/* Level Up — MSAL auth gate + fail-closed visibility (styles/auth.css)

   The body ships data-auth-state="checking" in STATIC HTML. Every body child
   except the gate stays display:none in ANY state but signed-in — so the app can
   never flash before auth completes, even if JavaScript fails entirely.
   scripts/auth.js advances the state: checking | signed-out | signed-in | error.
   There is no bypass.

   The selector is deliberately "every body child that isn't the gate" rather than
   a hand-kept list, so a region added to index.html later is protected by default.
   Tokens come from styles/levelup.css. */
body:not([data-auth-state="signed-in"]) > :not(#auth-gate):not(script){display:none!important;}
body[data-auth-state="signed-in"] > #auth-gate{display:none;}
/* The mobile layout pads the body for the fixed bottom tab bar — not while gated. */
body:not([data-auth-state="signed-in"]){padding-bottom:0!important;}

.auth-gate{position:fixed;inset:0;z-index:1000;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:14px;background:var(--navy-deep);text-align:center;padding:24px;}
.auth-logo{height:36px;width:auto;margin-bottom:6px;}
.auth-title{font-family:var(--display);font-size:26px;font-weight:800;color:#fff;letter-spacing:-.01em;}
.auth-msg{font-size:14px;color:rgba(255,255,255,.65);max-width:380px;line-height:1.55;}
.auth-btn{margin-top:8px;padding:10px 22px;border-radius:10px;background:var(--lime);border:none;color:#13283D;font-family:var(--body);font-size:15px;font-weight:700;cursor:pointer;}
.auth-btn:hover{filter:brightness(.96);}
/* The button ships [hidden] and auth.js un-hides it. Nothing here sets display
   on it, so the UA rule works — restated anyway (the .nav-logo-link lesson). */
.auth-btn[hidden]{display:none;}