Merge: Login case-insensitiv + Passwort-Wiederholfeld

Fix: Login case-insensitiv (Registrierung speichert lowercase, Login war case-sensitiv) + Passwort-Wiederholfeld
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 20:04:08 +02:00 · 2026-06-30 20:03:46 +02:00 · 2026-06-30 18:04:47 +02:00 · 2026-06-30 18:03:55 +02:00 · 2026-06-30 16:32:45 +02:00 · 2026-06-30 16:32:03 +02:00
33 changed files with 6594 additions and 12 deletions
@@ -4,6 +4,43 @@ Alle nennenswerten Änderungen an **Mindflux** werden hier dokumentiert.
 Format angelehnt an [Keep a Changelog](https://keepachangelog.com/de/1.0.0/),
 Versionierung [semantisch](https://semver.org/lang/de/).

+## [Unreleased] – 2026-06-30 · Dev Lab
+
+Neues Spiel **Dev Lab**: ein Entwicklerlabor, das mehrere kleine Disziplinen bündelt
+(SQL, Java/Debugging, Git, HTML, CSS, Regex, PHP, REST). Im Gegensatz zur ersten,
+rein clientseitigen Skizze ist Dev Lab jetzt **server-autoritativ, DB-gestützt und im
+Admin pflegbar** – mit **echter Mechanik-Vielfalt** statt überall demselben Lückentext.
+
+### Hinzugefügt
+- **Spiel: Dev Lab (`/devlab`)** mit Hub (drei Trainingspfade: Syntax · Debugging · Praxis)
+  und **11 Disziplinen** (`query-builder`, `sql-detective`, `debug-hunt`, `git-mission`,
+  `html-architect`, `css-designer`, `css-cascade`, `flexbox-factory`, `regex-master`,
+  `php-request`, `api-explorer`), zusammen **189 Aufgaben** (16–21 je Spiel).
+- **Sechs unterschiedliche Spielmechaniken** – passend zum Thema gemischt:
+  **cloze** (Code-Lücke tippen), **choice** (Multiple-Choice-Chips), **order**
+  (Bausteine klick-basiert zusammensetzen/sortieren), **spot** (den fehlerhaften Token
+  anklicken), **match** (Paare zuordnen) und **regex** (Muster schreiben mit
+  **Live-Treffer-Vorschau** gegen Beispiel-Strings).
+- **Server-autoritativ & Anti-Cheat:** Aus dem JSON-Payload jeder Aufgabe baut der Server
+  eine bereinigte Sicht **ohne Lösung**; geprüft und gewertet wird ausschließlich serverseitig
+  (Text-/Reihenfolge-/Verhaltensvergleich). `correctIndex`/`bugIndex`/Lösungen/Pattern verlassen
+  nie das Backend. Score über die generische `game_scores`-Tabelle (Kennung `devlab`, `deck`=Spiel-Slug).
+- **Fehler-Mechanik** wie bei Syntax Saga: bis zu drei Versuche mit Hinweis, dann „Auflösung",
+  kein Game-Over; Punkte nach Versuch, Sterne 0–3.
+- **Admin-Verwaltung (`/admin/devlab`):** Spiele und Aufgaben (Typ + JSON-Payload) anlegen,
+  bearbeiten, löschen, aktiv/inaktiv schalten. Inhalte aus `devlab/content.json` (idempotenter Seeder).
+
+### Behoben / geändert (ggü. der ersten Dev-Lab-Skizze)
+- **Platzhalter-Leak entfernt:** Die Eingabefelder zeigten vorher die Lösung als Platzhalter –
+  jetzt sind es neutrale Kategorie-Labels („Keyword", „Operator", „Tag" …). Geprüft wird serverseitig.
+- **Echte Mechanik-Abwechslung** statt 11×Lückentext; **deutlich mehr Aufgaben** je Disziplin.
+
+### Technik
+- Neue Entities `DevLabGame`/`DevLabTask` (JSON-`payload`) + Flyway `V8__devlab.sql`;
+  `DevLabService` mit sechs Mechanik-Checkern; JSON-API `/api/devlab/**`
+  (`catalog`/`session`/`check`/`finish`, CSRF-ausgenommen, `devlab` in `KNOWN_GAMES`).
+  Frontend: polymorphe Engine `devlabgame.js`, DB-getriebener Hub `devlab.js`, `devlabgame.css` (Prefix `dlg-`).
+
 ## [Unreleased] – 2026-06-30

 Neues Spiel **Syntax Saga**: interaktive IT-Geschichten, in denen man den fehlenden
@@ -0,0 +1,128 @@
+package com.example.mindflux.config;
+
+import com.example.mindflux.model.DevLabGame;
+import com.example.mindflux.model.DevLabTask;
+import com.example.mindflux.repository.DevLabGameRepository;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.boot.CommandLineRunner;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * Befüllt das Dev Lab einmalig (wenn leer) aus devlab/content.json. Jede Aufgabe wird mit
+ * ihrem Typ + vollständigem JSON-Payload gespeichert; der Service liest daraus.
+ */
+@Component
+public class DevLabSeeder implements CommandLineRunner {
+
+    private static final int MAX_PAYLOAD = 8000;
+
+    private final DevLabGameRepository gameRepository;
+    private final ObjectMapper objectMapper;
+
+    public DevLabSeeder(DevLabGameRepository gameRepository, ObjectMapper objectMapper) {
+        this.gameRepository = gameRepository;
+        this.objectMapper = objectMapper;
+    }
+
+    @Override
+    @Transactional
+    public void run(String... args) {
+        if (gameRepository.count() > 0) {
+            return;
+        }
+        try {
+            JsonNode root = objectMapper.readTree(new ClassPathResource("devlab/content.json").getInputStream());
+            JsonNode games = root.get("games");
+            if (games == null || !games.isArray()) {
+                System.out.println("⚠️ Dev-Lab-Seed: content.json ohne 'games'.");
+                return;
+            }
+
+            Set<String> used = new HashSet<>();
+            int order = 1;
+            int gameCount = 0;
+            int taskCount = 0;
+            int skipped = 0;
+
+            for (JsonNode gNode : games) {
+                String title = gNode.path("title").asText("");
+                JsonNode tasks = gNode.get("tasks");
+                if (title.isBlank() || tasks == null || !tasks.isArray()) {
+                    continue;
+                }
+                String base = gNode.hasNonNull("slug") ? gNode.get("slug").asText() : title;
+                DevLabGame game = new DevLabGame(
+                        uniqueSlug(base, used),
+                        trim(title, 200),
+                        trim(textOrNull(gNode, "language"), 50),
+                        trim(textOrNull(gNode, "path"), 50),
+                        trim(textOrNull(gNode, "description"), 1000),
+                        order, true);
+
+                int sort = 0;
+                for (JsonNode t : tasks) {
+                    String type = t.path("type").asText("");
+                    String prompt = t.path("prompt").asText("");
+                    if (type.isBlank() || prompt.isBlank()) {
+                        continue;
+                    }
+                    String payload = t.toString();
+                    if (payload.length() > MAX_PAYLOAD) {
+                        skipped++;
+                        continue;
+                    }
+                    game.addTask(new DevLabTask(type, trim(prompt, 300), t.path("points").asInt(100), sort++, payload));
+                    taskCount++;
+                }
+
+                if (!game.getTasks().isEmpty()) {
+                    gameRepository.save(game);
+                    order++;
+                    gameCount++;
+                }
+            }
+            System.out.println("✅ Dev Lab: " + gameCount + " Spiele / " + taskCount + " Aufgaben geladen"
+                    + (skipped > 0 ? " (" + skipped + " zu groß, übersprungen)" : "") + ".");
+        } catch (Exception e) {
+            System.out.println("⚠️ Dev-Lab-Seed übersprungen: " + e.getMessage());
+        }
+    }
+
+    private String uniqueSlug(String base, Set<String> used) {
+        String slug = base.toLowerCase()
+                .replace("ä", "ae").replace("ö", "oe").replace("ü", "ue").replace("ß", "ss")
+                .replaceAll("[^a-z0-9]+", "-")
+                .replaceAll("(^-|-$)", "");
+        if (slug.isBlank()) {
+            slug = "game";
+        }
+        String candidate = slug;
+        int counter = 2;
+        while (used.contains(candidate) || gameRepository.existsBySlug(candidate)) {
+            candidate = slug + "-" + counter++;
+        }
+        used.add(candidate);
+        return candidate;
+    }
+
+    private String textOrNull(JsonNode node, String field) {
+        if (!node.hasNonNull(field)) {
+            return null;
+        }
+        String value = node.get(field).asText("");
+        return value.isBlank() ? null : value;
+    }
+
+    private String trim(String value, int max) {
+        if (value == null) {
+            return null;
+        }
+        return value.length() <= max ? value : value.substring(0, max);
+    }
+}
@@ -40,7 +40,7 @@ public class SecurityConfig {
            .csrf(csrf -> csrf
                // Spiele-APIs werden per fetch (application/json) ohne Token aufgerufen -> ausnehmen.
                // Reine JSON-Endpunkte sind nicht über klassische HTML-Formulare CSRF-ausnutzbar.
-                .ignoringRequestMatchers("/api/games/**", "/api/techtacular/**", "/api/mindmatch/**", "/api/syntaxsaga/**")
+                .ignoringRequestMatchers("/api/games/**", "/api/techtacular/**", "/api/mindmatch/**", "/api/syntaxsaga/**", "/api/devlab/**")
            );

        return http.build();
@@ -49,7 +49,7 @@ public class SecurityConfig {
    @Bean
    public UserDetailsService userDetailsService(UserRepository userRepo) {
        return username -> {
-            User user = userRepo.findByUsername(username)
+            User user = userRepo.findByUsernameIgnoreCase(username)
                    .orElseThrow(() -> new UsernameNotFoundException("Benutzer nicht gefunden"));

            return org.springframework.security.core.userdetails.User
@@ -0,0 +1,82 @@
+package com.example.mindflux.controller;
+
+import com.example.mindflux.model.DevLabGame;
+import com.example.mindflux.service.DevLabService;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.*;
+
+/** Admin-Verwaltung der Dev-Lab-Spiele und -Aufgaben (ROLE_ADMIN via /admin/**). */
+@Controller
+@RequestMapping("/admin/devlab")
+public class AdminDevLabController {
+
+    private final DevLabService devLabService;
+
+    public AdminDevLabController(DevLabService devLabService) {
+        this.devLabService = devLabService;
+    }
+
+    @GetMapping("")
+    public String manage(Model model) {
+        model.addAttribute("games", devLabService.gameRows());
+        return "admin/devlab";
+    }
+
+    @GetMapping("/games/{gameId}")
+    public String game(@PathVariable Long gameId, Model model) {
+        DevLabGame game = devLabService.gameWithTasks(gameId);
+        if (game == null) {
+            return "redirect:/admin/devlab";
+        }
+        model.addAttribute("game", game);
+        return "admin/devlab-game";
+    }
+
+    @PostMapping("/games")
+    public String createGame(@RequestParam String title,
+                             @RequestParam(required = false) String language,
+                             @RequestParam(required = false) String path,
+                             @RequestParam(required = false) String description) {
+        Long id = devLabService.createGame(title, language, path, description);
+        return id == null ? "redirect:/admin/devlab" : "redirect:/admin/devlab/games/" + id;
+    }
+
+    @PostMapping("/games/{gameId}/tasks")
+    public String addTask(@PathVariable Long gameId,
+                          @RequestParam String type,
+                          @RequestParam String prompt,
+                          @RequestParam(defaultValue = "100") int points,
+                          @RequestParam String payload) {
+        devLabService.addTask(gameId, type, prompt, points, payload);
+        return "redirect:/admin/devlab/games/" + gameId;
+    }
+
+    @PostMapping("/tasks/{taskId}/update")
+    public String updateTask(@PathVariable Long taskId,
+                             @RequestParam Long gameId,
+                             @RequestParam String prompt,
+                             @RequestParam(defaultValue = "100") int points,
+                             @RequestParam String payload) {
+        devLabService.updateTask(taskId, prompt, points, payload);
+        return "redirect:/admin/devlab/games/" + gameId;
+    }
+
+    @PostMapping("/tasks/{taskId}/delete")
+    public String deleteTask(@PathVariable Long taskId, @RequestParam Long gameId) {
+        devLabService.deleteTask(taskId);
+        return "redirect:/admin/devlab/games/" + gameId;
+    }
+
+    @PostMapping("/games/{gameId}/delete")
+    public String deleteGame(@PathVariable Long gameId) {
+        devLabService.deleteGame(gameId);
+        return "redirect:/admin/devlab";
+    }
+
+    @PostMapping("/games/{gameId}/toggle")
+    public String toggleGame(@PathVariable Long gameId) {
+        devLabService.toggleGame(gameId);
+        return "redirect:/admin/devlab";
+    }
+}
@@ -0,0 +1,46 @@
+package com.example.mindflux.controller;
+
+import com.example.mindflux.dto.DevLabCheckRequest;
+import com.example.mindflux.dto.DevLabFinishRequest;
+import com.example.mindflux.dto.DevLabResult;
+import com.example.mindflux.service.DevLabService;
+import com.fasterxml.jackson.databind.JsonNode;
+import org.springframework.web.bind.annotation.*;
+
+import java.security.Principal;
+
+/** JSON-API fürs Dev Lab. Server-autoritativ: Lösungen werden nie ausgeliefert. */
+@RestController
+@RequestMapping("/api/devlab")
+public class DevLabApiController {
+
+    private final DevLabService devLabService;
+
+    public DevLabApiController(DevLabService devLabService) {
+        this.devLabService = devLabService;
+    }
+
+    /** Spiele-Katalog für den Hub (nach Pfad gruppierbar). */
+    @GetMapping("/catalog")
+    public JsonNode catalog() {
+        return devLabService.buildCatalog();
+    }
+
+    /** Eine Spielrunde: Aufgaben einer Disziplin – ohne Lösungen. */
+    @GetMapping("/games/{slug}/session")
+    public JsonNode session(@PathVariable String slug) {
+        return devLabService.buildSession(slug);
+    }
+
+    /** Eine Aufgabe serverseitig prüfen; mit {@code reveal=true} auch die Auflösung. */
+    @PostMapping("/check")
+    public JsonNode check(@RequestBody DevLabCheckRequest request) {
+        return devLabService.check(request.getTaskId(), request.isReveal(), request.getSubmission());
+    }
+
+    /** Durchlauf abschließen: Score wird serverseitig neu berechnet und gespeichert. */
+    @PostMapping("/finish")
+    public DevLabResult finish(@RequestBody DevLabFinishRequest request, Principal principal) {
+        return devLabService.finish(principal.getName(), request);
+    }
+}
@@ -0,0 +1,21 @@
+package com.example.mindflux.controller;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+
+@Controller
+public class DevLabController {
+
+    @GetMapping("/devlab")
+    public String showDevLab() {
+        return "devlab";
+    }
+
+    @GetMapping("/devlab/games/{slug}")
+    public String showDevLabGame(@PathVariable String slug, Model model) {
+        model.addAttribute("gameSlug", slug);
+        return "devlab-game";
+    }
+}
@@ -21,7 +21,7 @@ public class GameScoreController {

    /** Bekannte Spiele (entsprechen den Dashboard-Routen). */
    private static final Set<String> KNOWN_GAMES = Set.of(
-            "mindmatch", "techtacular", "syntax-saga", "escape-room",
+            "mindmatch", "techtacular", "syntax-saga", "devlab", "escape-room",
            "service-clash", "bug-hunter", "netzwerker");

    private final GameScoreService gameScoreService;
@@ -24,17 +24,24 @@ public class RegisterController {
    }

    @PostMapping("/register")
-    public String processRegistration(@ModelAttribute("user") User user, Model model) {
-        // Benutzername klein schreiben, um Doppelungen zu vermeiden
-        user.setUsername(user.getUsername().toLowerCase());
+    public String processRegistration(@ModelAttribute("user") User user,
+                                      @RequestParam(value = "confirmPassword", required = false) String confirmPassword) {
+        // Schreibweise des Benutzernamens beibehalten, nur trimmen
+        String username = user.getUsername() == null ? "" : user.getUsername().trim();
+        user.setUsername(username);

-        // Prüfen, ob Benutzername schon existiert
-        if (userService.findByUsername(user.getUsername()) != null) {
-            // Zurück zur kombinierten Login/Signup-Seite mit geöffnetem Signup-Panel
+        // Passwörter müssen übereinstimmen (Schutz vor Tippfehlern bei der Eingabe)
+        if (user.getPassword() == null || user.getPassword().isBlank()
+                || !user.getPassword().equals(confirmPassword)) {
+            return "redirect:/?passwordMismatch";
+        }
+
+        // Benutzername schon vergeben? (case-insensitiv, damit "Alice" und "alice" nicht kollidieren)
+        if (username.isBlank() || userService.findByUsernameIgnoreCase(username) != null) {
            return "redirect:/?registerError";
        }

-        // Passwort verschlüsseln
+        // Passwort verschlüsseln und speichern
        user.setPassword(passwordEncoder.encode(user.getPassword()));
        user.setRole("USER"); // Standardrolle
        userService.save(user);
@@ -0,0 +1,20 @@
+package com.example.mindflux.dto;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+/** Prüft eine Dev-Lab-Aufgabe. {@code submission} ist mechanikspezifisch (JSON). */
+public class DevLabCheckRequest {
+
+    private Long taskId;
+    private boolean reveal;
+    private JsonNode submission;
+
+    public Long getTaskId() { return taskId; }
+    public void setTaskId(Long taskId) { this.taskId = taskId; }
+
+    public boolean isReveal() { return reveal; }
+    public void setReveal(boolean reveal) { this.reveal = reveal; }
+
+    public JsonNode getSubmission() { return submission; }
+    public void setSubmission(JsonNode submission) { this.submission = submission; }
+}
@@ -0,0 +1,43 @@
+package com.example.mindflux.dto;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import java.util.List;
+
+/**
+ * Abschluss eines Dev-Lab-Durchlaufs: pro Aufgabe die letzte Eingabe + Versuche/Auflösung.
+ * Der Score wird serverseitig aus den Eingaben neu berechnet.
+ */
+public class DevLabFinishRequest {
+
+    private String slug;
+    private int durationSeconds;
+    private List<Item> items;
+
+    public String getSlug() { return slug; }
+    public void setSlug(String slug) { this.slug = slug; }
+
+    public int getDurationSeconds() { return durationSeconds; }
+    public void setDurationSeconds(int durationSeconds) { this.durationSeconds = durationSeconds; }
+
+    public List<Item> getItems() { return items; }
+    public void setItems(List<Item> items) { this.items = items; }
+
+    public static class Item {
+        private Long taskId;
+        private JsonNode submission;
+        private int attempts;
+        private boolean revealed;
+
+        public Long getTaskId() { return taskId; }
+        public void setTaskId(Long taskId) { this.taskId = taskId; }
+
+        public JsonNode getSubmission() { return submission; }
+        public void setSubmission(JsonNode submission) { this.submission = submission; }
+
+        public int getAttempts() { return attempts; }
+        public void setAttempts(int attempts) { this.attempts = attempts; }
+
+        public boolean isRevealed() { return revealed; }
+        public void setRevealed(boolean revealed) { this.revealed = revealed; }
+    }
+}
@@ -0,0 +1,31 @@
+package com.example.mindflux.dto;
+
+/** Eine Zeile in der Admin-Spieleübersicht (ohne alle Aufgaben zu laden). */
+public class DevLabGameRow {
+    private final Long id;
+    private final String slug;
+    private final String title;
+    private final String language;
+    private final String path;
+    private final boolean active;
+    private final long taskCount;
+
+    public DevLabGameRow(Long id, String slug, String title, String language, String path,
+                         boolean active, long taskCount) {
+        this.id = id;
+        this.slug = slug;
+        this.title = title;
+        this.language = language;
+        this.path = path;
+        this.active = active;
+        this.taskCount = taskCount;
+    }
+
+    public Long getId() { return id; }
+    public String getSlug() { return slug; }
+    public String getTitle() { return title; }
+    public String getLanguage() { return language; }
+    public String getPath() { return path; }
+    public boolean isActive() { return active; }
+    public long getTaskCount() { return taskCount; }
+}
@@ -0,0 +1,35 @@
+package com.example.mindflux.dto;
+
+/** Endergebnis eines Dev-Lab-Durchlaufs (Score serverseitig berechnet) + Highscore-Stand. */
+public class DevLabResult {
+
+    private final int score;
+    private final int maxScore;
+    private final int solvedTasks;
+    private final int totalTasks;
+    private final int stars;
+    private final int highscore;
+    private final boolean newHighscore;
+    private final long plays;
+
+    public DevLabResult(int score, int maxScore, int solvedTasks, int totalTasks, int stars,
+                        int highscore, boolean newHighscore, long plays) {
+        this.score = score;
+        this.maxScore = maxScore;
+        this.solvedTasks = solvedTasks;
+        this.totalTasks = totalTasks;
+        this.stars = stars;
+        this.highscore = highscore;
+        this.newHighscore = newHighscore;
+        this.plays = plays;
+    }
+
+    public int getScore() { return score; }
+    public int getMaxScore() { return maxScore; }
+    public int getSolvedTasks() { return solvedTasks; }
+    public int getTotalTasks() { return totalTasks; }
+    public int getStars() { return stars; }
+    public int getHighscore() { return highscore; }
+    public boolean isNewHighscore() { return newHighscore; }
+    public long getPlays() { return plays; }
+}
@@ -0,0 +1,88 @@
+package com.example.mindflux.model;
+
+import jakarta.persistence.*;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Ein Dev-Lab-Spiel (z.B. "SQL Detective"). Bündelt themengleiche Aufgaben unterschiedlicher
+ * Mechaniken. Inhalte DB-gestützt und im Admin pflegbar; server-autoritativ geprüft.
+ */
+@Entity
+@Table(name = "devlab_games")
+public class DevLabGame {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(unique = true)
+    private String slug;
+
+    private String title;
+
+    /** Anzeige-Sprache/Domäne, z.B. "SQL", "CSS", "Git". */
+    @Column(name = "code_language")
+    private String language;
+
+    /** Trainingspfad: "syntax" | "debugging" | "visual". */
+    @Column(name = "lab_path")
+    private String path;
+
+    private String description;
+
+    @Column(name = "sort_order")
+    private int sortOrder;
+
+    private boolean active = true;
+
+    @OneToMany(mappedBy = "game", cascade = CascadeType.ALL, orphanRemoval = true)
+    @OrderBy("sortOrder ASC, id ASC")
+    private List<DevLabTask> tasks = new ArrayList<>();
+
+    public DevLabGame() {
+    }
+
+    public DevLabGame(String slug, String title, String language, String path,
+                      String description, int sortOrder, boolean active) {
+        this.slug = slug;
+        this.title = title;
+        this.language = language;
+        this.path = path;
+        this.description = description;
+        this.sortOrder = sortOrder;
+        this.active = active;
+    }
+
+    public void addTask(DevLabTask task) {
+        task.setGame(this);
+        this.tasks.add(task);
+    }
+
+    public Long getId() { return id; }
+    public void setId(Long id) { this.id = id; }
+
+    public String getSlug() { return slug; }
+    public void setSlug(String slug) { this.slug = slug; }
+
+    public String getTitle() { return title; }
+    public void setTitle(String title) { this.title = title; }
+
+    public String getLanguage() { return language; }
+    public void setLanguage(String language) { this.language = language; }
+
+    public String getPath() { return path; }
+    public void setPath(String path) { this.path = path; }
+
+    public String getDescription() { return description; }
+    public void setDescription(String description) { this.description = description; }
+
+    public int getSortOrder() { return sortOrder; }
+    public void setSortOrder(int sortOrder) { this.sortOrder = sortOrder; }
+
+    public boolean isActive() { return active; }
+    public void setActive(boolean active) { this.active = active; }
+
+    public List<DevLabTask> getTasks() { return tasks; }
+    public void setTasks(List<DevLabTask> tasks) { this.tasks = tasks; }
+}
@@ -0,0 +1,69 @@
+package com.example.mindflux.model;
+
+import jakarta.persistence.*;
+
+/**
+ * Eine Dev-Lab-Aufgabe. Der {@code type} bestimmt die Spielmechanik (cloze, choice, order,
+ * spot, match, regex); die mechanikspezifischen Daten inkl. Lösung stehen als JSON im
+ * {@code payload}. Der {@code payload} verlässt nie unverändert das Backend – der Service baut
+ * daraus eine bereinigte Sicht (ohne Lösung) und prüft serverseitig.
+ */
+@Entity
+@Table(name = "devlab_tasks")
+public class DevLabTask {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @ManyToOne(fetch = FetchType.LAZY)
+    @JoinColumn(name = "game_id")
+    private DevLabGame game;
+
+    /** Mechanik: cloze | choice | order | spot | match | regex. */
+    @Column(name = "task_type")
+    private String type;
+
+    /** Kurzer Aufgabentitel (für Anzeige + Admin-Liste). */
+    private String prompt;
+
+    private int points = 100;
+
+    @Column(name = "sort_order")
+    private int sortOrder;
+
+    /** Vollständige Aufgabenspezifikation als JSON (inkl. Lösung). */
+    private String payload;
+
+    public DevLabTask() {
+    }
+
+    public DevLabTask(String type, String prompt, int points, int sortOrder, String payload) {
+        this.type = type;
+        this.prompt = prompt;
+        this.points = points;
+        this.sortOrder = sortOrder;
+        this.payload = payload;
+    }
+
+    public Long getId() { return id; }
+    public void setId(Long id) { this.id = id; }
+
+    public DevLabGame getGame() { return game; }
+    public void setGame(DevLabGame game) { this.game = game; }
+
+    public String getType() { return type; }
+    public void setType(String type) { this.type = type; }
+
+    public String getPrompt() { return prompt; }
+    public void setPrompt(String prompt) { this.prompt = prompt; }
+
+    public int getPoints() { return points; }
+    public void setPoints(int points) { this.points = points; }
+
+    public int getSortOrder() { return sortOrder; }
+    public void setSortOrder(int sortOrder) { this.sortOrder = sortOrder; }
+
+    public String getPayload() { return payload; }
+    public void setPayload(String payload) { this.payload = payload; }
+}
@@ -0,0 +1,18 @@
+package com.example.mindflux.repository;
+
+import com.example.mindflux.model.DevLabGame;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import java.util.List;
+import java.util.Optional;
+
+public interface DevLabGameRepository extends JpaRepository<DevLabGame, Long> {
+
+    List<DevLabGame> findAllByActiveTrueOrderBySortOrderAscIdAsc();
+
+    List<DevLabGame> findAllByOrderBySortOrderAscIdAsc();
+
+    Optional<DevLabGame> findBySlug(String slug);
+
+    boolean existsBySlug(String slug);
+}
@@ -0,0 +1,9 @@
+package com.example.mindflux.repository;
+
+import com.example.mindflux.model.DevLabTask;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface DevLabTaskRepository extends JpaRepository<DevLabTask, Long> {
+
+    long countByGameId(Long gameId);
+}
@@ -9,6 +9,9 @@ public interface UserRepository extends JpaRepository<User, Long> {
    // Benutzer anhand des Benutzernamens suchen
    Optional<User> findByUsername(String username);

+    // Case-insensitive Suche: Login und Registrierung sollen unabhängig von Groß-/Kleinschreibung greifen
+    Optional<User> findByUsernameIgnoreCase(String username);
+
    // Benutzer anhand des Benutzernamens löschen
    void deleteByUsername(String username);
 }
@@ -0,0 +1,555 @@
+package com.example.mindflux.service;
+
+import com.example.mindflux.dto.DevLabFinishRequest;
+import com.example.mindflux.dto.DevLabGameRow;
+import com.example.mindflux.dto.DevLabResult;
+import com.example.mindflux.dto.ScoreResult;
+import com.example.mindflux.model.DevLabGame;
+import com.example.mindflux.model.DevLabTask;
+import com.example.mindflux.repository.DevLabGameRepository;
+import com.example.mindflux.repository.DevLabTaskRepository;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ArrayNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.util.*;
+import java.util.regex.Pattern;
+
+/**
+ * Server-autoritative Logik fürs Dev Lab. Aus dem JSON-Payload jeder Aufgabe wird eine
+ * bereinigte Sicht (ohne Lösung) gebaut; geprüft wird ausschließlich serverseitig per
+ * Text-/Reihenfolge-/Verhaltensvergleich gegen den gespeicherten Payload. Mechaniken:
+ * cloze, choice, order, spot, match, regex.
+ */
+@Service
+public class DevLabService {
+
+    private static final String GAME = "devlab";
+    private static final Set<String> KNOWN_TYPES = Set.of("cloze", "choice", "order", "spot", "match", "regex");
+    private static final Set<String> KNOWN_PATHS = Set.of("syntax", "debugging", "visual");
+
+    private final DevLabGameRepository gameRepository;
+    private final DevLabTaskRepository taskRepository;
+    private final GameScoreService gameScoreService;
+    private final ObjectMapper mapper;
+    private final Random random = new Random();
+
+    public DevLabService(DevLabGameRepository gameRepository, DevLabTaskRepository taskRepository,
+                         GameScoreService gameScoreService, ObjectMapper mapper) {
+        this.gameRepository = gameRepository;
+        this.taskRepository = taskRepository;
+        this.gameScoreService = gameScoreService;
+        this.mapper = mapper;
+    }
+
+    // ---------- Katalog (Hub) ----------
+
+    /** Aktive Spiele nach Trainingspfad gruppiert (für den Hub). */
+    @Transactional(readOnly = true)
+    public JsonNode buildCatalog() {
+        ObjectNode root = mapper.createObjectNode();
+        ArrayNode games = root.putArray("games");
+        for (DevLabGame game : gameRepository.findAllByActiveTrueOrderBySortOrderAscIdAsc()) {
+            if (game.getTasks().isEmpty()) {
+                continue;
+            }
+            ObjectNode g = games.addObject();
+            g.put("slug", game.getSlug());
+            g.put("title", game.getTitle());
+            g.put("language", game.getLanguage());
+            g.put("path", game.getPath());
+            g.put("description", game.getDescription());
+            g.put("taskCount", game.getTasks().size());
+        }
+        return root;
+    }
+
+    // ---------- Spielrunde ----------
+
+    /** Eine Spielrunde: Spiel-Meta + alle aktiven Aufgaben als bereinigte Sicht (ohne Lösung). */
+    @Transactional(readOnly = true)
+    public JsonNode buildSession(String slug) {
+        DevLabGame game = gameRepository.findBySlug(slug).filter(DevLabGame::isActive).orElse(null);
+        ObjectNode root = mapper.createObjectNode();
+        if (game == null) {
+            root.put("found", false);
+            return root;
+        }
+        root.put("found", true);
+        root.put("slug", game.getSlug());
+        root.put("title", game.getTitle());
+        root.put("language", game.getLanguage());
+        root.put("path", game.getPath());
+        root.put("description", game.getDescription());
+
+        ArrayNode tasks = root.putArray("tasks");
+        int maxScore = 0;
+        for (DevLabTask task : game.getTasks()) {
+            ObjectNode view = sanitize(task);
+            if (view == null) {
+                continue;
+            }
+            tasks.add(view);
+            maxScore += task.getPoints();
+        }
+        root.put("maxScore", maxScore);
+        root.put("totalTasks", tasks.size());
+        return root;
+    }
+
+    /** Baut die spielerseitige Sicht einer Aufgabe – ohne Lösung. */
+    private ObjectNode sanitize(DevLabTask task) {
+        JsonNode p = parse(task.getPayload());
+        if (p == null) {
+            return null;
+        }
+        ObjectNode v = mapper.createObjectNode();
+        v.put("taskId", task.getId());
+        v.put("type", task.getType());
+        v.put("prompt", task.getPrompt());
+        v.put("points", task.getPoints());
+        copyText(p, v, "narrative");
+        copyText(p, v, "instruction");
+        copyText(p, v, "question");
+        copyText(p, v, "code");
+        copyText(p, v, "hint");
+        copyText(p, v, "successText");
+
+        switch (task.getType()) {
+            case "cloze" -> {
+                copyText(p, v, "codeTemplate");
+                ArrayNode gaps = v.putArray("gaps");
+                for (JsonNode g : array(p, "gaps")) {
+                    ObjectNode gv = gaps.addObject();
+                    gv.put("position", g.path("position").asInt());
+                    gv.put("placeholder", g.path("placeholder").asText(""));
+                    gv.put("hint", g.path("hint").asText(""));
+                }
+            }
+            case "choice" -> v.set("options", shuffledTextArray(stringList(p, "options")));
+            case "order" -> v.set("items", shuffledTextArray(stringList(p, "items")));
+            case "spot" -> {
+                ArrayNode tokens = v.putArray("tokens");
+                for (JsonNode t : array(p, "tokens")) {
+                    tokens.add(t.asText(""));
+                }
+            }
+            case "match" -> {
+                ArrayNode left = v.putArray("left");
+                ArrayNode right = v.putArray("right");
+                List<String> rights = new ArrayList<>();
+                for (JsonNode pair : array(p, "pairs")) {
+                    if (pair.isArray() && pair.size() >= 2) {
+                        left.add(pair.get(0).asText(""));
+                        rights.add(pair.get(1).asText(""));
+                    }
+                }
+                Collections.shuffle(rights, random);
+                rights.forEach(right::add);
+            }
+            case "regex" -> {
+                ArrayNode samples = v.putArray("samples");
+                for (JsonNode s : array(p, "samples")) {
+                    ObjectNode sv = samples.addObject();
+                    sv.put("text", s.path("text").asText(""));
+                    sv.put("shouldMatch", s.path("shouldMatch").asBoolean(false));
+                }
+            }
+            default -> { return null; }
+        }
+        return v;
+    }
+
+    // ---------- Prüfung ----------
+
+    /** Prüft eine Aufgabe serverseitig; mit {@code reveal} kommt die Auflösung dazu. */
+    @Transactional(readOnly = true)
+    public JsonNode check(Long taskId, boolean reveal, JsonNode submission) {
+        ObjectNode result = mapper.createObjectNode();
+        DevLabTask task = taskId == null ? null : taskRepository.findById(taskId).orElse(null);
+        JsonNode p = task == null ? null : parse(task.getPayload());
+        if (p == null) {
+            result.put("correct", false);
+            return result;
+        }
+        JsonNode sub = submission == null ? mapper.createObjectNode() : submission;
+        boolean correct = switch (task.getType()) {
+            case "cloze" -> checkCloze(p, sub, result, reveal);
+            case "choice" -> checkChoice(p, sub, result, reveal);
+            case "order" -> checkOrder(p, sub, result, reveal);
+            case "spot" -> checkSpot(p, sub, result, reveal);
+            case "match" -> checkMatch(p, sub, result, reveal);
+            case "regex" -> checkRegex(p, sub, result, reveal);
+            default -> false;
+        };
+        result.put("correct", correct);
+        if (correct && p.hasNonNull("successText")) {
+            result.put("successText", p.get("successText").asText());
+        }
+        return result;
+    }
+
+    private boolean checkCloze(JsonNode p, JsonNode sub, ObjectNode result, boolean reveal) {
+        Map<Integer, String> typed = new HashMap<>();
+        for (JsonNode g : array(sub, "gaps")) {
+            typed.put(g.path("position").asInt(), g.path("text").asText(""));
+        }
+        ArrayNode detail = result.putArray("detail");
+        boolean all = true;
+        for (JsonNode gap : array(p, "gaps")) {
+            int pos = gap.path("position").asInt();
+            boolean caseSensitive = gap.path("caseSensitive").asBoolean(true);
+            boolean ok = anyEquals(stringList(gap, "solutions"), typed.get(pos), caseSensitive);
+            if (!ok) {
+                all = false;
+            }
+            ObjectNode d = detail.addObject();
+            d.put("position", pos);
+            d.put("correct", ok);
+            if (reveal && !ok) {
+                List<String> sols = stringList(gap, "solutions");
+                d.put("solution", sols.isEmpty() ? "" : sols.get(0));
+            }
+        }
+        return all;
+    }
+
+    private boolean checkChoice(JsonNode p, JsonNode sub, ObjectNode result, boolean reveal) {
+        List<String> options = stringList(p, "options");
+        int correctIndex = p.path("correctIndex").asInt(-1);
+        String correctText = (correctIndex >= 0 && correctIndex < options.size()) ? options.get(correctIndex) : null;
+        boolean ok = correctText != null && textEquals(correctText, sub.path("choice").asText(""), false);
+        if (reveal && !ok && correctText != null) {
+            result.put("solution", correctText);
+        }
+        return ok;
+    }
+
+    private boolean checkOrder(JsonNode p, JsonNode sub, ObjectNode result, boolean reveal) {
+        List<String> correctOrder = stringList(p, "items");
+        List<String> given = stringList(sub, "order");
+        boolean ok = given.size() == correctOrder.size();
+        for (int i = 0; ok && i < correctOrder.size(); i++) {
+            if (!textEquals(correctOrder.get(i), given.get(i), false)) {
+                ok = false;
+            }
+        }
+        if (reveal && !ok) {
+            result.put("solution", String.join("  →  ", correctOrder));
+        }
+        return ok;
+    }
+
+    private boolean checkSpot(JsonNode p, JsonNode sub, ObjectNode result, boolean reveal) {
+        int bugIndex = p.path("bugIndex").asInt(-1);
+        boolean ok = sub.path("index").asInt(-2) == bugIndex;
+        if (reveal && !ok) {
+            ObjectNode sol = result.putObject("solution");
+            sol.put("index", bugIndex);
+            sol.put("fix", p.path("fix").asText(""));
+        }
+        return ok;
+    }
+
+    private boolean checkMatch(JsonNode p, JsonNode sub, ObjectNode result, boolean reveal) {
+        Map<String, String> correctPairs = new HashMap<>();
+        ArrayNode solution = mapper.createArrayNode();
+        for (JsonNode pair : array(p, "pairs")) {
+            if (pair.isArray() && pair.size() >= 2) {
+                correctPairs.put(normalize(pair.get(0).asText("")), normalize(pair.get(1).asText("")));
+                ArrayNode pv = solution.addArray();
+                pv.add(pair.get(0).asText(""));
+                pv.add(pair.get(1).asText(""));
+            }
+        }
+        int matched = 0;
+        for (JsonNode pair : array(sub, "pairs")) {
+            if (pair.isArray() && pair.size() >= 2) {
+                String want = correctPairs.get(normalize(pair.get(0).asText("")));
+                if (want != null && want.equals(normalize(pair.get(1).asText("")))) {
+                    matched++;
+                }
+            }
+        }
+        boolean ok = matched == correctPairs.size() && matched > 0;
+        if (reveal && !ok) {
+            result.set("solution", solution);
+        }
+        return ok;
+    }
+
+    private boolean checkRegex(JsonNode p, JsonNode sub, ObjectNode result, boolean reveal) {
+        String patternText = sub.path("pattern").asText("");
+        boolean ok = false;
+        if (!patternText.isBlank()) {
+            try {
+                Pattern pattern = Pattern.compile(patternText);
+                ok = true;
+                for (JsonNode s : array(p, "samples")) {
+                    boolean shouldMatch = s.path("shouldMatch").asBoolean(false);
+                    boolean matches = pattern.matcher(s.path("text").asText("")).matches();
+                    if (matches != shouldMatch) {
+                        ok = false;
+                        break;
+                    }
+                }
+            } catch (RuntimeException ex) {
+                result.put("error", "Ungültiges Regex-Muster.");
+                ok = false;
+            }
+        }
+        if (reveal && !ok && p.hasNonNull("pattern")) {
+            result.put("solution", p.get("pattern").asText());
+        }
+        return ok;
+    }
+
+    // ---------- Abschluss ----------
+
+    /** Schließt einen Durchlauf ab: Score wird aus den Eingaben recomputed und gespeichert. */
+    @Transactional
+    public DevLabResult finish(String username, DevLabFinishRequest request) {
+        int score = 0;
+        int maxScore = 0;
+        int solved = 0;
+        int total = 0;
+
+        if (request.getItems() != null) {
+            for (DevLabFinishRequest.Item item : request.getItems()) {
+                if (item.getTaskId() == null) {
+                    continue;
+                }
+                DevLabTask task = taskRepository.findById(item.getTaskId()).orElse(null);
+                if (task == null) {
+                    continue;
+                }
+                total++;
+                maxScore += task.getPoints();
+                JsonNode verdict = check(task.getId(), false, item.getSubmission());
+                if (verdict.path("correct").asBoolean(false) && !item.isRevealed()) {
+                    solved++;
+                    score += awardedPoints(task.getPoints(), item.getAttempts());
+                }
+            }
+        }
+
+        int stars = stars(score, maxScore);
+        int seconds = Math.max(request.getDurationSeconds(), 0);
+        String deck = request.getSlug() == null ? null : request.getSlug();
+        ScoreResult saved = gameScoreService.recordScore(username, GAME, deck, score, solved, seconds);
+        return new DevLabResult(score, maxScore, solved, total, stars,
+                saved.getHighscore(), saved.isNewHighscore(), saved.getPlays());
+    }
+
+    private int awardedPoints(int points, int attempts) {
+        int a = Math.max(1, attempts);
+        double factor = switch (a) {
+            case 1 -> 1.0;
+            case 2 -> 0.6;
+            default -> 0.3;
+        };
+        return (int) Math.round(points * factor);
+    }
+
+    private int stars(int score, int maxScore) {
+        if (maxScore <= 0 || score <= 0) {
+            return 0;
+        }
+        double ratio = (double) score / maxScore;
+        if (ratio >= 0.8) {
+            return 3;
+        }
+        if (ratio >= 0.5) {
+            return 2;
+        }
+        return 1;
+    }
+
+    // ---------- Admin ----------
+
+    @Transactional(readOnly = true)
+    public List<DevLabGameRow> gameRows() {
+        return gameRepository.findAllByOrderBySortOrderAscIdAsc().stream()
+                .map(g -> new DevLabGameRow(g.getId(), g.getSlug(), g.getTitle(), g.getLanguage(),
+                        g.getPath(), g.isActive(), taskRepository.countByGameId(g.getId())))
+                .toList();
+    }
+
+    @Transactional(readOnly = true)
+    public DevLabGame gameWithTasks(Long id) {
+        DevLabGame game = gameRepository.findById(id).orElse(null);
+        if (game != null) {
+            game.getTasks().size(); // lazy init
+        }
+        return game;
+    }
+
+    @Transactional
+    public Long createGame(String title, String language, String path, String description) {
+        if (title == null || title.isBlank()) {
+            return null;
+        }
+        String clean = title.trim();
+        int order = (int) gameRepository.count() + 1;
+        DevLabGame game = new DevLabGame(uniqueSlug(clean), clean, blankToNull(language),
+                normalizePath(path), blankToNull(description), order, true);
+        gameRepository.save(game);
+        return game.getId();
+    }
+
+    @Transactional
+    public void addTask(Long gameId, String type, String prompt, int points, String payload) {
+        if (type == null || prompt == null || prompt.isBlank()
+                || !KNOWN_TYPES.contains(type.trim()) || !isValidJson(payload)) {
+            return;
+        }
+        gameRepository.findById(gameId).ifPresent(game -> {
+            int sort = game.getTasks().size();
+            game.addTask(new DevLabTask(type.trim(), cap(prompt.trim(), 300), normalizePoints(points), sort, payload.trim()));
+            gameRepository.save(game);
+        });
+    }
+
+    @Transactional
+    public void updateTask(Long taskId, String prompt, int points, String payload) {
+        taskRepository.findById(taskId).ifPresent(task -> {
+            if (prompt != null && !prompt.isBlank()) {
+                task.setPrompt(cap(prompt.trim(), 300));
+            }
+            task.setPoints(normalizePoints(points));
+            if (isValidJson(payload)) {
+                task.setPayload(payload.trim());
+            }
+        });
+    }
+
+    @Transactional
+    public void deleteTask(Long taskId) {
+        taskRepository.deleteById(taskId);
+    }
+
+    @Transactional
+    public void deleteGame(Long gameId) {
+        gameRepository.deleteById(gameId);
+    }
+
+    @Transactional
+    public void toggleGame(Long gameId) {
+        gameRepository.findById(gameId).ifPresent(g -> g.setActive(!g.isActive()));
+    }
+
+    // ---------- Helfer ----------
+
+    private boolean isValidJson(String json) {
+        if (json == null || json.isBlank()) {
+            return false;
+        }
+        try {
+            return mapper.readTree(json).isObject();
+        } catch (Exception ex) {
+            return false;
+        }
+    }
+
+    private String blankToNull(String value) {
+        return (value == null || value.isBlank()) ? null : value.trim();
+    }
+
+    private String normalizePath(String path) {
+        if (path == null) {
+            return "syntax";
+        }
+        String p = path.trim().toLowerCase();
+        return KNOWN_PATHS.contains(p) ? p : "syntax";
+    }
+
+    private int normalizePoints(int points) {
+        return points <= 0 ? 100 : Math.min(1000, points);
+    }
+
+    private String cap(String value, int max) {
+        return value.length() <= max ? value : value.substring(0, max);
+    }
+
+    private String uniqueSlug(String title) {
+        String base = title.toLowerCase()
+                .replace("ä", "ae").replace("ö", "oe").replace("ü", "ue").replace("ß", "ss")
+                .replaceAll("[^a-z0-9]+", "-")
+                .replaceAll("(^-|-$)", "");
+        if (base.isBlank()) {
+            base = "game";
+        }
+        String slug = base;
+        int counter = 2;
+        while (gameRepository.existsBySlug(slug)) {
+            slug = base + "-" + counter++;
+        }
+        return slug;
+    }
+
+    private JsonNode parse(String json) {
+        if (json == null || json.isBlank()) {
+            return null;
+        }
+        try {
+            return mapper.readTree(json);
+        } catch (Exception ex) {
+            return null;
+        }
+    }
+
+    private static String normalize(String value) {
+        return value == null ? "" : value.trim().replaceAll("\\s+", " ");
+    }
+
+    private static boolean textEquals(String a, String b, boolean caseSensitive) {
+        String na = normalize(a);
+        String nb = normalize(b);
+        return caseSensitive ? na.equals(nb) : na.equalsIgnoreCase(nb);
+    }
+
+    private static boolean anyEquals(List<String> candidates, String value, boolean caseSensitive) {
+        if (value == null || normalize(value).isEmpty()) {
+            return false;
+        }
+        for (String candidate : candidates) {
+            if (textEquals(candidate, value, caseSensitive)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private Iterable<JsonNode> array(JsonNode node, String field) {
+        JsonNode arr = node == null ? null : node.get(field);
+        return (arr != null && arr.isArray()) ? arr : mapper.createArrayNode();
+    }
+
+    private List<String> stringList(JsonNode node, String field) {
+        List<String> out = new ArrayList<>();
+        for (JsonNode item : array(node, field)) {
+            out.add(item.asText(""));
+        }
+        return out;
+    }
+
+    private ArrayNode shuffledTextArray(List<String> texts) {
+        List<String> copy = new ArrayList<>(texts);
+        Collections.shuffle(copy, random);
+        ArrayNode arr = mapper.createArrayNode();
+        copy.forEach(arr::add);
+        return arr;
+    }
+
+    private void copyText(JsonNode source, ObjectNode target, String field) {
+        if (source.hasNonNull(field)) {
+            String value = source.get(field).asText();
+            if (!value.isEmpty()) {
+                target.put(field, value);
+            }
+        }
+    }
+}
@@ -4,6 +4,7 @@ import com.example.mindflux.model.User;

 public interface UserService {
    User findByUsername(String username);
+    User findByUsernameIgnoreCase(String username);
    void save(User user);
    void deleteByUsername(String username); // <-- Nur die Methodensignatur, ohne {}
 }
@@ -25,6 +25,11 @@ public class UserServiceImpl implements UserService {
        return userRepository.findByUsername(username).orElse(null); // <-- Optional aufgelöst
    }

+    @Override
+    public User findByUsernameIgnoreCase(String username) {
+        return userRepository.findByUsernameIgnoreCase(username).orElse(null);
+    }
+
    @Override
    public void save(User user) {
        userRepository.save(user);
@@ -0,0 +1,26 @@
+-- Dev Lab: Entwicklerlabor mit mehreren Spielmechaniken (cloze, choice, order, spot, match, regex).
+-- Spiel -> Aufgaben; je Aufgabe ein Typ + JSON-Payload (inkl. Lösung). Inhalte DB-basiert und
+-- Admin-pflegbar; server-autoritativ geprüft (Lösungen verlassen nie unverändert das Backend).
+
+CREATE TABLE devlab_games (
+    id            BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    slug          VARCHAR(150)  NOT NULL UNIQUE,
+    title         VARCHAR(200)  NOT NULL,
+    code_language VARCHAR(50),
+    lab_path      VARCHAR(50),
+    description   VARCHAR(1000),
+    sort_order    INT           NOT NULL DEFAULT 0,
+    active        BOOLEAN       NOT NULL DEFAULT TRUE
+);
+
+CREATE TABLE devlab_tasks (
+    id         BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    game_id    BIGINT        NOT NULL REFERENCES devlab_games (id) ON DELETE CASCADE,
+    task_type  VARCHAR(30)   NOT NULL,
+    prompt     VARCHAR(300)  NOT NULL,
+    points     INT           NOT NULL DEFAULT 100,
+    sort_order INT           NOT NULL DEFAULT 0,
+    payload    VARCHAR(8000) NOT NULL
+);
+
+CREATE INDEX idx_devlab_tasks_game ON devlab_tasks (game_id);
@@ -0,0 +1,387 @@
+/* === Dev Lab === Zentraler Hub für Programmier- und Webtechnologien.
+   Design folgt STYLEGUIDE.md: nur theme.css-Tokens, Prefix dl-. */
+
+body.dl-body {
+  min-height: 100vh;
+  color: var(--text);
+}
+
+.dl-shell.mf-shell.no-right {
+  min-height: calc(100vh - 3.5rem);
+}
+
+.dl-topbar {
+  align-items: center;
+}
+
+.dl-lab-status {
+  margin-top: auto;
+}
+
+.dl-lab-status h4 {
+  color: var(--accent);
+  font-size: .74rem;
+  letter-spacing: .12em;
+  text-transform: uppercase;
+  margin-bottom: .75rem;
+}
+
+.dl-lab-status p {
+  color: var(--muted);
+  font-size: .78rem;
+  line-height: 1.45;
+  margin-top: .65rem;
+}
+
+.dl-main {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.dl-hero {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) 220px;
+  align-items: center;
+  min-height: 230px;
+  overflow: hidden;
+  position: relative;
+}
+
+.dl-hero::before {
+  content: "";
+  position: absolute;
+  inset: 0;
+  background:
+    linear-gradient(90deg, transparent 0 31px, var(--line) 32px, transparent 33px),
+    linear-gradient(0deg, transparent 0 31px, var(--line) 32px, transparent 33px);
+  background-size: 34px 34px;
+  opacity: .2;
+  pointer-events: none;
+}
+
+.dl-hero > * {
+  position: relative;
+  z-index: 1;
+}
+
+.dl-hero h2 {
+  max-width: 760px;
+  color: var(--heading);
+  font-size: clamp(1.6rem, 3.2vw, 2.7rem);
+  line-height: 1.08;
+  margin: .4rem 0 .75rem;
+}
+
+.dl-hero p:not(.mf-eyebrow) {
+  max-width: 780px;
+  color: var(--muted);
+  line-height: 1.6;
+}
+
+.dl-tube {
+  position: relative;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  min-height: 190px;
+  color: var(--accent);
+  filter: drop-shadow(0 0 16px var(--glow-s));
+}
+
+.dl-tube svg {
+  width: 132px;
+  height: 176px;
+}
+
+.dl-tube span {
+  position: absolute;
+  font-family: "JetBrains Mono", "Fira Code", "Consolas", "Courier New", monospace;
+  color: var(--secondary);
+  font-weight: 800;
+  text-shadow: 0 0 12px var(--glow-w);
+  animation: dlFloat 4.8s ease-in-out infinite;
+}
+
+.dl-tube span:nth-child(2) { top: 55px; left: 72px; animation-delay: 0s; }
+.dl-tube span:nth-child(3) { top: 82px; right: 46px; animation-delay: -.9s; }
+.dl-tube span:nth-child(4) { bottom: 56px; left: 80px; animation-delay: -1.8s; }
+.dl-tube span:nth-child(5) { bottom: 82px; right: 66px; animation-delay: -2.8s; }
+
+.dl-workbench {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) minmax(340px, 420px);
+  gap: 1rem;
+  align-items: start;
+}
+
+.dl-panel-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  margin-bottom: .9rem;
+}
+
+.dl-panel-head h2,
+.dl-panel-head h3 {
+  color: var(--heading);
+  font-size: 1rem;
+}
+
+.dl-station-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: .8rem;
+}
+
+.dl-station {
+  display: grid;
+  grid-template-columns: 54px minmax(0, 1fr);
+  gap: .75rem;
+  width: 100%;
+  min-height: 126px;
+  padding: .9rem;
+  text-align: left;
+  color: var(--text);
+  background: var(--surface-2);
+  border: 1px solid var(--border);
+  border-radius: 14px;
+  cursor: pointer;
+  transition: transform .16s ease, border-color .18s ease, box-shadow .2s ease, background-color .2s ease;
+}
+
+.dl-station:hover,
+.dl-station.active {
+  transform: translateY(-2px);
+  border-color: var(--border-accent);
+  box-shadow: 0 0 18px var(--glow-w);
+}
+
+.dl-station.active {
+  background: color-mix(in srgb, var(--accent) 10%, var(--surface-2));
+}
+
+.dl-station-icon,
+.dl-world-icon {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  color: var(--accent);
+  background: var(--surface);
+  border: 1px solid var(--border-accent);
+  box-shadow: inset 0 0 18px var(--glow-w), 0 0 12px var(--glow-w);
+}
+
+.dl-station-icon {
+  width: 54px;
+  height: 54px;
+  border-radius: 13px;
+  font-size: 1rem;
+  font-weight: 900;
+}
+
+.dl-station h3 {
+  color: var(--heading);
+  font-size: 1rem;
+  margin-bottom: .25rem;
+}
+
+.dl-station p {
+  color: var(--muted);
+  font-size: .82rem;
+  line-height: 1.45;
+}
+
+.dl-station-meta {
+  display: flex;
+  flex-wrap: wrap;
+  gap: .35rem;
+  margin-top: .65rem;
+}
+
+.dl-chip {
+  display: inline-flex;
+  align-items: center;
+  min-height: 24px;
+  padding: .18rem .48rem;
+  border-radius: 7px;
+  border: 1px solid var(--border);
+  color: var(--muted);
+  font-size: .68rem;
+  font-weight: 800;
+  letter-spacing: .03em;
+  text-transform: uppercase;
+}
+
+.dl-world {
+  position: sticky;
+  top: 1rem;
+}
+
+.dl-world-head {
+  display: flex;
+  align-items: center;
+  gap: .85rem;
+  margin-bottom: .8rem;
+}
+
+.dl-world-icon {
+  width: 62px;
+  height: 62px;
+  border-radius: 16px;
+  font-size: 1.1rem;
+  font-weight: 900;
+}
+
+.dl-world h2 {
+  color: var(--heading);
+  font-size: 1.5rem;
+}
+
+.dl-world-copy {
+  color: var(--muted);
+  line-height: 1.55;
+}
+
+.dl-progression {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: .55rem;
+  margin: 1rem 0;
+}
+
+.dl-progression div {
+  padding: .65rem;
+  background: var(--surface-2);
+  border: 1px solid var(--border);
+  border-radius: 10px;
+}
+
+.dl-progression span {
+  display: block;
+  color: var(--muted);
+  font-size: .66rem;
+  letter-spacing: .08em;
+  text-transform: uppercase;
+}
+
+.dl-progression b {
+  display: block;
+  color: var(--heading);
+  font-size: .95rem;
+  margin-top: .18rem;
+}
+
+.dl-mechanics {
+  display: flex;
+  flex-wrap: wrap;
+  gap: .45rem;
+  margin-bottom: 1rem;
+}
+
+.dl-mechanics .dl-chip {
+  color: var(--secondary);
+  border-color: var(--secondary);
+  background: color-mix(in srgb, var(--secondary) 12%, transparent);
+}
+
+.dl-games-head {
+  margin-top: .2rem;
+}
+
+.dl-game-list {
+  display: grid;
+  gap: .65rem;
+}
+
+.dl-game {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) auto;
+  gap: .85rem;
+  align-items: center;
+  padding: .8rem;
+  background: var(--surface-2);
+  border: 1px solid var(--border);
+  border-radius: 12px;
+}
+
+.dl-game h4 {
+  color: var(--heading);
+  font-size: .95rem;
+  margin-bottom: .25rem;
+}
+
+.dl-game p {
+  color: var(--muted);
+  font-size: .8rem;
+  line-height: 1.45;
+}
+
+.dl-game-actions {
+  display: flex;
+  flex-direction: column;
+  gap: .4rem;
+  align-items: flex-end;
+}
+
+.dl-game-state {
+  font-size: .66rem;
+  font-weight: 900;
+  letter-spacing: .06em;
+  text-transform: uppercase;
+  color: var(--muted);
+}
+
+.dl-game.playable .dl-game-state {
+  color: var(--success);
+}
+
+.dl-game .mf-btn {
+  min-width: 92px;
+  padding: .48rem .75rem;
+  font-size: .72rem;
+}
+
+@keyframes dlFloat {
+  0%, 100% { transform: translateY(0); opacity: .75; }
+  50% { transform: translateY(-9px); opacity: 1; }
+}
+
+@media (max-width: 1120px) {
+  .dl-workbench {
+    grid-template-columns: 1fr;
+  }
+
+  .dl-world {
+    position: static;
+  }
+}
+
+@media (max-width: 760px) {
+  .dl-hero {
+    grid-template-columns: 1fr;
+    min-height: auto;
+    padding-top: 3.2rem;
+  }
+
+  .dl-tube {
+    display: none;
+  }
+
+  .dl-station-grid {
+    grid-template-columns: 1fr;
+  }
+
+  .dl-progression {
+    grid-template-columns: 1fr;
+  }
+
+  .dl-game {
+    grid-template-columns: 1fr;
+  }
+
+  .dl-game-actions {
+    align-items: flex-start;
+  }
+}
@@ -0,0 +1,119 @@
+/* === Dev Lab – Spiel-Engine === polymorphe Mechaniken, Farben/Tokens zentral aus theme.css
+   (richtig = Blau, falsch = Rot, Akzent = Amber). Keine hartkodierten Farben. */
+
+@keyframes dlgIn { 0% { opacity: 0; transform: translateY(14px); } 100% { opacity: 1; transform: translateY(0); } }
+
+body.dlg-body { min-height: 100vh; display: flex; flex-direction: column; color: var(--text); }
+.dlg-shell { flex: 1; width: 100%; max-width: 1100px; margin: 0 auto; display: flex; flex-direction: column; padding: 0.7rem 0.9rem 1.4rem; gap: 0.7rem; }
+
+.dlg-header { display: flex; align-items: center; justify-content: space-between; gap: 1rem; padding: 0.5rem 1.1rem; background: var(--surface); border: 1px solid var(--border); border-radius: 12px; box-shadow: var(--g-soft); }
+.dlg-head-title { text-align: center; }
+.dlg-head-title h1 { color: var(--accent); font-size: 1.25rem; text-shadow: 0 0 8px var(--glow-s); }
+.dlg-header-tools { display: flex; align-items: center; gap: 0.7rem; }
+.dlg-back, .dlg-logout { text-decoration: none; font-weight: bold; }
+.dlg-back { color: var(--accent); } .dlg-logout { color: var(--danger); }
+
+.dlg-bar { display: flex; align-items: center; justify-content: space-between; flex-wrap: wrap; gap: 0.55rem; }
+.dlg-bar-group { display: flex; align-items: center; flex-wrap: wrap; gap: 0.5rem; }
+.dlg-stat { display: inline-flex; align-items: baseline; gap: 0.4rem; padding: 0.35rem 0.7rem; background: var(--surface-2); border: 1px solid var(--border); border-radius: 10px; font-size: 0.7rem; text-transform: uppercase; letter-spacing: 0.05em; color: var(--muted); white-space: nowrap; }
+.dlg-stat b { font-size: 1.05rem; color: var(--accent); }
+
+.dlg-stage { flex: 1; display: grid; grid-template-columns: 1fr 300px; gap: 0.8rem; align-items: start; }
+.dlg-card { background: var(--surface); border: 1px solid var(--border-accent); border-radius: 16px; padding: 1.3rem 1.5rem 1.4rem; box-shadow: 0 0 24px var(--glow-w); animation: dlgIn 0.32s ease-out; min-width: 0; }
+.dlg-card-head { display: flex; align-items: center; justify-content: space-between; margin-bottom: 0.5rem; }
+.dlg-points { color: var(--accent); font-weight: 800; }
+.dlg-card h2 { color: var(--heading); font-size: 1.3rem; font-weight: 800; margin-bottom: 0.4rem; }
+.dlg-narrative { color: var(--text); line-height: 1.55; margin-bottom: 0.5rem; }
+.dlg-narrative[hidden], .dlg-instruction[hidden] { display: none; }
+.dlg-instruction { color: var(--muted); font-size: 0.9rem; margin-bottom: 0.7rem; }
+.dlg-playfield { margin: 0.4rem 0 0.8rem; }
+.dlg-mini { color: var(--muted); font-size: 0.78rem; margin: 0.5rem 0 0.3rem; }
+.dlg-mini.reveal { color: var(--secondary); font-family: monospace; }
+
+/* Code + Lücken (cloze) */
+.dlg-code { background: var(--surface-2); border: 1px solid var(--border); border-radius: 12px; padding: 1rem 1.1rem; overflow-x: auto; box-shadow: inset 0 0 22px var(--glow-w); }
+.dlg-code, .dlg-code code { font-family: "JetBrains Mono", "Fira Code", "Consolas", monospace; font-size: 0.92rem; line-height: 2; white-space: pre; color: var(--text); }
+.dlg-gap { font-family: inherit; font-size: inherit; color: var(--accent); background: color-mix(in srgb, var(--accent) 10%, transparent); border: 1px solid var(--border-accent); border-radius: 5px; padding: 0.05rem 0.35rem; margin: 0 0.12rem; min-width: 3ch; }
+.dlg-gap::placeholder { color: var(--muted); opacity: 0.7; }
+.dlg-gap:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 2px var(--glow-w); }
+.dlg-gap.correct { color: var(--success); border-color: var(--success); background: color-mix(in srgb, var(--success) 16%, transparent); }
+.dlg-gap.wrong { color: var(--danger); border-color: var(--danger); background: color-mix(in srgb, var(--danger) 16%, transparent); }
+.dlg-gap.revealed { color: var(--secondary); border-color: var(--secondary); background: color-mix(in srgb, var(--secondary) 14%, transparent); }
+
+/* Multiple Choice */
+.dlg-question { color: var(--heading); font-weight: 600; margin-bottom: 0.6rem; }
+.dlg-choices { display: grid; gap: 0.55rem; }
+.dlg-choice { text-align: left; padding: 0.7rem 1rem; border: 1px solid var(--border-accent); border-radius: 10px; background: var(--surface-2); color: var(--text); font-size: 0.98rem; cursor: pointer; transition: border-color .18s, background .18s; }
+.dlg-choice:hover:not(:disabled) { border-color: var(--accent); background: var(--surface); }
+.dlg-choice.selected { border-color: var(--accent); box-shadow: 0 0 0 2px var(--glow-w); }
+.dlg-choice.correct { border-color: var(--success); background: color-mix(in srgb, var(--success) 16%, transparent); color: var(--success); }
+.dlg-choice.wrong { border-color: var(--danger); background: color-mix(in srgb, var(--danger) 16%, transparent); color: var(--danger); }
+.dlg-choice:disabled { cursor: default; }
+
+/* Tokens (order + spot) */
+.dlg-token, .dlg-spot-token { font-family: "JetBrains Mono", "Consolas", monospace; font-size: 0.9rem; padding: 0.4rem 0.7rem; border: 1px solid var(--border-accent); border-radius: 8px; background: var(--surface-2); color: var(--text); cursor: pointer; transition: all .15s; }
+.dlg-token:hover:not(:disabled), .dlg-spot-token:hover:not(:disabled) { border-color: var(--accent); transform: translateY(-1px); }
+.dlg-order-answer { min-height: 2.6rem; display: flex; flex-wrap: wrap; gap: 0.5rem; padding: 0.6rem; border: 1px dashed var(--border-accent); border-radius: 10px; background: color-mix(in srgb, var(--accent) 5%, transparent); }
+.dlg-order-answer:not(.filled)::before { content: attr(data-empty); color: var(--muted); font-size: 0.82rem; }
+.dlg-order-bank { display: flex; flex-wrap: wrap; gap: 0.5rem; }
+.dlg-spot { display: flex; flex-wrap: wrap; gap: 0.45rem; padding: 0.8rem; background: var(--surface-2); border: 1px solid var(--border); border-radius: 12px; }
+.dlg-spot-token.selected { border-color: var(--accent); box-shadow: 0 0 0 2px var(--glow-w); color: var(--accent); }
+.dlg-spot-token.correct { border-color: var(--success); color: var(--success); background: color-mix(in srgb, var(--success) 14%, transparent); }
+.dlg-spot-token.wrong { border-color: var(--danger); color: var(--danger); background: color-mix(in srgb, var(--danger) 14%, transparent); }
+
+/* Zuordnen (match) */
+.dlg-match { display: grid; grid-template-columns: 1fr 1fr; gap: 0.8rem; }
+.dlg-match-col { display: flex; flex-direction: column; gap: 0.5rem; }
+.dlg-match-item { display: flex; align-items: center; justify-content: space-between; gap: 0.5rem; padding: 0.6rem 0.8rem; border: 1px solid var(--border-accent); border-radius: 10px; background: var(--surface-2); color: var(--text); cursor: pointer; text-align: left; transition: all .15s; }
+.dlg-match-item:hover:not(:disabled) { border-color: var(--accent); }
+.dlg-match-item.active { border-color: var(--accent); box-shadow: 0 0 0 2px var(--glow-w); }
+.dlg-match-item.connected { border-color: var(--secondary); background: color-mix(in srgb, var(--secondary) 12%, transparent); }
+.dlg-match-badge { min-width: 1.4rem; height: 1.4rem; display: inline-flex; align-items: center; justify-content: center; border-radius: 50%; font-size: 0.72rem; font-weight: 800; color: var(--accent-ink); background: transparent; }
+.dlg-match-item.connected .dlg-match-badge { background: var(--secondary); }
+
+/* Regex */
+.dlg-regex { display: flex; flex-direction: column; gap: 0.7rem; }
+.dlg-regex-input { font-family: "JetBrains Mono", "Consolas", monospace; font-size: 1rem; padding: 0.6rem 0.8rem; border: 1px solid var(--border-accent); border-radius: 10px; background: var(--surface-2); color: var(--accent); }
+.dlg-regex-input:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 2px var(--glow-w); }
+.dlg-regex-samples { display: flex; flex-wrap: wrap; gap: 0.5rem; }
+.dlg-sample { display: flex; flex-direction: column; gap: 0.15rem; padding: 0.4rem 0.7rem; border: 1px solid var(--border); border-radius: 9px; font-family: "JetBrains Mono", monospace; font-size: 0.85rem; background: var(--surface-2); }
+.dlg-sample small { font-family: inherit; font-size: 0.62rem; text-transform: uppercase; letter-spacing: 0.04em; color: var(--muted); }
+.dlg-sample.ok { border-color: var(--success); color: var(--success); }
+.dlg-sample.bad { border-color: var(--danger); color: var(--danger); }
+
+/* Feedback */
+.dlg-feedback { min-height: 1.3rem; font-weight: 700; margin-bottom: 0.4rem; line-height: 1.5; }
+.dlg-feedback.correct { color: var(--success); } .dlg-feedback.correct::before { content: "\2713  "; }
+.dlg-feedback.wrong { color: var(--danger); } .dlg-feedback.wrong::before { content: "\2717  "; }
+.dlg-feedback.revealed { color: var(--secondary); }
+.dlg-success { color: var(--secondary); background: color-mix(in srgb, var(--secondary) 10%, transparent); border-left: 3px solid var(--secondary); border-radius: 6px; padding: 0.7rem 0.9rem; margin-bottom: 0.7rem; line-height: 1.5; }
+.dlg-success[hidden] { display: none; }
+
+.dlg-actions { display: flex; flex-wrap: wrap; gap: 0.6rem; }
+.dlg-actions .mf-btn[hidden] { display: none; }
+
+/* Seitenpanel */
+.dlg-side h2 { color: var(--accent); font-size: 1rem; margin-bottom: 0.5rem; }
+.dlg-description { color: var(--muted); font-size: 0.88rem; line-height: 1.5; margin-bottom: 0.9rem; }
+.dlg-progress span { color: var(--muted); font-size: 0.72rem; text-transform: uppercase; letter-spacing: 0.06em; }
+.dlg-progress .mf-bar { margin-top: 0.3rem; }
+.dlg-best { color: var(--muted); font-size: 0.82rem; margin-top: 0.9rem; }
+
+/* Ergebnis-Overlay */
+.dlg-overlay { position: fixed; inset: 0; display: flex; align-items: center; justify-content: center; background: var(--bg-glow), rgba(0,0,0,.55); backdrop-filter: blur(4px); z-index: 1000; padding: 1rem; }
+.dlg-overlay[hidden] { display: none; }
+.dlg-result-card { background: var(--surface); border: 1px solid var(--border-accent); border-radius: 16px; padding: 1.6rem 1.8rem; width: min(440px, 94vw); text-align: center; box-shadow: 0 0 30px var(--glow-w); animation: dlgIn 0.4s ease-out; }
+.dlg-result-card h2 { color: var(--accent); margin-bottom: 0.4rem; }
+.dlg-result-stars { font-size: 2rem; color: var(--accent); letter-spacing: 0.2rem; margin-bottom: 0.5rem; text-shadow: 0 0 12px var(--glow-s); }
+.dlg-result-score { font-size: 1.35rem; color: var(--text); margin-bottom: 0.4rem; } .dlg-result-score strong { color: var(--accent); }
+.dlg-result-detail { color: var(--muted); margin-bottom: 0.5rem; }
+.dlg-result-high { color: var(--accent); font-weight: 800; margin-bottom: 0.8rem; }
+.dlg-result-high[hidden] { display: none; }
+.dlg-result-actions { display: flex; flex-wrap: wrap; gap: 0.7rem; justify-content: center; margin-top: 1rem; }
+
+@media (max-width: 820px) { .dlg-stage { grid-template-columns: 1fr; } }
+@media (max-width: 560px) {
+  .dlg-head-title h1 { font-size: 1.05rem; }
+  .dlg-stat { font-size: 0.62rem; padding: 0.3rem 0.5rem; }
+  .dlg-code, .dlg-code code { font-size: 0.82rem; }
+}
@@ -0,0 +1,76 @@
+/* Dev Lab Hub – lädt den Spiele-Katalog aus /api/devlab/catalog (DB-gestützt) und gruppiert
+   die Spiele nach Trainingspfad. Spielkarten verlinken auf /devlab/games/{slug}. */
+(function () {
+  const PATHS = [
+    { id: 'syntax', marker: '{}', title: 'Syntax & Grundlagen', type: 'Grundlagenpfad',
+      copy: 'Sprachsyntax, Strukturen und Muster verstehen, bevor der Code komplex wird.',
+      mechanics: ['Lücken füllen', 'Zusammensetzen', 'Multiple Choice', 'Regex live'], badge: 'Syntax Core' },
+    { id: 'debugging', marker: '</>', title: 'Debugging & Problemlösung', type: 'Ermittlungspfad',
+      copy: 'Fehler finden, Ursache erkennen und den passenden Reparaturschritt wählen.',
+      mechanics: ['Bug finden', 'Lücken füllen', 'Befehlsfolgen', 'Storyfälle'], badge: 'Bug Hunter' },
+    { id: 'visual', marker: '[]', title: 'Praxis & Visualisierung', type: 'Werkstattpfad',
+      copy: 'Direkt sehen, was Regeln, Layouts, APIs und Kaskaden im System bewirken.',
+      mechanics: ['Zuordnen', 'Multiple Choice', 'Statuscodes', 'Kaskade'], badge: 'Visual Builder' }
+  ];
+
+  const pathRoot = document.getElementById('dl-stations');
+  const gameRoot = document.getElementById('dl-games');
+  const mechanicsRoot = document.getElementById('dl-mechanics');
+  const ui = {
+    title: document.getElementById('dl-world-title'), type: document.getElementById('dl-world-type'),
+    icon: document.getElementById('dl-world-icon'), copy: document.getElementById('dl-world-copy'),
+    levels: document.getElementById('dl-levels'), xp: document.getElementById('dl-xp'),
+    badge: document.getElementById('dl-badge'), gameCount: document.getElementById('dl-game-count')
+  };
+
+  const esc = (v) => String(v).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+  let byPath = {};
+
+  function renderStations(activeId) {
+    pathRoot.innerHTML = PATHS.map((p) => {
+      const games = byPath[p.id] || [];
+      return `<button type="button" class="dl-station${p.id === activeId ? ' active' : ''}" data-path="${p.id}">
+        <span class="dl-station-icon">${esc(p.marker)}</span>
+        <span><h3>${esc(p.title)}</h3><p>${esc(p.copy)}</p>
+          <span class="dl-station-meta"><span class="dl-chip">${games.length} Spiele</span><span class="dl-chip">${esc(p.type)}</span></span>
+        </span></button>`;
+    }).join('');
+  }
+
+  function renderPath(p) {
+    const games = byPath[p.id] || [];
+    const totalTasks = games.reduce((sum, g) => sum + (g.taskCount || 0), 0);
+    ui.title.textContent = p.title; ui.type.textContent = p.type; ui.icon.textContent = p.marker;
+    ui.copy.textContent = p.copy; ui.levels.textContent = games.length; ui.xp.textContent = totalTasks; ui.badge.textContent = p.badge;
+    ui.gameCount.textContent = `${games.length} Spiele`;
+    mechanicsRoot.innerHTML = p.mechanics.map((m) => `<span class="dl-chip">${esc(m)}</span>`).join('');
+    gameRoot.innerHTML = games.length ? games.map((g) => `
+      <article class="dl-game playable">
+        <div><h4>${esc(g.title)}</h4><p>${esc(g.description || '')}</p></div>
+        <div class="dl-game-actions">
+          <span class="dl-game-state">${g.taskCount} Aufgaben</span>
+          <a class="mf-btn" href="/devlab/games/${encodeURIComponent(g.slug)}">Starten</a>
+        </div>
+      </article>`).join('') : '<p class="dl-empty">Für diesen Pfad sind noch keine Spiele freigeschaltet.</p>';
+    renderStations(p.id);
+  }
+
+  pathRoot.addEventListener('click', (e) => {
+    const btn = e.target.closest('.dl-station');
+    if (!btn) return;
+    const p = PATHS.find((x) => x.id === btn.dataset.path);
+    if (p) renderPath(p);
+  });
+
+  fetch('/api/devlab/catalog')
+    .then((res) => res.json())
+    .then((data) => {
+      byPath = {};
+      (data.games || []).forEach((g) => {
+        const key = PATHS.some((p) => p.id === g.path) ? g.path : 'syntax';
+        (byPath[key] = byPath[key] || []).push(g);
+      });
+      renderPath(PATHS[0]);
+    })
+    .catch(() => renderPath(PATHS[0]));
+})();
@@ -0,0 +1,377 @@
+/* Dev Lab – polymorphe Spiel-Engine. Aufgaben kommen aus /api/devlab/games/{slug}/session
+   (ohne Lösung), geprüft + bewertet wird serverseitig. Eine Render-/Submit-Funktion je Typ:
+   cloze · choice · order · spot · match · regex. Interaktion klick-basiert. */
+(function () {
+  'use strict';
+
+  const MAX_ATTEMPTS = 3;
+  const GAME = 'devlab';
+  const slug = document.body.dataset.game || '';
+  const MECH_LABEL = {
+    cloze: 'Lücken füllen', choice: 'Multiple Choice', order: 'Zusammensetzen',
+    spot: 'Bug finden', match: 'Zuordnen', regex: 'Regex'
+  };
+
+  const el = (id) => document.getElementById(id);
+  const r = {
+    title: el('dlg-title'), language: el('dlg-language'), taskNo: el('dlg-task-no'),
+    score: el('dlg-score'), time: el('dlg-time'), best: el('dlg-best'), mech: el('dlg-mech'),
+    kind: el('dlg-kind'), points: el('dlg-points'), prompt: el('dlg-prompt'),
+    narrative: el('dlg-narrative'), instruction: el('dlg-instruction'), playfield: el('dlg-playfield'),
+    feedback: el('dlg-feedback'), success: el('dlg-success'),
+    check: el('dlg-check'), hint: el('dlg-hint'), reveal: el('dlg-reveal'), next: el('dlg-next'),
+    result: el('dlg-result'), resultStars: el('dlg-result-stars'), resultScore: el('dlg-result-score'),
+    resultMax: el('dlg-result-max'), resultDetail: el('dlg-result-detail'), resultHigh: el('dlg-result-high'),
+    again: el('dlg-again'), description: el('dlg-description'), sideTitle: el('dlg-side-title'),
+    progress: el('dlg-progress'), bestLine: el('dlg-best-line')
+  };
+
+  let session = null, index = 0, score = 0, seconds = 0, timer = null, running = false;
+  let finishItems = [];
+  let cur = null; // { task, attempts, solved, revealed, collect, lock, mark }
+
+  // ---------- Helfer ----------
+  const escapeHtml = (v) => String(v).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  const formatTime = (s) => `${Math.floor(s / 60)}:${String(s % 60).padStart(2, '0')}`;
+  function awarded(points, attempts) {
+    const a = Math.max(1, attempts);
+    return Math.round(points * (a === 1 ? 1 : a === 2 ? 0.6 : 0.3));
+  }
+  function starString(stars) {
+    const n = Math.max(0, Math.min(3, stars));
+    return '★'.repeat(n) + '☆'.repeat(3 - n);
+  }
+  function startTimer() { if (!timer) timer = setInterval(() => { seconds++; r.time.textContent = formatTime(seconds); }, 1000); }
+  function stopTimer() { clearInterval(timer); timer = null; }
+
+  function updateHud() {
+    r.taskNo.textContent = `${Math.min(index + 1, session.tasks.length)} / ${session.tasks.length}`;
+    r.score.textContent = String(score);
+    r.progress.style.width = `${Math.round((index / session.tasks.length) * 100)}%`;
+  }
+
+  // ---------- Renderer je Mechanik ----------
+  const RENDERERS = {
+    cloze(task) {
+      const inputs = {};
+      const pre = document.createElement('pre');
+      pre.className = 'dlg-code';
+      const code = document.createElement('code');
+      const tpl = task.codeTemplate || '';
+      const regex = /\{\{(\d+)\}\}/g;
+      const gapMap = Object.fromEntries((task.gaps || []).map((g) => [g.position, g]));
+      let last = 0, m;
+      while ((m = regex.exec(tpl)) !== null) {
+        if (m.index > last) code.appendChild(document.createTextNode(tpl.slice(last, m.index)));
+        const pos = Number(m[1]);
+        const gap = gapMap[pos] || {};
+        const input = document.createElement('input');
+        input.type = 'text'; input.className = 'dlg-gap'; input.dataset.pos = pos;
+        input.autocomplete = 'off'; input.autocapitalize = 'off'; input.spellcheck = false;
+        input.setAttribute('autocorrect', 'off');
+        if (gap.placeholder) input.placeholder = gap.placeholder;
+        input.size = Math.max(6, (gap.placeholder || '').length + 1);
+        input.addEventListener('input', () => { input.size = Math.max(4, input.value.length + 1); });
+        input.addEventListener('keydown', (e) => { if (e.key === 'Enter') { e.preventDefault(); doCheck(false); } });
+        inputs[pos] = input;
+        code.appendChild(input);
+        last = m.index + m[0].length;
+      }
+      if (last < tpl.length) code.appendChild(document.createTextNode(tpl.slice(last)));
+      pre.appendChild(code);
+      r.playfield.appendChild(pre);
+      const first = Object.values(inputs)[0]; if (first) first.focus();
+      return {
+        collect: () => ({ gaps: Object.entries(inputs).map(([pos, i]) => ({ position: Number(pos), text: i.value })) }),
+        lock: () => Object.values(inputs).forEach((i) => { i.disabled = true; }),
+        mark: (data) => (data.detail || []).forEach((d) => {
+          const i = inputs[d.position]; if (!i) return;
+          i.classList.toggle('correct', d.correct); i.classList.toggle('wrong', !d.correct);
+          if (d.solution) { i.value = d.solution; i.classList.remove('wrong'); i.classList.add('revealed'); }
+        })
+      };
+    },
+
+    choice(task) {
+      let selected = null;
+      const wrap = document.createElement('div'); wrap.className = 'dlg-choices';
+      if (task.code) { const pre = document.createElement('pre'); pre.className = 'dlg-code'; pre.textContent = task.code; r.playfield.appendChild(pre); }
+      if (task.question) { const q = document.createElement('p'); q.className = 'dlg-question'; q.textContent = task.question; r.playfield.appendChild(q); }
+      (task.options || []).forEach((opt) => {
+        const b = document.createElement('button');
+        b.type = 'button'; b.className = 'dlg-choice'; b.textContent = opt;
+        b.addEventListener('click', () => {
+          if (cur.solved || cur.revealed) return;
+          selected = opt;
+          wrap.querySelectorAll('.dlg-choice').forEach((x) => x.classList.toggle('selected', x === b));
+        });
+        wrap.appendChild(b);
+      });
+      r.playfield.appendChild(wrap);
+      return {
+        collect: () => ({ choice: selected || '' }),
+        lock: () => wrap.querySelectorAll('.dlg-choice').forEach((b) => { b.disabled = true; }),
+        mark: (data) => {
+          wrap.querySelectorAll('.dlg-choice').forEach((b) => {
+            if (b.textContent === selected) b.classList.add(data.correct ? 'correct' : 'wrong');
+            if (data.solution && b.textContent === data.solution) b.classList.add('correct');
+          });
+        }
+      };
+    },
+
+    order(task) {
+      const answer = document.createElement('div'); answer.className = 'dlg-order-answer'; answer.dataset.empty = 'Hier in die richtige Reihenfolge klicken …';
+      const bank = document.createElement('div'); bank.className = 'dlg-order-bank';
+      function chip(text, inAnswer) {
+        const b = document.createElement('button'); b.type = 'button'; b.className = 'dlg-token'; b.textContent = text;
+        b.addEventListener('click', () => {
+          if (cur.solved || cur.revealed) return;
+          if (inAnswer) { bank.appendChild(chip(text, false)); b.remove(); }
+          else { answer.appendChild(chip(text, true)); b.remove(); }
+          answer.classList.toggle('filled', answer.children.length > 0);
+        });
+        return b;
+      }
+      (task.items || []).forEach((it) => bank.appendChild(chip(it, false)));
+      const wrap = document.createElement('div'); wrap.className = 'dlg-order';
+      const lblA = document.createElement('p'); lblA.className = 'dlg-mini'; lblA.textContent = 'Deine Reihenfolge:';
+      const lblB = document.createElement('p'); lblB.className = 'dlg-mini'; lblB.textContent = 'Bausteine:';
+      wrap.append(lblA, answer, lblB, bank);
+      r.playfield.appendChild(wrap);
+      return {
+        collect: () => ({ order: Array.from(answer.children).map((c) => c.textContent) }),
+        lock: () => wrap.querySelectorAll('.dlg-token').forEach((b) => { b.disabled = true; }),
+        mark: (data) => { if (data.solution) { const s = document.createElement('p'); s.className = 'dlg-mini reveal'; s.textContent = 'Lösung: ' + data.solution; wrap.appendChild(s); } }
+      };
+    },
+
+    spot(task) {
+      let selected = -1;
+      const box = document.createElement('div'); box.className = 'dlg-spot';
+      (task.tokens || []).forEach((tok, i) => {
+        const b = document.createElement('button'); b.type = 'button'; b.className = 'dlg-spot-token'; b.textContent = tok;
+        b.addEventListener('click', () => {
+          if (cur.solved || cur.revealed) return;
+          selected = i;
+          box.querySelectorAll('.dlg-spot-token').forEach((x, j) => x.classList.toggle('selected', j === i));
+        });
+        box.appendChild(b);
+      });
+      r.playfield.appendChild(box);
+      return {
+        collect: () => ({ index: selected }),
+        lock: () => box.querySelectorAll('.dlg-spot-token').forEach((b) => { b.disabled = true; }),
+        mark: (data) => {
+          if (data.correct && selected >= 0) box.children[selected].classList.add('correct');
+          else if (selected >= 0) box.children[selected].classList.add('wrong');
+          const sol = data.solution; if (sol && typeof sol.index === 'number' && box.children[sol.index]) box.children[sol.index].classList.add('correct');
+        }
+      };
+    },
+
+    match(task) {
+      const left = task.left || [], right = task.right || [];
+      const conn = {}; // leftIndex -> rightIndex
+      let activeLeft = -1;
+      const wrap = document.createElement('div'); wrap.className = 'dlg-match';
+      const colL = document.createElement('div'); colL.className = 'dlg-match-col';
+      const colR = document.createElement('div'); colR.className = 'dlg-match-col';
+      function render() {
+        wrap.querySelectorAll('.dlg-match-item').forEach((node) => {
+          const side = node.dataset.side, i = Number(node.dataset.i);
+          node.classList.toggle('active', side === 'l' && i === activeLeft);
+          let badge = '';
+          if (side === 'l' && conn[i] != null) badge = String(Object.keys(conn).indexOf(String(i)) + 1);
+          if (side === 'r') { const li = Object.keys(conn).find((k) => conn[k] === i); if (li != null) badge = String(Object.keys(conn).indexOf(li) + 1); }
+          node.classList.toggle('connected', !!badge);
+          node.querySelector('.dlg-match-badge').textContent = badge;
+        });
+      }
+      function item(text, side, i) {
+        const b = document.createElement('button'); b.type = 'button'; b.className = 'dlg-match-item'; b.dataset.side = side; b.dataset.i = i;
+        b.innerHTML = `<span>${escapeHtml(text)}</span><span class="dlg-match-badge"></span>`;
+        b.addEventListener('click', () => {
+          if (cur.solved || cur.revealed) return;
+          if (side === 'l') { activeLeft = (conn[i] != null) ? (delete conn[i], -1) : i; }
+          else if (activeLeft >= 0) { Object.keys(conn).forEach((k) => { if (conn[k] === i) delete conn[k]; }); conn[activeLeft] = i; activeLeft = -1; }
+          render();
+        });
+        return b;
+      }
+      left.forEach((t, i) => colL.appendChild(item(t, 'l', i)));
+      right.forEach((t, i) => colR.appendChild(item(t, 'r', i)));
+      wrap.append(colL, colR); r.playfield.appendChild(wrap);
+      return {
+        collect: () => ({ pairs: Object.entries(conn).map(([li, ri]) => [left[li], right[ri]]) }),
+        lock: () => wrap.querySelectorAll('.dlg-match-item').forEach((b) => { b.disabled = true; }),
+        mark: (data) => {
+          if (data.solution) { const s = document.createElement('p'); s.className = 'dlg-mini reveal'; s.textContent = 'Lösung: ' + data.solution.map((p) => `${p[0]} → ${p[1]}`).join(' · '); wrap.parentElement.appendChild(s); }
+        }
+      };
+    },
+
+    regex(task) {
+      const input = document.createElement('input');
+      input.type = 'text'; input.className = 'dlg-regex-input'; input.placeholder = 'Regex-Muster …';
+      input.autocomplete = 'off'; input.spellcheck = false;
+      const list = document.createElement('div'); list.className = 'dlg-regex-samples';
+      const samples = task.samples || [];
+      function preview() {
+        let pat = null;
+        try { pat = input.value ? new RegExp(input.value) : null; } catch (e) { pat = null; }
+        list.innerHTML = samples.map((s) => {
+          const matches = pat ? pat.test(s.text) : false;
+          const ok = matches === s.shouldMatch;
+          const want = s.shouldMatch ? 'soll matchen' : 'soll nicht matchen';
+          return `<span class="dlg-sample ${ok ? 'ok' : 'bad'}">${escapeHtml(s.text === '' ? '∅ (leer)' : s.text)}<small>${want}</small></span>`;
+        }).join('');
+      }
+      input.addEventListener('input', preview);
+      input.addEventListener('keydown', (e) => { if (e.key === 'Enter') { e.preventDefault(); doCheck(false); } });
+      const wrap = document.createElement('div'); wrap.className = 'dlg-regex';
+      wrap.append(input, list); r.playfield.appendChild(wrap); preview(); input.focus();
+      return {
+        collect: () => ({ pattern: input.value }),
+        lock: () => { input.disabled = true; },
+        mark: (data) => { if (data.solution) { const s = document.createElement('p'); s.className = 'dlg-mini reveal'; s.textContent = 'Lösung: ' + data.solution; wrap.appendChild(s); } }
+      };
+    }
+  };
+
+  // ---------- Ablauf ----------
+  function renderTask() {
+    const task = session.tasks[index];
+    cur = { task, attempts: 0, solved: false, revealed: false };
+    r.kind.textContent = `Aufgabe ${index + 1}`;
+    r.mech.textContent = MECH_LABEL[task.type] || task.type;
+    r.points.textContent = String(task.points || 100);
+    r.prompt.textContent = task.prompt || '';
+    r.narrative.textContent = task.narrative || '';
+    r.narrative.hidden = !task.narrative;
+    r.instruction.textContent = task.instruction || '';
+    r.instruction.hidden = !task.instruction;
+    r.feedback.textContent = ''; r.feedback.className = 'dlg-feedback';
+    r.success.hidden = true; r.success.textContent = '';
+    r.check.hidden = false; r.hint.hidden = !task.hint; r.reveal.hidden = true; r.next.hidden = true;
+    r.playfield.innerHTML = '';
+    const renderer = RENDERERS[task.type];
+    cur.ctrl = renderer ? renderer(task) : { collect: () => ({}), lock: () => {}, mark: () => {} };
+    updateHud();
+  }
+
+  async function doCheck(reveal) {
+    if (!running || !cur || cur.solved) return;
+    if (!reveal) cur.attempts++;
+    const submission = cur.ctrl.collect();
+    let data;
+    try {
+      const res = await fetch('/api/devlab/check', {
+        method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ taskId: cur.task.taskId, reveal, submission })
+      });
+      data = await res.json();
+    } catch (err) { r.feedback.textContent = 'Prüfung fehlgeschlagen.'; r.feedback.className = 'dlg-feedback wrong'; return; }
+
+    cur.lastSubmission = submission;
+    cur.ctrl.mark(data);
+
+    if (data.correct) {
+      cur.solved = true;
+      score += awarded(cur.task.points || 100, cur.attempts);
+      cur.ctrl.lock();
+      r.feedback.textContent = 'Richtig. Sitzt!'; r.feedback.className = 'dlg-feedback correct';
+      finishMissionUi(data, false);
+    } else if (reveal) {
+      cur.revealed = true;
+      cur.ctrl.lock();
+      r.feedback.textContent = 'Aufgelöst – schau dir die Lösung an, dann weiter.'; r.feedback.className = 'dlg-feedback revealed';
+      finishMissionUi(data, true);
+    } else {
+      const hint = cur.task.hint ? ` Hinweis: ${cur.task.hint}` : '';
+      r.feedback.textContent = (data.error || 'Noch nicht ganz.') + hint; r.feedback.className = 'dlg-feedback wrong';
+      if (cur.attempts >= MAX_ATTEMPTS) r.reveal.hidden = false;
+    }
+    updateHud();
+  }
+
+  function finishMissionUi(data, revealed) {
+    r.check.hidden = true; r.hint.hidden = true; r.reveal.hidden = true; r.next.hidden = false;
+    if (data.successText) { r.success.textContent = data.successText; r.success.hidden = false; }
+    r.next.focus();
+  }
+
+  function showHint() {
+    if (!cur || !cur.task.hint) return;
+    r.feedback.textContent = `Hinweis: ${cur.task.hint}`; r.feedback.className = 'dlg-feedback revealed';
+    score = Math.max(0, score - 10); updateHud();
+  }
+
+  function nextTask() {
+    finishItems.push({ taskId: cur.task.taskId, submission: cur.lastSubmission || cur.ctrl.collect(), attempts: cur.attempts || 1, revealed: cur.revealed });
+    index++;
+    if (index >= session.tasks.length) finish();
+    else renderTask();
+  }
+
+  async function finish() {
+    running = false; stopTimer();
+    try {
+      const res = await fetch('/api/devlab/finish', {
+        method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ slug, durationSeconds: seconds, items: finishItems })
+      });
+      const data = await res.json();
+      score = data.score; updateHud();
+      r.resultStars.textContent = starString(data.stars);
+      r.resultScore.textContent = String(data.score);
+      r.resultMax.textContent = String(data.maxScore);
+      r.resultDetail.textContent = `${data.solvedTasks} von ${data.totalTasks} auf Anhieb · ${formatTime(seconds)}`;
+      r.resultHigh.hidden = !data.newHighscore;
+      r.best.textContent = String(data.highscore);
+      r.result.hidden = false;
+    } catch (err) { console.error('Abschluss fehlgeschlagen', err); }
+  }
+
+  async function loadStats() {
+    try {
+      const res = await fetch(`/api/games/${GAME}/stats`);
+      if (!res.ok) return;
+      const s = await res.json();
+      r.best.textContent = s.highscore > 0 ? String(s.highscore) : '–';
+      r.bestLine.textContent = s.highscore > 0 ? `Dev-Lab-Bestwert: ${s.highscore} Punkte` : 'Noch kein Dev-Lab-Bestwert.';
+    } catch (err) { /* egal */ }
+  }
+
+  function start() {
+    index = 0; score = 0; seconds = 0; finishItems = []; r.time.textContent = '0:00'; r.result.hidden = true;
+    running = true; renderTask(); startTimer();
+  }
+
+  async function init() {
+    try {
+      const res = await fetch(`/api/devlab/games/${encodeURIComponent(slug)}/session`);
+      session = await res.json();
+    } catch (err) { session = null; }
+    if (!session || !session.found || !session.tasks || !session.tasks.length) {
+      r.title.textContent = 'Spiel nicht gefunden';
+      r.prompt.textContent = 'Für diese Disziplin gibt es noch keine Aufgaben.';
+      r.check.hidden = true; r.hint.hidden = true;
+      return;
+    }
+    document.title = `${session.title} – Mindflux`;
+    r.title.textContent = session.title;
+    r.language.textContent = session.language || 'Dev Lab';
+    r.sideTitle.textContent = session.title;
+    r.description.textContent = session.description || '';
+    loadStats();
+    start();
+  }
+
+  r.check.addEventListener('click', () => doCheck(false));
+  r.hint.addEventListener('click', showHint);
+  r.reveal.addEventListener('click', () => doCheck(true));
+  r.next.addEventListener('click', nextTask);
+  r.again.addEventListener('click', start);
+  init();
+})();
@@ -47,6 +47,7 @@
        <a th:href="@{/admin/mindmatch}" class="admin-card">🧩 MindMatch-Decks verwalten</a>
        <a th:href="@{/admin/techtacular}" class="admin-card">🎯 TechTacular-Fragen verwalten</a>
        <a th:href="@{/admin/syntaxsaga}" class="admin-card">📜 Syntax-Saga-Missionen verwalten</a>
+        <a th:href="@{/admin/devlab}" class="admin-card">⚗️ Dev-Lab-Aufgaben verwalten</a>
      </div>
      <p style="margin-top:1.1rem; color:var(--muted);">
        Hier entsteht noch Großes... ✨ Bleib dran!
@@ -0,0 +1,108 @@
+<!DOCTYPE html>
+<html lang="de" data-theme="dark"
+      xmlns:th="http://www.thymeleaf.org"
+      xmlns:sec="https://www.thymeleaf.org/thymeleaf-extras-springsecurity6">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title th:text="${game.title} + ' – Dev Lab'">Dev-Lab-Spiel</title>
+  <link rel="stylesheet" href="/css/theme.css">
+  <script src="/js/theme.js"></script>
+  <style>
+    .dlg { max-width: 1000px; margin: 0 auto; padding: 0 1rem; width: 100%; }
+    .dlg .grid2 { display: grid; grid-template-columns: 160px 1fr; gap: 0.7rem; }
+    .dlg .field { margin-bottom: 0.7rem; display: flex; flex-direction: column; gap: 0.35rem; }
+    .dlg .field > label { color: var(--accent); font-weight: 700; font-size: 0.85rem; }
+    .dlg textarea.mf-input { font-family: "JetBrains Mono", monospace; resize: vertical; min-height: 8rem; font-size: 0.82rem; }
+    .dlg .task { background: var(--surface); border: 1px solid var(--border); border-left: 4px solid var(--secondary); border-radius: 12px; padding: 0.9rem 1.1rem; margin-bottom: 0.7rem; box-shadow: var(--g-soft); }
+    .dlg .task-head { display: flex; align-items: center; gap: 0.6rem; justify-content: space-between; flex-wrap: wrap; }
+    .dlg .ttype { background: var(--glow-w); color: var(--accent); font-weight: 800; border: 1px solid var(--border-accent); border-radius: 7px; padding: 0.14rem 0.55rem; font-size: 0.78rem; font-family: monospace; }
+    .dlg .tprompt { color: var(--heading); font-weight: 600; }
+    .dlg .hint { color: var(--muted); font-size: 0.82rem; margin-bottom: 0.8rem; line-height: 1.5; }
+    .dlg .hint code { color: var(--accent); }
+    .dlg .empty { color: var(--danger); }
+    .dlg details { margin-top: 0.5rem; }
+    .dlg summary { cursor: pointer; color: var(--accent); font-size: 0.85rem; }
+    @media (max-width: 600px) { .dlg .grid2 { grid-template-columns: 1fr; } }
+  </style>
+</head>
+<body>
+<div class="mf-theme-float"><button class="mf-theme"></button></div>
+<div class="mf-container" style="max-width:1040px">
+  <div class="mf-page-head">
+    <a th:href="@{/admin/devlab}" class="mf-back">⟵ Zurück zur Spieleliste</a>
+  </div>
+  <header style="margin-bottom:1.4rem">
+    <div class="mf-eyebrow">Dev Lab · Spiel</div>
+    <h1 style="color:var(--heading); font-size:1.75rem; font-weight:800; margin-top:.35rem" th:text="'⚗️ ' + ${game.title}">Spiel</h1>
+    <p style="color:var(--muted); margin-top:.3rem">
+      <span th:text="'/' + ${game.slug}">/slug</span> ·
+      <span th:text="${game.path}">syntax</span> ·
+      <span th:text="${game.language}">SQL</span>
+    </p>
+  </header>
+
+  <main class="dlg">
+    <h4 style="color:var(--accent); margin:0 0 0.7rem; text-transform:uppercase; letter-spacing:.08em; font-size:.8rem">Aufgaben</h4>
+
+    <div class="task" th:each="t : ${game.tasks}">
+      <div class="task-head">
+        <span><span class="ttype" th:text="${t.type}">cloze</span> <span class="tprompt" th:text="${t.prompt}">Titel</span></span>
+        <form th:action="@{'/admin/devlab/tasks/' + ${t.id} + '/delete'}" method="post" onsubmit="return confirm('Aufgabe löschen?');">
+          <input type="hidden" name="gameId" th:value="${game.id}">
+          <button type="submit" class="mf-btn danger">✕ Löschen</button>
+        </form>
+      </div>
+      <details>
+        <summary>Bearbeiten (JSON-Payload)</summary>
+        <form th:action="@{'/admin/devlab/tasks/' + ${t.id} + '/update'}" method="post" style="margin-top:.6rem">
+          <input type="hidden" name="gameId" th:value="${game.id}">
+          <div class="grid2">
+            <div class="field"><label>Punkte</label><input class="mf-input" type="number" name="points" th:value="${t.points}" min="10" max="1000"></div>
+            <div class="field"><label>Titel</label><input class="mf-input" type="text" name="prompt" th:value="${t.prompt}" required></div>
+          </div>
+          <div class="field"><label>Payload (JSON)</label><textarea class="mf-input" name="payload" th:text="${t.payload}" required></textarea></div>
+          <button type="submit" class="mf-btn">💾 Speichern</button>
+        </form>
+      </details>
+    </div>
+    <p th:if="${game.tasks.isEmpty()}" class="empty">Noch keine Aufgaben – unten hinzufügen. Ohne Aufgaben erscheint das Spiel nicht.</p>
+
+    <div class="mf-panel accent" style="margin-top:1.6rem">
+      <h4>Aufgabe hinzufügen</h4>
+      <p class="hint">Typ wählen und den passenden <strong>JSON-Payload</strong> eintragen. Pflichtfelder je Typ:
+        <code>cloze</code>: codeTemplate (<code>{{1}}</code>…), gaps[{position, placeholder, hint, caseSensitive, solutions[]}] ·
+        <code>choice</code>: question, options[], correctIndex ·
+        <code>order</code>: instruction, items[] (richtige Reihenfolge) ·
+        <code>spot</code>: tokens[], bugIndex, fix ·
+        <code>match</code>: instruction, pairs[[l,r]…] ·
+        <code>regex</code>: instruction, samples[{text, shouldMatch}], pattern.
+        Optional überall: narrative, hint, successText. Platzhalter nie die Lösung!</p>
+      <form th:action="@{'/admin/devlab/games/' + ${game.id} + '/tasks'}" method="post">
+        <div class="grid2">
+          <div class="field"><label>Typ</label>
+            <select class="mf-select" name="type">
+              <option value="cloze">cloze – Lücke tippen</option>
+              <option value="choice">choice – Multiple Choice</option>
+              <option value="order">order – Zusammensetzen</option>
+              <option value="spot">spot – Bug finden</option>
+              <option value="match">match – Zuordnen</option>
+              <option value="regex">regex – Muster schreiben</option>
+            </select>
+          </div>
+          <div class="field"><label>Titel</label><input class="mf-input" type="text" name="prompt" placeholder="kurzer Aufgabentitel" required></div>
+        </div>
+        <div class="field" style="max-width:160px"><label>Punkte</label><input class="mf-input" type="number" name="points" value="100" min="10" max="1000"></div>
+        <div class="field"><label>Payload (JSON)</label><textarea class="mf-input" name="payload" placeholder='{ "question": "...", "options": ["A","B"], "correctIndex": 0, "hint": "...", "successText": "..." }' required></textarea></div>
+        <button type="submit" class="mf-btn">➕ Aufgabe speichern</button>
+      </form>
+    </div>
+  </main>
+</div>
+<footer class="mf-footer">
+  <a href="#">Support</a><a href="#">Feedback</a>
+  <a href="/nutzungsbedingungen">Nutzungsbedingungen</a><a href="/richtlinien">Richtlinien</a>
+  <a href="/datenschutz">Datenschutz</a><a href="/impressum">Impressum</a>
+</footer>
+</body>
+</html>
@@ -0,0 +1,96 @@
+<!DOCTYPE html>
+<html lang="de" data-theme="dark"
+      xmlns:th="http://www.thymeleaf.org"
+      xmlns:sec="https://www.thymeleaf.org/thymeleaf-extras-springsecurity6">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Dev-Lab-Verwaltung – Admin</title>
+  <link rel="stylesheet" href="/css/theme.css">
+  <script src="/js/theme.js"></script>
+  <style>
+    .dla { max-width: 1000px; margin: 0 auto; padding: 0 1rem; width: 100%; }
+    .dla .new-game { margin-bottom: 1.6rem; }
+    .dla .grid2 { display: grid; grid-template-columns: 1fr 1fr; gap: 0.7rem; }
+    .dla .game {
+      display: flex; align-items: center; flex-wrap: wrap; gap: 0.6rem; justify-content: space-between;
+      background: var(--surface); border: 1px solid var(--border); border-left: 4px solid var(--accent);
+      border-radius: 12px; padding: 0.9rem 1.1rem; margin-bottom: 0.7rem; box-shadow: var(--g-soft);
+    }
+    .dla .game.inactive { border-left-color: var(--danger); opacity: 0.7; }
+    .dla .game h2 { color: var(--heading); margin: 0; font-size: 1.05rem; }
+    .dla .slug { color: var(--accent); font-size: 0.78rem; font-family: monospace; }
+    .dla .badge { font-size: 0.66rem; text-transform: uppercase; padding: 0.14rem 0.45rem; border-radius: 7px; border: 1px solid var(--border-accent); color: var(--secondary); border-color: var(--secondary); }
+    .dla .badge.on { background: var(--glow-w); color: var(--accent); border-color: var(--border-accent); }
+    .dla .badge.off { background: rgba(255,95,107,.12); color: var(--danger); border-color: var(--danger); }
+    .dla .count { color: var(--muted); font-size: 0.85rem; }
+    .dla .actions { display: flex; gap: 0.45rem; flex-wrap: wrap; align-items: center; }
+    .dla .field { margin-bottom: 0.7rem; display: flex; flex-direction: column; gap: 0.35rem; }
+    .dla .field > label { color: var(--accent); font-weight: 700; font-size: 0.85rem; }
+    .dla .empty { color: var(--muted); }
+    @media (max-width: 600px) { .dla .grid2 { grid-template-columns: 1fr; } }
+  </style>
+</head>
+<body>
+<div class="mf-theme-float"><button class="mf-theme"></button></div>
+<div class="mf-container" style="max-width:1040px">
+  <div class="mf-page-head">
+    <a th:href="@{/admin}" class="mf-back">⟵ Zurück zum Admin-Dashboard</a>
+  </div>
+  <header style="margin-bottom:1.4rem">
+    <div class="mf-eyebrow">Dev Lab</div>
+    <h1 style="color:var(--heading); font-size:1.75rem; font-weight:800; margin-top:.35rem">⚗️ Dev-Lab-Verwaltung</h1>
+  </header>
+
+  <main class="dla">
+    <div class="mf-panel accent new-game">
+      <h4>Neues Spiel anlegen</h4>
+      <form th:action="@{/admin/devlab/games}" method="post">
+        <div class="grid2">
+          <div class="field"><label>Titel</label><input class="mf-input" type="text" name="title" placeholder="z. B. SQL Detective" required></div>
+          <div class="field"><label>Sprache/Domäne</label><input class="mf-input" type="text" name="language" placeholder="SQL / CSS / Git …"></div>
+        </div>
+        <div class="grid2">
+          <div class="field"><label>Pfad</label>
+            <select class="mf-select" name="path">
+              <option value="syntax">Syntax &amp; Grundlagen</option>
+              <option value="debugging">Debugging &amp; Problemlösung</option>
+              <option value="visual">Praxis &amp; Visualisierung</option>
+            </select>
+          </div>
+          <div class="field"><label>Beschreibung</label><input class="mf-input" type="text" name="description" placeholder="kurze Beschreibung"></div>
+        </div>
+        <button type="submit" class="mf-btn">➕ Spiel anlegen &amp; Aufgaben hinzufügen</button>
+      </form>
+    </div>
+
+    <div class="game" th:each="g : ${games}" th:classappend="${g.active} ? '' : 'inactive'">
+      <div>
+        <h2 th:text="${g.title}">Spiel</h2>
+        <span class="slug" th:text="'/' + ${g.slug}">/slug</span>
+        <span class="badge" th:text="${g.path}">syntax</span>
+        <span class="badge" th:if="${g.language}" th:text="${g.language}">SQL</span>
+        <span class="badge on"  th:if="${g.active}">aktiv</span>
+        <span class="badge off" th:unless="${g.active}">inaktiv</span>
+        <span class="count" th:text="'· ' + ${g.taskCount} + ' Aufgaben'">· 0 Aufgaben</span>
+      </div>
+      <div class="actions">
+        <a class="mf-btn" th:href="@{'/admin/devlab/games/' + ${g.id}}">Aufgaben verwalten</a>
+        <form th:action="@{'/admin/devlab/games/' + ${g.id} + '/toggle'}" method="post">
+          <button type="submit" class="mf-btn outline" th:text="${g.active} ? 'Deaktivieren' : 'Aktivieren'">Toggle</button>
+        </form>
+        <form th:action="@{'/admin/devlab/games/' + ${g.id} + '/delete'}" method="post" onsubmit="return confirm('Spiel inkl. aller Aufgaben löschen?');">
+          <button type="submit" class="mf-btn danger">Löschen</button>
+        </form>
+      </div>
+    </div>
+    <p th:if="${games.isEmpty()}" class="empty">Noch keine Spiele. Lege oben das erste an.</p>
+  </main>
+</div>
+<footer class="mf-footer">
+  <a href="#">Support</a><a href="#">Feedback</a>
+  <a href="/nutzungsbedingungen">Nutzungsbedingungen</a><a href="/richtlinien">Richtlinien</a>
+  <a href="/datenschutz">Datenschutz</a><a href="/impressum">Impressum</a>
+</footer>
+</body>
+</html>
@@ -176,6 +176,7 @@
    brain:'<path d="M28 8c-9-5-22 0-23 11-7 2-9 12-3 18-3 7 2 15 10 16 3 6 13 7 18 2M28 8c9-5 22 0 23 11 7 2 9 12 3 18 3 7-2 15-10 16-3 6-13 7-18 2M28 8v45M16 22c6 2 6 10 0 13M40 22c-6 2-6 10 0 13M12 40c7 0 10 5 10 11M44 40c-7 0-10 5-10 11"/>',
    code:'<path d="M22 16L8 28l14 12M42 16l14 12-14 12"/>',
    terminal:'<rect x="6" y="10" width="52" height="44" rx="4"/><path d="M16 26l9 6-9 6M32 40h14"/>',
+    lab:'<path d="M26 8h12"/><path d="M30 8v18L16 48c-2.3 3.7.4 8.5 4.8 8.5h22.4c4.4 0 7.1-4.8 4.8-8.5L34 26V8"/><path d="M23 43h18"/><path d="M25 49h14"/><path d="M25 32l-4 4 4 4"/><path d="M39 32l4 4-4 4"/><path d="M30 42l4-12"/>',
    lock:'<rect x="12" y="28" width="40" height="28" rx="5"/><path d="M20 28v-7a12 12 0 0 1 24 0v7M32 39v6"/>',
    sword:'<path d="M48 8l4 4-22 22-4-4zM26 30l8 8M30 26l8 8M22 38l-6 6 6 6 6-6M16 44l-6 6"/>',
    bug:'<rect x="20" y="20" width="24" height="30" rx="12"/><path d="M32 20v-6M24 12l4 6M40 12l-4 6M20 30h-8M52 30h-8M20 40H10M54 40H44M20 50l-7 7M44 50l7 7"/>',
@@ -185,6 +186,7 @@
  const GAMES = [
    ['MindMatch','brain','Trainiere dein Gedächtnis mit IT-Begriffen in einem klassischen Memory-Spiel.','/mindmatch'],
    ['TechTacular','code','Das IT-Quizduell im Jeopardy-Stil – teste dein Wissen in verschiedenen Kategorien.','/techtacular'],
+    ['Dev Lab','lab','Das Entwicklerlabor bündelt Java, SQL, CSS, PHP, HTML, Git, REST und Regex.','/devlab'],
    ['Syntax Saga','terminal','Interaktive IT-Geschichten mit Lückentexten – wie ein Textadventure zum Mitdenken.','/syntaxsaga'],
    ['Code Escape Room','lock','Entkomme mit IT-Rätseln aus digitalen Räumen – sei schnell und clever.','/comingsoon'],
    ['Service Clash','sword','Der chaotische Admin-Alltag als Spiel – meistere Anfragen & halte Systeme am Laufen!','/comingsoon'],
@@ -0,0 +1,85 @@
+<!DOCTYPE html>
+<html lang="de" data-theme="dark" xmlns:th="http://www.thymeleaf.org">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Dev Lab Spiel – Mindflux</title>
+  <link rel="stylesheet" href="/css/theme.css">
+  <script src="/js/theme.js"></script>
+  <link rel="stylesheet" href="/css/devlabgame.css?v=3">
+</head>
+<body class="dlg-body" th:attr="data-game=${gameSlug}">
+  <div class="dlg-shell">
+    <header class="dlg-header">
+      <a href="/devlab" class="dlg-back">⟵ Dev Lab</a>
+      <div class="dlg-head-title">
+        <p id="dlg-language" class="mf-eyebrow">Dev Lab</p>
+        <h1 id="dlg-title">Spiel wird geladen…</h1>
+      </div>
+      <div class="dlg-header-tools">
+        <button type="button" class="mf-theme"></button>
+        <a href="/logout" class="dlg-logout">Logout</a>
+      </div>
+    </header>
+
+    <div class="dlg-bar">
+      <div class="dlg-bar-group">
+        <span class="dlg-stat">Aufgabe <b id="dlg-task-no">– / –</b></span>
+        <span class="dlg-stat">Punkte <b id="dlg-score">0</b></span>
+        <span class="dlg-stat">Zeit <b id="dlg-time">0:00</b></span>
+        <span class="dlg-stat">Bestwert <b id="dlg-best">–</b></span>
+      </div>
+      <div class="dlg-bar-group">
+        <span id="dlg-mech" class="mf-badge">–</span>
+      </div>
+    </div>
+
+    <main class="dlg-stage">
+      <section class="dlg-card">
+        <div class="dlg-card-head">
+          <span id="dlg-kind" class="mf-badge">Aufgabe</span>
+          <span id="dlg-points" class="dlg-points">100</span>
+        </div>
+        <h2 id="dlg-prompt"></h2>
+        <p id="dlg-narrative" class="dlg-narrative"></p>
+        <p id="dlg-instruction" class="dlg-instruction"></p>
+        <div id="dlg-playfield" class="dlg-playfield"></div>
+        <p id="dlg-feedback" class="dlg-feedback" aria-live="polite"></p>
+        <p id="dlg-success" class="dlg-success" hidden></p>
+        <div class="dlg-actions">
+          <button id="dlg-check" class="mf-btn" type="button">Prüfen</button>
+          <button id="dlg-hint" class="mf-btn ghost" type="button">Hinweis</button>
+          <button id="dlg-reveal" class="mf-btn outline" type="button" hidden>Auflösung</button>
+          <button id="dlg-next" class="mf-btn" type="button" hidden>Weiter</button>
+        </div>
+      </section>
+
+      <aside class="dlg-side mf-panel accent">
+        <h2 id="dlg-side-title">Mission Log</h2>
+        <p id="dlg-description" class="dlg-description"></p>
+        <div class="dlg-progress">
+          <span>Fortschritt</span>
+          <div class="mf-bar"><i id="dlg-progress" style="width:0"></i></div>
+        </div>
+        <p id="dlg-best-line" class="dlg-best"></p>
+      </aside>
+    </main>
+  </div>
+
+  <div id="dlg-result" class="dlg-overlay" hidden>
+    <div class="dlg-result-card">
+      <h2>Disziplin abgeschlossen 🎉</h2>
+      <p id="dlg-result-stars" class="dlg-result-stars">★★★</p>
+      <p class="dlg-result-score">Score: <strong id="dlg-result-score">0</strong> / <span id="dlg-result-max">0</span></p>
+      <p id="dlg-result-detail" class="dlg-result-detail"></p>
+      <p id="dlg-result-high" class="dlg-result-high" hidden>🏆 Neuer Bestwert!</p>
+      <div class="dlg-result-actions">
+        <button id="dlg-again" class="mf-btn" type="button">Nochmal</button>
+        <a href="/devlab" class="mf-btn outline">Zur Spielsammlung</a>
+      </div>
+    </div>
+  </div>
+
+  <script src="/js/devlabgame.js?v=3" defer></script>
+</body>
+</html>
@@ -0,0 +1,122 @@
+<!DOCTYPE html>
+<html lang="de" data-theme="dark" xmlns:th="http://www.thymeleaf.org">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Dev Lab - Mindflux</title>
+  <link rel="stylesheet" href="/css/theme.css">
+  <script src="/js/theme.js"></script>
+  <link rel="stylesheet" href="/css/devlab.css?v=2">
+</head>
+<body class="dl-body">
+  <div class="mf-shell no-right dl-shell">
+    <aside class="mf-sidebar">
+      <a th:href="@{/dashboard}" class="mf-logo">
+        <span class="mark"></span>
+        <span class="txt"><b>MINDFLUX</b><span>KNOWLEDGE. CODE. WIN.</span></span>
+      </a>
+
+      <nav class="mf-nav">
+        <a th:href="@{/dashboard}">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="3" width="7" height="7" rx="1.5"/><rect x="14" y="3" width="7" height="7" rx="1.5"/><rect x="3" y="14" width="7" height="7" rx="1.5"/><rect x="14" y="14" width="7" height="7" rx="1.5"/></svg>
+          Dashboard
+        </a>
+        <a th:href="@{/devlab}" class="active">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M9 2h6"/><path d="M10 2v6l-5 9a3 3 0 0 0 2.6 4.5h8.8A3 3 0 0 0 19 17l-5-9V2"/><path d="M8 15h8"/><path d="M9 18h6"/></svg>
+          Dev Lab
+        </a>
+        <a th:href="@{/progress}">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M4 20V10M10 20V4M16 20v-8M22 20H2"/></svg>
+          Statistiken
+        </a>
+      </nav>
+
+      <div class="dl-lab-status mf-panel accent">
+        <h4>Laborstatus</h4>
+        <div class="mf-bar"><i style="width:42%"></i></div>
+        <p>3 Trainingspfade · 12 Spiele · Konzept umgesetzt</p>
+      </div>
+    </aside>
+
+    <header class="mf-topbar dl-topbar">
+      <div class="mf-hello">
+        <p class="mf-eyebrow">Entwicklerlabor</p>
+        <h1>Dev Lab</h1>
+        <p>Ein zentraler Hub für die Spiele aus Syntax, Debugging und visueller Praxis.</p>
+      </div>
+      <div class="mf-tools">
+        <button type="button" class="mf-theme"></button>
+        <a class="mf-iconbtn" href="/logout" aria-label="Logout" style="color:var(--danger)"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4M16 17l5-5-5-5M21 12H9"/></svg></a>
+      </div>
+    </header>
+
+    <main class="mf-main dl-main">
+      <section class="dl-hero mf-panel accent">
+        <div>
+          <p class="mf-eyebrow">Dev-Lab-Ausbildungszentrum</p>
+          <h2>Wähle einen Trainingspfad und starte ein Spiel.</h2>
+          <p>Die Spiele sind nach Fähigkeit gruppiert: Syntax &amp; Grundlagen, Debugging &amp; Problemlösung sowie Praxis &amp; Visualisierung.</p>
+        </div>
+        <div class="dl-tube" aria-hidden="true">
+          <svg viewBox="0 0 96 128" fill="none" stroke="currentColor" stroke-width="3" stroke-linecap="round" stroke-linejoin="round">
+            <path d="M36 8h24"/>
+            <path d="M42 8v36L19 91c-6 12 3 27 17 27h24c14 0 23-15 17-27L54 44V8"/>
+            <path d="M31 87h34"/>
+            <path d="M35 100h26"/>
+            <path d="M34 69l-8 7 8 7"/>
+            <path d="M62 69l8 7-8 7"/>
+            <path d="M44 92l8-30"/>
+          </svg>
+          <span>{}</span><span>&lt;/&gt;</span><span>[]</span><span>0101</span>
+        </div>
+      </section>
+
+      <section class="dl-workbench">
+        <div class="dl-stations mf-panel">
+          <div class="dl-panel-head">
+            <h2>Trainingspfade</h2>
+            <span class="mf-badge">3 Pfade</span>
+          </div>
+          <div id="dl-stations" class="dl-station-grid" aria-label="Trainingspfade"></div>
+        </div>
+
+        <aside class="dl-world mf-panel accent" aria-live="polite">
+          <div class="dl-world-head">
+            <span id="dl-world-icon" class="dl-world-icon">{}</span>
+            <div>
+              <p id="dl-world-type" class="mf-eyebrow">Grundlagenpfad</p>
+              <h2 id="dl-world-title">Syntax &amp; Grundlagen</h2>
+            </div>
+          </div>
+          <p id="dl-world-copy" class="dl-world-copy"></p>
+
+          <div class="dl-progression">
+            <div><span>Level</span><b id="dl-levels">0</b></div>
+            <div><span>XP</span><b id="dl-xp">0</b></div>
+            <div><span>Badge</span><b id="dl-badge">-</b></div>
+          </div>
+
+          <div class="dl-mechanics" id="dl-mechanics"></div>
+
+          <div class="dl-panel-head dl-games-head">
+            <h3>Spiele</h3>
+            <span id="dl-game-count" class="mf-badge">0 Spiele</span>
+          </div>
+          <div id="dl-games" class="dl-game-list"></div>
+        </aside>
+      </section>
+    </main>
+  </div>
+
+  <footer class="mf-footer">
+    <a href="#">Support</a>
+    <a href="#">Feedback</a>
+    <a href="/nutzungsbedingungen">Nutzungsbedingungen</a>
+    <a href="/richtlinien">Richtlinien</a>
+    <a href="/datenschutz">Datenschutz</a>
+    <a href="/impressum">Impressum</a>
+  </footer>
+
+  <script src="/js/devlab.js?v=4" defer></script>
+</body>
+</html>
@@ -58,6 +58,7 @@
          </div>

          <div th:if="${param.registerError}" class="mf-alert err">Benutzername bereits vergeben.</div>
+          <div th:if="${param.passwordMismatch}" class="mf-alert err">Die Passwörter stimmen nicht überein. Bitte erneut eingeben.</div>

          <form th:action="@{/register}" method="post">
            <div class="mf-field">
@@ -72,6 +73,11 @@
              <label class="mf-label" for="reg-password">Passwort</label>
              <input id="reg-password" class="mf-input" type="password" name="password" placeholder="Passwort" required>
            </div>
+            <div class="mf-field">
+              <label class="mf-label" for="reg-password2">Passwort wiederholen</label>
+              <input id="reg-password2" class="mf-input" type="password" name="confirmPassword" placeholder="Passwort wiederholen" required>
+            </div>
+            <p id="reg-pw-msg" class="mf-alert err" style="display:none">Die Passwörter stimmen nicht überein.</p>
            <button class="neon-btn" type="submit"><span class="lock">🚀</span> Account erstellen</button>
          </form>

@@ -128,10 +134,30 @@
      el.addEventListener('click', function (e) { e.preventDefault(); c.classList.remove('active'); });
    });

-    // Bei Registrierungsfehler direkt das Signup-Panel öffnen
-    if (new URLSearchParams(window.location.search).has('registerError')) {
+    // Bei Registrierungs-/Passwortfehler direkt das Signup-Panel öffnen
+    var qp = new URLSearchParams(window.location.search);
+    if (qp.has('registerError') || qp.has('passwordMismatch')) {
      c.classList.add('active');
    }
+
+    // Client-seitiger Passwort-Abgleich (sofortiges Feedback; der Server prüft zusätzlich)
+    var pw = document.getElementById('reg-password');
+    var pw2 = document.getElementById('reg-password2');
+    var pwMsg = document.getElementById('reg-pw-msg');
+    var signupForm = pw2 ? pw2.closest('form') : null;
+    function pwCheck() {
+      var mismatch = pw2.value.length > 0 && pw.value !== pw2.value;
+      if (pwMsg) pwMsg.style.display = mismatch ? 'block' : 'none';
+      pw2.setCustomValidity(pw.value !== pw2.value ? 'Passwörter stimmen nicht überein' : '');
+      return !mismatch;
+    }
+    if (pw && pw2) {
+      pw.addEventListener('input', pwCheck);
+      pw2.addEventListener('input', pwCheck);
+      if (signupForm) signupForm.addEventListener('submit', function (e) {
+        if (pw.value !== pw2.value) { e.preventDefault(); pwCheck(); c.classList.add('active'); }
+      });
+    }
  })();
 </script>
Author	SHA1	Message	Date
AliceDarkest	b4fbc972f2	Merge: Login case-insensitiv + Passwort-Wiederholfeld mindflux-ci / build (push) Successful in 27s Details	2026-06-30 20:04:08 +02:00
AliceDarkest	21c594445f	Fix: Login case-insensitiv (Registrierung speichert lowercase, Login war case-sensitiv) + Passwort-Wiederholfeld Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-30 20:03:46 +02:00
AliceDarkest	035d603504	Merge: Fix Dev-Lab Debugging-Pfad-Icon mindflux-ci / build (push) Successful in 27s Details	2026-06-30 18:04:47 +02:00
AliceDarkest	adb5646b5e	Fix: Dev-Lab Debugging-Pfad-Icon (</>-Marker HTML-escapen) + Cache-Buster v4 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-30 18:03:55 +02:00
AliceDarkest	08e5e2b089	Merge: Dev Lab – Entwicklerlabor (6 Mechaniken, 189 Aufgaben) + STYLEGUIDE.md mindflux-ci / build (push) Successful in 26s Details	2026-06-30 16:32:45 +02:00
AliceDarkest	b88962da6f	Dev Lab: server-autoritatives Entwicklerlabor mit 6 Mechaniken + 189 Aufgaben Dev Lab bündelt mehrere Disziplinen (SQL, Java/Debugging, Git, HTML, CSS, Regex, PHP, REST) in 11 Spielen mit zusammen 189 Aufgaben. Im Gegensatz zur ersten, rein clientseitigen Skizze jetzt server-autoritativ, DB-gestützt und im Admin pflegbar – mit echter Mechanik-Vielfalt statt überall Lückentext: cloze (Lücke tippen), choice (Multiple Choice), order (Bausteine zusammensetzen), spot (Bug anklicken), match (Paare zuordnen), regex (Muster schreiben mit Live-Treffer-Vorschau). Prüfung und Score ausschließlich serverseitig – die Lösungen verlassen nie das Backend; Eingabe-Platzhalter sind neutrale Labels (Lösungs-Leak behoben). Fehler-Mechanik mit Versuchen + Hinweis + Auflösung, kein Game-Over; Score über die generische game_scores-Tabelle (Kennung devlab, deck=Spiel-Slug). - Entities DevLabGame/DevLabTask (JSON-payload) + Flyway V8__devlab.sql - DevLabService mit sechs Mechanik-Checkern; API /api/devlab/** (CSRF-ausgenommen, devlab in KNOWN_GAMES) - Admin /admin/devlab (Spiele + Aufgaben pflegen); polymorphe Frontend-Engine devlabgame.js + DB-getriebener Hub devlab.js - Inhalte aus devlab/content.json (idempotenter Seeder); ersetzt die erste clientseitige Dev-Lab-Skizze (devlab.js/devlabgame.js/-game.html/-game.css neu) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-30 16:32:03 +02:00
AliceDarkest	f2db7f286b	Merge: Syntax Saga – neues Spiel + 34 Seed-Missionen mindflux-ci / build (push) Successful in 27s Details	2026-06-30 12:14:27 +02:00
AliceDarkest	d255c7b4db	Merge pull request 'Mobile-Fixes: Spiele scrollbar + FinalFlux-Hub Overlap/Menue' (#6 ) from fix/mobile-games-finalflux into main mindflux-ci / build (push) Successful in 27s Details Reviewed-on: #6	2026-06-29 18:13:28 +00:00