/* ──────────────────────────────────────────────────────────────────────────
   Auth pages — modern minimal.
   Loaded ONLY by login.html / set_password.html / password_forgot.html (via
   _auth_base.html), so the element selectors below are effectively scoped to
   those pages. We hide the global admin header here to present a clean,
   self-contained auth screen. Nothing in this file affects other admin pages.
   ────────────────────────────────────────────────────────────────────────── */

:root {
    /* Palette tracks the admin UI (templates/base.html): slate #2c3e50 header,
       #3498db accent — so the login matches the rest of the product. */
    --auth-ink: #2c3e50;          /* slate: text + primary button            */
    --auth-ink-soft: #475569;     /* secondary text                          */
    --auth-muted: #64748b;        /* tertiary text                           */
    --auth-line: #e2e8f0;         /* hairlines / input borders               */
    --auth-bg: #eef2f7;
    --auth-card: #ffffff;
    --auth-accent: #3498db;       /* the single accent (app link blue)       */
    --auth-accent-strong: #2980b9;
    --auth-accent-tint: #eaf4fb;
    --auth-radius: 14px;
    --auth-shadow: 0 1px 2px rgba(44, 62, 80, .05), 0 18px 40px -16px rgba(44, 62, 80, .24);
}

/* Hide the global admin chrome on auth pages. */
.header { display: none !important; }

body {
    background:
        radial-gradient(1100px 520px at 50% -8%, #ffffff 0%, rgba(255, 255, 255, 0) 62%),
        var(--auth-bg);
    min-height: 100vh;
}

/* base.html wraps content in a Bootstrap .container; let auth own the width. */
body > .container {
    max-width: none;
    padding: 0;
    margin: 0;
}

/* If base.html flashed any messages, keep them card-width and centered. */
body > .container > .flash-messages {
    max-width: 412px;
    margin: 1.75rem auto -0.25rem;
}

.auth-shell {
    display: flex;
    justify-content: center;
    padding: clamp(2.5rem, 9vh, 6rem) 1.25rem 4rem;
}

.auth-card {
    position: relative;
    width: 100%;
    max-width: 412px;
    background: var(--auth-card);
    border: 1px solid var(--auth-line);
    border-radius: var(--auth-radius);
    box-shadow: var(--auth-shadow);
    padding: 2.25rem 2.25rem 2rem;
    overflow: hidden;
    animation: auth-rise .5s cubic-bezier(.16, 1, .3, 1) both;
}

/* Hairline accent along the top edge — the one flourish. */
.auth-card::before {
    content: "";
    position: absolute;
    inset: 0 0 auto 0;
    height: 3px;
    background: linear-gradient(90deg, var(--auth-accent), #60a5fa);
}

@keyframes auth-rise {
    from { opacity: 0; transform: translateY(10px); }
    to   { opacity: 1; transform: translateY(0); }
}

/* Setup-mode ribbon (bleeds to the card edges). */
.auth-ribbon {
    margin: -2.25rem -2.25rem 1.5rem;
    padding: .7rem 1rem;
    background: var(--auth-accent-tint);
    color: #1e40af;
    border-bottom: 1px solid #bfdbfe;
    font-size: .8rem;
    font-weight: 600;
    text-align: center;
}

.auth-brand {
    display: flex;
    align-items: center;
    gap: .6rem;
    margin-bottom: 1.6rem;
}

.auth-mark {
    width: 34px;
    height: 34px;
    border-radius: 9px;
    background: var(--auth-ink);
    color: #fff;
    display: grid;
    place-items: center;
    font-weight: 700;
    font-size: 15px;
    letter-spacing: .01em;
}

.auth-wordmark {
    font-size: .76rem;
    font-weight: 600;
    color: var(--auth-ink-soft);
    letter-spacing: .15em;
    text-transform: uppercase;
}

.auth-title {
    margin: 0 0 .4rem;
    font-size: 1.4rem;
    font-weight: 700;
    line-height: 1.25;
    letter-spacing: -.01em;
    color: var(--auth-ink);
}

.auth-subtitle {
    margin: 0 0 1.4rem;
    font-size: .9rem;
    color: var(--auth-muted);
}

/* A login method (SSO / password / setup). Top hairline separates stacked
   methods regardless of which combination renders. */
.auth-method {
    margin-top: 1.4rem;
    padding-top: 1.4rem;
    border-top: 1px solid var(--auth-line);
}

.auth-method-title {
    margin: 0 0 .9rem;
    font-size: .76rem;
    font-weight: 700;
    text-transform: uppercase;
    letter-spacing: .1em;
    color: var(--auth-muted);
}

.auth-field { margin-bottom: .9rem; }

.auth-label {
    display: block;
    margin-bottom: .35rem;
    font-size: .78rem;
    font-weight: 600;
    color: var(--auth-ink-soft);
}

.auth-input {
    width: 100%;
    box-sizing: border-box;
    padding: .65rem .75rem;
    font-size: .92rem;
    color: var(--auth-ink);
    background: #fff;
    border: 1px solid var(--auth-line);
    border-radius: 9px;
    transition: border-color .15s ease, box-shadow .15s ease;
}

.auth-input:focus {
    outline: none;
    border-color: var(--auth-accent);
    box-shadow: 0 0 0 3px rgba(37, 99, 235, .15);
}

.auth-input[readonly] {
    background: #f8fafc;
    color: var(--auth-muted);
}

.auth-btn {
    width: 100%;
    display: inline-flex;
    align-items: center;
    justify-content: center;
    gap: .5rem;
    padding: .7rem 1rem;
    font-size: .92rem;
    font-weight: 600;
    border: 1px solid transparent;
    border-radius: 9px;
    cursor: pointer;
    text-decoration: none;
    background: var(--auth-ink);
    color: #fff;
    transition: transform .12s ease, box-shadow .15s ease, background .15s ease, border-color .15s ease;
}

.auth-btn:hover {
    background: #1e293b;
    transform: translateY(-1px);
    box-shadow: 0 10px 22px -10px rgba(15, 23, 42, .55);
}

.auth-btn:active { transform: translateY(0); }

.auth-btn--accent { background: var(--auth-accent); }
.auth-btn--accent:hover { background: var(--auth-accent-strong); }

.auth-btn--ghost {
    background: #fff;
    color: var(--auth-ink);
    border-color: var(--auth-line);
    box-shadow: none;
}
.auth-btn--ghost:hover {
    background: #f8fafc;
    border-color: #cbd5e1;
    box-shadow: none;
}

.auth-btn + .auth-btn { margin-top: .75rem; }

.auth-hint { margin: .4rem 0 1rem; font-size: .78rem; color: var(--auth-muted); }

.auth-forgot { margin: .85rem 0 0; text-align: center; font-size: .82rem; }

.auth-footer {
    margin-top: 1.5rem;
    font-size: .82rem;
    line-height: 1.6;
    color: var(--auth-muted);
    text-align: center;
}

.auth-link {
    color: var(--auth-accent);
    text-decoration: none;
    font-weight: 500;
}
.auth-link:hover { text-decoration: underline; }

.auth-callout {
    margin: 1.25rem 0 0;
    padding: 1rem 1.1rem;
    background: #f8fafc;
    border: 1px solid var(--auth-line);
    border-radius: 10px;
    font-size: .82rem;
    line-height: 1.55;
    color: var(--auth-ink-soft);
    text-align: left;
}
.auth-callout--warn { background: #fffbeb; border-color: #fde68a; color: #92400e; }
.auth-callout--info { background: var(--auth-accent-tint); border-color: #bfdbfe; color: #1e40af; }
.auth-callout code {
    font-family: ui-monospace, Menlo, Monaco, "Courier New", monospace;
    font-size: .9em;
    background: rgba(15, 23, 42, .06);
    padding: .08em .35em;
    border-radius: 4px;
}

/* Soften base.html's .alert styling for use inside the card. */
.auth-card .alert {
    border-radius: 9px;
    font-size: .85rem;
    text-align: left;
}

@media (max-width: 480px) {
    .auth-card { padding: 1.75rem 1.4rem 1.5rem; border-radius: 12px; }
    .auth-ribbon { margin: -1.75rem -1.4rem 1.25rem; }
}