/* ---------------------------------------------------------------------------
 * auth.css — page layout for sign in, sign up, forgot password and reset
 * password ONLY.
 *
 * Every control (input, select, checkbox, label, hint, error) comes from
 * forms.css, and every button from base.css. This sheet adds the centred
 * card shell and the small links around it, nothing more. Tokens only.
 * ------------------------------------------------------------------------- */

/* Centres the card and keeps it narrow on every viewport. 420px matches the
   design; the card itself never exceeds the container, so 375px does not
   scroll sideways. */
.auth {
  display: flex;
  justify-content: center;
}
.auth__inner {
  width: 100%;
  max-width: 440px;
  min-width: 0;
}

.auth-card {
  background: var(--surface-2);
  border: 1px solid var(--border-hairline);
  border-radius: var(--radius-lg);
  padding: clamp(var(--space-6), 5vw, var(--space-8));
  box-shadow: var(--elev-2), var(--elev-2-highlight);
}

.auth-card__title {
  font-family: var(--font-display);
  font-size: var(--h3-size);
  line-height: var(--h3-lh);
  font-weight: var(--h1-weight);
  letter-spacing: var(--h2-tracking);
  color: var(--text-primary);
  margin: 0 0 var(--space-2);
}
.auth-card__intro {
  font-size: var(--body-sm-size);
  line-height: 1.55;
  font-weight: 300;
  color: var(--text-secondary);
  margin: 0 0 var(--space-6);
}

/* Inline failure notice.
   Needed because req.flash() called during a request that then RE-RENDERS does
   not reach that response: middleware/locals.js copies session flash into
   res.locals at the start of the request, before the handler pushes anything.
   Login and sign-up both re-render on failure, so without this the customer
   would see a 401/400 page with no explanation. Route code is untouched. */
.auth-alert {
  display: flex;
  align-items: flex-start;
  gap: var(--space-3);
  background: var(--surface-1);
  border: 1px solid var(--error-border);
  border-left: 3px solid var(--error);
  border-radius: var(--radius-md);
  padding: var(--space-4);
  margin-bottom: var(--space-5);
  font-size: 13px;
  line-height: 1.5;
  color: var(--text-secondary);
}

/* Spacing between the stacked fields inside a card. */
.auth-fields { margin-bottom: var(--space-6); }

/* Row that holds the forgot-password link, and the sign-up consent tick box.
   Wraps at 375px. */
.auth-row {
  display: flex;
  align-items: center;
  justify-content: space-between;
  flex-wrap: wrap;
  gap: var(--space-3);
  margin-bottom: var(--space-6);
}
.auth-link {
  font-family: var(--font-display);
  font-size: var(--body-sm-size);
  font-weight: 600;
  color: var(--accent-purple);
}
.auth-link:hover { color: var(--accent-pink); }

.auth-card__foot {
  text-align: center;
  font-size: var(--body-sm-size);
  line-height: 1.55;
  color: var(--text-secondary);
  margin: var(--space-5) 0 0;
}
.auth-card__foot a { font-weight: 600; }

/* Small print under the submit button (e.g. the verification-email note). */
.auth-note {
  text-align: center;
  font-size: 13px;
  line-height: 1.55;
  color: var(--text-muted);
  margin: var(--space-5) 0 0;
}