/* Sign-in screen — the standalone, branded login shell (pages/login.php).
 *
 * These rules lived in an inline <style> block, which production CSP refuses:
 * `default-src 'self'` with no style-src and no 'unsafe-inline' blocks a <style> element exactly as
 * it blocks a style= attribute. The consequence was visible rather than theoretical — the live login
 * screen rendered with none of this applied: no card, no centring, no branded background, unstyled
 * inputs on a bare white page.
 *
 * It is its own asset rather than an addition to style.css because login is a standalone document:
 * it renders OUTSIDE the portal chrome, sets its own <body class="login-body">, and shares no
 * component with the authenticated app. Nothing else should ever load these rules.
 */
.login-body{min-height:100vh;margin:0;display:flex;align-items:center;justify-content:center;
  background:linear-gradient(160deg,#0f172a 0%,#1e293b 55%,#334155 100%);padding:24px;box-sizing:border-box}
.login-card{width:100%;max-width:380px;background:#fff;border-radius:14px;padding:30px 28px 24px;
  box-shadow:0 18px 50px rgba(2,6,23,.45);box-sizing:border-box}
.login-brand{display:flex;flex-direction:column;gap:2px;margin-bottom:6px}
.login-brand .b1{font-size:20px;font-weight:700;color:#0f172a;letter-spacing:-.01em}
.login-brand .b2{font-size:12px;color:#64748b;text-transform:uppercase;letter-spacing:.08em}
.login-card h1{font-size:16px;margin:16px 0 2px;color:#0f172a}
.login-card .sub{font-size:13px;color:#64748b;margin:0 0 16px}
.login-form label{display:block;font-size:12px;font-weight:600;color:#334155;margin:12px 0 5px}
.login-form input[type=email],.login-form input[type=password]{width:100%;box-sizing:border-box;
  padding:11px 12px;border:1px solid #cbd5e1;border-radius:9px;font-size:15px;background:#f8fafc}
.login-form input:focus{outline:none;border-color:#2563eb;background:#fff;box-shadow:0 0 0 3px rgba(37,99,235,.15)}
.login-remember{display:flex;align-items:center;gap:8px;font-size:13px;color:#475569;font-weight:500;margin:14px 0 4px}
.login-remember input{width:auto;margin:0}
.login-btn{width:100%;margin-top:14px;padding:12px;font-size:15px;font-weight:600;border:0;border-radius:9px;
  background:#2563eb;color:#fff;cursor:pointer}
.login-btn:hover{background:#1d4ed8}
.login-error{background:#fef2f2;border:1px solid #fecaca;color:#b91c1c;font-size:13px;
  padding:9px 12px;border-radius:9px;margin:14px 0 0}
.login-foot{margin:18px 0 0;font-size:11px;color:#94a3b8;text-align:center}
@media (max-width:420px){.login-card{padding:24px 18px}}

/* The legacy single-password gate renders INSIDE the portal layout, so it is a panel, not a shell.
   Its two inline attributes moved here and to the shared spacing scale in style.css. */
.login-legacy-panel{max-width:380px;margin:40px auto}
