:root {
  --bg: #f4f4f4; --panel: #ffffff; --ink: #161616; --muted: #525252;
  --line: #e0e0e0; --accent: #0f62fe; --ok: #24a148; --warn: #ff832b; --bad: #da1e28;
}
* { box-sizing: border-box; }
body {
  margin: 0; background: var(--bg); color: var(--ink);
  font: 14px/1.5 "IBM Plex Sans", -apple-system, "Segoe UI", sans-serif;
}
header {
  display: flex; align-items: center; gap: 2rem;
  background: var(--ink); color: #fff; padding: 0 1.5rem; height: 3rem;
}
.brand { font-weight: 600; }
.brand span { font-weight: 300; opacity: .8; }
header nav { display: flex; gap: 1.25rem; }
header nav a { color: #c6c6c6; text-decoration: none; }
header nav a:hover { color: #fff; }
.logout { margin-left: auto; display: flex; gap: .75rem; align-items: center; }
.logout .who { color: #8d8d8d; }
main { max-width: 1200px; margin: 1.5rem auto; padding: 0 1.5rem; }
footer { text-align: center; color: var(--muted); padding: 2rem 0; font-size: 12px; }

h1 { font-size: 1.4rem; font-weight: 500; margin: 0 0 1rem; }
h2 { font-size: 1.05rem; font-weight: 600; margin: 2rem 0 .5rem; }
.panel { background: var(--panel); border: 1px solid var(--line); padding: 1rem 1.25rem; margin-bottom: 1rem; }
/* Single-form panels: cap the box at the form's width instead of stretching a 620px
   form inside a 1200px frame of dead space. */
.panel.narrow { max-width: 680px; }

/* Tables keep their natural width and the WRAPPER scrolls — a narrow window gets a
   scrollbar, not columns crushed into one-word-per-line slivers. */
.table-wrap { overflow-x: auto; margin-bottom: 1rem; }
.table-wrap table { min-width: 880px; }
table { width: 100%; border-collapse: collapse; background: var(--panel); border: 1px solid var(--line); }
th, td { text-align: left; padding: .5rem .75rem; border-bottom: 1px solid var(--line); vertical-align: top; }
th { background: #ececec; font-weight: 600; white-space: nowrap; }
tr:last-child td { border-bottom: 0; }
/* overflow-wrap (not word-break: break-all): long unbroken runs — fingerprints, keys,
   db: identities — still wrap anywhere when they must, but module lists and sentences
   break at spaces instead of mid-word ("offic / e"). */
code, .mono { font: 12px/1.5 "IBM Plex Mono", ui-monospace, monospace; overflow-wrap: anywhere; }

.flash { padding: .6rem 1rem; margin-bottom: 1rem; border-left: 3px solid; }
.flash.ok { background: #defbe6; border-color: var(--ok); }
.flash.err { background: #fff1f1; border-color: var(--bad); }

.badge { display: inline-block; padding: 0 .5rem; border-radius: 9px; font-size: 12px; color: #fff; }
.badge.ok { background: var(--ok); }
.badge.warn { background: var(--warn); }
.badge.bad { background: var(--bad); }
.badge.neutral { background: var(--muted); }
.badge.release { background: #8a3ffc; }
.badge.dev { background: #6f6f6f; }

.drift { color: var(--bad); font-size: 13px; margin: .15rem 0; }
/* weight reset matters: hints usually sit inside bold form labels and must not
   inherit the boldness. */
.hint { color: var(--muted); font-size: 12px; font-weight: 400; }

form.stack { display: grid; gap: .75rem; max-width: 620px; }
form.stack label { display: grid; gap: .2rem; font-weight: 600; }
form.stack input[type=text], form.stack input[type=email], form.stack input[type=password],
form.stack input[type=number], form.stack input[type=date], form.stack textarea, form.stack select {
  font: inherit; padding: .45rem .6rem; border: 1px solid #8d8d8d; background: #fff; width: 100%;
}
form.stack textarea { min-height: 5.5rem; font-family: "IBM Plex Mono", ui-monospace, monospace; font-size: 12px; }
form.stack .inline { display: flex; gap: .5rem; align-items: center; font-weight: 400; }
/* Buttons size to their label; a full-width primary button is a login-box thing only. */
form.stack button { justify-self: start; }
.login-box form.stack button { justify-self: stretch; }
button, .btn {
  font: inherit; background: var(--accent); border: 0; color: #fff;
  padding: .5rem 1rem; cursor: pointer; text-decoration: none; display: inline-block;
}
button.danger { background: var(--bad); }
button.linklike { background: none; color: #78a9ff; padding: 0; text-decoration: underline; }
.actions { display: flex; gap: .5rem; align-items: center; flex-wrap: wrap; margin: .75rem 0 .25rem; }
.actions form { display: contents; }
.modules { display: grid; grid-template-columns: repeat(2, minmax(0,1fr)); gap: .3rem .75rem; }
/* form.stack label sets display:grid and wins on specificity, which stacked each
   checkbox ABOVE its module name — restate the row layout at equal-or-higher
   specificity so a checkbox sits beside its label like a checkbox should. */
form.stack .modules label, .modules label {
  display: flex; gap: .5rem; align-items: baseline; font-weight: 400;
}
.token-reveal { background: #fff8e1; border: 1px solid var(--warn); padding: 1rem; margin-bottom: 1rem; }
.login-box { max-width: 360px; margin: 4rem auto; }
/* Enrollment carries a 320px QR plus the typed-secret fallback, so it needs more
   room than the plain sign-in box. */
.login-box.wide { max-width: 420px; }
.login-box img { display: block; margin: 0 auto; max-width: 100%; height: auto; }
.secret { display: block; padding: .5rem .6rem; background: #f4f4f4; border: 1px solid var(--line); user-select: all; }
.kv { display: grid; grid-template-columns: 12rem 1fr; gap: .25rem .75rem; }
.kv dt { color: var(--muted); }
.kv dd { margin: 0; }