diff --git a/resources/js/Components/Chat/ChatSidebar.vue b/resources/js/Components/Chat/ChatSidebar.vue
index aea190d..d867a50 100644
--- a/resources/js/Components/Chat/ChatSidebar.vue
+++ b/resources/js/Components/Chat/ChatSidebar.vue
@@ -205,15 +205,12 @@ onMounted(async () => {
 
 <template>
     <button
+        v-show="!isOpen"
         class="fixed bottom-6 right-6 z-[60] flex items-center justify-center w-12 h-12 rounded-full bg-indigo-600 hover:bg-indigo-500 shadow-lg text-white text-xl transition-transform hover:scale-105"
-        :class="isOpen ? 'scale-95' : ''"
         title="Toggle AI Chat"
         @click="toggleSidebar"
     >
-        <span v-if="!isOpen">&#x1F4AC;</span>
-        <svg v-else class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/>
-        </svg>
+        <span>&#x1F4AC;</span>
     </button>
 
     <div
diff --git a/resources/js/Components/Graph/KnowledgeGraphViewer.vue b/resources/js/Components/Graph/KnowledgeGraphViewer.vue
index b4098d9..599b98e 100644
--- a/resources/js/Components/Graph/KnowledgeGraphViewer.vue
+++ b/resources/js/Components/Graph/KnowledgeGraphViewer.vue
@@ -43,8 +43,14 @@ async function fetchGraph() {
         const url = props.contentId
             ? `/api/v1/graph/node/${props.contentId}`
             : `/api/v1/graph/space/${props.spaceId}`;
+        const xsrfToken = document.cookie.match(/XSRF-TOKEN=([^;]+)/)?.[1] ?? '';
         const res = await fetch(url, {
-            headers: { 'Accept': 'application/json', 'X-Requested-With': 'XMLHttpRequest' },
+            credentials: 'same-origin',
+            headers: {
+                'Accept': 'application/json',
+                'X-Requested-With': 'XMLHttpRequest',
+                'X-XSRF-TOKEN': xsrfToken,
+            },
         });
         if (!res.ok) throw new Error(`HTTP ${res.status}`);
         const data = await res.json();
diff --git a/resources/js/Components/Media/MediaUploadZone.vue b/resources/js/Components/Media/MediaUploadZone.vue
index 55c597a..6509afb 100644
--- a/resources/js/Components/Media/MediaUploadZone.vue
+++ b/resources/js/Components/Media/MediaUploadZone.vue
@@ -76,7 +76,7 @@ async function uploadFile(file) {
             resolve({ ok: false });
         });
 
-        xhr.open('POST', '/v1/media');
+        xhr.open('POST', '/api/media');
         xhr.setRequestHeader('Accept', 'application/json');
         xhr.setRequestHeader('X-XSRF-TOKEN', xsrfToken());
         xhr.withCredentials = true;
diff --git a/resources/js/Pages/Media/Index.vue b/resources/js/Pages/Media/Index.vue
index 0796e44..375f6a5 100644
--- a/resources/js/Pages/Media/Index.vue
+++ b/resources/js/Pages/Media/Index.vue
@@ -26,7 +26,7 @@ async function fetchAssets(page = 1) {
         if (filters.type)   params.set('type',   filters.type);
         if (filters.tag)    params.set('tag',     filters.tag);
         await csrfCookie();
-        const res = await fetch(`/api/v1/media?${params}`, {
+        const res = await fetch(`/api/media?${params}`, {
             credentials: 'include',
             headers: { 'Accept': 'application/json', 'X-XSRF-TOKEN': xsrfToken() },
         });
@@ -72,7 +72,7 @@ function closeDetail()      { activeAsset.value = null; }
 async function deleteAsset(asset) {
     if (!confirm(`Delete "${asset.filename}"? This cannot be undone.`)) return;
     await csrfCookie();
-    const res = await fetch(`/api/v1/media/${asset.id}`, {
+    const res = await fetch(`/api/media/${asset.id}`, {
         method: 'DELETE', credentials: 'include',
         headers: { 'Accept': 'application/json', 'X-XSRF-TOKEN': xsrfToken() },
     });
diff --git a/routes/web.php b/routes/web.php
index 81a30fe..8cd2e72 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -164,12 +164,26 @@
     // Knowledge Graph
     Route::get('/graph', [GraphController::class, 'index'])->name('graph.index');
 
-    // Plugins (Bug 2: was missing web route)
-    Route::get('/plugins', fn () => Inertia::render('Admin/Plugins/Index'))->name('admin.plugins');
+    // Plugins
+    Route::get('/plugins', function () {
+        $plugins = \App\Models\Plugin::withTrashed()->with('settings')->orderBy('display_name')->get();
+
+        return Inertia::render('Admin/Plugins/Index', [
+            'plugins' => \App\Http\Resources\PluginResource::collection($plugins)->resolve(),
+        ]);
+    })->name('admin.plugins');
 
     // Media (Bug 3: was missing web route)
     Route::get('/media', fn () => Inertia::render('Media/Index'))->name('admin.media');
 
-    // Locales / i18n settings (Bug 5: was missing web route)
-    Route::get('/settings/locales', fn () => Inertia::render('Settings/Locales'))->name('admin.settings.locales');
+    // Locales / i18n settings
+    Route::get('/settings/locales', function () {
+        $localeService = app(\App\Services\LocaleService::class);
+        $space = app()->bound('current_space') ? app('current_space') : \App\Models\Space::first();
+        $locales = $space ? $space->locales()->get() : collect();
+        $rawSupported = $localeService->getSupportedLocales();
+        $supported = collect($rawSupported)->map(fn ($label, $code) => ['code' => $code, 'label' => $label])->values();
+
+        return Inertia::render('Settings/Locales', ['locales' => $locales, 'supported' => $supported]);
+    })->name('admin.settings.locales');
 });