diff --git a/.bundler-audit.yml b/.bundler-audit.yml
index 67c1bf5a..e836d3dc 100644
--- a/.bundler-audit.yml
+++ b/.bundler-audit.yml
@@ -31,10 +31,12 @@ ignore:
   - CVE-2025-55193
   - GHSA-76r7-hhxj-r776
 
-  # activestorage (5.2.4.6) — fix: ~> 6.1.7.7, >= 7.0.8.1
+  # activestorage (5.2.4.6) — fix: ~> 6.1.7.7, >= 7.0.8.1; CVE-2026-33658 fix: ~> 7.2.3.1, ~> 8.0.4.1, >= 8.1.2.1
   - CVE-2022-21831
   - CVE-2024-26144
+  - CVE-2026-33658
   - GHSA-8h22-8cf7-hq6g
+  - GHSA-p9fm-f462-ggrg
 
   # activesupport (5.2.4.6) — fix: ~> 5.2.8, ~> 6.1.7.x, >= 7.0.x
   - CVE-2023-22796
@@ -44,10 +46,6 @@ ignore:
   - GHSA-pj73-v5mw-pm9j
   - GHSA-cr5q-6q9f-rq6q
 
-  # aws-sdk-s3 (1.114.0) — fix: >= 1.208.0
-  - CVE-2025-14762
-  - GHSA-2xgq-q749-89fq
-
   # carrierwave (1.3.2) — fix: ~> 2.2.6, >= 3.0.7
   - CVE-2023-49090
   - CVE-2024-29034
@@ -59,20 +57,10 @@ ignore:
   - GHSA-fcjw-8rhj-gwwc
   - GHSA-57hq-95w6-v4fc
 
-  # faraday (0.17.5) — fix: ~> 1.10.5, >= 2.14.1
+  # faraday (0.17.6) — fix: ~> 1.10.5, >= 2.14.1
   - CVE-2026-25765
   - GHSA-33mh-2634-fwr2
 
-  # globalid (1.0.0) — fix: >= 1.0.1
-  - CVE-2023-22799
-  - GHSA-23c2-gwp5-pxw9
-
-  # httparty (0.20.0) — fix: >= 0.24.0 (SSRF); >= 0.21.0 (multipart)
-  - CVE-2024-22049
-  - CVE-2025-68696
-  - GHSA-5pq7-52mg-hr42
-  - GHSA-hm5p-x4rq-38w4
-
   # jquery-ui-rails (6.0.1) — fix: >= 7.0.0 or >= 8.0.0 depending on CVE
   - CVE-2021-41182
   - CVE-2021-41183
@@ -83,13 +71,7 @@ ignore:
   - GHSA-gpqq-952q-5327
   - GHSA-h6gj-6jjq-h8g9
 
-  # loofah (2.18.0) — fix: >= 2.19.1
-  - CVE-2022-23514
-  - CVE-2022-23515
-  - CVE-2022-23516
-  - GHSA-228g-948r-83gx
-
-  # nokogiri (1.13.8) — fix: >= 1.14.3 through >= 1.19.1 depending on CVE
+  # nokogiri (1.15.7) — fix: >= 1.14.3 through >= 1.19.1 depending on CVE
   - CVE-2022-23476
   - GHSA-mrxw-mxhj-p664
   - GHSA-2qc6-mcvw-92cw
@@ -149,37 +131,7 @@ ignore:
   - GHSA-whrj-4476-wvmp
   - GHSA-mxw3-3hh2-x2mh
 
-  # rails-html-sanitizer (1.4.3) — fix: >= 1.4.4
-  - CVE-2022-23517
-  - CVE-2022-23518
-  - CVE-2022-23519
-  - CVE-2022-23520
-  - GHSA-mcvf-2q2m-x72m
-  - GHSA-rrfc-7g8p-99q8
-  - GHSA-9h9g-93gc-623h
-
-  # rexml (3.2.5) — fix: >= 3.3.6
-  - CVE-2024-35176
-  - CVE-2024-39908
-  - CVE-2024-41123
-  - CVE-2024-41946
-  - CVE-2024-43398
-  - CVE-2024-49761
-  - GHSA-vg3r-rm7w-2xgh
-  - GHSA-4xqq-m2hx-25v8
-  - GHSA-r55c-59qm-vjw6
-  - GHSA-5866-49gr-22v4
-  - GHSA-vmwr-mc7x-5vc3
-
   # sidekiq (6.5.5) — fix: ~> 6.5.10, >= 7.1.3
   - CVE-2023-26141
   - GHSA-3qc2-v3hp-6cv8
 
-  # thor (1.2.1) — fix: >= 1.4.0
-  - CVE-2025-54314
-  - GHSA-mqcp-p2hv-vw6x
-
-  # webrick (1.7.0) — fix: >= 1.8.2
-  - CVE-2024-47220
-  - CVE-2025-6442
-  - GHSA-r995-q44h-hr64
diff --git a/.gitignore b/.gitignore
index 0cc19672..61ad63fc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,3 +42,7 @@ dump.rdb
 
 # Compiled assets
 public/**
+
+# Node / Yarn (local state; regenerated by yarn install)
+.yarn/install-state.gz
+node_modules/
diff --git a/.yarnrc.yml b/.yarnrc.yml
new file mode 100644
index 00000000..3186f3f0
--- /dev/null
+++ b/.yarnrc.yml
@@ -0,0 +1 @@
+nodeLinker: node-modules
diff --git a/Gemfile.lock b/Gemfile.lock
index 95fa2593..1349da95 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -80,15 +80,15 @@ GEM
       rdf-vocab (< 3.1.5)
       rsolr (>= 1.1.2, < 3)
       ruby-progressbar (~> 1.0)
-    active-triples (1.1.1)
+    active-triples (1.2.0)
       activemodel (>= 3.0.0)
       activesupport (>= 3.0.0)
       rdf (>= 2.0.2, < 4.0)
       rdf-vocab (>= 2.0, < 4.0)
-    active_attr (0.15.4)
-      actionpack (>= 3.0.2, < 7.1)
-      activemodel (>= 3.0.2, < 7.1)
-      activesupport (>= 3.0.2, < 7.1)
+    active_attr (0.17.2)
+      actionpack (>= 3.0.2, < 8.2)
+      activemodel (>= 3.0.2, < 8.2)
+      activesupport (>= 3.0.2, < 8.2)
     active_encode (0.8.2)
       rails
       sprockets (< 4)
@@ -97,15 +97,15 @@ GEM
       globalid (>= 0.3.6)
     activemodel (5.2.4.6)
       activesupport (= 5.2.4.6)
-    activemodel-serializers-xml (1.0.2)
-      activemodel (> 5.x)
-      activesupport (> 5.x)
+    activemodel-serializers-xml (1.0.3)
+      activemodel (>= 5.0.0.a)
+      activesupport (>= 5.0.0.a)
       builder (~> 3.1)
     activerecord (5.2.4.6)
       activemodel (= 5.2.4.6)
       activesupport (= 5.2.4.6)
       arel (>= 9.0)
-    activerecord-import (1.4.0)
+    activerecord-import (2.2.0)
       activerecord (>= 4.2)
     activestorage (5.2.4.6)
       actionpack (= 5.2.4.6)
@@ -116,39 +116,41 @@ GEM
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    addressable (2.8.1)
-      public_suffix (>= 2.0.2, < 6.0)
-    airbrussh (1.4.1)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    airbrussh (1.6.1)
       sshkit (>= 1.6.1, != 1.7.0)
     almond-rails (0.3.0)
       rails (>= 4.2)
-    amazing_print (1.4.0)
     arel (9.0.0)
-    ast (2.4.2)
-    autoprefixer-rails (10.4.7.0)
+    ast (2.4.3)
+    autoprefixer-rails (10.4.21.0)
       execjs (~> 2)
-    awesome_nested_set (3.5.0)
-      activerecord (>= 4.0.0, < 7.1)
-    aws-eventstream (1.2.0)
-    aws-partitions (1.626.0)
-    aws-sdk-core (3.142.0)
-      aws-eventstream (~> 1, >= 1.0.2)
-      aws-partitions (~> 1, >= 1.525.0)
-      aws-sigv4 (~> 1.1)
+    awesome_nested_set (3.9.0)
+      activerecord (>= 4.0.0, < 8.2)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1245.0)
+    aws-sdk-core (3.246.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.58.0)
-      aws-sdk-core (~> 3, >= 3.127.0)
-      aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.114.0)
-      aws-sdk-core (~> 3, >= 3.127.0)
+      logger
+    aws-sdk-kms (1.124.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.221.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
       aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.4)
+      aws-sigv4 (~> 1.5)
     aws-sdk-xray (1.4.0)
       aws-sdk-core (~> 3)
       aws-sigv4 (~> 1.0)
-    aws-sigv4 (1.5.1)
+    aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
-    aws-xray-sdk (0.13.0)
+    aws-xray-sdk (0.16.0)
       aws-sdk-xray (~> 1.4.0)
       multi_json (~> 1)
     axiom-types (0.1.1)
@@ -159,13 +161,15 @@ GEM
     babel-transpiler (0.7.0)
       babel-source (>= 4.0, < 6)
       execjs (~> 2.0)
-    bagit (0.4.4)
+    bagit (0.7.0)
       docopt (~> 0.5.0)
+      logger (~> 1.7)
       validatable (~> 1.6)
+    base64 (0.3.0)
     bcp47 (0.3.3)
       i18n
-    bcrypt (3.1.18)
-    bcrypt_pbkdf (1.1.1)
+    bcrypt (3.1.22)
+    bcrypt_pbkdf (1.1.2)
     bigdecimal (1.3.5)
     bindex (0.8.1)
     bixby (5.0.2)
@@ -213,8 +217,8 @@ GEM
       signet (~> 0.8)
       sprockets (~> 3.7)
       typhoeus
-    builder (3.2.4)
-    bulkrax (4.3.0)
+    builder (3.3.0)
+    bulkrax (4.3.1)
       bagit (~> 0.4)
       coderay
       iso8601 (~> 0.9.0)
@@ -228,19 +232,19 @@ GEM
       rdf (>= 2.0.2, < 4.0)
       rubyzip
       simple_form
-    bundler-audit (0.9.1)
-      bundler (>= 1.2.0, < 3)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
       thor (~> 1.0)
     byebug (11.1.3)
     cancancan (1.17.0)
-    capistrano (3.17.1)
+    capistrano (3.20.0)
       airbrussh (>= 1.0.0)
       i18n
       rake (>= 10.0.0)
       sshkit (>= 1.9.0)
     capistrano-bundler (1.6.0)
       capistrano (~> 3.1)
-    capistrano-rails (1.6.2)
+    capistrano-rails (1.7.0)
       capistrano (~> 3.1)
       capistrano-bundler (>= 1.1, < 3)
     capistrano-rvm (0.1.2)
@@ -263,7 +267,7 @@ GEM
       ssrf_filter (~> 1.0)
     childprocess (0.9.0)
       ffi (~> 1.0, >= 1.0.11)
-    clamby (1.6.8)
+    clamby (1.6.11)
     clipboard-rails (1.7.1)
     coderay (1.1.3)
     coercible (1.0.0)
@@ -275,22 +279,25 @@ GEM
       coffee-script-source
       execjs
     coffee-script-source (1.12.2)
-    concurrent-ruby (1.1.10)
+    concurrent-ruby (1.3.6)
     connection_pool (2.5.5)
-    coveralls_reborn (0.28.0)
+    coveralls_reborn (0.29.0)
       simplecov (~> 0.22.0)
       term-ansicolor (~> 1.7)
       thor (~> 1.2)
       tins (~> 1.32)
-    crack (0.4.5)
+    crack (1.0.1)
+      bigdecimal
       rexml
     crass (1.0.6)
-    database_cleaner (2.0.1)
-      database_cleaner-active_record (~> 2.0.0)
-    database_cleaner-active_record (2.0.1)
+    csv (3.3.5)
+    database_cleaner (2.1.0)
+      database_cleaner-active_record (>= 2, < 3)
+    database_cleaner-active_record (2.2.2)
       activerecord (>= 5.a)
-      database_cleaner-core (~> 2.0.0)
+      database_cleaner-core (~> 2.0)
     database_cleaner-core (2.0.1)
+    date (3.5.1)
     declarative (0.0.20)
     deprecation (1.1.0)
       activesupport
@@ -302,18 +309,17 @@ GEM
       railties (>= 4.1.0, < 6.0)
       responders
       warden (~> 1.2.3)
-    devise-guests (0.8.1)
+    devise-guests (0.8.3)
       devise
-    diff-lcs (1.5.0)
-    docile (1.4.0)
+    diff-lcs (1.6.2)
+    docile (1.4.1)
     docopt (0.5.0)
-    domain_name (0.5.20190701)
-      unf (>= 0.0.5, < 1.0.0)
+    domain_name (0.6.20240107)
     dotenv (2.8.1)
     dotenv-rails (2.8.1)
       dotenv (= 2.8.1)
       railties (>= 3.2)
-    draper (4.0.2)
+    draper (4.0.6)
       actionpack (>= 5.0)
       activemodel (>= 5.0)
       activemodel-serializers-xml (>= 1.0)
@@ -323,77 +329,80 @@ GEM
     dropbox_api (0.1.21)
       faraday (< 3.0)
       oauth2 (~> 1.1)
-    dry-configurable (0.15.0)
-      concurrent-ruby (~> 1.0)
-      dry-core (~> 0.6)
-    dry-container (0.10.1)
-      concurrent-ruby (~> 1.0)
-    dry-core (0.8.1)
+    dry-configurable (1.0.1)
+      dry-core (~> 1.0, < 2)
+      zeitwerk (~> 2.6)
+    dry-core (1.0.0)
       concurrent-ruby (~> 1.0)
+      zeitwerk (~> 2.6)
     dry-equalizer (0.3.0)
-    dry-events (0.3.0)
+    dry-events (1.0.1)
       concurrent-ruby (~> 1.0)
-      dry-core (~> 0.5, >= 0.5)
-    dry-inflector (0.3.0)
+      dry-core (~> 1.0, < 2)
+    dry-inflector (1.1.0)
     dry-initializer (3.1.1)
-    dry-logic (1.2.0)
+    dry-logic (1.5.0)
       concurrent-ruby (~> 1.0)
-      dry-core (~> 0.5, >= 0.5)
-    dry-matcher (0.9.0)
-      dry-core (~> 0.4, >= 0.4.8)
-    dry-monads (1.4.0)
+      dry-core (~> 1.0, < 2)
+      zeitwerk (~> 2.6)
+    dry-matcher (0.10.0)
+      dry-core (~> 1.0)
+    dry-monads (1.6.0)
       concurrent-ruby (~> 1.0)
-      dry-core (~> 0.7)
-    dry-schema (1.10.2)
+      dry-core (~> 1.0, < 2)
+      zeitwerk (~> 2.6)
+    dry-schema (1.13.4)
       concurrent-ruby (~> 1.0)
-      dry-configurable (~> 0.13, >= 0.13.0)
-      dry-core (~> 0.5, >= 0.5)
+      dry-configurable (~> 1.0, >= 1.0.1)
+      dry-core (~> 1.0, < 2)
       dry-initializer (~> 3.0)
-      dry-logic (~> 1.0)
-      dry-types (~> 1.5)
-    dry-struct (1.4.0)
-      dry-core (~> 0.5, >= 0.5)
-      dry-types (~> 1.5)
+      dry-logic (>= 1.4, < 2)
+      dry-types (>= 1.7, < 2)
+      zeitwerk (~> 2.6)
+    dry-struct (1.6.0)
+      dry-core (~> 1.0, < 2)
+      dry-types (>= 1.7, < 2)
       ice_nine (~> 0.11)
-    dry-transaction (0.13.3)
-      dry-container (>= 0.2.8)
-      dry-events (>= 0.1.0)
-      dry-matcher (>= 0.7.0)
-      dry-monads (>= 0.4.0)
-    dry-types (1.5.1)
+      zeitwerk (~> 2.6)
+    dry-transaction (0.15.0)
+      dry-core (~> 1.0)
+      dry-events (~> 1.0)
+      dry-matcher (~> 0.10)
+      dry-monads (~> 1.6)
+    dry-types (1.7.1)
       concurrent-ruby (~> 1.0)
-      dry-container (~> 0.3)
-      dry-core (~> 0.5, >= 0.5)
-      dry-inflector (~> 0.1, >= 0.1.2)
-      dry-logic (~> 1.0, >= 1.0.2)
-    dry-validation (1.8.1)
+      dry-core (~> 1.0)
+      dry-inflector (~> 1.0)
+      dry-logic (~> 1.4)
+      zeitwerk (~> 2.6)
+    dry-validation (1.10.0)
       concurrent-ruby (~> 1.0)
-      dry-container (~> 0.7, >= 0.7.1)
-      dry-core (~> 0.5, >= 0.5)
+      dry-core (~> 1.0, < 2)
       dry-initializer (~> 3.0)
-      dry-schema (~> 1.8, >= 1.8.0)
-    ebnf (2.3.1)
-      amazing_print (~> 1.4)
+      dry-schema (>= 1.12, < 2)
+      zeitwerk (~> 2.6)
+    ebnf (2.3.5)
       htmlentities (~> 4.3)
       rdf (~> 3.2)
       scanf (~> 1.0)
       sxp (~> 1.2)
-      unicode-types (~> 1.7)
+      unicode-types (~> 1.8)
     ed25519 (1.3.0)
-    email_validator (2.2.3)
+    email_validator (2.2.4)
       activemodel
     equivalent-xml (0.6.0)
       nokogiri (>= 1.4.3)
-    erubi (1.11.0)
-    ethon (0.15.0)
+    erubi (1.13.1)
+    ethon (0.18.0)
       ffi (>= 1.15.0)
-    execjs (2.8.1)
+      logger
+    execjs (2.10.1)
     factory_bot (4.11.1)
       activesupport (>= 3.0.0)
     factory_bot_rails (4.11.1)
       factory_bot (~> 4.11.1)
       railties (>= 3.0.0)
-    faraday (0.17.5)
+    faraday (0.17.6)
       multipart-post (>= 1.2, < 3)
     faraday-encoding (0.0.4)
       faraday
@@ -401,27 +410,29 @@ GEM
       faraday (>= 0.7.4, < 1.0)
     fcrepo_wrapper (0.9.0)
       ruby-progressbar
-    ffi (1.15.5)
-    ffi-compiler (1.0.1)
-      ffi (>= 1.0.0)
+    ffi (1.17.4)
+    ffi-compiler (1.4.2)
+      ffi (>= 1.15.5)
       rake
-    figaro (1.2.0)
+    figaro (1.3.0)
       thor (>= 0.14.0, < 2)
-    flipflop (2.7.0)
+    flipflop (2.8.0)
       activesupport (>= 4.0)
       terminal-table (>= 1.8)
     flot-rails (0.0.7)
       jquery-rails
-    font-awesome-rails (4.7.0.8)
-      railties (>= 3.2, < 8.0)
+    font-awesome-rails (4.7.0.9)
+      railties (>= 3.2, < 9.0)
     gems (1.2.0)
-    geocoder (1.8.0)
-    globalid (1.0.0)
+    geocoder (1.8.6)
+      base64 (>= 0.1.0)
+      csv (>= 3.0.0)
+    globalid (1.1.0)
       activesupport (>= 5.0)
     google-api-client (0.53.0)
       google-apis-core (~> 0.1)
       google-apis-generator (~> 0.1)
-    google-apis-core (0.7.0)
+    google-apis-core (0.11.3)
       addressable (~> 2.5, >= 2.5.1)
       googleauth (>= 0.16.2, < 2.a)
       httpclient (>= 2.8.1, < 3.a)
@@ -429,19 +440,18 @@ GEM
       representable (~> 3.0)
       retriable (>= 2.0, < 4.a)
       rexml
-      webrick
-    google-apis-discovery_v1 (0.11.0)
-      google-apis-core (>= 0.7, < 2.a)
-    google-apis-drive_v3 (0.27.0)
-      google-apis-core (>= 0.7, < 2.a)
-    google-apis-generator (0.9.0)
+    google-apis-discovery_v1 (0.14.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-drive_v3 (0.46.0)
+      google-apis-core (>= 0.11.0, < 2.a)
+    google-apis-generator (0.12.0)
       activesupport (>= 5.0)
       gems (~> 1.2)
-      google-apis-core (>= 0.7, < 2.a)
+      google-apis-core (>= 0.11.0, < 2.a)
       google-apis-discovery_v1 (~> 0.5)
       thor (>= 0.20, < 2.a)
-    google-apis-sheets_v4 (0.17.0)
-      google-apis-core (>= 0.7, < 2.a)
+    google-apis-sheets_v4 (0.26.0)
+      google-apis-core (>= 0.11.0, < 2.a)
     google_drive (3.0.7)
       google-apis-drive_v3 (>= 0.5.0, < 1.0.0)
       google-apis-sheets_v4 (>= 0.4.0, < 1.0.0)
@@ -454,8 +464,8 @@ GEM
       multi_json (~> 1.11)
       os (>= 0.9, < 2.0)
       signet (~> 0.15)
-    grape (1.6.2)
-      activesupport
+    grape (2.0.0)
+      activesupport (>= 5)
       builder
       dry-types (>= 1.1)
       mustermann-grape (~> 1.0.0)
@@ -466,23 +476,26 @@ GEM
     haml (5.2.2)
       temple (>= 0.8.0)
       tilt
-    hashdiff (1.0.1)
-    hashie (5.0.0)
+    hashdiff (1.2.1)
+    hashie (5.1.0)
+      logger
     hiredis (0.6.3)
-    htmlentities (4.3.4)
-    http (5.1.0)
+    htmlentities (4.4.2)
+    http (5.3.1)
       addressable (~> 2.8)
       http-cookie (~> 1.0)
       http-form_data (~> 2.2)
-      llhttp-ffi (~> 0.4.0)
-    http-cookie (1.0.5)
+      llhttp-ffi (~> 0.5.0)
+    http-cookie (1.1.6)
       domain_name (~> 0.5)
     http-form_data (2.3.0)
-    http_logger (0.7.0)
-    httparty (0.20.0)
-      mime-types (~> 3.0)
+    http_logger (1.0.2)
+    httparty (0.24.2)
+      csv
+      mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    httpclient (2.8.3)
+    httpclient (2.9.0)
+      mutex_m
     hydra-access-controls (11.0.7)
       active-fedora (>= 10.0.0)
       activesupport (>= 4, < 6)
@@ -510,21 +523,23 @@ GEM
       simple_form (>= 4.1.0, < 6.0)
       sprockets (~> 3.7)
       sprockets-es6
-    hydra-file_characterization (1.1.2)
+    hydra-file_characterization (1.2.0)
       activesupport (>= 3.0.0)
     hydra-head (11.0.7)
       hydra-access-controls (= 11.0.7)
       hydra-core (= 11.0.7)
       rails (>= 5.2, < 6.1)
-    hydra-pcdm (1.1.0)
-      active-fedora (>= 10, < 14)
+    hydra-pcdm (1.4.0)
+      active-fedora (>= 10)
       mime-types (>= 1)
-    hydra-role-management (1.0.3)
-      blacklight
+      rdf-vocab
+    hydra-role-management (1.2.0)
+      blacklight (< 8)
       bootstrap_form
       bundler (>= 1.5)
       cancancan
       json (>= 1.8)
+      psych (~> 3.0)
     hydra-works (1.2.0)
       activesupport (>= 4.2.10, < 6.0)
       hydra-derivatives (~> 3.0)
@@ -581,44 +596,45 @@ GEM
       signet
       solrizer (>= 3.4, < 5)
       tinymce-rails (~> 4.1)
-    i18n (1.12.0)
+    i18n (1.14.8)
       concurrent-ruby (~> 1.0)
     ice_nine (0.11.2)
-    iiif-image-api (0.2.0)
+    iiif-image-api (0.3.0)
       activesupport
     iiif_manifest (0.5.0)
       activesupport (>= 4)
     iso8601 (0.9.1)
-    jbuilder (2.11.5)
+    jbuilder (2.13.0)
       actionview (>= 5.0.0)
       activesupport (>= 5.0.0)
-    jmespath (1.6.1)
+    jmespath (1.6.2)
     jquery-datatables-rails (3.4.0)
       actionpack (>= 3.1)
       jquery-rails
       railties (>= 3.1)
       sass-rails
-    jquery-rails (4.5.0)
+    jquery-rails (4.6.1)
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
     jquery-ui-rails (6.0.1)
       railties (>= 3.2.16)
-    json (2.6.2)
-    json-canonicalization (0.3.0)
-    json-ld (3.2.3)
+    json (2.19.5)
+    json-canonicalization (0.4.0)
+    json-ld (3.2.5)
       htmlentities (~> 4.3)
-      json-canonicalization (~> 0.3)
+      json-canonicalization (~> 0.3, >= 0.3.2)
       link_header (~> 0.0, >= 0.0.8)
       multi_json (~> 1.15)
-      rack (~> 2.2)
-      rdf (~> 3.2, >= 3.2.9)
-    json-ld-preloaded (3.2.0)
+      rack (>= 2.2, < 4)
+      rdf (~> 3.2, >= 3.2.10)
+    json-ld-preloaded (3.2.2)
       json-ld (~> 3.2)
       rdf (~> 3.2)
-    json-schema (3.0.0)
-      addressable (>= 2.8)
-    jwt (2.5.0)
+    json-schema (5.1.0)
+      addressable (~> 2.8)
+    jwt (2.10.2)
+      base64
     kaltura (0.1.1)
       hashie (>= 1.0.0)
       httparty (>= 0.7.8)
@@ -637,8 +653,8 @@ GEM
     kaminari_route_prefix (0.1.1)
       kaminari (~> 1.0)
     language_list (1.2.1)
-    ld-patch (3.2.0)
-      ebnf (~> 2.2)
+    ld-patch (3.2.2)
+      ebnf (~> 2.3)
       rdf (~> 3.2)
       rdf-xsd (~> 3.2)
       sparql (~> 3.2)
@@ -691,15 +707,19 @@ GEM
     listen (3.0.8)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
-    llhttp-ffi (0.4.0)
+    llhttp-ffi (0.5.1)
       ffi-compiler (~> 1.0)
       rake (~> 13.0)
-    logger (1.5.1)
-    loofah (2.18.0)
+    logger (1.7.0)
+    loofah (2.25.1)
       crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
-    mail (2.7.1)
+      nokogiri (>= 1.12.0)
+    mail (2.9.0)
+      logger
       mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
     mailboxer (0.15.1)
       carrierwave (>= 0.5.8)
       rails (>= 5.0.0)
@@ -707,43 +727,56 @@ GEM
       activesupport
     marcel (0.3.3)
       mimemagic (~> 0.3.2)
-    matrix (0.4.2)
+    matrix (0.4.3)
     memoist (0.16.2)
-    method_source (1.0.0)
-    mime-types (3.4.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2022.0105)
+    method_source (1.1.0)
+    mime-types (3.7.0)
+      logger
+      mime-types-data (~> 3.2025, >= 3.2025.0507)
+    mime-types-data (3.2026.0414)
     mimemagic (0.3.10)
       nokogiri (~> 1)
       rake
-    mini_magick (4.11.0)
-    mini_mime (1.1.2)
-    mini_portile2 (2.8.0)
-    minitar (0.9)
-    minitest (5.16.3)
+    mini_magick (4.13.2)
+    mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
+    minitar (0.12.1)
+    minitest (5.26.1)
     multi_json (1.15.0)
     multi_xml (0.6.0)
-    multipart-post (2.2.3)
-    mustermann (3.0.0)
-      ruby2_keywords (~> 0.0.1)
+    multipart-post (2.4.1)
+    mustermann (3.1.1)
     mustermann-grape (1.0.2)
       mustermann (>= 1.0.0)
-    mysql2 (0.5.6)
+    mutex_m (0.3.0)
+    mysql2 (0.5.7)
+      bigdecimal
     nest (3.2.0)
       redic
-    net-http-persistent (4.0.1)
-      connection_pool (~> 2.2)
-    net-scp (1.2.1)
-      net-ssh (>= 2.6.5)
-    net-ssh (7.3.0)
+    net-http-persistent (4.0.8)
+      connection_pool (>= 2.2.4, < 4)
+    net-imap (0.4.24)
+      date
+      net-protocol
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.2.2)
+      timeout
+    net-scp (4.1.0)
+      net-ssh (>= 2.6.5, < 8.0.0)
+    net-sftp (4.0.0)
+      net-ssh (>= 5.0.0, < 8.0.0)
+    net-smtp (0.5.1)
+      net-protocol
+    net-ssh (7.3.2)
     netrc (0.11.0)
     nio4r (2.7.5)
     noid (0.9.0)
     noid-rails (3.0.3)
       actionpack (>= 5.0.0, < 7)
       noid (~> 0.9)
-    nokogiri (1.13.8)
-      mini_portile2 (~> 2.8.0)
+    nokogiri (1.15.7)
+      mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     nokogumbo (2.0.5)
       nokogiri (~> 1.8, >= 1.8.4)
@@ -751,28 +784,31 @@ GEM
       builder (>= 3.1.0)
       faraday
       faraday_middleware
-    oauth (1.1.0)
-      oauth-tty (~> 1.0, >= 1.0.1)
+    oauth (1.1.3)
+      base64 (~> 0.1)
+      oauth-tty (~> 1.0, >= 1.0.6)
       snaky_hash (~> 2.0)
-      version_gem (~> 1.1)
-    oauth-tty (1.0.5)
-      version_gem (~> 1.1, >= 1.1.1)
-    oauth2 (1.4.10)
+      version_gem (~> 1.1, >= 1.1.9)
+    oauth-tty (1.0.6)
+      version_gem (~> 1.1, >= 1.1.9)
+    oauth2 (1.4.11)
       faraday (>= 0.17.3, < 3.0)
       jwt (>= 1.0, < 3.0)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-    okcomputer (1.18.5)
+      rack (>= 1.2, < 4)
+    okcomputer (1.18.6)
     omniauth (1.9.2)
       hashie (>= 3.4.6)
       rack (>= 1.6.2, < 3)
     omniauth-oauth2 (1.3.1)
       oauth2 (~> 1.0)
       omniauth (~> 1.2)
-    omniauth-openid (2.0.1)
-      omniauth (>= 1.0, < 3.0)
-      rack-openid (~> 1.4.0)
+    omniauth-openid (2.0.2)
+      omniauth (>= 1.1)
+      rack-openid (~> 1.4)
+      ruby-openid (~> 2.1, >= 2.1.8)
+      version_gem (~> 1.1, >= 1.1.8)
     omniauth-orcid (0.6)
       omniauth (~> 1.0)
       omniauth-oauth2 (~> 1.1)
@@ -782,33 +818,37 @@ GEM
       rails (> 3.2.0)
     orm_adapter (0.5.0)
     os (1.1.4)
-    parallel (1.22.1)
-    parser (3.1.2.1)
+    ostruct (0.6.3)
+    parallel (1.28.0)
+    parser (3.3.11.1)
       ast (~> 2.4.1)
+      racc
     parslet (2.0.0)
     posix-spawn (0.3.15)
     power_converter (0.1.2)
-    public_suffix (5.0.0)
+    prism (1.9.0)
+    psych (3.3.4)
+    public_suffix (5.1.1)
     pul_uv_rails (2.0.1)
     puma (4.3.12)
       nio4r (~> 2.0)
-    qa (5.9.0)
+    qa (5.15.0)
       activerecord-import
       deprecation
       faraday (< 3.0, != 2.0.0)
       geocoder
       ldpath
       nokogiri (~> 1.6)
-      rails (>= 5.0, < 6.2)
+      rails (>= 5.0, < 8.1)
       rdf
-    racc (1.6.0)
+    racc (1.8.1)
     rack (2.2.3)
     rack-accept (0.4.5)
       rack (>= 0.4)
     rack-openid (1.4.2)
       rack (>= 1.1.0)
       ruby-openid (>= 2.1.8)
-    rack-test (2.0.2)
+    rack-test (2.2.0)
       rack (>= 1.3)
     rails (5.2.4.6)
       actioncable (= 5.2.4.6)
@@ -827,13 +867,17 @@ GEM
       actionpack (>= 5.0.1.rc1)
       actionview (>= 5.0.1.rc1)
       activesupport (>= 5.0.1.rc1)
-    rails-dom-testing (2.0.3)
-      activesupport (>= 4.2.0)
+    rails-dom-testing (2.3.0)
+      activesupport (>= 5.0.0)
+      minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.4.3)
-      loofah (~> 2.3)
-    rails_autolink (1.1.6)
-      rails (> 3.1)
+    rails-html-sanitizer (1.7.0)
+      loofah (~> 2.25)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    rails_autolink (1.1.8)
+      actionview (> 3.1)
+      activesupport (> 3.1)
+      railties (> 3.1)
     railties (5.2.4.6)
       actionpack (= 5.2.4.6)
       activesupport (= 5.2.4.6)
@@ -841,11 +885,11 @@ GEM
       rake (>= 0.8.7)
       thor (>= 0.19.0, < 2.0)
     rainbow (3.1.1)
-    rake (13.0.6)
+    rake (13.4.2)
     rb-fsevent (0.11.2)
-    rb-inotify (0.10.1)
+    rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rdf (3.2.9)
+    rdf (3.2.12)
       link_header (~> 0.0, >= 0.0.8)
     rdf-aggregate-repo (3.2.1)
       rdf (~> 3.2)
@@ -863,7 +907,7 @@ GEM
       rdf (~> 3.2)
       sparql (~> 3.2)
       sxp (~> 1.2)
-    rdf-normalize (0.5.0)
+    rdf-normalize (0.6.1)
       rdf (~> 3.2)
     rdf-rdfa (3.1.0)
       haml (~> 5.1)
@@ -871,11 +915,11 @@ GEM
       rdf (~> 3.1)
       rdf-aggregate-repo (~> 3.1)
       rdf-xsd (~> 3.1)
-    rdf-rdfxml (3.1.1)
+    rdf-rdfxml (3.2.2)
+      builder (~> 3.2)
       htmlentities (~> 4.3)
-      rdf (~> 3.1)
-      rdf-rdfa (~> 3.1)
-      rdf-xsd (~> 3.1)
+      rdf (~> 3.2)
+      rdf-xsd (~> 3.2)
     rdf-reasoner (0.8.0)
       rdf (~> 3.2)
       rdf-xsd (~> 3.2)
@@ -907,48 +951,49 @@ GEM
       redis-client (>= 0.22.0)
     redis-client (0.28.0)
       connection_pool
-    redis-namespace (1.9.0)
+    redis-namespace (1.11.0)
       redis (>= 4)
-    redlock (1.3.0)
-      redis (>= 3.0.0, < 6.0)
-    regexp_parser (2.5.0)
+    redlock (2.1.0)
+      redis-client (>= 0.14.1, < 1.0.0)
+    regexp_parser (2.12.0)
     representable (3.2.0)
       declarative (< 0.1.0)
       trailblazer-option (>= 0.1.1, < 0.2.0)
       uber (< 0.2.0)
-    request_store (1.5.1)
+    request_store (1.7.0)
       rack (>= 1.4)
-    responders (3.0.1)
-      actionpack (>= 5.0)
-      railties (>= 5.0)
+    responders (3.1.1)
+      actionpack (>= 5.2)
+      railties (>= 5.2)
     rest-client (2.0.2)
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
-    retriable (3.1.2)
-    rexml (3.2.5)
-    riiif (2.4.0)
+    retriable (3.4.1)
+    rexml (3.4.4)
+    riiif (2.8.1)
       deprecation (>= 1.0.0)
       iiif-image-api (>= 0.1.0)
-      railties (>= 4.2, < 8)
-    rsolr (2.5.0)
+      railties (>= 4.2, < 9)
+      ruby-vips
+    rsolr (2.6.0)
       builder (>= 2.1.2)
       faraday (>= 0.9, < 3, != 2.0.0)
-    rspec-activemodel-mocks (1.1.0)
+    rspec-activemodel-mocks (1.3.0)
       activemodel (>= 3.0)
       activesupport (>= 3.0)
       rspec-mocks (>= 2.99, < 4.0)
-    rspec-core (3.11.0)
-      rspec-support (~> 3.11.0)
-    rspec-expectations (3.11.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.11.0)
-    rspec-its (1.3.0)
+      rspec-support (~> 3.13.0)
+    rspec-its (1.3.1)
       rspec-core (>= 3.0.0)
       rspec-expectations (>= 3.0.0)
-    rspec-mocks (3.11.1)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.11.0)
+      rspec-support (~> 3.13.0)
     rspec-rails (5.1.2)
       actionpack (>= 5.2)
       activesupport (>= 5.2)
@@ -959,8 +1004,8 @@ GEM
       rspec-support (~> 3.10)
     rspec-retry (0.6.2)
       rspec-core (> 3.3)
-    rspec-support (3.11.0)
-    rspec_junit_formatter (0.5.1)
+    rspec-support (3.13.7)
+    rspec_junit_formatter (0.6.0)
       rspec-core (>= 2, < 4, != 2.12.0)
     rubocop (1.28.2)
       parallel (~> 1.10)
@@ -971,9 +1016,10 @@ GEM
       rubocop-ast (>= 1.17.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.21.0)
-      parser (>= 3.1.1.0)
-    rubocop-performance (1.14.3)
+    rubocop-ast (1.49.1)
+      parser (>= 3.3.7.2)
+      prism (~> 1.7)
+    rubocop-performance (1.19.1)
       rubocop (>= 1.7.0, < 2.0)
       rubocop-ast (>= 0.4.0)
     rubocop-rails (2.15.2)
@@ -988,7 +1034,10 @@ GEM
       multipart-post
       oauth2
     ruby-openid (2.9.2)
-    ruby-progressbar (1.11.0)
+    ruby-progressbar (1.13.0)
+    ruby-vips (2.3.0)
+      ffi (~> 1.12)
+      logger
     ruby2_keywords (0.0.5)
     rubyzip (1.3.0)
     samvera-nesting_indexer (2.0.0)
@@ -1036,25 +1085,25 @@ GEM
       redis (>= 4.5.0)
     sidekiq-limit_fetch (4.4.1)
       sidekiq (>= 6)
-    signet (0.17.0)
+    signet (0.19.0)
       addressable (~> 2.8)
       faraday (>= 0.17.5, < 3.a)
       jwt (>= 1.5, < 3.0)
       multi_json (~> 1.10)
-    simple_form (5.1.0)
+    simple_form (5.3.1)
       actionpack (>= 5.2)
       activemodel (>= 5.2)
     simplecov (0.22.0)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
-    simplecov-html (0.12.3)
-    simplecov-lcov (0.8.0)
+    simplecov-html (0.13.2)
+    simplecov-lcov (0.9.0)
     simplecov_json_formatter (0.1.4)
-    slop (4.9.2)
-    snaky_hash (2.0.1)
-      hashie
-      version_gem (~> 1.1, >= 1.1.1)
+    slop (4.10.1)
+    snaky_hash (2.0.3)
+      hashie (>= 0.1.0, < 6)
+      version_gem (>= 1.1.8, < 3)
     solr_wrapper (4.0.2)
       http
       minitar
@@ -1064,19 +1113,20 @@ GEM
       activesupport
       nokogiri
       xml-simple
-    sparql (3.2.4)
-      builder (~> 3.2)
-      ebnf (~> 2.2, >= 2.3.1)
+    sparql (3.2.6)
+      builder (~> 3.2, >= 3.2.4)
+      ebnf (~> 2.3, >= 2.3.5)
       logger (~> 1.5)
-      rdf (~> 3.2, >= 3.2.8)
-      rdf-aggregate-repo (~> 3.2)
+      rdf (~> 3.2, >= 3.2.11)
+      rdf-aggregate-repo (~> 3.2, >= 3.2.1)
       rdf-xsd (~> 3.2)
-      sparql-client (~> 3.2, >= 3.2.1)
-      sxp (~> 1.2, >= 1.2.2)
-    sparql-client (3.2.1)
-      net-http-persistent (~> 4.0, >= 4.0.1)
-      rdf (~> 3.2, >= 3.2.6)
-    sprockets (3.7.2)
+      sparql-client (~> 3.2, >= 3.2.2)
+      sxp (~> 1.2, >= 1.2.4)
+    sparql-client (3.2.2)
+      net-http-persistent (~> 4.0, >= 4.0.2)
+      rdf (~> 3.2, >= 3.2.11)
+    sprockets (3.7.5)
+      base64
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
     sprockets-es6 (0.9.2)
@@ -1088,25 +1138,31 @@ GEM
       activesupport (>= 5.2)
       sprockets (>= 3.0.0)
     sqlite3 (1.3.13)
-    sshkit (1.21.3)
+    sshkit (1.25.0)
+      base64
+      logger
       net-scp (>= 1.1.2)
+      net-sftp (>= 2.1.2)
       net-ssh (>= 2.8.0)
-    ssrf_filter (1.1.1)
-    sxp (1.2.2)
-      matrix
+      ostruct
+    ssrf_filter (1.5.0)
+    sxp (1.2.4)
+      matrix (~> 0.4)
       rdf (~> 3.2)
     sync (0.5.0)
-    temple (0.8.2)
-    term-ansicolor (1.7.1)
-      tins (~> 1.0)
-    terminal-table (3.0.2)
-      unicode-display_width (>= 1.1.1, < 3)
-    thor (1.2.1)
+    temple (0.10.4)
+    term-ansicolor (1.11.3)
+      tins (~> 1)
+    terminal-table (4.0.0)
+      unicode-display_width (>= 1.1.1, < 4)
+    thor (1.5.0)
     thread_safe (0.3.6)
-    tilt (2.0.11)
-    tins (1.32.1)
+    tilt (2.7.0)
+    timeout (0.6.1)
+    tins (1.43.0)
+      bigdecimal
       sync
-    tinymce-rails (4.9.11)
+    tinymce-rails (4.9.11.1)
       railties (>= 3.1.1)
     trailblazer-option (0.1.2)
     turbolinks (5.2.1)
@@ -1116,21 +1172,18 @@ GEM
       actionpack (>= 3.1)
       jquery-rails
       railties (>= 3.1)
-    typhoeus (1.4.0)
-      ethon (>= 0.9.0)
-    tzinfo (1.2.10)
+    typhoeus (1.6.0)
+      ethon (>= 0.18.0)
+    tzinfo (1.2.11)
       thread_safe (~> 0.1)
     uber (0.1.0)
-    uglifier (4.2.0)
+    uglifier (4.2.1)
       execjs (>= 0.3.0, < 3)
-    unf (0.1.4)
-      unf_ext
-    unf_ext (0.0.8.2)
-    unicode-display_width (2.2.0)
-    unicode-types (1.7.0)
+    unicode-display_width (2.6.0)
+    unicode-types (1.11.0)
     validatable (1.6.7)
-    vcr (6.1.0)
-    version_gem (1.1.3)
+    vcr (6.4.0)
+    version_gem (1.1.9)
     virtus (2.0.0)
       axiom-types (~> 0.1)
       coercible (~> 1.0)
@@ -1146,18 +1199,19 @@ GEM
       nokogiri (~> 1.6)
       rubyzip (~> 1.0)
       selenium-webdriver (~> 3.0)
-    webmock (3.18.1)
+    webmock (3.26.2)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    webrick (1.7.0)
-    websocket-driver (0.7.5)
+    websocket-driver (0.8.0)
+      base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     xml-simple (1.1.9)
       rexml
     xpath (3.2.0)
       nokogiri (~> 1.8)
+    zeitwerk (2.6.18)
 
 PLATFORMS
   ruby
diff --git a/README.md b/README.md
index eb431066..e4890825 100644
--- a/README.md
+++ b/README.md
@@ -14,14 +14,15 @@
 * Fedora Commons 4.5.1+
 * MySQL 8.0+
 * Redis
-* ImageMagick
+* Node.js 20+ (with Corepack enabled for Yarn 4)
+* ImageMagick 6 (`imagemagick@6`; provides `convert`, `identify`, `mogrify`)
 * Java 8 (for Fedora)
 * LibreOffice
 
 ### macOS with Intel Chip
 
 * Ruby 2.7.8 (build instructions same as above, but runs natively on Intel)
-* All other dependencies same as Apple Silicon
+* All other dependencies same as Apple Silicon (including `imagemagick@6`)
 * No special compiler flags needed for native extensions
 
 > **Note:** Solr will not run properly if there are spaces in any of the directory names in its path.
@@ -40,11 +41,23 @@ git checkout develop
 
 ### Step 2: Install Dependencies
 
+**Enable Yarn 4 (one-time machine setup):**
+```bash
+corepack enable
+corepack prepare yarn@4.0.2 --activate
+yarn --version
+```
+
+**Install JavaScript dependencies:**
+```bash
+yarn install
+```
+
 #### macOS with Apple Silicon (M1–M4)
 
 **Install Homebrew packages:**
 ```bash
-brew install sqlite3 mysql-client redis solr@8 imagemagick@6 libreoffice libsodium zstd
+brew install sqlite3 mysql-client redis solr@8 imagemagick@6 libreoffice libsodium zstd node@20
 ```
 
 **Install Java 8 (required for Fedora):**
@@ -57,6 +70,16 @@ brew install --cask temurin@8
 /usr/libexec/java_home -v 1.8
 ```
 
+**Install FITS (required for file upload characterization):**
+```bash
+mkdir -p "$HOME/.local/opt"
+cd "$HOME/.local/opt"
+curl -fL -o fits-1.6.0.zip https://github.com/harvard-lts/fits/releases/download/1.6.0/fits-1.6.0.zip
+unzip -qo fits-1.6.0.zip
+chmod +x "$HOME/.local/opt/fits.sh"
+"$HOME/.local/opt/fits.sh" -v
+```
+
 **Build OpenSSL 1.1.1 (required by Ruby 2.7.8):**
 ```bash
 cd /tmp
@@ -84,11 +107,17 @@ bundle _2.4.22_ config set build.mysql2 "--with-mysql-config=$(brew --prefix mys
 bundle _2.4.22_ install
 ```
 
+**Set local FITS path for development and test:**
+```bash
+printf "SCHOLAR_FITS_PATH=%s\n" "$HOME/.local/opt/fits.sh" > .env.development.local
+printf "SCHOLAR_FITS_PATH=%s\n" "$HOME/.local/opt/fits.sh" > .env.test.local
+```
+
 #### macOS with Intel Chip
 
 **Install Homebrew packages:**
 ```bash
-brew install sqlite3 mysql-client redis solr@8 imagemagick@6 libreoffice libsodium
+brew install sqlite3 mysql-client redis solr@8 imagemagick@6 libreoffice libsodium node@20
 ```
 
 **Install Java 8:**
@@ -101,6 +130,16 @@ brew install --cask temurin@8
 /usr/libexec/java_home -v 1.8
 ```
 
+**Install FITS (required for file upload characterization):**
+```bash
+mkdir -p "$HOME/.local/opt"
+cd "$HOME/.local/opt"
+curl -fL -o fits-1.6.0.zip https://github.com/harvard-lts/fits/releases/download/1.6.0/fits-1.6.0.zip
+unzip -qo fits-1.6.0.zip
+chmod +x "$HOME/.local/opt/fits.sh"
+"$HOME/.local/opt/fits.sh" -v
+```
+
 **Install Ruby 2.7.8 via rbenv:**
 ```bash
 brew install rbenv ruby-build
@@ -115,6 +154,12 @@ cd /path/to/ucrate
 bundle install
 ```
 
+**Set local FITS path for development and test:**
+```bash
+printf "SCHOLAR_FITS_PATH=%s\n" "$HOME/.local/opt/fits.sh" > .env.development.local
+printf "SCHOLAR_FITS_PATH=%s\n" "$HOME/.local/opt/fits.sh" > .env.test.local
+```
+
 ---
 
 ## Running the Application (All Platforms)
@@ -259,6 +304,45 @@ redis-server --version
 redis-server
 ```
 
+### `Usage Error: This project is configured to use yarn@4.0.2` (or similar Yarn/Corepack errors)
+
+Cause: Corepack is not enabled on this machine, or Yarn 4 has not been activated yet.
+
+Fix:
+```bash
+corepack enable
+corepack prepare yarn@4.0.2 --activate
+yarn --version
+yarn install
+```
+
+### `Unable to execute command "fits.sh ...": command not found`
+
+Cause: FITS is not installed locally, or `SCHOLAR_FITS_PATH` is not set.
+
+Fix:
+```bash
+mkdir -p "$HOME/.local/opt"
+cd "$HOME/.local/opt"
+curl -fL -o fits-1.6.0.zip https://github.com/harvard-lts/fits/releases/download/1.6.0/fits-1.6.0.zip
+unzip -qo fits-1.6.0.zip
+chmod +x "$HOME/.local/opt/fits.sh"
+printf "SCHOLAR_FITS_PATH=%s\n" "$HOME/.local/opt/fits.sh" > /path/to/ucrate/.env.development.local
+printf "SCHOLAR_FITS_PATH=%s\n" "$HOME/.local/opt/fits.sh" > /path/to/ucrate/.env.test.local
+"$HOME/.local/opt/fits.sh" -v
+```
+
+### `MiniMagick::Invalid: You must have ImageMagick or GraphicsMagick installed`
+
+Cause: ImageMagick binaries are not installed or not on your shell `PATH`.
+
+Fix:
+```bash
+brew install imagemagick@6
+which convert
+convert -version
+```
+
 ### Unexpected warnings when starting Rails console
 
 Examples:
diff --git a/app/assets/javascripts/application.js b/app/assets/javascripts/application.js
index f1abd067..223b75b0 100644
--- a/app/assets/javascripts/application.js
+++ b/app/assets/javascripts/application.js
@@ -14,7 +14,6 @@
 //= require jquery_ujs
 //= require dataTables/jquery.dataTables
 //= require dataTables/bootstrap/3/jquery.dataTables.bootstrap
-//= require jquery_ujs
 //= require jquery-ui-1.9.2/jquery.ui.widget
 //= require jquery-ui-1.9.2/jquery.ui.core
 //= require jquery-ui-1.9.2/jquery.ui.menu
diff --git a/app/assets/javascripts/hyrax/app.js.erb b/app/assets/javascripts/hyrax/app.js.erb
new file mode 100644
index 00000000..652f2231
--- /dev/null
+++ b/app/assets/javascripts/hyrax/app.js.erb
@@ -0,0 +1,225 @@
+// Once, javascript is written in a modular format, all initialization
+// code should be called from here.
+Hyrax = {
+    resolveModule: function (mod) {
+        if (mod && mod.default) return mod.default;
+        return mod;
+    },
+
+    // Any uncaught exception here aborts Blacklight.activate()'s queue, so callbacks
+    // registered after hyrax/initialize in the bundle (notably hyrax/tabs.js) never run —
+    // work form bootstrap tabs stay broken / content stays non-visible to Capybara.
+    initialize: function () {
+        try {
+            this.popovers();
+            this.permissions();
+            this.notifications();
+            this.transfers();
+            this.workEditor();
+            this.fileManager();
+            this.selectWorkType();
+            this.selectCollectionType();
+            this.datatable();
+            this.adminSetEditor();
+            this.collectionEditor();
+            this.collectionsV2();
+            this.collectionTypes();
+            this.collectionTypeEditor();
+            this.collectionUtilities();
+            this.adminStatisticsGraphs();
+            this.tinyMCE();
+            this.sortAndPerPage();
+            this.sidebar();
+            this.batchSelect();
+            this.internationalizationHelper();
+        } catch (e) {
+            if (typeof console !== 'undefined' && console.warn)
+                console.warn('[Hyrax.initialize]', e);
+        }
+    },
+
+    // Add WYSIWYG editor functionality to editable content blocks
+    tinyMCE: function() {
+        if (typeof tinyMCE === "undefined")
+            return;
+        tinyMCE.init({
+            selector: 'textarea.tinymce'
+        });
+    },
+
+    // The AdminSet edit page
+    adminSetEditor: function() {
+      var elem = $('#admin-set-controls');
+      if (elem.length === 0) return;
+      var AdminSetControls = this.resolveModule(require('hyrax/admin/admin_set_controls'));
+      var controls = new AdminSetControls(elem);
+    },
+
+    // The collectionType edit page
+    collectionTypeEditor: function() {
+      var elem = $('#collection-types-controls');
+      if (elem.length === 0) return;
+      var CollectionTypeControls = this.resolveModule(require('hyrax/admin/collection_type_controls'));
+      var controls = new CollectionTypeControls(elem);
+    },
+
+    // The Collection edit page
+    collectionEditor: function() {
+      var elem = $('#collection-edit-controls');
+      if (elem.length === 0) return;
+      var CollectionControls = this.resolveModule(require('hyrax/collections/editor'));
+      var controls = new CollectionControls(elem);
+    },
+
+    // Collections v2 - collections related js should (over time) be moved here
+    // from 'collections.js' to take advantage of shared modules
+    collectionsV2: function() {
+      var CollectionsV2 = this.resolveModule(require('hyrax/collections_v2'));
+      new CollectionsV2();
+    },
+
+    // Collection types
+    collectionTypes: function() {
+      var CollectionTypes = this.resolveModule(require('hyrax/collection_types'));
+      var collection_types = new CollectionTypes($('.collection-types-wrapper'))
+    },
+
+    collectionUtilities: function() {
+      var CollectionUtilities = this.resolveModule(require('hyrax/collections_utils'));
+      new CollectionUtilities();
+    },
+
+    // Pretty graphs on the dashboard page
+    adminStatisticsGraphs: function() {
+        var AdminGraphs = this.resolveModule(require('hyrax/admin/graphs'));
+        new AdminGraphs(Hyrax.statistics);
+    },
+
+    // Sortable/pageable tables
+    datatable: function () {
+        // This keeps the datatable from being added to a table that already has it.
+        // This is a problem when turbolinks is active.
+        if ($('.dataTables_wrapper').length === 0) {
+            $('.datatable').DataTable();
+        }
+    },
+
+    internationalizationHelper: function () {
+        var InternationalizationHelper = this.resolveModule(require('hyrax/i18n_helper'));
+        new InternationalizationHelper();
+    },
+
+    // The work edit page
+    workEditor: function () {
+        var element = $("[data-behavior='work-form']")
+        if (element.length > 0) {
+          var Editor = this.resolveModule(require('hyrax/editor'));
+          new Editor(element).init();
+        }
+    },
+
+    // Popover help modals. Used on the user profile page.
+    popovers: function () {
+        $("a[data-toggle=popover]").popover({html: true})
+            .click(function () {
+                return false;
+            });
+    },
+
+    // Add access grants for a user/group to a work/fileset/collection
+    // TODO: This could get moved to workEditor() or similar
+    permissions: function () {
+        var PermissionsControl = this.resolveModule(require('hyrax/permissions/control'));
+        // On the edit work page
+        new PermissionsControl($("#share"), 'tmpl-work-grant');
+        // On the edit fileset page
+        new PermissionsControl($("#permission"), 'tmpl-file-set-grant');
+        // On the batch edit page
+        new PermissionsControl($("#form_permissions"), 'tmpl-work-grant');
+        // On the edit collection page
+        new PermissionsControl($("#collection_permissions"), 'tmpl-collection-grant');
+    },
+
+    // ActionCable for user notifications. This is displayed in the navbar.
+    notifications: function() {
+        // Do not create a consumer if user is not logged in
+        if ($("meta[name='current-user']").length === 0)
+            return;
+        <% if Hyrax.config.realtime_notifications? %>
+        var consumer = ActionCable.createConsumer("<%= Hyrax::Engine.routes.url_helpers.notifications_endpoint_path %>");
+        consumer.subscriptions.create("Hyrax::NotificationsChannel", {
+            connected: function(data) {
+                this.perform("update_locale", { locale: $('html').attr('lang') });
+            },
+
+            received: function(data) {
+                var Notification = Hyrax.resolveModule(require('hyrax/notification'));
+                new Notification($('.notify-number')).update(data.notifications_count, data.notifications_label);
+            }
+        });
+        <% end %>
+    },
+
+    // Search for a user to transfer a work to
+    transfers: function () {
+        $("#proxy_deposit_request_transfer_to").userSearch();
+    },
+
+    // Popover menu to select the type of work when starting a deposit
+    selectWorkType: function () {
+        var SelectWorkType = this.resolveModule(require('hyrax/select_work_type'));
+        $("[data-behavior=select-work]").each(function () {
+            new SelectWorkType($(this));
+        });
+    },
+
+    // Popover menu to select the type when creating a new collection
+    selectCollectionType: function () {
+        var SelectCollectionType = this.resolveModule(require('hyrax/select_collection_type'));
+        $("[data-behavior=select-collection]").each(function () {
+            new SelectCollectionType($(this)); // eslint-disable-line no-new
+        });
+    },
+
+    // Minimize/maximize the dashboard sidebar
+    sidebar: function () {
+        $('.sidebar-toggle').on('click', function() {
+            $('.sidebar, .main-content').toggleClass('maximized')
+        })
+    },
+
+    // Add and reorder files attached to works.
+    // Must not throw: an uncaught error in Hyrax.initialize aborts Blacklight.activate()
+    // before callbacks registered later in the bundle (including hyrax/tabs.js).
+    fileManager: function () {
+        if ($('#sortable').length === 0)
+            return;
+        try {
+            var FileManager = this.resolveModule(require('hyrax/file_manager'));
+            new FileManager();
+        } catch (e) {
+            if (typeof console !== 'undefined' && console.warn)
+                console.warn('[Hyrax] fileManager init skipped:', e);
+        }
+    },
+
+    // Per Page select will submit its form to change records shown
+    sortAndPerPage: function () {
+        var SortAndPerPage = this.resolveModule(require('hyrax/sort_and_per_page'));
+        $('#sort, #per_page').each(function () {
+            new SortAndPerPage($(this));
+        });
+    },
+
+    // Saved so that inline javascript can put data somewhere.
+    statistics: {},
+
+    // initialized in hyrax/config.js
+    config: {},
+
+    // Adds selected items to the batch before any batch operation is performed
+    batchSelect: function () {
+        var BatchSelect = this.resolveModule(require('hyrax/batch_select'));
+        BatchSelect.initialize_batch_selected();
+    }
+};
diff --git a/app/assets/javascripts/hyrax/collection_types.es6 b/app/assets/javascripts/hyrax/collection_types.es6
new file mode 100644
index 00000000..a3729593
--- /dev/null
+++ b/app/assets/javascripts/hyrax/collection_types.es6
@@ -0,0 +1,112 @@
+// Override gem: collections_utils interop may be { default: Class }; see collections_v2.es6.
+// Gem constructor always ran `new CollectionUtilities()` before checking element.length, which
+// aborted Hyrax.initialize on pages without `.collection-types-wrapper`.
+import CollectionUtilitiesModule from 'hyrax/collections_utils';
+
+const CollectionUtilities =
+  CollectionUtilitiesModule && CollectionUtilitiesModule.default
+    ? CollectionUtilitiesModule.default
+    : CollectionUtilitiesModule;
+
+export default class CollectionTypes {
+  constructor(element) {
+    if (element.length === 0) {
+      return;
+    }
+
+    this.collectionUtilities = new CollectionUtilities();
+
+    this.handleCollapseToggle();
+    this.handleDelete();
+
+    // Edit Collection Type
+    this.setupAddParticipantsHandler();
+    this.participantsAddButtonDisabler();
+  }
+
+  setupAddParticipantsHandler() {
+    const { addParticipants } = this.collectionUtilities;
+    const wrapEl = '.form-add-participants-wrapper';
+    const url = '/admin/collection_type_participants?locale=en';
+
+    $('#participants')
+      .find('.add-participants-form input[type="submit"]')
+      .on(
+        'click',
+        {
+          wrapEl,
+          urlFn: (e) => url,
+        },
+        addParticipants.handleAddParticipants.bind(addParticipants),
+      );
+  }
+
+  handleCollapseToggle() {
+    let $collapseHeader = $('a.collapse-header');
+    let $collapseHeaderSpan = $('a.collapse-header').find('span');
+    const collapseText = $collapseHeader.data('collapseText');
+    const expandText = $collapseHeader.data('expandText');
+
+    $('#collapseAbout').on('show.bs.collapse', () => {
+      $collapseHeader.addClass('open');
+      $collapseHeaderSpan.html(collapseText);
+    });
+    $('#collapseAbout').on('hide.bs.collapse', () => {
+      $collapseHeader.removeClass('open');
+      $collapseHeaderSpan.html(expandText);
+    });
+  }
+
+  handleDelete() {
+    $('.delete-collection-type').on('click', (event) => {
+      let dataset = event.target.dataset;
+      let collectionType = JSON.parse(dataset.collectionType) || null;
+      let hasCollections = dataset.hasCollections === 'true';
+      this.handleDelete_event_target = event.target;
+      this.collectionType_id = collectionType.id;
+
+      if (hasCollections === true) {
+        $('.view-collections-of-this-type').attr('href', dataset.collectionTypeIndex);
+        $('#deleteDenyModal').modal();
+      } else {
+        $('#deleteModal').modal();
+      }
+    });
+
+    $('.confirm-delete-collection-type').on('click', (event) => {
+      event.preventDefault();
+      const deleteTarget = this.handleDelete_event_target;
+      const collectionTypeId = this.collectionType_id;
+      const $clicked = $(event.target);
+      $.ajax({
+        url: window.location.pathname + '/' + collectionTypeId,
+        type: 'DELETE',
+      }).done(() => {
+        $(deleteTarget).parent('td').parent('tr').remove();
+        let defaultButton = $clicked.parent('div').find('.btn-default');
+        defaultButton.trigger('click');
+      });
+    });
+
+    $('.view-collections-of-this-type').on('click', (event) => {
+      $('#deleteDenyModal').modal('hide');
+    });
+  }
+
+  participantsAddButtonDisabler() {
+    const { addParticipantsInputValidator } = this.collectionUtilities;
+    const buttonSelector = '.add-participants-form input[type="submit"]';
+    const inputsWrapper = '.form-add-participants-wrapper';
+
+    $('#participants')
+      .find(inputsWrapper)
+      .on(
+        'change',
+        {
+          buttonSelector,
+          inputsWrapper,
+        },
+        addParticipantsInputValidator.handleWrapperContentsChange.bind(addParticipantsInputValidator),
+      );
+  }
+}
diff --git a/app/assets/javascripts/hyrax/collections_v2.es6 b/app/assets/javascripts/hyrax/collections_v2.es6
new file mode 100644
index 00000000..6464be48
--- /dev/null
+++ b/app/assets/javascripts/hyrax/collections_v2.es6
@@ -0,0 +1,63 @@
+// Override gem: Almond/Babel may expose hyrax/collections_utils as { default: Class }.
+// Using that object with `new` throws and aborts Hyrax.initialize(), which prevents later
+// Blacklight.onLoad callbacks (notably hyrax/collections.js delete-modal handlers) from running.
+import CollectionUtilitiesModule from 'hyrax/collections_utils';
+
+const CollectionUtilities =
+  CollectionUtilitiesModule && CollectionUtilitiesModule.default
+    ? CollectionUtilitiesModule.default
+    : CollectionUtilitiesModule;
+
+export default class CollectionsV2 {
+  constructor() {
+    this.collectionUtilities = new CollectionUtilities();
+    this.setupAddSharingHandler();
+    this.sharingAddButtonDisabler();
+  }
+
+  /**
+   * Set up the handler for adding groups or users via AJAX POSTS at the following location:
+   * Collection > Edit > Sharing tab; or
+   * Collection Types > Edit > Participants tab
+   * @return {void}
+   */
+  setupAddSharingHandler() {
+    const { addParticipants } = this.collectionUtilities;
+    const wrapEl = '.form-add-sharing-wrapper';
+
+    $('#participants')
+      .find('.edit-collection-add-sharing-button')
+      .on(
+        'click',
+        {
+          wrapEl,
+          urlFn: (e) => {
+            const $wrapEl = $(e.target).parents(wrapEl);
+            return '/dashboard/collections/' + $wrapEl.data('id') + '/permission_template?locale=en';
+          },
+        },
+        addParticipants.handleAddParticipants.bind(addParticipants),
+      );
+  }
+
+  /**
+   * Set up enabling/disabling "Add" button for adding groups and/or users in
+   * Edit Collection > Sharing tab
+   * @return {void}
+   */
+  sharingAddButtonDisabler() {
+    const { addParticipantsInputValidator } = this.collectionUtilities;
+    const inputsWrapper = '.form-add-sharing-wrapper';
+
+    $('#participants')
+      .find(inputsWrapper)
+      .on(
+        'change',
+        {
+          buttonSelector: '.edit-collection-add-sharing-button',
+          inputsWrapper,
+        },
+        addParticipantsInputValidator.handleWrapperContentsChange.bind(addParticipantsInputValidator),
+      );
+  }
+}
diff --git a/config/initializers/hyrax.rb b/config/initializers/hyrax.rb
index 4a8ab8b9..67df81e7 100644
--- a/config/initializers/hyrax.rb
+++ b/config/initializers/hyrax.rb
@@ -89,7 +89,11 @@
   # config.redis_namespace = "hyrax"
 
   # Path to the file characterization tool
-  # config.fits_path = "fits.sh"
+  fits_path = ENV["SCHOLAR_FITS_PATH"].presence ||
+              ["/opt/fits-1.0.5/fits.sh", "fits.sh"].find do |path|
+                File.exist?(path)
+              end
+  config.fits_path = fits_path if fits_path.present?
 
   # Path to the file derivatives creation tool
   config.libreoffice_path = ENV["SCHOLAR_SOFFICE_PATH"]
diff --git a/package.json b/package.json
new file mode 100644
index 00000000..497fb17f
--- /dev/null
+++ b/package.json
@@ -0,0 +1,3 @@
+{
+  "packageManager": "yarn@4.0.2+sha512.4e502bea682e7d8004561f916f1da2dfbe6f718024f6aa50bf8cd86f38ea3a94a7f1bf854a9ca666dd8eafcfb8d44baaa91bf5c7876e79a7aeac952c332f0e88"
+}
diff --git a/yarn.lock b/yarn.lock
new file mode 100644
index 00000000..11cbfd15
--- /dev/null
+++ b/yarn.lock
@@ -0,0 +1,12 @@
+# This file is generated by running "yarn install" inside your project.
+# Manual changes might be lost - proceed with caution!
+
+__metadata:
+  version: 8
+  cacheKey: 10c0
+
+"root-workspace-0b6124@workspace:.":
+  version: 0.0.0-use.local
+  resolution: "root-workspace-0b6124@workspace:."
+  languageName: unknown
+  linkType: soft