('OLLAMA_MODEL', 'llama3.1'),
+    ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Storage Path Templates
+    |--------------------------------------------------------------------------
+    */
+    'storage' => [
+        'audio_path' => 'transcriptions/{uuid}/audio',
+    ],
+
+];
--- a/database/.gitignore
+++ b/database/.gitignore
@@ -0,0 +1 @@
+*.sqlite*
--- a/database/factories/TranscriptionProjectFactory.php
+++ b/database/factories/TranscriptionProjectFactory.php
@@ -0,0 +1,53 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\TranscriptionProject;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Support\Str;
+
+/** @extends Factory<TranscriptionProject> */
+class TranscriptionProjectFactory extends Factory
+{
+    public function definition(): array
+    {
+        return [
+            'uuid'                 => (string) Str::uuid(),
+            'title'                => fake()->sentence(4),
+            'description'          => fake()->optional()->sentence(),
+            'owner_user_id'        => User::factory(),
+            'original_filename'    => fake()->word() . '.mp3',
+            'stored_audio_path'    => 'transcriptions/' . Str::uuid() . '/audio/' . Str::random(20) . '.mp3',
+            'mime_type'            => 'audio/mpeg',
+            'file_size'            => fake()->numberBetween(100000, 50000000),
+            'duration_seconds'     => fake()->optional()->numberBetween(60, 3600),
+            'language'             => 'ms',
+            'transcription_status' => 'pending',
+            'transcription_engine' => 'faster-whisper',
+            'transcript_text'      => null,
+        ];
+    }
+
+    public function completed(): static
+    {
+        return $this->state(fn () => [
+            'transcription_status' => 'completed',
+            'transcript_text'      => fake()->paragraphs(3, true),
+            'processed_at'         => now(),
+        ]);
+    }
+
+    public function failed(): static
+    {
+        return $this->state(fn () => [
+            'transcription_status' => 'failed',
+            'error_message'        => 'Connection refused',
+        ]);
+    }
+
+    public function processing(): static
+    {
+        return $this->state(fn () => ['transcription_status' => 'processing']);
+    }
+}
--- a/database/factories/UserFactory.php
+++ b/database/factories/UserFactory.php
@@ -0,0 +1,43 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\User;
+use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+
+/** @extends Factory<User> */
+class UserFactory extends Factory
+{
+    protected static ?string $password;
+
+    public function definition(): array
+    {
+        return [
+            'name'              => fake()->name(),
+            'email'             => fake()->unique()->safeEmail(),
+            'email_verified_at' => now(),
+            'password'          => static::$password ??= Hash::make('password'),
+            'role'              => 'user',
+            'department_id'     => null,
+            'is_active'         => true,
+            'remember_token'    => Str::random(10),
+        ];
+    }
+
+    public function admin(): static
+    {
+        return $this->state(fn () => ['role' => 'admin']);
+    }
+
+    public function inactive(): static
+    {
+        return $this->state(fn () => ['is_active' => false]);
+    }
+
+    public function unverified(): static
+    {
+        return $this->state(fn () => ['email_verified_at' => null]);
+    }
+}
--- a/database/migrations/0001_01_01_000000_create_users_table.php
+++ b/database/migrations/0001_01_01_000000_create_users_table.php
@@ -0,0 +1,57 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('departments', function (Blueprint $table) {
+            $table->id();
+            $table->string('name');
+            $table->string('code', 50)->nullable()->unique();
+            $table->boolean('is_active')->default(true);
+            $table->timestamps();
+        });
+
+        Schema::create('users', function (Blueprint $table) {
+            $table->id();
+            $table->string('name');
+            $table->string('email')->unique();
+            $table->timestamp('email_verified_at')->nullable();
+            $table->string('password');
+            $table->enum('role', ['admin', 'user'])->default('user');
+            $table->foreignId('department_id')->nullable()->constrained('departments')->nullOnDelete();
+            $table->boolean('is_active')->default(true);
+            $table->timestamp('last_login_at')->nullable();
+            $table->rememberToken();
+            $table->timestamps();
+            $table->softDeletes();
+        });
+
+        Schema::create('password_reset_tokens', function (Blueprint $table) {
+            $table->string('email')->primary();
+            $table->string('token');
+            $table->timestamp('created_at')->nullable();
+        });
+
+        Schema::create('sessions', function (Blueprint $table) {
+            $table->string('id')->primary();
+            $table->foreignId('user_id')->nullable()->index();
+            $table->string('ip_address', 45)->nullable();
+            $table->text('user_agent')->nullable();
+            $table->longText('payload');
+            $table->integer('last_activity')->index();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('sessions');
+        Schema::dropIfExists('password_reset_tokens');
+        Schema::dropIfExists('users');
+        Schema::dropIfExists('departments');
+    }
+};
--- a/database/migrations/0001_01_01_000001_create_cache_table.php
+++ b/database/migrations/0001_01_01_000001_create_cache_table.php
@@ -0,0 +1,35 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('cache', function (Blueprint $table) {
+            $table->string('key')->primary();
+            $table->mediumText('value');
+            $table->bigInteger('expiration')->index();
+        });
+
+        Schema::create('cache_locks', function (Blueprint $table) {
+            $table->string('key')->primary();
+            $table->string('owner');
+            $table->bigInteger('expiration')->index();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('cache');
+        Schema::dropIfExists('cache_locks');
+    }
+};
--- a/database/migrations/0001_01_01_000002_create_jobs_table.php
+++ b/database/migrations/0001_01_01_000002_create_jobs_table.php
@@ -0,0 +1,59 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('jobs', function (Blueprint $table) {
+            $table->id();
+            $table->string('queue')->index();
+            $table->longText('payload');
+            $table->unsignedSmallInteger('attempts');
+            $table->unsignedInteger('reserved_at')->nullable();
+            $table->unsignedInteger('available_at');
+            $table->unsignedInteger('created_at');
+        });
+
+        Schema::create('job_batches', function (Blueprint $table) {
+            $table->string('id')->primary();
+            $table->string('name');
+            $table->integer('total_jobs');
+            $table->integer('pending_jobs');
+            $table->integer('failed_jobs');
+            $table->longText('failed_job_ids');
+            $table->mediumText('options')->nullable();
+            $table->integer('cancelled_at')->nullable();
+            $table->integer('created_at');
+            $table->integer('finished_at')->nullable();
+        });
+
+        Schema::create('failed_jobs', function (Blueprint $table) {
+            $table->id();
+            $table->string('uuid')->unique();
+            $table->string('connection');
+            $table->string('queue');
+            $table->longText('payload');
+            $table->longText('exception');
+            $table->timestamp('failed_at')->useCurrent();
+
+            $table->index(['connection', 'queue', 'failed_at']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('jobs');
+        Schema::dropIfExists('job_batches');
+        Schema::dropIfExists('failed_jobs');
+    }
+};
--- a/database/migrations/2024_01_01_000010_create_audit_logs_table.php
+++ b/database/migrations/2024_01_01_000010_create_audit_logs_table.php
@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('audit_logs', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('actor_user_id')->nullable()->constrained('users')->nullOnDelete();
+            $table->string('actor_role', 50)->nullable();
+            $table->string('action', 100)->index();
+            $table->string('subject_type', 100)->nullable();
+            $table->unsignedBigInteger('subject_id')->nullable();
+            $table->foreignId('target_user_id')->nullable()->constrained('users')->nullOnDelete();
+            $table->unsignedBigInteger('project_id')->nullable();
+            $table->json('old_values')->nullable();
+            $table->json('new_values')->nullable();
+            $table->text('justification')->nullable();
+            $table->string('ip_address', 45)->nullable();
+            $table->text('user_agent')->nullable();
+            $table->timestamp('created_at')->nullable()->index();
+
+            $table->index(['subject_type', 'subject_id']);
+            $table->index('project_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('audit_logs');
+    }
+};
--- a/database/migrations/2024_01_01_000020_create_transcription_projects_table.php
+++ b/database/migrations/2024_01_01_000020_create_transcription_projects_table.php
@@ -0,0 +1,76 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('transcription_projects', function (Blueprint $table) {
+            $table->id();
+            $table->uuid('uuid')->unique();
+            $table->string('title');
+            $table->text('description')->nullable();
+            $table->foreignId('owner_user_id')->constrained('users')->restrictOnDelete();
+            $table->string('original_filename', 500);
+            $table->string('stored_audio_path', 1000);
+            $table->string('mime_type', 100);
+            $table->unsignedBigInteger('file_size');
+            $table->unsignedInteger('duration_seconds')->nullable();
+            $table->string('language', 10)->default('ms');
+            $table->enum('transcription_status', ['pending', 'processing', 'completed', 'failed'])->default('pending')->index();
+            $table->string('transcription_engine', 50)->nullable();
+            $table->longText('transcript_text')->nullable();  // encrypted via model cast
+            $table->decimal('transcript_confidence', 5, 4)->nullable();
+            $table->text('error_message')->nullable();
+            $table->timestamp('processed_at')->nullable();
+            $table->timestamps();
+            $table->softDeletes();
+
+            $table->index('owner_user_id');
+        });
+
+        Schema::create('project_collaborators', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('project_id')->constrained('transcription_projects')->cascadeOnDelete();
+            $table->foreignId('user_id')->constrained('users')->cascadeOnDelete();
+            $table->enum('role', ['editor', 'viewer'])->default('editor');
+            $table->foreignId('added_by')->constrained('users')->restrictOnDelete();
+            $table->timestamps();
+
+            $table->unique(['project_id', 'user_id']);
+        });
+
+        Schema::create('transcript_versions', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('project_id')->constrained('transcription_projects')->cascadeOnDelete();
+            $table->foreignId('edited_by')->constrained('users')->restrictOnDelete();
+            $table->unsignedInteger('version_number');
+            $table->longText('old_text')->nullable();
+            $table->longText('new_text');
+            $table->string('change_summary', 500)->nullable();
+            $table->timestamp('created_at')->nullable();
+
+            $table->index(['project_id', 'version_number']);
+        });
+
+        Schema::create('project_comments', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('project_id')->constrained('transcription_projects')->cascadeOnDelete();
+            $table->foreignId('user_id')->constrained('users')->restrictOnDelete();
+            $table->text('message');
+            $table->timestamps();
+            $table->softDeletes();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('project_comments');
+        Schema::dropIfExists('transcript_versions');
+        Schema::dropIfExists('project_collaborators');
+        Schema::dropIfExists('transcription_projects');
+    }
+};
--- a/database/seeders/AdminUserSeeder.php
+++ b/database/seeders/AdminUserSeeder.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Models\User;
+use Illuminate\Database\Seeder;
+use Illuminate\Support\Facades\Hash;
+
+class AdminUserSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $name     = env('ADMIN_DEFAULT_NAME');
+        $email    = env('ADMIN_DEFAULT_EMAIL');
+        $password = env('ADMIN_DEFAULT_PASSWORD');
+
+        if (! $name || ! $email || ! $password) {
+            $this->command->warn(
+                'Admin default tidak dicipta. Sila isi ADMIN_DEFAULT_NAME, ADMIN_DEFAULT_EMAIL, dan ADMIN_DEFAULT_PASSWORD dalam .env'
+            );
+            return;
+        }
+
+        $admin = User::firstOrCreate(
+            ['email' => $email],
+            [
+                'name'              => $name,
+                'password'          => Hash::make($password),
+                'role'              => 'admin',
+                'is_active'         => true,
+                'email_verified_at' => now(),
+            ]
+        );
+
+        if ($admin->wasRecentlyCreated) {
+            $this->command->info("Admin '{$name}' ({$email}) berjaya dicipta.");
+        } else {
+            $this->command->info("Admin '{$email}' sudah wujud. Tiada perubahan.");
+        }
+    }
+}
--- a/database/seeders/DatabaseSeeder.php
+++ b/database/seeders/DatabaseSeeder.php
@@ -0,0 +1,16 @@
+<?php
+
+namespace Database\Seeders;
+
+use Illuminate\Database\Seeder;
+
+class DatabaseSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $this->call([
+            DepartmentSeeder::class,
+            AdminUserSeeder::class,
+        ]);
+    }
+}
--- a/database/seeders/DepartmentSeeder.php
+++ b/database/seeders/DepartmentSeeder.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Models\Department;
+use Illuminate\Database\Seeder;
+
+class DepartmentSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $departments = [
+            ['name' => 'Jabatan Pentadbiran',            'code' => 'JPA'],
+            ['name' => 'Jabatan Kewangan',               'code' => 'JKW'],
+            ['name' => 'Jabatan Kejuruteraan',            'code' => 'JKJ'],
+            ['name' => 'Jabatan Perancangan Bandar',      'code' => 'JPB'],
+            ['name' => 'Jabatan Kesihatan Persekitaran',  'code' => 'JKP'],
+            ['name' => 'Jabatan Pelesenan',               'code' => 'JPL'],
+            ['name' => 'Jabatan Undang-Undang',           'code' => 'JUU'],
+            ['name' => 'Jabatan Teknologi Maklumat',      'code' => 'JTM'],
+            ['name' => 'Jabatan Landskap & Rekreasi',     'code' => 'JLR'],
+            ['name' => 'Jabatan Penguatkuasaan',          'code' => 'JPK'],
+        ];
+
+        foreach ($departments as $dept) {
+            Department::firstOrCreate(['code' => $dept['code']], $dept);
+        }
+    }
+}
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -0,0 +1,167 @@
+name: speech2text-mbip
+
+services:
+  # ============================================================
+  # Nginx — Web Server
+  # ============================================================
+  nginx:
+    image: nginx:1.25-alpine
+    container_name: speech2text_nginx
+    restart: unless-stopped
+    ports:
+      - "80:80"
+    volumes:
+      - ./:/var/www/html:ro
+      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      - app
+    networks:
+      - speech2text_net
+
+  # ============================================================
+  # App — Laravel PHP-FPM
+  # ============================================================
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: speech2text_app
+    restart: unless-stopped
+    environment:
+      - APP_ENV=${APP_ENV:-production}
+    volumes:
+      - ./:/var/www/html
+      - ./docker/php/php.ini:/usr/local/etc/php/conf.d/app.ini:ro
+    depends_on:
+      mysql:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    networks:
+      - speech2text_net
+
+  # ============================================================
+  # MySQL 8
+  # ============================================================
+  mysql:
+    image: mysql:8.0
+    container_name: speech2text_mysql
+    restart: unless-stopped
+    environment:
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
+      MYSQL_DATABASE: ${MYSQL_DATABASE:-speech2text}
+      MYSQL_USER: ${MYSQL_USER:-speech2text}
+      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
+    volumes:
+      - mysql_data:/var/lib/mysql
+    ports:
+      - "127.0.0.1:3307:3306"  # host:3307 → container:3306 (elak conflict jika ada projek lain)
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - speech2text_net
+
+  # ============================================================
+  # Redis — Queue & Cache
+  # ============================================================
+  redis:
+    image: redis:7-alpine
+    container_name: speech2text_redis
+    restart: unless-stopped
+    command: redis-server --save 60 1 --loglevel warning
+    volumes:
+      - redis_data:/data
+    networks:
+      - speech2text_net
+
+  # ============================================================
+  # Queue Worker — Laravel
+  # ============================================================
+  queue-worker:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: speech2text_queue
+    restart: unless-stopped
+    command: php artisan queue:work redis --sleep=3 --tries=3 --max-time=3600 --memory=256
+    volumes:
+      - ./:/var/www/html
+    depends_on:
+      mysql:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    networks:
+      - speech2text_net
+
+  # ============================================================
+  # Scheduler — Laravel Cron
+  # ============================================================
+  scheduler:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: speech2text_scheduler
+    restart: unless-stopped
+    command: php artisan schedule:work
+    volumes:
+      - ./:/var/www/html
+    depends_on:
+      mysql:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    networks:
+      - speech2text_net
+
+  # ============================================================
+  # Transcription Worker — Python FastAPI + faster-whisper
+  # INTERNAL ONLY — tidak boleh diakses dari luar Docker network
+  # ============================================================
+  transcription-worker:
+    build:
+      context: ./docker/transcription-worker
+      dockerfile: Dockerfile
+    container_name: speech2text_transcription
+    restart: unless-stopped
+    environment:
+      WHISPER_MODEL: ${WHISPER_MODEL:-small}
+      WHISPER_LANGUAGE: ${WHISPER_LANGUAGE:-ms}
+      WHISPER_DEVICE: ${WHISPER_DEVICE:-cpu}
+      WHISPER_COMPUTE_TYPE: ${WHISPER_COMPUTE_TYPE:-int8}
+    volumes:
+      - whisper_models:/root/.cache/huggingface  # cache model agar tidak download ulang
+    # Port TIDAK di-expose ke host — internal sahaja
+    networks:
+      - speech2text_net
+
+  # ============================================================
+  # Ollama — Optional Local LLM (disabled by default)
+  # Uncomment jika OLLAMA_ENABLED=true
+  # ============================================================
+  # ollama:
+  #   image: ollama/ollama
+  #   container_name: speech2text_ollama
+  #   restart: unless-stopped
+  #   volumes:
+  #     - ollama_data:/root/.ollama
+  #   networks:
+  #     - speech2text_net
+
+networks:
+  speech2text_net:
+    driver: bridge
+
+volumes:
+  mysql_data:
+    name: speech2text_mysql_data   # nama eksplisit — susah ter-delete secara tidak sengaja
+    labels:
+      com.speech2text.description: "MySQL production data — JANGAN PADAM"
+  redis_data:
+    name: speech2text_redis_data
+  whisper_models:
+    name: speech2text_whisper_models
+  # ollama_data:
--- a/docker/nginx/default.conf
+++ b/docker/nginx/default.conf
@@ -0,0 +1,40 @@
+server {
+    listen 80;
+    server_name _;
+    root /var/www/html/public;
+    index index.php index.html;
+
+    client_max_body_size 210M;
+
+    add_header X-Frame-Options "DENY";
+    add_header X-XSS-Protection "1; mode=block";
+    add_header X-Content-Type-Options "nosniff";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    location = /favicon.ico { access_log off; log_not_found off; }
+    location = /robots.txt  { access_log off; log_not_found off; }
+
+    error_page 404 /index.php;
+
+    location ~ \.php$ {
+        fastcgi_pass app:9000;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
+        include fastcgi_params;
+        fastcgi_read_timeout 300;
+    }
+
+    # Deny access to hidden files
+    location ~ /\. {
+        deny all;
+    }
+
+    # Deny direct access to storage (private files served via PHP)
+    location ~ ^/storage/ {
+        deny all;
+    }
+}
--- a/docker/php-apache/Dockerfile
+++ b/docker/php-apache/Dockerfile
@@ -0,0 +1,25 @@
+FROM php:8.5-apache
+
+ENV APACHE_DOCUMENT_ROOT=/var/www/html/public
+
+RUN apt-get update && apt-get install -y \
+    git \
+    unzip \
+    libzip-dev \
+    libpng-dev \
+    libjpeg62-turbo-dev \
+    libfreetype6-dev \
+    libicu-dev \
+    && docker-php-ext-configure gd --with-freetype --with-jpeg \
+    && docker-php-ext-install pdo_mysql gd intl zip \
+    && pecl install redis \
+    && docker-php-ext-enable redis \
+    && a2enmod rewrite headers \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+COPY docker/php-apache/vhost.conf /etc/apache2/sites-available/000-default.conf
+
+WORKDIR /var/www/html
+
+RUN chown -R www-data:www-data /var/www/html
--- a/docker/php-apache/vhost.conf
+++ b/docker/php-apache/vhost.conf
@@ -0,0 +1,13 @@
+<VirtualHost *:80>
+    ServerAdmin webmaster@localhost
+    DocumentRoot /var/www/html/public
+
+    <Directory /var/www/html/public>
+        AllowOverride All
+        Require all granted
+        Options -Indexes
+    </Directory>
+
+    ErrorLog ${APACHE_LOG_DIR}/error.log
+    CustomLog ${APACHE_LOG_DIR}/access.log combined
+</VirtualHost>
--- a/docker/php/custom.ini
+++ b/docker/php/custom.ini
@@ -0,0 +1,4 @@
+display_errors = On
+display_startup_errors = Off
+log_errors = On
+error_reporting = E_ALL & ~E_DEPRECATED & ~E_USER_DEPRECATED
--- a/docker/php/php.ini
+++ b/docker/php/php.ini
@@ -0,0 +1,34 @@
+; Speech2Text MBIP — PHP Configuration
+
+[PHP]
+upload_max_filesize = 210M
+post_max_size = 215M
+max_execution_time = 300
+max_input_time = 300
+memory_limit = 512M
+
+; Security
+expose_php = Off
+display_errors = Off
+log_errors = On
+error_log = /var/log/php_errors.log
+
+; File uploads
+file_uploads = On
+upload_tmp_dir = /tmp
+
+; Session
+session.cookie_httponly = 1
+session.cookie_secure = 1
+session.use_strict_mode = 1
+session.gc_maxlifetime = 7200
+
+; Timezone
+date.timezone = Asia/Kuala_Lumpur
+
+[opcache]
+opcache.enable = 1
+opcache.memory_consumption = 128
+opcache.max_accelerated_files = 10000
+opcache.revalidate_freq = 0
+opcache.validate_timestamps = 0
--- a/docker/supervisor/supervisord.conf
+++ b/docker/supervisor/supervisord.conf
@@ -0,0 +1,27 @@
+[supervisord]
+nodaemon=true
+user=root
+logfile=/var/log/supervisor/supervisord.log
+pidfile=/var/run/supervisord.pid
+
+[program:php-fpm]
+command=php-fpm
+autostart=true
+autorestart=true
+priority=5
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+
+[program:queue-worker]
+process_name=%(program_name)s_%(process_num)02d
+command=php /var/www/html/artisan queue:work redis --sleep=3 --tries=3 --max-time=3600 --memory=256
+autostart=true
+autorestart=true
+stopasgroup=true
+killasgroup=true
+numprocs=2
+redirect_stderr=true
+stdout_logfile=/var/log/supervisor/queue-worker.log
+stopwaitsecs=3600
--- a/docker/transcription-worker/Dockerfile
+++ b/docker/transcription-worker/Dockerfile
@@ -0,0 +1,18 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+# Install system dependencies for faster-whisper
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ffmpeg \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Python dependencies
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY main.py .
+
+EXPOSE 8000
+
+CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]
--- a/docker/transcription-worker/main.py
+++ b/docker/transcription-worker/main.py
@@ -0,0 +1,125 @@
+"""
+Speech2Text MBIP — Transcription Worker
+FastAPI service wrapping faster-whisper for Bahasa Melayu transcription.
+Internal-only service; not exposed to internet.
+"""
+
+import os
+import tempfile
+import logging
+from pathlib import Path
+from typing import Optional
+
+from fastapi import FastAPI, UploadFile, File, HTTPException
+from pydantic import BaseModel
+from faster_whisper import WhisperModel
+
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger(__name__)
+
+app = FastAPI(title="Speech2Text Transcription Worker", docs_url=None, redoc_url=None)
+
+# Config from environment
+MODEL_SIZE = os.getenv("WHISPER_MODEL", "small")
+LANGUAGE = os.getenv("WHISPER_LANGUAGE", "ms")
+DEVICE = os.getenv("WHISPER_DEVICE", "cpu")
+COMPUTE_TYPE = os.getenv("WHISPER_COMPUTE_TYPE", "int8")
+
+logger.info(f"Loading Whisper model: {MODEL_SIZE}, device: {DEVICE}, compute: {COMPUTE_TYPE}")
+
+# Load model once at startup
+model = WhisperModel(MODEL_SIZE, device=DEVICE, compute_type=COMPUTE_TYPE)
+
+logger.info("Whisper model loaded successfully.")
+
+
+class TranscribeResponse(BaseModel):
+    success: bool
+    transcript: Optional[str] = None
+    language: Optional[str] = None
+    confidence: Optional[float] = None
+    duration_seconds: Optional[float] = None
+    error: Optional[str] = None
+
+
+@app.get("/health")
+def health_check():
+    return {"status": "ok", "model": MODEL_SIZE, "language": LANGUAGE}
+
+
+@app.post("/transcribe", response_model=TranscribeResponse)
+async def transcribe_audio(audio: UploadFile = File(...)):
+    """
+    Terima fail audio, transkripkan ke teks Bahasa Melayu.
+    Hanya accessible dari dalam Docker network sahaja.
+    """
+    # Validate content type
+    allowed_types = {
+        "audio/mpeg", "audio/mp3", "audio/wav", "audio/x-wav",
+        "audio/mp4", "audio/x-m4a", "audio/aac", "video/mp4",
+        "audio/ogg", "audio/flac", "audio/webm",
+    }
+
+    if audio.content_type and audio.content_type not in allowed_types:
+        logger.warning(f"Rejected content type: {audio.content_type}")
+        raise HTTPException(status_code=400, detail=f"Unsupported audio format: {audio.content_type}")
+
+    # Save to temp file
+    suffix = Path(audio.filename or "audio.mp3").suffix or ".mp3"
+
+    try:
+        with tempfile.NamedTemporaryFile(delete=False, suffix=suffix) as tmp:
+            content = await audio.read()
+            tmp.write(content)
+            tmp_path = tmp.name
+
+        logger.info(f"Transcribing: {audio.filename}, size: {len(content)} bytes")
+
+        # Run transcription
+        segments, info = model.transcribe(
+            tmp_path,
+            language=LANGUAGE,
+            beam_size=5,
+            vad_filter=True,
+        )
+
+        # Collect segments
+        all_text = []
+        total_confidence = []
+
+        for segment in segments:
+            all_text.append(segment.text.strip())
+            # faster-whisper segments have avg_logprob; convert to 0-1 range
+            if hasattr(segment, "avg_logprob") and segment.avg_logprob is not None:
+                import math
+                confidence = min(1.0, max(0.0, math.exp(segment.avg_logprob)))
+                total_confidence.append(confidence)
+
+        transcript = " ".join(all_text).strip()
+        avg_confidence = sum(total_confidence) / len(total_confidence) if total_confidence else None
+        duration = info.duration if hasattr(info, "duration") else None
+
+        logger.info(f"Transcription complete: {len(transcript)} chars, lang: {info.language}")
+
+        return TranscribeResponse(
+            success=True,
+            transcript=transcript,
+            language=info.language,
+            confidence=round(avg_confidence, 4) if avg_confidence else None,
+            duration_seconds=round(duration, 2) if duration else None,
+        )
+
+    except Exception as e:
+        logger.error(f"Transcription failed: {e}", exc_info=True)
+        return TranscribeResponse(
+            success=False,
+            error=str(e),
+        )
+
+    finally:
+        # Always cleanup temp file
+        if "tmp_path" in locals():
+            try:
+                os.unlink(tmp_path)
+            except Exception:
+                pass
--- a/docker/transcription-worker/requirements.txt
+++ b/docker/transcription-worker/requirements.txt
@@ -0,0 +1,6 @@
+fastapi==0.115.0
+uvicorn==0.30.6
+faster-whisper==1.0.3
+python-multipart==0.0.9
+pydantic==2.8.2
+requests==2.32.3
--- a/Show More
+++ b/Show More