enhance(kb): streamline knowledge base management

.agents/skills/klicker-frontend-ui/SKILL.md

@@ -43,7 +43,7 @@ Conventions (design system, Tailwind v4, Apollo, i18n, CSP): [docs/frontend-conv
 ## App boundaries
 
 - `frontend-manage` (lecturer), `frontend-pwa` (student; also has a localforage offline side-channel for live-quiz answers — don't bypass `storageHelpers.ts`), `frontend-control` (mobile controller), `auth` (login flows — auth changes also need [docs/auth-model.md](../../../docs/auth-model.md)).
-- Knowledge-base management is a reusable package mounted by `frontend-manage`: edit `packages/kb-management`, not duplicate app-local components. Verify `/resources/knowledgeBases` plus the detail route at desktop and mobile widths, both locales, and every changed empty/active/success/failure state.
+- Knowledge-base management is a reusable package mounted by `frontend-manage`: edit `packages/kb-management`, not duplicate app-local components. The detail resource workspace uses a semantic metadata table, one `+ Add resource` chooser for Website/Document with Video disabled until supported, and an overflow menu for destructive row actions. Preserve the explicit `ADDED`-before-Ingest lifecycle and keep the chooser non-dismissible after a file upload ticket is requested until confirmation or terminal failure. Verify `/resources/knowledgeBases` plus the detail route at desktop and mobile widths, both locales, and every changed empty/active/success/failure state.
 - The KB navigation item is an interim `user.privatePreview` discovery gate. Direct catalog/detail URLs must render the localized `KB_PREVIEW_ACCESS_REQUIRED` service error for a non-preview lecturer; never rely on hidden navigation as authorization.
 - The knowledge-resource Ingest action accepts only the resource identifier. Do not expose transport tuning in the UI unless the GraphQL and ingestion-platform contracts add a real user-controlled setting.
 - Keep full KB attempt history out of the two-second detail poll. Load the bounded, owner-checked history query only when a lecturer expands a resource, while the parent query carries only the latest run needed for operation status.

.agents/skills/klicker-playwright-e2e/SKILL.md

@@ -35,6 +35,43 @@ rg -n "test\\(" playwright/tests
 
 ## Local Test Setup
 
+### Host-run against a running devrouter workspace (preferred)
+
+Playwright is a black-box driver: run it from the host against the devrouter
+routes. Browser binaries and node_modules come from shared host caches, so
+never download browsers into a DevPod.
+
+```bash
+# auto-detects routed worktrees / plain devcontainer / host-run apps
+bash util/run-host-e2e.sh --project=chromium tests/Y-kb-management-ux.spec.ts
+
+# inspect the resolved URL + database mapping without running anything
+bash util/run-host-e2e.sh --print
+
+# linked-workspace token override (long branch names can get truncated)
+E2E_WORKSPACE=<token> bash util/run-host-e2e.sh --project=chromium <spec>
+```
+
+The runner installs only the Playwright workspace dependencies on the host,
+builds `@klicker-uzh/prisma` and `@klicker-uzh/types` for global setup, maps
+the application URLs and seed database to the reachable runtime, and reuses
+the host browser cache. Headless runs install only the smaller Chromium shell;
+a headed run needs one full Chromium installation on the host.
+
+The seed database uses the workspace Postgres container's OrbStack host name.
+Node Postgres cannot negotiate libpq direct TLS through the Traefik database
+route; that route remains correct for psql and other libpq tooling.
+On another Docker runtime, pass `E2E_DATABASE_URL` for a disposable database
+that is reachable from the host.
+Container-local dependencies stay behind the routed applications. If a future
+browser journey needs direct access to another service, expose a host route for
+that service instead of running Playwright inside the DevPod.
+
+The existing global setup resets and reseeds the mapped database. Run the host
+runner only against a disposable local test runtime.
+
+### Legacy host-based stack
+
 Run from repo root. Use Volta when Node/pnpm versions are confusing.
 
 ```bash

AGENTS.md

@@ -132,7 +132,7 @@ Prisma split-schema under `packages/prisma/src/prisma/schema/`. After editing a
 
 ### Self-contained devcontainer (recommended)
 
-Clone-and-run via a self-contained devcontainer — no Infisical/Doppler, no EduID, no `/etc/hosts` edits. The container owns the whole stack (Node 24 + pnpm toolchain, Postgres, 3× Redis, MailHog, Hatchet) and runs **all core apps in ONE container** via `turbo dev`. Run pnpm/prisma/tests **inside the container**, never on the host.
+Clone-and-run via a self-contained devcontainer — no Infisical/Doppler, no EduID, no `/etc/hosts` edits. The container owns the whole stack (Node 24 + pnpm toolchain, Postgres, 3× Redis, MailHog, Hatchet) and runs **all core apps in ONE container** via `turbo dev`. Run pnpm/prisma/unit tests **inside the container**, never on the host. **Exception — Playwright E2E runs on the host**: run `bash util/run-host-e2e.sh --project=chromium tests/<spec>.spec.ts` (or `pnpm --filter @klicker-uzh/playwright test:host -- --project=chromium <spec>`) — it auto-maps the app URLs and seed database for routed devrouter workspaces, a plain primary devcontainer, or host-run apps, and shares host browser/node caches; never download browsers into a DevPod. Services without direct routes stay inside the container and are exercised through the routed apps; do not move Playwright into the container to reach them.
 
 ```bash
 devrouter ensure .

docs/frontend-conventions.md

@@ -84,6 +84,8 @@ The lecturer routes `apps/frontend-manage/src/pages/resources/knowledgeBases.tsx
 
 The catalog uses server search and cursor-driven “load more” rather than loading all owned KBs. The detail page keeps metadata/metrics separate from `packages/kb-management/src/components/KnowledgeBaseResourceList.tsx:KnowledgeBaseResourceList`, which owns server search plus design-system type/status filters, selection, confirmed bulk deletion, the source inspector, and contextual Ingest/Retry/Re-ingest/Delete actions. While any loaded row is `QUEUED`/`PROCESSING`, the two-second interval fetches page zero plus pages known to contain active rows and runs a full loaded-window walk every tenth tick. Cursor or page-length drift triggers an immediate full walk. Promise-only polls use `ApolloClient.query` with `no-cache`; generation fencing, the latest loaded-count ref, and shared cache merge preserve the loaded window and remove rows from selection when they become active. Show indeterminate real-operation progress and safe-to-leave messaging rather than invented percentages.
 
+The detail resource workspace presents that loaded window as a semantic design-system table with source, operation, serving, update, selection, and contextual action metadata. Use one `+ Add resource` action that opens the chooser for Website or Document; keep Video visibly unavailable until its ingestion contract exists. Keep destructive resource deletion in the row overflow menu, and preserve the explicit inspector Ingest action for resources that are only `ADDED`. When a file upload has requested its ticket, keep the chooser open and non-dismissible until upload confirmation or a terminal failure.
+
 The inspector loads the owner-checked five-attempt history lazily. Full attempt history must stay outside the two-second list poll. Lecturer-facing failure detail is localized from stable status/error codes; raw platform messages are not rendered. Transport tuning is not user-controlled. Changes must preserve EN/DE messages, `data-cy` hooks, keyboard/focus behavior, and browser evidence for desktop plus 390 px mobile states, including search/filter, selection/confirmation, empty, active, ready, failed, and replacement-cutover feedback where affected.
 
 KB and resource deletion dialogs explain the two observable phases: the item disappears immediately, while stored files and the external index are removed in the background. Success toasts confirm removal from the lecturer view without claiming that external cleanup has already completed.

docs/getting-started.md

@@ -60,6 +60,7 @@ Clone-and-run via a self-contained devcontainer — no Infisical, no external Ed
         Use `devrouter workspace up <branch-name>` from the main repository to create a new worktree. Do not use bare `devpod up` or manual route-token loops; `ensure` owns the persisted identity, Git mount, overlay, aliases, runtime proof, and routes together.
      3. Those namespaced hosts only work because `allowedDevOrigins` in `packages/next-config/index.js` is `['**.localhost']` in development (and `undefined` in production) — Next's implicit `*.localhost` matches a single label only. If that glob ever stops covering a worktree host, the symptom is an app that serves HTML but never hydrates, with no obvious error.
 3. **Logs:** The dev servers auto-start inside the container. View logs via `devrouter exec . -- tail -f /tmp/dev.log`.
+4. **Browser E2E:** Run Playwright from the host with `bash util/run-host-e2e.sh --project=chromium <spec>`. The runner detects routed linked and primary checkouts, a plain primary devcontainer, and host-run apps; it maps the app URLs and seed database while reusing the host browser cache. Never install Playwright browser binaries in a DevPod. The existing global setup resets and reseeds the mapped database, so use only a disposable local test runtime.
 
 For OpenRouter-backed Chat, inject the shared prototyping key when starting the
 workspace; never write it into the repository:

packages/i18n/messages/de.ts

@@ -1534,6 +1534,7 @@ Da die KlickerUZH-App noch nicht im iOS-App-Store verfügbar ist, folgen Sie die
       '{resources, plural, one {# Ressource} other {# Ressourcen}} · {chatbots, plural, one {# verknüpfter Chatbot} other {# verknüpfte Chatbots}}',
     loadMore: 'Weitere Wissensdatenbanken laden',
     notFound: 'Die Wissensdatenbank konnte nicht gefunden werden.',
+    detailFallbackTitle: 'Wissensdatenbank',
     backToList: 'Zurück zu den Wissensdatenbanken',
     metricsTitle: 'Nutzung und Verknüpfungen',
     metricVisibleResources: 'Sichtbare Ressourcen',
@@ -1568,6 +1569,8 @@ Da die KlickerUZH-App noch nicht im iOS-App-Store verfügbar ist, folgen Sie die
     linkSuccess: 'Link wurde zur Wissensdatenbank hinzugefügt.',
     linkError: 'Der Link konnte nicht hinzugefügt werden.',
     resourcesTitle: 'Ressourcen',
+    resourceColumn: 'Ressource',
+    resourceActions: 'Aktionen',
     resourcesLoadError: 'Die Ressourcen konnten nicht geladen werden.',
     searchResources: 'Ressourcen suchen',
     searchResourcesPlaceholder: 'Titel, Dateiname oder URL suchen',
@@ -1576,13 +1579,28 @@ Da die KlickerUZH-App noch nicht im iOS-App-Store verfügbar ist, folgen Sie die
     filterAll: 'Alle',
     typeFile: 'Datei',
     typeUrl: 'Link',
+    addResource: 'Ressource hinzufügen',
+    addResourceTitle: 'Ressource hinzufügen',
+    addResourceDescription:
+      'Wählen Sie, wie Sie diese Ressource hinzufügen möchten.',
+    addWebsite: 'Website',
+    addWebsiteDescription: 'Eine Website-URL zur Verarbeitung registrieren.',
+    addDocument: 'Dokument',
+    addDocumentDescription: 'Eine PDF-, TXT- oder Markdown-Datei hochladen.',
+    addVideo: 'Video',
+    comingSoon: 'Demnächst verfügbar',
+    configure: 'Konfigurieren',
+    backToResourceTypes: 'Zurück',
     noResourceResults: 'Keine Ressourcen entsprechen diesen Filtern.',
     resourceResultCount:
       '{count, plural, =0 {Keine Ressourcen} one {# Ressource} other {# Ressourcen}}',
     selectAllPage: 'Bis zu 50 verfügbare Ressourcen auswählen',
     selectResource: '„{title}“ auswählen',
     loadMoreResources: 'Weitere Ressourcen laden',
     noResources: 'Es wurden noch keine Ressourcen hinzugefügt.',
+    emptyResourceHint:
+      'Verwenden Sie oben «Ressource hinzufügen», um eine Website oder ein Dokument hinzuzufügen.',
+    updatedAtLabel: 'Aktualisiert',
     updatedAt: 'Aktualisiert {date}',
     statusAdded: 'Hinzugefügt',
     statusQueued: 'In Warteschlange',

packages/i18n/messages/en.ts

@@ -1526,6 +1526,7 @@ Since the KlickerUZH app is not yet available in the iOS App Store, follow these
       '{resources, plural, one {# resource} other {# resources}} · {chatbots, plural, one {# connected chatbot} other {# connected chatbots}}',
     loadMore: 'Load more knowledge bases',
     notFound: 'The knowledge base could not be found.',
+    detailFallbackTitle: 'Knowledge base',
     backToList: 'Back to knowledge bases',
     metricsTitle: 'Usage and connections',
     metricVisibleResources: 'Visible resources',
@@ -1558,6 +1559,8 @@ Since the KlickerUZH app is not yet available in the iOS App Store, follow these
     linkSuccess: 'Link added to the knowledge base.',
     linkError: 'The link could not be added.',
     resourcesTitle: 'Resources',
+    resourceColumn: 'Resource',
+    resourceActions: 'Actions',
     resourcesLoadError: 'The resources could not be loaded.',
     searchResources: 'Search resources',
     searchResourcesPlaceholder: 'Search title, filename or URL',
@@ -1566,13 +1569,26 @@ Since the KlickerUZH app is not yet available in the iOS App Store, follow these
     filterAll: 'All',
     typeFile: 'File',
     typeUrl: 'Link',
+    addResource: 'Add resource',
+    addResourceTitle: 'Add a resource',
+    addResourceDescription: 'Choose how you want to add this resource.',
+    addWebsite: 'Website',
+    addWebsiteDescription: 'Register a website URL for ingestion.',
+    addDocument: 'Document',
+    addDocumentDescription: 'Upload a PDF, TXT or Markdown file.',
+    addVideo: 'Video',
+    comingSoon: 'Coming soon',
+    configure: 'Configure',
+    backToResourceTypes: 'Back',
     noResourceResults: 'No resources match these filters.',
     resourceResultCount:
       '{count, plural, =0 {No resources} one {# resource} other {# resources}}',
     selectAllPage: 'Select up to 50 available resources',
     selectResource: 'Select “{title}”',
     loadMoreResources: 'Load more resources',
     noResources: 'No resources have been added yet.',
+    emptyResourceHint: 'Use Add resource above to add a website or document.',
+    updatedAtLabel: 'Updated',
     updatedAt: 'Updated {date}',
     statusAdded: 'Added',
     statusQueued: 'Queued',