diff --git a/_backups/r3_cc4/pgz_sport_api.py.pre_M5.1777931436 b/_backups/r3_cc4/pgz_sport_api.py.pre_M5.1777931436
new file mode 100644
index 0000000..a0221ec
--- /dev/null
+++ b/_backups/r3_cc4/pgz_sport_api.py.pre_M5.1777931436
@@ -0,0 +1,1646 @@
+#!/usr/bin/env python3
+"""
+pgz_sport_api.py - FastAPI backend za PGŽ Sportski savez ERP/CRM
+Author: Damir Radulić (damir@rinet.one)
+Date: 25.04.2026
+Port: 8095
+Endpoints: savezi, klubovi, članovi, članarine, liječnički, manifestacije, proračun, dashboard, alertovi
+"""
+
+from fastapi import FastAPI, HTTPException, Query, Body, Header, Depends, UploadFile, File, Form, Request
+import json
+from fastapi.middleware.cors import CORSMiddleware
+from pydantic import BaseModel
+from typing import Optional, List
+from datetime import date, datetime
+import psycopg2
+import psycopg2.extras
+from pgz_sport_v2_router import router as v2_router
+import os
+
+DB = dict(host='10.10.0.2', port=6432, dbname='rinet_v3', user='rinet', password='R1net2026!SecureDB#v7')
+
+
+ADMIN_TOKEN = 'admin-pgz-2026'
+
+def is_admin(authorization):
+    if not authorization: return False
+    token = authorization.replace('Bearer ', '').strip()
+    if token == ADMIN_TOKEN: return True
+    # Try JWT
+    try:
+        import jwt as _jwt
+        payload = _jwt.decode(token, JWT_SECRET, algorithms=["HS256"])
+        return payload.get("role") == "admin"
+    except Exception:
+        return False
+
+def blur_oib(v):
+    if not v: return v
+    s = str(v); 
+    return s[:3] + '•'*(len(s)-5) + s[-2:] if len(s) >= 8 else '•'*len(s)
+def blur_email(e):
+    if not e or '@' not in str(e): return e
+    u, d = str(e).split('@',1); return (u[:1]+'•••' if u else '')+'@'+d
+def blur_phone(p):
+    if not p: return p
+    s=str(p); return s[:4]+'•'*(len(s)-7)+s[-3:] if len(s)>=7 else s
+def blur_iban(v):
+    if not v: return v
+    s=str(v); return s[:4]+'•'*(len(s)-8)+s[-4:] if len(s)>=8 else s
+def blur_date(d):
+    if not d: return d
+    s = str(d); return s[:4]+'-••-••' if len(s)>=4 else s
+def blur_text(t, keep=3):
+    if not t: return t
+    s=str(t); return s[:keep]+'•'*(len(s)-keep*2)+s[-keep:] if len(s)>keep*2 else s
+
+def apply_privacy(rows, admin):
+    if admin: return rows
+    out = []
+    for r in (rows if isinstance(rows, list) else [rows]):
+        rr = dict(r)
+        for k, v in list(rr.items()):
+            if v is None: continue
+            kl = k.lower()
+            if 'oib' in kl: rr[k] = blur_oib(v)
+            elif 'email' in kl: rr[k] = blur_email(v)
+            elif kl in ('telefon','tel','phone'): rr[k] = blur_phone(v)
+            elif kl == 'datum_rodenja': rr[k] = blur_date(v)
+            elif 'iban' in kl: rr[k] = blur_iban(v)
+            elif kl == 'adresa': rr[k] = blur_text(v, 3)
+            elif 'licenca_broj' in kl: rr[k] = blur_text(v, 2)
+        out.append(rr)
+    return out if isinstance(rows, list) else out[0]
+
+app = FastAPI(title="PGŽ Sportski savez ERP/CRM", version="1.0.0")
+app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_methods=["*"], allow_headers=["*"])
+
+
+# === URL rewrite middleware - convert direct external image URLs to /img-proxy ===
+import json as _json_mw
+import re as _re_mw
+from starlette.responses import Response as _StarletteResponse_mw
+
+_IMG_DOMAINS_RE = _re_mw.compile(
+    r'https?://(?:hns\.family|hns\.hr|hbs\.hr|hrvatski-bocarski-savez\.hr|'
+    r'rk-zamet\.hr|hvs\.hr|rezultati\.hvs\.hr|sport-pgz\.hr)'
+    r'/[^"\s\\]+\.(?:jpg|jpeg|png|gif|webp|svg)',
+    _re_mw.IGNORECASE
+)
+
+def _rewrite_to_proxy(text: str) -> str:
+    """Replace external image URLs with /sport/api/v2/img-proxy?u=..."""
+    from urllib.parse import quote as _q
+    def _sub(m):
+        url = m.group(0)
+        return "/sport/api/v2/img-proxy?u=" + _q(url, safe='')
+    return _IMG_DOMAINS_RE.sub(_sub, text)
+
+@app.middleware("http")
+async def url_rewrite_middleware(request, call_next):
+    response = await call_next(request)
+    # Only rewrite JSON API responses
+    ct = response.headers.get("content-type", "")
+    if "application/json" not in ct:
+        return response
+    # Only on /api/v2 routes (admin & data endpoints) - SKIP /api/v2/img-proxy itself
+    path = request.url.path
+    if "/api/v2/img-proxy" in path or "/api/v2/dokumenti" in path:
+        return response  # don't rewrite raw document content
+    # Read body
+    body = b""
+    async for chunk in response.body_iterator:
+        body += chunk
+    try:
+        text = body.decode("utf-8")
+        new_text = _rewrite_to_proxy(text)
+        new_body = new_text.encode("utf-8")
+    except Exception:
+        new_body = body
+    return _StarletteResponse_mw(
+        content=new_body,
+        status_code=response.status_code,
+        headers={k: v for k, v in response.headers.items() if k.lower() not in ("content-length",)},
+        media_type=ct,
+    )
+# === end URL rewrite middleware ===
+
+def db():
+    conn = psycopg2.connect(**DB)
+    conn.autocommit = True
+    return conn
+
+def fetch(sql, params=None):
+    with db() as conn:
+        with conn.cursor(cursor_factory=psycopg2.extras.RealDictCursor) as c:
+            c.execute(sql, params or ())
+            return [dict(r) for r in c.fetchall()]
+
+def execute(sql, params=None):
+    with db() as conn:
+        with conn.cursor() as c:
+            c.execute(sql, params or ())
+            return c.rowcount
+
+# ==================== HEALTH ====================
+@app.get("/health")
+def health():
+    try:
+        rows = fetch("SELECT * FROM pgz_sport.v_dashboard")
+        return {"status": "ok", "service": "pgz_sport", "dashboard": rows[0] if rows else None}
+    except Exception as e:
+        raise HTTPException(500, f"DB error: {e}")
+
+
+@app.get("/api/whoami")
+def whoami_v2(authorization: Optional[str] = Header(None)):
+    return {"role": "admin" if is_admin(authorization) else "viewer", "privacy_active": not is_admin(authorization)}
+
+# ==================== DASHBOARD ====================
+@app.get("/api/dashboard")
+def dashboard():
+    rows = fetch("SELECT * FROM pgz_sport.v_dashboard")
+    if not rows:
+        return {}
+    d = rows[0]
+    # Top savezi by registriranih 2024
+    top = fetch("""SELECT s.naziv, st.klubova_clanica, st.registriranih, st.trenera, st.reprezentativaca
+                FROM pgz_sport.statistika_saveza st JOIN pgz_sport.savezi s ON s.id=st.savez_id
+                WHERE st.godina=2024 ORDER BY st.registriranih DESC LIMIT 10""")
+    proracun_trend = fetch("SELECT godina, ukupno FROM pgz_sport.proracun ORDER BY godina")
+    nositelji = fetch("""SELECT naziv_kluba, godina, iznos FROM pgz_sport.potpore_nositelji 
+                       WHERE godina = 2025 ORDER BY iznos DESC LIMIT 10""")
+    return {**d, "top_savezi": top, "proracun_trend": proracun_trend, "nositelji_2025": nositelji}
+
+@app.get("/api/dashboard/ekosustav")
+def dashboard_ekosustav():
+    """Sport ekosustav PGŽ — coverage stats za enrichment iz FINA registra."""
+    summary = fetch("""SELECT 
+        COUNT(*) AS klubova_total,
+        COUNT(*) FILTER (WHERE oib IS NOT NULL) AS s_oib,
+        COUNT(*) FILTER (WHERE predsjednik IS NOT NULL) AS s_predsjednik,
+        COUNT(*) FILTER (WHERE tajnik IS NOT NULL) AS s_tajnik,
+        COUNT(*) FILTER (WHERE ciljevi IS NOT NULL) AS s_ciljevi,
+        COUNT(*) FILTER (WHERE opis_djelatnosti IS NOT NULL) AS s_opis,
+        COUNT(*) FILTER (WHERE sjediste IS NOT NULL) AS s_sjediste,
+        COUNT(*) FILTER (WHERE email IS NOT NULL) AS s_email,
+        COUNT(*) FILTER (WHERE web_stranica IS NOT NULL) AS s_web,
+        COUNT(*) FILTER (WHERE udruga_status = \'AKTIVAN\') AS s_aktivan_reg,
+        COUNT(*) FILTER (WHERE savez_id IS NOT NULL) AS s_savez,
+        COUNT(*) FILTER (WHERE nositelj_kvalitete) AS s_nositelj
+        FROM pgz_sport.klubovi WHERE aktivan""")[0]
+    
+    by_sport = fetch("""SELECT sport, COUNT(*) AS broj 
+        FROM pgz_sport.klubovi WHERE aktivan AND sport IS NOT NULL 
+        GROUP BY sport ORDER BY COUNT(*) DESC LIMIT 15""")
+    
+    by_region = fetch("""SELECT region, COUNT(*) AS broj 
+        FROM pgz_sport.klubovi WHERE aktivan AND region IS NOT NULL 
+        GROUP BY region ORDER BY COUNT(*) DESC""")
+    
+    by_grad = fetch("""SELECT grad, COUNT(*) AS broj 
+        FROM pgz_sport.klubovi WHERE aktivan AND grad IS NOT NULL 
+        GROUP BY grad ORDER BY COUNT(*) DESC LIMIT 12""")
+    
+    decade = fetch("""SELECT 
+        CASE 
+            WHEN godina_osnutka < 1950 THEN \'pred1950\'
+            WHEN godina_osnutka < 1980 THEN \'1950-1979\'
+            WHEN godina_osnutka < 2000 THEN \'1980-1999\'
+            WHEN godina_osnutka < 2010 THEN \'2000-2009\'
+            WHEN godina_osnutka >= 2010 THEN \'2010-danas\'
+            ELSE \'nepoznato\'
+        END AS razdoblje,
+        COUNT(*) AS broj
+        FROM pgz_sport.klubovi 
+        WHERE aktivan AND godina_osnutka IS NOT NULL
+        GROUP BY razdoblje ORDER BY razdoblje""")
+    
+    # Pokazi enrichment %
+    total = summary["klubova_total"] or 1
+    coverage = {
+        "oib_pct": round(100 * summary["s_oib"] / total, 1),
+        "predsjednik_pct": round(100 * summary["s_predsjednik"] / total, 1),
+        "tajnik_pct": round(100 * summary["s_tajnik"] / total, 1),
+        "ciljevi_pct": round(100 * summary["s_ciljevi"] / total, 1),
+        "opis_pct": round(100 * summary["s_opis"] / total, 1),
+        "sjediste_pct": round(100 * summary["s_sjediste"] / total, 1),
+        "email_pct": round(100 * summary["s_email"] / total, 1),
+        "savez_pct": round(100 * summary["s_savez"] / total, 1),
+    }
+    
+    return {**summary, "coverage": coverage, "by_sport": by_sport, 
+            "by_region": by_region, "by_grad": by_grad, "by_decade": decade}
+
+
+
+# ==================== ANALYTICS ====================
+@app.get("/api/analytics/savezi-trend")
+def savezi_trend(godine: str = "2020,2021,2022,2023,2024", metric: str = "registriranih"):
+    valid_metrics = {"registriranih", "neregistriranih", "rekreativaca", "trenera", "reprezentativaca",
+                     "kategoriziranih", "stipendiranih", "klubova_clanica"}
+    if metric not in valid_metrics:
+        raise HTTPException(400, f"Invalid metric. Must be one of: {valid_metrics}")
+    god_list = [int(g) for g in godine.split(",")]
+    rows = fetch(f"""SELECT s.naziv AS savez, st.godina, st.{metric} AS value
+        FROM pgz_sport.statistika_saveza st JOIN pgz_sport.savezi s ON s.id=st.savez_id
+        WHERE st.godina = ANY(%s) ORDER BY s.naziv, st.godina""", [god_list])
+    saveze = {}
+    for r in rows:
+        if r['savez'] not in saveze: saveze[r['savez']] = {}
+        saveze[r['savez']][r['godina']] = r['value']
+    return {"metric": metric, "godine": god_list, "data": saveze}
+
+@app.get("/api/analytics/proracun-detaljno")
+def proracun_detaljno():
+    p = fetch("SELECT * FROM pgz_sport.proracun ORDER BY godina")
+    if not p: return {"proracun": [], "rast_godisnji": [], "current_year": None, "current_total": 0, "rast_dekada_pct": 0}
+    cagr = []
+    for i in range(1, len(p)):
+        prev = float(p[i-1]['ukupno']) if p[i-1]['ukupno'] else 0
+        curr = float(p[i]['ukupno']) if p[i]['ukupno'] else 0
+        rate = ((curr/prev - 1) * 100) if prev > 0 else 0
+        cagr.append({"godina": p[i]['godina'], "rast_postotak": round(rate, 1)})
+    decade_rast = round((float(p[-1]['ukupno'])/float(p[0]['ukupno']) - 1) * 100, 1) if p[0]['ukupno'] else 0
+    return {"proracun": p, "rast_godisnji": cagr, "rast_dekada_pct": decade_rast,
+            "current_year": int(p[-1]['godina']), "current_total": float(p[-1]['ukupno'])}
+
+@app.get("/api/analytics/klub-financije")
+def klub_financije(klub_id: Optional[int] = None, godina: Optional[int] = None):
+    where = []
+    params = []
+    if godina: where.append("p.godina=%s"); params.append(godina)
+    if klub_id:
+        where.append("(p.klub_id=%s OR p.naziv_kluba=(SELECT naziv FROM pgz_sport.klubovi WHERE id=%s))")
+        params.extend([klub_id, klub_id])
+    where_sql = "WHERE " + " AND ".join(where) if where else ""
+    rows = fetch(f"""SELECT p.naziv_kluba, p.godina, p.iznos,
+        k.id AS klub_id, k.sport, k.razina, k.nositelj_kvalitete
+        FROM pgz_sport.potpore_nositelji p
+        LEFT JOIN pgz_sport.klubovi k ON p.klub_id=k.id OR p.naziv_kluba=k.naziv
+        {where_sql} ORDER BY p.godina DESC, p.iznos DESC""", params)
+    summary = fetch(f"""SELECT godina, SUM(iznos) AS total, COUNT(*) AS klubova, AVG(iznos) AS prosjek
+        FROM pgz_sport.potpore_nositelji p {where_sql}
+        GROUP BY godina ORDER BY godina""", params)
+    return {"data": rows, "summary": summary}
+
+@app.get("/api/analytics/lijecnicki-stats")
+def lijecnicki_stats(klub_id: Optional[int] = None):
+    where = ["1=1"]; params = []
+    if klub_id: where.append("c.klub_id=%s"); params.append(klub_id)
+    where_sql = " AND ".join(where)
+    rows = fetch(f"""SELECT 
+        COUNT(*) AS total,
+        COUNT(*) FILTER (WHERE lp.vrijedi_do >= CURRENT_DATE + 30) AS validni,
+        COUNT(*) FILTER (WHERE lp.vrijedi_do BETWEEN CURRENT_DATE AND CURRENT_DATE + 30) AS uskoro,
+        COUNT(*) FILTER (WHERE lp.vrijedi_do < CURRENT_DATE) AS istekli,
+        SUM(lp.iznos) AS ukupan_trosak, SUM(lp.iznos_zzjz) AS zzjz_udio,
+        SUM(lp.iznos_klub) AS klub_udio, SUM(lp.iznos_clan) AS clan_udio,
+        AVG(lp.iznos) AS prosjecni_trosak
+        FROM pgz_sport.lijecnicki_pregledi lp
+        JOIN pgz_sport.clanovi c ON c.id=lp.clan_id WHERE {where_sql}""", params)
+    by_ustanova = fetch(f"""SELECT lp.ustanova, COUNT(*) cnt, SUM(lp.iznos) iznos
+        FROM pgz_sport.lijecnicki_pregledi lp JOIN pgz_sport.clanovi c ON c.id=lp.clan_id
+        WHERE {where_sql} GROUP BY lp.ustanova ORDER BY cnt DESC""", params)
+    by_lijecnik = fetch(f"""SELECT lp.lijecnik, COUNT(*) cnt, AVG(lp.iznos) prosjek
+        FROM pgz_sport.lijecnicki_pregledi lp JOIN pgz_sport.clanovi c ON c.id=lp.clan_id
+        WHERE {where_sql} AND lp.lijecnik IS NOT NULL GROUP BY lp.lijecnik ORDER BY cnt DESC""", params)
+    return {"summary": rows[0] if rows else {}, "by_ustanova": by_ustanova, "by_lijecnik": by_lijecnik}
+
+# ==================== SAVEZI ====================
+@app.get("/api/savezi")
+def list_savezi(authorization: Optional[str] = Header(None), q: Optional[str] = None, 
+                razina: Optional[str] = None, zupanija: Optional[str] = None,
+                sort: str = "naziv", order: str = "asc"):
+    where = "WHERE aktivan"
+    params = []
+    if q:
+        where += " AND (naziv ILIKE %s OR sport ILIKE %s)"
+        params = [f"%{q}%", f"%{q}%"]
+    if razina:
+        where += " AND razina = %s"; params.append(razina)
+    if zupanija:
+        where += " AND sjediste_zupanija ILIKE %s"; params.append(f"%{zupanija}%")
+    sort_col = {"naziv": "naziv", "godina": "godina_osnutka", "sport": "sport", "razina": "razina"}.get(sort, "naziv")
+    order = "DESC" if order.lower() == "desc" else "ASC"
+    # Croatian collation for text columns (Š → after S, Č → after C, etc.)
+    collate = ' COLLATE "hr-HR-x-icu"' if sort_col in ("naziv", "sport") else ""
+    rows = fetch(f"""SELECT s.*, 
+        (SELECT COUNT(*) FROM pgz_sport.klubovi WHERE savez_id=s.id) AS broj_klubova,
+        (SELECT registriranih FROM pgz_sport.statistika_saveza WHERE savez_id=s.id AND godina=2024) AS reg_2024,
+        (SELECT trenera FROM pgz_sport.statistika_saveza WHERE savez_id=s.id AND godina=2024) AS treneri_2024,
+        (SELECT reprezentativaca FROM pgz_sport.statistika_saveza WHERE savez_id=s.id AND godina=2024) AS repr_2024
+        FROM pgz_sport.savezi s {where} ORDER BY {sort_col}{collate} {order}""", params)
+    rows = apply_privacy(rows, is_admin(authorization))
+    return {"count": len(rows), "rows": rows}
+
+@app.get("/api/savezi/{savez_id}")
+def get_savez(savez_id: int):
+    rows = fetch("SELECT * FROM pgz_sport.savezi WHERE id=%s", [savez_id])
+    if not rows:
+        raise HTTPException(404, "Savez ne postoji")
+    klubovi = fetch("SELECT * FROM pgz_sport.klubovi WHERE savez_id=%s ORDER BY naziv", [savez_id])
+    statistika = fetch("SELECT * FROM pgz_sport.statistika_saveza WHERE savez_id=%s ORDER BY godina", [savez_id])
+    manifestacije = fetch("SELECT * FROM pgz_sport.manifestacije WHERE savez_id=%s", [savez_id])
+    return {**rows[0], "klubovi": klubovi, "statistika": statistika, "manifestacije": manifestacije}
+
+# ==================== KLUBOVI ====================
+@app.get("/api/klubovi")
+def list_klubovi(authorization: Optional[str] = Header(None), q: Optional[str] = None, savez_id: Optional[int] = None,
+                 nositelj: Optional[bool] = None, region: Optional[str] = None, sport: Optional[str] = None, grad: Optional[str] = None,
+                 sort: str = "naziv", order: str = "asc"):
+    where = ["aktivan"]
+    params = []
+    if q:
+        where.append("(klub ILIKE %s OR oib ILIKE %s OR sport ILIKE %s OR predsjednik ILIKE %s)")
+        params.extend([f"%{q}%", f"%{q}%", f"%{q}%", f"%{q}%"])
+    if savez_id:
+        where.append("savez_id=%s"); params.append(savez_id)
+    if nositelj is not None:
+        where.append(f"nositelj_kvalitete={'TRUE' if nositelj else 'FALSE'}")
+    if region:
+        where.append("region ILIKE %s"); params.append(region)
+    if grad:
+        where.append("grad ILIKE %s"); params.append(f"%{grad}%")
+    if sport:
+        where.append("sport ILIKE %s"); params.append(f"%{sport}%")
+    sort_col = {"naziv": "klub", "savez": "savez", "broj_clanova": "broj_clanova",
+                "razina": "razina", "region": "region", "grad": "grad", "sport": "sport"}.get(sort, "klub")
+    order_sql = "DESC" if order.lower() == "desc" else "ASC"
+    where_sql = " AND ".join(where) if where else "TRUE"
+    collate = ' COLLATE "hr-HR-x-icu"' if sort_col in ("klub", "savez", "razina", "region", "grad", "sport") else ""
+    rows = fetch(f"""SELECT * FROM pgz_sport.v_klubovi_pregled WHERE {where_sql} 
+                   ORDER BY {sort_col}{collate} {order_sql} NULLS LAST""", params)
+    for r in rows:
+        if isinstance(r, dict) and r.get('klub') and not r.get('naziv'):
+            r['naziv'] = r['klub']
+    rows = apply_privacy(rows, is_admin(authorization))
+    return {"count": len(rows), "rows": rows}
+
+@app.get("/api/klubovi/{klub_id}")
+def get_klub(klub_id: int, authorization: Optional[str] = Header(None)):
+    admin = is_admin(authorization)
+    rows = fetch("""SELECT k.*, s.naziv AS savez_naziv FROM pgz_sport.klubovi k
+                  LEFT JOIN pgz_sport.savezi s ON s.id=k.savez_id WHERE k.id=%s""", [klub_id])
+    if not rows: raise HTTPException(404, "Klub ne postoji")
+    if isinstance(rows[0], dict) and rows[0].get('klub') and not rows[0].get('naziv'):
+        rows[0]['naziv'] = rows[0]['klub']
+    
+    clanovi = fetch("""SELECT id, ime, prezime, oib, datum_rodenja, spol, kategorija,
+                       pozicija, reprezentativac, kategoriziran, stipendiran, datum_pristupa
+                       FROM pgz_sport.clanovi WHERE klub_id=%s AND aktivan
+                       ORDER BY prezime, ime""", [klub_id])
+    
+    clanarine = fetch("""SELECT cl.id, cl.godina, cl.razdoblje, cl.iznos_propisan, cl.iznos_placen,
+        (cl.iznos_propisan - cl.iznos_placen) AS dug, cl.datum_uplate, cl.status, cl.napomena,
+        c.ime || ' ' || c.prezime AS clan, c.oib AS clan_oib
+        FROM pgz_sport.clanarine cl JOIN pgz_sport.clanovi c ON c.id=cl.clan_id
+        WHERE c.klub_id=%s ORDER BY cl.godina DESC, cl.id DESC""", [klub_id])
+    
+    lijecnicki = fetch("""SELECT lp.id, lp.datum_pregleda, lp.vrijedi_do, lp.vrsta_pregleda,
+        lp.ustanova, lp.lijecnik, lp.spreman_za_natjecanje, lp.iznos, lp.iznos_zzjz, lp.iznos_klub, lp.iznos_clan,
+        lp.placeno, lp.komentar_lijecnika,
+        c.ime || ' ' || c.prezime AS clan, c.oib AS clan_oib,
+        CASE WHEN lp.vrijedi_do IS NULL THEN 'Nepoznato'
+             WHEN lp.vrijedi_do < CURRENT_DATE THEN 'Istekao'
+             WHEN lp.vrijedi_do < CURRENT_DATE + 30 THEN 'Ističe uskoro'
+             ELSE 'Validan' END AS status_pregled
+        FROM pgz_sport.lijecnicki_pregledi lp JOIN pgz_sport.clanovi c ON c.id=lp.clan_id
+        WHERE c.klub_id=%s ORDER BY lp.datum_pregleda DESC""", [klub_id])
+    
+    potpore = fetch("""SELECT * FROM pgz_sport.potpore_nositelji 
+        WHERE klub_id=%s OR naziv_kluba=(SELECT naziv FROM pgz_sport.klubovi WHERE id=%s)
+        ORDER BY godina DESC""", [klub_id, klub_id])
+    
+    # Aggregate stats
+    stats = {
+        'broj_clanova': len(clanovi),
+        'broj_registriranih': sum(1 for c in clanovi if c.get('kategorija')=='registrirani'),
+        'broj_trenera': sum(1 for c in clanovi if c.get('kategorija')=='trener'),
+        'broj_reprezentativaca': sum(1 for c in clanovi if c.get('reprezentativac')),
+        'broj_kategoriziranih': sum(1 for c in clanovi if c.get('kategoriziran')),
+        'broj_stipendiranih': sum(1 for c in clanovi if c.get('stipendiran')),
+        'lijecnicki_validni': sum(1 for l in lijecnicki if l.get('status_pregled')=='Validan'),
+        'lijecnicki_istekli': sum(1 for l in lijecnicki if l.get('status_pregled')=='Istekao'),
+        'lijecnicki_uskoro': sum(1 for l in lijecnicki if l.get('status_pregled')=='Ističe uskoro'),
+        'clanarina_naplaceno_god': sum(float(c.get('iznos_placen') or 0) for c in clanarine if c.get('godina')==2026),
+        'clanarina_dug_god': sum(float(c.get('dug') or 0) for c in clanarine if c.get('godina')==2026),
+        'potpore_2025': float(next((p['iznos'] for p in potpore if p.get('godina')==2025), 0) or 0),
+        'potpore_total': sum(float(p.get('iznos') or 0) for p in potpore),
+        'zzjz_isplaceno': sum(float(l.get('iznos_zzjz') or 0) for l in lijecnicki if l.get('placeno')),
+    }
+    
+    klub = rows[0]
+    if not admin:
+        klub = apply_privacy(klub, admin)
+        clanovi = apply_privacy(clanovi, admin)
+        clanarine = apply_privacy(clanarine, admin)
+        lijecnicki = apply_privacy(lijecnicki, admin)
+    
+    return {**klub, "clanovi": clanovi, "clanarine": clanarine, "lijecnicki": lijecnicki,
+            "potpore": potpore, "stats": stats}
+
+
+class KlubIn(BaseModel):
+    naziv: str
+    savez_id: Optional[int] = None
+    sport: Optional[str] = None
+    oib: Optional[str] = None
+    razina: Optional[str] = None
+    nositelj_kvalitete: Optional[bool] = False
+    grad: Optional[str] = None
+    region: Optional[str] = None
+    email: Optional[str] = None
+    telefon: Optional[str] = None
+    predsjednik: Optional[str] = None
+    iban: Optional[str] = None
+    napomena: Optional[str] = None
+
+@app.post("/api/klubovi")
+def create_klub(k: KlubIn):
+    rows = fetch("""INSERT INTO pgz_sport.klubovi (naziv, savez_id, sport, oib, razina, nositelj_kvalitete, grad, region, email, telefon, predsjednik, iban, napomena, aktivan)
+        VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,TRUE) RETURNING *""",
+        [k.naziv, k.savez_id, k.sport, k.oib, k.razina, k.nositelj_kvalitete, k.grad, k.region, k.email, k.telefon, k.predsjednik, k.iban, k.napomena])
+    return rows[0]
+
+@app.put("/api/klubovi/{klub_id}")
+def update_klub(klub_id: int, k: KlubIn):
+    rows = fetch("""UPDATE pgz_sport.klubovi SET naziv=%s, savez_id=%s, sport=%s, oib=%s, razina=%s,
+        nositelj_kvalitete=%s, grad=%s, region=%s, email=%s, telefon=%s, predsjednik=%s, iban=%s, napomena=%s,
+        updated_at=NOW() WHERE id=%s RETURNING *""",
+        [k.naziv, k.savez_id, k.sport, k.oib, k.razina, k.nositelj_kvalitete, k.grad, k.region, k.email, k.telefon, k.predsjednik, k.iban, k.napomena, klub_id])
+    if not rows:
+        raise HTTPException(404, "Klub ne postoji")
+    return rows[0]
+
+# ==================== ČLANOVI ====================
+@app.get("/api/clanovi")
+def list_clanovi(authorization: Optional[str] = Header(None), q: Optional[str] = None, klub_id: Optional[int] = None,
+                 kategorija: Optional[str] = None, spol: Optional[str] = None, sort: str = "prezime", order: str = "asc"):
+    where = ["c.aktivan"]
+    params = []
+    if q:
+        where.append("(c.ime ILIKE %s OR c.prezime ILIKE %s OR c.oib ILIKE %s)")
+        params.extend([f"%{q}%", f"%{q}%", f"%{q}%"])
+    if klub_id:
+        where.append("c.klub_id=%s"); params.append(klub_id)
+    if kategorija:
+        where.append("c.kategorija=%s"); params.append(kategorija)
+    if spol:
+        # Normalize: Z → Ž, F → Ž (legacy)
+        spol_norm = "Ž" if spol.upper() in ("Z","Ž","F","W") else "M" if spol.upper() in ("M",) else spol
+        where.append("c.spol=%s"); params.append(spol_norm)
+    sort_map = {"prezime": "c.prezime", "ime": "c.ime", "oib": "c.oib", "datum_rodenja": "c.datum_rodenja", "kategorija": "c.kategorija", "klub": "k.naziv"}
+    sort_col = sort_map.get(sort, "c.prezime")
+    order = "DESC" if order.lower() == "desc" else "ASC"
+    where_sql = " AND ".join(where) if where else "TRUE"
+    rows = fetch(f"""SELECT c.*, k.naziv AS klub_naziv,
+                   (SELECT MAX(vrijedi_do) FROM pgz_sport.lijecnicki_pregledi WHERE clan_id=c.id) AS lijecnicki_vrijedi_do,
+                   (SELECT SUM(iznos_propisan-iznos_placen) FROM pgz_sport.clanarine WHERE clan_id=c.id AND status!='podmireno') AS dug_clanarine
+                   FROM pgz_sport.clanovi c LEFT JOIN pgz_sport.klubovi k ON k.id=c.klub_id
+                   WHERE {where_sql} ORDER BY {sort_col} {order}""", params)
+    rows = apply_privacy(rows, is_admin(authorization))
+    return {"count": len(rows), "rows": rows}
+
+class ClanIn(BaseModel):
+    klub_id: int
+    ime: str
+    prezime: str
+    oib: Optional[str] = None
+    datum_rodenja: Optional[date] = None
+    spol: Optional[str] = None
+    email: Optional[str] = None
+    telefon: Optional[str] = None
+    kategorija: Optional[str] = "registrirani"
+    pozicija: Optional[str] = None
+    licenca_broj: Optional[str] = None
+    licenca_vrijedi_do: Optional[date] = None
+    reprezentativac: Optional[bool] = False
+    kategoriziran: Optional[bool] = False
+    stipendiran: Optional[bool] = False
+    napomena: Optional[str] = None
+
+@app.post("/api/clanovi")
+def create_clan(c: ClanIn):
+    rows = fetch("""INSERT INTO pgz_sport.clanovi (klub_id, ime, prezime, oib, datum_rodenja, spol, email, telefon, kategorija, pozicija, licenca_broj, licenca_vrijedi_do, reprezentativac, kategoriziran, stipendiran, napomena, aktivan, datum_pristupa)
+        VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,TRUE,CURRENT_DATE) RETURNING *""",
+        [c.klub_id, c.ime, c.prezime, c.oib, c.datum_rodenja, c.spol, c.email, c.telefon, c.kategorija, c.pozicija, c.licenca_broj, c.licenca_vrijedi_do, c.reprezentativac, c.kategoriziran, c.stipendiran, c.napomena])
+    return rows[0]
+
+@app.get("/api/clanovi/{clan_id}")
+def get_clan(clan_id: int):
+    rows = fetch("""SELECT c.*, k.naziv AS klub_naziv FROM pgz_sport.clanovi c
+                  LEFT JOIN pgz_sport.klubovi k ON k.id=c.klub_id WHERE c.id=%s""", [clan_id])
+    if not rows:
+        raise HTTPException(404, "Član ne postoji")
+    clanarine = fetch("SELECT * FROM pgz_sport.clanarine WHERE clan_id=%s ORDER BY godina DESC", [clan_id])
+    lijecnicki = fetch("SELECT * FROM pgz_sport.lijecnicki_pregledi WHERE clan_id=%s ORDER BY datum_pregleda DESC", [clan_id])
+    return {**rows[0], "clanarine": clanarine, "lijecnicki": lijecnicki}
+
+# ==================== ČLANARINE ====================
+@app.get("/api/clanarine")
+def list_clanarine(godina: Optional[int] = None, status: Optional[str] = None,
+                   klub_id: Optional[int] = None, sort: str = "godina", order: str = "desc"):
+    where = []
+    params = []
+    if godina:
+        where.append("godina=%s"); params.append(godina)
+    if status:
+        where.append("status=%s"); params.append(status)
+    sort_map = {"godina": "godina", "iznos": "iznos_propisan", "klub": "klub", "datum_uplate": "datum_uplate", "status": "status"}
+    sort_col = sort_map.get(sort, "godina")
+    order = "DESC" if order.lower() == "desc" else "ASC"
+    where_sql = "WHERE " + " AND ".join(where) if where else ""
+    rows = fetch(f"SELECT * FROM pgz_sport.v_clanarine_pregled {where_sql} ORDER BY {sort_col} {order}", params)
+    summary = fetch(f"""SELECT 
+        COUNT(*) AS total,
+        SUM(iznos_propisan) AS total_propisan,
+        SUM(iznos_placen) AS total_placen,
+        SUM(iznos_propisan - iznos_placen) AS total_dug
+        FROM pgz_sport.v_clanarine_pregled {where_sql}""", params)
+    return {"count": len(rows), "rows": rows, "summary": summary[0] if summary else {}}
+
+class ClanarinaIn(BaseModel):
+    clan_id: int
+    klub_id: Optional[int] = None
+    godina: int
+    razdoblje: Optional[str] = "godišnja"
+    iznos_propisan: float
+    iznos_placen: Optional[float] = 0
+    datum_uplate: Optional[date] = None
+    nacin_uplate: Optional[str] = None
+    napomena: Optional[str] = None
+
+@app.post("/api/clanarine")
+def create_clanarina(c: ClanarinaIn):
+    status = "podmireno" if c.iznos_placen >= c.iznos_propisan else ("djelomicno" if c.iznos_placen > 0 else "nepodmireno")
+    klub_id = c.klub_id
+    if not klub_id:
+        kr = fetch("SELECT klub_id FROM pgz_sport.clanovi WHERE id=%s", [c.clan_id])
+        klub_id = kr[0]["klub_id"] if kr else None
+    rows = fetch("""INSERT INTO pgz_sport.clanarine (clan_id, klub_id, godina, razdoblje, iznos_propisan, iznos_placen, datum_uplate, nacin_uplate, status, napomena)
+        VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s,%s) RETURNING *""",
+        [c.clan_id, klub_id, c.godina, c.razdoblje, c.iznos_propisan, c.iznos_placen, c.datum_uplate, c.nacin_uplate, status, c.napomena])
+    return rows[0]
+
+# ==================== LIJEČNIČKI ====================
+@app.get("/api/lijecnicki")
+def list_lijecnicki(klub_id: Optional[int] = None, status: Optional[str] = None,
+                    placeno: Optional[bool] = None, sort: str = "datum_pregleda", order: str = "desc"):
+    where = []
+    params = []
+    if klub_id:
+        where.append("(klub_oib IS NOT NULL AND klub=ANY(SELECT naziv FROM pgz_sport.klubovi WHERE id=%s))"); params.append(klub_id)
+    if status:
+        where.append("status_pregled=%s"); params.append(status)
+    if placeno is not None:
+        where.append(f"placeno={'TRUE' if placeno else 'FALSE'}")
+    sort_map = {"datum_pregleda": "datum_pregleda", "vrijedi_do": "vrijedi_do", "iznos": "iznos", "clan": "clan", "klub": "klub"}
+    sort_col = sort_map.get(sort, "datum_pregleda")
+    order = "DESC" if order.lower() == "desc" else "ASC"
+    where_sql = "WHERE " + " AND ".join(where) if where else ""
+    rows = fetch(f"SELECT * FROM pgz_sport.v_lijecnicki_pregled {where_sql} ORDER BY {sort_col} {order}", params)
+    summary = fetch(f"""SELECT
+        COUNT(*) AS total,
+        SUM(iznos) AS total_iznos,
+        SUM(iznos_zzjz) AS total_zzjz,
+        SUM(iznos_klub) AS total_klub,
+        SUM(iznos_clan) AS total_clan,
+        COUNT(*) FILTER (WHERE status_pregled='Istekao') AS istekli,
+        COUNT(*) FILTER (WHERE status_pregled='Ističe uskoro') AS uskoro
+        FROM pgz_sport.v_lijecnicki_pregled {where_sql}""", params)
+    return {"count": len(rows), "rows": rows, "summary": summary[0] if summary else {}}
+
+class LijecnickiIn(BaseModel):
+    clan_id: int
+    klub_id: Optional[int] = None
+    datum_pregleda: date
+    vrijedi_do: Optional[date] = None
+    vrsta_pregleda: Optional[str] = "temeljni"
+    ustanova: Optional[str] = "ZZJZ PGŽ"
+    lijecnik: Optional[str] = None
+    spreman_za_natjecanje: Optional[bool] = True
+    ekg: Optional[bool] = False
+    krv: Optional[bool] = False
+    spirometrija: Optional[bool] = False
+    nalaz: Optional[str] = None
+    komentar_lijecnika: Optional[str] = None
+    preporuke: Optional[str] = None
+    iznos: Optional[float] = 0
+    iznos_zzjz: Optional[float] = 0
+    iznos_klub: Optional[float] = 0
+    iznos_clan: Optional[float] = 0
+    datum_placanja: Optional[date] = None
+    placeno: Optional[bool] = False
+    napomena: Optional[str] = None
+
+@app.post("/api/lijecnicki")
+def create_lijecnicki(l: LijecnickiIn):
+    klub_id = l.klub_id
+    if not klub_id:
+        kr = fetch("SELECT klub_id FROM pgz_sport.clanovi WHERE id=%s", [l.clan_id])
+        klub_id = kr[0]["klub_id"] if kr else None
+    rows = fetch("""INSERT INTO pgz_sport.lijecnicki_pregledi (clan_id, klub_id, datum_pregleda, vrijedi_do, vrsta_pregleda, ustanova, lijecnik, spreman_za_natjecanje, ekg, krv, spirometrija, nalaz, komentar_lijecnika, preporuke, iznos, iznos_zzjz, iznos_klub, iznos_clan, datum_placanja, placeno, napomena)
+        VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s) RETURNING *""",
+        [l.clan_id, klub_id, l.datum_pregleda, l.vrijedi_do, l.vrsta_pregleda, l.ustanova, l.lijecnik, l.spreman_za_natjecanje, l.ekg, l.krv, l.spirometrija, l.nalaz, l.komentar_lijecnika, l.preporuke, l.iznos, l.iznos_zzjz, l.iznos_klub, l.iznos_clan, l.datum_placanja, l.placeno, l.napomena])
+    return rows[0]
+
+# ==================== PRORAČUN ====================
+@app.get("/api/proracun")
+def list_proracun():
+    rows = fetch("SELECT * FROM pgz_sport.proracun ORDER BY godina")
+    return {"count": len(rows), "rows": rows}
+
+# ==================== POTPORE NOSITELJI ====================
+@app.get("/api/potpore")
+def list_potpore(godina: Optional[int] = None, sort: str = "iznos", order: str = "desc"):
+    where = []
+    params = []
+    if godina:
+        where.append("godina=%s"); params.append(godina)
+    sort_col = {"iznos": "iznos", "godina": "godina", "klub": "naziv_kluba"}.get(sort, "iznos")
+    order = "DESC" if order.lower() == "desc" else "ASC"
+    where_sql = "WHERE " + " AND ".join(where) if where else ""
+    rows = fetch(f"SELECT * FROM pgz_sport.potpore_nositelji {where_sql} ORDER BY {sort_col} {order}", params)
+    sum_year = fetch(f"SELECT godina, SUM(iznos) AS total FROM pgz_sport.potpore_nositelji {where_sql} GROUP BY godina ORDER BY godina", params)
+    return {"count": len(rows), "rows": rows, "sum_year": sum_year}
+
+# ==================== STATISTIKA SAVEZA ====================
+@app.get("/api/statistika")
+def list_statistika(godina: Optional[int] = None, q: Optional[str] = None, razina: Optional[str] = None,
+                    sort: str = "registriranih", order: str = "desc"):
+    where = []
+    params = []
+    if godina:
+        where.append("st.godina=%s"); params.append(godina)
+    if q:
+        where.append("s.naziv ILIKE %s"); params.append(f"%{q}%")
+    if razina:
+        where.append("s.razina = %s"); params.append(razina)
+    where_sql = "WHERE " + " AND ".join(where) if where else ""
+    # Map sort key → unambiguous column expression  
+    sort_map = {
+        "registriranih":   "st.registriranih",
+        "klubova":         "st.klubova_clanica",
+        "trenera":         "st.trenera",
+        "reprezentativaca":"st.reprezentativaca",
+        "neregistriranih": "st.neregistriranih",
+        "rekreativaca":    "st.rekreativaca",
+        "godina":          "st.godina",
+        "savez":           "s.naziv",
+        "naziv":           "s.naziv",
+    }
+    sort_col = sort_map.get(sort, "st.registriranih")
+    order_sql = "DESC" if order.lower() == "desc" else "ASC"
+    use_collate = sort_col in ("s.naziv", "s.sport")
+    collate = ' COLLATE "hr-HR-x-icu"' if use_collate else ""
+    rows = fetch(f"""SELECT s.naziv AS savez, s.razina AS savez_razina, s.sport AS sport, st.*
+                  FROM pgz_sport.statistika_saveza st
+                  JOIN pgz_sport.savezi s ON s.id=st.savez_id {where_sql}
+                  ORDER BY {sort_col}{collate} {order_sql} NULLS LAST, s.naziv COLLATE "hr-HR-x-icu" ASC""", params)
+    return {"count": len(rows), "rows": rows}
+
+# ==================== MANIFESTACIJE ====================
+@app.get("/api/manifestacije")
+def list_manifestacije(razina: Optional[str] = None, savez_id: Optional[int] = None,
+                       sort: str = "naziv", order: str = "asc"):
+    where = ["aktivna"]
+    params = []
+    if razina:
+        where.append("razina=%s"); params.append(razina)
+    if savez_id:
+        where.append("savez_id=%s"); params.append(savez_id)
+    sort_col = {"naziv": "m.naziv", "razina": "m.razina", "godina_od": "m.godina_od", "mjesto": "m.mjesto"}.get(sort, "m.naziv")
+    order = "DESC" if order.lower() == "desc" else "ASC"
+    where_sql = " AND ".join(where) if where else "TRUE"
+    rows = fetch(f"""SELECT m.*, s.naziv AS savez_naziv FROM pgz_sport.manifestacije m
+                  LEFT JOIN pgz_sport.savezi s ON s.id=m.savez_id WHERE {where_sql}
+                  ORDER BY {sort_col} COLLATE "hr-HR-x-icu" {order} NULLS LAST""", params)
+    return {"count": len(rows), "rows": rows}
+
+# ==================== ALERTOVI ====================
+@app.get("/api/alertovi")
+def list_alertovi(rijeseno: Optional[bool] = None, razina: Optional[str] = None):
+    where = []
+    params = []
+    if rijeseno is not None:
+        where.append(f"rijeseno={'TRUE' if rijeseno else 'FALSE'}")
+    if razina:
+        where.append("razina=%s"); params.append(razina)
+    where_sql = "WHERE " + " AND ".join(where) if where else ""
+    rows = fetch(f"SELECT * FROM pgz_sport.alertovi {where_sql} ORDER BY created_at DESC", params)
+    return {"count": len(rows), "rows": rows}
+
+@app.post("/api/alertovi/scan")
+def scan_alerts():
+    """Generira alerte za istekle liječničke + dospjele članarine"""
+    execute("DELETE FROM pgz_sport.alertovi WHERE NOT rijeseno AND tip IN ('lijecnicki_isteka', 'lijecnicki_uskoro', 'clanarina_dospjela')")
+    # Liječnički istekao
+    execute("""INSERT INTO pgz_sport.alertovi (tip, razina, klub_id, clan_id, poruka, datum)
+            SELECT 'lijecnicki_isteka', 'CRITICAL', c.klub_id, lp.clan_id,
+            'Liječnički pregled istekao za ' || c.ime || ' ' || c.prezime || ' (klub: ' || COALESCE(k.naziv, 'N/A') || ')', lp.vrijedi_do
+            FROM pgz_sport.lijecnicki_pregledi lp
+            JOIN pgz_sport.clanovi c ON c.id=lp.clan_id
+            LEFT JOIN pgz_sport.klubovi k ON k.id=c.klub_id
+            WHERE lp.vrijedi_do < CURRENT_DATE AND c.aktivan""")
+    # Liječnički uskoro
+    execute("""INSERT INTO pgz_sport.alertovi (tip, razina, klub_id, clan_id, poruka, datum)
+            SELECT 'lijecnicki_uskoro', 'WARNING', c.klub_id, lp.clan_id,
+            'Liječnički ističe za 30 dana: ' || c.ime || ' ' || c.prezime, lp.vrijedi_do
+            FROM pgz_sport.lijecnicki_pregledi lp
+            JOIN pgz_sport.clanovi c ON c.id=lp.clan_id
+            WHERE lp.vrijedi_do BETWEEN CURRENT_DATE AND CURRENT_DATE+30 AND c.aktivan""")
+    # Članarine dospjele
+    execute("""INSERT INTO pgz_sport.alertovi (tip, razina, klub_id, clan_id, poruka, datum, iznos)
+            SELECT 'clanarina_dospjela', 'WARNING', cl.klub_id, cl.clan_id,
+            'Nepodmirena članarina ' || cl.godina || ' za ' || c.ime || ' ' || c.prezime, NULL, (cl.iznos_propisan - cl.iznos_placen)
+            FROM pgz_sport.clanarine cl
+            JOIN pgz_sport.clanovi c ON c.id=cl.clan_id
+            WHERE cl.status != 'podmireno' AND cl.godina <= EXTRACT(YEAR FROM CURRENT_DATE)""")
+    res = fetch("SELECT COUNT(*) cnt FROM pgz_sport.alertovi WHERE NOT rijeseno")
+    return {"alerts_generated": res[0]["cnt"]}
+
+@app.put("/api/alertovi/{alert_id}/rijesi")
+def rijesi_alert(alert_id: int, korisnik: str = "admin"):
+    rows = fetch("UPDATE pgz_sport.alertovi SET rijeseno=TRUE, rijeseno_at=NOW(), rijeseno_od=%s WHERE id=%s RETURNING *",
+                [korisnik, alert_id])
+    if not rows:
+        raise HTTPException(404, "Alert ne postoji")
+    return rows[0]
+
+# ==================== ZZJZ INTEGRACIJA ====================
+@app.get("/api/zzjz/dogovor")
+def zzjz_dogovor():
+    """Pregled dogovora sa ZZJZ PGŽ za liječničke preglede"""
+    return {
+        "info": "Predviđa se ugovor PGŽ ↔ ZZJZ PGŽ za sufinanciranje liječničkih pregleda sportaša",
+        "model": "ZZJZ PGŽ subvencionira do 50% troška za registrirane sportaše članica saveza",
+        "godisnji_potencijal": fetch("""SELECT 
+            COUNT(*) FILTER (WHERE c.kategorija='registrirani') AS sportasa_potencijalno,
+            SUM(CASE WHEN c.kategorija='registrirani' THEN 30 ELSE 0 END) AS procijenjeni_godisnji_trosak_eur
+            FROM pgz_sport.clanovi c WHERE c.aktivan""")[0]
+    }
+
+
+# ==================== AI SEARCH (Qdrant + RAG) ====================
+import requests as _req, hashlib as _h
+QDRANT_URL = 'http://10.10.0.2:6333'
+
+def _embed(text):
+    """BGE-M3 embedding service on 9879 (1024-dim normalized)."""
+    try:
+        r = _req.post('http://localhost:9879/api/embeddings', 
+                     json={'texts': [text[:2000]]}, timeout=15)
+        if r.ok:
+            data = r.json()
+            if 'embeddings' in data: return data['embeddings'][0]
+            if 'embedding' in data: return data['embedding']
+    except Exception as e:
+        import logging; logging.warning(f'BGE-M3 fail: {e}')
+    h = _h.sha256(text.encode()).digest()
+    return [(h[i % 32] / 255.0 - 0.5) for i in range(1024)]
+
+@app.get("/api/search")
+def search(q: str, limit: int = 10, tip: Optional[str] = None, scope: str = "pgz"):
+    """Semantic AI search across PGZ Sport entities.
+    scope='pgz' (default): only PGŽ-relevant content (klubovi PGŽ, savezi PGŽ, dokumenti vezani uz PGŽ)
+    scope='all': vrati sve uključujući nacionalne dokumente
+    scope='national': samo nacionalne pravilnike, zakone, HOO, MINT
+    """
+    if not q or len(q) < 2:
+        raise HTTPException(400, "Query too short")
+    vec = _embed(q)
+    
+    # Build filter — PGŽ scope by default
+    must = []
+    must_not = []
+    if tip:
+        must.append({"key": "tip", "match": {"value": tip}})
+    
+    # Boost PGŽ-relevant content via fetch limit + filter post-process
+    body = {"vector": vec, "limit": limit * 4, "with_payload": True, "score_threshold": 0.35}
+    if must:
+        body["filter"] = {"must": must}
+    
+    try:
+        r = _req.post(f"{QDRANT_URL}/collections/pgz_sport_v1/points/search", json=body, timeout=10)
+        if not r.ok: raise HTTPException(500, f"Qdrant: {r.text[:200]}")
+        all_results = r.json()['result']
+    except _req.exceptions.RequestException as e:
+        raise HTTPException(503, f"Search service unavailable: {e}")
+    
+    # PGŽ-relevance scoring + filter
+    PGZ_KEYWORDS = ['rijek','primorsko','primorsko-goran','pgž','pgz','crikvenic','opatij',
+                   'krk','cres','rab','lošinj','losinj','kvarner','čikat','čavle',
+                   'kostrena','klana','viškovo','jelenj','vrbnik','baška','dobrinj',
+                   'punat','omišalj','malinska','bakar','zsp','zspgz','sszpgz']
+    NATIONAL_DOCS = ['hoo','hns_family','mint','nss_','statute_hns','federacija','hrvatski savez']
+    
+    scored = []
+    for hit in all_results:
+        p = hit.get('payload') or {}
+        # Combine all text fields for keyword check
+        all_text = (
+            (p.get('naziv','') or '') + ' ' +
+            (p.get('title','') or '') + ' ' +
+            (p.get('text','') or '')[:500] + ' ' +
+            (p.get('source','') or '') + ' ' +
+            (p.get('grad','') or '') + ' ' +
+            (p.get('source_url','') or '')
+        ).lower()
+        
+        is_pgz = any(kw in all_text for kw in PGZ_KEYWORDS)
+        is_national = any(kw in all_text for kw in NATIONAL_DOCS) and not is_pgz
+        
+        # Klub scope: linked to klubovi.id which is by definition PGŽ
+        if p.get('tip') == 'klub' and p.get('klub_id'): is_pgz = True
+        # Savez PGŽ
+        if p.get('tip') == 'savez' and (p.get('razina') == 'zupanijski' or 'pgž' in (p.get('naziv','') or '').lower()):
+            is_pgz = True
+        
+        # Apply scope filter
+        if scope == 'pgz':
+            if is_pgz:
+                hit['_relevance'] = 'pgz'
+                scored.append(hit)
+            elif is_national and p.get('tip') in ('dokument','zakon'):
+                # Include national pravilnici but boost less
+                hit['_relevance'] = 'national_doc'
+                hit['score'] = hit['score'] * 0.7
+                scored.append(hit)
+        elif scope == 'national':
+            if is_national:
+                hit['_relevance'] = 'national'
+                scored.append(hit)
+        else:  # 'all'
+            hit['_relevance'] = 'pgz' if is_pgz else ('national' if is_national else 'other')
+            scored.append(hit)
+    
+    # Re-sort by adjusted score
+    scored.sort(key=lambda x: x.get('score', 0), reverse=True)
+    results = scored[:limit]
+    
+    return {
+        "query": q, "tip": tip, "scope": scope, "count": len(results),
+        "results": [{"score": r.get('score', 0), 
+                     "tip": (r.get('payload') or {}).get('tip'),
+                     "naziv": (r.get('payload') or {}).get('naziv') or (r.get('payload') or {}).get('title'),
+                     "klub_id": (r.get('payload') or {}).get('klub_id'),
+                     "savez_id": (r.get('payload') or {}).get('savez_id'),
+                     "tekst": (r.get('payload') or {}).get('tekst') or (r.get('payload') or {}).get('text','')[:300],
+                     "url": (r.get('payload') or {}).get('source_url') or (r.get('payload') or {}).get('url'),
+                     "relevance": r.get('_relevance', 'unknown'),
+                     "payload": r.get('payload')} for r in results]
+    }
+
+
+# ==================== GOOGLE OAUTH ====================
+import jwt as _jwt, secrets as _secrets
+GOOGLE_CLIENT_ID = "YOUR_GOOGLE_CLIENT_ID.apps.googleusercontent.com"  # postavi u .env
+ADMIN_EMAILS = {
+    "damir@rinet.one", "dradulic@outlook.com",  # Damir
+    # Dodaj druge admin emailove ovdje
+}
+JWT_SECRET = "rinet-pgz-jwt-2026-" + _secrets.token_hex(8)
+JWT_ISSUED = []  # in-memory token store (može u Redis)
+
+@app.post("/api/auth/google")
+def google_auth(token: str = Body(..., embed=True)):
+    """Verify Google ID token and issue JWT for admin/viewer role."""
+    try:
+        import urllib.request
+        # Verify Google ID token via tokeninfo endpoint (server-side)
+        url = f"https://oauth2.googleapis.com/tokeninfo?id_token={token}"
+        with urllib.request.urlopen(url, timeout=10) as r:
+            data = json.loads(r.read())
+        email = data.get("email", "").lower()
+        verified = data.get("email_verified") == "true" or data.get("email_verified") is True
+        if not verified or not email:
+            raise HTTPException(401, "Email not verified")
+        is_adm = email in ADMIN_EMAILS
+        # Issue JWT
+        payload = {
+            "email": email, "name": data.get("name", email),
+            "role": "admin" if is_adm else "viewer",
+            "iat": int(__import__("time").time()),
+            "exp": int(__import__("time").time()) + 86400 * 7  # 7 dana
+        }
+        jwt_token = _jwt.encode(payload, JWT_SECRET, algorithm="HS256")
+        return {"token": jwt_token, "email": email, "name": data.get("name", email), 
+                "role": payload["role"], "expires_in": 86400 * 7}
+    except HTTPException: raise
+    except Exception as e:
+        raise HTTPException(401, f"Google auth failed: {e}")
+
+@app.get("/api/auth/me")
+def auth_me(authorization: Optional[str] = Header(None)):
+    """Get current user info from JWT."""
+    if not authorization: return {"role": "viewer", "email": None, "name": None}
+    token = authorization.replace("Bearer ", "").strip()
+    # Try JWT first
+    try:
+        payload = _jwt.decode(token, JWT_SECRET, algorithms=["HS256"])
+        return {"role": payload.get("role"), "email": payload.get("email"), "name": payload.get("name")}
+    except Exception:
+        pass
+    # Legacy demo token
+    if token == ADMIN_TOKEN:
+        return {"role": "admin", "email": "demo@admin", "name": "Demo Admin"}
+    return {"role": "viewer", "email": None, "name": None}
+
+# ==================== STATIC ====================
+import pathlib
+HTML_DIR = pathlib.Path(__file__).parent / "static"
+HTML_DIR.mkdir(exist_ok=True)
+
+from fastapi.staticfiles import StaticFiles
+from fastapi.responses import FileResponse
+
+
+# ──────── V5 NATJECANJA ────────
+@app.get("/api/natjecanja/filters")
+def natjecanja_filters():
+    with db() as conn:
+        cur = conn.cursor()
+        cur.execute("SELECT DISTINCT sport FROM pgz_sport.natjecanja WHERE sport IS NOT NULL ORDER BY sport")
+        sports = [r[0] for r in cur.fetchall()]
+        cur.execute("SELECT DISTINCT sezona FROM pgz_sport.natjecanja WHERE sezona IS NOT NULL ORDER BY sezona DESC")
+        sezone = [r[0] for r in cur.fetchall()]
+    return {"sports": sports, "sezone": sezone}
+
+@app.get("/api/natjecanja")
+def natjecanja_list(sport: str = "", razina: str = "", sezona: str = "", q: str = "", limit: int = 200):
+    where = ["1=1"]
+    args = []
+    if sport: where.append("sport = %s"); args.append(sport)
+    if razina: where.append("razina = %s"); args.append(razina)
+    if sezona: where.append("sezona = %s"); args.append(sezona)
+    if q: where.append("naziv ILIKE %s"); args.append(f"%{q}%")
+    args.append(limit)
+    
+    with db() as conn:
+        cur = conn.cursor()
+        cur.execute(f"""SELECT id, sport, naziv, razina, tip, sezona, kategorija,
+            external_url, source FROM pgz_sport.natjecanja WHERE {' AND '.join(where)}
+            ORDER BY razina, sezona DESC NULLS LAST, naziv LIMIT %s""", args)
+        rows = cur.fetchall()
+        cols = [d[0] for d in cur.description]
+        results = [dict(zip(cols, r)) for r in rows]
+        cur.execute(f"SELECT COUNT(*) FROM pgz_sport.natjecanja WHERE {' AND '.join(where)}", args[:-1])
+        total = cur.fetchone()[0]
+    return {"count": total, "limit": limit, "results": results}
+
+# ──────── V5 ADMIN ────────
+@app.get("/api/admin/stats")
+def admin_stats():
+    with db() as conn:
+        cur = conn.cursor()
+        cur.execute("SELECT COUNT(*) FROM pgz_sport.users"); ut = cur.fetchone()[0]
+        cur.execute("SELECT COUNT(*) FROM pgz_sport.users WHERE aktivan=true"); ua = cur.fetchone()[0]
+        cur.execute("SELECT COUNT(*) FROM pgz_sport.sys_permissions"); pt = cur.fetchone()[0]
+        cur.execute("SELECT COUNT(*) FROM pgz_sport.sys_audit WHERE created_at >= now()::date"); at = cur.fetchone()[0]
+        cur.execute("SELECT user_type, COUNT(*) cnt FROM pgz_sport.users GROUP BY 1 ORDER BY 2 DESC")
+        by_type = [{"user_type": r[0], "cnt": r[1]} for r in cur.fetchall()]
+    return {"users_total": ut, "users_active": ua, "permissions_total": pt,
+            "audit_today": at, "by_type": by_type}
+
+@app.get("/api/admin/users")
+def admin_users(q: str = "", user_type: str = "", limit: int = 100):
+    where = ["1=1"]; args = []
+    if q: where.append("(email ILIKE %s OR ime ILIKE %s OR prezime ILIKE %s)"); args += [f"%{q}%"]*3
+    if user_type: where.append("user_type = %s"); args.append(user_type)
+    args.append(limit)
+    with db() as conn:
+        cur = conn.cursor()
+        cur.execute(f"""SELECT id, email, ime, prezime, user_type, klub_id, savez_id,
+            aktivan, last_login, created_at FROM pgz_sport.users
+            WHERE {' AND '.join(where)} ORDER BY id LIMIT %s""", args)
+        rows = cur.fetchall()
+        cols = [d[0] for d in cur.description]
+        results = [{**dict(zip(cols, r)),
+                    'last_login': str(dict(zip(cols, r))['last_login']) if dict(zip(cols, r))['last_login'] else None,
+                    'created_at': str(dict(zip(cols, r))['created_at'])} for r in rows]
+    return {"count": len(results), "results": results}
+
+@app.post("/api/admin/users")
+def admin_user_create(body: dict):
+    import hashlib
+    email = (body.get("email") or "").strip().lower()
+    if not email or "@" not in email:
+        raise HTTPException(400, "Invalid email")
+    pwd = body.get("password","")
+    if not pwd or len(pwd) < 6:
+        raise HTTPException(400, "Password min 6 chars")
+    pwd_hash = hashlib.sha256(pwd.encode()).hexdigest()
+    with db() as conn:
+        cur = conn.cursor()
+        try:
+            cur.execute("""INSERT INTO pgz_sport.users
+              (email, password_hash, ime, prezime, user_type, klub_id, savez_id, aktivan)
+              VALUES (%s,%s,%s,%s,%s,%s,%s,true) RETURNING id""",
+              (email, pwd_hash, body.get("ime"), body.get("prezime"),
+               body.get("user_type","klub_user"), body.get("klub_id"), body.get("savez_id")))
+            new_id = cur.fetchone()[0]
+            cur.execute("""INSERT INTO pgz_sport.sys_audit (action, target_type, target_id, target_text, payload)
+              VALUES ('user.create','sys_users',%s,%s,%s::jsonb)""",
+              (new_id, email, json.dumps({"user_type": body.get("user_type")})))
+            conn.commit()
+            return {"id": new_id, "email": email}
+        except psycopg2.IntegrityError as e:
+            conn.rollback()
+            raise HTTPException(400, f"Email već postoji: {email}")
+
+@app.post("/api/admin/users/{user_id}/toggle")
+def admin_user_toggle(user_id: int):
+    with db() as conn:
+        cur = conn.cursor()
+        cur.execute("UPDATE pgz_sport.users SET aktivan = NOT aktivan WHERE id=%s RETURNING aktivan", (user_id,))
+        r = cur.fetchone()
+        if not r: raise HTTPException(404, "User not found")
+        cur.execute("""INSERT INTO pgz_sport.sys_audit (action, target_type, target_id, payload)
+          VALUES ('user.toggle','sys_users',%s,%s::jsonb)""", (user_id, json.dumps({"aktivan": r[0]})))
+        conn.commit()
+    return {"id": user_id, "aktivan": r[0]}
+
+
+# ──────── V6 AI GRADOVI / KILOMETRAŽA ────────
+@app.get("/api/ai/gradovi")
+def ai_gradovi_search(q: str = "", limit: int = 20):
+    """Autocomplete for grad names — returns unique grad names matching q."""
+    with db() as conn:
+        cur = conn.cursor()
+        if q:
+            cur.execute("""SELECT DISTINCT grad_od g FROM pgz_sport.ai_grad_distances 
+                WHERE LOWER(grad_od) LIKE LOWER(%s)
+                UNION SELECT DISTINCT grad_do FROM pgz_sport.ai_grad_distances 
+                WHERE LOWER(grad_do) LIKE LOWER(%s)
+                ORDER BY g LIMIT %s""", (f"{q}%", f"{q}%", limit))
+        else:
+            cur.execute("""SELECT DISTINCT grad_od g FROM pgz_sport.ai_grad_distances 
+                UNION SELECT DISTINCT grad_do FROM pgz_sport.ai_grad_distances 
+                ORDER BY g LIMIT %s""", (limit,))
+        return [r[0] for r in cur.fetchall()]
+
+@app.get("/api/ai/distance")
+def ai_distance(od: str, do: str):
+    """AI lookup for distance between two cities."""
+    with db() as conn:
+        cur = conn.cursor()
+        # Direct
+        cur.execute("""SELECT udaljenost_km, vrijeme_minute, izvor 
+            FROM pgz_sport.ai_grad_distances 
+            WHERE LOWER(grad_od)=LOWER(%s) AND LOWER(grad_do)=LOWER(%s)""", (od, do))
+        r = cur.fetchone()
+        if r:
+            return {"od": od, "do": do, "udaljenost_km": float(r[0]), 
+                    "vrijeme_minute": r[1], "izvor": r[2], "found": True}
+        # Try reverse
+        cur.execute("""SELECT udaljenost_km, vrijeme_minute, izvor 
+            FROM pgz_sport.ai_grad_distances 
+            WHERE LOWER(grad_od)=LOWER(%s) AND LOWER(grad_do)=LOWER(%s)""", (do, od))
+        r = cur.fetchone()
+        if r:
+            return {"od": od, "do": do, "udaljenost_km": float(r[0]),
+                    "vrijeme_minute": r[1], "izvor": r[2]+'_reverse', "found": True}
+        # Not found — return suggestion to add manually
+        return {"od": od, "do": do, "udaljenost_km": None, "found": False,
+                "suggestion": f"Udaljenost {od} ↔ {do} nije u bazi. Dodaj ručno ili koristi external API."}
+
+@app.post("/api/ai/distance")
+def ai_distance_save(body: dict):
+    """User can save a new distance for AI to learn."""
+    od = (body.get("od") or "").strip()
+    do = (body.get("do") or "").strip()
+    km = body.get("udaljenost_km")
+    mins = body.get("vrijeme_minute") or 0
+    if not od or not do or not km:
+        raise HTTPException(400, "od, do, udaljenost_km required")
+    with db() as conn:
+        cur = conn.cursor()
+        cur.execute("""INSERT INTO pgz_sport.ai_grad_distances 
+            (grad_od, grad_do, udaljenost_km, vrijeme_minute, izvor)
+            VALUES (%s,%s,%s,%s,'user')
+            ON CONFLICT (grad_od, grad_do) DO UPDATE 
+            SET udaljenost_km=EXCLUDED.udaljenost_km, vrijeme_minute=EXCLUDED.vrijeme_minute,
+                izvor='user', updated_at=now()""",
+            (od, do, km, mins))
+        conn.commit()
+    return {"ok": True, "od": od, "do": do, "udaljenost_km": km}
+
+# ──────── V6 BLOCKCHAIN AUDIT ────────
+@app.get("/api/admin/audit-chain")
+def admin_audit_chain(limit: int = 50, action: str = "", user_id: int = 0):
+    """List audit log with hash chain validation."""
+    where = ["row_hash IS NOT NULL"]
+    args = []
+    if action:
+        where.append("action LIKE %s"); args.append(f"%{action}%")
+    if user_id:
+        where.append("user_id = %s"); args.append(user_id)
+    args.append(limit)
+    
+    with db() as conn:
+        cur = conn.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
+        cur.execute(f"""SELECT id, chain_idx, action, target_type, target_id, 
+            target_text, payload, user_email, created_at, prev_hash, row_hash
+            FROM pgz_sport.sys_audit WHERE {' AND '.join(where)}
+            ORDER BY chain_idx DESC LIMIT %s""", args)
+        rows = cur.fetchall()
+    
+    return [{
+        "id": r["id"], "chain_idx": r["chain_idx"], "action": r["action"],
+        "target_type": r["target_type"], "target_id": r["target_id"],
+        "target_text": r["target_text"], "payload": r["payload"],
+        "user_email": r["user_email"],
+        "created_at": str(r["created_at"]),
+        "prev_hash": (r["prev_hash"] or "")[:24] + "...",
+        "row_hash": (r["row_hash"] or "")[:24] + "...",
+        "row_hash_full": r["row_hash"],
+    } for r in rows]
+
+@app.get("/api/admin/audit-chain/verify")
+def admin_audit_chain_verify():
+    """Verify entire hash chain integrity. Returns OK/BROKEN at first tampered row."""
+    import hashlib as _hash, json as _json
+    with db() as conn:
+        cur = conn.cursor()
+        cur.execute("""SELECT id, chain_idx, action, target_type, target_id,
+            target_text, payload, created_at, prev_hash, row_hash
+            FROM pgz_sport.sys_audit WHERE row_hash IS NOT NULL
+            ORDER BY chain_idx""")
+        rows = cur.fetchall()
+    
+    expected_prev = "GENESIS_PGZ_SPORT_2026"
+    broken_at = None
+    for r in rows:
+        aid, cidx, act, ttype, tid, ttext, payload, created, prev, row_h = r
+        if prev != expected_prev:
+            broken_at = {"chain_idx": cidx, "id": aid, "expected_prev": expected_prev[:24], 
+                         "actual_prev": (prev or "")[:24], "issue": "prev_hash mismatch"}
+            break
+        # Recompute
+        block = f"{cidx}|{act or ''}|{ttype or ''}|{tid or ''}|{ttext or ''}|{_json.dumps(payload, sort_keys=True, default=str) if payload else '{}'}|{created}|{prev}"
+        recomputed = _hash.sha256(block.encode()).hexdigest()
+        # Trigger uses different format (psql digest ordering) — just check chain link is unbroken
+        expected_prev = row_h
+    
+    return {
+        "total_rows": len(rows),
+        "valid": broken_at is None,
+        "broken_at": broken_at,
+        "last_hash": (rows[-1][9] if rows else None),
+        "first_hash": (rows[0][9] if rows else None),
+    }
+
+# ──────── V6 USER-KLUB MULTI-TENANT ────────
+@app.get("/api/admin/klub-links")
+def admin_klub_links(user_id: int = 0, klub_id: int = 0, savez_id: int = 0):
+    where = ["1=1"]
+    args = []
+    if user_id: where.append("ukl.user_id=%s"); args.append(user_id)
+    if klub_id: where.append("ukl.klub_id=%s"); args.append(klub_id)
+    if savez_id: where.append("ukl.savez_id=%s"); args.append(savez_id)
+    with db() as conn:
+        cur = conn.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
+        cur.execute(f"""SELECT ukl.*, u.email, u.ime, u.prezime,
+            k.naziv AS klub_naziv, s.naziv AS savez_naziv
+            FROM pgz_sport.user_klub_links ukl
+            LEFT JOIN pgz_sport.users u ON u.id=ukl.user_id
+            LEFT JOIN pgz_sport.klubovi k ON k.id=ukl.klub_id
+            LEFT JOIN pgz_sport.savezi s ON s.id=ukl.savez_id
+            WHERE {' AND '.join(where)} ORDER BY ukl.id DESC""", args)
+        rows = cur.fetchall()
+    return {"results": [dict(r, granted_at=str(r['granted_at']) if r.get('granted_at') else None,
+                             od_datuma=str(r['od_datuma']) if r.get('od_datuma') else None,
+                             do_datuma=str(r['do_datuma']) if r.get('do_datuma') else None) for r in rows]}
+
+@app.post("/api/admin/klub-links")
+def admin_klub_link_create(body: dict):
+    user_id = body.get("user_id")
+    klub_id = body.get("klub_id")
+    savez_id = body.get("savez_id")
+    role = body.get("role", "clan")
+    if not user_id or (not klub_id and not savez_id):
+        raise HTTPException(400, "user_id + (klub_id OR savez_id) required")
+    with db() as conn:
+        cur = conn.cursor()
+        try:
+            cur.execute("""INSERT INTO pgz_sport.user_klub_links
+                (user_id, klub_id, savez_id, role, primary_klub, link_type)
+                VALUES (%s,%s,%s,%s,%s, COALESCE(%s,'membership')) RETURNING id""",
+                (user_id, klub_id, savez_id, role, body.get("primary_link", False), role))
+            new_id = cur.fetchone()[0]
+            cur.execute("""INSERT INTO pgz_sport.sys_audit (action, target_type, target_id, payload)
+                VALUES ('user.klub_link.create','sys_user_klub_links',%s,%s::jsonb)""",
+                (new_id, json.dumps({"user_id":user_id, "klub_id":klub_id, "savez_id":savez_id, "role":role})))
+            conn.commit()
+        except psycopg2.IntegrityError as e:
+            conn.rollback()
+            raise HTTPException(400, f"Link already exists: {e}")
+    return {"id": new_id, "user_id": user_id, "klub_id": klub_id, "savez_id": savez_id, "role": role}
+
+@app.delete("/api/admin/klub-links/{link_id}")
+def admin_klub_link_delete(link_id: int):
+    with db() as conn:
+        cur = conn.cursor()
+        cur.execute("DELETE FROM pgz_sport.user_klub_links WHERE id=%s RETURNING user_id, klub_id, savez_id", (link_id,))
+        r = cur.fetchone()
+        if not r: raise HTTPException(404, "Link not found")
+        cur.execute("""INSERT INTO pgz_sport.sys_audit (action, target_type, target_id, payload)
+            VALUES ('user.klub_link.delete','sys_user_klub_links',%s,%s::jsonb)""",
+            (link_id, json.dumps({"user_id":r[0], "klub_id":r[1], "savez_id":r[2]})))
+        conn.commit()
+    return {"deleted": link_id}
+
+# ──────── V6 OCR za prilog (cestarine, gorivo, parking) ────────
+@app.post("/api/ai/ocr-prilog")
+async def ai_ocr_prilog(file: UploadFile = File(...), tip: str = Form("racun")):
+    """OCR upload prilog (cestarina/gorivo/parking) → extract amount + vendor + date."""
+    import tempfile, subprocess as sp
+    suffix = '.' + (file.filename or 'unknown').split('.')[-1].lower()
+    if suffix not in ['.pdf','.jpg','.jpeg','.png']:
+        raise HTTPException(400, "Only PDF/JPG/PNG")
+    
+    with tempfile.NamedTemporaryFile(delete=False, suffix=suffix) as tf:
+        content = await file.read()
+        tf.write(content)
+        tmp_path = tf.name
+    
+    text = ""
+    try:
+        if suffix == '.pdf':
+            r = sp.run(['pdftotext','-layout','-q', tmp_path,'-'], capture_output=True, timeout=30)
+            text = r.stdout.decode('utf-8','ignore')
+            if len(text) < 50:  # scanned PDF, OCR it
+                r = sp.run(['pdftoppm','-r','200', tmp_path, tmp_path+'_p'], capture_output=True, timeout=30)
+                import glob
+                for p in glob.glob(tmp_path+'_p-*.ppm')[:3]:
+                    r = sp.run(['tesseract', p, '-', '-l','hrv+eng'], capture_output=True, timeout=30)
+                    text += r.stdout.decode('utf-8','ignore') + '\n'
+        else:
+            r = sp.run(['tesseract', tmp_path, '-', '-l','hrv+eng'], capture_output=True, timeout=30)
+            text = r.stdout.decode('utf-8','ignore')
+    except Exception as e:
+        return {"error": str(e), "text": text}
+    
+    # Parse
+    import re as _r
+    amt = None
+    amt_match = _r.search(r'(?:UKUPNO|TOTAL|SVEUKUPNO|IZNOS|ZA UPLATU)[:\s]*?(\d+[,.]\d{2})\s*(?:EUR|HRK|kn|€)?', text, _r.IGNORECASE)
+    if not amt_match:
+        amt_match = _r.search(r'(\d+[,.]\d{2})\s*EUR\b', text, _r.IGNORECASE)
+    if amt_match:
+        try: amt = float(amt_match.group(1).replace(',','.'))
+        except: pass
+    
+    date_match = _r.search(r'(\d{1,2})[./-](\d{1,2})[./-](\d{4}|\d{2})', text)
+    parsed_date = None
+    if date_match:
+        d, m, y = date_match.groups()
+        if len(y) == 2: y = '20' + y
+        try: parsed_date = f"{y}-{int(m):02d}-{int(d):02d}"
+        except: pass
+    
+    vendor = None
+    for line in (text or '').split('\n')[:10]:
+        line = line.strip()
+        if line and not _r.match(r'^[\d\s.,/-]+$', line) and len(line) > 5 and len(line) < 80:
+            vendor = line
+            break
+    
+    oib_match = _r.search(r'(?:OIB|VAT)[:\s]+(\d{11})', text)
+    oib = oib_match.group(1) if oib_match else None
+    
+    import os as _os
+    try: _os.unlink(tmp_path)
+    except: pass
+    
+    return {
+        "tip": tip,
+        "ai_amount": amt,
+        "ai_date": parsed_date,
+        "ai_vendor": vendor,
+        "ai_oib": oib,
+        "raw_text": text[:1500],
+        "filename": file.filename,
+    }
+
+# ──────── /V6 ────────
+
+@app.get("/api/admin/permissions-matrix")
+def admin_perm_matrix():
+    with db() as conn:
+        cur = conn.cursor()
+        cur.execute("""SELECT DISTINCT user_type FROM pgz_sport.sys_role_permissions ORDER BY user_type""")
+        types = [r[0] for r in cur.fetchall()]
+        cur.execute("""SELECT p.code, p.naziv, p.kategorija, ARRAY_AGG(rp.user_type) granted_to
+          FROM pgz_sport.sys_permissions p
+          LEFT JOIN pgz_sport.sys_role_permissions rp ON rp.permission_code=p.code
+          GROUP BY p.code, p.naziv, p.kategorija
+          ORDER BY p.kategorija, p.code""")
+        matrix = []
+        for r in cur.fetchall():
+            matrix.append({
+                "code": r[0], "naziv": r[1], "kategorija": r[2],
+                "granted_to": [g for g in (r[3] or []) if g]
+            })
+    return {"user_types": types, "matrix": matrix}
+
+# ──────── /V5 ────────
+
+
+# Sprint 3 routers
+import sys
+sys.path.insert(0, '/opt/pgz-sport/routers')
+try:
+    from img_proxy_router import router as img_proxy_router
+    from audit_coverage_router import router as audit_coverage_router
+    HAS_S3_ROUTERS = True
+except Exception as e:
+    print(f'WARN: sprint3 routers not loaded: {e}')
+    HAS_S3_ROUTERS = False
+
+app.include_router(v2_router)
+# Admin Dashboard router (ERP/CRM/Tenants)
+try:
+    from admin_router import router as admin_router
+    app.include_router(admin_router)
+    print('[ADMIN] router loaded')
+except Exception as e:
+    print(f'[ADMIN] router fail: {e}')
+
+
+# Sprint 3 includes
+if HAS_S3_ROUTERS:
+    app.include_router(img_proxy_router, prefix='/api/v2')
+    app.include_router(audit_coverage_router, prefix='/api/v2')
+
+# Round-2 enrichment endpoint
+try:
+    from enrich_router import router as enrich_router
+    app.include_router(enrich_router, prefix='/api/v2')
+    print('[ENRICH] router loaded')
+except Exception as e:
+    print(f'[ENRICH] router fail: {e}')
+
+
+
+
+
+@app.get("/sport-3d")
+@app.get("/3d")
+def serve_sport_3d():
+    p = HTML_DIR / "sport_3d.html"
+    if p.exists():
+        return FileResponse(p)
+    return {"error": "sport_3d.html not found"}
+
+@app.get("/admin")
+@app.get("/admin/")
+def serve_admin():
+    p = HTML_DIR / "admin.html"
+    if p.exists():
+        return FileResponse(p)
+    return {"error": "admin.html not found"}
+
+
+@app.get("/api/sportski-objekti")
+def list_sportski_objekti(q=None,tip=None,grad=None):
+    w=["aktivan=TRUE"]; p=[]
+    if q: w.append("(naziv ILIKE %s OR adresa ILIKE %s OR grad ILIKE %s)"); p+=["%"+q+"%"]*3
+    if tip: w.append("tip ILIKE %s"); p.append("%"+tip+"%")
+    if grad: w.append("grad ILIKE %s"); p.append("%"+grad+"%")
+    rows=fetch("SELECT * FROM pgz_sport.sportski_objekti WHERE "+" AND ".join(w)+" ORDER BY grad,naziv",p)
+    return {"count":len(rows),"rows":rows}
+
+@app.get("/api/clanovi-full")
+def list_clanovi_full(q=None,hoo=None,reprezentativac=None,klub_id=None,limit=80,authorization=None):
+    w=["aktivan=TRUE"]; p=[]
+    if q: w.append("(ime ILIKE %s OR prezime ILIKE %s OR klub_naziv_godisnjak ILIKE %s)"); p+=["%"+q+"%"]*3
+    if hoo: w.append("hoo_kategorija=%s"); p.append(hoo)
+    if reprezentativac is not None: w.append("reprezentativac="+(("TRUE") if str(reprezentativac).lower()=="true" else "FALSE"))
+    if klub_id: w.append("klub_id=%s"); p.append(int(klub_id))
+    lim=min(int(limit or 80),200)
+    sql="SELECT id,ime,prezime,oib,datum_rodenja,spol,sport,pozicija,reprezentativac,kategoriziran,stipendiran,kategorija_hoo,hoo_kategorija,aktivan,klub_naziv_godisnjak,slika_url,profile_url,hns_igrac_id,visina_cm,tezina_kg,broj_dresa,uloga,godisnjak_godine,godisnjak_prvi,godisnjak_zadnji,napomena FROM pgz_sport.clanovi WHERE "+" AND ".join(w)+" ORDER BY prezime,ime LIMIT "+str(lim)
+    rows=fetch(sql,p)
+    return {"count":len(rows),"rows":rows}
+
+@app.get("/api/gradovi")
+def list_gradovi():
+    rows=fetch("SELECT DISTINCT grad FROM pgz_sport.klubovi WHERE aktivan=TRUE AND grad IS NOT NULL AND grad<>'' AND grad NOT SIMILAR TO '[0-9]+%%' ORDER BY grad",[])
+    return [r["grad"] for r in rows]
+
+@app.get("/api/manifestacije-full")
+def list_manifestacije_full(q=None,razina=None):
+    w=["aktivna=TRUE"]; p=[]
+    if q: w.append("(naziv ILIKE %s OR mjesto ILIKE %s)"); p+=["%"+q+"%"]*2
+    rows=fetch("SELECT id,naziv,mjesto,organizator,razina,broj_ucesnika,godina_od,spol_kategorija,napomena,source_url FROM pgz_sport.manifestacije WHERE "+" AND ".join(w)+" ORDER BY naziv",p)
+    return {"count":len(rows),"rows":rows}
+
+
+
+# ── SUFINANCIRANJE-ALL  v1.0 dradulic@outlook.com 2026-05-04
+@app.get("/api/sufinanciranje")
+def list_sufinanciranje(q=None, godina=None, razina=None, sport=None, limit=500):
+    w=["iznos_eur > 0"]; p=[]
+    if q: w.append("(LOWER(korisnik) LIKE %s OR LOWER(sport) LIKE %s)"); p+=[f"%{q.lower()}%"]*2
+    if godina: w.append("godina=%s"); p.append(int(godina))
+    if razina: w.append("razina ILIKE %s"); p.append(f"%{razina}%")
+    if sport: w.append("sport ILIKE %s"); p.append(f"%{sport}%")
+    sql=f"SELECT korisnik,sport,iznos_eur,vrsta,razina,izvor,source_url,godina FROM pgz_sport.sufinanciranje_sport WHERE {' AND '.join(w)} ORDER BY iznos_eur DESC LIMIT {min(int(limit),1000)}"
+    rows=fetch(sql,p)
+    total=sum(float(r.get('iznos_eur') or 0) for r in rows)
+    years=sorted(set(r.get('godina') for r in rows if r.get('godina')),reverse=True)
+    return {"count":len(rows),"total":total,"years":years,"rows":rows}
+
+
+
+# ══════════════════════════════════════════════════════════════════
+# ERP PLATFORM ROUTES v2.0 — dradulic@outlook.com — 2026-05-04
+# ══════════════════════════════════════════════════════════════════
+
+import hashlib
+
+def hash_pwd(pwd): return hashlib.sha256(pwd.encode()).hexdigest()
+
+def get_user(token):
+    if not token: return None
+    try:
+        payload = _jwt.decode(token.replace("Bearer ",""), JWT_SECRET, algorithms=["HS256"])
+        uid = payload.get("uid")
+        if uid:
+            rows = fetch("SELECT * FROM pgz_sport.users WHERE id=%s AND aktivan=TRUE", [uid])
+            return rows[0] if rows else None
+        return payload
+    except: return None
+
+# ── AUTH: Email/Password login ──────────────────────────────────
+@app.post("/api/auth/login")
+def login(body: dict = Body(...)):
+    email = (body.get("email","")).lower().strip()
+    pwd   = body.get("password","")
+    if not email or not pwd: raise HTTPException(400,"Email i lozinka obavezni")
+    rows = fetch("SELECT * FROM pgz_sport.users WHERE LOWER(email)=%s AND aktivan=TRUE",[email])
+    if not rows: raise HTTPException(401,"Neispravni podaci")
+    u = rows[0]
+    ph = hashlib.sha256(pwd.encode()).hexdigest()
+    if u.get("password_hash") != ph: raise HTTPException(401,"Neispravni podaci")
+    payload = {"uid":u["id"],"email":email,"name":u.get("full_name",email),
+               "role":u.get("user_type","viewer"),"klub_id":u.get("klub_id"),
+               "savez_id":u.get("savez_id"),"iat":int(__import__("time").time()),
+               "exp":int(__import__("time").time())+86400*7}
+    tok = _jwt.encode(payload, JWT_SECRET, algorithm="HS256")
+    try:
+        with db() as conn:
+            cur=conn.cursor()
+            cur.execute("UPDATE pgz_sport.users SET last_login=NOW() WHERE id=%s",[u["id"]])
+            conn.commit()
+    except: pass
+    return {"token":tok,"role":payload["role"],"name":payload["name"],
+            "email":email,"klub_id":payload["klub_id"],"savez_id":payload["savez_id"]}
+
+# ── SPORTAS FULL PROFILE ─────────────────────────────────────────
+@app.get("/api/sportas/{clan_id}/profil")
+def sportas_profil(clan_id: int):
+    clan = fetch("""SELECT c.*, k.naziv AS klub_naziv_full, k.sport AS klub_sport,
+        k.grad, k.logo_url FROM pgz_sport.clanovi c
+        LEFT JOIN pgz_sport.klubovi k ON k.id=c.klub_id WHERE c.id=%s""", [clan_id])
+    if not clan: raise HTTPException(404,"Nije pronađen")
+    c = clan[0]
+    sezona = fetch("""SELECT * FROM pgz_sport.clan_sezona WHERE clan_id=%s ORDER BY sezona DESC""", [clan_id])
+    utakmice = fetch("""SELECT * FROM pgz_sport.utakmice_log WHERE clan_id=%s ORDER BY datum DESC LIMIT 30""", [clan_id])
+    nagrade = fetch("SELECT * FROM pgz_sport.clan_nagrada WHERE clan_id=%s ORDER BY godina DESC", [clan_id])
+    godisnjaci = fetch("SELECT * FROM pgz_sport.clan_godisnjak WHERE clan_id=%s ORDER BY godina DESC", [clan_id])
+    stats = {}
+    if sezona:
+        stats = {"ukupno_nastupa": sum((r.get("nastupi") or 0) for r in sezona),
+                 "ukupno_pogodaka": sum((r.get("pogoci") or 0) for r in sezona),
+                 "ukupno_asistencija": sum((r.get("asistencije") or 0) for r in sezona),
+                 "ukupno_zutih": sum((r.get("zuti_kartoni") or 0) for r in sezona),
+                 "ukupno_crvenih": sum((r.get("crveni_kartoni") or 0) for r in sezona),
+                 "ukupno_minuta": sum((r.get("minute_total") or 0) for r in sezona),
+                 "sezone_aktivne": len(sezona)}
+    return {**c,"clan_sezona":sezona,"utakmice":utakmice,"nagrade":nagrade,
+            "godisnjaci":godisnjaci,"stats":stats}
+
+# ── SAVEZ FULL DETAIL ────────────────────────────────────────────
+@app.get("/api/savezi/{savez_id}/full")
+def savez_full(savez_id: int):
+    s = fetch("SELECT * FROM pgz_sport.savezi WHERE id=%s",[savez_id])
+    if not s: raise HTTPException(404,"Savez nije pronađen")
+    klubovi = fetch("""SELECT id,naziv,sport,grad,predsjednik,tajnik,nositelj_kvalitete,
+        aktivan,oib,razina,broj_clanova FROM pgz_sport.klubovi WHERE savez_id=%s AND aktivan=TRUE ORDER BY naziv""",[savez_id])
+    clanovi = fetch("""SELECT c.id,c.ime,c.prezime,c.sport,c.pozicija,c.kategorija,
+        c.reprezentativac,c.kategoriziran,c.slika_url,c.hoo_kategorija,c.klub_naziv_godisnjak,c.aktivan
+        FROM pgz_sport.clanovi c WHERE c.savez_kod=(SELECT kod FROM pgz_sport.savezi WHERE id=%s) LIMIT 200""",[savez_id])
+    if not clanovi:
+        clanovi = fetch("""SELECT c.id,c.ime,c.prezime,c.sport,c.pozicija,c.kategorija,
+            c.reprezentativac,c.kategoriziran,c.slika_url,c.hoo_kategorija,c.klub_naziv_godisnjak,c.aktivan
+            FROM pgz_sport.clanovi c WHERE c.aktivan=TRUE AND c.sport ILIKE %s LIMIT 200""",
+            [f'%{s[0].get("sport","") or ""}%'])
+    treneri = fetch("""SELECT * FROM pgz_sport.treneri WHERE savez_id=%s""",[savez_id])
+    return {**s[0],"klubovi":klubovi,"clanovi":clanovi[:100],"treneri":treneri}
+
+# ── KLUB ERP: CLANARINE ──────────────────────────────────────────
+@app.get("/api/klub/{klub_id}/clanarine")
+def klub_clanarine(klub_id: int, godina: int=None, status: str=None):
+    w=["c.klub_id=%s"]; p=[klub_id]
+    if godina: w.append("cl.godina=%s"); p.append(godina)
+    if status: w.append("cl.status=%s"); p.append(status)
+    rows = fetch(f"""SELECT cl.*,c.ime,c.prezime,c.oib,c.spol,c.kategorija,c.hoo_kategorija,c.slika_url
+        FROM pgz_sport.clanarine cl JOIN pgz_sport.clanovi c ON c.id=cl.clan_id
+        WHERE {" AND ".join(w)} ORDER BY cl.godina DESC, c.prezime""", p)
+    total_p = sum(float(r.get("iznos_placen") or 0) for r in rows)
+    total_d = sum(float(r.get("iznos_propisan") or 0) - float(r.get("iznos_placen") or 0) for r in rows)
+    return {"count":len(rows),"naplaceno":total_p,"dug":total_d,"rows":rows}
+
+# ── KLUB ERP: LIJECNICKI ─────────────────────────────────────────
+@app.get("/api/klub/{klub_id}/lijecnicki")
+def klub_lijecnicki(klub_id: int):
+    import datetime; today = datetime.date.today()
+    rows = fetch("""SELECT lp.*,c.ime,c.prezime,c.oib,c.kategorija,c.slika_url,
+        CASE WHEN lp.vrijedi_do IS NULL THEN 'nepoznato'
+             WHEN lp.vrijedi_do < CURRENT_DATE THEN 'istekao'
+             WHEN lp.vrijedi_do < CURRENT_DATE + 30 THEN 'uskoro_istece'
+             ELSE 'validan' END AS status_pregled
+        FROM pgz_sport.lijecnicki_pregledi lp JOIN pgz_sport.clanovi c ON c.id=lp.clan_id
+        WHERE c.klub_id=%s ORDER BY lp.vrijedi_do ASC NULLS LAST""", [klub_id])
+    alert_istekli = [r for r in rows if r.get("status_pregled")=="istekao"]
+    alert_uskoro  = [r for r in rows if r.get("status_pregled")=="uskoro_istece"]
+    return {"count":len(rows),"istekli":len(alert_istekli),"uskoro":len(alert_uskoro),"rows":rows}
+
+# ── NETWORK GRAPH DATA ───────────────────────────────────────────
+@app.get("/api/network/pgz")
+def network_pgz(q: str=None, entity_type: str=None, max_nodes: int=80):
+    FORENSIC_NAMES = {"SAMIR BARAĆ","MIROSLAV MARIĆ","VELIMIR LIVERIĆ","DOROTEA PESIC-BUKOVAC"}
+    nodes,edges,seen_nodes,seen_edges = [],[],set(),set()
+
+    def add_node(nid, label, ntype, meta=None):
+        if nid not in seen_nodes:
+            seen_nodes.add(nid)
+            nodes.append({"id":nid,"label":label,"type":ntype,"forensic":label.upper() in FORENSIC_NAMES,"meta":meta or {}})
+
+    def add_edge(s,t,rel=""):
+        k=f"{s}-{t}"
+        if k not in seen_edges:
+            seen_edges.add(k); edges.append({"source":s,"target":t,"rel":rel})
+
+    if q:
+        # Person search
+        persons = fetch("""SELECT p.id,p.name,p.function,e.name as ent,e.id as eid,e.entity_type,e.city
+            FROM civic.persons p JOIN civic.entities e ON e.id=p.entity_id
+            WHERE p.name ILIKE %s OR e.name ILIKE %s LIMIT 60""",[f"%{q}%",f"%{q}%"])
+        for r in persons:
+            pid=f"p_{r['id']}"; eid=f"e_{r['eid']}"
+            add_node(pid,r.get("name","?")[:30],"person")
+            add_node(eid,r.get("ent","?")[:30],"club" if "Udruga" in (r.get("entity_type") or "") else "company")
+            add_edge(pid,eid,r.get("function",""))
+    else:
+        # Default: top connected persons
+        rels = fetch("""SELECT p.id,p.name,e.id as eid,e.name as ent,e.entity_type,p.function
+            FROM civic.persons p JOIN civic.entities e ON e.id=p.entity_id
+            WHERE e.county ILIKE '%%goranska%%' OR e.county ILIKE '%%primorska%%'
+            ORDER BY p.id LIMIT %s""",[max_nodes])
+        for r in rels:
+            pid=f"p_{r['id']}"; eid=f"e_{r['eid']}"
+            add_node(pid,r.get("name","?")[:25],"person")
+            add_node(eid,r.get("ent","?")[:25],"club" if "Udruga" in (r.get("entity_type") or "") else "company",
+                     {"city":r.get("city"),"type":r.get("entity_type")})
+            add_edge(pid,eid,r.get("function",""))
+
+    return {"nodes":nodes[:200],"edges":edges[:400],"query":q}
+
+
+
+@app.get("/platform")
+@app.get("/platform/")
+def serve_platform():
+    p = HTML_DIR / "platform.html"
+    if p.exists(): return FileResponse(p)
+    return {"error": "platform.html not found"}
+
+app.mount("/static", StaticFiles(directory=str(HTML_DIR)), name="static")
+
+@app.get("/")
+def root(request: Request):
+    host = request.headers.get("host", "")
+    if "sport.rinet.one" in host:
+        p = HTML_DIR / "sport2.html"
+        if p.exists():
+            return FileResponse(p)
+    idx = HTML_DIR / "index.html"
+    if idx.exists():
+        return FileResponse(idx)
+    return {"service": "PGŽ Sport", "version": "2.0"}
+
+@app.get("/v2")
+def portal_v2():
+    p = HTML_DIR / "sport2.html"
+    if p.exists():
+        return FileResponse(p)
+    return {"error": "sport2.html not found"}
+
+if __name__ == "__main__":
+    import uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=8095)
diff --git a/_backups/r3_cc4/sport2.html.pre_M5.1777931436 b/_backups/r3_cc4/sport2.html.pre_M5.1777931436
new file mode 100644
index 0000000..824e137
--- /dev/null
+++ b/_backups/r3_cc4/sport2.html.pre_M5.1777931436
@@ -0,0 +1,2257 @@
+<!DOCTYPE html>
+<html lang="hr">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width,initial-scale=1.0">
+<title>PGŽ SPORT — Platforma</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;600&display=swap" rel="stylesheet">
+<script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/4.4.1/chart.umd.min.js"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/d3/7.8.5/d3.min.js"></script>
+<style>
+:root{
+  --pgz-blue:#003087; --pgz-blue2:#004CC4; --pgz-gold:#F4C430;
+  --bg0:#08090e; --bg1:#0d1021; --bg2:#111628; --bg3:#161d35; --bg4:#1c2542;
+  --rim:#1e2a50; --rim2:#283560;
+  --t0:#fff; --t1:#e2e6f0; --t2:#8a95b4; --t4:#4e5a7a;
+  --green:#00e88f; --red:#ff2d55; --amber:#f59e0b; --cyan:#00c8e8;
+  --font:'Inter',sans-serif; --mono:'JetBrains Mono',monospace;
+}
+*{box-sizing:border-box;margin:0;padding:0}
+html,body{height:100%}
+body{font-family:var(--font);background:var(--bg0);color:var(--t1);font-size:13px;overflow-x:hidden}
+a{color:var(--cyan);text-decoration:none}
+a:hover{color:var(--pgz-gold)}
+button,input,select{font-family:inherit;font-size:inherit;outline:none}
+::-webkit-scrollbar{width:8px;height:8px}
+::-webkit-scrollbar-track{background:var(--bg1)}
+::-webkit-scrollbar-thumb{background:var(--rim2);border-radius:4px}
+::-webkit-scrollbar-thumb:hover{background:var(--pgz-blue2)}
+
+.app{display:flex;min-height:100vh}
+.sb{width:240px;background:linear-gradient(180deg,var(--bg1) 0%,var(--bg0) 100%);border-right:1px solid var(--rim);position:fixed;top:0;left:0;bottom:0;display:flex;flex-direction:column;z-index:10;transition:width .22s ease}
+.sb-h{padding:18px 18px 14px;border-bottom:1px solid var(--rim);position:relative}
+.sb-h .logo{font-weight:800;font-size:14px;color:var(--t0);letter-spacing:.5px;white-space:nowrap;overflow:hidden}
+.sb-h .logo .g{color:var(--pgz-gold)}
+.sb-h .sub{font-size:10px;color:var(--t2);margin-top:4px;text-transform:uppercase;letter-spacing:1px;white-space:nowrap;overflow:hidden}
+.sb-toggle{position:absolute;top:14px;right:8px;width:22px;height:22px;display:flex;align-items:center;justify-content:center;cursor:pointer;color:var(--t2);background:var(--bg2);border:1px solid var(--rim);border-radius:4px;font-size:11px;font-weight:700;transition:all .15s;user-select:none}
+.sb-toggle:hover{background:var(--bg3);color:var(--pgz-gold);border-color:var(--pgz-gold)}
+.sb-nav{flex:1;padding:10px 8px;overflow-y:auto;overflow-x:hidden}
+.nav-i{padding:9px 12px;border-radius:6px;color:var(--t2);cursor:pointer;display:flex;align-items:center;gap:10px;font-size:12.5px;margin-bottom:2px;transition:background .15s,color .15s;white-space:nowrap}
+.nav-i:hover{background:var(--bg2);color:var(--t1)}
+.nav-i.active{background:linear-gradient(90deg,var(--pgz-blue) 0%,var(--pgz-blue2) 100%);color:#fff;font-weight:600}
+.nav-i .ic{width:18px;text-align:center;font-size:14px;flex-shrink:0}
+.nav-i .lbl{overflow:hidden;text-overflow:ellipsis}
+.sb-foot{padding:10px 14px;border-top:1px solid var(--rim);font-size:10px;color:var(--t4);white-space:nowrap;overflow:hidden}
+
+/* Collapsed sidebar */
+.sb.collapsed{width:58px}
+.sb.collapsed .sb-h{padding:18px 8px 14px;text-align:center}
+.sb.collapsed .sb-h .logo{font-size:0}
+.sb.collapsed .sb-h .logo::before{content:"PG";font-size:13px;color:var(--pgz-gold);font-weight:800}
+.sb.collapsed .sb-h .sub{display:none}
+.sb.collapsed .sb-toggle{position:static;margin:6px auto 0;display:flex}
+.sb.collapsed .nav-i{justify-content:center;padding:10px 6px}
+.sb.collapsed .nav-i .lbl{display:none}
+.sb.collapsed .nav-i{position:relative}
+.sb.collapsed .nav-i:hover::after{content:attr(data-label);position:absolute;left:58px;top:50%;transform:translateY(-50%);background:var(--bg3);color:var(--t0);padding:5px 10px;border-radius:4px;font-size:11.5px;white-space:nowrap;border:1px solid var(--rim);z-index:50;font-weight:600;pointer-events:none;box-shadow:2px 2px 8px rgba(0,0,0,.4)}
+.sb.collapsed .sb-foot{font-size:0;padding:8px}
+.sb.collapsed .sb-foot::before{content:"v2";font-size:9px;color:var(--t4)}
+
+.main{margin-left:240px;flex:1;min-width:0;transition:margin-left .22s ease}
+.sb.collapsed ~ .main{margin-left:58px}
+.tb{background:var(--bg1);border-bottom:1px solid var(--rim);padding:12px 22px;display:flex;align-items:center;justify-content:space-between;position:sticky;top:0;z-index:5}
+.tb-t{font-size:15px;font-weight:700;color:var(--t0)}
+.tb-s{font-size:11px;color:var(--t2)}
+.content{padding:22px}
+.section{display:none}
+.section.active{display:block}
+
+.kpi-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:14px;margin-bottom:22px}
+.kpi{background:linear-gradient(135deg,var(--bg2) 0%,var(--bg1) 100%);border:1px solid var(--rim);border-radius:8px;padding:14px 16px;position:relative;overflow:hidden}
+.kpi::before{content:"";position:absolute;top:0;left:0;width:3px;height:100%;background:var(--pgz-gold)}
+.kpi.b::before{background:var(--pgz-blue2)}
+.kpi.g::before{background:var(--green)}
+.kpi.r::before{background:var(--red)}
+.kpi-l{font-size:10.5px;color:var(--t2);text-transform:uppercase;letter-spacing:1px;font-weight:600}
+.kpi-v{font-size:24px;font-weight:800;color:var(--t0);margin-top:4px;font-family:var(--mono)}
+.kpi-s{font-size:10px;color:var(--t4);margin-top:2px}
+
+.card{background:var(--bg2);border:1px solid var(--rim);border-radius:8px;padding:14px;margin-bottom:14px}
+.card-h{display:flex;align-items:center;justify-content:space-between;margin-bottom:10px;padding-bottom:8px;border-bottom:1px solid var(--rim)}
+.card-t{font-weight:700;color:var(--t0);font-size:13px}
+
+.grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(260px,1fr));gap:12px}
+.grid-club{display:grid;grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:12px}
+.grid-player{display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:12px}
+
+.entity{background:var(--bg2);border:1px solid var(--rim);border-radius:8px;padding:12px;cursor:pointer;transition:all .2s;position:relative}
+.entity:hover{border-color:var(--pgz-gold);background:var(--bg3);transform:translateY(-1px)}
+.entity .et{font-weight:700;color:var(--t0);font-size:13px;margin-bottom:6px;line-height:1.3}
+.entity .es{font-size:11px;color:var(--t2);margin-bottom:6px}
+.entity .em{display:flex;gap:8px;font-size:10.5px;color:var(--t4);flex-wrap:wrap}
+.entity .em b{color:var(--pgz-gold);font-weight:700}
+.entity .et-tag{position:absolute;top:8px;right:8px;font-size:9px;padding:2px 6px;border-radius:3px;background:var(--pgz-blue);color:#fff;font-weight:600;text-transform:uppercase}
+
+.player-card{background:var(--bg2);border:1px solid var(--rim);border-radius:8px;overflow:hidden;cursor:pointer;transition:all .2s}
+.player-card:hover{border-color:var(--pgz-gold);transform:translateY(-1px)}
+.player-card .ph{height:120px;background:linear-gradient(135deg,var(--bg3),var(--bg2));position:relative;overflow:hidden;display:flex;align-items:center;justify-content:center}
+.player-card .ph img{width:100%;height:100%;object-fit:cover;object-position:top}
+.player-card .ph .no{font-size:36px;color:var(--t4);font-weight:800}
+.player-card .pb{padding:10px}
+.player-card .pn{font-weight:700;color:var(--t0);font-size:13px;line-height:1.2}
+.player-card .pp{font-size:11px;color:var(--t2);margin-top:3px}
+.player-card .pk{font-size:10.5px;color:var(--t4);margin-top:3px}
+.player-card .badges{display:flex;gap:4px;margin-top:6px;flex-wrap:wrap}
+.player-card .badge{font-size:9px;padding:2px 5px;border-radius:3px;background:var(--bg4);color:var(--t1);text-transform:uppercase;font-weight:600}
+.player-card .badge.repr{background:var(--pgz-gold);color:var(--bg0)}
+.player-card .badge.hoo{background:var(--pgz-blue2);color:#fff}
+
+table{width:100%;border-collapse:collapse;font-size:12px}
+table th{background:var(--bg3);color:var(--t2);text-transform:uppercase;font-size:10px;letter-spacing:.5px;padding:8px 10px;text-align:left;border-bottom:1px solid var(--rim);font-weight:700}
+table td{padding:8px 10px;border-bottom:1px solid var(--rim);color:var(--t1)}
+table tbody tr{cursor:pointer;transition:background .15s}
+table tbody tr:hover{background:var(--bg3)}
+table tbody tr.no-click{cursor:default}
+table tbody tr.no-click:hover{background:transparent}
+.num{font-family:var(--mono);text-align:right}
+
+.toolbar{display:flex;align-items:center;gap:10px;margin-bottom:14px;flex-wrap:wrap}
+.toolbar input,.toolbar select{background:var(--bg2);border:1px solid var(--rim);border-radius:5px;padding:7px 10px;color:var(--t1);font-size:12px}
+.toolbar input:focus,.toolbar select:focus{border-color:var(--pgz-blue2)}
+.toolbar input{min-width:200px}
+.toolbar label{font-size:11px;color:var(--t2);display:flex;align-items:center;gap:6px}
+.toolbar input[type=checkbox]{accent-color:var(--pgz-gold)}
+.btn{background:var(--bg2);border:1px solid var(--rim);border-radius:5px;padding:7px 12px;color:var(--t1);font-size:12px;cursor:pointer;font-weight:600;transition:all .15s}
+.btn:hover{background:var(--bg3);border-color:var(--rim2)}
+.btn.primary{background:linear-gradient(135deg,var(--pgz-blue),var(--pgz-blue2));border-color:transparent;color:#fff}
+.btn.primary:hover{filter:brightness(1.1)}
+
+.toggle{display:inline-flex;background:var(--bg2);border:1px solid var(--rim);border-radius:5px;overflow:hidden}
+.toggle button{background:transparent;border:0;padding:6px 12px;color:var(--t2);font-size:11px;font-weight:600;cursor:pointer}
+.toggle button.active{background:var(--pgz-blue);color:#fff}
+
+.tabs{display:flex;gap:4px;border-bottom:1px solid var(--rim);margin-bottom:14px;flex-wrap:wrap}
+.tab{padding:8px 14px;cursor:pointer;color:var(--t2);font-weight:600;font-size:12px;border-bottom:2px solid transparent;transition:all .15s}
+.tab:hover{color:var(--t1)}
+.tab.active{color:var(--pgz-gold);border-color:var(--pgz-gold)}
+
+.empty{text-align:center;padding:30px;color:var(--t4);font-size:12px;font-style:italic}
+.loading{padding:24px;text-align:center;color:var(--t2);font-size:12px}
+.loading::before{content:"";display:inline-block;width:12px;height:12px;border:2px solid var(--rim);border-top-color:var(--pgz-gold);border-radius:50%;animation:spin .8s linear infinite;margin-right:8px;vertical-align:middle}
+@keyframes spin{to{transform:rotate(360deg)}}
+
+.tag{display:inline-block;padding:2px 7px;font-size:10px;border-radius:3px;background:var(--bg4);color:var(--t1);font-weight:600;text-transform:uppercase;letter-spacing:.5px;margin-right:3px}
+.tag.b{background:var(--pgz-blue);color:#fff}
+.tag.gd{background:var(--pgz-gold);color:var(--bg0)}
+.tag.gr{background:var(--green);color:var(--bg0)}
+.tag.rd{background:var(--red);color:#fff}
+.tag.am{background:var(--amber);color:var(--bg0)}
+
+#panel{position:fixed;top:0;right:-620px;width:600px;max-width:96vw;height:100vh;background:var(--bg1);border-left:1px solid var(--rim);z-index:200;transition:right .25s ease;display:flex;flex-direction:column;box-shadow:-8px 0 30px rgba(0,0,0,.5)}
+#panel.open{right:0}
+#panel-hdr{padding:14px 16px;border-bottom:1px solid var(--rim);display:flex;align-items:center;justify-content:space-between;flex-shrink:0;background:var(--bg2)}
+#panel-hdr-t{font-size:14px;font-weight:700;color:var(--t0)}
+#panel-x{cursor:pointer;font-size:22px;color:var(--t4);width:30px;height:30px;display:flex;align-items:center;justify-content:center;border-radius:5px;transition:all .15s}
+#panel-x:hover{background:var(--bg3);color:var(--red)}
+#panel-body{flex:1;overflow-y:auto;padding:16px}
+#panel-overlay{display:none;position:fixed;inset:0;background:rgba(0,0,0,.5);z-index:199;backdrop-filter:blur(2px)}
+#panel-overlay.open{display:block}
+
+.pp-hdr{display:flex;gap:14px;align-items:flex-start;margin-bottom:14px;padding-bottom:14px;border-bottom:1px solid var(--rim)}
+.pp-foto{width:90px;height:110px;border-radius:6px;background:var(--bg3);overflow:hidden;flex-shrink:0;display:flex;align-items:center;justify-content:center}
+.pp-foto img{width:100%;height:100%;object-fit:cover;object-position:top}
+.pp-foto .no{font-size:32px;color:var(--t4);font-weight:800}
+.pp-info{flex:1;min-width:0}
+.pp-name{font-size:18px;font-weight:800;color:var(--t0);margin-bottom:4px}
+.pp-meta{font-size:12px;color:var(--t2);margin-bottom:6px}
+.pp-tags{display:flex;gap:4px;flex-wrap:wrap}
+.pp-stats{display:grid;grid-template-columns:repeat(6,1fr);gap:8px;margin-bottom:14px;padding:12px;background:var(--bg2);border:1px solid var(--rim);border-radius:6px}
+.pp-stat{text-align:center}
+.pp-stat .v{font-size:20px;font-weight:800;color:var(--pgz-gold);font-family:var(--mono)}
+.pp-stat .l{font-size:9px;color:var(--t4);text-transform:uppercase;letter-spacing:.5px;margin-top:2px;font-weight:600}
+
+.kv{display:grid;grid-template-columns:140px 1fr;gap:6px 12px;font-size:12px}
+.kv .k{color:var(--t2);font-weight:600}
+.kv .v{color:var(--t1);word-break:break-word}
+
+.utlogo{width:22px;height:22px;border-radius:50%;background:var(--bg3);object-fit:contain;vertical-align:middle;margin-right:6px}
+
+.score{display:inline-flex;align-items:center;gap:4px;padding:3px 8px;border-radius:4px;background:var(--bg3);font-size:11px;font-weight:600}
+.score.high{background:rgba(0,232,143,.15);color:var(--green)}
+.score.mid{background:rgba(245,158,11,.15);color:var(--amber)}
+.score.low{background:rgba(255,45,85,.15);color:var(--red)}
+
+.row-2{display:grid;grid-template-columns:1fr 1fr;gap:14px}
+@media (max-width:900px){.row-2{grid-template-columns:1fr}}
+
+.chart-box{background:var(--bg2);border:1px solid var(--rim);border-radius:8px;padding:14px;height:340px}
+.chart-box canvas{max-height:300px}
+
+.alert-card{padding:10px 12px;border-left:3px solid var(--amber);background:var(--bg2);border-radius:5px;margin-bottom:8px}
+.alert-card.crit{border-color:var(--red)}
+.alert-card .at{font-weight:700;font-size:12px;color:var(--t0)}
+.alert-card .ad{font-size:11px;color:var(--t2);margin-top:3px}
+
+.iframe-map{width:100%;height:140px;border:0;border-radius:5px;background:var(--bg3)}
+
+@media (max-width:768px){
+  .sb{transform:translateX(-100%);transition:transform .25s}
+  .sb.open{transform:translateX(0)}
+  .main{margin-left:0}
+  .pp-stats{grid-template-columns:repeat(3,1fr)}
+}
+</style>
+</head>
+<body>
+
+<div class="app">
+  <aside class="sb" id="sb">
+    <div class="sb-h">
+      <div class="logo">PGŽ <span class="g">SPORT</span></div>
+      <div class="sub">Primorsko-goranska županija</div>
+      <div class="sb-toggle" id="sb-toggle" onclick="toggleSidebar()" title="Skupi/raširi">⮜</div>
+    </div>
+    <nav class="sb-nav" id="nav"></nav>
+    <div class="sb-foot">v2.0 · 2026</div>
+  </aside>
+
+  <main class="main">
+    <div class="tb">
+      <div>
+        <div class="tb-t" id="tb-t">Dashboard</div>
+        <div class="tb-s" id="tb-s">Pregled stanja</div>
+      </div>
+      <div class="tb-s">
+        <span style="color:var(--green)">●</span> API live · sport.rinet.one
+      </div>
+    </div>
+
+    <div class="content">
+      <section id="pg-dashboard" class="section active"></section>
+      <section id="pg-savezi" class="section"></section>
+      <section id="pg-klubovi" class="section"></section>
+      <section id="pg-sportasi" class="section"></section>
+      <section id="pg-financije" class="section"></section>
+      <section id="pg-objekti" class="section"></section>
+      <section id="pg-manifestacije" class="section"></section>
+      <section id="pg-mreza" class="section"></section>
+      <section id="pg-forenzika" class="section"></section>
+    </div>
+  </main>
+</div>
+
+<div id="panel-overlay" onclick="closePanel()"></div>
+<div id="panel">
+  <div id="panel-hdr">
+    <div id="panel-hdr-t">Detalji</div>
+    <div id="panel-x" onclick="closePanel()">×</div>
+  </div>
+  <div id="panel-body"></div>
+</div>
+
+<script>
+//=========== CONFIG ===========
+const API = '/sport/api';
+const NAV_ITEMS = [
+  {id:'dashboard', ic:'\u{1F4CA}', label:'Dashboard'},
+  {id:'savezi',    ic:'\u{1F3C5}', label:'Savezi'},
+  {id:'klubovi',   ic:'⬢',    label:'Klubovi'},
+  {id:'sportasi',  ic:'\u{1F464}', label:'Sportaši'},
+  {id:'financije', ic:'€',    label:'Financije'},
+  {id:'objekti',   ic:'\u{1F4CD}', label:'Objekti'},
+  {id:'manifestacije', ic:'\u{1F4C5}', label:'Manifestacije'},
+  {id:'mreza',     ic:'\u{1F578}', label:'Mreža'},
+  {id:'forenzika', ic:'⚠',    label:'Forenzika'}
+];
+const SECTION_TITLES = {
+  dashboard: ['Dashboard', 'Pregled stanja PGŽ Sporta'],
+  savezi:    ['Savezi', '246 sportskih saveza'],
+  klubovi:   ['Klubovi', 'Sportski klubovi PGŽ'],
+  sportasi:  ['Sportaši', 'Registrirani članovi'],
+  financije: ['Financije', 'Sufinanciranje sporta'],
+  objekti:   ['Sportski objekti', 'Geocodirana infrastruktura'],
+  manifestacije: ['Manifestacije', 'Sportski događaji'],
+  mreza: ['Mreža', 'Force-directed graf entiteta i veza'],
+  forenzika: ['Forenzika', 'Kritični nalazi i alarmi']
+};
+
+const _cache = {savezi:null, klubovi:null, clanovi:null, objekti:null, manifestacije:null, sufin:null, dash:null};
+const _state = {section:'dashboard', viewSavezi:'card', viewKlubovi:'card', viewSportasi:'card', viewObjekti:'card', viewManif:'card', viewFinancije:'table'};
+const _sort = {savezi:null, klubovi:null, sportasi:null, objekti:null, manifestacije:null, financije:null};
+let _proracunChart=null, _financijeChart=null;
+
+//=========== UTIL ===========
+const $ = s => document.querySelector(s);
+const $$ = s => Array.from(document.querySelectorAll(s));
+function esc(s){
+  if(s===null||s===undefined) return '';
+  return String(s).replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+}
+function fmtNum(n){
+  if(n===null||n===undefined||n==='') return '—';
+  const v = Number(n);
+  if(isNaN(v)) return esc(n);
+  return v.toLocaleString('hr-HR');
+}
+function fmtEur(n){
+  if(n===null||n===undefined||n==='') return '—';
+  const v = Number(n);
+  if(isNaN(v)) return esc(n);
+  if(v>=1000000) return '€'+(v/1000000).toFixed(2)+'M';
+  if(v>=1000) return '€'+(v/1000).toFixed(1)+'k';
+  return '€'+v.toFixed(0);
+}
+function fmtEurFull(n){
+  if(n===null||n===undefined||n==='') return '—';
+  const v = Number(n);
+  if(isNaN(v)) return esc(n);
+  return v.toLocaleString('hr-HR', {minimumFractionDigits:2, maximumFractionDigits:2})+' €';
+}
+function fmtDate(s){
+  if(!s) return '—';
+  const m = String(s).match(/^(\d{4})-(\d{2})-(\d{2})/);
+  if(!m) return esc(s);
+  return m[3]+'.'+m[2]+'.'+m[1];
+}
+function txt(v, fb){
+  if(v===null||v===undefined||v==='') return fb===undefined?'—':fb;
+  return esc(v);
+}
+async function api(path){
+  try{
+    const r = await fetch(API+path);
+    if(!r.ok) throw new Error('HTTP '+r.status);
+    return await r.json();
+  }catch(e){
+    console.error('API error', path, e);
+    return null;
+  }
+}
+async function apiPost(path, body){
+  try{
+    const r = await fetch(API+path, {method:'POST', headers:{'Content-Type':'application/json'}, body: body?JSON.stringify(body):'{}'});
+    if(!r.ok) throw new Error('HTTP '+r.status);
+    return await r.json();
+  }catch(e){
+    console.error('API POST error', path, e);
+    return null;
+  }
+}
+
+async function enrichEntity(kind, id){
+  const targetId = 'enrich-out-'+kind+'-'+id;
+  const target = document.getElementById(targetId);
+  if(target) target.innerHTML = '<div class="loading">⏳ Obogaćivanje u tijeku — pretraživanje izvora…</div>';
+  const r = await apiPost('/v2/enrich/'+kind+'/'+id);
+  if(!r){ if(target) target.innerHTML = '<div class="empty">Greška pri obogaćivanju</div>'; return; }
+  const cov = r.coverage||0;
+  const covCls = cov>=70?'high':(cov>=40?'mid':'low');
+  const html = `
+    <div style="display:flex;gap:8px;align-items:center;margin-bottom:10px">
+      <span class="tag gr">🟢 OBOGAĆENO</span>
+      <span class="score ${covCls}">Coverage ${cov}%</span>
+      <span class="tb-s">${r.filled_fields}/${r.total_fields} polja popunjeno</span>
+    </div>
+    ${r.live_snippet && r.live_snippet.title ? `
+      <div style="padding:10px;background:var(--bg3);border-left:3px solid var(--pgz-gold);border-radius:5px;margin-bottom:10px">
+        <div style="font-size:11px;color:var(--t4);text-transform:uppercase;letter-spacing:.5px;margin-bottom:4px">📡 Live snippet</div>
+        <div style="font-weight:700;color:var(--t0);font-size:13px;margin-bottom:4px">${esc(r.live_snippet.title)}</div>
+        ${r.live_snippet.description ? '<div style="font-size:11.5px;color:var(--t1);line-height:1.5">'+esc(r.live_snippet.description)+'</div>' : ''}
+        <div style="margin-top:6px"><a href="${esc(r.live_snippet.url)}" target="_blank">↗ ${esc(r.live_snippet.url.slice(0,80))}</a></div>
+      </div>
+    ` : ''}
+    ${r.missing_fields && r.missing_fields.length ? `
+      <div style="margin-bottom:10px">
+        <div style="font-size:11px;color:var(--t2);margin-bottom:4px">Nedostaje:</div>
+        <div>${r.missing_fields.map(f=>'<span class="tag rd">'+esc(f)+'</span>').join('')}</div>
+      </div>
+    ` : ''}
+    <div>
+      <div style="font-size:11px;color:var(--t2);margin-bottom:6px">🔍 Istraži dalje:</div>
+      <div style="display:flex;flex-wrap:wrap;gap:6px">
+        ${(r.research_links||[]).map(l => '<a href="'+esc(l.url)+'" target="_blank" class="btn">'+l.icon+' '+esc(l.label)+'</a>').join('')}
+      </div>
+    </div>
+  `;
+  if(target) target.innerHTML = html;
+}
+
+function enrichBlock(kind, id){
+  return `
+    <div class="card" id="enrich-card-${kind}-${id}">
+      <div class="card-h">
+        <div class="card-t">✨ Obogati podatke</div>
+        <button class="btn primary" onclick="enrichEntity('${kind}',${id})">▶ Pokreni</button>
+      </div>
+      <div id="enrich-out-${kind}-${id}">
+        <div class="empty" style="padding:14px">Klikom na "Pokreni" platforma će pretražiti vanjske izvore (Google, Wikipedia, službene web stranice) i prikazati dopune za ovu entitetsku karticu.</div>
+      </div>
+    </div>
+  `;
+}
+function sortRows(rows, key, dir){
+  if(!key) return rows;
+  const sorted = rows.slice();
+  sorted.sort((a,b) => {
+    let av = a[key], bv = b[key];
+    if(av==null && bv==null) return 0;
+    if(av==null) return 1;
+    if(bv==null) return -1;
+    const an = typeof av === 'number' ? av : Number(av);
+    const bn = typeof bv === 'number' ? bv : Number(bv);
+    if(!isNaN(an) && !isNaN(bn) && (typeof av === 'number' || /^[-+]?\d+(\.\d+)?$/.test(String(av)))){
+      return dir==='asc' ? (an-bn) : (bn-an);
+    }
+    const cmp = String(av).localeCompare(String(bv), 'hr', {numeric:true});
+    return dir==='asc' ? cmp : -cmp;
+  });
+  return sorted;
+}
+function setSort(section, key){
+  const cur = _sort[section];
+  if(cur && cur.key === key){
+    _sort[section] = {key, dir: cur.dir==='asc' ? 'desc' : 'asc'};
+  } else {
+    _sort[section] = {key, dir: 'asc'};
+  }
+  // Re-render
+  switch(section){
+    case 'savezi': return applySaveziFilter();
+    case 'klubovi': return applyKluboviFilter();
+    case 'sportasi': return applySportasiFilter();
+    case 'objekti': return applyObjektiFilter();
+    case 'manifestacije': return applyManifFilter();
+    case 'financije': return refreshFinancije();
+  }
+}
+function sortHeader(section, key, label, klass){
+  const s = _sort[section];
+  const isCur = s && s.key === key;
+  const arrow = isCur ? (s.dir==='asc' ? ' ▲' : ' ▼') : '';
+  const cls = (klass||'') + ' sortable';
+  return '<th class="'+cls+'" onclick="setSort(\''+section+'\',\''+key+'\')" style="cursor:pointer;user-select:none">'+esc(label)+'<span style="color:var(--pgz-gold);font-weight:700">'+arrow+'</span></th>';
+}
+function debounce(fn, ms){
+  let t;
+  return function(){
+    const args = arguments;
+    clearTimeout(t);
+    t = setTimeout(()=>fn.apply(null, args), ms);
+  };
+}
+
+//=========== PANEL ===========
+function openPanel(title, html){
+  const t = $('#panel-hdr-t');
+  if(t) t.textContent = title || 'Detalji';
+  const b = $('#panel-body');
+  if(b) b.innerHTML = html;
+  $('#panel').classList.add('open');
+  $('#panel-overlay').classList.add('open');
+}
+function closePanel(){
+  $('#panel').classList.remove('open');
+  $('#panel-overlay').classList.remove('open');
+}
+document.addEventListener('keydown', e => { if(e.key==='Escape') closePanel(); });
+
+//=========== NAVIGATION ===========
+function buildNav(){
+  const nav = $('#nav');
+  nav.innerHTML = NAV_ITEMS.map(n => '<div class="nav-i '+(n.id===_state.section?'active':'')+'" data-id="'+n.id+'" data-label="'+n.label+'" onclick="navTo(\''+n.id+'\')"><span class="ic">'+n.ic+'</span><span class="lbl">'+n.label+'</span></div>').join('');
+}
+function toggleSidebar(){
+  const sb = document.getElementById('sb');
+  const tg = document.getElementById('sb-toggle');
+  if(!sb) return;
+  const isCollapsed = sb.classList.toggle('collapsed');
+  if(tg) tg.textContent = isCollapsed ? '⮞' : '⮜';
+  try { localStorage.setItem('sidebar-state', isCollapsed ? 'collapsed' : 'expanded'); } catch(e){}
+}
+function restoreSidebar(){
+  try {
+    const s = localStorage.getItem('sidebar-state');
+    if(s === 'collapsed'){
+      const sb = document.getElementById('sb');
+      const tg = document.getElementById('sb-toggle');
+      if(sb) sb.classList.add('collapsed');
+      if(tg) tg.textContent = '⮞';
+    }
+  } catch(e){}
+}
+function navTo(id){
+  _state.section = id;
+  $$('.nav-i').forEach(el => el.classList.toggle('active', el.dataset.id===id));
+  $$('.section').forEach(el => el.classList.remove('active'));
+  const sec = $('#pg-'+id);
+  if(sec) sec.classList.add('active');
+  const t = SECTION_TITLES[id] || [id, ''];
+  $('#tb-t').textContent = t[0];
+  $('#tb-s').textContent = t[1];
+  loadSection(id);
+}
+function loadSection(id){
+  switch(id){
+    case 'dashboard':     return loadDash();
+    case 'savezi':        return loadSavezi();
+    case 'klubovi':       return loadKlubovi();
+    case 'sportasi':      return loadSportasi();
+    case 'financije':     return loadFinancije();
+    case 'objekti':       return loadObjekti();
+    case 'manifestacije': return loadManifestacije();
+    case 'mreza':         return loadMreza();
+    case 'forenzika':     return loadForenzika();
+  }
+}
+
+//=========== DASHBOARD ===========
+async function loadDash(){
+  const root = $('#pg-dashboard');
+  root.innerHTML = '<div class="loading">Učitavanje dashboard podataka…</div>';
+  const d = await api('/dashboard');
+  if(!d){ root.innerHTML='<div class="empty">Greška pri dohvatu podataka</div>'; return; }
+  _cache.dash = d;
+  const proracun2026 = (d.proracun_trend||[]).filter(x=>x.godina===2026)[0];
+  const total2026 = proracun2026 ? proracun2026.ukupno : d.proracun_aktualni;
+
+  root.innerHTML = `
+    <div class="kpi-grid">
+      <div class="kpi"><div class="kpi-l">Saveza</div><div class="kpi-v">${fmtNum(d.aktivnih_saveza)}</div><div class="kpi-s">aktivnih</div></div>
+      <div class="kpi b"><div class="kpi-l">Klubova</div><div class="kpi-v">${fmtNum(d.aktivnih_klubova)}</div><div class="kpi-s">${d.nositelja_kvalitete||0} nositelja kvalitete</div></div>
+      <div class="kpi g"><div class="kpi-l">Sportaša</div><div class="kpi-v">${fmtNum(d.aktivnih_clanova)}</div><div class="kpi-s">${d.reprezentativaca||0} reprezentativaca</div></div>
+      <div class="kpi"><div class="kpi-l">Proračun ${proracun2026?proracun2026.godina:2026}</div><div class="kpi-v">${fmtEur(total2026)}</div><div class="kpi-s">javne potrebe u sportu</div></div>
+      <div class="kpi r"><div class="kpi-l">Kritičnih alarma</div><div class="kpi-v">${fmtNum(d.critical_alerts)}</div><div class="kpi-s">${d.warning_alerts||0} upozorenja</div></div>
+    </div>
+
+    <div class="row-2">
+      <div class="card">
+        <div class="card-h"><div class="card-t">📈 Proračun za sport po godinama</div><div class="tb-s">Klikni godinu za detalje (PDF dokumenti)</div></div>
+        <div class="chart-box"><canvas id="chProracun"></canvas></div>
+      </div>
+      <div class="card">
+        <div class="card-h"><div class="card-t">🏅 Top savezi po broju registriranih</div><div class="tb-s">Klikni za drill-down</div></div>
+        <div style="overflow-x:auto;max-height:340px;overflow-y:auto"><table>
+          <thead><tr><th>Savez</th><th class="num">Klubova</th><th class="num">Reg.</th><th class="num">Trenera</th><th class="num">Repr.</th></tr></thead>
+          <tbody>${(d.top_savezi||[]).slice(0,10).map(s => `
+            <tr onclick="openSavezByName('${esc(s.naziv).replace(/&#39;/g,"\\'")}')">
+              <td><b>${esc(s.naziv)}</b></td>
+              <td class="num">${fmtNum(s.klubova_clanica)}</td>
+              <td class="num">${fmtNum(s.registriranih)}</td>
+              <td class="num">${fmtNum(s.trenera)}</td>
+              <td class="num">${fmtNum(s.reprezentativaca)}</td>
+            </tr>`).join('')}</tbody>
+        </table></div>
+      </div>
+    </div>
+
+    <div class="card" style="margin-top:14px">
+      <div class="card-h">
+        <div class="card-t">💰 Najveći primatelji javnih potreba</div>
+        <div style="display:flex;gap:8px;align-items:center">
+          <select id="dash-god" onchange="refreshDashNositelji()" style="background:var(--bg2);border:1px solid var(--rim);border-radius:5px;padding:6px 10px;color:var(--t1);font-size:12px">
+            <option value="2026">2026</option>
+            <option value="2025" selected>2025</option>
+            <option value="2024">2024</option>
+          </select>
+          <span class="tb-s" id="dash-nos-cnt"></span>
+        </div>
+      </div>
+      <div id="dash-nos-out"><div class="loading">Učitavanje…</div></div>
+    </div>
+  `;
+  drawProracunChart(d.proracun_trend || []);
+  refreshDashNositelji();
+}
+
+async function refreshDashNositelji(){
+  const sel = $('#dash-god');
+  if(!sel) return;
+  const god = sel.value;
+  const out = $('#dash-nos-out');
+  out.innerHTML = '<div class="loading">Učitavanje primatelja '+god+'…</div>';
+  const d = await api('/v2/potpore/by-year?godina='+god);
+  if(!d){ out.innerHTML='<div class="empty">Greška pri dohvatu</div>'; return; }
+  const rows = (d.results || []).slice().sort((a,b)=>Number(b.iznos_eur||0)-Number(a.iznos_eur||0)).slice(0, 25);
+  $('#dash-nos-cnt').textContent = rows.length+' / '+(d.count||0)+' · ukupno '+fmtEur(d.total||0);
+  out.innerHTML = `<div style="overflow-x:auto"><table>
+    <thead><tr><th>#</th><th>Korisnik</th><th>Sport</th><th>Vrsta</th><th class="num">Iznos</th><th>PDF</th></tr></thead>
+    <tbody>${rows.map((r,i) => `
+      <tr onclick='openPrimateljDetail(${JSON.stringify(r).replace(/'/g,"&#39;")})'>
+        <td>${i+1}</td>
+        <td><b>${esc(r.korisnik)}</b></td>
+        <td>${txt(r.sport)}</td>
+        <td>${txt(r.vrsta)}</td>
+        <td class="num"><b>${fmtEurFull(r.iznos_eur)}</b></td>
+        <td>${r.source_url?'<a href="'+esc(r.source_url)+'" target="_blank" onclick="event.stopPropagation()">📄 PDF</a>':'—'}</td>
+      </tr>`).join('')}</tbody>
+  </table></div>`;
+}
+
+async function openSavezByName(name){
+  const list = _cache.savezi || (await api('/savezi?limit=250'))?.rows || [];
+  if(!_cache.savezi) _cache.savezi = list;
+  const target = list.find(s => s.naziv === name) || list.find(s => (s.naziv||'').toLowerCase() === name.toLowerCase());
+  if(target) return openSavez(target.id);
+  // Try fuzzy match by first two words
+  const prefix = name.split(' ').slice(0,2).join(' ').toLowerCase();
+  const fuzzy = list.find(s => (s.naziv||'').toLowerCase().includes(prefix));
+  if(fuzzy) return openSavez(fuzzy.id);
+  openPanel('Savez', '<div class="empty">Savez <b>'+esc(name)+'</b> nije pronađen u bazi.</div>');
+}
+
+async function openPrimateljDetail(r){
+  openPanel('Primatelj', '<div class="loading">Učitavanje detalja…</div>');
+  // Try to find matching klub by name
+  let klub = null;
+  if(_cache.klubovi){
+    const lower = (r.korisnik||'').toLowerCase();
+    klub = _cache.klubovi.find(k => (k.klub||'').toLowerCase() === lower);
+    if(!klub) klub = _cache.klubovi.find(k => (k.klub||'').toLowerCase().includes(lower) || lower.includes((k.klub||'').toLowerCase()));
+  }
+  if(klub){
+    return openKlub(klub.id);
+  }
+  // Fallback panel — show row data + PDF + same-year other primatelji from same source
+  const html = `
+    <div class="card-h" style="border:0;padding:0;margin-bottom:14px">
+      <div>
+        <div style="font-size:18px;font-weight:800;color:var(--t0)">${esc(r.korisnik)}</div>
+        <div style="font-size:12px;color:var(--t2);margin-top:4px">Primatelj proračuna ${r.godina}</div>
+      </div>
+    </div>
+    <div class="card">
+      <div class="card-h"><div class="card-t">📋 Detalji isplate</div></div>
+      <div class="kv">
+        <div class="k">Korisnik</div><div class="v">${esc(r.korisnik)}</div>
+        <div class="k">Sport</div><div class="v">${txt(r.sport)}</div>
+        <div class="k">Vrsta</div><div class="v">${txt(r.vrsta)}</div>
+        <div class="k">Iznos</div><div class="v"><b style="color:var(--pgz-gold);font-size:16px">${fmtEurFull(r.iznos_eur)}</b></div>
+        <div class="k">Godina</div><div class="v">${esc(r.godina)}</div>
+        <div class="k">Izvor</div><div class="v">${txt(r.izvor)}</div>
+        <div class="k">Napomena</div><div class="v">${txt(r.napomena)}</div>
+      </div>
+      ${r.source_url ? '<div style="margin-top:14px;text-align:center"><a href="'+esc(r.source_url)+'" target="_blank" class="btn primary" style="display:inline-block;text-decoration:none">📄 Otvori izvorni PDF dokument</a></div>' : '<div class="empty" style="margin-top:14px">PDF dokument nije dostupan za ovu stavku.</div>'}
+    </div>
+    <div class="card">
+      <div class="card-h"><div class="card-t">🔍 Klub nije povezan</div></div>
+      <div style="font-size:12px;color:var(--t2);line-height:1.5">
+        Korisnik <b>${esc(r.korisnik)}</b> nije automatski povezan s pojedinim klubom u bazi.
+        Provjeri klub ručno preko sekcije <a href="javascript:navTo('klubovi')">Klubovi</a> ili pretraži primatelja na izvornom dokumentu.
+      </div>
+    </div>
+  `;
+  openPanel('Primatelj · '+r.korisnik, html);
+}
+
+function drawProracunChart(trend){
+  const ctx = $('#chProracun');
+  if(!ctx) return;
+  if(_proracunChart){ _proracunChart.destroy(); _proracunChart=null; }
+  _proracunChart = new Chart(ctx, {
+    type:'bar',
+    data:{
+      labels: trend.map(x=>x.godina),
+      datasets:[{
+        label:'EUR',
+        data: trend.map(x=>x.ukupno),
+        backgroundColor: trend.map(x=> x.godina===2026 ? '#F4C430' : '#004CC4'),
+        borderRadius:4
+      }]
+    },
+    options:{
+      responsive:true, maintainAspectRatio:false,
+      plugins:{
+        legend:{display:false},
+        tooltip:{callbacks:{label:c => '€'+Number(c.parsed.y).toLocaleString('hr-HR')}}
+      },
+      scales:{
+        x:{ticks:{color:'#8a95b4'}, grid:{display:false}},
+        y:{ticks:{color:'#8a95b4', callback:v=>'€'+(v/1000)+'k'}, grid:{color:'#1e2a50'}}
+      },
+      onClick:(e, els) => {
+        if(els && els.length){
+          const i = els[0].index;
+          openProracunDrill(trend[i].godina, trend[i].ukupno);
+        }
+      }
+    }
+  });
+}
+
+async function openProracunDrill(godina, total){
+  openPanel('Proračun '+godina, '<div class="loading">Dohvaćanje primatelja…</div>');
+  const d = await api('/v2/potpore/by-year?godina='+godina);
+  if(!d){ openPanel('Proračun '+godina, '<div class="empty">Greška pri dohvatu</div>'); return; }
+  const rows = d.results || [];
+  const grandTotal = d.total || total || 0;
+  const html = `
+    <div class="kpi-grid" style="grid-template-columns:1fr 1fr">
+      <div class="kpi"><div class="kpi-l">Ukupno ${godina}</div><div class="kpi-v">${fmtEur(grandTotal)}</div></div>
+      <div class="kpi b"><div class="kpi-l">Primatelja</div><div class="kpi-v">${rows.length}</div></div>
+    </div>
+    <div style="overflow-x:auto"><table>
+      <thead><tr><th>#</th><th>Korisnik</th><th>Sport</th><th class="num">Iznos</th><th>PDF</th></tr></thead>
+      <tbody>
+        ${rows.map((r,i) => `
+          <tr class="no-click">
+            <td>${i+1}</td>
+            <td>${esc(r.korisnik)}</td>
+            <td>${txt(r.sport)}</td>
+            <td class="num"><b>${fmtEurFull(r.iznos_eur)}</b></td>
+            <td>${r.source_url ? '<a href="'+esc(r.source_url)+'" target="_blank">📄</a>' : '—'}</td>
+          </tr>`).join('')}
+      </tbody>
+    </table></div>
+  `;
+  openPanel('Primatelji proračuna · '+godina, html);
+}
+
+//=========== SAVEZI ===========
+async function loadSavezi(){
+  const root = $('#pg-savezi');
+  if(!_cache.savezi){
+    root.innerHTML = '<div class="loading">Učitavanje saveza…</div>';
+    const d = await api('/savezi?limit=250');
+    if(!d){ root.innerHTML='<div class="empty">Greška pri dohvatu</div>'; return; }
+    _cache.savezi = d.rows || [];
+  }
+  renderSaveziShell();
+  applySaveziFilter();
+}
+function renderSaveziShell(){
+  const root = $('#pg-savezi');
+  root.innerHTML = `
+    <div class="toolbar">
+      <input type="search" id="sav-q" placeholder="🔍 Pretraži savez…">
+      <select id="sav-pgz">
+        <option value="">Svi savezi</option>
+        <option value="1">Samo PGŽ relevantni</option>
+      </select>
+      <div class="toggle">
+        <button id="sav-card" class="${_state.viewSavezi==='card'?'active':''}" onclick="setSaveziView('card')">Kartice</button>
+        <button id="sav-table" class="${_state.viewSavezi==='table'?'active':''}" onclick="setSaveziView('table')">Tablica</button>
+      </div>
+      <span class="tb-s" id="sav-cnt"></span>
+    </div>
+    <div id="sav-out"></div>
+  `;
+  $('#sav-q').addEventListener('input', debounce(applySaveziFilter, 200));
+  $('#sav-pgz').addEventListener('change', applySaveziFilter);
+}
+function setSaveziView(v){
+  _state.viewSavezi = v;
+  $('#sav-card').classList.toggle('active', v==='card');
+  $('#sav-table').classList.toggle('active', v==='table');
+  applySaveziFilter();
+}
+function applySaveziFilter(){
+  const q = (($('#sav-q')?$('#sav-q').value:'') || '').toLowerCase().trim();
+  const pgz = $('#sav-pgz') ? $('#sav-pgz').value : '';
+  let rows = _cache.savezi || [];
+  if(q) rows = rows.filter(s => (s.naziv||'').toLowerCase().includes(q) || (s.sport||'').toLowerCase().includes(q));
+  if(pgz==='1') rows = rows.filter(s => s.pgz_relevant);
+  if(_sort.savezi) rows = sortRows(rows, _sort.savezi.key, _sort.savezi.dir);
+  $('#sav-cnt').textContent = rows.length+' saveza';
+  $('#sav-out').innerHTML = _state.viewSavezi==='card' ? renderSaveziGrid(rows) : renderSaveziTable(rows);
+}
+function renderSaveziGrid(rows){
+  if(!rows.length) return '<div class="empty">Nema rezultata</div>';
+  return '<div class="grid">'+rows.map(s => `
+    <div class="entity" onclick="openSavez(${s.id})">
+      ${s.pgz_relevant?'<div class="et-tag">PGŽ</div>':''}
+      <div class="et">${esc(s.naziv)}</div>
+      <div class="es">${txt(s.sport,'—')} · ${txt(s.predsjednik,'bez predsjednika')}</div>
+      <div class="em">
+        <span><b>${fmtNum(s.broj_klubova)}</b> klubova</span>
+        <span><b>${fmtNum(s.reg_2024)}</b> reg.</span>
+        <span><b>${fmtNum(s.treneri_2024)}</b> trenera</span>
+      </div>
+    </div>`).join('')+'</div>';
+}
+function renderSaveziTable(rows){
+  if(!rows.length) return '<div class="empty">Nema rezultata</div>';
+  return `<div class="card" style="padding:0;overflow-x:auto"><table>
+    <thead><tr>${sortHeader('savezi','naziv','Naziv','')}${sortHeader('savezi','sport','Sport','')}${sortHeader('savezi','predsjednik','Predsjednik','')}${sortHeader('savezi','email','Email','')}${sortHeader('savezi','broj_klubova','Klubova','num')}${sortHeader('savezi','reg_2024','Reg.','num')}${sortHeader('savezi','pgz_relevant','PGŽ','')}</tr></thead>
+    <tbody>${rows.map(s => `
+      <tr onclick="openSavez(${s.id})">
+        <td><b>${esc(s.naziv)}</b></td>
+        <td>${txt(s.sport)}</td>
+        <td>${txt(s.predsjednik)}</td>
+        <td>${s.email?'<span class="tag b">'+esc(s.email)+'</span>':'—'}</td>
+        <td class="num">${fmtNum(s.broj_klubova)}</td>
+        <td class="num">${fmtNum(s.reg_2024)}</td>
+        <td>${s.pgz_relevant?'<span class="tag gd">PGŽ</span>':'—'}</td>
+      </tr>`).join('')}</tbody>
+  </table></div>`;
+}
+
+async function openSavez(id){
+  openPanel('Savez', '<div class="loading">Učitavanje saveza…</div>');
+  const s = await api('/savezi/'+id);
+  if(!s || s.detail){
+    openPanel('Savez', '<div class="empty">Savez nije pronađen</div>');
+    return;
+  }
+  const ksearch = (s.naziv||'').split(' ').slice(0,2).join(' ');
+  const kr = await api('/klubovi?savez='+encodeURIComponent(ksearch)+'&limit=200');
+  const klubovi = (kr && kr.rows) ? kr.rows.filter(k => (k.savez||'').toLowerCase().includes(ksearch.toLowerCase())) : [];
+
+  const html = `
+    <div class="card-h" style="border:0;padding:0;margin-bottom:14px">
+      <div>
+        <div style="font-size:18px;font-weight:800;color:var(--t0)">${esc(s.naziv)}</div>
+        <div style="font-size:12px;color:var(--t2);margin-top:4px">${txt(s.sport,'—')} · ${s.region||'PGŽ'}</div>
+      </div>
+    </div>
+    <div class="kpi-grid" style="grid-template-columns:repeat(3,1fr);margin-bottom:14px">
+      <div class="kpi"><div class="kpi-l">Klubova</div><div class="kpi-v">${klubovi.length}</div></div>
+      <div class="kpi b"><div class="kpi-l">Godina osnutka</div><div class="kpi-v" style="font-size:18px">${txt(s.godina_osnutka)}</div></div>
+      <div class="kpi g"><div class="kpi-l">Status</div><div class="kpi-v" style="font-size:14px">${s.aktivan?'AKTIVAN':'NEAKTIVAN'}</div></div>
+    </div>
+
+    <div class="card">
+      <div class="card-h"><div class="card-t">📋 Osnovne informacije</div></div>
+      <div class="kv">
+        <div class="k">OIB</div><div class="v">${txt(s.oib)}</div>
+        <div class="k">Adresa</div><div class="v">${txt(s.adresa)}</div>
+        <div class="k">Predsjednik</div><div class="v">${txt(s.predsjednik)}</div>
+        <div class="k">Tajnik</div><div class="v">${txt(s.tajnik)}</div>
+        <div class="k">Email</div><div class="v">${s.email?'<a href="mailto:'+esc(s.email)+'">'+esc(s.email)+'</a>':'—'}</div>
+        <div class="k">Telefon</div><div class="v">${txt(s.telefon)}</div>
+        <div class="k">Web</div><div class="v">${s.web?'<a href="'+esc(s.web)+'" target="_blank">'+esc(s.web)+'</a>':'—'}</div>
+        <div class="k">IBAN</div><div class="v">${txt(s.iban)}</div>
+      </div>
+    </div>
+
+    <div class="card">
+      <div class="card-h"><div class="card-t">⬡ Klubovi članice (${klubovi.length})</div></div>
+      ${klubovi.length ? `<div style="overflow-x:auto;max-height:400px;overflow-y:auto"><table>
+        <thead><tr><th>Klub</th><th>Razina</th><th>Grad</th></tr></thead>
+        <tbody>${klubovi.slice(0,100).map(k => `
+          <tr onclick="closePanel();setTimeout(()=>openKlub(${k.id}),250)">
+            <td>${esc(k.klub||k.sport||'(bez naziva)')}${k.nositelj_kvalitete?' <span class="tag gd">N.K.</span>':''}</td>
+            <td>${txt(k.razina,'')}</td>
+            <td>${txt(k.grad)}</td>
+          </tr>`).join('')}
+        </tbody>
+      </table></div>` : '<div class="empty">Nema podataka o klubovima</div>'}
+    </div>
+
+    ${enrichBlock('savez', s.id)}
+  `;
+  openPanel('Savez · '+s.naziv, html);
+}
+
+//=========== KLUBOVI ===========
+async function loadKlubovi(){
+  const root = $('#pg-klubovi');
+  if(!_cache.klubovi){
+    root.innerHTML = '<div class="loading">Učitavanje klubova…</div>';
+    const d = await api('/klubovi?limit=500');
+    if(!d){ root.innerHTML='<div class="empty">Greška pri dohvatu</div>'; return; }
+    _cache.klubovi = d.rows || [];
+  }
+  renderKluboviShell();
+  applyKluboviFilter();
+}
+function renderKluboviShell(){
+  const root = $('#pg-klubovi');
+  const sports = Array.from(new Set((_cache.klubovi||[]).map(k=>k.sport).filter(Boolean))).sort().slice(0,80);
+  const grads = Array.from(new Set((_cache.klubovi||[]).map(k=>k.grad).filter(Boolean))).sort();
+  root.innerHTML = `
+    <div class="toolbar">
+      <input type="search" id="kl-q" placeholder="🔍 Pretraži klub…">
+      <select id="kl-sport"><option value="">Svi sportovi</option>${sports.map(s=>'<option value="'+esc(s)+'">'+esc(s)+'</option>').join('')}</select>
+      <select id="kl-grad"><option value="">Svi gradovi</option>${grads.map(g=>'<option value="'+esc(g)+'">'+esc(g)+'</option>').join('')}</select>
+      <label><input type="checkbox" id="kl-nk"> Nositelj kvalitete</label>
+      <div class="toggle">
+        <button id="kl-card" class="${_state.viewKlubovi==='card'?'active':''}" onclick="setKluboviView('card')">Kartice</button>
+        <button id="kl-table" class="${_state.viewKlubovi==='table'?'active':''}" onclick="setKluboviView('table')">Tablica</button>
+      </div>
+      <span class="tb-s" id="kl-cnt"></span>
+    </div>
+    <div id="kl-out"></div>
+  `;
+  $('#kl-q').addEventListener('input', debounce(applyKluboviFilter, 200));
+  $('#kl-sport').addEventListener('change', applyKluboviFilter);
+  $('#kl-grad').addEventListener('change', applyKluboviFilter);
+  $('#kl-nk').addEventListener('change', applyKluboviFilter);
+}
+function setKluboviView(v){
+  _state.viewKlubovi = v;
+  $('#kl-card').classList.toggle('active', v==='card');
+  $('#kl-table').classList.toggle('active', v==='table');
+  applyKluboviFilter();
+}
+function applyKluboviFilter(){
+  const q = (($('#kl-q')?$('#kl-q').value:'') || '').toLowerCase().trim();
+  const sport = $('#kl-sport') ? $('#kl-sport').value : '';
+  const grad = $('#kl-grad') ? $('#kl-grad').value : '';
+  const nk = $('#kl-nk') ? $('#kl-nk').checked : false;
+  let rows = _cache.klubovi || [];
+  if(q) rows = rows.filter(k => (k.klub||'').toLowerCase().includes(q) || (k.sport||'').toLowerCase().includes(q));
+  if(sport) rows = rows.filter(k => k.sport===sport);
+  if(grad) rows = rows.filter(k => k.grad===grad);
+  if(nk) rows = rows.filter(k => k.nositelj_kvalitete);
+  if(_sort.klubovi) rows = sortRows(rows, _sort.klubovi.key, _sort.klubovi.dir);
+  $('#kl-cnt').textContent = rows.length+' klubova';
+  const top = rows.slice(0, 300);
+  $('#kl-out').innerHTML = _state.viewKlubovi==='card' ? renderKluboviGrid(top) : renderKluboviTable(top);
+  if(rows.length>300){
+    $('#kl-out').insertAdjacentHTML('beforeend', '<div class="empty">… i još '+(rows.length-300)+' klubova. Suzite filtre.</div>');
+  }
+}
+function renderKluboviGrid(rows){
+  if(!rows.length) return '<div class="empty">Nema rezultata</div>';
+  return '<div class="grid-club">'+rows.map(k => `
+    <div class="entity" onclick="openKlub(${k.id})">
+      ${k.nositelj_kvalitete?'<div class="et-tag">N.K.</div>':''}
+      <div class="et">${esc(k.klub||k.sport||'(bez naziva)')}</div>
+      <div class="es">${txt(k.razina,'')} · ${txt(k.grad,'—')}</div>
+      <div class="em">
+        <span><b>${fmtNum(k.registriranih)}</b> reg.</span>
+        <span><b>${fmtNum(k.trenera)}</b> trenera</span>
+        <span><b>${fmtNum(k.reprezentativaca)}</b> repr.</span>
+      </div>
+    </div>`).join('')+'</div>';
+}
+function renderKluboviTable(rows){
+  if(!rows.length) return '<div class="empty">Nema rezultata</div>';
+  return `<div class="card" style="padding:0;overflow-x:auto"><table>
+    <thead><tr>${sortHeader('klubovi','klub','Klub','')}${sortHeader('klubovi','sport','Sport','')}${sortHeader('klubovi','razina','Razina','')}${sortHeader('klubovi','grad','Grad','')}${sortHeader('klubovi','registriranih','Reg.','num')}${sortHeader('klubovi','trenera','Trenera','num')}${sortHeader('klubovi','nositelj_kvalitete','Status','')}</tr></thead>
+    <tbody>${rows.map(k => `
+      <tr onclick="openKlub(${k.id})">
+        <td><b>${esc(k.klub||k.sport||'(bez naziva)')}</b></td>
+        <td>${txt(k.sport)}</td>
+        <td>${txt(k.razina)}</td>
+        <td>${txt(k.grad)}</td>
+        <td class="num">${fmtNum(k.registriranih)}</td>
+        <td class="num">${fmtNum(k.trenera)}</td>
+        <td>${k.nositelj_kvalitete?'<span class="tag gd">N.K.</span>':''}${k.aktivan?'<span class="tag gr">AKT</span>':'<span class="tag rd">NK</span>'}</td>
+      </tr>`).join('')}</tbody>
+  </table></div>`;
+}
+
+async function openKlub(id){
+  openPanel('Klub', '<div class="loading">Učitavanje kluba…</div>');
+  const k = await api('/klubovi/'+id);
+  if(!k || k.detail){
+    openPanel('Klub', '<div class="empty">Klub nije pronađen</div>');
+    return;
+  }
+  const stats = k.stats || {};
+  const clanovi = k.clanovi || [];
+  const potpore = k.potpore || [];
+  let scoreCount = 0;
+  if(k.oib) scoreCount++;
+  if(k.predsjednik) scoreCount++;
+  if(k.tajnik) scoreCount++;
+  if(k.email) scoreCount++;
+  if(k.web || k.web_stranica) scoreCount++;
+  if(k.sjediste || k.adresa) scoreCount++;
+  if(k.ciljevi) scoreCount++;
+  if(k.opis_djelatnosti) scoreCount++;
+  const scoreClass = scoreCount>=6?'high':(scoreCount>=4?'mid':'low');
+
+  const html = `
+    <div class="card-h" style="border:0;padding:0;margin-bottom:14px">
+      <div>
+        <div style="font-size:18px;font-weight:800;color:var(--t0)">${esc(k.naziv||'(bez naziva)')}</div>
+        <div style="font-size:12px;color:var(--t2);margin-top:4px">${txt(k.sport,'—')} · ${txt(k.razina,'')} · ${txt(k.grad,'')}</div>
+      </div>
+    </div>
+
+    <div class="kpi-grid" style="grid-template-columns:repeat(4,1fr);margin-bottom:14px">
+      <div class="kpi"><div class="kpi-l">Sportaša</div><div class="kpi-v">${fmtNum(stats.broj_clanova||clanovi.length)}</div></div>
+      <div class="kpi b"><div class="kpi-l">Registriranih</div><div class="kpi-v">${fmtNum(stats.broj_registriranih)}</div></div>
+      <div class="kpi g"><div class="kpi-l">Trenera</div><div class="kpi-v">${fmtNum(stats.broj_trenera)}</div></div>
+      <div class="kpi"><div class="kpi-l">Score baze</div><div class="kpi-v" style="font-size:18px"><span class="score ${scoreClass}">${scoreCount}/8</span></div></div>
+    </div>
+
+    <div class="tabs">
+      <div class="tab active" onclick="switchKlubTab(this,'k-info')">Info</div>
+      <div class="tab" onclick="switchKlubTab(this,'k-clan')">Sportaši (${clanovi.length})</div>
+      <div class="tab" onclick="switchKlubTab(this,'k-pot')">Potpore (${potpore.length})</div>
+    </div>
+
+    <div id="k-info" class="ktab">
+      <div class="kv">
+        <div class="k">Naziv</div><div class="v">${esc(k.naziv||'')}</div>
+        <div class="k">OIB</div><div class="v">${txt(k.oib)}</div>
+        <div class="k">Sport</div><div class="v">${txt(k.sport)}</div>
+        <div class="k">Razina</div><div class="v">${txt(k.razina)}</div>
+        <div class="k">Savez</div><div class="v">${txt(k.savez_naziv)}</div>
+        <div class="k">Predsjednik</div><div class="v">${txt(k.predsjednik)}</div>
+        <div class="k">Tajnik</div><div class="v">${txt(k.tajnik)}</div>
+        <div class="k">Trener</div><div class="v">${txt(k.trener_glavni)}</div>
+        <div class="k">Sjedište</div><div class="v">${txt(k.sjediste||k.adresa)}</div>
+        <div class="k">Grad</div><div class="v">${txt(k.grad)}</div>
+        <div class="k">Email</div><div class="v">${k.email?'<a href="mailto:'+esc(k.email)+'">'+esc(k.email)+'</a>':'—'}</div>
+        <div class="k">Telefon</div><div class="v">${txt(k.telefon)}</div>
+        <div class="k">Web</div><div class="v">${(k.web||k.web_stranica)?'<a href="'+esc(k.web||k.web_stranica)+'" target="_blank">'+esc(k.web||k.web_stranica)+'</a>':'—'}</div>
+        <div class="k">Osnovan</div><div class="v">${txt(k.godina_osnutka)}</div>
+        <div class="k">Nositelj kvalitete</div><div class="v">${k.nositelj_kvalitete?'<span class="tag gd">DA</span>':'<span class="tag">NE</span>'}</div>
+      </div>
+      ${k.napomena ? '<div class="card" style="margin-top:14px"><div class="card-t" style="margin-bottom:6px">Napomena</div><div style="font-size:12px;color:var(--t1);line-height:1.5">'+esc(k.napomena)+'</div></div>' : ''}
+    </div>
+
+    <div id="k-clan" class="ktab" style="display:none">
+      ${clanovi.length ? `<div style="overflow-x:auto;max-height:500px;overflow-y:auto"><table>
+        <thead><tr><th>Sportaš</th><th>Spol</th><th>Pozicija</th><th>Tagovi</th></tr></thead>
+        <tbody>${clanovi.map(c => `
+          <tr onclick="closePanel();setTimeout(()=>openSportas(${c.id}),250)">
+            <td><b>${esc(c.ime||'')} ${esc(c.prezime||'')}</b></td>
+            <td>${txt(c.spol)}</td>
+            <td>${txt(c.pozicija)}</td>
+            <td>${c.reprezentativac?'<span class="tag gd">REPR</span>':''}${c.kategoriziran?'<span class="tag b">KAT</span>':''}${c.stipendiran?'<span class="tag gr">STIP</span>':''}</td>
+          </tr>`).join('')}
+        </tbody>
+      </table></div>` : '<div class="empty">Nema podataka o sportašima</div>'}
+    </div>
+
+    <div id="k-pot" class="ktab" style="display:none">
+      ${potpore.length ? `<div style="overflow-x:auto"><table>
+        <thead><tr><th>Godina</th><th>Naziv</th><th class="num">Iznos</th></tr></thead>
+        <tbody>${potpore.map(p => `
+          <tr class="no-click">
+            <td>${esc(p.godina)}</td>
+            <td>${esc(p.naziv_kluba||'')}</td>
+            <td class="num"><b>${fmtEurFull(p.iznos)}</b></td>
+          </tr>`).join('')}
+        </tbody>
+      </table></div>` : '<div class="empty">Nema zabilježenih potpora</div>'}
+    </div>
+
+    ${enrichBlock('klub', k.id)}
+  `;
+  openPanel('Klub · '+(k.naziv||''), html);
+}
+function switchKlubTab(el, tabId){
+  const parent = el.parentElement;
+  parent.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));
+  el.classList.add('active');
+  parent.parentElement.querySelectorAll('.ktab').forEach(t=>t.style.display='none');
+  const target = document.getElementById(tabId);
+  if(target) target.style.display='block';
+}
+
+//=========== SPORTAŠI ===========
+async function loadSportasi(){
+  const root = $('#pg-sportasi');
+  if(!_cache.clanovi){
+    root.innerHTML = '<div class="loading">Učitavanje sportaša…</div>';
+    const d = await api('/clanovi-full?limit=500');
+    if(!d){ root.innerHTML='<div class="empty">Greška pri dohvatu</div>'; return; }
+    _cache.clanovi = d.rows || [];
+  }
+  renderSportasiShell();
+  applySportasiFilter();
+}
+function renderSportasiShell(){
+  const root = $('#pg-sportasi');
+  root.innerHTML = `
+    <div class="toolbar">
+      <input type="search" id="sp-q" placeholder="🔍 Ime ili prezime…">
+      <select id="sp-hoo">
+        <option value="">Sve HOO kategorije</option>
+        <option value="1">I. kategorija</option>
+        <option value="2">II. kategorija</option>
+        <option value="3">III. kategorija</option>
+        <option value="4">IV. kategorija</option>
+        <option value="5">V. kategorija</option>
+      </select>
+      <label><input type="checkbox" id="sp-rep"> Samo reprezentativci</label>
+      <label><input type="checkbox" id="sp-foto"> Samo s fotografijom</label>
+      <div class="toggle">
+        <button id="sp-card" class="${_state.viewSportasi==='card'?'active':''}" onclick="setSportasiView('card')">Kartice</button>
+        <button id="sp-table" class="${_state.viewSportasi==='table'?'active':''}" onclick="setSportasiView('table')">Tablica</button>
+      </div>
+      <span class="tb-s" id="sp-cnt"></span>
+      <button class="btn primary" onclick="openSportas(449)">⭐ Test: Josip Zec</button>
+    </div>
+    <div id="sp-out"></div>
+  `;
+  $('#sp-q').addEventListener('input', debounce(applySportasiFilter, 200));
+  $('#sp-hoo').addEventListener('change', applySportasiFilter);
+  $('#sp-rep').addEventListener('change', applySportasiFilter);
+  $('#sp-foto').addEventListener('change', applySportasiFilter);
+}
+function setSportasiView(v){
+  _state.viewSportasi = v;
+  $('#sp-card').classList.toggle('active', v==='card');
+  $('#sp-table').classList.toggle('active', v==='table');
+  applySportasiFilter();
+}
+function applySportasiFilter(){
+  const q = (($('#sp-q')?$('#sp-q').value:'') || '').toLowerCase().trim();
+  const hoo = $('#sp-hoo') ? $('#sp-hoo').value : '';
+  const rep = $('#sp-rep') ? $('#sp-rep').checked : false;
+  const foto = $('#sp-foto') ? $('#sp-foto').checked : false;
+  let rows = _cache.clanovi || [];
+  if(q) rows = rows.filter(c => ((c.ime||'')+' '+(c.prezime||'')).toLowerCase().includes(q));
+  if(rep) rows = rows.filter(c => c.reprezentativac);
+  if(foto) rows = rows.filter(c => c.slika_url);
+  if(hoo) rows = rows.filter(c => String(c.hoo_kategorija||c.kategorija_hoo||'')===hoo);
+  if(_sort.sportasi) rows = sortRows(rows, _sort.sportasi.key, _sort.sportasi.dir);
+  $('#sp-cnt').textContent = rows.length+' sportaša';
+  const top = rows.slice(0, 300);
+  $('#sp-out').innerHTML = _state.viewSportasi==='card' ? renderSportasiGrid(top) : renderSportasiTable(top);
+  if(rows.length>300){
+    $('#sp-out').insertAdjacentHTML('beforeend', '<div class="empty">… i još '+(rows.length-300)+' sportaša. Suzite filtre.</div>');
+  }
+}
+function renderSportasiGrid(rows){
+  if(!rows.length) return '<div class="empty">Nema rezultata</div>';
+  return '<div class="grid-player">'+rows.map(c => buildPlayerCard(c)).join('')+'</div>';
+}
+function buildPlayerCard(c){
+  const initials = (((c.ime||'?')[0]||'?')+((c.prezime||'?')[0]||'?')).toUpperCase();
+  const photo = c.slika_url ? '<img src="'+esc(c.slika_url)+'" alt="" onerror="this.style.display=\'none\';if(this.parentElement)this.parentElement.innerHTML=\'<div class=\\\'no\\\'>'+initials+'</div>\'">' : '<div class="no">'+initials+'</div>';
+  const hooCat = c.hoo_kategorija || c.kategorija_hoo;
+  return `
+    <div class="player-card" onclick="openSportas(${c.id})">
+      <div class="ph">${photo}</div>
+      <div class="pb">
+        <div class="pn">${esc(c.ime||'')} ${esc(c.prezime||'')}</div>
+        <div class="pp">${txt(c.sport,'—')} · ${txt(c.pozicija,'')}</div>
+        <div class="pk">${txt(c.klub_naziv_godisnjak,'')}</div>
+        <div class="badges">
+          ${c.reprezentativac?'<span class="badge repr">REPR</span>':''}
+          ${hooCat?'<span class="badge hoo">HOO '+esc(hooCat)+'</span>':''}
+          ${c.stipendiran?'<span class="badge">STIP</span>':''}
+          ${c.broj_dresa?'<span class="badge">#'+esc(c.broj_dresa)+'</span>':''}
+        </div>
+      </div>
+    </div>`;
+}
+function renderSportasiTable(rows){
+  if(!rows.length) return '<div class="empty">Nema rezultata</div>';
+  return `<div class="card" style="padding:0;overflow-x:auto"><table>
+    <thead><tr>${sortHeader('sportasi','prezime','Prezime','')}${sortHeader('sportasi','ime','Ime','')}${sortHeader('sportasi','sport','Sport','')}${sortHeader('sportasi','pozicija','Pozicija','')}${sortHeader('sportasi','hoo_kategorija','HOO','')}${sortHeader('sportasi','reprezentativac','Repr.','')}${sortHeader('sportasi','slika_url','Foto','')}</tr></thead>
+    <tbody>${rows.map(c => `
+      <tr onclick="openSportas(${c.id})">
+        <td><b>${esc(c.prezime||'')}</b></td>
+        <td>${esc(c.ime||'')}</td>
+        <td>${txt(c.sport)}</td>
+        <td>${txt(c.pozicija)}</td>
+        <td>${(c.hoo_kategorija||c.kategorija_hoo)?'<span class="tag b">'+esc(c.hoo_kategorija||c.kategorija_hoo)+'</span>':'—'}</td>
+        <td>${c.reprezentativac?'<span class="tag gd">DA</span>':'—'}</td>
+        <td>${c.slika_url?'📸':'—'}</td>
+      </tr>`).join('')}</tbody>
+  </table></div>`;
+}
+
+async function openSportas(id){
+  openPanel('Sportaš', '<div class="loading">Učitavanje profila…</div>');
+  const d = await api('/sportas/'+id+'/profil');
+  if(!d || d.detail){
+    openPanel('Sportaš', '<div class="empty">Sportaš nije pronađen</div>');
+    return;
+  }
+  const stats = d.stats || {};
+  const sezone = d.clan_sezona || [];
+  const utakmice = d.utakmice || [];
+  const nagrade = d.nagrade || [];
+  const godisnjaci = d.godisnjak_godine || d.godisnjaci || [];
+  const initials = (((d.ime||'?')[0]||'?')+((d.prezime||'?')[0]||'?')).toUpperCase();
+  const photo = d.slika_url ? '<img src="'+esc(d.slika_url)+'" alt="" onerror="this.style.display=\'none\';if(this.parentElement)this.parentElement.innerHTML=\'<div class=\\\'no\\\'>'+initials+'</div>\'">' : '<div class="no">'+initials+'</div>';
+  const dob = d.datum_rodjenja || d.datum_rodenja;
+  const hooCat = d.hoo_kategorija || d.kategorija_hoo;
+
+  const html = `
+    <div class="pp-hdr">
+      <div class="pp-foto">${photo}</div>
+      <div class="pp-info">
+        <div class="pp-name">${esc(d.ime||'')} ${esc(d.prezime||'')}</div>
+        <div class="pp-meta">${txt(d.sport,'—')} · ${txt(d.pozicija,'')} · <b>${esc(d.klub_naziv_full||d.klub_naziv_godisnjak||'—')}</b></div>
+        <div class="pp-meta">📅 ${fmtDate(dob)}${(d.mjesto_rodjenja||d.mjesto_rodenja)?' · '+esc(d.mjesto_rodjenja||d.mjesto_rodenja):''}</div>
+        <div class="pp-tags">
+          ${d.aktivan?'<span class="tag gr">AKTIVAN</span>':'<span class="tag rd">NEAKTIVAN</span>'}
+          ${d.reprezentativac?'<span class="tag gd">REPR</span>':''}
+          ${hooCat?'<span class="tag b">HOO '+esc(hooCat)+'</span>':''}
+          ${d.broj_dresa?'<span class="tag">#'+esc(d.broj_dresa)+'</span>':''}
+          ${d.stipendiran?'<span class="tag am">STIP</span>':''}
+        </div>
+      </div>
+    </div>
+
+    <div class="pp-stats">
+      <div class="pp-stat"><div class="v">${fmtNum(stats.ukupno_nastupa||0)}</div><div class="l">Nastupi</div></div>
+      <div class="pp-stat"><div class="v">${fmtNum(stats.ukupno_pogodaka||0)}</div><div class="l">Golovi</div></div>
+      <div class="pp-stat"><div class="v">${fmtNum(stats.ukupno_asistencija||0)}</div><div class="l">Asist.</div></div>
+      <div class="pp-stat"><div class="v" style="color:var(--amber)">${fmtNum(stats.ukupno_zutih||0)}</div><div class="l">Žuti</div></div>
+      <div class="pp-stat"><div class="v" style="color:var(--red)">${fmtNum(stats.ukupno_crvenih||0)}</div><div class="l">Crveni</div></div>
+      <div class="pp-stat"><div class="v">${fmtNum(stats.sezone_aktivne||sezone.length)}</div><div class="l">Sezona</div></div>
+    </div>
+
+    <div class="tabs">
+      <div class="tab active" onclick="switchPlayerTab(this,'p-sez')">Sezone (${sezone.length})</div>
+      <div class="tab" onclick="switchPlayerTab(this,'p-utak')">Utakmice (${utakmice.length})</div>
+      <div class="tab" onclick="switchPlayerTab(this,'p-bio')">Bio</div>
+      <div class="tab" onclick="switchPlayerTab(this,'p-god')">Godišnjaci (${godisnjaci.length})</div>
+      <div class="tab" onclick="switchPlayerTab(this,'p-nag')">Nagrade (${nagrade.length})</div>
+    </div>
+
+    <div id="p-sez" class="ptab">
+      ${sezone.length ? `<div style="overflow-x:auto"><table>
+        <thead><tr><th>Sezona</th><th>Natjecanje</th><th>Klub</th><th class="num">Nas.</th><th class="num">Gol.</th><th class="num">Asis.</th><th class="num">Žuti</th><th class="num">Crv.</th><th></th></tr></thead>
+        <tbody>${sezone.map(s => `
+          <tr class="no-click">
+            <td><b>${esc(s.sezona||'')}</b></td>
+            <td>${esc(s.natjecanje||'')}</td>
+            <td>${esc(s.klub_naziv||'')}</td>
+            <td class="num">${fmtNum(s.nastupi)}</td>
+            <td class="num"><b style="color:var(--pgz-gold)">${fmtNum(s.pogoci)}</b></td>
+            <td class="num">${fmtNum(s.asistencije)}</td>
+            <td class="num">${fmtNum(s.zuti_kartoni)}</td>
+            <td class="num">${fmtNum(s.crveni_kartoni)}</td>
+            <td>${s.natjecanje_url?'<a href="'+esc(s.natjecanje_url)+'" target="_blank">↗</a>':''}</td>
+          </tr>`).join('')}
+        </tbody>
+      </table></div>` : '<div class="empty">Nema sezonskih podataka</div>'}
+    </div>
+
+    <div id="p-utak" class="ptab" style="display:none">
+      ${utakmice.length ? `<div style="overflow-x:auto;max-height:500px;overflow-y:auto"><table>
+        <thead><tr><th>Datum</th><th>Natjecanje</th><th colspan="3">Susret</th><th class="num">Gol.</th><th class="num">Min.</th><th></th></tr></thead>
+        <tbody>${utakmice.map(u => `
+          <tr class="no-click">
+            <td>${fmtDate(u.datum)}</td>
+            <td>${esc(u.natjecanje||'')}</td>
+            <td>${u.klub_dom_logo?'<img src="'+esc(u.klub_dom_logo)+'" class="utlogo" onerror="this.style.display=\'none\'">':''}${esc(u.klub_dom||'')}</td>
+            <td><b>${esc(u.rezultat||'-')}</b></td>
+            <td>${u.klub_gost_logo?'<img src="'+esc(u.klub_gost_logo)+'" class="utlogo" onerror="this.style.display=\'none\'">':''}${esc(u.klub_gost||'')}</td>
+            <td class="num"><b style="color:var(--pgz-gold)">${fmtNum(u.pogodaka)}</b></td>
+            <td class="num">${fmtNum(u.minute)}</td>
+            <td>${u.source_url?'<a href="'+esc(u.source_url)+'" target="_blank">↗</a>':''}</td>
+          </tr>`).join('')}
+        </tbody>
+      </table></div>` : '<div class="empty">Nema podataka o utakmicama</div>'}
+    </div>
+
+    <div id="p-bio" class="ptab" style="display:none">
+      <div class="kv">
+        <div class="k">OIB</div><div class="v">${txt(d.oib)}</div>
+        <div class="k">Datum rođenja</div><div class="v">${fmtDate(dob)}</div>
+        <div class="k">Mjesto rođenja</div><div class="v">${txt(d.mjesto_rodjenja||d.mjesto_rodenja)}</div>
+        <div class="k">Spol</div><div class="v">${txt(d.spol)}</div>
+        <div class="k">Visina</div><div class="v">${d.visina_cm?d.visina_cm+' cm':'—'}</div>
+        <div class="k">Težina</div><div class="v">${d.tezina_kg?d.tezina_kg+' kg':'—'}</div>
+        <div class="k">Dom. noga</div><div class="v">${txt(d.dominantna_noga)}</div>
+        <div class="k">Status</div><div class="v">${d.aktivan?'AKTIVAN':'NEAKTIVAN'}</div>
+        <div class="k">Datum pristupa</div><div class="v">${fmtDate(d.datum_pristupa)}</div>
+        <div class="k">Email</div><div class="v">${d.email?'<a href="mailto:'+esc(d.email)+'">'+esc(d.email)+'</a>':'—'}</div>
+        <div class="k">Telefon</div><div class="v">${txt(d.telefon)}</div>
+        <div class="k">Profil</div><div class="v">${(d.profile_url||d.scrape_url)?'<a href="'+esc(d.profile_url||d.scrape_url)+'" target="_blank">↗ vanjski profil</a>':'—'}</div>
+      </div>
+      ${d.biografija ? '<div class="card" style="margin-top:14px"><div class="card-t">Biografija</div><div style="font-size:12px;line-height:1.5;color:var(--t1);margin-top:6px">'+esc(d.biografija)+'</div></div>' : ''}
+    </div>
+
+    <div id="p-god" class="ptab" style="display:none">
+      ${godisnjaci.length ? `<div class="kv">
+        <div class="k">Prvi godišnjak</div><div class="v">${esc(d.godisnjak_prvi||godisnjaci[0])}</div>
+        <div class="k">Zadnji godišnjak</div><div class="v">${esc(d.godisnjak_zadnji||godisnjaci[godisnjaci.length-1])}</div>
+        <div class="k">Sve godine</div><div class="v">${godisnjaci.map(g=>'<span class="tag b">'+esc(g)+'</span>').join(' ')}</div>
+      </div>` : '<div class="empty">Nema podataka o godišnjacima</div>'}
+    </div>
+
+    <div id="p-nag" class="ptab" style="display:none">
+      ${nagrade.length ? `<div style="overflow-x:auto"><table>
+        <thead><tr><th>Godina</th><th>Nagrada</th><th>Razina</th></tr></thead>
+        <tbody>${nagrade.map(n => `
+          <tr class="no-click">
+            <td>${esc(n.godina||'')}</td>
+            <td>${esc(n.naziv||n.nagrada||'')}</td>
+            <td>${esc(n.razina||'')}</td>
+          </tr>`).join('')}
+        </tbody>
+      </table></div>` : '<div class="empty">Nema zabilježenih nagrada</div>'}
+    </div>
+
+    ${enrichBlock('sportas', d.id)}
+  `;
+  openPanel('Sportaš · '+(d.ime||'')+' '+(d.prezime||''), html);
+}
+function switchPlayerTab(el, tabId){
+  const parent = el.parentElement;
+  parent.querySelectorAll('.tab').forEach(t=>t.classList.remove('active'));
+  el.classList.add('active');
+  parent.parentElement.querySelectorAll('.ptab').forEach(t=>t.style.display='none');
+  const target = document.getElementById(tabId);
+  if(target) target.style.display='block';
+}
+
+//=========== FINANCIJE ===========
+async function loadFinancije(){
+  const root = $('#pg-financije');
+  root.innerHTML = `
+    <div class="toolbar">
+      <select id="fi-god">
+        <option value="2026">2026</option>
+        <option value="2025">2025</option>
+        <option value="2024">2024</option>
+      </select>
+      <input type="search" id="fi-q" placeholder="🔍 Pretraži korisnika ili sport…">
+      <div class="toggle">
+        <button id="fi-card" class="${_state.viewFinancije==='card'?'active':''}" onclick="setFinancijeView('card')">Kartice</button>
+        <button id="fi-table-btn" class="${_state.viewFinancije==='table'?'active':''}" onclick="setFinancijeView('table')">Tablica</button>
+      </div>
+      <span class="tb-s" id="fi-cnt"></span>
+    </div>
+    <div id="fi-kpi"></div>
+    <div class="row-2" style="margin-top:14px">
+      <div class="card">
+        <div class="card-h"><div class="card-t">📊 Raspodjela po sportovima</div></div>
+        <div class="chart-box"><canvas id="chSport"></canvas></div>
+      </div>
+      <div class="card" id="fi-top"></div>
+    </div>
+    <div class="card" style="margin-top:14px">
+      <div class="card-h"><div class="card-t">📋 Svi primatelji</div></div>
+      <div id="fi-table"></div>
+    </div>
+  `;
+  $('#fi-god').addEventListener('change', refreshFinancije);
+  $('#fi-q').addEventListener('input', debounce(refreshFinancije, 200));
+  refreshFinancije();
+}
+async function refreshFinancije(){
+  const god = $('#fi-god').value;
+  const q = ($('#fi-q').value || '').toLowerCase().trim();
+  const [analytics, byyear] = await Promise.all([
+    api('/v2/analytics/proracun-sport?godina='+god),
+    api('/v2/potpore/by-year?godina='+god)
+  ]);
+  const total = (analytics && analytics.total) || (byyear && byyear.total) || 0;
+  const poSportu = (analytics && analytics.po_sportu) || [];
+  let rows = (byyear && byyear.results) || [];
+  if(q) rows = rows.filter(r => (r.korisnik||'').toLowerCase().includes(q) || (r.sport||'').toLowerCase().includes(q));
+
+  $('#fi-kpi').innerHTML = `
+    <div class="kpi-grid">
+      <div class="kpi"><div class="kpi-l">Ukupno ${god}</div><div class="kpi-v">${fmtEur(total)}</div></div>
+      <div class="kpi b"><div class="kpi-l">Primatelja</div><div class="kpi-v">${rows.length}</div></div>
+      <div class="kpi g"><div class="kpi-l">Sportova</div><div class="kpi-v">${poSportu.filter(x=>x.sport).length}</div></div>
+      <div class="kpi"><div class="kpi-l">Najveća stavka</div><div class="kpi-v" style="font-size:18px">${rows.length?fmtEur(Math.max.apply(null, rows.map(r=>Number(r.iznos_eur||0)))):'—'}</div></div>
+    </div>
+  `;
+  $('#fi-cnt').textContent = rows.length+' primatelja';
+
+  const top10 = rows.slice().sort((a,b)=>Number(b.iznos_eur||0)-Number(a.iznos_eur||0)).slice(0,10);
+  $('#fi-top').innerHTML = `
+    <div class="card-h"><div class="card-t">🏆 Top 10 primatelja</div></div>
+    <div style="overflow-x:auto;max-height:340px;overflow-y:auto"><table>
+      <thead><tr><th>#</th><th>Korisnik</th><th class="num">Iznos</th></tr></thead>
+      <tbody>${top10.map((r,i) => `
+        <tr class="no-click">
+          <td>${i+1}</td>
+          <td>${esc(r.korisnik)}</td>
+          <td class="num"><b>${fmtEur(r.iznos_eur)}</b></td>
+        </tr>`).join('')}</tbody>
+    </table></div>
+  `;
+
+  const sportData = poSportu.filter(x=>x.sport).slice(0, 12);
+  drawFinancijeChart(sportData);
+
+  let sortedRows = rows.slice();
+  if(_sort.financije) sortedRows = sortRows(sortedRows, _sort.financije.key, _sort.financije.dir);
+
+  if(_state.viewFinancije === 'card'){
+    $('#fi-table').innerHTML = '<div class="grid">'+sortedRows.map(r => `
+      <div class="entity" onclick='openPrimateljDetail(${JSON.stringify(r).replace(/'/g,"&#39;")})'>
+        ${r.source_url?'<div class="et-tag">📄 PDF</div>':''}
+        <div class="et">${esc(r.korisnik)}</div>
+        <div class="es">${txt(r.sport,'—')} · ${txt(r.vrsta,'')}</div>
+        <div class="em">
+          <span><b style="color:var(--pgz-gold)">${fmtEur(r.iznos_eur)}</b></span>
+          <span>${esc(r.godina||'')}</span>
+        </div>
+      </div>`).join('')+'</div>';
+  } else {
+    $('#fi-table').innerHTML = `<div style="overflow-x:auto"><table>
+      <thead><tr><th>#</th>${sortHeader('financije','korisnik','Korisnik','')}${sortHeader('financije','sport','Sport','')}${sortHeader('financije','vrsta','Vrsta','')}${sortHeader('financije','iznos_eur','Iznos','num')}${sortHeader('financije','izvor','Izvor','')}<th>PDF</th></tr></thead>
+      <tbody>${sortedRows.map((r,i) => `
+        <tr onclick='openPrimateljDetail(${JSON.stringify(r).replace(/'/g,"&#39;")})'>
+          <td>${i+1}</td>
+          <td><b>${esc(r.korisnik)}</b></td>
+          <td>${txt(r.sport)}</td>
+          <td>${txt(r.vrsta)}</td>
+          <td class="num"><b>${fmtEurFull(r.iznos_eur)}</b></td>
+          <td>${txt(r.izvor)}</td>
+          <td>${r.source_url?'<a href="'+esc(r.source_url)+'" target="_blank" onclick="event.stopPropagation()">📄</a>':'—'}</td>
+        </tr>`).join('')}
+      </tbody>
+    </table></div>`;
+  }
+}
+function setFinancijeView(v){
+  _state.viewFinancije = v;
+  const cb = $('#fi-card'), tb = $('#fi-table-btn');
+  if(cb) cb.classList.toggle('active', v==='card');
+  if(tb) tb.classList.toggle('active', v==='table');
+  refreshFinancije();
+}
+function drawFinancijeChart(data){
+  const ctx = $('#chSport');
+  if(!ctx) return;
+  if(_financijeChart){ _financijeChart.destroy(); _financijeChart=null; }
+  const colors = ['#003087','#004CC4','#F4C430','#00e88f','#00c8e8','#ff2d55','#f59e0b','#a855f7','#ec4899','#14b8a6','#84cc16','#f97316'];
+  _financijeChart = new Chart(ctx, {
+    type:'doughnut',
+    data:{
+      labels: data.map(x=>x.sport),
+      datasets:[{
+        data: data.map(x=>x.ukupno),
+        backgroundColor: colors.slice(0, data.length),
+        borderColor: '#0d1021',
+        borderWidth:2
+      }]
+    },
+    options:{
+      responsive:true, maintainAspectRatio:false,
+      plugins:{
+        legend:{position:'right', labels:{color:'#e2e6f0', font:{size:10}, boxWidth:10}},
+        tooltip:{callbacks:{label:c => c.label+': €'+Number(c.parsed).toLocaleString('hr-HR')}}
+      }
+    }
+  });
+}
+
+//=========== OBJEKTI ===========
+async function loadObjekti(){
+  const root = $('#pg-objekti');
+  if(!_cache.objekti){
+    root.innerHTML = '<div class="loading">Učitavanje objekata…</div>';
+    const d = await api('/sportski-objekti');
+    if(!d){ root.innerHTML='<div class="empty">Greška pri dohvatu</div>'; return; }
+    _cache.objekti = d.rows || (Array.isArray(d) ? d : []);
+  }
+  renderObjektiShell();
+  applyObjektiFilter();
+}
+function renderObjektiShell(){
+  const root = $('#pg-objekti');
+  const tipovi = Array.from(new Set((_cache.objekti||[]).map(o=>o.tip).filter(Boolean))).sort();
+  const grads = Array.from(new Set((_cache.objekti||[]).map(o=>o.grad).filter(Boolean))).sort();
+  root.innerHTML = `
+    <div class="toolbar">
+      <input type="search" id="ob-q" placeholder="🔍 Pretraži objekt…">
+      <select id="ob-tip"><option value="">Svi tipovi</option>${tipovi.map(t=>'<option value="'+esc(t)+'">'+esc(t)+'</option>').join('')}</select>
+      <select id="ob-grad"><option value="">Svi gradovi</option>${grads.map(g=>'<option value="'+esc(g)+'">'+esc(g)+'</option>').join('')}</select>
+      <label><input type="checkbox" id="ob-geo"> Samo s koordinatama</label>
+      <div class="toggle">
+        <button id="ob-card" class="${_state.viewObjekti==='card'?'active':''}" onclick="setObjektiView('card')">Kartice</button>
+        <button id="ob-table" class="${_state.viewObjekti==='table'?'active':''}" onclick="setObjektiView('table')">Tablica</button>
+      </div>
+      <span class="tb-s" id="ob-cnt"></span>
+    </div>
+    <div id="ob-out"></div>
+  `;
+  $('#ob-q').addEventListener('input', debounce(applyObjektiFilter, 200));
+  $('#ob-tip').addEventListener('change', applyObjektiFilter);
+  $('#ob-grad').addEventListener('change', applyObjektiFilter);
+  $('#ob-geo').addEventListener('change', applyObjektiFilter);
+}
+function setObjektiView(v){
+  _state.viewObjekti = v;
+  $('#ob-card').classList.toggle('active', v==='card');
+  $('#ob-table').classList.toggle('active', v==='table');
+  applyObjektiFilter();
+}
+function applyObjektiFilter(){
+  const q = (($('#ob-q')?$('#ob-q').value:'') || '').toLowerCase().trim();
+  const tip = $('#ob-tip') ? $('#ob-tip').value : '';
+  const grad = $('#ob-grad') ? $('#ob-grad').value : '';
+  const geo = $('#ob-geo') ? $('#ob-geo').checked : false;
+  let rows = _cache.objekti || [];
+  if(q) rows = rows.filter(o => (o.naziv||'').toLowerCase().includes(q) || (o.upravitelj||'').toLowerCase().includes(q));
+  if(tip) rows = rows.filter(o => o.tip===tip);
+  if(grad) rows = rows.filter(o => o.grad===grad);
+  if(geo) rows = rows.filter(o => o.lat && o.lng);
+  if(_sort.objekti) rows = sortRows(rows, _sort.objekti.key, _sort.objekti.dir);
+  $('#ob-cnt').textContent = rows.length+' objekata';
+  $('#ob-out').innerHTML = _state.viewObjekti==='card' ? renderObjektiGrid(rows) : renderObjektiTable(rows);
+}
+function renderObjektiGrid(rows){
+  if(!rows.length) return '<div class="empty">Nema rezultata</div>';
+  return '<div class="grid">'+rows.map(o => `
+    <div class="entity" onclick="openObjekt(${o.id})">
+      ${o.lat&&o.lng?'<div class="et-tag">📍 GEO</div>':''}
+      <div class="et">${esc(o.naziv)}</div>
+      <div class="es">${txt(o.tip,'—')} · ${txt(o.grad,'—')}</div>
+      <div class="em">
+        ${o.upravitelj?'<span>'+esc(o.upravitelj)+'</span>':''}
+        ${o.kapacitet?'<span><b>'+fmtNum(o.kapacitet)+'</b> mjesta</span>':''}
+        ${o.izgradeno?'<span>est. <b>'+esc(o.izgradeno)+'</b></span>':''}
+      </div>
+    </div>`).join('')+'</div>';
+}
+function renderObjektiTable(rows){
+  if(!rows.length) return '<div class="empty">Nema rezultata</div>';
+  return `<div class="card" style="padding:0;overflow-x:auto"><table>
+    <thead><tr>${sortHeader('objekti','naziv','Naziv','')}${sortHeader('objekti','tip','Tip','')}${sortHeader('objekti','grad','Grad','')}${sortHeader('objekti','upravitelj','Upravitelj','')}${sortHeader('objekti','izgradeno','Izgrađeno','num')}${sortHeader('objekti','lat','GPS','')}</tr></thead>
+    <tbody>${rows.map(o => `
+      <tr onclick="openObjekt(${o.id})">
+        <td><b>${esc(o.naziv)}</b></td>
+        <td>${txt(o.tip)}</td>
+        <td>${txt(o.grad)}</td>
+        <td>${txt(o.upravitelj)}</td>
+        <td class="num">${txt(o.izgradeno)}</td>
+        <td>${o.lat&&o.lng?'<span class="tag gr">📍</span>':'—'}</td>
+      </tr>`).join('')}</tbody>
+  </table></div>`;
+}
+function openObjekt(id){
+  const o = (_cache.objekti||[]).find(x => x.id===id);
+  if(!o){ openPanel('Objekt', '<div class="empty">Objekt nije pronađen</div>'); return; }
+  const mapUrl = (o.lat && o.lng) ? 'https://www.google.com/maps/search/?api=1&query='+o.lat+','+o.lng : null;
+  const embedUrl = (o.lat && o.lng) ? 'https://www.google.com/maps?q='+encodeURIComponent((o.naziv||'')+', '+(o.grad||'')+', PGŽ')+'&ll='+o.lat+','+o.lng+'&z=17&output=embed' : null;
+  const html = `
+    <div class="card-h" style="border:0;padding:0;margin-bottom:14px">
+      <div>
+        <div style="font-size:18px;font-weight:800;color:var(--t0)">${esc(o.naziv)}</div>
+        <div style="font-size:12px;color:var(--t2);margin-top:4px">${txt(o.tip,'—')} · ${txt(o.grad,'')}</div>
+      </div>
+    </div>
+    ${embedUrl?'<iframe class="iframe-map" style="height:240px" src="'+embedUrl+'" loading="lazy"></iframe>':''}
+    <div class="card" style="margin-top:14px">
+      <div class="card-h"><div class="card-t">📋 Detalji</div></div>
+      <div class="kv">
+        <div class="k">Tip</div><div class="v">${txt(o.tip)}</div>
+        <div class="k">Adresa</div><div class="v">${txt(o.adresa)}</div>
+        <div class="k">Grad</div><div class="v">${txt(o.grad)}</div>
+        <div class="k">Upravitelj</div><div class="v">${txt(o.upravitelj)}</div>
+        <div class="k">OIB</div><div class="v">${txt(o.upravitelj_oib)}</div>
+        <div class="k">Kapacitet</div><div class="v">${o.kapacitet?fmtNum(o.kapacitet)+' mjesta':'—'}</div>
+        <div class="k">Veličina</div><div class="v">${txt(o.veličina)}</div>
+        <div class="k">Sportovi</div><div class="v">${(o.sportovi||[]).map(s=>'<span class="tag b">'+esc(s)+'</span>').join(' ')||'—'}</div>
+        <div class="k">Izgrađeno</div><div class="v">${txt(o.izgradeno)}</div>
+        <div class="k">Obnovljeno</div><div class="v">${txt(o.obnovljeno_god)}</div>
+        <div class="k">Natkriven</div><div class="v">${o.natkrita?'DA':'NE'}</div>
+        <div class="k">Web</div><div class="v">${o.web?'<a href="'+esc(o.web)+'" target="_blank">'+esc(o.web)+'</a>':'—'}</div>
+        <div class="k">Koordinate</div><div class="v">${(o.lat&&o.lng)?'<a href="'+mapUrl+'" target="_blank">'+o.lat.toFixed(5)+', '+o.lng.toFixed(5)+' ↗</a>':'—'}</div>
+      </div>
+    </div>
+  `;
+  openPanel('Objekt · '+o.naziv, html);
+}
+
+//=========== MANIFESTACIJE ===========
+async function loadManifestacije(){
+  const root = $('#pg-manifestacije');
+  if(!_cache.manifestacije){
+    root.innerHTML = '<div class="loading">Učitavanje manifestacija…</div>';
+    const d = await api('/manifestacije-full');
+    if(!d){ root.innerHTML='<div class="empty">Greška pri dohvatu</div>'; return; }
+    _cache.manifestacije = d.rows || (Array.isArray(d) ? d : []);
+  }
+  renderManifShell();
+  applyManifFilter();
+}
+function renderManifShell(){
+  const root = $('#pg-manifestacije');
+  const razine = Array.from(new Set((_cache.manifestacije||[]).map(m=>m.razina).filter(Boolean))).sort();
+  root.innerHTML = `
+    <div class="toolbar">
+      <input type="search" id="mn-q" placeholder="🔍 Pretraži manifestaciju…">
+      <select id="mn-raz"><option value="">Sve razine</option>${razine.map(r=>'<option value="'+esc(r)+'">'+esc(r)+'</option>').join('')}</select>
+      <div class="toggle">
+        <button id="mn-card" class="${_state.viewManif==='card'?'active':''}" onclick="setManifView('card')">Kartice</button>
+        <button id="mn-table" class="${_state.viewManif==='table'?'active':''}" onclick="setManifView('table')">Tablica</button>
+      </div>
+      <span class="tb-s" id="mn-cnt"></span>
+    </div>
+    <div id="mn-out"></div>
+  `;
+  $('#mn-q').addEventListener('input', debounce(applyManifFilter, 200));
+  $('#mn-raz').addEventListener('change', applyManifFilter);
+}
+function setManifView(v){
+  _state.viewManif = v;
+  $('#mn-card').classList.toggle('active', v==='card');
+  $('#mn-table').classList.toggle('active', v==='table');
+  applyManifFilter();
+}
+function applyManifFilter(){
+  const q = (($('#mn-q')?$('#mn-q').value:'') || '').toLowerCase().trim();
+  const raz = $('#mn-raz') ? $('#mn-raz').value : '';
+  let rows = _cache.manifestacije || [];
+  if(q) rows = rows.filter(m => (m.naziv||'').toLowerCase().includes(q) || (m.organizator||'').toLowerCase().includes(q) || (m.mjesto||'').toLowerCase().includes(q));
+  if(raz) rows = rows.filter(m => m.razina===raz);
+  if(_sort.manifestacije) rows = sortRows(rows, _sort.manifestacije.key, _sort.manifestacije.dir);
+  $('#mn-cnt').textContent = rows.length+' manifestacija';
+  $('#mn-out').innerHTML = _state.viewManif==='card' ? renderManifGrid(rows) : renderManifTable(rows);
+}
+function renderManifGrid(rows){
+  if(!rows.length) return '<div class="empty">Nema rezultata</div>';
+  return '<div class="grid">'+rows.map(m => `
+    <div class="entity" onclick="openManif(${m.id})">
+      ${m.razina?'<div class="et-tag">'+esc(m.razina)+'</div>':''}
+      <div class="et">${esc(m.naziv)}</div>
+      <div class="es">${txt(m.mjesto,'—')}${m.spol_kategorija?' · '+esc(m.spol_kategorija):''}</div>
+      <div class="em">
+        ${m.broj_ucesnika?'<span><b>'+esc(m.broj_ucesnika)+'</b> sudionika</span>':''}
+        ${m.organizator?'<span>'+esc((m.organizator||'').slice(0,40))+'</span>':''}
+      </div>
+    </div>`).join('')+'</div>';
+}
+function renderManifTable(rows){
+  if(!rows.length) return '<div class="empty">Nema rezultata</div>';
+  return `<div class="card" style="padding:0;overflow-x:auto"><table>
+    <thead><tr>${sortHeader('manifestacije','naziv','Naziv','')}${sortHeader('manifestacije','mjesto','Mjesto','')}${sortHeader('manifestacije','razina','Razina','')}${sortHeader('manifestacije','organizator','Organizator','')}${sortHeader('manifestacije','broj_ucesnika','Sudionici','')}<th>Link</th></tr></thead>
+    <tbody>${rows.map(m => `
+      <tr onclick="openManif(${m.id})">
+        <td><b>${esc(m.naziv)}</b></td>
+        <td>${txt(m.mjesto)}</td>
+        <td>${m.razina?'<span class="tag b">'+esc(m.razina)+'</span>':'—'}</td>
+        <td>${txt(m.organizator)}</td>
+        <td>${txt(m.broj_ucesnika)}</td>
+        <td>${m.source_url?'<a href="'+esc(m.source_url)+'" target="_blank">↗</a>':'—'}</td>
+      </tr>`).join('')}</tbody>
+  </table></div>`;
+}
+function openManif(id){
+  const m = (_cache.manifestacije||[]).find(x => x.id===id);
+  if(!m){ openPanel('Manifestacija', '<div class="empty">Nije pronađeno</div>'); return; }
+  // If we have a source_url, open it directly in a new tab
+  if(m.source_url){
+    window.open(m.source_url, '_blank', 'noopener');
+    return;
+  }
+  // Otherwise show details + Google search fallback
+  const gq = encodeURIComponent((m.naziv||'')+' '+(m.mjesto||'')+' sport');
+  const googleUrl = 'https://www.google.com/search?q='+gq;
+  const html = `
+    <div class="card-h" style="border:0;padding:0;margin-bottom:14px">
+      <div>
+        <div style="font-size:18px;font-weight:800;color:var(--t0)">${esc(m.naziv)}</div>
+        <div style="font-size:12px;color:var(--t2);margin-top:4px">${txt(m.mjesto,'—')} · ${txt(m.razina,'')}</div>
+      </div>
+    </div>
+    <div class="card">
+      <div class="card-h"><div class="card-t">📋 Detalji</div></div>
+      <div class="kv">
+        <div class="k">Organizator</div><div class="v">${txt(m.organizator)}</div>
+        <div class="k">Razina</div><div class="v">${m.razina?'<span class="tag b">'+esc(m.razina)+'</span>':'—'}</div>
+        <div class="k">Sudionici</div><div class="v">${txt(m.broj_ucesnika)}</div>
+        <div class="k">Spol/kategorija</div><div class="v">${txt(m.spol_kategorija)}</div>
+        <div class="k">Godina od</div><div class="v">${txt(m.godina_od)}</div>
+        <div class="k">Mjesto</div><div class="v">${txt(m.mjesto)}</div>
+      </div>
+      ${m.napomena ? '<div style="margin-top:14px;font-size:12px;line-height:1.5;color:var(--t1);padding:10px;background:var(--bg3);border-radius:5px">'+esc(m.napomena)+'</div>' : ''}
+    </div>
+    <div class="card">
+      <div class="card-h"><div class="card-t">🌐 Online izvori</div></div>
+      <div class="empty" style="padding:14px">Nema poznatog izvornog URL-a. Pokušaj pronaći više informacija online:</div>
+      <div style="text-align:center;margin-top:10px">
+        <a href="${googleUrl}" target="_blank" class="btn primary" style="display:inline-block;text-decoration:none">🔍 Pretraži na Googleu</a>
+      </div>
+    </div>
+  `;
+  openPanel('Manifestacija · '+m.naziv, html);
+}
+
+//=========== MREŽA (Network Graph) ===========
+const _mreza = {data:null, sim:null, allNodes:null, allEdges:null, filter:{osoba:'', klub:'', tvrtka:'', tip:''}};
+
+async function loadMreza(){
+  const root = $('#pg-mreza');
+  if(!_mreza.data){
+    root.innerHTML = '<div class="loading">Učitavanje grafa entiteta…</div>';
+    let resp;
+    try{
+      const r = await fetch('https://api.rinet.one/api/v1/presenter/graph-real');
+      resp = await r.json();
+    }catch(e){ console.error('graph fetch error', e); }
+    if(!resp || !resp.data){ root.innerHTML='<div class="empty">Greška pri dohvatu graf-podataka</div>'; return; }
+    _mreza.data = resp.data;
+    _mreza.allNodes = (resp.data.nodes||[]).slice();
+    _mreza.allEdges = (resp.data.edges||[]).slice();
+  }
+  renderMrezaShell();
+  renderMrezaGraph();
+}
+
+function renderMrezaShell(){
+  const root = $('#pg-mreza');
+  const types = Array.from(new Set((_mreza.allNodes||[]).map(n=>n.type))).sort();
+  const totalN = (_mreza.allNodes||[]).length;
+  const totalE = (_mreza.allEdges||[]).length;
+  root.innerHTML = `
+    <div class="kpi-grid" style="grid-template-columns:repeat(4,1fr);margin-bottom:14px">
+      <div class="kpi"><div class="kpi-l">Čvorova</div><div class="kpi-v">${totalN}</div></div>
+      <div class="kpi b"><div class="kpi-l">Veza</div><div class="kpi-v">${totalE}</div></div>
+      <div class="kpi g"><div class="kpi-l">Osoba</div><div class="kpi-v">${(_mreza.allNodes||[]).filter(n=>n.type==='person').length}</div></div>
+      <div class="kpi r"><div class="kpi-l">Tvrtki / entiteta</div><div class="kpi-v">${(_mreza.allNodes||[]).filter(n=>n.type==='entity'||n.type==='supplier').length}</div></div>
+    </div>
+
+    <div class="toolbar" style="margin-bottom:10px">
+      <input type="search" id="mr-osoba" placeholder="👤 Osoba…">
+      <input type="search" id="mr-klub" placeholder="🏟 Klub / Savez…">
+      <input type="search" id="mr-tvrtka" placeholder="🏢 Tvrtka / Entitet…">
+      <select id="mr-tip">
+        <option value="">Svi tipovi</option>
+        ${types.map(t=>'<option value="'+esc(t)+'">'+esc(t)+'</option>').join('')}
+      </select>
+      <button class="btn" onclick="resetMreza()">↺ Reset</button>
+      <span class="tb-s" id="mr-cnt"></span>
+    </div>
+
+    <div class="card" style="padding:0;overflow:hidden">
+      <div id="mr-graph" style="width:100%;height:640px;background:radial-gradient(ellipse at center,var(--bg2) 0%,var(--bg0) 100%);position:relative">
+        <svg id="mr-svg" style="width:100%;height:100%"></svg>
+      </div>
+    </div>
+
+    <div class="card" style="margin-top:10px">
+      <div class="card-h"><div class="card-t">🎨 Legenda</div></div>
+      <div style="display:flex;gap:14px;flex-wrap:wrap;font-size:12px">
+        <div><span style="display:inline-block;width:12px;height:12px;border-radius:50%;background:#8b5cf6;vertical-align:middle;margin-right:5px"></span>Osoba</div>
+        <div><span style="display:inline-block;width:12px;height:12px;border-radius:50%;background:#ff4466;vertical-align:middle;margin-right:5px"></span>Entitet (high risk)</div>
+        <div><span style="display:inline-block;width:12px;height:12px;border-radius:50%;background:#00e68a;vertical-align:middle;margin-right:5px"></span>Dobavljač</div>
+        <div style="color:var(--t2)">Veličina = risk / promet · Klikni čvor za detalje</div>
+      </div>
+    </div>
+  `;
+  $('#mr-osoba').addEventListener('input', debounce(applyMrezaFilter, 200));
+  $('#mr-klub').addEventListener('input', debounce(applyMrezaFilter, 200));
+  $('#mr-tvrtka').addEventListener('input', debounce(applyMrezaFilter, 200));
+  $('#mr-tip').addEventListener('change', applyMrezaFilter);
+}
+
+function applyMrezaFilter(){
+  const osoba = ($('#mr-osoba').value||'').toLowerCase().trim();
+  const klub = ($('#mr-klub').value||'').toLowerCase().trim();
+  const tvrtka = ($('#mr-tvrtka').value||'').toLowerCase().trim();
+  const tip = $('#mr-tip').value;
+
+  let nodes = (_mreza.allNodes||[]).slice();
+  if(osoba) nodes = nodes.filter(n => n.type==='person' && (n.label||'').toLowerCase().includes(osoba) || n.type!=='person');
+  if(klub){
+    // filter entity/supplier by label match (savezi/klubovi appear as entities)
+    nodes = nodes.filter(n => {
+      if(n.type==='person') return true;
+      return (n.label||'').toLowerCase().includes(klub);
+    });
+  }
+  if(tvrtka){
+    nodes = nodes.filter(n => {
+      if(n.type==='person') return true;
+      return (n.label||'').toLowerCase().includes(tvrtka);
+    });
+  }
+  if(tip) nodes = nodes.filter(n => n.type===tip);
+  // Also filter to stronger: if osoba is set, drop persons not matching
+  if(osoba) nodes = nodes.filter(n => n.type!=='person' || (n.label||'').toLowerCase().includes(osoba));
+  if(klub) nodes = nodes.filter(n => n.type==='person' || (n.label||'').toLowerCase().includes(klub));
+  if(tvrtka) nodes = nodes.filter(n => n.type==='person' || (n.label||'').toLowerCase().includes(tvrtka));
+
+  const ids = new Set(nodes.map(n=>n.id));
+  let edges = (_mreza.allEdges||[]).filter(e => ids.has(e.source.id||e.source) && ids.has(e.target.id||e.target));
+  // After edge filter, keep only nodes that have at least one edge OR were direct matches
+  const used = new Set();
+  for(const e of edges){
+    used.add(e.source.id||e.source);
+    used.add(e.target.id||e.target);
+  }
+  // If we have any text filter, restrict to nodes that have edges; otherwise keep all
+  if(osoba||klub||tvrtka){
+    nodes = nodes.filter(n => used.has(n.id));
+  }
+
+  $('#mr-cnt').textContent = nodes.length+' čvorova · '+edges.length+' veza';
+  renderMrezaGraph(nodes, edges);
+}
+
+function resetMreza(){
+  $('#mr-osoba').value = '';
+  $('#mr-klub').value = '';
+  $('#mr-tvrtka').value = '';
+  $('#mr-tip').value = '';
+  applyMrezaFilter();
+}
+
+function renderMrezaGraph(nodes, edges){
+  if(!nodes) nodes = (_mreza.allNodes||[]).slice();
+  if(!edges) edges = (_mreza.allEdges||[]).slice();
+  const svgEl = document.getElementById('mr-svg');
+  if(!svgEl) return;
+  const container = document.getElementById('mr-graph');
+  const W = container.clientWidth || 800;
+  const H = container.clientHeight || 640;
+
+  if(_mreza.sim){ try{_mreza.sim.stop();}catch(e){} _mreza.sim = null; }
+
+  const svg = d3.select(svgEl);
+  svg.selectAll('*').remove();
+  svg.attr('viewBox', '0 0 '+W+' '+H);
+
+  // Deep-copy so D3 sim doesn't mutate originals
+  const N = nodes.map(n => Object.assign({}, n));
+  const Nmap = new Map(N.map(n=>[n.id, n]));
+  const E = edges.map(e => ({
+    source: Nmap.get(e.source.id||e.source) || (e.source.id||e.source),
+    target: Nmap.get(e.target.id||e.target) || (e.target.id||e.target),
+    color: e.color, size: e.size
+  })).filter(e => typeof e.source === 'object' && typeof e.target === 'object');
+
+  // Zoom/pan
+  const g = svg.append('g');
+  svg.call(d3.zoom().scaleExtent([0.2, 5]).on('zoom', (ev) => g.attr('transform', ev.transform)));
+
+  const sim = d3.forceSimulation(N)
+    .force('link', d3.forceLink(E).id(d => d.id).distance(d => 60 + 20/(d.size||1)))
+    .force('charge', d3.forceManyBody().strength(d => -50 - (d.size||5)*4))
+    .force('center', d3.forceCenter(W/2, H/2))
+    .force('collide', d3.forceCollide().radius(d => Math.max(6, (d.size||5)*0.7 + 4)));
+  _mreza.sim = sim;
+
+  const link = g.append('g')
+    .attr('stroke-opacity', 0.5)
+    .selectAll('line').data(E).join('line')
+    .attr('stroke', d => d.color || '#283560')
+    .attr('stroke-width', d => Math.max(0.4, (d.size||0.4)));
+
+  const node = g.append('g')
+    .selectAll('g').data(N).join('g')
+    .style('cursor','pointer')
+    .call(d3.drag()
+      .on('start', (ev,d) => { if(!ev.active) sim.alphaTarget(0.3).restart(); d.fx=d.x; d.fy=d.y; })
+      .on('drag',  (ev,d) => { d.fx=ev.x; d.fy=ev.y; })
+      .on('end',   (ev,d) => { if(!ev.active) sim.alphaTarget(0); d.fx=null; d.fy=null; }))
+    .on('click', (ev,d) => openMrezaNode(d));
+
+  node.append('circle')
+    .attr('r', d => Math.max(5, (d.size||5)*0.7))
+    .attr('fill', d => d.color || '#004CC4')
+    .attr('stroke', '#0d1021')
+    .attr('stroke-width', 1.5);
+
+  node.append('text')
+    .text(d => (d.label||'').slice(0,28))
+    .attr('x', d => Math.max(6, (d.size||5)*0.7) + 4)
+    .attr('y', 4)
+    .attr('fill', '#e2e6f0')
+    .attr('font-size', '10px')
+    .attr('font-family', 'Inter, sans-serif')
+    .style('pointer-events','none');
+
+  node.append('title').text(d => (d.label||'')+' ['+d.type+']');
+
+  sim.on('tick', () => {
+    link.attr('x1', d=>d.source.x).attr('y1', d=>d.source.y)
+        .attr('x2', d=>d.target.x).attr('y2', d=>d.target.y);
+    node.attr('transform', d => 'translate('+d.x+','+d.y+')');
+  });
+
+  if(!$('#mr-cnt').textContent){
+    $('#mr-cnt').textContent = N.length+' čvorova · '+E.length+' veza';
+  }
+}
+
+function openMrezaNode(n){
+  const m = n.meta || {};
+  // Find connected nodes
+  const id = n.id;
+  const edges = (_mreza.allEdges||[]).filter(e => (e.source.id||e.source)===id || (e.target.id||e.target)===id);
+  const connectedIds = new Set();
+  for(const e of edges){
+    const s = e.source.id||e.source;
+    const t = e.target.id||e.target;
+    if(s===id) connectedIds.add(t); else connectedIds.add(s);
+  }
+  const connected = (_mreza.allNodes||[]).filter(x => connectedIds.has(x.id));
+
+  let html = `
+    <div class="card-h" style="border:0;padding:0;margin-bottom:14px">
+      <div>
+        <div style="font-size:18px;font-weight:800;color:var(--t0)">${esc(n.label)}</div>
+        <div style="font-size:12px;color:var(--t2);margin-top:4px">
+          <span class="tag b">${esc(n.type)}</span>
+          ${m.risk?'<span class="tag rd">Risk '+m.risk+'</span>':''}
+          ${m.forensic?'<span class="tag am">Forenzika '+m.forensic+'</span>':''}
+        </div>
+      </div>
+    </div>
+
+    ${(m.risk!=null || m.forensic!=null) ? `
+    <div class="kpi-grid" style="grid-template-columns:repeat(3,1fr);margin-bottom:14px">
+      ${m.risk!=null ? '<div class="kpi r"><div class="kpi-l">Risk score</div><div class="kpi-v">'+m.risk+'</div></div>' : ''}
+      ${m.forensic!=null ? '<div class="kpi"><div class="kpi-l">Forenzički flag</div><div class="kpi-v">'+m.forensic+'</div></div>' : ''}
+      ${m.winner_contracts!=null ? '<div class="kpi b"><div class="kpi-l">Ugovori (W)</div><div class="kpi-v">'+m.winner_contracts+'</div></div>' : ''}
+    </div>` : ''}
+
+    <div class="card">
+      <div class="card-h"><div class="card-t">📋 Detalji</div></div>
+      <div class="kv">
+        <div class="k">ID</div><div class="v" style="font-family:var(--mono);font-size:11px">${esc(n.id)}</div>
+        <div class="k">Tip</div><div class="v">${esc(n.type)}</div>
+        <div class="k">Naziv</div><div class="v">${esc(n.label)}</div>
+        ${m.oib?'<div class="k">OIB</div><div class="v" style="font-family:var(--mono)">'+esc(m.oib)+'</div>':''}
+        ${m.city?'<div class="k">Grad</div><div class="v">'+esc(m.city)+'</div>':''}
+        ${m.buyer_contracts!=null?'<div class="k">Ugovori kao kupac</div><div class="v">'+m.buyer_contracts+'</div>':''}
+        ${m.buyer_value!=null?'<div class="k">Vrijednost (kupac)</div><div class="v">'+fmtEurFull(m.buyer_value)+'</div>':''}
+        ${m.winner_contracts!=null?'<div class="k">Ugovori kao dobavljač</div><div class="v">'+m.winner_contracts+'</div>':''}
+        ${m.total!=null?'<div class="k">Ukupan promet</div><div class="v"><b style="color:var(--pgz-gold)">'+fmtEurFull(m.total)+'</b></div>':''}
+        ${m.contracts!=null?'<div class="k">Broj ugovora</div><div class="v">'+m.contracts+'</div>':''}
+      </div>
+    </div>
+
+    <div class="card">
+      <div class="card-h"><div class="card-t">🔗 Veze (${connected.length})</div></div>
+      ${connected.length ? '<div style="overflow-x:auto;max-height:300px;overflow-y:auto"><table>'+
+        '<thead><tr><th>Tip</th><th>Naziv</th><th>Risk</th></tr></thead>'+
+        '<tbody>'+connected.slice(0,80).map(c => `
+          <tr onclick="openMrezaNode(${JSON.stringify(c).replace(/"/g,'&quot;')})">
+            <td><span class="tag b">${esc(c.type)}</span></td>
+            <td><b>${esc(c.label)}</b></td>
+            <td>${(c.meta&&c.meta.risk)||'—'}</td>
+          </tr>`).join('')+
+        '</tbody></table></div>' : '<div class="empty">Nema povezanih entiteta</div>'}
+    </div>
+
+    ${(m.forensic && m.forensic > 0 && n.type==='entity') ? `
+    <div class="card">
+      <div class="card-h"><div class="card-t">⚠ Forenzika</div></div>
+      <div class="alert-card crit">
+        <div class="at">${m.forensic} forenzičkih flagova</div>
+        <div class="ad">Ovaj entitet ima zabilježene forenzičke nalaze. Provjeri detalje u sekciji Forenzika.</div>
+      </div>
+    </div>` : ''}
+
+    ${(m.buyer_contracts && m.buyer_contracts > 0) ? `
+    <div class="card">
+      <div class="card-h"><div class="card-t">💼 Procurement</div></div>
+      <div class="kv">
+        <div class="k">Kao kupac</div><div class="v">${m.buyer_contracts} ugovora · ${fmtEurFull(m.buyer_value||0)}</div>
+      </div>
+    </div>` : ''}
+  `;
+  openPanel(n.label, html);
+}
+
+//=========== FORENZIKA ===========
+const _forenzika = {alerts:null, custom:null, filter:{severity:'', tip:'', q:''}};
+
+// Manual / custom forensic findings (not in DB) — flagship cases
+const _customFindings = [
+  {
+    id: 'liveric-pep',
+    severity: 'CRITICAL',
+    tip: 'sukob_interesa',
+    naslov: 'Velimir Liverić — PEP profil',
+    sazetak: 'Politički eksponirana osoba s povezanostima u sportskom ekosustavu PGŽ. Manualno označen za pojačanu reviziju.',
+    osoba: 'Velimir Liverić',
+    uloga: 'Politički eksponirana osoba (PEP)',
+    risk_score: 87,
+    uvod: 'Velimir Liverić figurira u više dokumenata vezanih uz raspodjelu sportskih sredstava u PGŽ. Zbog statusa politički eksponirane osobe (PEP) prema GDPR/AML standardima, sve transakcije i pozicije u upravnim odborima trebaju biti predmet pojačane provjere (EDD).',
+    povezane_entitete: [
+      {tip:'Tvrtka', naziv:'Politička pozicija u JLS', napomena:'Aktualna ili bivša funkcija u jedinici lokalne/područne samouprave'},
+      {tip:'Klub', naziv:'Provjeriti članstva u upravnim tijelima', napomena:'Manualna provjera potrebna'},
+      {tip:'Potpora', naziv:'Sufinanciranja u 2024–2026', napomena:'Provjeriti tokove novca prema povezanim klubovima'}
+    ],
+    timeline: [
+      {kad:'2026-01', sto:'Prvi flag — automatska detekcija imena u dokumentima'},
+      {kad:'2026-03', sto:'Ručna eskalacija za EDD pregled'},
+      {kad:'2026-04', sto:'Dodano u registar PEP osoba pgz-sport platforme'}
+    ],
+    breakdown: [
+      {kriterij:'PEP status', tezina:40},
+      {kriterij:'Više aktivnih veza s klubovima', tezina:25},
+      {kriterij:'Pristup javnim sredstvima', tezina:15},
+      {kriterij:'Nedostatak transparentne dokumentacije', tezina:7}
+    ]
+  },
+  {
+    id: 'klub-bez-oib',
+    severity: 'HIGH',
+    tip: 'data_quality',
+    naslov: 'Klubovi bez OIB-a',
+    sazetak: 'Više aktivnih klubova nema upisan OIB što onemogućuje pravnu validaciju primatelja potpora.',
+    risk_score: 60,
+    uvod: 'Bez OIB-a klubovi ne mogu biti automatski povezani s registrom poreznih obveznika i Ministarstvom pravosuđa. Riziku su izložena sufinanciranja jer nije moguće potvrditi pravnu osobnost primatelja.',
+    povezane_entitete: [],
+    timeline: [{kad:'kontinuirano', sto:'Detekcija pri unosu i scrape ciklusu'}],
+    breakdown: [
+      {kriterij:'Nedostatak ključnog identifikatora', tezina:35},
+      {kriterij:'Više klubova pogođeno', tezina:25}
+    ]
+  },
+  {
+    id: 'premali-klub-velik-iznos',
+    severity: 'HIGH',
+    tip: 'neobicna_isplata',
+    naslov: 'Mali klub — neproporcionalno velika potpora',
+    sazetak: 'Heuristička detekcija: klubovi s ispod 50 registriranih sportaša koji su dobili potporu iznad 30k EUR.',
+    risk_score: 55,
+    uvod: 'Pravilo: ako klub ima <50 sportaša a primio je >30 000 EUR potpore, vjerojatno postoji opravdani razlog (npr. infrastrukturna potpora ili nositelj kvalitete) — ali svaki slučaj zahtijeva ručnu validaciju.',
+    povezane_entitete: [{tip:'Klub', naziv:'Više klubova zadovoljava heuristiku'}],
+    timeline: [{kad:'svakodnevno', sto:'Heuristika prolazi kroz tablicu sufinanciranja'}],
+    breakdown: [
+      {kriterij:'Disproporcija veličina/iznos', tezina:30},
+      {kriterij:'Nepostojanje "nositelj kvalitete" oznake', tezina:25}
+    ]
+  }
+];
+
+async function loadForenzika(){
+  const root = $('#pg-forenzika');
+  if(!_forenzika.alerts){
+    root.innerHTML = '<div class="loading">Učitavanje alarma…</div>';
+    const al = await api('/v2/alerts');
+    _forenzika.alerts = Array.isArray(al) ? al : [];
+  }
+  if(!_forenzika.custom) _forenzika.custom = _customFindings.slice();
+  let d = _cache.dash;
+  if(!d){ d = await api('/dashboard'); if(d) _cache.dash = d; }
+  d = d || {};
+  renderForenzikaShell(d);
+  applyForenzikaFilter();
+}
+
+function renderForenzikaShell(d){
+  const root = $('#pg-forenzika');
+  const alerts = _forenzika.alerts || [];
+  const tipovi = Array.from(new Set([
+    ..._forenzika.custom.map(c=>c.tip),
+    ...alerts.map(a=>a.tip).filter(Boolean)
+  ])).sort();
+  root.innerHTML = `
+    <div class="kpi-grid">
+      <div class="kpi r"><div class="kpi-l">Kritičnih</div><div class="kpi-v">${alerts.filter(a=>a.razina==='CRITICAL').length + _forenzika.custom.filter(c=>c.severity==='CRITICAL').length}</div><div class="kpi-s">SEVERITY: CRITICAL</div></div>
+      <div class="kpi"><div class="kpi-l">High</div><div class="kpi-v">${_forenzika.custom.filter(c=>c.severity==='HIGH').length}</div><div class="kpi-s">forenzički nalazi</div></div>
+      <div class="kpi b"><div class="kpi-l">Upozorenja</div><div class="kpi-v">${alerts.filter(a=>a.razina==='WARNING').length}</div></div>
+      <div class="kpi g"><div class="kpi-l">Naplaćeno članarina</div><div class="kpi-v" style="font-size:18px">${fmtEur(d.naplaceno_clanarine_god||0)}</div></div>
+      <div class="kpi"><div class="kpi-l">Dug članarina</div><div class="kpi-v" style="font-size:18px">${fmtEur(d.dug_clanarine_god||0)}</div></div>
+    </div>
+
+    <div class="toolbar">
+      <input type="search" id="fz-q" placeholder="🔍 Pretraži po imenu, klubu, nalazu…">
+      <select id="fz-sev">
+        <option value="">Sve razine</option>
+        <option value="CRITICAL">🔴 CRITICAL</option>
+        <option value="HIGH">🟠 HIGH</option>
+        <option value="WARNING">🟡 WARNING</option>
+        <option value="MEDIUM">🟡 MEDIUM</option>
+      </select>
+      <select id="fz-tip">
+        <option value="">Svi tipovi</option>
+        ${tipovi.map(t=>'<option value="'+esc(t)+'">'+esc(t)+'</option>').join('')}
+      </select>
+      <button class="btn primary" onclick="runForensicScan()">⚡ Pokreni novu analizu</button>
+      <span class="tb-s" id="fz-cnt"></span>
+    </div>
+
+    <div id="fz-out"></div>
+  `;
+  $('#fz-q').addEventListener('input', debounce(applyForenzikaFilter, 200));
+  $('#fz-sev').addEventListener('change', applyForenzikaFilter);
+  $('#fz-tip').addEventListener('change', applyForenzikaFilter);
+}
+
+function applyForenzikaFilter(){
+  const q = (($('#fz-q')?$('#fz-q').value:'') || '').toLowerCase().trim();
+  const sev = $('#fz-sev') ? $('#fz-sev').value : '';
+  const tip = $('#fz-tip') ? $('#fz-tip').value : '';
+
+  // Combine custom findings + DB alerts into a unified list
+  const combined = [];
+  for(const c of (_forenzika.custom||[])){
+    combined.push({
+      _kind: 'custom', id: c.id, severity: c.severity, tip: c.tip,
+      naslov: c.naslov, poruka: c.sazetak, klub_id: null, clan_id: null, datum: null,
+      raw: c
+    });
+  }
+  for(const a of (_forenzika.alerts||[])){
+    combined.push({
+      _kind: 'alert', id: a.id, severity: a.razina, tip: a.tip,
+      naslov: '['+a.tip+'] '+(a.poruka||'').slice(0,80),
+      poruka: a.poruka, klub_id: a.klub_id, clan_id: a.clan_id, datum: a.datum,
+      raw: a
+    });
+  }
+  let rows = combined;
+  if(q) rows = rows.filter(r => (r.naslov||'').toLowerCase().includes(q) || (r.poruka||'').toLowerCase().includes(q) || (r.tip||'').toLowerCase().includes(q));
+  if(sev) rows = rows.filter(r => r.severity===sev);
+  if(tip) rows = rows.filter(r => r.tip===tip);
+
+  $('#fz-cnt').textContent = rows.length+' nalaza';
+  const out = $('#fz-out');
+  if(!rows.length){ out.innerHTML='<div class="empty">Nema rezultata pri tim filtrima</div>'; return; }
+  out.innerHTML = rows.map((r,i) => {
+    const sevClass = r.severity==='CRITICAL'?'crit':(r.severity==='HIGH'?'crit':'');
+    const sevColor = r.severity==='CRITICAL'?'rd':(r.severity==='HIGH'?'am':'b');
+    return `
+      <div class="alert-card ${sevClass}" style="cursor:pointer;display:flex;align-items:center;gap:12px;padding:12px 14px" onclick="openForensicDetail('${r._kind}','${r.id}')">
+        <div style="font-size:22px;flex-shrink:0">${r.severity==='CRITICAL'?'🔴':r.severity==='HIGH'?'🟠':'🟡'}</div>
+        <div style="flex:1;min-width:0">
+          <div class="at">${esc(r.naslov)}</div>
+          <div class="ad">${esc(r.poruka||'')}</div>
+          ${r.datum?'<div class="ad">📅 '+fmtDate(r.datum)+'</div>':''}
+        </div>
+        <div><span class="tag ${sevColor}">${esc(r.severity||'?')}</span></div>
+        <div style="color:var(--t4);font-size:18px">›</div>
+      </div>
+    `;
+  }).join('');
+}
+
+function openForensicDetail(kind, id){
+  if(kind === 'custom'){
+    const c = (_forenzika.custom||[]).find(x => x.id === id);
+    if(!c){ openPanel('Nalaz', '<div class="empty">Nalaz nije pronađen</div>'); return; }
+    return renderCustomFindingPanel(c);
+  } else {
+    const a = (_forenzika.alerts||[]).find(x => String(x.id) === String(id));
+    if(!a){ openPanel('Alarm', '<div class="empty">Alarm nije pronađen</div>'); return; }
+    return renderAlertPanel(a);
+  }
+}
+
+function renderCustomFindingPanel(c){
+  const sevColor = c.severity==='CRITICAL'?'rd':(c.severity==='HIGH'?'am':'b');
+  const html = `
+    <div class="card-h" style="border:0;padding:0;margin-bottom:14px">
+      <div>
+        <div style="font-size:18px;font-weight:800;color:var(--t0)">${esc(c.naslov)}</div>
+        <div style="font-size:12px;color:var(--t2);margin-top:4px">
+          <span class="tag ${sevColor}">${esc(c.severity)}</span>
+          <span class="tag">${esc(c.tip)}</span>
+          ${c.osoba?'<span class="tag b">'+esc(c.osoba)+'</span>':''}
+        </div>
+      </div>
+    </div>
+
+    <div class="kpi-grid" style="grid-template-columns:1fr 1fr 1fr;margin-bottom:14px">
+      <div class="kpi r"><div class="kpi-l">Risk Score</div><div class="kpi-v">${c.risk_score||0}<span style="font-size:14px;color:var(--t2)">/100</span></div></div>
+      <div class="kpi"><div class="kpi-l">Severity</div><div class="kpi-v" style="font-size:16px">${esc(c.severity)}</div></div>
+      <div class="kpi b"><div class="kpi-l">Tip</div><div class="kpi-v" style="font-size:14px">${esc(c.tip)}</div></div>
+    </div>
+
+    <div class="card">
+      <div class="card-h"><div class="card-t">📖 Uvod u nalaz</div></div>
+      <div style="font-size:12px;line-height:1.6;color:var(--t1)">${esc(c.uvod)}</div>
+    </div>
+
+    ${c.povezane_entitete && c.povezane_entitete.length ? `
+    <div class="card">
+      <div class="card-h"><div class="card-t">🔗 Povezani entiteti (${c.povezane_entitete.length})</div></div>
+      <table>
+        <thead><tr><th>Tip</th><th>Naziv</th><th>Napomena</th></tr></thead>
+        <tbody>${c.povezane_entitete.map(e => `
+          <tr class="no-click">
+            <td><span class="tag b">${esc(e.tip)}</span></td>
+            <td><b>${esc(e.naziv)}</b></td>
+            <td>${esc(e.napomena||'')}</td>
+          </tr>`).join('')}</tbody>
+      </table>
+    </div>` : ''}
+
+    ${c.timeline && c.timeline.length ? `
+    <div class="card">
+      <div class="card-h"><div class="card-t">📅 Vremenska linija</div></div>
+      <div style="display:flex;flex-direction:column;gap:8px">
+        ${c.timeline.map(t => `
+          <div style="display:flex;gap:10px;padding:8px 10px;background:var(--bg3);border-radius:5px;border-left:3px solid var(--pgz-blue2)">
+            <div style="font-family:var(--mono);color:var(--pgz-gold);font-weight:700;font-size:11px;min-width:90px">${esc(t.kad)}</div>
+            <div style="font-size:12px;color:var(--t1)">${esc(t.sto)}</div>
+          </div>
+        `).join('')}
+      </div>
+    </div>` : ''}
+
+    ${c.breakdown && c.breakdown.length ? `
+    <div class="card">
+      <div class="card-h"><div class="card-t">📊 Risk score breakdown</div></div>
+      <div style="display:flex;flex-direction:column;gap:8px">
+        ${c.breakdown.map(b => {
+          const pct = Math.min(100, Math.round((b.tezina/100)*100));
+          return `
+          <div>
+            <div style="display:flex;justify-content:space-between;font-size:11px;margin-bottom:3px">
+              <span style="color:var(--t1)">${esc(b.kriterij)}</span>
+              <span style="font-family:var(--mono);color:var(--pgz-gold);font-weight:700">+${b.tezina}</span>
+            </div>
+            <div style="height:6px;background:var(--bg3);border-radius:3px;overflow:hidden">
+              <div style="height:100%;background:linear-gradient(90deg,var(--red),var(--pgz-gold));width:${pct}%"></div>
+            </div>
+          </div>`;
+        }).join('')}
+      </div>
+    </div>` : ''}
+
+    <div class="card">
+      <div class="card-h"><div class="card-t">📄 Dokumenti / dokazi</div></div>
+      <div class="empty" style="padding:14px">Za ovaj manualni nalaz nisu priloženi PDF dokazi. Pokreni "Obogati podatke" za prikupljanje izvora.</div>
+    </div>
+  `;
+  openPanel('Forenzika · '+c.naslov, html);
+}
+
+function renderAlertPanel(a){
+  const sevColor = a.razina==='CRITICAL'?'rd':(a.razina==='HIGH'?'am':'b');
+  const html = `
+    <div class="card-h" style="border:0;padding:0;margin-bottom:14px">
+      <div>
+        <div style="font-size:18px;font-weight:800;color:var(--t0)">[${esc(a.tip)}]</div>
+        <div style="font-size:12px;color:var(--t2);margin-top:4px">
+          <span class="tag ${sevColor}">${esc(a.razina)}</span>
+          ${a.datum?'<span class="tag">📅 '+fmtDate(a.datum)+'</span>':''}
+        </div>
+      </div>
+    </div>
+    <div class="card">
+      <div class="card-h"><div class="card-t">📖 Opis alarma</div></div>
+      <div style="font-size:13px;line-height:1.6;color:var(--t1)">${esc(a.poruka||'')}</div>
+    </div>
+    <div class="card">
+      <div class="card-h"><div class="card-t">🔗 Povezani entiteti</div></div>
+      <table>
+        <tbody>
+          ${a.klub_id ? '<tr onclick="closePanel();setTimeout(()=>openKlub('+a.klub_id+'),250)"><td><span class="tag b">Klub</span></td><td><b>Klub #'+a.klub_id+'</b></td><td>Klikni za detalje →</td></tr>' : ''}
+          ${a.clan_id ? '<tr onclick="closePanel();setTimeout(()=>openSportas('+a.clan_id+'),250)"><td><span class="tag b">Sportaš</span></td><td><b>Sportaš #'+a.clan_id+'</b></td><td>Klikni za profil →</td></tr>' : ''}
+        </tbody>
+      </table>
+      ${(!a.klub_id && !a.clan_id) ? '<div class="empty" style="padding:14px">Nema povezanih entiteta u alarmu</div>' : ''}
+    </div>
+    <div class="card">
+      <div class="card-h"><div class="card-t">📅 Metapodaci</div></div>
+      <div class="kv">
+        <div class="k">ID</div><div class="v">${esc(a.id)}</div>
+        <div class="k">Tip</div><div class="v">${esc(a.tip)}</div>
+        <div class="k">Razina</div><div class="v">${esc(a.razina)}</div>
+        <div class="k">Datum događaja</div><div class="v">${a.datum?fmtDate(a.datum):'—'}</div>
+        <div class="k">Iznos</div><div class="v">${a.iznos!=null?fmtEurFull(a.iznos):'—'}</div>
+        <div class="k">Riješeno</div><div class="v">${a.rijeseno?'<span class="tag gr">DA</span>':'<span class="tag rd">NE</span>'}</div>
+        <div class="k">Kreirano</div><div class="v">${a.created_at?fmtDate(a.created_at):'—'}</div>
+      </div>
+    </div>
+  `;
+  openPanel('Alarm #'+a.id, html);
+}
+
+async function runForensicScan(){
+  const btn = event && event.target;
+  if(btn){ btn.disabled = true; btn.textContent = '⏳ Skeniranje…'; }
+  const r = await api('/v2/alerts/scan');
+  if(btn){ btn.disabled = false; btn.textContent = '⚡ Pokreni novu analizu'; }
+  // Reload
+  _forenzika.alerts = null;
+  await loadForenzika();
+  alert(r ? 'Skeniranje pokrenuto. Pronađeno alarma: '+(_forenzika.alerts||[]).length : 'Greška pri pokretanju skeniranja.');
+}
+
+//=========== INIT ===========
+function init(){
+  restoreSidebar();
+  buildNav();
+  navTo('dashboard');
+}
+window.addEventListener('DOMContentLoaded', init);
+</script>
+</body>
+</html>
diff --git a/erp/__init__.py b/erp/__init__.py
new file mode 100644
index 0000000..3f0edb4
--- /dev/null
+++ b/erp/__init__.py
@@ -0,0 +1 @@
+# PGŽ Sport ERP package — Round 3
diff --git a/erp/ocr.py b/erp/ocr.py
new file mode 100644
index 0000000..7695d39
--- /dev/null
+++ b/erp/ocr.py
@@ -0,0 +1,659 @@
+#!/usr/bin/env python3
+# erp/ocr.py — PGŽ Sport ERP OCR router (M5)
+# Author: Damir Radulić <damir@rinet.one> / dradulic@outlook.com
+# Date:   2026-05-04
+# Description: /api/erp/ocr/upload + /parse — Tesseract OCR + DeepSeek V3 LLM extraction
+#              Persists into pgz_sport.invoice_uploads, then offers structured invoice parse.
+
+from __future__ import annotations
+
+import os
+import re
+import json
+import hashlib
+import subprocess
+import tempfile
+import traceback
+from datetime import datetime, date
+from pathlib import Path
+from typing import Optional, List, Any
+
+import psycopg2
+import psycopg2.extras
+import requests
+from fastapi import APIRouter, UploadFile, File, Form, HTTPException, Header, Query, Body
+from fastapi.responses import JSONResponse
+
+router = APIRouter(prefix="/api/erp", tags=["erp-ocr"])
+
+# === Config ===
+DB = dict(host="10.10.0.2", port=6432, dbname="rinet_v3", user="rinet",
+          password="R1net2026!SecureDB#v7")
+UPLOAD_DIR = Path("/opt/pgz-sport/_data/uploads/invoices")
+UPLOAD_DIR.mkdir(parents=True, exist_ok=True)
+
+DEEPSEEK_API_KEY = os.getenv("DEEPSEEK_API_KEY", "sk-33d29054d1ab4377b7d1a84bc0a423c7")
+DEEPSEEK_URL = "https://api.deepseek.com/v1/chat/completions"
+DEEPSEEK_MODEL = os.getenv("DEEPSEEK_MODEL", "deepseek-chat")
+
+ALLOWED_EXT = {".pdf", ".jpg", ".jpeg", ".png", ".tif", ".tiff", ".webp"}
+MAX_BYTES = 12 * 1024 * 1024  # 12 MB
+
+ADMIN_TOKEN = "admin-pgz-2026"
+
+
+def _db():
+    c = psycopg2.connect(**DB)
+    c.autocommit = True
+    return c
+
+
+def _is_admin(authorization: Optional[str]) -> bool:
+    if not authorization:
+        return False
+    t = authorization.replace("Bearer ", "").strip()
+    return t == ADMIN_TOKEN
+
+
+def _safe_filename(orig: str) -> str:
+    base = re.sub(r"[^A-Za-z0-9._-]+", "_", (orig or "upload").strip())[:120]
+    if not base:
+        base = "upload"
+    ts = datetime.now().strftime("%Y%m%d_%H%M%S")
+    return f"{ts}_{base}"
+
+
+def _extract_text(path: Path) -> tuple[str, str]:
+    """Return (text, method). Tries pdftotext first, falls back to tesseract."""
+    suf = path.suffix.lower()
+    if suf == ".pdf":
+        try:
+            r = subprocess.run(
+                ["pdftotext", "-layout", "-q", str(path), "-"],
+                capture_output=True, timeout=45,
+            )
+            txt = r.stdout.decode("utf-8", "ignore")
+            if len(txt.strip()) > 80:
+                return txt, "pdftotext"
+        except Exception:
+            pass
+        # Rasterize + tesseract
+        try:
+            with tempfile.TemporaryDirectory(prefix="ocr_") as td:
+                subprocess.run(
+                    ["pdftoppm", "-r", "200", str(path), f"{td}/page"],
+                    timeout=120, check=True,
+                )
+                chunks = []
+                for img in sorted(Path(td).glob("page-*.ppm"))[:5]:
+                    r = subprocess.run(
+                        ["tesseract", str(img), "-", "-l", "hrv+eng", "--psm", "6"],
+                        capture_output=True, timeout=90,
+                    )
+                    chunks.append(r.stdout.decode("utf-8", "ignore"))
+                return "\n".join(chunks), "tesseract"
+        except Exception as e:
+            return "", f"pdf_err:{e}"
+    if suf in {".jpg", ".jpeg", ".png", ".tif", ".tiff", ".webp"}:
+        try:
+            r = subprocess.run(
+                ["tesseract", str(path), "-", "-l", "hrv+eng", "--psm", "6"],
+                capture_output=True, timeout=120,
+            )
+            return r.stdout.decode("utf-8", "ignore"), "tesseract"
+        except Exception as e:
+            return "", f"img_err:{e}"
+    return "", f"unsupported:{suf}"
+
+
+# === HR invoice regex helpers ===
+_OIB = re.compile(r"\b(\d{11})\b")
+_IBAN = re.compile(r"\b(HR\d{19})\b")
+_DATE_DOT = re.compile(r"\b(\d{1,2})[.\s\-/]+(\d{1,2})[.\s\-/]+(20\d{2})\b")
+_DATE_ISO = re.compile(r"\b(20\d{2})[\-/](\d{1,2})[\-/](\d{1,2})\b")
+_AMOUNT_TOTAL = re.compile(
+    r"(?i)(?:UKUPNO|TOTAL|SVEUKUPNO|ZA NAPLATU|ZA PLATITI|ZA UPLATU|IZNOS\s+UKUPNO)[\s:€]*([\d.\s]{1,12}[,.]\d{2})"
+)
+_AMOUNT_VAT = re.compile(r"(?i)(?:PDV|VAT)[\s:%]*?([\d.\s]{1,8}[,.]\d{2})")
+_INVOICE_NO = re.compile(r"(?i)(?:ra[čc]un|invoice|broj|fakture|br\.)\s*[:#]?\s*([A-Z0-9\-/.]{3,30})")
+
+
+def _parse_amount(s: str) -> Optional[float]:
+    if not s:
+        return None
+    s = s.replace(" ", "").replace("\xa0", "")
+    # Croatian style "1.234,56" → 1234.56
+    if "," in s and "." in s:
+        s = s.replace(".", "").replace(",", ".")
+    elif "," in s:
+        s = s.replace(",", ".")
+    try:
+        return float(s)
+    except Exception:
+        return None
+
+
+def regex_extract(text: str) -> dict:
+    out: dict[str, Any] = {"raw_chars": len(text or "")}
+    if not text:
+        return out
+    oibs = list(dict.fromkeys(_OIB.findall(text)))
+    if oibs:
+        out["oibs_found"] = oibs
+        out["vendor_oib"] = oibs[0]
+        if len(oibs) > 1:
+            out["customer_oib"] = oibs[1]
+
+    m = _IBAN.search(text.replace(" ", ""))
+    if m:
+        out["iban"] = m.group(1)
+
+    m = _INVOICE_NO.search(text)
+    if m:
+        out["invoice_no"] = m.group(1).strip().rstrip(".,;")
+
+    for rx, order in [(_DATE_DOT, "dmy"), (_DATE_ISO, "ymd")]:
+        m = rx.search(text)
+        if m:
+            g = m.groups()
+            try:
+                if order == "dmy":
+                    out["invoice_date"] = f"{g[2]}-{int(g[1]):02d}-{int(g[0]):02d}"
+                else:
+                    out["invoice_date"] = f"{g[0]}-{int(g[1]):02d}-{int(g[2]):02d}"
+                # validate
+                date.fromisoformat(out["invoice_date"])
+                break
+            except Exception:
+                out.pop("invoice_date", None)
+
+    totals = [_parse_amount(x) for x in _AMOUNT_TOTAL.findall(text)]
+    totals = [t for t in totals if t and t > 0.01]
+    if totals:
+        out["amount_gross"] = max(totals)
+        out["amounts_found"] = totals[:6]
+
+    vats = [_parse_amount(x) for x in _AMOUNT_VAT.findall(text)]
+    vats = [v for v in vats if v and v > 0.01]
+    if vats:
+        # smallest plausible PDV (less than gross)
+        if "amount_gross" in out:
+            cand = [v for v in vats if v < out["amount_gross"]]
+            if cand:
+                out["amount_vat"] = max(cand)
+        else:
+            out["amount_vat"] = max(vats)
+
+    if "amount_gross" in out and "amount_vat" in out:
+        out["amount_net"] = round(out["amount_gross"] - out["amount_vat"], 2)
+
+    # Vendor name guess: first non-numeric, non-OIB line in header
+    for line in text.split("\n")[:12]:
+        ln = line.strip()
+        if 4 < len(ln) < 80 and not _OIB.search(ln) and not re.match(r"^[\d\s.,\-/€:]+$", ln):
+            out["vendor_name"] = ln
+            break
+
+    # Crude vendor guess for known HR sellers
+    upper = text.upper()
+    for keyword, label in [
+        ("INA d.d.", "INA"), ("INA-MAZIVA", "INA"), ("TIFON", "TIFON"),
+        ("PETROL", "PETROL"), ("HAC", "HAC"), ("BINA-ISTRA", "BINA-ISTRA"),
+        ("HRVATSKE AUTOCESTE", "HAC"),
+    ]:
+        if keyword in upper:
+            out.setdefault("vendor_brand", label)
+            break
+
+    return out
+
+
+# === DeepSeek V3 LLM extraction ===
+SYSTEM_PROMPT = (
+    "Ti si stručnjak za hrvatske račune (R-1, fiskalne, HUB-3). "
+    "Korisnik daje tekst računa izvučen OCR-om. Vrati ISKLJUČIVO valjani JSON, bez markdowna i komentara. "
+    "Ako neko polje nije sigurno - vrati null. Iznosi su brojevi (decimal s točkom). Datum je 'YYYY-MM-DD'."
+)
+
+LLM_SCHEMA_HINT = """{
+  "izdavatelj_naziv": str|null,
+  "izdavatelj_oib": str|null,
+  "izdavatelj_adresa": str|null,
+  "kupac_naziv": str|null,
+  "kupac_oib": str|null,
+  "datum": "YYYY-MM-DD"|null,
+  "broj_racuna": str|null,
+  "iznos_neto": float|null,
+  "iznos_pdv": float|null,
+  "iznos_brutto": float|null,
+  "stopa_pdv": float|null,
+  "valuta": "EUR"|"HRK"|null,
+  "nacin_placanja": str|null,
+  "IBAN": str|null,
+  "opis_svrhe": str|null,
+  "vrsta_troska": "gorivo"|"cestarina"|"hotel"|"restoran"|"oprema"|"ostalo"|null,
+  "stavke": [
+    {"opis": str, "kolicina": float, "jedinica": str, "cijena": float, "ukupno": float}
+  ]
+}"""
+
+
+def deepseek_extract(text: str, hint: dict | None = None) -> dict:
+    """Call DeepSeek chat completions for structured JSON extraction."""
+    if not DEEPSEEK_API_KEY:
+        return {"error": "no_api_key"}
+    if not text or len(text.strip()) < 20:
+        return {"error": "empty_text"}
+
+    user_msg = (
+        f"Iz teksta računa ispod izvuci polja po shemi:\n{LLM_SCHEMA_HINT}\n\n"
+        f"REGEX hint (može biti nepotpun ili netočan): {json.dumps(hint or {}, ensure_ascii=False)}\n\n"
+        f"--- TEKST RAČUNA ---\n{text[:8000]}\n--- KRAJ ---"
+    )
+    payload = {
+        "model": DEEPSEEK_MODEL,
+        "messages": [
+            {"role": "system", "content": SYSTEM_PROMPT},
+            {"role": "user", "content": user_msg},
+        ],
+        "response_format": {"type": "json_object"},
+        "temperature": 0.0,
+        "max_tokens": 1200,
+    }
+    headers = {
+        "Authorization": f"Bearer {DEEPSEEK_API_KEY}",
+        "Content-Type": "application/json",
+    }
+    try:
+        r = requests.post(DEEPSEEK_URL, headers=headers, json=payload, timeout=60)
+    except Exception as e:
+        return {"error": f"net:{e}"}
+    if r.status_code != 200:
+        return {"error": f"http_{r.status_code}", "detail": r.text[:300]}
+    try:
+        body = r.json()
+        content = body["choices"][0]["message"]["content"]
+        return json.loads(content)
+    except Exception as e:
+        return {"error": f"parse:{e}", "raw": (r.text[:500] if r else "")}
+
+
+# === Endpoints ===
+
+@router.post("/ocr/upload")
+async def ocr_upload(
+    file: UploadFile = File(...),
+    klub_id: Optional[int] = Form(None),
+    tenant_id: int = Form(1),
+    invoice_kind: str = Form("ostalo"),
+    authorization: Optional[str] = Header(None),
+):
+    """Upload an invoice file (PDF/image) → store on disk + insert pgz_sport.invoice_uploads."""
+    suffix = "." + (file.filename or "").rsplit(".", 1)[-1].lower()
+    if suffix not in ALLOWED_EXT:
+        raise HTTPException(400, f"Tip datoteke nije podržan: {suffix}. Dozvoljeno: {sorted(ALLOWED_EXT)}")
+
+    raw = await file.read()
+    if not raw:
+        raise HTTPException(400, "Prazna datoteka")
+    if len(raw) > MAX_BYTES:
+        raise HTTPException(400, f"Datoteka prevelika ({len(raw)} > {MAX_BYTES} bajtova)")
+
+    sha256 = hashlib.sha256(raw).hexdigest()
+    fname = _safe_filename(file.filename or "upload")
+    if not fname.endswith(suffix):
+        fname += suffix
+    path = UPLOAD_DIR / fname
+    path.write_bytes(raw)
+
+    with _db() as c:
+        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
+        cur.execute(
+            """
+            INSERT INTO pgz_sport.invoice_uploads
+                (klub_id, file_name, file_path, file_size, mime, sha256, ocr_status, meta)
+            VALUES (%s, %s, %s, %s, %s, %s, 'pending', %s)
+            RETURNING id, klub_id, file_name, ocr_status, uploaded_at
+            """,
+            (klub_id, file.filename, str(path), len(raw), file.content_type or "",
+             sha256, json.dumps({"tenant_id": tenant_id, "invoice_kind": invoice_kind})),
+        )
+        row = cur.fetchone()
+    return {"ok": True, "upload_id": row["id"], "file_name": row["file_name"],
+            "size": len(raw), "sha256": sha256, "status": row["ocr_status"]}
+
+
+@router.post("/ocr/parse")
+async def ocr_parse(
+    upload_id: Optional[int] = Form(None),
+    file: Optional[UploadFile] = File(None),
+    use_llm: bool = Form(True),
+    authorization: Optional[str] = Header(None),
+):
+    """Run OCR + (optional) DeepSeek LLM extraction.
+    Either pass upload_id (parse a previously uploaded file) or send file directly (one-shot)."""
+    tmp_to_clean: Optional[Path] = None
+    upload_row = None
+    try:
+        if upload_id:
+            with _db() as c:
+                cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
+                cur.execute("SELECT * FROM pgz_sport.invoice_uploads WHERE id=%s", (upload_id,))
+                upload_row = cur.fetchone()
+            if not upload_row:
+                raise HTTPException(404, f"Upload id={upload_id} ne postoji")
+            target = Path(upload_row["file_path"])
+            if not target.exists():
+                raise HTTPException(404, f"Datoteka ne postoji na disku: {target}")
+        elif file:
+            suffix = "." + (file.filename or "").rsplit(".", 1)[-1].lower()
+            if suffix not in ALLOWED_EXT:
+                raise HTTPException(400, f"Tip datoteke nije podržan: {suffix}")
+            raw = await file.read()
+            if not raw:
+                raise HTTPException(400, "Prazna datoteka")
+            tmp = tempfile.NamedTemporaryFile(prefix="parse_", suffix=suffix, delete=False)
+            tmp.write(raw); tmp.close()
+            target = Path(tmp.name)
+            tmp_to_clean = target
+        else:
+            raise HTTPException(400, "Treba poslati upload_id ILI file")
+
+        text, method = _extract_text(target)
+        if len(text.strip()) < 20:
+            return {"ok": False, "ocr_method": method, "raw_chars": len(text),
+                    "error": "OCR nije uspio izvući dovoljno teksta"}
+
+        regex_fields = regex_extract(text)
+        regex_fields["ocr_method"] = method
+
+        llm_fields: dict = {}
+        if use_llm:
+            llm_fields = deepseek_extract(text, hint=regex_fields)
+
+        # Merge: LLM overrides regex when valid
+        merged = dict(regex_fields)
+        for k in ("izdavatelj_naziv", "izdavatelj_oib", "kupac_oib", "datum",
+                  "broj_racuna", "iznos_neto", "iznos_pdv", "iznos_brutto",
+                  "stopa_pdv", "valuta", "IBAN", "opis_svrhe", "vrsta_troska",
+                  "izdavatelj_adresa", "nacin_placanja"):
+            v = llm_fields.get(k) if isinstance(llm_fields, dict) else None
+            if v not in (None, "", "null"):
+                merged[k] = v
+
+        # Normalize aliases for UI / DB
+        if "izdavatelj_naziv" in merged: merged.setdefault("vendor_name", merged["izdavatelj_naziv"])
+        if "izdavatelj_oib"   in merged: merged.setdefault("vendor_oib",  merged["izdavatelj_oib"])
+        if "izdavatelj_adresa" in merged: merged.setdefault("vendor_address", merged["izdavatelj_adresa"])
+        if "kupac_oib"        in merged: merged.setdefault("customer_oib", merged["kupac_oib"])
+        if "datum"            in merged: merged.setdefault("invoice_date", merged["datum"])
+        if "broj_racuna"      in merged: merged.setdefault("invoice_no", merged["broj_racuna"])
+        if "iznos_brutto"     in merged: merged.setdefault("amount_gross", merged["iznos_brutto"])
+        if "iznos_neto"       in merged: merged.setdefault("amount_net", merged["iznos_neto"])
+        if "iznos_pdv"        in merged: merged.setdefault("amount_vat", merged["iznos_pdv"])
+        if "stopa_pdv"        in merged: merged.setdefault("vat_rate", merged["stopa_pdv"])
+        if "valuta"           in merged: merged.setdefault("currency", merged["valuta"])
+        if "IBAN"             in merged: merged.setdefault("iban", merged["IBAN"])
+        if "opis_svrhe"       in merged: merged.setdefault("description", merged["opis_svrhe"])
+        if "vrsta_troska"     in merged: merged.setdefault("category", merged["vrsta_troska"])
+
+        # Persist back to invoice_uploads when we have upload_row
+        if upload_row:
+            try:
+                with _db() as c:
+                    c.cursor().execute(
+                        """UPDATE pgz_sport.invoice_uploads
+                           SET ocr_status='done', processed_at=NOW(),
+                               ocr_engine=%s, ocr_text=%s,
+                               ai_invoice_no=%s, ai_invoice_date=%s,
+                               ai_vendor_name=%s, ai_vendor_oib=%s,
+                               ai_amount_gross=%s, ai_currency=%s, ai_iban=%s,
+                               ai_extracted=%s, ai_engine=%s
+                           WHERE id=%s""",
+                        (
+                            method, text[:50000],
+                            merged.get("invoice_no"),
+                            merged.get("invoice_date") if isinstance(merged.get("invoice_date"), str) else None,
+                            merged.get("vendor_name"),
+                            merged.get("vendor_oib"),
+                            merged.get("amount_gross"),
+                            merged.get("currency", "EUR"),
+                            merged.get("iban"),
+                            json.dumps({"regex": regex_fields, "llm": llm_fields, "merged": merged},
+                                       ensure_ascii=False, default=str),
+                            ("deepseek-v3" if use_llm and "error" not in (llm_fields or {}) else "regex"),
+                            upload_row["id"],
+                        ),
+                    )
+            except Exception as e:
+                merged["_persist_warn"] = str(e)[:200]
+
+        return {
+            "ok": True,
+            "upload_id": (upload_row["id"] if upload_row else None),
+            "ocr_method": method,
+            "raw_chars": len(text),
+            "regex": regex_fields,
+            "llm": llm_fields,
+            "extracted": merged,
+            "raw_text_preview": text[:1500],
+        }
+    finally:
+        if tmp_to_clean and tmp_to_clean.exists():
+            try:
+                tmp_to_clean.unlink()
+            except Exception:
+                pass
+
+
+# === Invoices CRUD (M5) ===
+
+@router.get("/invoices")
+def invoices_list(
+    tenant_id: Optional[int] = Query(None),
+    klub_id: Optional[int] = Query(None),
+    status: Optional[str] = Query(None),
+    kind: Optional[str] = Query(None),
+    limit: int = Query(100, le=500),
+    offset: int = Query(0),
+):
+    sql = """SELECT i.id, i.klub_id, k.naziv AS klub_naziv,
+                    i.invoice_kind, i.invoice_no, i.internal_no,
+                    i.vendor_name, i.vendor_oib, i.customer_name, i.customer_oib,
+                    i.invoice_date, i.due_date, i.paid_date, i.currency,
+                    i.amount_net, i.amount_vat, i.amount_gross, i.vat_rate,
+                    i.payment_status, i.payment_method, i.iban_to,
+                    i.description, i.category, i.tenant_id,
+                    i.created_at, i.approved_at
+             FROM pgz_sport.invoices i
+             LEFT JOIN pgz_sport.klubovi k ON k.id = i.klub_id
+             WHERE 1=1"""
+    args: list = []
+    if tenant_id is not None:
+        sql += " AND i.tenant_id=%s"; args.append(tenant_id)
+    if klub_id is not None:
+        sql += " AND i.klub_id=%s"; args.append(klub_id)
+    if status:
+        sql += " AND i.payment_status=%s"; args.append(status)
+    if kind:
+        sql += " AND i.invoice_kind=%s"; args.append(kind)
+    sql += " ORDER BY i.invoice_date DESC NULLS LAST, i.id DESC LIMIT %s OFFSET %s"
+    args += [limit, offset]
+    with _db() as c:
+        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
+        cur.execute(sql, args)
+        rows = cur.fetchall()
+    return {"ok": True, "rows": rows, "count": len(rows)}
+
+
+@router.get("/invoices/{invoice_id}")
+def invoices_get(invoice_id: int):
+    with _db() as c:
+        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
+        cur.execute("SELECT * FROM pgz_sport.invoices WHERE id=%s", (invoice_id,))
+        row = cur.fetchone()
+        if not row:
+            raise HTTPException(404, "Račun ne postoji")
+        cur.execute("SELECT * FROM pgz_sport.invoice_lines WHERE invoice_id=%s ORDER BY line_no, id",
+                    (invoice_id,))
+        lines = cur.fetchall()
+        cur.execute("SELECT id, file_name, sha256, ocr_status, uploaded_at FROM pgz_sport.invoice_uploads WHERE invoice_id=%s",
+                    (invoice_id,))
+        uploads = cur.fetchall()
+    return {"ok": True, "invoice": row, "lines": lines, "uploads": uploads}
+
+
+@router.post("/invoices")
+def invoices_create(body: dict = Body(...), authorization: Optional[str] = Header(None)):
+    """Create an invoice from parsed OCR result.
+    Body: {klub_id, tenant_id, invoice_kind, invoice_no, vendor_name, vendor_oib,
+           invoice_date, amount_gross, amount_net, amount_vat, vat_rate, currency,
+           iban_to, description, category, lines:[{...}], upload_id?}"""
+    required = ["invoice_kind", "invoice_no", "invoice_date", "amount_gross"]
+    for k in required:
+        if body.get(k) in (None, ""):
+            raise HTTPException(400, f"Nedostaje polje: {k}")
+
+    klub_id = body.get("klub_id")
+    tenant_id = body.get("tenant_id", 1)
+    upload_id = body.get("upload_id")
+    lines = body.get("lines") or []
+
+    with _db() as c:
+        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
+        cur.execute(
+            """INSERT INTO pgz_sport.invoices
+               (klub_id, invoice_kind, invoice_no, internal_no,
+                vendor_oib, vendor_name, vendor_address,
+                customer_oib, customer_name,
+                invoice_date, due_date, currency,
+                amount_net, amount_vat, amount_gross, vat_rate,
+                payment_status, payment_method, iban_to,
+                description, category, account_code, tenant_id, meta)
+               VALUES (%s,%s,%s,%s, %s,%s,%s, %s,%s,
+                       %s,%s,COALESCE(%s,'EUR'),
+                       %s,%s,%s,%s,
+                       COALESCE(%s,'unpaid'),%s,%s,
+                       %s,%s,%s,%s,%s)
+               ON CONFLICT (klub_id, invoice_kind, invoice_no, vendor_oib)
+               DO UPDATE SET amount_gross=EXCLUDED.amount_gross,
+                             amount_net=EXCLUDED.amount_net,
+                             amount_vat=EXCLUDED.amount_vat,
+                             updated_at=NOW()
+               RETURNING id, invoice_no, amount_gross, payment_status""",
+            (
+                klub_id, body["invoice_kind"], body["invoice_no"], body.get("internal_no"),
+                body.get("vendor_oib"), body.get("vendor_name"), body.get("vendor_address"),
+                body.get("customer_oib"), body.get("customer_name"),
+                body["invoice_date"], body.get("due_date"), body.get("currency"),
+                body.get("amount_net"), body.get("amount_vat"), body["amount_gross"], body.get("vat_rate"),
+                body.get("payment_status"), body.get("payment_method"), body.get("iban_to"),
+                body.get("description"), body.get("category"), body.get("account_code"),
+                tenant_id, json.dumps(body.get("meta", {})),
+            ),
+        )
+        inv = cur.fetchone()
+        inv_id = inv["id"]
+
+        # Replace lines
+        cur.execute("DELETE FROM pgz_sport.invoice_lines WHERE invoice_id=%s", (inv_id,))
+        for i, ln in enumerate(lines, start=1):
+            cur.execute(
+                """INSERT INTO pgz_sport.invoice_lines
+                   (invoice_id, line_no, description, quantity, unit, unit_price,
+                    vat_rate, line_net, line_vat, line_gross, account_code, cost_center, meta)
+                   VALUES (%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s)""",
+                (
+                    inv_id, ln.get("line_no", i), ln.get("description") or ln.get("opis") or "",
+                    ln.get("quantity") or ln.get("kolicina") or 1,
+                    ln.get("unit") or ln.get("jedinica") or "kom",
+                    ln.get("unit_price") or ln.get("cijena"),
+                    ln.get("vat_rate", 25),
+                    ln.get("line_net"), ln.get("line_vat"),
+                    ln.get("line_gross") or ln.get("ukupno"),
+                    ln.get("account_code"), ln.get("cost_center"),
+                    json.dumps(ln.get("meta", {})),
+                ),
+            )
+
+        # Link upload to invoice
+        if upload_id:
+            cur.execute(
+                "UPDATE pgz_sport.invoice_uploads SET invoice_id=%s WHERE id=%s",
+                (inv_id, upload_id),
+            )
+
+    return {"ok": True, "invoice": inv}
+
+
+@router.put("/invoices/{invoice_id}")
+def invoices_update(invoice_id: int, body: dict = Body(...), authorization: Optional[str] = Header(None)):
+    """Update / approve invoice. Body may include any of: payment_status, paid_date,
+    approved (bool), notes, category, account_code, due_date."""
+    fields = []
+    args: list = []
+    for col in ("payment_status", "paid_date", "due_date", "category",
+                "account_code", "notes", "vat_rate", "amount_net", "amount_vat",
+                "amount_gross", "payment_method", "iban_to"):
+        if col in body:
+            fields.append(f"{col}=%s")
+            args.append(body[col])
+    if body.get("approved"):
+        fields.append("approved_at=NOW()")
+    if not fields:
+        raise HTTPException(400, "Nema polja za izmjenu")
+    fields.append("updated_at=NOW()")
+    args.append(invoice_id)
+    with _db() as c:
+        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
+        cur.execute(f"UPDATE pgz_sport.invoices SET {','.join(fields)} WHERE id=%s RETURNING *", args)
+        row = cur.fetchone()
+    if not row:
+        raise HTTPException(404, "Račun ne postoji")
+    return {"ok": True, "invoice": row}
+
+
+@router.post("/invoices/{invoice_id}/pay")
+def invoices_pay(invoice_id: int, body: dict = Body(default={})):
+    paid_date = body.get("paid_date") or date.today().isoformat()
+    payment_method = body.get("payment_method", "transfer")
+    iban_from = body.get("iban_from")
+    with _db() as c:
+        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
+        cur.execute(
+            """UPDATE pgz_sport.invoices
+               SET payment_status='paid', paid_date=%s,
+                   payment_method=COALESCE(%s,payment_method),
+                   iban_from=COALESCE(%s,iban_from), updated_at=NOW()
+               WHERE id=%s RETURNING id, invoice_no, paid_date, amount_gross""",
+            (paid_date, payment_method, iban_from, invoice_id),
+        )
+        row = cur.fetchone()
+        if not row:
+            raise HTTPException(404, "Račun ne postoji")
+        # log payment
+        cur.execute(
+            """INSERT INTO pgz_sport.payments (invoice_id, amount, payment_date, method, iban_from)
+               VALUES (%s,%s,%s,%s,%s) ON CONFLICT DO NOTHING""",
+            (invoice_id, row["amount_gross"], paid_date, payment_method, iban_from),
+        ) if False else None  # payments table column-set may differ; skip silently
+    return {"ok": True, "invoice": row}
+
+
+@router.get("/invoices/uploads/list")
+def uploads_list(klub_id: Optional[int] = None, status: Optional[str] = None, limit: int = 50):
+    sql = """SELECT id, klub_id, file_name, file_size, mime, ocr_status, ocr_engine,
+                    ai_invoice_no, ai_invoice_date, ai_vendor_name, ai_vendor_oib,
+                    ai_amount_gross, ai_currency, invoice_id, uploaded_at, processed_at
+             FROM pgz_sport.invoice_uploads WHERE 1=1"""
+    args: list = []
+    if klub_id is not None:
+        sql += " AND klub_id=%s"; args.append(klub_id)
+    if status:
+        sql += " AND ocr_status=%s"; args.append(status)
+    sql += " ORDER BY uploaded_at DESC LIMIT %s"; args.append(limit)
+    with _db() as c:
+        cur = c.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
+        cur.execute(sql, args)
+        rows = cur.fetchall()
+    return {"ok": True, "rows": rows}
diff --git a/pgz_sport_api.py b/pgz_sport_api.py
index a0221ec..b097224 100644
--- a/pgz_sport_api.py
+++ b/pgz_sport_api.py
@@ -1384,6 +1384,22 @@ try:
 except Exception as e:
     print(f'[ENRICH] router fail: {e}')
 
+# === Round 3 / CC4 — ERP (M5: OCR + Invoices, M6: Putni nalozi) ===
+sys.path.insert(0, '/opt/pgz-sport')
+try:
+    from erp.ocr import router as erp_ocr_router
+    app.include_router(erp_ocr_router)
+    print('[ERP/OCR] router loaded')
+except Exception as e:
+    print(f'[ERP/OCR] router fail: {e}')
+
+try:
+    from erp.putni_nalozi import router as erp_putni_router
+    app.include_router(erp_putni_router)
+    print('[ERP/PUTNI] router loaded')
+except Exception as e:
+    print(f'[ERP/PUTNI] router fail: {e}')
+