/* auth-pages.css — shared design system for the auth flow: index.php
   (login), activate.php (account setup), forgot_password.php,
   reset_password.php. Keep these four in sync.

   Concept: the calibration bench + the certificate. Every page splits into
   a dark instrument panel (left) carrying a status dial echoing the real
   calibration-status gauge this system tracks for actual devices, and a
   paper form panel (right) styled like a page from a cal log. Keep this
   file the single source of truth for both. */

:root {
  --brand-red:      #d21f27;
  --brand-red-dark: #a5171d;

  --bench-950: #12151a;
  --bench-900: #1a1e24;
  --bench-850: #20242b;
  --bench-line: #2c313a;
  --bench-text: #eeece3;
  --bench-text-dim: #8b9096;

  --paper: #f8f5ee;
  --paper-rule: #e4ddc8;
  --ink: #23211c;
  --ink-soft: #6f6a5c;

  --ok-green:  #1c8a4a;
  --ok-green-soft: #d9ede1;
  --warn-amber: #b9790a;
  --warn-amber-soft: #f4e6cd;
  --err-red: #c22530;
  --err-red-soft: #f6dcde;

  --font-display: 'Oswald', 'Arial Narrow', sans-serif;
  --font-body: 'IBM Plex Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
  --font-mono: 'IBM Plex Mono', 'SFMono-Regular', Consolas, monospace;

  /* Password-strength scale, shared by activate.php and reset_password.php
     so the two forms can't drift into different color meanings again. */
  --strength-1: #c22530;
  --strength-2: #b9790a;
  --strength-3: #c9a227;
  --strength-4: #4c9a5c;
  --strength-5: #1c8a4a;
  /* label-text-only variants: the bar-fill colors above read fine as a
     vivid strip but fall under 4.5:1 as text on the cream paper. */
  --strength-5-ink: #146b39;
}

html, body { height: 100%; }

/* ── Browser surfaces: theme what we didn't draw ──────────────────── */
body.login-page ::selection,
body.register-page ::selection { background: var(--brand-red); color: #fff; }
.auth-form .form-control { caret-color: var(--brand-red); }
.auth-shell a { text-underline-offset: 2px; }
body.login-page::-webkit-scrollbar,
body.register-page::-webkit-scrollbar { width: 10px; }
body.login-page::-webkit-scrollbar-track,
body.register-page::-webkit-scrollbar-track { background: var(--bench-950); }
body.login-page::-webkit-scrollbar-thumb,
body.register-page::-webkit-scrollbar-thumb { background: var(--bench-line); border-radius: 6px; }

body.login-page,
body.register-page {
  display: flex;
  align-items: center;
  justify-content: center;
  min-height: 100vh !important;
  height: auto !important;
  margin: 0;
  padding: 32px 16px;
  background:
    radial-gradient(ellipse 900px 500px at 18% 12%, #262b32 0%, transparent 60%),
    linear-gradient(160deg, var(--bench-950) 0%, #171a1f 55%, var(--bench-950) 100%);
  font-family: var(--font-body);
  color: var(--ink);
}

/* ── Shell: two-pane bench + certificate layout ─────────────────── */
.auth-shell {
  width: 100%;
  max-width: 900px;
  display: grid;
  grid-template-columns: minmax(240px, 340px) 1fr;
  align-items: stretch;
  border-radius: 16px;
  overflow: hidden;
  box-shadow: 0 30px 70px rgba(0, 0, 0, .45), 0 2px 0 rgba(255, 255, 255, .02) inset;
  background: var(--paper);
}

/* ── Left pane: instrument panel ─────────────────────────────────── */
.auth-brand-pane {
  position: relative;
  background:
    radial-gradient(ellipse 500px 320px at 30% 0%, #2a2f37 0%, transparent 65%),
    linear-gradient(195deg, var(--bench-900) 0%, var(--bench-950) 100%);
  color: var(--bench-text);
  padding: 2.6rem 2.1rem;
  display: flex;
  flex-direction: column;
  gap: 1.6rem;
}
.auth-brand-pane::after {
  /* perforated seam — the tear line of a certificate stub */
  content: "";
  position: absolute;
  top: 0; right: -1px; bottom: 0;
  width: 2px;
  background-image: radial-gradient(circle, var(--bench-line) 1.6px, transparent 2px);
  background-size: 100% 13px;
  background-repeat: repeat-y;
  opacity: .9;
}

.auth-brand-mark {
  display: flex;
  align-items: center;
  gap: .7rem;
}
.auth-brand-mark img {
  /* source logo is a wide 275x115 badge — size by width and let height
     follow, rather than cropping it into a square with object-fit. */
  width: 64px;
  height: auto;
  border-radius: 6px;
  box-shadow: 0 4px 14px rgba(0, 0, 0, .4);
  flex-shrink: 0;
}
.auth-brand-mark .name {
  font-family: var(--font-display);
  font-weight: 600;
  font-size: 1.05rem;
  letter-spacing: .04em;
  line-height: 1.15;
  color: #fff;
}
.auth-brand-mark .name small {
  display: block;
  font-family: var(--font-body);
  font-weight: 500;
  font-size: .72rem;
  letter-spacing: .06em;
  color: var(--bench-text-dim);
  text-transform: uppercase;
  margin-top: 2px;
}

.auth-brand-copy {
  font-family: var(--font-display);
  font-weight: 500;
  font-size: 1.5rem;
  line-height: 1.28;
  letter-spacing: .01em;
  color: #fdfcf9;
  margin: 0;
}
.auth-brand-sub {
  font-size: .84rem;
  line-height: 1.55;
  color: var(--bench-text-dim);
  margin: -.8rem 0 0;
}

/* ── Signature element: the calibration status dial ─────────────── */
.dial-wrap {
  margin-top: auto;
  display: flex;
  flex-direction: column;
  align-items: center;
  gap: .9rem;
  padding-top: 1rem;
}
.dial {
  --dial-size: 148px;
  position: relative;
  width: var(--dial-size);
  height: var(--dial-size);
}
.dial-ring {
  position: absolute;
  inset: 0;
  border-radius: 50%;
  background: conic-gradient(
    from -120deg,
    var(--err-red)    0deg 110deg,
    var(--warn-amber)  110deg 130deg,
    var(--ok-green)    130deg 240deg,
    transparent         240deg 360deg
  );
  -webkit-mask: radial-gradient(closest-side, transparent 0 74%, #000 76% 100%);
          mask: radial-gradient(closest-side, transparent 0 74%, #000 76% 100%);
  opacity: .9;
}
.dial-tick {
  position: absolute;
  top: 50%;
  left: 50%;
  width: 2px;
  height: 8px;
  background: var(--bench-text-dim);
  opacity: .55;
  transform-origin: 1px calc(var(--dial-size) * .446);
  margin: calc(var(--dial-size) * -.446) 0 0 -1px;
}
.dial-face {
  position: absolute;
  inset: 15%;
  border-radius: 50%;
  background: var(--bench-850);
  box-shadow: 0 0 0 1px var(--bench-line), inset 0 2px 8px rgba(0, 0, 0, .5);
}
.dial-needle {
  position: absolute;
  top: 50%;
  left: 50%;
  width: 3px;
  height: calc(var(--dial-size) * .351);
  margin: calc(var(--dial-size) * -.351) 0 0 -1.5px;
  background: linear-gradient(to top, var(--brand-red), rgba(210, 31, 39, 0));
  border-radius: 2px;
  transform-origin: 50% 100%;
  transform: rotate(-120deg);
  animation: dial-sweep 1.3s cubic-bezier(.22, .9, .21, 1) .15s forwards;
}
.dial-hub {
  position: absolute;
  top: 50%;
  left: 50%;
  width: 10px;
  height: 10px;
  margin: -5px 0 0 -5px;
  border-radius: 50%;
  background: var(--brand-red);
  box-shadow: 0 0 0 3px var(--bench-850);
}
@keyframes dial-sweep {
  to { transform: rotate(var(--rest-angle, 35deg)); }
}
.dial-caption {
  font-family: var(--font-mono);
  font-size: .68rem;
  letter-spacing: .1em;
  text-transform: uppercase;
  color: var(--bench-text-dim);
  text-align: center;
  display: flex;
  align-items: center;
  gap: .45rem;
  opacity: 0;
  animation: dial-caption-in .5s ease .95s forwards;
}
.dial-caption .dot {
  width: 6px;
  height: 6px;
  border-radius: 50%;
  background: var(--ok-green);
  box-shadow: 0 0 0 3px rgba(28, 138, 74, .18);
  flex-shrink: 0;
}
.dial-caption.tone-amber .dot { background: var(--warn-amber); box-shadow: 0 0 0 3px rgba(185, 121, 10, .18); }
.dial-caption.tone-red   .dot { background: var(--err-red);   box-shadow: 0 0 0 3px rgba(194, 37, 48, .18); }
@keyframes dial-caption-in {
  to { opacity: 1; }
}
@media (prefers-reduced-motion: reduce) {
  .dial-needle { animation: none; transform: rotate(var(--rest-angle, 35deg)); }
  .dial-caption { animation: none; opacity: 1; }
}

/* ── Right pane: the certificate / form ──────────────────────────── */
.auth-form-pane {
  background:
    repeating-linear-gradient(var(--paper) 0 27px, var(--paper-rule) 27px 28px),
    var(--paper);
  background-blend-mode: normal;
  padding: 2.6rem 2.4rem;
  display: flex;
  flex-direction: column;
  justify-content: center;
}
.auth-title {
  font-family: var(--font-display);
  font-weight: 600;
  font-size: 1.7rem;
  letter-spacing: .01em;
  color: var(--ink);
  margin: 0 0 .35rem;
  line-height: 1.2;
}
.auth-title strong { color: var(--brand-red-dark); }
.auth-sub {
  font-size: .85rem;
  color: var(--ink-soft);
  line-height: 1.5;
  margin: 0 0 1.4rem;
}

/* ── Alerts: a tone badge (echoes the dial dot / seal), no side-tab border ── */
.auth-alert {
  display: flex;
  align-items: center;
  gap: .65rem;
  background: var(--err-red-soft);
  color: #7a1119;
  padding: .65rem .8rem;
  border-radius: 6px;
  font-size: .82rem;
  line-height: 1.45;
  margin-bottom: 1.1rem;
  position: relative;
}
.auth-alert .badge {
  flex-shrink: 0;
  width: 26px;
  height: 26px;
  border-radius: 50%;
  display: flex;
  align-items: center;
  justify-content: center;
  font-size: .72rem;
  background: var(--err-red);
  color: #fff;
}
.auth-alert.tone-warning { background: var(--warn-amber-soft); color: #6b4a08; }
.auth-alert.tone-warning .badge { background: var(--warn-amber); }
.auth-alert.tone-info    { background: #dbe7f2; color: #1f4a6e; }
.auth-alert.tone-info .badge { background: #3b6fa0; }
.auth-alert.tone-success { background: var(--ok-green-soft); color: #0f5c30; }
.auth-alert.tone-success .badge { background: var(--ok-green); }
.auth-alert .close {
  margin-left: auto;
  background: none;
  border: none;
  color: inherit;
  opacity: .55;
  font-size: 1rem;
  line-height: 1;
  cursor: pointer;
  padding: 0;
}
.auth-alert .close:hover { opacity: .9; }

/* ── Toast: same tone language as .auth-alert, but a transient top-right
   popup instead of a fixture in the form — for status that's nice to know
   but doesn't need to sit on screen until the user dismisses it. ── */
.auth-toast {
  position: fixed;
  top: 18px;
  right: 18px;
  z-index: 2000;
  display: flex;
  align-items: center;
  gap: .65rem;
  max-width: 320px;
  background: var(--ok-green-soft);
  color: #0f5c30;
  padding: .65rem .8rem;
  border-radius: 6px;
  font-size: .82rem;
  line-height: 1.45;
  box-shadow: 0 10px 28px rgba(0, 0, 0, .18);
  opacity: 0;
  transform: translateY(-10px);
  transition: opacity .25s ease, transform .25s ease;
  pointer-events: none;
}
.auth-toast.show { opacity: 1; transform: translateY(0); pointer-events: auto; }
.auth-toast .badge {
  flex-shrink: 0;
  width: 26px;
  height: 26px;
  border-radius: 50%;
  display: flex;
  align-items: center;
  justify-content: center;
  font-size: .72rem;
  background: var(--ok-green);
  color: #fff;
}
.auth-toast .close {
  margin-left: auto;
  background: none;
  border: none;
  color: inherit;
  opacity: .55;
  font-size: 1rem;
  line-height: 1;
  cursor: pointer;
  padding: 0;
}
.auth-toast .close:hover { opacity: .9; }

.auth-note {
  background: #f0ece0;
  border: 1px solid var(--paper-rule);
  border-radius: 6px;
  padding: .7rem .85rem;
  font-size: .78rem;
  line-height: 1.5;
  color: var(--ink-soft);
}
.auth-note i { color: var(--brand-red-dark); margin-right: .3rem; }

/* ── Fields ───────────────────────────────────────────────────────── */
.auth-form .form-group { margin-bottom: 1.05rem; }
.auth-form label {
  font-family: var(--font-body);
  font-size: .74rem;
  font-weight: 600;
  letter-spacing: .02em;
  color: var(--ink-soft);
  margin-bottom: .35rem;
}
.auth-form .form-control,
.auth-form .input-group-text {
  border-radius: 6px;
  border-color: #d8d2bd;
  font-family: var(--font-body);
  font-size: .92rem;
}
.auth-form .form-control {
  background: #fffdf8;
  color: var(--ink);
  padding: .55rem .75rem;
}
.auth-form .form-control::placeholder { color: var(--ink-soft); }
.auth-form .input-group-text {
  background: #f0ece0;
  color: #57503f;
}
.auth-form .form-control:focus {
  border-color: var(--brand-red);
  box-shadow: 0 0 0 .15rem rgba(210, 31, 39, .14);
}
.auth-form .input-group:focus-within .input-group-text {
  border-color: var(--brand-red);
  color: var(--brand-red);
}
.auth-form small.form-text { font-size: .74rem; color: var(--ink-soft); }

/* ── Brand button ───────────────────────────────────────────────── */
.btn-brand {
  background: linear-gradient(135deg, var(--brand-red) 0%, var(--brand-red-dark) 100%);
  border: none;
  color: #fff;
  font-family: var(--font-body);
  font-weight: 600;
  letter-spacing: .02em;
  padding: .62rem 1rem;
  border-radius: 6px;
  transition: filter .15s ease, transform .15s ease;
}
.btn-brand:hover, .btn-brand:focus {
  filter: brightness(1.08);
  color: #fff;
  transform: translateY(-1px);
}
.btn-brand:active { transform: translateY(0); }

/* ── Links ─────────────────────────────────────────────────────── */
/* :not(.btn) — an <a class="btn"> is a BUTTON, and carries its own
   background and text colour. Without this exclusion the rule below wins
   on specificity (0,0,1,1 beats .btn-brand's 0,0,1,0) and repaints every
   button-shaped anchor dark red: dark-red text on the red .btn-brand
   gradient measures 1.45:1 at the light end and 1:1 — invisible — at the
   dark end, against a WCAG AA floor of 4.5:1. Hit the "Back to login" /
   "Return to homepage" buttons on this page, activate.php and
   reset_password.php. Genuine inline links (the reset-link box, the
   footer link) are unaffected and keep the brand colour. */
.auth-shell a:not(.btn) { color: var(--brand-red-dark); font-weight: 600; text-decoration: none; }
.auth-shell a:not(.btn):hover { color: var(--brand-red); text-decoration: underline; }
.auth-foot {
  margin-top: 1.3rem;
  font-size: .82rem;
  text-align: center;
  color: var(--ink-soft);
}
.auth-foot-divider {
  border: none;
  border-top: 1px dashed var(--paper-rule);
  margin: 1.3rem 0;
}

.icheck-primary > input:first-child:checked + label::before {
  border-color: var(--brand-red) !important;
  background-color: var(--brand-red) !important;
}
.icheck-primary label { font-size: .84rem; color: var(--ink-soft); }

/* ── Password visibility toggle (a real <button>, not a decorative span) ── */
.toggle-pwd { cursor: pointer; }
.toggle-pwd:focus {
  outline: none;
  z-index: 3;
  position: relative;
  border-color: var(--brand-red);
  color: var(--brand-red);
  box-shadow: 0 0 0 .15rem rgba(210, 31, 39, .14);
}

/* ── Password strength meter, shared by activate.php and reset_password.php ── */
.strength-bar {
  height: 5px;
  border-radius: 3px;
  margin-top: 6px;
  background: #e9e3d2;
  overflow: hidden;
}
.strength-bar .fill {
  height: 100%;
  width: 100%;
  border-radius: 3px;
  transform: scaleX(0);
  transform-origin: left;
  transition: transform .3s ease, background-color .3s ease;
}
.strength-bar .fill.strength-1 { background: var(--strength-1); }
.strength-bar .fill.strength-2 { background: var(--strength-2); }
.strength-bar .fill.strength-3 { background: var(--strength-3); }
.strength-bar .fill.strength-4 { background: var(--strength-4); }
.strength-bar .fill.strength-5 { background: var(--strength-5); }

.strength-label {
  font-family: var(--font-mono);
  font-size: 11px;
  margin-top: 3px;
  min-height: 14px;
}
/* Bar-fill colors above are tuned for the vivid strip; label text needs its
   own darker set to clear 4.5:1 on the cream paper background. */
.strength-label.strength-1 { color: var(--strength-1); }
.strength-label.strength-2 { color: #8a5c08; }
.strength-label.strength-3 { color: #7c6712; }
.strength-label.strength-4 { color: #266b3c; }
.strength-label.strength-5 { color: var(--strength-5-ink); }

.match-msg {
  font-family: var(--font-body);
  font-weight: 500;
  font-size: 12px;
  min-height: 14px;
  margin-top: 6px;
  margin-bottom: 10px;
}
.match-msg.is-match    { color: var(--strength-5-ink); }
.match-msg.is-mismatch { color: var(--strength-1); }

/* ── Status screens (success / error / expired) inside the paper pane ── */
.auth-status {
  text-align: center;
  padding: .4rem 0 .2rem;
}
.auth-status .seal {
  width: 64px;
  height: 64px;
  margin: 0 auto 1rem;
  border-radius: 50%;
  display: flex;
  align-items: center;
  justify-content: center;
  font-size: 1.5rem;
  background: var(--ok-green-soft);
  color: var(--ok-green);
  box-shadow: 0 0 0 4px rgba(28, 138, 74, .12);
}
.auth-status.tone-danger .seal  { background: var(--err-red-soft);   color: var(--err-red); box-shadow: 0 0 0 4px rgba(194, 37, 48, .12); }
.auth-status.tone-warning .seal { background: var(--warn-amber-soft); color: var(--warn-amber); box-shadow: 0 0 0 4px rgba(185, 121, 10, .12); }
.auth-status h1 {
  font-family: var(--font-display);
  font-weight: 600;
  font-size: 1.3rem;
  color: var(--ink);
  margin-bottom: .5rem;
}
.auth-status p {
  font-size: .86rem;
  color: var(--ink-soft);
  line-height: 1.55;
}
/* The address a reset link was sent to — masked server-side, see
   calsys_mask_email() in forgot_password.php. Mono so the run of bullets
   reads as redacted data rather than prose, and full --ink rather than the
   surrounding --ink-soft because it is the one thing on this screen the
   reader actually needs to check (14.9:1 on --paper). break-all keeps a
   long address inside the card on a narrow phone. */
.masked-email {
  display: block;
  margin: .55rem 0;
  font-family: var(--font-mono);
  font-size: .95rem;
  font-weight: 600;
  color: var(--ink);
  word-break: break-all;
}
.reset-link-box {
  background: #fffdf8;
  border: 1px solid var(--paper-rule);
  border-radius: 6px;
  padding: 12px 14px;
  word-break: break-all;
  font-family: var(--font-mono);
  font-size: 12px;
  margin-top: 10px;
  text-align: left;
}

/* ── Responsive: stack panes, shrink the dial ────────────────────── */
@media (max-width: 860px) {
  .auth-shell { grid-template-columns: 1fr; max-width: 460px; }
  .auth-brand-pane {
    padding: 1.7rem 1.7rem 1.6rem;
    gap: 1rem;
  }
  .auth-brand-pane::after {
    top: auto; right: 0; left: 0; bottom: -1px;
    width: auto; height: 2px;
    background-image: radial-gradient(circle, var(--bench-line) 1.6px, transparent 2px);
    background-size: 13px 100%;
    background-repeat: repeat-x;
  }
  .auth-brand-copy { font-size: 1.2rem; }
  .auth-brand-sub { display: none; }
  .dial-wrap { margin-top: 0; flex-direction: row; gap: .9rem; padding-top: .3rem; }
  .dial { --dial-size: 56px; flex-shrink: 0; }
  .dial-tick { display: none; }
  .dial-caption { text-align: left; }
  .auth-form-pane { padding: 1.7rem 1.6rem; }
}