diff --git a/.vitepress/config.mts b/.vitepress/config.mts
index 0c02f0d..8018ac6 100644
--- a/.vitepress/config.mts
+++ b/.vitepress/config.mts
@@ -172,6 +172,35 @@ export default withMermaid({
         items: [
           { text: 'Overview', link: '/docs/panel/overview' },
           { text: 'Environment', link: '/docs/panel/environment' },
+          {
+            text: 'Features',
+            link: '/docs/panel/features/',
+            collapsed: true,
+            items: [
+              {
+                text: 'Dashboard',
+                link: '/docs/panel/features/dashboard/',
+                collapsed: true,
+                items: [
+                  { text: 'Servers', link: '/docs/panel/features/dashboard/servers' },
+                  { text: 'Account', link: '/docs/panel/features/dashboard/account' },
+                  { text: 'Security Keys', link: '/docs/panel/features/dashboard/security-keys' },
+                  {
+                    text: 'API Keys',
+                    link: '/docs/panel/features/dashboard/api-keys',
+                    collapsed: true,
+                    items: [{ text: 'Permissions Reference', link: '/docs/panel/features/dashboard/permissions' }],
+                  },
+                  { text: 'SSH Keys', link: '/docs/panel/features/dashboard/ssh-keys' },
+                  { text: 'Command Snippets', link: '/docs/panel/features/dashboard/command-snippets' },
+                  { text: 'OAuth Links', link: '/docs/panel/features/dashboard/oauth-links' },
+                  { text: 'Sessions', link: '/docs/panel/features/dashboard/sessions' },
+                  { text: 'Keyboard Shortcuts', link: '/docs/panel/features/dashboard/keyboard-shortcuts' },
+                  { text: 'Activity', link: '/docs/panel/features/dashboard/activity' },
+                ],
+              },
+            ],
+          },
           {
             text: 'Installation',
             link: '/docs/panel/installation/',
diff --git a/web/docs/integrations/blesta.md b/web/docs/integrations/blesta.md
index d2628a5..7829c74 100644
--- a/web/docs/integrations/blesta.md
+++ b/web/docs/integrations/blesta.md
@@ -29,7 +29,7 @@ Clients are matched to panel users by their Blesta client ID (stored as the user
 
 The client service page shows a server summary (name, status, address, memory, disk) with an **Open in Panel** button, and the admin service tab surfaces the same details.
 
-![](./images/blesta/client-area.png)
+![](./images/blesta/client-area.webp)
 
 ## Requirements
 
@@ -58,7 +58,7 @@ The client service page shows a server summary (name, status, address, memory, d
 
    Saving validates the connection against the panel.
 
-![](./images/blesta/server-config.png)
+![](./images/blesta/server-config.webp)
 
 ## Configuring a package
 
diff --git a/web/docs/integrations/images/blesta/client-area.png b/web/docs/integrations/images/blesta/client-area.png
deleted file mode 100644
index accf895..0000000
Binary files a/web/docs/integrations/images/blesta/client-area.png and /dev/null differ
diff --git a/web/docs/integrations/images/blesta/client-area.webp b/web/docs/integrations/images/blesta/client-area.webp
new file mode 100644
index 0000000..9b1238e
Binary files /dev/null and b/web/docs/integrations/images/blesta/client-area.webp differ
diff --git a/web/docs/integrations/images/blesta/server-config.png b/web/docs/integrations/images/blesta/server-config.png
deleted file mode 100644
index 0bb2b37..0000000
Binary files a/web/docs/integrations/images/blesta/server-config.png and /dev/null differ
diff --git a/web/docs/integrations/images/blesta/server-config.webp b/web/docs/integrations/images/blesta/server-config.webp
new file mode 100644
index 0000000..0702d8b
Binary files /dev/null and b/web/docs/integrations/images/blesta/server-config.webp differ
diff --git a/web/docs/integrations/images/paymenter/server-config.png b/web/docs/integrations/images/paymenter/server-config.png
deleted file mode 100644
index 9649e22..0000000
Binary files a/web/docs/integrations/images/paymenter/server-config.png and /dev/null differ
diff --git a/web/docs/integrations/images/paymenter/server-config.webp b/web/docs/integrations/images/paymenter/server-config.webp
new file mode 100644
index 0000000..d365c48
Binary files /dev/null and b/web/docs/integrations/images/paymenter/server-config.webp differ
diff --git a/web/docs/integrations/images/vscode/command-palette.png b/web/docs/integrations/images/vscode/command-palette.png
deleted file mode 100644
index 90c2401..0000000
Binary files a/web/docs/integrations/images/vscode/command-palette.png and /dev/null differ
diff --git a/web/docs/integrations/images/vscode/command-palette.webp b/web/docs/integrations/images/vscode/command-palette.webp
new file mode 100644
index 0000000..4578c18
Binary files /dev/null and b/web/docs/integrations/images/vscode/command-palette.webp differ
diff --git a/web/docs/integrations/images/vscode/connect-dropdown.png b/web/docs/integrations/images/vscode/connect-dropdown.png
deleted file mode 100644
index 0f26173..0000000
Binary files a/web/docs/integrations/images/vscode/connect-dropdown.png and /dev/null differ
diff --git a/web/docs/integrations/images/vscode/connect-dropdown.webp b/web/docs/integrations/images/vscode/connect-dropdown.webp
new file mode 100644
index 0000000..0906fa1
Binary files /dev/null and b/web/docs/integrations/images/vscode/connect-dropdown.webp differ
diff --git a/web/docs/integrations/images/vscode/extensions-view.png b/web/docs/integrations/images/vscode/extensions-view.png
deleted file mode 100644
index 5b1f26b..0000000
Binary files a/web/docs/integrations/images/vscode/extensions-view.png and /dev/null differ
diff --git a/web/docs/integrations/images/vscode/extensions-view.webp b/web/docs/integrations/images/vscode/extensions-view.webp
new file mode 100644
index 0000000..d9d07f1
Binary files /dev/null and b/web/docs/integrations/images/vscode/extensions-view.webp differ
diff --git a/web/docs/integrations/images/vscode/integrated-terminal.png b/web/docs/integrations/images/vscode/integrated-terminal.png
deleted file mode 100644
index b3264ce..0000000
Binary files a/web/docs/integrations/images/vscode/integrated-terminal.png and /dev/null differ
diff --git a/web/docs/integrations/images/vscode/integrated-terminal.webp b/web/docs/integrations/images/vscode/integrated-terminal.webp
new file mode 100644
index 0000000..c7c35dc
Binary files /dev/null and b/web/docs/integrations/images/vscode/integrated-terminal.webp differ
diff --git a/web/docs/integrations/images/vscode/status-bar.png b/web/docs/integrations/images/vscode/status-bar.png
deleted file mode 100644
index 3c7d378..0000000
Binary files a/web/docs/integrations/images/vscode/status-bar.png and /dev/null differ
diff --git a/web/docs/integrations/images/vscode/status-bar.webp b/web/docs/integrations/images/vscode/status-bar.webp
new file mode 100644
index 0000000..4f44119
Binary files /dev/null and b/web/docs/integrations/images/vscode/status-bar.webp differ
diff --git a/web/docs/integrations/images/vscode/uri-scheme-setting.png b/web/docs/integrations/images/vscode/uri-scheme-setting.png
deleted file mode 100644
index 376f482..0000000
Binary files a/web/docs/integrations/images/vscode/uri-scheme-setting.png and /dev/null differ
diff --git a/web/docs/integrations/images/vscode/uri-scheme-setting.webp b/web/docs/integrations/images/vscode/uri-scheme-setting.webp
new file mode 100644
index 0000000..6f05a06
Binary files /dev/null and b/web/docs/integrations/images/vscode/uri-scheme-setting.webp differ
diff --git a/web/docs/integrations/images/whmcs/add-new-server.png b/web/docs/integrations/images/whmcs/add-new-server.png
deleted file mode 100644
index 0f89d55..0000000
Binary files a/web/docs/integrations/images/whmcs/add-new-server.png and /dev/null differ
diff --git a/web/docs/integrations/images/whmcs/add-new-server.webp b/web/docs/integrations/images/whmcs/add-new-server.webp
new file mode 100644
index 0000000..b5241cc
Binary files /dev/null and b/web/docs/integrations/images/whmcs/add-new-server.webp differ
diff --git a/web/docs/integrations/images/whmcs/client-area.png b/web/docs/integrations/images/whmcs/client-area.png
deleted file mode 100644
index b4020ef..0000000
Binary files a/web/docs/integrations/images/whmcs/client-area.png and /dev/null differ
diff --git a/web/docs/integrations/images/whmcs/client-area.webp b/web/docs/integrations/images/whmcs/client-area.webp
new file mode 100644
index 0000000..9708fab
Binary files /dev/null and b/web/docs/integrations/images/whmcs/client-area.webp differ
diff --git a/web/docs/integrations/paymenter.md b/web/docs/integrations/paymenter.md
index 933b68e..b1d0574 100644
--- a/web/docs/integrations/paymenter.md
+++ b/web/docs/integrations/paymenter.md
@@ -46,7 +46,7 @@ Customers are matched to panel users by their Paymenter user ID (stored as the u
 
 4. Use **Test Connection** to confirm Paymenter can reach the panel with the supplied key.
 
-![](./images/paymenter/server-config.png)
+![](./images/paymenter/server-config.webp)
 
 ## Configuring a product
 
diff --git a/web/docs/integrations/vscode.md b/web/docs/integrations/vscode.md
index 1cdf54a..24bb84a 100644
--- a/web/docs/integrations/vscode.md
+++ b/web/docs/integrations/vscode.md
@@ -41,13 +41,13 @@ VSCodium, code-server, and most other forks are wired to the [Open VSX Registry]
 
 ::::
 
-![](./images/vscode/extensions-view.png)
+![](./images/vscode/extensions-view.webp)
 
 ## Connecting from the panel
 
 The quickest way to get started is straight from your server's file manager. Open the **Files** tab for any server, then click the **Connect** dropdown in the toolbar and choose **Connect via VS Code**.
 
-![](./images/vscode/connect-dropdown.png)
+![](./images/vscode/connect-dropdown.webp)
 
 Your editor opens, mounts the server's files as a workspace folder, and attaches to the console automatically. The same **Connect** dropdown is available in the header while editing a file, which will open that exact file in your editor once the server is mounted.
 
@@ -67,7 +67,7 @@ You can also drive everything from the editor using the Command Palette (`Ctrl`/
 | `Calagopus: Open Server Console` | Pick a server and attach to its console. |
 | `Calagopus: Server Power Action` | Start, stop, restart, or kill the active server. |
 
-![](./images/vscode/command-palette.png)
+![](./images/vscode/command-palette.webp)
 
 ## Features
 
@@ -83,13 +83,13 @@ When the editor's proposed search APIs are enabled, you can search across your s
 
 Attach to your server's console as an integrated terminal. Output streams in real time and you can send commands straight from the terminal input, exactly as you would from the panel's console tab.
 
-![](./images/vscode/integrated-terminal.png)
+![](./images/vscode/integrated-terminal.webp)
 
 ### Power actions & status bar
 
 The current server's power state is shown in the status bar. Use the **Calagopus: Server Power Action** command (or the status bar item) to **start**, **stop**, **restart**, or **kill** the server without switching back to the panel.
 
-![](./images/vscode/status-bar.png)
+![](./images/vscode/status-bar.webp)
 
 ## Deep links
 
@@ -110,7 +110,7 @@ vscode://calagopus.calagopus/open?origin=<panel-url>&server=<server-uuid>
 ::: warning
 A `vscode://` link is the canonical scheme for Visual Studio Code. Some forks register a different scheme (for example, `vscodium://` or `codium://`) - if a link does not open in your editor, click the settings icon in the top left of the file manager and change the VS Code URI scheme to match your editor's registered scheme.
 
-![](./images/vscode/uri-scheme-setting.png)
+![](./images/vscode/uri-scheme-setting.webp)
 :::
 
 ## Authentication
@@ -129,7 +129,7 @@ Deep links that include an `apiKey` parameter open an **ephemeral** session - th
 
 Your editor may register a URI scheme other than `vscode://`. Click the settings icon in the top left of the file manager and change the VS Code URI scheme to match your editor's registered scheme (for example, `vscodium://` or `codium://`).
 
-![](./images/vscode/uri-scheme-setting.png)
+![](./images/vscode/uri-scheme-setting.webp)
 
 ### File search returns no results
 
diff --git a/web/docs/integrations/whmcs.md b/web/docs/integrations/whmcs.md
index 4bbb148..88c26e2 100644
--- a/web/docs/integrations/whmcs.md
+++ b/web/docs/integrations/whmcs.md
@@ -21,7 +21,7 @@ Clients are matched to panel users by their WHMCS user ID (stored as the user's
 
 The client area renders a server summary (name, status, address, memory, disk, CPU) with a **Go to Server Panel** button, and the admin services tab surfaces the server UUID, node, owner, and panel link.
 
-![](./images/whmcs/client-area.png)
+![](./images/whmcs/client-area.webp)
 
 ## Requirements
 
@@ -51,7 +51,7 @@ The client area renders a server summary (name, status, address, memory, disk, C
 
 4. Create a **Server Group** and assign your Calagopus server to it.
 
-![](./images/whmcs/add-new-server.png)
+![](./images/whmcs/add-new-server.webp)
 
 ::: info
 To store the panel's server UUID against each service, create two **custom fields** named `Server UUID` and `Server ID` on the product (admin-only). The module fills these in automatically on provisioning. They are optional - without them, the module falls back to looking the server up by its `external_id`.
diff --git a/web/docs/panel/features/dashboard/account.md b/web/docs/panel/features/dashboard/account.md
new file mode 100644
index 0000000..96a77a4
--- /dev/null
+++ b/web/docs/panel/features/dashboard/account.md
@@ -0,0 +1,48 @@
+---
+title: Account
+description: Manage your Calagopus account, password, email, two-factor authentication, account details, and avatar.
+---
+
+# Account
+
+The Account page covers everything about your own user profile: password, email, two-factor authentication, display details, and avatar.
+
+![](./images/account/overview.webp)
+
+## Password
+
+Enter your current password, then your new password twice, and hit **Update**. You always have to confirm your current password first, even if you're already logged in.
+
+![](./images/account/password.webp)
+
+## Email
+
+Same idea: enter your new email and your current password, then **Update**.
+
+![](./images/account/email.webp)
+
+## Two-Factor Authentication
+
+Standard TOTP-based 2FA, the same kind used by most apps. Scan the QR code (or enter the code shown below it) in your authenticator app, then enter the 6-digit code it generates along with your current password to enable it.
+
+![](./images/account/2fa-setup.webp)
+
+To disable it, you'll need a valid authentication code and your password again.
+
+![](./images/account/2fa-disable.webp)
+
+## Account Details
+
+Your first name, last name, username, panel language, and toast position (where notifications pop up on screen). There's also a toggle for whether the panel should open to the **Grouped Servers** view instead of **All Servers**, off by default. See [Servers](./servers.md) for the difference.
+
+![](./images/account/details.webp)
+
+## Avatar
+
+Click the empty **Avatar** field to upload an image. If it doesn't crop the way you want, drag the position handles on the preview grid to adjust it before saving.
+
+![](./images/account/avatar-empty.webp)
+
+Once you have an avatar set, upload a new file and hit **Update** to replace it, or **Remove** to delete it.
+
+![](./images/account/avatar-set.webp)
diff --git a/web/docs/panel/features/dashboard/activity.md b/web/docs/panel/features/dashboard/activity.md
new file mode 100644
index 0000000..5c8bb4c
--- /dev/null
+++ b/web/docs/panel/features/dashboard/activity.md
@@ -0,0 +1,14 @@
+---
+title: Activity
+description: View the activity log for your Calagopus account.
+---
+
+# Activity
+
+Activity is a log of everything that's happened on your account: the actor, the event, the IP address it came from, and when it happened. Like most tables in the panel, it's paginated and searchable.
+
+![](./images/activity/activity-list.webp)
+
+Click the info button on a row to see the full details for that event.
+
+![](./images/activity/activity-details.webp)
diff --git a/web/docs/panel/features/dashboard/api-keys.md b/web/docs/panel/features/dashboard/api-keys.md
new file mode 100644
index 0000000..77b982f
--- /dev/null
+++ b/web/docs/panel/features/dashboard/api-keys.md
@@ -0,0 +1,42 @@
+---
+title: API Keys
+description: Create and manage personal API keys for the Calagopus API, with granular permissions per key.
+---
+
+# API Keys
+
+API keys are personal access tokens for the [API](https://demo.calagopus.com/api). Each key gets its own set of permissions, so you can hand out a key scoped to exactly what it needs rather than your full account access.
+
+The list shows each key's name, its key value, how many user/server/admin permissions it has, and its last used, expiry, and created timestamps.
+
+![](./images/api-keys/list.webp)
+
+## Creating a Key
+
+Click **Create** in the top right. Give it a name, optionally an expiry date, and optionally a list of IPs it's allowed to be used from (leave empty to allow any IP).
+
+![](./images/api-keys/create-form.webp)
+
+Expiry uses a calendar picker with an optional time:
+
+![](./images/api-keys/expires-picker.webp)
+
+Below that are the permission categories: **User**, **Server**, and **Admin** (the last only shown if your own account has admin permissions). Check individual permissions, or toggle an entire category at once. Everything you've selected shows up on the right under **Selected Permissions**, where you can also copy the full list or clear it with **Deselect All**. See the [Permissions Reference](./permissions.md) for what every permission does.
+
+Once you're happy with the selection, scroll down and hit **Save**, or **Close** to back out without creating anything.
+
+## Editing, Recreating, and Removing
+
+Right-click a key for **Edit**, **Recreate**, or **Remove**.
+
+![](./images/api-keys/context-menu.webp)
+
+**Edit** opens the same form as creating one, letting you change the name, expiry, allowed IPs, and permissions.
+
+![](./images/api-keys/edit-form.webp)
+
+**Recreate** issues a new key value with the same name and permissions, immediately invalidating the old value. Use this if a key may have leaked. **Remove** deletes the key outright.
+
+::: info
+A key can never edit itself or grant permissions it doesn't already have, even with `api-keys.update`.
+:::
diff --git a/web/docs/panel/features/dashboard/command-snippets.md b/web/docs/panel/features/dashboard/command-snippets.md
new file mode 100644
index 0000000..74da080
--- /dev/null
+++ b/web/docs/panel/features/dashboard/command-snippets.md
@@ -0,0 +1,26 @@
+---
+title: Command Snippets
+description: Set up shortcuts for commands you use often in the Calagopus server console.
+---
+
+# Command Snippets
+
+Command snippets are shortcuts for commands you type often into a server console. The list is empty by default and shows each snippet's name, which eggs it applies to, and when it was created.
+
+![](./images/command-snippets/list.webp)
+
+## Creating a Snippet
+
+Click **Create** and give it a short name, since that name is what you'll actually type in the console. Optionally pick an egg to restrict the snippet to servers using it; leave it empty to make the snippet available on every server.
+
+![](./images/command-snippets/create-form.webp)
+
+Then enter the command it should paste. For example, a snippet named `hello` with the command `say hello world!`:
+
+![](./images/command-snippets/example.webp)
+
+Typing `!hello` in the console and pressing enter pastes `say hello world!` in its place, so you don't have to type the full command every time.
+
+![](./images/command-snippets/usage-example.gif)
+
+Right-click an existing snippet to edit or delete it.
diff --git a/web/docs/panel/features/dashboard/images/account/2fa-disable.webp b/web/docs/panel/features/dashboard/images/account/2fa-disable.webp
new file mode 100644
index 0000000..1c63608
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/account/2fa-disable.webp differ
diff --git a/web/docs/panel/features/dashboard/images/account/2fa-setup.webp b/web/docs/panel/features/dashboard/images/account/2fa-setup.webp
new file mode 100644
index 0000000..4a84648
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/account/2fa-setup.webp differ
diff --git a/web/docs/panel/features/dashboard/images/account/avatar-empty.webp b/web/docs/panel/features/dashboard/images/account/avatar-empty.webp
new file mode 100644
index 0000000..15aae2a
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/account/avatar-empty.webp differ
diff --git a/web/docs/panel/features/dashboard/images/account/avatar-set.webp b/web/docs/panel/features/dashboard/images/account/avatar-set.webp
new file mode 100644
index 0000000..89bd445
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/account/avatar-set.webp differ
diff --git a/web/docs/panel/features/dashboard/images/account/details.webp b/web/docs/panel/features/dashboard/images/account/details.webp
new file mode 100644
index 0000000..15662b0
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/account/details.webp differ
diff --git a/web/docs/panel/features/dashboard/images/account/email.webp b/web/docs/panel/features/dashboard/images/account/email.webp
new file mode 100644
index 0000000..4c16073
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/account/email.webp differ
diff --git a/web/docs/panel/features/dashboard/images/account/overview.webp b/web/docs/panel/features/dashboard/images/account/overview.webp
new file mode 100644
index 0000000..f54a3b2
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/account/overview.webp differ
diff --git a/web/docs/panel/features/dashboard/images/account/password.webp b/web/docs/panel/features/dashboard/images/account/password.webp
new file mode 100644
index 0000000..74c7254
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/account/password.webp differ
diff --git a/web/docs/panel/features/dashboard/images/activity/activity-details.webp b/web/docs/panel/features/dashboard/images/activity/activity-details.webp
new file mode 100644
index 0000000..ca51cda
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/activity/activity-details.webp differ
diff --git a/web/docs/panel/features/dashboard/images/activity/activity-list.webp b/web/docs/panel/features/dashboard/images/activity/activity-list.webp
new file mode 100644
index 0000000..f730912
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/activity/activity-list.webp differ
diff --git a/web/docs/panel/features/dashboard/images/api-keys/context-menu.webp b/web/docs/panel/features/dashboard/images/api-keys/context-menu.webp
new file mode 100644
index 0000000..521a17e
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/api-keys/context-menu.webp differ
diff --git a/web/docs/panel/features/dashboard/images/api-keys/create-form.webp b/web/docs/panel/features/dashboard/images/api-keys/create-form.webp
new file mode 100644
index 0000000..992a947
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/api-keys/create-form.webp differ
diff --git a/web/docs/panel/features/dashboard/images/api-keys/edit-form.webp b/web/docs/panel/features/dashboard/images/api-keys/edit-form.webp
new file mode 100644
index 0000000..d7133e7
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/api-keys/edit-form.webp differ
diff --git a/web/docs/panel/features/dashboard/images/api-keys/expires-picker.webp b/web/docs/panel/features/dashboard/images/api-keys/expires-picker.webp
new file mode 100644
index 0000000..1accd89
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/api-keys/expires-picker.webp differ
diff --git a/web/docs/panel/features/dashboard/images/api-keys/list.webp b/web/docs/panel/features/dashboard/images/api-keys/list.webp
new file mode 100644
index 0000000..c437151
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/api-keys/list.webp differ
diff --git a/web/docs/panel/features/dashboard/images/command-snippets/create-form.webp b/web/docs/panel/features/dashboard/images/command-snippets/create-form.webp
new file mode 100644
index 0000000..f85548c
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/command-snippets/create-form.webp differ
diff --git a/web/docs/panel/features/dashboard/images/command-snippets/example.webp b/web/docs/panel/features/dashboard/images/command-snippets/example.webp
new file mode 100644
index 0000000..de4a858
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/command-snippets/example.webp differ
diff --git a/web/docs/panel/features/dashboard/images/command-snippets/list.webp b/web/docs/panel/features/dashboard/images/command-snippets/list.webp
new file mode 100644
index 0000000..f28372a
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/command-snippets/list.webp differ
diff --git a/web/docs/panel/features/dashboard/images/command-snippets/usage-example.gif b/web/docs/panel/features/dashboard/images/command-snippets/usage-example.gif
new file mode 100644
index 0000000..ef61301
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/command-snippets/usage-example.gif differ
diff --git a/web/docs/panel/features/dashboard/images/keyboard-shortcuts/disabled.webp b/web/docs/panel/features/dashboard/images/keyboard-shortcuts/disabled.webp
new file mode 100644
index 0000000..a77a007
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/keyboard-shortcuts/disabled.webp differ
diff --git a/web/docs/panel/features/dashboard/images/keyboard-shortcuts/overview.webp b/web/docs/panel/features/dashboard/images/keyboard-shortcuts/overview.webp
new file mode 100644
index 0000000..1691b10
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/keyboard-shortcuts/overview.webp differ
diff --git a/web/docs/panel/features/dashboard/images/keyboard-shortcuts/rebind-hover.webp b/web/docs/panel/features/dashboard/images/keyboard-shortcuts/rebind-hover.webp
new file mode 100644
index 0000000..86e79f0
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/keyboard-shortcuts/rebind-hover.webp differ
diff --git a/web/docs/panel/features/dashboard/images/keyboard-shortcuts/rebind-listening.webp b/web/docs/panel/features/dashboard/images/keyboard-shortcuts/rebind-listening.webp
new file mode 100644
index 0000000..9d0a5a0
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/keyboard-shortcuts/rebind-listening.webp differ
diff --git a/web/docs/panel/features/dashboard/images/keyboard-shortcuts/toolbar.webp b/web/docs/panel/features/dashboard/images/keyboard-shortcuts/toolbar.webp
new file mode 100644
index 0000000..d9fefc3
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/keyboard-shortcuts/toolbar.webp differ
diff --git a/web/docs/panel/features/dashboard/images/nav-menu.webp b/web/docs/panel/features/dashboard/images/nav-menu.webp
new file mode 100644
index 0000000..fcd1d31
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/nav-menu.webp differ
diff --git a/web/docs/panel/features/dashboard/images/nav-search.webp b/web/docs/panel/features/dashboard/images/nav-search.webp
new file mode 100644
index 0000000..f1ebb1e
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/nav-search.webp differ
diff --git a/web/docs/panel/features/dashboard/images/oauth-links/connect-menu.webp b/web/docs/panel/features/dashboard/images/oauth-links/connect-menu.webp
new file mode 100644
index 0000000..2f39c9c
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/oauth-links/connect-menu.webp differ
diff --git a/web/docs/panel/features/dashboard/images/oauth-links/list.webp b/web/docs/panel/features/dashboard/images/oauth-links/list.webp
new file mode 100644
index 0000000..4b7e4c1
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/oauth-links/list.webp differ
diff --git a/web/docs/panel/features/dashboard/images/security-keys/context-menu.webp b/web/docs/panel/features/dashboard/images/security-keys/context-menu.webp
new file mode 100644
index 0000000..01bb732
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/security-keys/context-menu.webp differ
diff --git a/web/docs/panel/features/dashboard/images/security-keys/create-form.webp b/web/docs/panel/features/dashboard/images/security-keys/create-form.webp
new file mode 100644
index 0000000..aa73a10
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/security-keys/create-form.webp differ
diff --git a/web/docs/panel/features/dashboard/images/security-keys/edit-form.webp b/web/docs/panel/features/dashboard/images/security-keys/edit-form.webp
new file mode 100644
index 0000000..2c494c2
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/security-keys/edit-form.webp differ
diff --git a/web/docs/panel/features/dashboard/images/security-keys/list.webp b/web/docs/panel/features/dashboard/images/security-keys/list.webp
new file mode 100644
index 0000000..20000e0
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/security-keys/list.webp differ
diff --git a/web/docs/panel/features/dashboard/images/security-keys/save-prompt.webp b/web/docs/panel/features/dashboard/images/security-keys/save-prompt.webp
new file mode 100644
index 0000000..5f5dc15
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/security-keys/save-prompt.webp differ
diff --git a/web/docs/panel/features/dashboard/images/servers/add-server-picker.webp b/web/docs/panel/features/dashboard/images/servers/add-server-picker.webp
new file mode 100644
index 0000000..eed955d
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/servers/add-server-picker.webp differ
diff --git a/web/docs/panel/features/dashboard/images/servers/all-servers.webp b/web/docs/panel/features/dashboard/images/servers/all-servers.webp
new file mode 100644
index 0000000..a32f749
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/servers/all-servers.webp differ
diff --git a/web/docs/panel/features/dashboard/images/servers/bulk-power-actions.webp b/web/docs/panel/features/dashboard/images/servers/bulk-power-actions.webp
new file mode 100644
index 0000000..6c709d1
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/servers/bulk-power-actions.webp differ
diff --git a/web/docs/panel/features/dashboard/images/servers/create-group.webp b/web/docs/panel/features/dashboard/images/servers/create-group.webp
new file mode 100644
index 0000000..8db22a9
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/servers/create-group.webp differ
diff --git a/web/docs/panel/features/dashboard/images/servers/edit-group.webp b/web/docs/panel/features/dashboard/images/servers/edit-group.webp
new file mode 100644
index 0000000..49e5f40
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/servers/edit-group.webp differ
diff --git a/web/docs/panel/features/dashboard/images/servers/group-actions.webp b/web/docs/panel/features/dashboard/images/servers/group-actions.webp
new file mode 100644
index 0000000..4df78f9
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/servers/group-actions.webp differ
diff --git a/web/docs/panel/features/dashboard/images/servers/group-collapsed.webp b/web/docs/panel/features/dashboard/images/servers/group-collapsed.webp
new file mode 100644
index 0000000..88d19ee
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/servers/group-collapsed.webp differ
diff --git a/web/docs/panel/features/dashboard/images/servers/group-expanded.webp b/web/docs/panel/features/dashboard/images/servers/group-expanded.webp
new file mode 100644
index 0000000..78e787a
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/servers/group-expanded.webp differ
diff --git a/web/docs/panel/features/dashboard/images/servers/grouped-servers.webp b/web/docs/panel/features/dashboard/images/servers/grouped-servers.webp
new file mode 100644
index 0000000..50668db
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/servers/grouped-servers.webp differ
diff --git a/web/docs/panel/features/dashboard/images/servers/other-users-toggle.webp b/web/docs/panel/features/dashboard/images/servers/other-users-toggle.webp
new file mode 100644
index 0000000..703e200
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/servers/other-users-toggle.webp differ
diff --git a/web/docs/panel/features/dashboard/images/sessions/context-menu.webp b/web/docs/panel/features/dashboard/images/sessions/context-menu.webp
new file mode 100644
index 0000000..b473d4f
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/sessions/context-menu.webp differ
diff --git a/web/docs/panel/features/dashboard/images/sessions/list.webp b/web/docs/panel/features/dashboard/images/sessions/list.webp
new file mode 100644
index 0000000..1124cac
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/sessions/list.webp differ
diff --git a/web/docs/panel/features/dashboard/images/ssh-keys/context-menu.webp b/web/docs/panel/features/dashboard/images/ssh-keys/context-menu.webp
new file mode 100644
index 0000000..6bedc30
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/ssh-keys/context-menu.webp differ
diff --git a/web/docs/panel/features/dashboard/images/ssh-keys/create-form.webp b/web/docs/panel/features/dashboard/images/ssh-keys/create-form.webp
new file mode 100644
index 0000000..487094d
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/ssh-keys/create-form.webp differ
diff --git a/web/docs/panel/features/dashboard/images/ssh-keys/edit-form.webp b/web/docs/panel/features/dashboard/images/ssh-keys/edit-form.webp
new file mode 100644
index 0000000..28b010e
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/ssh-keys/edit-form.webp differ
diff --git a/web/docs/panel/features/dashboard/images/ssh-keys/import-form.webp b/web/docs/panel/features/dashboard/images/ssh-keys/import-form.webp
new file mode 100644
index 0000000..b1a47f6
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/ssh-keys/import-form.webp differ
diff --git a/web/docs/panel/features/dashboard/images/ssh-keys/list.webp b/web/docs/panel/features/dashboard/images/ssh-keys/list.webp
new file mode 100644
index 0000000..9454319
Binary files /dev/null and b/web/docs/panel/features/dashboard/images/ssh-keys/list.webp differ
diff --git a/web/docs/panel/features/dashboard/index.md b/web/docs/panel/features/dashboard/index.md
new file mode 100644
index 0000000..c8fb128
--- /dev/null
+++ b/web/docs/panel/features/dashboard/index.md
@@ -0,0 +1,31 @@
+---
+title: Dashboard
+description: A tour of the Calagopus user dashboard, the part of the Panel every user sees after logging in to manage their account and servers.
+---
+
+# Dashboard
+
+The Dashboard is what every user lands on after logging in. It covers your own account (password, email, two-factor, avatar), your servers, and account-level self-service like API keys, SSH keys, and security keys. It's separate from the **Admin** area, which is only visible to users with admin permissions and covers instance-wide management like nodes, locations, and other users.
+
+| Page | Description |
+| --- | --- |
+| [Servers](./servers.md) | Your server list, server groups, and bulk power actions |
+| [Account](./account.md) | Password, email, two-factor authentication, and avatar |
+| [Security Keys](./security-keys.md) | Passkeys and hardware security keys for login |
+| [API Keys](./api-keys.md) | Personal access tokens for the API, with granular permissions |
+| [SSH Keys](./ssh-keys.md) | Public keys used for SFTP and SSH access to Wings |
+| [Command Snippets](./command-snippets.md) | Shortcuts for commands you use often in the server console |
+| [OAuth Links](./oauth-links.md) | Linking third-party accounts for faster login |
+| [Sessions](./sessions.md) | Devices currently logged into your account |
+| [Keyboard Shortcuts](./keyboard-shortcuts.md) | Rebindable shortcuts for navigating the panel |
+| [Activity](./activity.md) | A log of everything that's happened on your account |
+
+## Navigating the Dashboard
+
+The sidebar lists every page above, plus **Servers** and **Admin** (if you have admin permissions) at the top. At the bottom, the profile box doubles as a search box: if you have more than a handful of servers, click into it to search and jump straight to one.
+
+![](./images/nav-search.webp)
+
+The three dots next to your name open a small menu to jump to your **Account** page, switch to the **Admin** area, toggle light/dark mode, or log out.
+
+![](./images/nav-menu.webp)
diff --git a/web/docs/panel/features/dashboard/keyboard-shortcuts.md b/web/docs/panel/features/dashboard/keyboard-shortcuts.md
new file mode 100644
index 0000000..5d1e1a7
--- /dev/null
+++ b/web/docs/panel/features/dashboard/keyboard-shortcuts.md
@@ -0,0 +1,103 @@
+---
+title: Keyboard Shortcuts
+description: View and rebind keyboard shortcuts for navigating and interacting with the Calagopus panel.
+---
+
+# Keyboard Shortcuts
+
+Keyboard shortcuts let you navigate and interact with the panel without reaching for the mouse, grouped by where they apply: the file manager, the server console, and table navigation.
+
+![](./images/keyboard-shortcuts/overview.webp)
+
+The panel detects whether you're on Windows/Linux or macOS and shows the matching modifier keys automatically.
+
+## Default Bindings
+
+| File Manager | Binding |
+| --- | --- |
+| Select all files | `Ctrl+A` |
+| Cut selected files | `Ctrl+X` |
+| Copy selected files | `Ctrl+C` |
+| Paste files | `Ctrl+V` |
+| Duplicate selected file | `D` |
+| Search files | `Ctrl+K` |
+| Move up a directory | `Alt+↑` |
+| Move up the selection | `↑` |
+| Move down the selection | `↓` |
+| Rename file | `F2` |
+| Deselect all files | `Esc` |
+| Delete selected files | `Del` |
+
+| Server Console | Binding |
+| --- | --- |
+| Search in console output | `Ctrl+F` |
+| Previous command in history | `↑` |
+| Next command in history | `↓` |
+
+| Table Navigation | Binding |
+| --- | --- |
+| Previous page | `←` |
+| Next page | `→` |
+| First page | `Shift+←` |
+| Last page | `Shift+→` |
+
+(`Ctrl` shows as `Cmd` on macOS.)
+
+## Rebinding, Disabling, and Resetting
+
+Each shortcut has three buttons next to it: rebind, disable, and reset to default.
+
+![](./images/keyboard-shortcuts/rebind-hover.webp)
+
+Click the pencil and press the new key combination you want; it's captured as soon as you press it.
+
+![](./images/keyboard-shortcuts/rebind-listening.webp)
+
+The circle-slash button disables a shortcut entirely, and the reset button restores it to its shipped default.
+
+![](./images/keyboard-shortcuts/disabled.webp)
+
+## Copy, Paste, and Reset All
+
+The toolbar at the top has four actions:
+
+![](./images/keyboard-shortcuts/toolbar.webp)
+
+- **Copy All** copies every current binding as text, in a format you can edit directly and paste back in to apply changes. It's also the easiest way to carry your keybinds over to another Calagopus panel: copy from one, paste into the other.
+- **Paste** applies a previously copied (and optionally edited) set of bindings.
+- **Reset All** restores every shortcut to its default at once.
+
+```txt
+# Calagopus keyboard shortcuts
+#
+# Edit the value after "=" then paste this back to apply your changes.
+#   - a key combination such as  Ctrl+Shift+K  or  Mod+S  (Mod = Ctrl/Cmd)
+#   - "disabled" turns the shortcut off
+#   - "default" restores the shipped binding
+# Lines starting with "#" and unknown ids are ignored.
+
+[files] # File Manager
+files.selectAll         = Mod+A
+files.cut               = Mod+X
+files.copy              = Mod+C
+files.paste             = Mod+V
+files.duplicate         = D
+files.search            = Mod+K
+files.moveUpDirectory   = Alt+ArrowUp
+files.moveUpSelection   = ArrowUp
+files.moveDownSelection = ArrowDown
+files.rename            = F2
+files.deselectAll       = Escape
+files.delete            = Delete
+
+[console] # Server Console
+console.search          = Mod+F
+console.previousCommand = ArrowUp
+console.nextCommand     = ArrowDown
+
+[table] # Table Navigation
+table.previousPage      = ArrowLeft
+table.nextPage          = ArrowRight
+table.firstPage         = Shift+ArrowLeft
+table.lastPage          = Shift+ArrowRight
+```
diff --git a/web/docs/panel/features/dashboard/oauth-links.md b/web/docs/panel/features/dashboard/oauth-links.md
new file mode 100644
index 0000000..5a36992
--- /dev/null
+++ b/web/docs/panel/features/dashboard/oauth-links.md
@@ -0,0 +1,22 @@
+---
+title: OAuth Links
+description: Link third-party accounts to your Calagopus account for faster login.
+---
+
+# OAuth Links
+
+OAuth links let you log in with a third-party account instead of typing your username and password. The list shows the provider name, identifier, and last used and created timestamps for each linked account.
+
+![](./images/oauth-links/list.webp)
+
+## Linking an Account
+
+This only works once an administrator has configured at least one OAuth provider on the instance. If they have, click **Connect** in the top right and pick a provider.
+
+![](./images/oauth-links/connect-menu.webp)
+
+You're sent to that provider to authorize the connection; accepting links it to your Calagopus account. Any OIDC-compliant provider works. Our docs cover setup for [Discord, Google, GitHub, and generic OIDC providers](../../../additional/setting-up-oauth/index.md) like Authentik or Pocket ID.
+
+## Removing a Link
+
+Right-click a linked account and select **Delete**.
diff --git a/web/docs/panel/features/dashboard/permissions.md b/web/docs/panel/features/dashboard/permissions.md
new file mode 100644
index 0000000..cb69c85
--- /dev/null
+++ b/web/docs/panel/features/dashboard/permissions.md
@@ -0,0 +1,447 @@
+---
+title: Permissions Reference
+description: Full reference of every user, server, and admin permission available for Calagopus API keys.
+---
+
+# Permissions Reference
+
+Every permission available when creating or editing an [API Key](./api-keys.md), grouped the same way they're grouped in the panel. **User** permissions apply to your account as a whole, **Server** permissions apply per-server, and **Admin** permissions apply to the instance and are only available to accounts that already have them.
+
+## User Permissions
+
+### Account
+
+Permissions that control the ability to change account settings.
+
+| Permission | Description |
+| --- | --- |
+| `account.infos` | Allows changing the account's basic account information. |
+| `account.email` | Allows changing the account's email address. |
+| `account.password` | Allows changing the account's password. |
+| `account.two-factor` | Allows adding and removing two-factor authentication. |
+| `account.avatar` | Allows updating and removing the account's avatar. |
+
+### Servers
+
+Permissions that control the ability to list servers and manage server groups.
+
+| Permission | Description |
+| --- | --- |
+| `servers.create` | Allows creating new server groups. |
+| `servers.read` | Allows viewing servers and server groups. |
+| `servers.update` | Allows modifying server groups. |
+| `servers.delete` | Allows deleting server groups. |
+
+### API Keys
+
+Permissions that control the ability to manage API keys on an account. API keys can never edit themselves or assign permissions they do not have.
+
+| Permission | Description |
+| --- | --- |
+| `api-keys.create` | Allows creating new API keys. |
+| `api-keys.read` | Allows viewing API keys and their permissions. |
+| `api-keys.update` | Allows modifying other API keys. |
+| `api-keys.delete` | Allows deleting API keys. |
+| `api-keys.recreate` | Allows recreating API keys. |
+
+### Security Keys
+
+Permissions that control the ability to manage security keys on an account.
+
+| Permission | Description |
+| --- | --- |
+| `security-keys.create` | Allows creating new security keys. |
+| `security-keys.read` | Allows viewing security keys. |
+| `security-keys.update` | Allows modifying security keys. |
+| `security-keys.delete` | Allows deleting security keys. |
+
+### SSH Keys
+
+Permissions that control the ability to manage SSH keys on an account.
+
+| Permission | Description |
+| --- | --- |
+| `ssh-keys.create` | Allows creating or importing new SSH keys. |
+| `ssh-keys.read` | Allows viewing SSH keys. |
+| `ssh-keys.update` | Allows modifying other SSH keys. |
+| `ssh-keys.delete` | Allows deleting SSH keys. |
+
+### OAuth Links
+
+Permissions that control the ability to manage OAuth links on an account.
+
+| Permission | Description |
+| --- | --- |
+| `oauth-links.create` | Allows creating new OAuth links. |
+| `oauth-links.read` | Allows viewing OAuth links. |
+| `oauth-links.delete` | Allows deleting OAuth links. |
+
+### Command Snippets
+
+Permissions that control the ability to manage command snippets on an account.
+
+| Permission | Description |
+| --- | --- |
+| `command-snippets.create` | Allows creating new command snippets. |
+| `command-snippets.read` | Allows viewing command snippets. |
+| `command-snippets.update` | Allows modifying command snippets. |
+| `command-snippets.delete` | Allows deleting command snippets. |
+
+### Sessions
+
+Permissions that control the ability to manage sessions on an account.
+
+| Permission | Description |
+| --- | --- |
+| `sessions.read` | Allows viewing sessions and their IP addresses. |
+| `sessions.delete` | Allows deleting sessions. |
+
+### Activity
+
+Permissions that control the ability to view the activity log on an account.
+
+| Permission | Description |
+| --- | --- |
+| `activity.read` | Allows viewing the account's activity logs. |
+
+## Server Permissions
+
+### Control
+
+Permissions that control the ability to control the power state of a server, read the console, or send commands.
+
+| Permission | Description |
+| --- | --- |
+| `control.read-console` | Allows reading the server console logs. |
+| `control.console` | Allows sending commands to the server instance via the console. |
+| `control.start` | Allows starting the server if it is stopped. |
+| `control.stop` | Allows stopping the server if it is running. |
+| `control.restart` | Allows restarting the server. Permits starting it if offline, but not placing it in a fully stopped state. |
+
+### Subusers
+
+Permissions that control the ability to manage subusers of a server. Users can never edit their own account or assign permissions they do not have.
+
+| Permission | Description |
+| --- | --- |
+| `subusers.create` | Allows creating new subusers for the server. |
+| `subusers.read` | Allows viewing subusers and their permissions. |
+| `subusers.update` | Allows modifying other subusers. |
+| `subusers.delete` | Allows deleting subusers from the server. |
+
+### Files
+
+Permissions that control the ability to modify the filesystem for this server.
+
+| Permission | Description |
+| --- | --- |
+| `files.create` | Allows creating additional files and folders via the panel or direct upload. |
+| `files.read` | Allows viewing the contents of a directory, but not reading or downloading individual files. |
+| `files.read-content` | Allows viewing the contents of a specific file. Also permits downloading files. |
+| `files.update` | Allows updating the contents of an existing file or directory. |
+| `files.delete` | Allows deleting files or directories. |
+| `files.archive` | Allows archiving the contents of a directory and decompressing files. |
+| `files.sftp` | Allows connecting via SFTP to manage files. |
+
+### Backups
+
+Permissions that control the ability to manage server backups.
+
+| Permission | Description |
+| --- | --- |
+| `backups.create` | Allows creating new backups for the server. |
+| `backups.read` | Allows viewing existing backups. |
+| `backups.download` | Allows downloading backups. |
+| `backups.restore` | Allows restoring backups. |
+| `backups.update` | Allows updating existing backups. |
+| `backups.delete` | Allows deleting backups. |
+
+### Schedules
+
+Permissions that control the ability to manage server schedules.
+
+| Permission | Description |
+| --- | --- |
+| `schedules.create` | Allows creating new schedules. |
+| `schedules.read` | Allows viewing existing schedules. |
+| `schedules.update` | Allows updating existing schedules. |
+| `schedules.delete` | Allows deleting schedules. |
+
+### Allocations
+
+Permissions that control the ability to modify the port allocations for this server.
+
+| Permission | Description |
+| --- | --- |
+| `allocations.read` | Allows viewing all allocations currently assigned. Users with any access can always view the primary allocation. |
+| `allocations.create` | Allows assigning additional allocations to the server. |
+| `allocations.update` | Allows changing the primary server allocation and attaching notes to allocations. |
+| `allocations.delete` | Allows deleting allocations from the server. |
+
+### Startup
+
+Permissions that control the ability to view and modify this server's startup parameters.
+
+| Permission | Description |
+| --- | --- |
+| `startup.read` | Allows viewing the startup variables for the server. |
+| `startup.update` | Allows modifying the startup variables. |
+| `startup.command` | Allows modifying the command used to start the server. |
+| `startup.docker-image` | Allows modifying the Docker image used when running the server. |
+
+### Databases
+
+Permissions that control the ability to manage databases on this server.
+
+| Permission | Description |
+| --- | --- |
+| `databases.create` | Allows creating new databases. |
+| `databases.read` | Allows viewing databases associated with this server. |
+| `databases.read-password` | Allows viewing the password associated with a database instance. |
+| `databases.update` | Allows rotating the password on a database instance. Users without `read-password` won't see the new value. |
+| `databases.recreate` | Allows deleting and recreating a database, wiping all data. |
+| `databases.delete` | Allows removing database instances from this server. |
+
+### Mounts
+
+Permissions that control the ability to manage server mounts.
+
+| Permission | Description |
+| --- | --- |
+| `mounts.attach` | Allows attaching new mounts to the server. |
+| `mounts.read` | Allows viewing existing mounts. |
+| `mounts.detach` | Allows detaching mounts from the server. |
+
+### Settings
+
+Permissions that control the ability to manage settings on this server.
+
+| Permission | Description |
+| --- | --- |
+| `settings.rename` | Allows renaming the server and changing its description. |
+| `settings.timezone` | Allows changing the server's timezone. |
+| `settings.auto-kill` | Allows changing the server's auto-kill settings. |
+| `settings.auto-start` | Allows changing the server's auto-start settings. |
+| `settings.install` | Allows triggering a reinstall of the server. |
+| `settings.cancel-install` | Allows canceling the server's installation process. |
+
+### Activity
+
+Permissions that control the ability to view the activity log on this server.
+
+| Permission | Description |
+| --- | --- |
+| `activity.read` | Allows viewing the server's activity logs. |
+| `activity.read-ip` | Allows viewing IP addresses associated with activity logs. |
+
+## Admin Permissions
+
+### Stats
+
+| Permission | Description |
+| --- | --- |
+| `stats.read` | Allows viewing panel statistics. |
+
+### Settings
+
+| Permission | Description |
+| --- | --- |
+| `settings.read` | Allows viewing panel settings and secrets. |
+| `settings.update` | Allows modifying panel settings and secrets. |
+
+### Email Templates
+
+| Permission | Description |
+| --- | --- |
+| `email-templates.read` | Allows viewing email templates. |
+| `email-templates.update` | Allows modifying email templates. |
+
+### Extensions
+
+| Permission | Description |
+| --- | --- |
+| `extensions.read` | Allows viewing panel extensions. |
+| `extensions.manage` | Allows installing, updating, and removing panel extensions; usually also manages extension settings. |
+
+### Announcements
+
+| Permission | Description |
+| --- | --- |
+| `announcements.create` | Allows creating new announcements. |
+| `announcements.read` | Allows viewing announcements. |
+| `announcements.update` | Allows modifying announcements. |
+| `announcements.delete` | Allows deleting announcements. |
+
+### Assets
+
+| Permission | Description |
+| --- | --- |
+| `assets.read` | Allows viewing panel assets. |
+| `assets.upload` | Allows creating and modifying assets. |
+| `assets.delete` | Allows deleting panel assets. |
+
+### Users
+
+| Permission | Description |
+| --- | --- |
+| `users.create` | Allows creating new users. |
+| `users.read` | Allows viewing users. |
+| `users.update` | Allows modifying users. |
+| `users.disable-two-factor` | Allows removing two-factor authentication from users. |
+| `users.delete` | Allows deleting users. |
+| `users.email` | Allows sending email actions to users, such as password resets. |
+| `users.activity` | Allows viewing a user's activity log. |
+| `users.oauth-links` | Allows viewing and managing a user's OAuth links. |
+| `users.impersonate` | Allows impersonating other users. |
+
+### Roles
+
+| Permission | Description |
+| --- | --- |
+| `roles.create` | Allows creating new roles. |
+| `roles.read` | Allows viewing roles. |
+| `roles.update` | Allows modifying roles. |
+| `roles.delete` | Allows deleting roles. |
+
+### Locations
+
+| Permission | Description |
+| --- | --- |
+| `locations.create` | Allows creating new locations. |
+| `locations.read` | Allows viewing locations. |
+| `locations.update` | Allows modifying locations. |
+| `locations.delete` | Allows deleting locations. |
+| `locations.database-hosts` | Allows viewing and managing a location's database hosts. |
+| `locations.database-agent-hosts` | Allows viewing and managing a location's database agent hosts. |
+
+### Backup Configurations
+
+| Permission | Description |
+| --- | --- |
+| `backup-configurations.create` | Allows creating new backup configurations. |
+| `backup-configurations.read` | Allows viewing backup configurations and their passwords. |
+| `backup-configurations.update` | Allows modifying backup configurations and their passwords. |
+| `backup-configurations.delete` | Allows deleting backup configurations. |
+| `backup-configurations.backups` | Allows viewing backups associated with a backup configuration. |
+
+### Nodes
+
+| Permission | Description |
+| --- | --- |
+| `nodes.create` | Allows creating new nodes. |
+| `nodes.read` | Allows viewing nodes. |
+| `nodes.update` | Allows modifying nodes. |
+| `nodes.delete` | Allows deleting nodes. |
+| `nodes.read-token` | Allows viewing a node's token. |
+| `nodes.reset-token` | Allows resetting a node's token. |
+| `nodes.allocations` | Allows viewing and managing a node's allocations. |
+| `nodes.mounts` | Allows viewing and managing a node's mounts. |
+| `nodes.backups` | Allows viewing and managing a node's backups. |
+| `nodes.power` | Allows executing mass-power actions on nodes. |
+| `nodes.transfers` | Allows viewing and managing mass-server transfers between nodes. |
+
+### Servers
+
+| Permission | Description |
+| --- | --- |
+| `servers.create` | Allows creating new servers. |
+| `servers.read` | Allows viewing servers. |
+| `servers.update` | Allows modifying servers. |
+| `servers.delete` | Allows deleting servers. |
+| `servers.transfer` | Allows transferring servers to other nodes or canceling ongoing transfers. |
+| `servers.allocations` | Allows viewing and managing a server's allocations. |
+| `servers.variables` | Allows viewing and managing a server's variables. |
+| `servers.mounts` | Allows viewing and managing a server's mounts. |
+
+### Nests
+
+| Permission | Description |
+| --- | --- |
+| `nests.create` | Allows creating new nests. |
+| `nests.read` | Allows viewing nests. |
+| `nests.update` | Allows modifying nests. |
+| `nests.delete` | Allows deleting nests. |
+
+### Eggs
+
+| Permission | Description |
+| --- | --- |
+| `eggs.create` | Allows creating and importing new eggs. |
+| `eggs.read` | Allows viewing eggs. |
+| `eggs.update` | Allows modifying eggs. |
+| `eggs.delete` | Allows deleting eggs. |
+| `eggs.mounts` | Allows viewing and managing an egg's mounts. |
+
+### Egg Configurations
+
+| Permission | Description |
+| --- | --- |
+| `egg-configurations.create` | Allows creating new egg configurations. |
+| `egg-configurations.read` | Allows viewing egg configurations. |
+| `egg-configurations.update` | Allows modifying egg configurations. |
+| `egg-configurations.delete` | Allows deleting egg configurations. |
+
+### Egg Repositories
+
+| Permission | Description |
+| --- | --- |
+| `egg-repositories.create` | Allows creating new egg repositories. |
+| `egg-repositories.read` | Allows viewing egg repositories. |
+| `egg-repositories.update` | Allows modifying egg repositories. |
+| `egg-repositories.delete` | Allows deleting egg repositories. |
+| `egg-repositories.sync` | Allows synchronizing egg repositories with their remote sources. |
+
+### Database Hosts
+
+| Permission | Description |
+| --- | --- |
+| `database-hosts.create` | Allows creating new database hosts. |
+| `database-hosts.read` | Allows viewing database hosts. |
+| `database-hosts.update` | Allows modifying database hosts. |
+| `database-hosts.delete` | Allows deleting database hosts. |
+| `database-hosts.test` | Allows testing database host connections. |
+
+### Database Agent Hosts
+
+| Permission | Description |
+| --- | --- |
+| `database-agent-hosts.create` | Allows creating new database agent hosts. |
+| `database-agent-hosts.read` | Allows viewing database agent hosts. |
+| `database-agent-hosts.update` | Allows modifying database agent hosts. |
+| `database-agent-hosts.delete` | Allows deleting database agent hosts. |
+| `database-agent-hosts.read-token` | Allows viewing a database agent host's token. |
+| `database-agent-hosts.reset-token` | Allows resetting database agent host tokens. |
+| `database-agent-hosts.test` | Allows testing database agent host connections. |
+
+### Database Agent Templates
+
+| Permission | Description |
+| --- | --- |
+| `database-agent-templates.create` | Allows creating new database agent templates. |
+| `database-agent-templates.read` | Allows viewing database agent templates. |
+| `database-agent-templates.update` | Allows modifying database agent templates. |
+| `database-agent-templates.delete` | Allows deleting database agent templates. |
+
+### OAuth Providers
+
+| Permission | Description |
+| --- | --- |
+| `oauth-providers.create` | Allows creating new OAuth providers. |
+| `oauth-providers.read` | Allows viewing OAuth providers. |
+| `oauth-providers.update` | Allows modifying OAuth providers. |
+| `oauth-providers.delete` | Allows deleting OAuth providers. |
+
+### Mounts
+
+| Permission | Description |
+| --- | --- |
+| `mounts.create` | Allows creating new mounts. |
+| `mounts.read` | Allows viewing mounts. |
+| `mounts.update` | Allows modifying mounts. |
+| `mounts.delete` | Allows deleting mounts. |
+
+### Activity
+
+| Permission | Description |
+| --- | --- |
+| `activity.read` | Allows viewing the activity logs for all admin operations. |
diff --git a/web/docs/panel/features/dashboard/security-keys.md b/web/docs/panel/features/dashboard/security-keys.md
new file mode 100644
index 0000000..327480e
--- /dev/null
+++ b/web/docs/panel/features/dashboard/security-keys.md
@@ -0,0 +1,29 @@
+---
+title: Security Keys
+description: Add passkeys and hardware security keys (WebAuthn) to your Calagopus account for passwordless login.
+---
+
+# Security Keys
+
+Security keys use [WebAuthn](https://webauthn.io/) to let you log in with a passkey, your device's biometrics, or a physical hardware key instead of typing your password. Your instance needs a valid SSL certificate for this to work; see [Generating SSL Certificates](../../../additional/ssl-certificates.md) if it doesn't have one yet.
+
+Existing keys are listed with their name, credential ID, last used, and created timestamps. Right-click one to rename it or delete it.
+
+![](./images/security-keys/list.webp)
+
+## Creating a Security Key
+
+Click **Create** in the top right and give the key a name.
+
+![](./images/security-keys/create-form.webp)
+
+After confirming, the browser takes over and asks where to save the credential: a password manager extension like Bitwarden, a platform prompt (Windows Hello, iCloud Keychain, Android), or a physical key. Closing that prompt cancels the creation.
+
+![](./images/security-keys/save-prompt.webp)
+
+## Editing and Removing
+
+Right-click a key to rename it or delete it. Editing only changes the display name, not the credential itself.
+
+![](./images/security-keys/context-menu.webp)
+![](./images/security-keys/edit-form.webp)
diff --git a/web/docs/panel/features/dashboard/servers.md b/web/docs/panel/features/dashboard/servers.md
new file mode 100644
index 0000000..c97bea0
--- /dev/null
+++ b/web/docs/panel/features/dashboard/servers.md
@@ -0,0 +1,48 @@
+---
+title: Servers
+description: Browse your servers, organize them into groups, and manage power state from the Calagopus dashboard.
+---
+
+# Servers
+
+The Servers page is the landing page for most users and lists every server you have access to. It has two views: **All Servers**, a flat list, and **Grouped Servers**, where you organize servers into your own groups.
+
+![](./images/servers/all-servers.webp)
+
+Each server card shows its power state, name, address, and live CPU, memory, and disk usage. If you have access to servers owned by other users (for example as a subuser), a **Show other user's servers** toggle appears in the top right; it's off by default.
+
+![](./images/servers/other-users-toggle.webp)
+
+## Grouped Servers
+
+Groups are personal and only affect how servers are organized for you, they don't change who has access to a server.
+
+![](./images/servers/grouped-servers.webp)
+
+### Creating a Group
+
+Switch to the **Grouped Servers** tab and click **Create**. Give the group a name.
+
+![](./images/servers/create-group.webp)
+
+### Adding and Removing Servers
+
+Open a group's menu to add a server to it, then search for and pick the server you want to add.
+
+![](./images/servers/add-server-picker.webp)
+
+Groups are collapsible; click the chevron to expand or collapse one.
+
+![](./images/servers/group-collapsed.webp)
+![](./images/servers/group-expanded.webp)
+
+Click a server inside a group to select it. A small action bar appears with power controls (start, stop, restart) and an option to remove it from the group without deleting the server itself.
+
+![](./images/servers/bulk-power-actions.webp)
+
+### Renaming and Deleting a Group
+
+Open the group's menu for **Edit** to rename it, or **Delete** to remove the group. Deleting a group never deletes the servers inside it, it just ungroups them.
+
+![](./images/servers/group-actions.webp)
+![](./images/servers/edit-group.webp)
diff --git a/web/docs/panel/features/dashboard/sessions.md b/web/docs/panel/features/dashboard/sessions.md
new file mode 100644
index 0000000..d331a6c
--- /dev/null
+++ b/web/docs/panel/features/dashboard/sessions.md
@@ -0,0 +1,16 @@
+---
+title: Sessions
+description: View and revoke devices currently logged into your Calagopus account.
+---
+
+# Sessions
+
+Sessions lists every device currently logged into your account: its IP address, whether it's the device you're using right now, its user agent, and when it was last active.
+
+![](./images/sessions/list.webp)
+
+## Revoking a Session
+
+Right-click a session and select **Remove** to log it out. This is useful if you spot a session you don't recognize or want to sign out an old device.
+
+![](./images/sessions/context-menu.webp)
diff --git a/web/docs/panel/features/dashboard/ssh-keys.md b/web/docs/panel/features/dashboard/ssh-keys.md
new file mode 100644
index 0000000..bea3575
--- /dev/null
+++ b/web/docs/panel/features/dashboard/ssh-keys.md
@@ -0,0 +1,32 @@
+---
+title: SSH Keys
+description: Add public SSH keys to your Calagopus account to use for SFTP and SSH access to Wings.
+---
+
+# SSH Keys
+
+SSH keys added here are used for SFTP and SSH logins to Wings, the node daemon. The list shows each key's name, fingerprint, and when it was created; it's empty until you add your first one.
+
+![](./images/ssh-keys/list.webp)
+
+## Adding a Key
+
+**Create** lets you paste or upload a public key file (`.pub`) and give it a name.
+
+![](./images/ssh-keys/create-form.webp)
+
+**Import** does the same thing but is meant for grabbing a key straight from a `.pub` file without typing anything else in.
+
+![](./images/ssh-keys/import-form.webp)
+
+Either way, once the key is added it can be used for SFTP or SSH logins to Wings right away.
+
+## Editing and Removing
+
+Right-click a key to edit or delete it.
+
+![](./images/ssh-keys/context-menu.webp)
+
+Editing only lets you change the key's name, not the key material itself. Add a new key instead if the underlying key pair changed.
+
+![](./images/ssh-keys/edit-form.webp)
diff --git a/web/docs/panel/features/index.md b/web/docs/panel/features/index.md
new file mode 100644
index 0000000..e9aab4e
--- /dev/null
+++ b/web/docs/panel/features/index.md
@@ -0,0 +1,7 @@
+# Features
+
+A closer look at what Calagopus can do, organized by area of the panel.
+
+| Page | Description |
+| --- | --- |
+| [Dashboard](./dashboard/index.md) | The user-facing side of the panel: account, servers, API keys, and more |
diff --git a/web/docs/panel/index.md b/web/docs/panel/index.md
index a39fe32..fce7231 100644
--- a/web/docs/panel/index.md
+++ b/web/docs/panel/index.md
@@ -10,6 +10,7 @@ The Panel is the web interface and API that ties everything together: managing u
 | Page | Description |
 | --- | --- |
 | [Overview](./overview.md) | Requirements, architecture, and how the panel is built |
+| [Features](./features/index.md) | A tour of every panel feature: account, servers, API keys, and more |
 | [Installation](./installation/index.md) | Get the panel running via Docker, package manager, or binary |
 | [Environment](./environment.md) | Reference for every environment variable the panel reads |
 | [Updating the Panel](./updating.md) | Keep the panel up to date for your installation method |