/* security.css — Integrations → "Additional security" card + the
   full-screen TOTP login gate (auth_gate.js).

   Visual language matches sections.css / modal.css so the new card and
   modals don't look like a foreign body in the rest of the panel. */

/* ── Card body ──────────────────────────────────────────────────────────── */

.security-list {
  display: flex;
  flex-direction: column;
  gap: 0.75rem;
}

.sec-row {
  border: 1px solid var(--border);
  border-radius: 12px;
  padding: 0.85rem 1rem;
  background: var(--security-row-bg);
  display: flex;
  flex-direction: column;
  gap: 0.4rem;
}

.sec-row-head {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 0.6rem;
}
.sec-row-title {
  display: inline-flex;
  align-items: center;
  gap: 0.5rem;
  font-size: 0.95rem;
}
.sec-emoji { font-size: 1.05rem; }

.sec-status {
  font-size: 0.78rem;
  letter-spacing: 0.04em;
  text-transform: uppercase;
  padding: 2px 8px;
  border-radius: 999px;
}
.sec-status-on  { background: var(--security-on-bg); color: var(--security-on-text); }
.sec-status-off { background: var(--security-off-bg); color: var(--security-off-text); }

.sec-row-desc {
  margin: 0;
  font-size: 0.85rem;
  opacity: 0.85;
  line-height: 1.4;
}

.sec-row-actions {
  display: flex;
  gap: 0.5rem;
  margin-top: 0.25rem;
  flex-wrap: wrap;
}

.sec-backup-line { font-size: 0.8rem; opacity: 0.75; margin: 0; }

/* ── In-modal styling (setup / disable / regen) ─────────────────────────── */

.sec-step-intro {
  margin: 0 0 0.5rem 0;
  font-size: 0.9rem;
  line-height: 1.45;
}

.sec-qr-wrap {
  display: flex;
  justify-content: center;
  margin: 0.6rem 0 0.75rem 0;
}
.sec-qr {
  width: 200px;
  height: 200px;
  background: #fff;
  padding: 8px;
  border-radius: 10px;
}

.sec-secret {
  display: block;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 0.95rem;
  letter-spacing: 0.05em;
  background: var(--surface-control);
  padding: 0.55rem 0.7rem;
  border-radius: 8px;
  margin: 0.25rem 0 0.85rem 0;
  user-select: all;
  word-break: break-all;
}

.sec-code-input {
  width: 100%;
  font-size: 1.4rem;
  letter-spacing: 0.18em;
  text-align: center;
  padding: 0.55rem 0.6rem;
  border-radius: 10px;
  border: 1px solid var(--border2, var(--border));
  background: var(--surface-control);
  color: inherit;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  margin: 0.4rem 0 0.5rem 0;
}
.sec-code-input:focus {
  outline: none;
  border-color: var(--accent);
}

.sec-error {
  color: var(--danger-action);
  font-size: 0.85rem;
  margin: 0 0 0.4rem 0;
}

.sec-warn {
  background: var(--byok-soft);
  color: var(--text);
  border-radius: 8px;
  padding: 0.5rem 0.7rem;
  font-size: 0.85rem;
  margin: 0.25rem 0 0.6rem 0;
}

.sec-modal-foot {
  display: flex;
  justify-content: flex-end;
  gap: 0.5rem;
  margin-top: 0.6rem;
}
.sec-modal-foot .danger {
  background: var(--err);
  color: var(--on-accent-solid);
  border: 1px solid var(--err);
}
.sec-modal-foot .danger:hover { background: var(--danger-action-hover); }
.sec-row-actions .danger {
  background: transparent;
  color: var(--danger-action);
  border: 1px solid color-mix(in srgb, var(--err) 55%, transparent);
}
.sec-row-actions .danger:hover { background: var(--err); color: var(--on-accent-solid); }

.sec-backup-list {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 0.35rem 1rem;
  margin: 0.4rem 0 0.6rem 0;
  padding-left: 1rem;
  list-style: none;
}
.sec-backup-list li {
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 0.95rem;
  letter-spacing: 0.06em;
}
.sec-backup-list code {
  background: transparent;
  padding: 0;
  font-size: inherit;
}

/* ── Full-screen auth gate (auth_gate.js) ───────────────────────────────── */

.auth-gate-overlay {
  position: fixed;
  inset: 0;
  z-index: 100000;            /* above modal-overlay (9999) */
  background: color-mix(in srgb, var(--bg) 92%, transparent);
  backdrop-filter: blur(8px);
  display: flex;
  align-items: center;
  justify-content: center;
  padding: 1rem;
}

.auth-gate-card {
  background: var(--card);
  border: 1px solid var(--border2);
  border-radius: 14px;
  padding: 1.25rem 1.4rem 1.4rem 1.4rem;
  width: min(420px, 100%);
  box-shadow: 0 18px 54px rgba(0, 0, 0, 0.55);
}

.auth-gate-head {
  display: flex;
  align-items: center;
  gap: 0.6rem;
  margin-bottom: 0.6rem;
}
.auth-gate-icon { font-size: 1.4rem; }
.auth-gate-title { font-size: 1.05rem; font-weight: 600; }

.auth-gate-intro {
  margin: 0 0 0.65rem 0;
  font-size: 0.9rem;
  line-height: 1.45;
  opacity: 0.85;
}

.auth-gate-input {
  width: 100%;
  font-size: 1.5rem;
  letter-spacing: 0.2em;
  text-align: center;
  padding: 0.55rem 0.6rem;
  border-radius: 10px;
  border: 1px solid var(--border2, var(--border));
  background: var(--surface-control);
  color: inherit;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
}
.auth-gate-input:focus { outline: none; border-color: var(--accent); }

.auth-gate-error {
  color: var(--danger-action);
  font-size: 0.85rem;
  margin: 0.55rem 0 0 0;
}

/* One shape for every full-width action in a gate card, so the primary button
   and the Telegram one measure identically and read as one set. The Telegram
   action is an <a> and inherits NOTHING from base.css's `button` rule, so the
   geometry that rule would have supplied — font size, weight, line height — is
   spelled out here for both rather than left to differ by element name. */
.auth-gate-submit,
.auth-gate-telegram {
  display: flex;
  align-items: center;
  justify-content: center;
  gap: 0.5rem;
  width: 100%;
  margin-top: 0.7rem;
  padding: 0.6rem 0.8rem;
  border-radius: 10px;
  font-size: 0.82rem;
  font-weight: 600;
  line-height: 1.2;
  text-decoration: none;
  cursor: pointer;
}

.auth-gate-hint {
  margin: 0.85rem 0 0 0;
  font-size: 0.8rem;
  opacity: 0.7;
  text-align: center;
}

/* Telegram is the other half of the same invitation, not a footnote, so it
   gets a real button in Telegram's own blue. No rule separates the two: they
   are different destinations, not a second attempt at the first one, and a
   hairline between two adjacent buttons only adds a line to look at.
   The transparent border keeps this box exactly as tall as the primary
   button's bordered one. */
.auth-gate-telegram {
  border: 1px solid transparent;
  background: #229ed9;          /* Telegram brand blue */
  color: #fff;
  transition: background 0.15s ease;
}
.auth-gate-telegram:hover { background: #2aabee; color: #fff; }
.auth-gate-telegram:focus-visible {
  outline: 2px solid var(--accent);
  outline-offset: 2px;
}

.auth-gate-telegram-mark {
  width: 1.1rem;
  height: 1.1rem;
  flex: none;
  fill: currentColor;
}

/* The hint belongs to the button right above it, not to the card. */
.auth-gate-telegram + .auth-gate-hint { margin-top: 0.55rem; }

/* The login page (login.html) reuses the gate card. "Keep me signed in" is a
   plain checkbox row; its note sits right under it, left-aligned like the
   row, not centred like the card's other hints. The e-mail way is the same
   full-width shape as the primary button, in the card's own colours. */
.login-keep {
  display: flex;
  align-items: flex-start;
  gap: 0.5rem;
  margin-top: 0.9rem;
  font-size: 0.85rem;
  cursor: pointer;
}
.login-keep input { margin: 0.15rem 0 0 0; flex: none; }
.login-keep-note { margin-top: 0.35rem; text-align: left; padding-left: 1.4rem; }
.login-email {
  border: 1px solid var(--btn-border);
  background: var(--btn-bg);
  color: var(--btn-text);
}
.login-email:hover {
  border-color: var(--btn-hover-border);
  background: var(--btn-hover-bg);
  color: var(--btn-hover-text);
}

/* Sessions & devices: the idle-expiry picker. */
.sec-expiry-label {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  justify-content: space-between;
  gap: 0.5rem;
}
.sec-expiry-label select { max-width: 100%; }