diff --git a/src/lib/routes.ts b/src/lib/routes.ts
new file mode 100644
index 0000000..2836415
--- /dev/null
+++ b/src/lib/routes.ts
@@ -0,0 +1,1685 @@
+import {
+  Activity,
+  Archive,
+  Bell,
+  Bot,
+  BriefcaseBusiness,
+  CheckCircle2,
+  Code2,
+  Database,
+  FileCode2,
+  Files,
+  Gauge,
+  Globe2,
+  HardDrive,
+  LayoutDashboard,
+  LifeBuoy,
+  LockKeyhole,
+  Mail,
+  Network,
+  Package,
+  Palette,
+  PanelLeft,
+  ScrollText,
+  Server,
+  Settings,
+  Shield,
+  Terminal,
+  Users,
+  Workflow,
+} from "lucide-react";
+import type { LucideIcon } from "lucide-react";
+import type { Permission } from "@/lib/permissions";
+
+export type RouteItem = {
+  path: string;
+  label: string;
+  description: string;
+  category: string;
+  icon: LucideIcon;
+  permission: Permission;
+  keywords: string[];
+  primaryActions?: string[];
+  danger?: boolean;
+};
+
+export const routeItems: RouteItem[] = [
+  {
+    path: "/dashboard",
+    label: "Dashboard",
+    description: "Account details, usage, server status, and quick actions.",
+    category: "Home",
+    icon: LayoutDashboard,
+    permission: "dashboard:read",
+    keywords: ["home", "stats", "usage"],
+    primaryActions: ["Create website", "Open terminal", "Run backup"],
+  },
+  {
+    path: "/tools",
+    label: "Tools",
+    description: "Search and launch every hosting management tool.",
+    category: "Home",
+    icon: PanelLeft,
+    permission: "tools:read",
+    keywords: ["launcher", "favorites", "recent"],
+  },
+  {
+    path: "/websites",
+    label: "Websites",
+    description: "Manage websites, applications, runtimes, domains, deployments, and logs.",
+    category: "Websites",
+    icon: Globe2,
+    permission: "websites:manage",
+    keywords: ["apps", "runtime", "deployments", "ssl"],
+    primaryActions: ["Create website", "Clone website", "View logs"],
+  },
+  {
+    path: "/websites/new",
+    label: "Create Website",
+    description: "Ten-step website creation wizard using mock services.",
+    category: "Websites",
+    icon: Globe2,
+    permission: "websites:manage",
+    keywords: ["wizard", "new", "runtime"],
+  },
+  {
+    path: "/websites/alpha-site",
+    label: "Website Overview",
+    description: "Website health, domains, resources, deployments, and backups.",
+    category: "Websites",
+    icon: Globe2,
+    permission: "websites:manage",
+    keywords: ["overview", "health"],
+  },
+  {
+    path: "/websites/alpha-site/deployments",
+    label: "Deployment History",
+    description: "Git, manual, rollback, and staging deployment events.",
+    category: "Websites",
+    icon: Code2,
+    permission: "websites:manage",
+    keywords: ["deploy", "git", "rollback"],
+  },
+  {
+    path: "/websites/alpha-site/logs",
+    label: "Website Logs",
+    description: "Access logs, error logs, live filtering, and export.",
+    category: "Websites",
+    icon: ScrollText,
+    permission: "websites:manage",
+    keywords: ["access", "errors"],
+  },
+  {
+    path: "/websites/alpha-site/settings",
+    label: "Website Settings",
+    description: "Environment variables, resource limits, maintenance, SSL, and backups.",
+    category: "Websites",
+    icon: Settings,
+    permission: "websites:manage",
+    keywords: ["env", "limits", "maintenance"],
+  },
+  {
+    path: "/domains",
+    label: "Domains",
+    description: "Domains, aliases, redirects, transfer status, DNSSEC, and certificates.",
+    category: "Domains",
+    icon: Network,
+    permission: "domains:manage",
+    keywords: ["dns", "subdomains", "redirects"],
+    primaryActions: ["Add domain", "Import zone", "Check propagation"],
+  },
+  {
+    path: "/domains/new",
+    label: "Add Domain",
+    description: "Register a domain in the panel and validate ownership.",
+    category: "Domains",
+    icon: Network,
+    permission: "domains:manage",
+    keywords: ["new", "verification"],
+  },
+  {
+    path: "/domains/example.com",
+    label: "Domain Health",
+    description: "Propagation, certificate, DNSSEC, and routing status.",
+    category: "Domains",
+    icon: Network,
+    permission: "domains:manage",
+    keywords: ["health", "certificate"],
+  },
+  {
+    path: "/domains/example.com/dns",
+    label: "DNS Zone Editor",
+    description: "Add, edit, duplicate, delete, import, export, and validate DNS records.",
+    category: "Domains",
+    icon: Network,
+    permission: "domains:manage",
+    keywords: ["A", "AAAA", "CNAME", "MX", "TXT", "SRV", "CAA", "NS", "PTR"],
+    primaryActions: ["Add record", "Import zone", "Raw editor"],
+  },
+  {
+    path: "/domains/example.com/ssl",
+    label: "Domain SSL",
+    description: "Certificate status, Let's Encrypt, custom upload, and HTTPS policy.",
+    category: "Domains",
+    icon: Shield,
+    permission: "security:manage",
+    keywords: ["tls", "certificate", "hsts"],
+  },
+  {
+    path: "/domains/subdomains",
+    label: "Subdomains",
+    description: "Create subdomains, assign document roots, and review routing status.",
+    category: "Domains",
+    icon: Network,
+    permission: "domains:manage",
+    keywords: ["subdomain", "document root"],
+  },
+  {
+    path: "/domains/aliases",
+    label: "Aliases",
+    description: "Alias and parked domain management with certificate readiness checks.",
+    category: "Domains",
+    icon: Network,
+    permission: "domains:manage",
+    keywords: ["parked", "alias"],
+  },
+  {
+    path: "/domains/redirects",
+    label: "Redirects",
+    description: "Permanent, temporary, wildcard, and HTTPS redirect rules.",
+    category: "Domains",
+    icon: Network,
+    permission: "domains:manage",
+    keywords: ["301", "302", "wildcard"],
+  },
+  {
+    path: "/domains/dynamic-dns",
+    label: "Dynamic DNS",
+    description: "Dynamic DNS tokens, update URLs, host mappings, and recent changes.",
+    category: "Domains",
+    icon: Activity,
+    permission: "domains:manage",
+    keywords: ["ddns", "token"],
+  },
+  {
+    path: "/domains/transfers",
+    label: "Transfer Status",
+    description: "Domain transfer state, EPP checks, contacts, and registrar notes.",
+    category: "Domains",
+    icon: ScrollText,
+    permission: "domains:manage",
+    keywords: ["transfer", "registrar"],
+  },
+  {
+    path: "/domains/verification",
+    label: "Domain Verification",
+    description: "Ownership checks, TXT tokens, HTTP file checks, and validation history.",
+    category: "Domains",
+    icon: CheckCircle2,
+    permission: "domains:manage",
+    keywords: ["ownership", "txt"],
+  },
+  {
+    path: "/domains/dnssec",
+    label: "DNSSEC",
+    description: "DS records, signing status, key rollovers, and registry readiness.",
+    category: "Domains",
+    icon: Shield,
+    permission: "domains:manage",
+    keywords: ["ds", "signing"],
+  },
+  {
+    path: "/domains/nameservers",
+    label: "Nameservers",
+    description: "Authoritative nameservers, glue records, resolvers, and health checks.",
+    category: "Domains",
+    icon: Server,
+    permission: "domains:manage",
+    keywords: ["ns", "glue", "resolver"],
+  },
+  {
+    path: "/files",
+    label: "Files",
+    description:
+      "Premium file manager with tree, drag-and-drop, editor, preview, trash, and permissions.",
+    category: "Files",
+    icon: Files,
+    permission: "files:manage",
+    keywords: ["file manager", "upload", "monaco", "permissions"],
+    primaryActions: ["Upload", "Create file", "Create directory"],
+  },
+  {
+    path: "/files/ftp",
+    label: "FTP Accounts",
+    description: "FTP accounts, sessions, Web Disk, anonymous FTP, and access restrictions.",
+    category: "Files",
+    icon: Files,
+    permission: "files:manage",
+    keywords: ["ftp", "web disk"],
+  },
+  {
+    path: "/files/disk-usage",
+    label: "Disk Usage",
+    description: "Directory sizes, quota attribution, and storage analytics.",
+    category: "Files",
+    icon: HardDrive,
+    permission: "files:manage",
+    keywords: ["storage", "quota"],
+  },
+  {
+    path: "/files/git",
+    label: "Git Repositories",
+    description: "Repository browser, deployment hooks, branch status, and pull logs.",
+    category: "Files",
+    icon: Code2,
+    permission: "files:manage",
+    keywords: ["git", "version control"],
+  },
+  {
+    path: "/files/backups",
+    label: "Backup Browser",
+    description: "Browse backup snapshots and restore selected files.",
+    category: "Files",
+    icon: Archive,
+    permission: "backups:manage",
+    keywords: ["restore", "snapshot"],
+  },
+  {
+    path: "/files/privacy",
+    label: "Directory Privacy",
+    description: "Protect directories with credentials, realms, and access rules.",
+    category: "Files",
+    icon: LockKeyhole,
+    permission: "files:manage",
+    keywords: ["password", "directory"],
+  },
+  {
+    path: "/files/web-disk",
+    label: "Web Disk",
+    description: "WebDAV accounts, client configuration, locks, and connection status.",
+    category: "Files",
+    icon: HardDrive,
+    permission: "files:manage",
+    keywords: ["webdav", "disk"],
+  },
+  {
+    path: "/files/ftp-sessions",
+    label: "FTP Sessions",
+    description: "Active FTP sessions, source IPs, idle time, and disconnect controls.",
+    category: "Files",
+    icon: Activity,
+    permission: "files:manage",
+    keywords: ["ftp", "sessions"],
+  },
+  {
+    path: "/files/anonymous-ftp",
+    label: "Anonymous FTP",
+    description: "Anonymous FTP policy, upload permissions, banners, and access logs.",
+    category: "Files",
+    icon: Users,
+    permission: "files:manage",
+    keywords: ["anonymous", "ftp"],
+  },
+  {
+    path: "/files/images",
+    label: "Images",
+    description: "Image browser, thumbnails, conversions, scaling, and preview metadata.",
+    category: "Files",
+    icon: Files,
+    permission: "files:manage",
+    keywords: ["image", "thumbnail"],
+  },
+  {
+    path: "/files/checksums",
+    label: "Checksums",
+    description: "Generate and compare checksums for files, releases, and backups.",
+    category: "Files",
+    icon: FileCode2,
+    permission: "files:manage",
+    keywords: ["sha256", "integrity"],
+  },
+  {
+    path: "/databases",
+    label: "Databases",
+    description: "MySQL, MariaDB, PostgreSQL, users, permissions, analytics, and tools.",
+    category: "Databases",
+    icon: Database,
+    permission: "databases:manage",
+    keywords: ["mysql", "postgresql", "phpmyadmin"],
+    primaryActions: ["Create database", "Create user", "Test connection"],
+  },
+  {
+    path: "/databases/new",
+    label: "Database Wizard",
+    description: "Create a database, user, password, privileges, access, and backups.",
+    category: "Databases",
+    icon: Database,
+    permission: "databases:manage",
+    keywords: ["wizard", "privileges"],
+  },
+  {
+    path: "/databases/users",
+    label: "Database Users",
+    description: "Manage users, generated passwords, host access, and privilege matrices.",
+    category: "Databases",
+    icon: Users,
+    permission: "databases:manage",
+    keywords: ["permissions", "password"],
+  },
+  {
+    path: "/databases/remote",
+    label: "Remote Database Access",
+    description: "Allowed hosts, connection tests, TLS, and firewall readiness.",
+    category: "Databases",
+    icon: Network,
+    permission: "databases:manage",
+    keywords: ["remote", "access"],
+  },
+  {
+    path: "/databases/backups",
+    label: "Database Backups",
+    description: "Backup schedules, restore jobs, verification, and storage use.",
+    category: "Databases",
+    icon: Archive,
+    permission: "databases:manage",
+    keywords: ["backup", "restore"],
+  },
+  {
+    path: "/databases/mysql",
+    label: "MySQL Databases",
+    description: "MySQL schemas, users, sizes, grants, and connection metadata.",
+    category: "Databases",
+    icon: Database,
+    permission: "databases:manage",
+    keywords: ["mysql", "schemas"],
+  },
+  {
+    path: "/databases/postgresql",
+    label: "PostgreSQL Databases",
+    description: "PostgreSQL databases, roles, extensions, and connection limits.",
+    category: "Databases",
+    icon: Database,
+    permission: "databases:manage",
+    keywords: ["postgres", "roles"],
+  },
+  {
+    path: "/databases/phpmyadmin",
+    label: "phpMyAdmin",
+    description: "Launch the live phpMyAdmin deployment for MySQL and MariaDB administration.",
+    category: "Databases",
+    icon: Database,
+    permission: "databases:manage",
+    keywords: ["phpmyadmin", "mysql"],
+  },
+  {
+    path: "/databases/adminer",
+    label: "Adminer",
+    description: "Adminer launcher contract for compact SQL administration deployments.",
+    category: "Databases",
+    icon: Database,
+    permission: "databases:manage",
+    keywords: ["adminer", "sql"],
+  },
+  {
+    path: "/databases/pgadmin",
+    label: "pgAdmin",
+    description: "pgAdmin launcher contract for PostgreSQL databases and roles.",
+    category: "Databases",
+    icon: Database,
+    permission: "databases:manage",
+    keywords: ["pgadmin", "postgresql"],
+  },
+  {
+    path: "/databases/process-list",
+    label: "Database Process List",
+    description: "Active statements, wait states, locks, users, and mock kill actions.",
+    category: "Databases",
+    icon: Activity,
+    permission: "databases:manage",
+    keywords: ["process", "connections"],
+  },
+  {
+    path: "/databases/slow-queries",
+    label: "Slow Queries",
+    description: "Slow query samples, durations, affected tables, and tuning notes.",
+    category: "Databases",
+    icon: Gauge,
+    permission: "databases:manage",
+    keywords: ["slow", "performance"],
+  },
+  {
+    path: "/email",
+    label: "Email",
+    description: "Mailboxes, routing, authentication, filters, delivery tracking, and queue.",
+    category: "Email",
+    icon: Mail,
+    permission: "email:manage",
+    keywords: ["mail", "imap", "smtp", "spam"],
+    primaryActions: ["Create email", "Track delivery", "Open webmail"],
+  },
+  {
+    path: "/email/accounts",
+    label: "Email Accounts",
+    description: "Mailbox quotas, passwords, storage, sessions, and client configuration.",
+    category: "Email",
+    icon: Mail,
+    permission: "email:manage",
+    keywords: ["mailbox", "quota"],
+  },
+  {
+    path: "/email/forwarders",
+    label: "Forwarders",
+    description: "Mailbox and domain forwarders with loop detection.",
+    category: "Email",
+    icon: Mail,
+    permission: "email:manage",
+    keywords: ["forward"],
+  },
+  {
+    path: "/email/filters",
+    label: "Email Filters",
+    description: "Account and global filters, spam actions, and rule testing.",
+    category: "Email",
+    icon: Mail,
+    permission: "email:manage",
+    keywords: ["rules", "spam"],
+  },
+  {
+    path: "/email/routing",
+    label: "Email Routing",
+    description: "Local, remote, backup exchanger, and route diagnostics.",
+    category: "Email",
+    icon: Mail,
+    permission: "email:manage",
+    keywords: ["mx", "route"],
+  },
+  {
+    path: "/email/authentication",
+    label: "Email Authentication",
+    description: "DKIM, SPF, DMARC, TLS reporting, reputation, allow lists, and block lists.",
+    category: "Email",
+    icon: LockKeyhole,
+    permission: "email:manage",
+    keywords: ["dkim", "spf", "dmarc"],
+  },
+  {
+    path: "/email/delivery",
+    label: "Delivery Tracking",
+    description: "Delivery events, reputation, logs, and failed message analysis.",
+    category: "Email",
+    icon: Activity,
+    permission: "email:manage",
+    keywords: ["logs", "queue"],
+  },
+  {
+    path: "/email/queue",
+    label: "Mail Queue",
+    description: "Queued, deferred, frozen, and retried mail with mock actions.",
+    category: "Email",
+    icon: Mail,
+    permission: "email:manage",
+    keywords: ["queue", "retry"],
+  },
+  {
+    path: "/email/autoresponders",
+    label: "Autoresponders",
+    description: "Vacation replies, schedules, character sets, and response previews.",
+    category: "Email",
+    icon: Mail,
+    permission: "email:manage",
+    keywords: ["auto responder", "vacation"],
+  },
+  {
+    path: "/email/default-address",
+    label: "Default Address",
+    description: "Catch-all behavior, discard policy, forwarding, and bounce messages.",
+    category: "Email",
+    icon: Mail,
+    permission: "email:manage",
+    keywords: ["catch all", "default"],
+  },
+  {
+    path: "/email/mailing-lists",
+    label: "Mailing Lists",
+    description: "List membership, moderation, archives, and delivery policy.",
+    category: "Email",
+    icon: Users,
+    permission: "email:manage",
+    keywords: ["lists", "mailman"],
+  },
+  {
+    path: "/email/spam",
+    label: "Spam Filters",
+    description: "Spam thresholds, quarantine, auto-delete, bayes status, and tests.",
+    category: "Email",
+    icon: Shield,
+    permission: "email:manage",
+    keywords: ["spamassassin", "quarantine"],
+  },
+  {
+    path: "/email/encryption",
+    label: "Email Encryption",
+    description: "GPG keys, encryption status, key import, and trust metadata.",
+    category: "Email",
+    icon: LockKeyhole,
+    permission: "email:manage",
+    keywords: ["gpg", "keys"],
+  },
+  {
+    path: "/email/calendars",
+    label: "Calendars",
+    description: "CalDAV accounts, sharing, sync URLs, and device configuration.",
+    category: "Email",
+    icon: Activity,
+    permission: "email:manage",
+    keywords: ["caldav", "calendar"],
+  },
+  {
+    path: "/email/contacts",
+    label: "Contacts",
+    description: "CardDAV accounts, address books, sync URLs, and export tools.",
+    category: "Email",
+    icon: Users,
+    permission: "email:manage",
+    keywords: ["carddav", "address book"],
+  },
+  {
+    path: "/email/disk-usage",
+    label: "Email Disk Usage",
+    description: "Mailbox folders, quota pressure, cleanup suggestions, and retention.",
+    category: "Email",
+    icon: HardDrive,
+    permission: "email:manage",
+    keywords: ["storage", "quota"],
+  },
+  {
+    path: "/email/logs",
+    label: "Mail Logs",
+    description: "SMTP, IMAP, POP3, spam, delivery, and authentication log views.",
+    category: "Email",
+    icon: ScrollText,
+    permission: "email:manage",
+    keywords: ["logs", "smtp"],
+  },
+  {
+    path: "/email/webmail",
+    label: "Webmail",
+    description: "Mock webmail launcher with mailbox selection and SSO readiness.",
+    category: "Email",
+    icon: Mail,
+    permission: "email:manage",
+    keywords: ["roundcube", "webmail"],
+  },
+  {
+    path: "/metrics",
+    label: "Metrics",
+    description: "Visitors, traffic, resource usage, errors, logs, and SSL timelines.",
+    category: "Metrics",
+    icon: Gauge,
+    permission: "metrics:read",
+    keywords: ["analytics", "charts"],
+  },
+  {
+    path: "/metrics/traffic",
+    label: "Traffic Analytics",
+    description: "Bandwidth, raw access, top URLs, referrers, countries, agents, and IPs.",
+    category: "Metrics",
+    icon: Activity,
+    permission: "metrics:read",
+    keywords: ["bandwidth", "visitors"],
+  },
+  {
+    path: "/metrics/resources",
+    label: "Resource Usage",
+    description: "CPU, memory, disk, network, processes, and live update indicators.",
+    category: "Metrics",
+    icon: Gauge,
+    permission: "metrics:read",
+    keywords: ["cpu", "memory"],
+  },
+  {
+    path: "/metrics/errors",
+    label: "Error Analytics",
+    description: "HTTP status distribution, error logs, and affected URLs.",
+    category: "Metrics",
+    icon: Activity,
+    permission: "metrics:read",
+    keywords: ["404", "500"],
+  },
+  {
+    path: "/metrics/visitors",
+    label: "Visitors",
+    description: "AWStats-style and Webalizer-style visitor analytics.",
+    category: "Metrics",
+    icon: Gauge,
+    permission: "metrics:read",
+    keywords: ["awstats", "webalizer"],
+  },
+  {
+    path: "/metrics/access-logs",
+    label: "Access Logs",
+    description: "Raw and parsed access logs with filters, status codes, and downloads.",
+    category: "Metrics",
+    icon: ScrollText,
+    permission: "metrics:read",
+    keywords: ["access", "raw logs"],
+  },
+  {
+    path: "/metrics/bandwidth",
+    label: "Bandwidth",
+    description: "Hourly, daily, monthly, and domain-level bandwidth summaries.",
+    category: "Metrics",
+    icon: Activity,
+    permission: "metrics:read",
+    keywords: ["traffic", "transfer"],
+  },
+  {
+    path: "/metrics/awstats",
+    label: "AWStats",
+    description: "AWStats-style reports for visits, countries, referrers, and agents.",
+    category: "Metrics",
+    icon: Gauge,
+    permission: "metrics:read",
+    keywords: ["awstats", "reports"],
+  },
+  {
+    path: "/metrics/webalizer",
+    label: "Webalizer",
+    description: "Webalizer-style traffic summaries, hits, pages, visits, and sites.",
+    category: "Metrics",
+    icon: Gauge,
+    permission: "metrics:read",
+    keywords: ["webalizer", "traffic"],
+  },
+  {
+    path: "/metrics/top-urls",
+    label: "Top URLs",
+    description: "Most requested URLs, cache hit rate, status mix, and response sizes.",
+    category: "Metrics",
+    icon: Activity,
+    permission: "metrics:read",
+    keywords: ["urls", "requests"],
+  },
+  {
+    path: "/metrics/top-referrers",
+    label: "Top Referrers",
+    description: "Referrer domains, campaigns, search engines, and suspicious sources.",
+    category: "Metrics",
+    icon: Activity,
+    permission: "metrics:read",
+    keywords: ["referrer", "campaign"],
+  },
+  {
+    path: "/metrics/ssl-expiry",
+    label: "SSL Expiry Timeline",
+    description: "Certificate expiry dates, renewal state, issuer, and alert thresholds.",
+    category: "Metrics",
+    icon: Shield,
+    permission: "metrics:read",
+    keywords: ["ssl", "certificate"],
+  },
+  {
+    path: "/security",
+    label: "Security",
+    description:
+      "Security score, findings, attacks, failed logins, malware, firewall, and updates.",
+    category: "Security",
+    icon: Shield,
+    permission: "security:manage",
+    keywords: ["ssl", "firewall", "ssh", "malware"],
+    primaryActions: ["Run scan", "Issue certificate", "Add firewall rule"],
+  },
+  {
+    path: "/security/ssl",
+    label: "SSL/TLS",
+    description: "Certificates, CSRs, private keys, automatic HTTPS, redirects, and HSTS.",
+    category: "Security",
+    icon: Shield,
+    permission: "security:manage",
+    keywords: ["letsencrypt", "certificate"],
+  },
+  {
+    path: "/security/firewall",
+    label: "Firewall",
+    description: "IP blocker, port rules, brute-force protection, and attack history.",
+    category: "Security",
+    icon: Shield,
+    permission: "security:manage",
+    keywords: ["rules", "blocked"],
+  },
+  {
+    path: "/security/ssh",
+    label: "SSH Access",
+    description: "SSH keys, sessions, trusted devices, and login history.",
+    category: "Security",
+    icon: Terminal,
+    permission: "security:manage",
+    keywords: ["keys", "terminal"],
+  },
+  {
+    path: "/security/malware",
+    label: "Malware Scanner",
+    description: "Antivirus, malware scans, file integrity, and quarantine workflow.",
+    category: "Security",
+    icon: Shield,
+    permission: "security:manage",
+    keywords: ["scan", "antivirus"],
+  },
+  {
+    path: "/security/two-factor",
+    label: "Two-Factor Authentication",
+    description: "TOTP, recovery codes, passkeys, and policy enforcement.",
+    category: "Security",
+    icon: LockKeyhole,
+    permission: "security:manage",
+    keywords: ["2fa", "passkey"],
+  },
+  {
+    path: "/security/sessions",
+    label: "Sessions",
+    description: "Session management, devices, forced logout, and account locks.",
+    category: "Security",
+    icon: Users,
+    permission: "security:manage",
+    keywords: ["devices", "login"],
+  },
+  {
+    path: "/security/api-tokens",
+    label: "API Tokens",
+    description: "API tokens, scopes, last used metadata, and reveal-once secrets.",
+    category: "Security",
+    icon: Code2,
+    permission: "security:manage",
+    keywords: ["api", "token"],
+  },
+  {
+    path: "/security/certificates",
+    label: "Certificates",
+    description: "Installed certificates, chains, issuers, SANs, and renewal status.",
+    category: "Security",
+    icon: Shield,
+    permission: "security:manage",
+    keywords: ["certificate", "chain"],
+  },
+  {
+    path: "/security/csr",
+    label: "Certificate Signing Requests",
+    description: "CSR generation, subject details, SANs, and pending request history.",
+    category: "Security",
+    icon: FileCode2,
+    permission: "security:manage",
+    keywords: ["csr", "certificate"],
+  },
+  {
+    path: "/security/private-keys",
+    label: "Private Keys",
+    description: "Private key inventory, association status, and protected metadata.",
+    category: "Security",
+    icon: LockKeyhole,
+    permission: "security:manage",
+    keywords: ["keys", "private"],
+  },
+  {
+    path: "/security/hotlink-protection",
+    label: "Hotlink Protection",
+    description: "Allowed referrers, protected extensions, redirect targets, and tests.",
+    category: "Security",
+    icon: Shield,
+    permission: "security:manage",
+    keywords: ["hotlink", "referrer"],
+  },
+  {
+    path: "/security/leech-protection",
+    label: "Leech Protection",
+    description: "Directory abuse controls, login thresholds, redirects, and alerts.",
+    category: "Security",
+    icon: Shield,
+    permission: "security:manage",
+    keywords: ["leech", "abuse"],
+  },
+  {
+    path: "/security/directory-protection",
+    label: "Directory Protection",
+    description: "Protected paths, users, access prompts, and audit-ready changes.",
+    category: "Security",
+    icon: LockKeyhole,
+    permission: "security:manage",
+    keywords: ["directory", "password"],
+  },
+  {
+    path: "/security/modsecurity",
+    label: "Web Application Firewall",
+    description: "ModSecurity-style rules, exclusions, hit history, and rule testing.",
+    category: "Security",
+    icon: Shield,
+    permission: "security:manage",
+    keywords: ["modsecurity", "waf"],
+  },
+  {
+    path: "/security/login-history",
+    label: "Login History",
+    description: "Successful and failed logins, devices, source IPs, and geo summaries.",
+    category: "Security",
+    icon: ScrollText,
+    permission: "security:manage",
+    keywords: ["login", "history"],
+  },
+  {
+    path: "/security/trusted-devices",
+    label: "Trusted Devices",
+    description: "Trusted browsers, passkey readiness, risk state, and revocation.",
+    category: "Security",
+    icon: Users,
+    permission: "security:manage",
+    keywords: ["devices", "trust"],
+  },
+  {
+    path: "/software",
+    label: "Software",
+    description: "Runtimes, PHP, Node.js, Python, Ruby, Docker, cache, and packages.",
+    category: "Software",
+    icon: Package,
+    permission: "software:manage",
+    keywords: ["runtime", "php", "node", "docker"],
+  },
+  {
+    path: "/software/php",
+    label: "PHP Manager",
+    description: "PHP versions, extensions, INI editor, FPM pools, and per-domain settings.",
+    category: "Software",
+    icon: FileCode2,
+    permission: "software:manage",
+    keywords: ["php", "extensions"],
+  },
+  {
+    path: "/software/nodejs",
+    label: "Node.js Manager",
+    description: "Node.js versions, npm scripts, environment variables, and process manager.",
+    category: "Software",
+    icon: Code2,
+    permission: "software:manage",
+    keywords: ["node", "npm"],
+  },
+  {
+    path: "/software/python",
+    label: "Python Manager",
+    description: "Python versions, virtual environments, package state, and process manager.",
+    category: "Software",
+    icon: Code2,
+    permission: "software:manage",
+    keywords: ["python", "venv"],
+  },
+  {
+    path: "/software/docker",
+    label: "Docker Apps",
+    description: "Container applications, image status, ports, volumes, and environment.",
+    category: "Software",
+    icon: Package,
+    permission: "software:manage",
+    keywords: ["docker", "containers"],
+  },
+  {
+    path: "/software/cache",
+    label: "Cache Settings",
+    description: "Redis, OPcache, object cache, compression, and website optimization.",
+    category: "Software",
+    icon: HardDrive,
+    permission: "software:manage",
+    keywords: ["redis", "opcache"],
+  },
+  {
+    path: "/software/ruby",
+    label: "Ruby Manager",
+    description: "Ruby versions, gems, app roots, environment variables, and processes.",
+    category: "Software",
+    icon: Code2,
+    permission: "software:manage",
+    keywords: ["ruby", "gems"],
+  },
+  {
+    path: "/software/composer",
+    label: "Composer Manager",
+    description: "Composer packages, scripts, lockfile status, and update previews.",
+    category: "Software",
+    icon: Package,
+    permission: "software:manage",
+    keywords: ["composer", "php"],
+  },
+  {
+    path: "/software/npm",
+    label: "npm Scripts",
+    description: "Package scripts, dependency status, logs, and mock execution results.",
+    category: "Software",
+    icon: Package,
+    permission: "software:manage",
+    keywords: ["npm", "scripts"],
+  },
+  {
+    path: "/software/extensions",
+    label: "PHP Extensions",
+    description: "Extension inventory, version compatibility, INI directives, and toggles.",
+    category: "Software",
+    icon: FileCode2,
+    permission: "software:manage",
+    keywords: ["php", "extensions"],
+  },
+  {
+    path: "/software/installer",
+    label: "Application Installer",
+    description: "Curated application templates, install plans, and dependency previews.",
+    category: "Software",
+    icon: Package,
+    permission: "software:manage",
+    keywords: ["wordpress", "templates"],
+  },
+  {
+    path: "/software/optimization",
+    label: "Website Optimization",
+    description: "Compression, cache headers, image policy, and static asset tuning.",
+    category: "Software",
+    icon: Gauge,
+    permission: "software:manage",
+    keywords: ["compression", "cache"],
+  },
+  {
+    path: "/advanced",
+    label: "Advanced",
+    description: "Cron, terminal, logs, webhooks, API explorer, DNS lookup, and maintenance.",
+    category: "Advanced",
+    icon: Terminal,
+    permission: "advanced:manage",
+    keywords: ["cron", "terminal", "api"],
+  },
+  {
+    path: "/advanced/cron",
+    label: "Cron Jobs",
+    description: "Task scheduler with validation, history, environment, and retries.",
+    category: "Advanced",
+    icon: Activity,
+    permission: "advanced:manage",
+    keywords: ["scheduler", "tasks"],
+  },
+  {
+    path: "/advanced/terminal",
+    label: "Terminal",
+    description:
+      "Mock xterm.js session with tabs, reconnect, search, transcript, and fullscreen.",
+    category: "Advanced",
+    icon: Terminal,
+    permission: "advanced:manage",
+    keywords: ["shell", "xterm"],
+  },
+  {
+    path: "/advanced/processes",
+    label: "Process Manager",
+    description: "Process list, service status, queues, and mock restart controls.",
+    category: "Advanced",
+    icon: Activity,
+    permission: "advanced:manage",
+    keywords: ["process", "service"],
+  },
+  {
+    path: "/advanced/logs",
+    label: "Log Viewer",
+    description: "Virtualized logs, filters, download, search, and severity grouping.",
+    category: "Advanced",
+    icon: ScrollText,
+    permission: "advanced:manage",
+    keywords: ["logs", "viewer"],
+  },
+  {
+    path: "/advanced/webhooks",
+    label: "Webhooks",
+    description: "Webhook endpoints, signing secrets, retries, and execution previews.",
+    category: "Advanced",
+    icon: Workflow,
+    permission: "advanced:manage",
+    keywords: ["hooks", "events"],
+  },
+  {
+    path: "/advanced/dns-lookup",
+    label: "DNS Lookup",
+    description: "Mock DNS lookup for A, AAAA, CNAME, MX, TXT, NS, CAA, and trace views.",
+    category: "Advanced",
+    icon: Network,
+    permission: "advanced:manage",
+    keywords: ["dig", "lookup"],
+  },
+  {
+    path: "/advanced/traceroute",
+    label: "Traceroute",
+    description: "Mock route hops, packet loss, latency spread, and exportable results.",
+    category: "Advanced",
+    icon: Network,
+    permission: "advanced:manage",
+    keywords: ["trace", "network"],
+  },
+  {
+    path: "/advanced/index-manager",
+    label: "Index Manager",
+    description: "Directory index behavior, inherited settings, and preview URLs.",
+    category: "Advanced",
+    icon: Files,
+    permission: "advanced:manage",
+    keywords: ["index", "directory"],
+  },
+  {
+    path: "/advanced/error-pages",
+    label: "Error Pages",
+    description: "Custom 4xx and 5xx pages, templates, previews, and restore defaults.",
+    category: "Advanced",
+    icon: FileCode2,
+    permission: "advanced:manage",
+    keywords: ["404", "500"],
+  },
+  {
+    path: "/advanced/mime-types",
+    label: "MIME Types",
+    description: "MIME mappings, extensions, conflicts, and Apache/Nginx compatibility.",
+    category: "Advanced",
+    icon: FileCode2,
+    permission: "advanced:manage",
+    keywords: ["mime", "types"],
+  },
+  {
+    path: "/advanced/apache-handlers",
+    label: "Apache Handlers",
+    description: "Handler mappings, extension rules, inherited values, and impact preview.",
+    category: "Advanced",
+    icon: Settings,
+    permission: "advanced:manage",
+    keywords: ["apache", "handler"],
+  },
+  {
+    path: "/advanced/nginx-snippets",
+    label: "Nginx Snippets",
+    description: "Snippet library, include order, syntax checks, and rollback metadata.",
+    category: "Advanced",
+    icon: FileCode2,
+    permission: "advanced:manage",
+    keywords: ["nginx", "snippets"],
+  },
+  {
+    path: "/advanced/queue",
+    label: "Queue Manager",
+    description: "Queued jobs, workers, retries, failed tasks, and throughput health.",
+    category: "Advanced",
+    icon: Activity,
+    permission: "advanced:manage",
+    keywords: ["queue", "workers"],
+  },
+  {
+    path: "/advanced/system-info",
+    label: "System Information",
+    description: "Kernel, uptime, panel version, limits, packages, and environment summary.",
+    category: "Advanced",
+    icon: Server,
+    permission: "advanced:manage",
+    keywords: ["system", "kernel"],
+  },
+  {
+    path: "/developer/api-explorer",
+    label: "API Explorer",
+    description: "Contract-ready endpoints, request builders, mock responses, and schemas.",
+    category: "Developer Tools",
+    icon: Code2,
+    permission: "advanced:manage",
+    keywords: ["api", "openapi"],
+  },
+  {
+    path: "/developer/api-docs",
+    label: "API Documentation",
+    description: "Backend-ready API contracts, response envelopes, errors, and DTOs.",
+    category: "Developer Tools",
+    icon: ScrollText,
+    permission: "advanced:manage",
+    keywords: ["docs", "contracts"],
+  },
+  {
+    path: "/developer/environment",
+    label: "Environment Inspector",
+    description: "Runtime variables, redaction rules, app scope, and configuration drift.",
+    category: "Developer Tools",
+    icon: Settings,
+    permission: "advanced:manage",
+    keywords: ["env", "variables"],
+  },
+  {
+    path: "/developer/log-streams",
+    label: "Log Streams",
+    description: "Application, deploy, access, error, and worker streams in one console.",
+    category: "Developer Tools",
+    icon: ScrollText,
+    permission: "advanced:manage",
+    keywords: ["logs", "stream"],
+  },
+  {
+    path: "/developer/webhooks",
+    label: "Developer Webhooks",
+    description: "Developer event subscriptions, payload samples, signing, and retries.",
+    category: "Developer Tools",
+    icon: Workflow,
+    permission: "advanced:manage",
+    keywords: ["webhooks", "events"],
+  },
+  {
+    path: "/servers",
+    label: "Server",
+    description: "Overview, services, processes, network, updates, health, and clusters.",
+    category: "Server Administration",
+    icon: Server,
+    permission: "servers:manage",
+    keywords: ["host", "services", "updates"],
+  },
+  {
+    path: "/servers/srv-dal-01",
+    label: "Server Overview",
+    description: "Server hardware, OS, panel version, labels, migration, and registration.",
+    category: "Server Administration",
+    icon: Server,
+    permission: "servers:manage",
+    keywords: ["overview", "kernel"],
+  },
+  {
+    path: "/servers/srv-dal-01/services",
+    label: "Services",
+    description:
+      "Web server, PHP-FPM, database, DNS, queue, firewall, and monitoring services.",
+    category: "Server Administration",
+    icon: Server,
+    permission: "servers:manage",
+    keywords: ["systemd", "status"],
+  },
+  {
+    path: "/servers/srv-dal-01/processes",
+    label: "Server Processes",
+    description: "Process table with CPU, memory, user, command, and mock actions.",
+    category: "Server Administration",
+    icon: Activity,
+    permission: "servers:manage",
+    keywords: ["ps", "cpu"],
+  },
+  {
+    path: "/servers/srv-dal-01/updates",
+    label: "System Updates",
+    description: "Kernel, package updates, reboot requirements, and audit-preview dialogs.",
+    category: "Server Administration",
+    icon: Package,
+    permission: "servers:manage",
+    keywords: ["packages", "kernel"],
+  },
+  {
+    path: "/servers/srv-dal-01/network",
+    label: "Network Interfaces",
+    description: "Interfaces, routes, DNS resolvers, nameservers, and firewall status.",
+    category: "Server Administration",
+    icon: Network,
+    permission: "servers:manage",
+    keywords: ["interfaces", "dns"],
+  },
+  {
+    path: "/servers/srv-dal-01/filesystems",
+    label: "Mounted Filesystems",
+    description: "Mount points, capacity, inode usage, options, and health warnings.",
+    category: "Server Administration",
+    icon: HardDrive,
+    permission: "servers:manage",
+    keywords: ["mounts", "storage"],
+  },
+  {
+    path: "/servers/srv-dal-01/storage",
+    label: "Storage Devices",
+    description: "Block devices, partitions, SMART-style health, and capacity planning.",
+    category: "Server Administration",
+    icon: HardDrive,
+    permission: "servers:manage",
+    keywords: ["disks", "smart"],
+  },
+  {
+    path: "/servers/srv-dal-01/firewall",
+    label: "Server Firewall",
+    description: "Server-level firewall state, port rules, zones, and recent decisions.",
+    category: "Server Administration",
+    icon: Shield,
+    permission: "servers:manage",
+    keywords: ["firewall", "ports"],
+  },
+  {
+    path: "/servers/srv-dal-01/migration",
+    label: "Server Migration",
+    description: "Migration readiness, transfer batches, validation, and cutover previews.",
+    category: "Server Administration",
+    icon: Workflow,
+    permission: "servers:manage",
+    keywords: ["migration", "transfer"],
+  },
+  {
+    path: "/servers/clusters",
+    label: "Cluster Overview",
+    description: "Server groups, labels, roles, health, and multi-server status.",
+    category: "Server Administration",
+    icon: Server,
+    permission: "servers:manage",
+    keywords: ["cluster", "groups"],
+  },
+  {
+    path: "/users",
+    label: "Users",
+    description:
+      "Hosting users, team members, invitations, sessions, migrations, and suspensions.",
+    category: "Users",
+    icon: Users,
+    permission: "users:manage",
+    keywords: ["accounts", "teams"],
+  },
+  {
+    path: "/roles",
+    label: "Roles",
+    description: "Role templates and detailed permission editor for every panel module.",
+    category: "Users",
+    icon: LockKeyhole,
+    permission: "users:manage",
+    keywords: ["permissions", "rbac"],
+  },
+  {
+    path: "/users/team",
+    label: "Team Members",
+    description: "Team users, invitations, role assignments, and session visibility.",
+    category: "Users",
+    icon: Users,
+    permission: "users:manage",
+    keywords: ["team", "members"],
+  },
+  {
+    path: "/users/invitations",
+    label: "Invitations",
+    description: "Pending invitations, accepted users, expiry, and resend controls.",
+    category: "Users",
+    icon: Mail,
+    permission: "users:manage",
+    keywords: ["invite", "pending"],
+  },
+  {
+    path: "/users/suspended",
+    label: "Suspended Accounts",
+    description: "Suspended users, reasons, restore eligibility, and audit notes.",
+    category: "Users",
+    icon: LockKeyhole,
+    permission: "users:manage",
+    keywords: ["suspend", "locked"],
+  },
+  {
+    path: "/users/sessions",
+    label: "User Sessions",
+    description: "Active sessions, device trust, IPs, and forced logout controls.",
+    category: "Users",
+    icon: Activity,
+    permission: "users:manage",
+    keywords: ["sessions", "devices"],
+  },
+  {
+    path: "/resellers",
+    label: "Resellers",
+    description: "Reseller accounts, packages, quotas, feature lists, and ownership transfer.",
+    category: "Resellers",
+    icon: BriefcaseBusiness,
+    permission: "resellers:manage",
+    keywords: ["hosting packages", "feature lists"],
+  },
+  {
+    path: "/packages",
+    label: "Packages",
+    description: "Hosting packages, account quotas, limits, and feature availability.",
+    category: "Resellers",
+    icon: Package,
+    permission: "resellers:manage",
+    keywords: ["quota", "limits"],
+  },
+  {
+    path: "/resellers/features",
+    label: "Feature Lists",
+    description: "Feature list templates, module availability, limits, and inheritance.",
+    category: "Resellers",
+    icon: CheckCircle2,
+    permission: "resellers:manage",
+    keywords: ["features", "packages"],
+  },
+  {
+    path: "/resellers/quotas",
+    label: "Account Quotas",
+    description: "Disk, bandwidth, mailbox, database, and account-level quota plans.",
+    category: "Resellers",
+    icon: Gauge,
+    permission: "resellers:manage",
+    keywords: ["quotas", "limits"],
+  },
+  {
+    path: "/backups",
+    label: "Backups",
+    description:
+      "Full, website, database, email, config, snapshots, retention, and destinations.",
+    category: "Backups",
+    icon: Archive,
+    permission: "backups:manage",
+    keywords: ["restore", "snapshot", "s3"],
+  },
+  {
+    path: "/backups/new",
+    label: "Create Backup",
+    description: "Backup wizard for scope, destination, retention, encryption, and schedule.",
+    category: "Backups",
+    icon: Archive,
+    permission: "backups:manage",
+    keywords: ["new", "wizard"],
+  },
+  {
+    path: "/backups/bak-2026-06-12",
+    label: "Backup Details",
+    description: "Verification, contents, encryption, download, clone, restore, and delete.",
+    category: "Backups",
+    icon: Archive,
+    permission: "backups:manage",
+    keywords: ["details", "verify"],
+  },
+  {
+    path: "/restore",
+    label: "Restore",
+    description: "Guided restore wizard with impact preview, two-factor mock, and audit note.",
+    category: "Backups",
+    icon: Archive,
+    permission: "backups:manage",
+    keywords: ["restore", "wizard"],
+    danger: true,
+  },
+  {
+    path: "/backups/schedules",
+    label: "Backup Schedules",
+    description: "Scheduled backups, windows, retention, destinations, and failure policy.",
+    category: "Backups",
+    icon: Activity,
+    permission: "backups:manage",
+    keywords: ["schedule", "retention"],
+  },
+  {
+    path: "/backups/destinations",
+    label: "Backup Destinations",
+    description: "Local, SFTP, S3-compatible, B2, GCS, Azure, and custom object targets.",
+    category: "Backups",
+    icon: HardDrive,
+    permission: "backups:manage",
+    keywords: ["s3", "storage"],
+  },
+  {
+    path: "/backups/verification",
+    label: "Backup Verification",
+    description: "Checksum, restore test, encryption, and recent verification history.",
+    category: "Backups",
+    icon: CheckCircle2,
+    permission: "backups:manage",
+    keywords: ["verify", "checksum"],
+  },
+  {
+    path: "/backups/retention",
+    label: "Retention Policy",
+    description: "Retention tiers, pruning rules, legal hold, and projected storage.",
+    category: "Backups",
+    icon: Archive,
+    permission: "backups:manage",
+    keywords: ["retention", "pruning"],
+  },
+  {
+    path: "/automation",
+    label: "Automation",
+    description: "Scheduled tasks, pipelines, webhooks, triggers, retries, and history.",
+    category: "Automation",
+    icon: Workflow,
+    permission: "automation:manage",
+    keywords: ["workflow", "pipelines"],
+  },
+  {
+    path: "/automation/new",
+    label: "Workflow Builder",
+    description:
+      "Visual builder with triggers, conditions, actions, branches, validation, and test mode.",
+    category: "Automation",
+    icon: Workflow,
+    permission: "automation:manage",
+    keywords: ["builder", "trigger"],
+  },
+  {
+    path: "/automation/deploy-main",
+    label: "Automation Details",
+    description: "Execution preview, history, failed runs, retry policy, and notifications.",
+    category: "Automation",
+    icon: Workflow,
+    permission: "automation:manage",
+    keywords: ["execution", "history"],
+  },
+  {
+    path: "/automation/templates",
+    label: "Automation Templates",
+    description: "Reusable deployment, backup, certificate, monitoring, and alert templates.",
+    category: "Automation",
+    icon: Workflow,
+    permission: "automation:manage",
+    keywords: ["templates", "workflow"],
+  },
+  {
+    path: "/automation/history",
+    label: "Execution History",
+    description: "Automation runs, retries, failed executions, logs, and duration metrics.",
+    category: "Automation",
+    icon: ScrollText,
+    permission: "automation:manage",
+    keywords: ["history", "runs"],
+  },
+  {
+    path: "/automation/triggers",
+    label: "Event Triggers",
+    description: "Git, backup, SSL, monitoring, resource, and notification triggers.",
+    category: "Automation",
+    icon: Activity,
+    permission: "automation:manage",
+    keywords: ["events", "triggers"],
+  },
+  {
+    path: "/notifications",
+    label: "Notifications",
+    description: "Notification center, preferences, critical alerts, and delivery settings.",
+    category: "Notifications",
+    icon: Bell,
+    permission: "notifications:read",
+    keywords: ["alerts", "preferences"],
+  },
+  {
+    path: "/notifications/preferences",
+    label: "Notification Preferences",
+    description: "Email, browser, webhook, digest, and quiet-hour notification settings.",
+    category: "Notifications",
+    icon: Settings,
+    permission: "notifications:read",
+    keywords: ["preferences", "email"],
+  },
+  {
+    path: "/notifications/critical",
+    label: "Critical Alerts",
+    description: "Security, backup, resource, SSL, deployment, and service alerts.",
+    category: "Notifications",
+    icon: Bell,
+    permission: "notifications:read",
+    keywords: ["critical", "alerts"],
+  },
+  {
+    path: "/notifications/webhooks",
+    label: "Webhook Notifications",
+    description: "Webhook targets, payload signing, delivery tests, and retry history.",
+    category: "Notifications",
+    icon: Workflow,
+    permission: "notifications:read",
+    keywords: ["webhooks", "delivery"],
+  },
+  {
+    path: "/audit-logs",
+    label: "Audit Logs",
+    description: "Audit events, request IDs, actor metadata, bulk filters, and export.",
+    category: "Audit",
+    icon: ScrollText,
+    permission: "audit:read",
+    keywords: ["events", "security"],
+  },
+  {
+    path: "/support",
+    label: "Support",
+    description:
+      "Documentation, knowledge base, diagnostics, tickets, replies, and attachments.",
+    category: "Support",
+    icon: LifeBuoy,
+    permission: "support:manage",
+    keywords: ["tickets", "docs"],
+  },
+  {
+    path: "/support/documentation",
+    label: "Documentation",
+    description: "Product documentation, guided procedures, backend contracts, and examples.",
+    category: "Support",
+    icon: ScrollText,
+    permission: "support:manage",
+    keywords: ["docs", "manual"],
+  },
+  {
+    path: "/support/knowledge-base",
+    label: "Knowledge Base",
+    description: "Searchable support articles, diagnostics, and common hosting fixes.",
+    category: "Support",
+    icon: LifeBuoy,
+    permission: "support:manage",
+    keywords: ["kb", "articles"],
+  },
+  {
+    path: "/support/tickets",
+    label: "Support Tickets",
+    description: "Ticket inbox, priority, status, replies, attachments, and diagnostics.",
+    category: "Support",
+    icon: Mail,
+    permission: "support:manage",
+    keywords: ["tickets", "replies"],
+  },
+  {
+    path: "/support/diagnostics",
+    label: "System Diagnostics",
+    description: "Diagnostic report generator, service checks, logs, and export package.",
+    category: "Support",
+    icon: Activity,
+    permission: "support:manage",
+    keywords: ["diagnostics", "report"],
+  },
+  {
+    path: "/settings",
+    label: "Settings",
+    description:
+      "Branding, theme, locale, session, security defaults, APIs, privacy, and maintenance.",
+    category: "Preferences",
+    icon: Settings,
+    permission: "settings:manage",
+    keywords: ["branding", "theme", "feature flags"],
+  },
+  {
+    path: "/setup",
+    label: "First-Run Setup",
+    description: "Initial server, account, security, branding, and notification setup.",
+    category: "Preferences",
+    icon: Bot,
+    permission: "settings:manage",
+    keywords: ["onboarding", "wizard"],
+  },
+  {
+    path: "/settings/branding",
+    label: "Branding",
+    description: "Logo, accent color, favicon, dark assets, and live brand preview.",
+    category: "Preferences",
+    icon: Palette,
+    permission: "settings:manage",
+    keywords: ["logo", "theme"],
+  },
+  {
+    path: "/settings/localization",
+    label: "Localization",
+    description: "Locale, date format, time format, timezone, and regional defaults.",
+    category: "Preferences",
+    icon: Settings,
+    permission: "settings:manage",
+    keywords: ["locale", "timezone"],
+  },
+  {
+    path: "/settings/security-defaults",
+    label: "Security Defaults",
+    description: "Password policy, two-factor defaults, sessions, and trusted-device policy.",
+    category: "Preferences",
+    icon: LockKeyhole,
+    permission: "settings:manage",
+    keywords: ["password", "2fa"],
+  },
+  {
+    path: "/settings/feature-flags",
+    label: "Feature Flags",
+    description: "Module flags, experimental features, beta controls, and rollout notes.",
+    category: "Preferences",
+    icon: Settings,
+    permission: "settings:manage",
+    keywords: ["flags", "experimental"],
+  },
+  {
+    path: "/settings/api",
+    label: "API Settings",
+    description: "API defaults, token policy, CORS, rate-limit profiles, and audit metadata.",
+    category: "Preferences",
+    icon: Code2,
+    permission: "settings:manage",
+    keywords: ["api", "tokens"],
+  },
+];
+
+export const sidebarRoutes = routeItems.filter((item) =>
+  [
+    "/dashboard",
+    "/tools",
+    "/websites",
+    "/domains",
+    "/files",
+    "/databases",
+    "/email",
+    "/metrics",
+    "/security",
+    "/software",
+    "/advanced",
+    "/servers",
+    "/users",
+    "/resellers",
+    "/backups",
+    "/automation",
+    "/notifications",
+    "/audit-logs",
+    "/support",
+    "/settings",
+  ].includes(item.path),
+);
+
+export const favoriteDefaults = [
+  "/files",
+  "/domains/example.com/dns",
+  "/email/accounts",
+  "/databases",
+  "/advanced/terminal",
+  "/backups",
+];
+
+export function findRoute(path: string) {
+  return routeItems.find((route) => route.path === path);
+}
+
+export function groupRoutes(items = routeItems) {
+  return items.reduce<Record<string, RouteItem[]>>((groups, item) => {
+    groups[item.category] = [...(groups[item.category] ?? []), item];
+    return groups;
+  }, {});
+}