:root {
    --bg: #0f1117;
    --bg-panel: #161a23;
    --bg-card: #1b202c;
    --bg-hover: #222839;
    --border: #2a3142;
    --text: #e6e9f0;
    --text-dim: #9aa3b5;
    --accent: #3b82f6;
    --accent-hover: #2563eb;
    --green: #22c55e;
    --yellow: #eab308;
    --red: #ef4444;
    --mono: "SF Mono", "JetBrains Mono", Menlo, Consolas, monospace;
  }
  * { margin: 0; padding: 0; box-sizing: border-box; }
  body {
    background: var(--bg);
    color: var(--text);
    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", sans-serif;
    font-size: 14px;
    line-height: 1.5;
  }
  /* ---------- Layout ---------- */
  #app { display: none; min-height: 100vh; }
  #app.authed { display: flex; }
  .sidebar {
    width: 230px; flex-shrink: 0;
    background: var(--bg-panel);
    border-right: 1px solid var(--border);
    padding: 20px 0;
    display: flex; flex-direction: column;
    position: sticky; top: 0; height: 100vh;
  }
  .sidebar .brand {
    padding: 0 20px 18px;
    font-size: 16px; font-weight: 700;
    border-bottom: 1px solid var(--border);
    display: flex; align-items: center; justify-content: space-between;
  }
  .sidebar .brand span.accent { color: var(--accent); }
  .sidebar nav { flex: 1; padding-top: 12px; overflow-y: auto; }
  .sidebar nav a {
    display: flex; align-items: center; gap: 10px;
    padding: 10px 20px;
    color: var(--text-dim);
    text-decoration: none;
    font-size: 13.5px;
    border-left: 3px solid transparent;
    cursor: pointer;
  }
  .sidebar nav a:hover { background: var(--bg-hover); color: var(--text); }
  .sidebar nav a.active {
    color: var(--text);
    background: var(--bg-hover);
    border-left-color: var(--accent);
  }
  .sidebar nav a .icon { width: 18px; text-align: center; }
  .sidebar .foot { padding: 14px 20px; border-top: 1px solid var(--border); }
  main { flex: 1; padding: 28px 32px; min-width: 0; }
  .page-head { display: flex; align-items: center; justify-content: space-between; margin-bottom: 20px; }
  .page-head h1 { font-size: 20px; font-weight: 600; }
  .page-head .sub { color: var(--text-dim); font-size: 13px; margin-top: 2px; }
  .tab-panel { display: none; }
  .tab-panel.active { display: block; }
  /* Role-based UI: gateway users (role != admin) never see
     admin-only controls; the server enforces the same split. The
     role-user class is also applied when an admin previews the
     dashboard in user mode (admin-view-toggle), so the preview shows
     exactly what a regular user would see. */
  body.role-user [data-admin-only] { display: none !important; }
  /* Admin-view toggle: lets admins preview the dashboard as a regular
     user. Only rendered for real admins (role === "admin"); hidden by
     default and revealed by applyViewMode() once the identity loads. */
  #admin-view-toggle {
    display: none;
    width: 100%;
    margin-bottom: 8px;
    justify-content: space-between;
    gap: 8px;
  }
  body.role-admin #admin-view-toggle { display: flex; }
  #admin-view-toggle .mode-label { flex: 1; text-align: center; }
  #admin-view-toggle.active-user { border-color: var(--accent); color: var(--accent); }
  /* ---------- Login ---------- */
  #login {
    display: flex; align-items: center; justify-content: center;
    min-height: 100vh;
  }
  #app.authed ~ #login, body.authed #login { display: none; }
  .login-card {
    background: var(--bg-panel);
    border: 1px solid var(--border);
    border-radius: 12px;
    padding: 36px;
    width: 380px;
  }
  .login-card h1 { font-size: 20px; margin-bottom: 6px; }
  .login-card h1 span { color: var(--accent); }
  .login-card p { color: var(--text-dim); font-size: 13px; margin-bottom: 22px; }