/* U8 security client (S10b-cli, S14b-cli; impl-plan §1, D-29): the second sign-in step, Konto →
   Sicherheit (QR, recovery codes), the Kanzlei workspace, Treuhandmandat, Zugriffsprotokoll and the
   Lohnläufe sum row. Tokens only (no colour literal, weights from the role tokens); desktop first. */

/* Second sign-in step */
.mfa-login-card .mfa-login-account { margin: -12px 0 16px; color: var(--text-secondary); }
.mfa-login-card .mfa-code-input { max-width: 180px; font-family: var(--font-mono); font-size: var(--text-lg); letter-spacing: .12em; font-variant-numeric: tabular-nums lining-nums; }
.mfa-login-card .mfa-recovery-input { font-family: var(--font-mono); letter-spacing: .04em; text-transform: uppercase; }
.mfa-login-links { display: flex; flex-wrap: wrap; justify-content: space-between; gap: 8px; }

/* User menu: the count of unread security notices beside «Sicherheit». */
.user-menu .menu-item .menu-count { margin-left: auto; min-width: 20px; padding: 0 6px; border-radius: var(--radius-xs); background: var(--amber-3); color: var(--warning-fg); font-size: var(--text-xs); line-height: 20px; font-weight: var(--weight-semibold); text-align: center; }

/* Sicherheit */
/* D-29: the page (head included) spans the content width; only the cards keep a reading width. */
.sec-root { display: grid; gap: var(--space-5, 20px); }
.sec-root > .page-head { margin-bottom: 0; }
.sec-root > .sec-card { max-width: 880px; }
.sec-card { display: grid; gap: 12px; }
.sec-card h2 { margin: 0; font-size: var(--text-lg); line-height: var(--lh-lg); font-weight: var(--weight-semibold); }
.sec-card .card-head { display: grid; gap: 4px; }
.sec-card .notice { margin: 0; }
.sec-facts { max-width: 560px; }
.sec-actions { flex-wrap: wrap; justify-content: flex-start; }
.sec-notice-list { display: grid; gap: 8px; margin: 0; padding: 0; list-style: none; font-size: var(--text-sm); line-height: var(--lh-sm); }
.sec-notice-list time { display: block; color: var(--text-muted); font-size: var(--text-xs); line-height: var(--lh-xs); }
.sec-steps { margin: 0; padding-left: 20px; color: var(--text-secondary); font-size: var(--text-sm); line-height: var(--lh-sm); }
.sec-qr-row { display: flex; flex-wrap: wrap; align-items: center; gap: 24px; }
.sec-qr { margin: 0; padding: 8px; border: 1px solid var(--border-hairline); border-radius: var(--radius); background: var(--paper); line-height: 0; }
.sec-qr svg { display: block; width: 200px; height: 200px; }
.sec-key { display: grid; gap: 6px; min-width: 0; }
.sec-secret { display: inline-block; padding: 6px 8px; border-radius: var(--radius-sm); background: var(--stone-3); color: var(--text-primary); font-size: var(--text-md); letter-spacing: .06em; overflow-wrap: anywhere; user-select: all; }
.sec-code-input { max-width: 180px; font-family: var(--font-mono); letter-spacing: .12em; font-variant-numeric: tabular-nums lining-nums; }
.sec-codes { display: grid; grid-template-columns: repeat(2, minmax(0, max-content)); gap: 8px 32px; margin: 0; padding-left: 28px; font-size: var(--text-md); }
.sec-codes code { font-size: var(--text-md); letter-spacing: .04em; user-select: all; }
/* Without a company: the sign-in layout; the forms are not cards inside the card (D-29). */
.sec-gate-card { display: grid; gap: 16px; width: min(560px, 100%); }
.sec-gate-card .sec-card { padding: 0; border: 0; background: transparent; box-shadow: none; }
.sec-gate-card .sec-codes { grid-template-columns: repeat(2, minmax(0, 1fr)); }
.sec-gate-actions { justify-content: flex-end; }

/* Kanzlei */
.kz-root { display: grid; grid-template-columns: minmax(0, 1fr); gap: 16px; }
.kz-root > *, .tm-root > *, .zp-root > * { min-width: 0; }
.kz-root > .page-head { margin-bottom: 0; }
.kz-root > .status-tabs { margin-bottom: 0; }
.kz-card .section-head { min-height: 48px; }
.kz-card-body { padding: 0 0 4px; }
.kz-card-body > .status-tabs { margin: 8px var(--card-pad) 0; }
.kz-card-body > p.kz-empty { margin: 0; padding: 12px var(--card-pad); }
.kz-card-body > .form-actions { padding: 8px var(--card-pad); }
.kz-toolbar { display: flex; flex-wrap: wrap; align-items: flex-end; justify-content: space-between; gap: 12px; }
.kz-toolbar > .status-tabs { flex: 1 1 auto; margin-bottom: 0; }
.kz-search { display: flex; align-items: center; gap: 8px; }
.kz-search .input { width: 260px; }
.kz-search .select { width: auto; }
.kz-table td { vertical-align: top; }
.kz-people { margin: 0; padding: 0; list-style: none; }
.kz-people li + li { margin-top: 2px; }
/* The row actions wrap inside their cell (never the page). */
.kz-actions { min-width: 180px; white-space: normal; }
.kz-actions .btn { margin: 2px 4px 2px 0; }
.kz-card .table-wrap { overflow-x: auto; }
.kz-facts { max-width: 480px; padding: 0 var(--card-pad); }
.kz-affected { margin: 8px 0 0; padding-left: 20px; }
.kz-scope, .kz-checklist { margin: 0; padding: 0; border: 0; display: grid; gap: 6px; }
.kz-scope legend, .kz-checklist legend { margin-bottom: 4px; padding: 0; color: var(--text-secondary); font-size: var(--text-sm); font-weight: var(--weight-medium); }
.kz-checklist-items { display: grid; gap: 6px; max-height: 240px; overflow: auto; padding: 8px; border: 1px solid var(--border-hairline); border-radius: var(--radius-sm); }
.kz-assign { width: min(760px, 100%); }
.kz-standalone { min-height: 100vh; background: var(--bg-app); }
.kz-standalone-head { display: flex; align-items: center; gap: 12px; height: var(--topbar-height); padding: 0 var(--page-gutter); border-bottom: 1px solid var(--border-hairline); background: var(--paper); }
/* The mark of the sidebar head (24 px), not the 44 px mark of the sign-in page. */
.kz-standalone-head .brand-mark { width: 24px; height: 24px; font-size: 14px; border-radius: var(--radius-sm); }
.kz-standalone-actions { display: flex; gap: 8px; margin-left: auto; }
.kz-standalone > .page { max-width: var(--page-max); padding: var(--page-top) var(--page-gutter); }

/* Treuhandmandat */
.tm-root { display: grid; gap: 16px; }
.tm-root > .page-head { margin-bottom: 0; }
.tm-root > .tm-card { max-width: 1080px; }
.tm-card { display: grid; gap: 12px; }
.tm-card .notice { margin: 0; }
.tm-facts { max-width: 640px; }
.tm-subtitle { margin: 4px 0 0; font-size: var(--text-md); line-height: var(--lh-md); font-weight: var(--weight-semibold); }
.tm-consent { max-width: 76ch; padding: 12px 16px; border: 1px solid var(--border-hairline); border-radius: var(--radius-sm); background: var(--stone-2); font-size: var(--text-sm); line-height: var(--lh-sm); }
.tm-consent p { margin: 0 0 8px; }
.tm-consent p:last-child { margin-bottom: 0; }
.tm-accept { max-width: 560px; }

/* Zugriffsprotokoll */
.zp-root { display: grid; gap: 16px; }
.zp-root > .page-head { margin-bottom: 0; }
.zp-root > .notice { margin: 0; }
.zp-filter { display: flex; flex-wrap: wrap; align-items: flex-end; gap: 12px; }
.zp-filter .field { margin: 0; }

/* Lohnläufe: the server's sums under Brutto and Netto (listen-summen lohnlaeufe; D-07). */
.data-table tfoot .payroll-sum-row > :is(th, td) { padding: 7px 10px 6px; border-top: 1px solid var(--line-strong); background: var(--bg-subtle); color: var(--text-primary); font-weight: var(--weight-semibold); white-space: nowrap; }
.data-table tfoot .payroll-sum-row > th { text-align: left; }
.data-table tfoot .payroll-sum-row > td.grid-sum-value { text-align: right; font-variant-numeric: tabular-nums lining-nums; }

/* Printing the recovery codes: only the sheet (the shell is hidden by the print rules of styles.css;
   on the enrolment page without a company, the sign-in hero). */
@media print {
  .sec-root[data-sheet] > :not(.sec-codes-sheet) { display: none !important; }
  .sec-gate-page .auth-hero { display: none !important; }
  .sec-codes-sheet { border: 0; padding: 0; }
}