+4. The token is validated against the backend before granting access
+
+The token is stored in `localStorage` and automatically attached to all API requests. It is verified server-side on every admin page navigation and on every protected API call.
+
+### Token verification endpoint
+
+```
+POST /api/auth/verify
+Authorization: Bearer <token>
```
+Returns `{ "valid": true }` if the token is valid, or `401` if not.
+
+## Health Checks
+
+Services with a URL are automatically monitored. The health checker runs every 60 seconds (configurable via `HEALTH_CHECK_INTERVAL` environment variable) and:
+
+- Sends an HTTP GET request to the service URL (10s timeout)
+- Updates the service status to `operational` (HTTP < 400) or `major` (HTTP >= 400 or unreachable)
+- Records response time, uptime, and error rate as metrics
+
+Services without a URL retain manual status control from the admin dashboard.
+ `You've subscribed to ServPulse status updates.\n\nPlease confirm your subscription by visiting:\n${confirmUrl}\n\nIf you didn't request this, you can ignore this email.`
+ );
+ }
+
+ res.status(201).json({ message: 'Please check your email to confirm your subscription.' });
+ `You requested your unsubscribe link for ServPulse.\n\nTo unsubscribe, visit:\n${unsubscribeUrl}\n\nIf you didn't request this, you can ignore this email.`
+ );
+ }
+
+ res.status(200).json({ message: 'If that email is subscribed, an unsubscribe link has been sent.' });
+ <label class="block text-xs font-medium text-gray-600 dark:text-gray-400 mb-1">Line 1 — Text <span class="text-gray-400">(use %link1% and %link2% for links)</span></label>
+ <input v-model="settingsForm.footer.line1.text" class="input-field" :maxlength="MAX_FOOTER_LENGTH" placeholder="Powered by %link1% — made with ❤️ by %link2%" />