feat: add login page customization (background image, glass card style, subtitle)

docs/admin-guide.md

@@ -231,6 +231,12 @@ See [Roles & Permissions](roles.md) for details on which settings are owner-only
 
 Navigate to **Admin Settings** (owner only) to configure:
 
+### Login Page Customization
+
+- **Background Image** — Upload a custom background image for the login page (max 5 MB, JPEG/PNG/WebP). The image is centered and fills the screen without distortion (`background-size: cover`).
+- **Card Style** — Choose between **Default** (solid card) and **Glass** (transparent, blurred backdrop).
+- **Subtitle** — Custom text shown below the application name on the login page. Leave empty for the default subtitle.
+
 ### Application Settings
 
 - **App Name** — Custom application name displayed in the UI

docs/backup-restore.md

@@ -31,6 +31,8 @@ Keywarden provides a built-in encrypted backup and restore feature for the entir
 | Audit Log | ✅ |
 | Application Settings | ✅ |
 
+> **Note:** Uploaded branding assets (e.g., custom login background images in `data/branding/`) are stored as files and are **not** included in the `.kwbak` database backup. Use a Docker volume backup to include these files.
+
 > **Note:** SSH private keys are stored with double encryption in backups — first with the application's `KEYWARDEN_ENCRYPTION_KEY`, then with the backup password. Both keys are needed to access the private keys.
 
 ## Importing a Backup

docs/deployment.md

@@ -132,6 +132,7 @@ All persistent data is stored in the `/data` volume:
 | `/data/keys/` | Reserved for future use |
 | `/data/master/` | Reserved for future use |
 | `/data/avatars/` | User profile pictures |
+| `/data/branding/` | Login page branding assets (background images) |
 
 > **Important:** The SQLite database contains encrypted private keys. Back up the `/data` volume regularly. See [Backup & Restore](backup-restore.md).
 

docs/environment-variables.md

@@ -115,3 +115,5 @@ In addition to environment variables, the following settings are configured thro
 | `lockout_attempts` | `5` | Failed login attempts before lockout (0 = disabled) |
 | `lockout_duration` | `15` | Lockout duration in minutes |
 | `mfa_required` | `false` | Enforce MFA for all users |
+| `login_card_style` | `default` | Login card style: `default` or `glass` |
+| `login_subtitle` | _(empty)_ | Custom subtitle on the login page |

docs/user-guide.md

@@ -134,7 +134,7 @@ If email is configured, you can enable **Login Notifications**. Every time someo
 
 ### Profile Picture
 
-Upload a profile picture (avatar) that is displayed next to your name in the navigation. Supported formats: JPEG, PNG, GIF, WebP. Maximum size is limited by the server's request size limit.
+Upload a profile picture (avatar) that is displayed next to your name in the navigation. Supported formats: JPEG, PNG, GIF, WebP. Maximum file size: 5 MB.
 
 ## Audit Log