/* ============================================================================
   auth-tokens.css — THE single palette source for the pre-auth surface.

   Cycle-14 R2-M0662 (E-27). Before this file existed, every view under
   Views/Auth/ spelled its own colours as raw hex literals inline: 173 hex
   literals in CSS position across 12 views, 58 distinct spellings, the same
   brand purple respelled 19 times and its darker partner 15 times. There was
   no one place to change the auth palette, so a brand change meant a hunt
   through fifteen Razor files, and "the auth blue" could drift a digit per
   file without anything noticing.

   SCOPE — the pre-auth surface ONLY (Views/Auth/*.cshtml). This is NOT a
   platform-wide design-token system: no owner ruling governs design tokens
   anywhere in the ruling pack, so nothing here is imposed on Views/Admin,
   Views/Member or the dashboard theme. wwwroot/css/vg-dashboard-theme.css
   remains the owner of the signed-in `data-theme` palettes and of the
   --sidebar/--hero/--accent/--main-bg/--card-bg/--text-1/--text-2 names the
   six themes switch at runtime; this file deliberately uses a distinct
   `--auth-` prefix so the two can never collide.

   NAMED BY ROLE, NOT BY COLOUR. A token called `--auth-orange` starts lying
   the moment the brand stops being orange. Every name below says what the
   colour is FOR.

   VALUE-IDENTICAL. Introducing this file changed no rendered colour. Each
   token carries exactly the hex the views already painted. Where one colour
   served two roles (#ffffff is both the card surface and the ink on the brand
   bar) it gets two tokens with the same value, because those two roles will
   not move together. Where two near-identical colours were found they were
   KEPT APART — see the "near neighbours" note at the end — because merging
   them would have silently repainted a page.

   Guarded by tests/MealMatrixServer.Tests/Views/AuthPaletteTokenTests.cs:
   Razor is runtime-compiled here, so a colour regression in a .cshtml fails
   no build and no controller test. The source scan is the only guard there is.
   ============================================================================ */

:root {
    /* ── Brand ──────────────────────────────────────────────────────────────
       --auth-brand          primary action: submit buttons, focus rings, links
       --auth-brand-strong   the darker partner: header bars, hover states
       --auth-brand-deep     deepest step: button hover on the verification
                             surface, and the badge ink that sits on -wash
       --auth-brand-alt      the registration surface's own primary
       --auth-brand-tint     the lavender page ground behind the login card
       --auth-brand-wash     the lightest brand ground: page background on the
                             password/verification surfaces, info-banner fill */
    --auth-brand: #534ab7;
    --auth-brand-strong: #3d3494;
    --auth-brand-deep: #4338ca;
    --auth-brand-alt: #667eea;
    --auth-brand-tint: #ede9fa;
    --auth-brand-wash: #eef2ff;

    /* ── Accent ─────────────────────────────────────────────────────────────
       --auth-accent         the brand's contrast accent (login/role switcher)
       --auth-accent-alt     the registration surface's accent for icons and
                             emphasised labels */
    --auth-accent: #f26522;
    --auth-accent-alt: #ff9f43;

    /* ── Surfaces ───────────────────────────────────────────────────────────
       --auth-surface        the card the form sits on
       --auth-surface-subtle a recessed panel inside a card
       --auth-input-bg       the field fill
       --auth-page-bg        the neutral page ground
       --auth-page-bg-alt    the second page ground (the cooler of the two —
                             kept separate, see "near neighbours") */
    --auth-surface: #ffffff;
    --auth-surface-subtle: #f8f9ff;
    --auth-input-bg: #fdfdfd;
    --auth-page-bg: #f8fafc;
    --auth-page-bg-alt: #f4f6fb;

    /* ── Text ───────────────────────────────────────────────────────────────
       --auth-on-brand       ink ON a brand-filled bar or button. Same value as
                             --auth-surface today; a SEPARATE token because it
                             must track the brand, not the card.
       --auth-text           default body ink
       --auth-text-strong    the strongest heading ink
       --auth-text-heading   section headings on the registration surface
       --auth-text-body      long-form paragraph ink
       --auth-text-secondary supporting copy under a heading
       --auth-text-soft      the registration surface's body ink
       --auth-text-label     form-label ink
       --auth-text-muted     de-emphasised captions and helper text
       --auth-text-muted-alt the registration surface's muted caption ink
       --auth-text-subtle    the faintest legible caption / disabled hint
       --auth-text-placeholder  empty-field prompt ink
       --auth-text-disabled     a control that cannot be used
       --auth-heading-brand     heading ink where the ground is --auth-brand-tint
       --auth-text-on-tint-muted  muted ink on that same tinted ground */
    --auth-on-brand: #ffffff;
    --auth-text: #1f2937;
    --auth-text-strong: #111827;
    --auth-text-heading: #334155;
    --auth-text-body: #475569;
    --auth-text-secondary: #4b5563;
    --auth-text-soft: #555;
    --auth-text-label: #374151;
    --auth-text-muted: #6b7280;
    --auth-text-muted-alt: #64748b;
    --auth-text-subtle: #9ca3af;
    --auth-text-placeholder: #b0b8c9;
    --auth-text-disabled: #c4c8d8;
    --auth-heading-brand: #1a1340;
    --auth-text-on-tint-muted: #6b6490;

    /* ── Borders ────────────────────────────────────────────────────────────
       --auth-border            default hairline
       --auth-border-strong     the heavier field outline
       --auth-border-soft       the registration surface's field outline
       --auth-border-alt        the reset/set-password field outline
       --auth-border-brand      brand-tinted divider
       --auth-border-brand-soft the lightest brand-tinted hairline */
    --auth-border: #e5e7eb;
    --auth-border-strong: #d1d5db;
    --auth-border-soft: #ddd;
    --auth-border-alt: #dbe3f0;
    --auth-border-brand: #dbe4ff;
    --auth-border-brand-soft: #e4e9ff;

    /* ── Danger ─────────────────────────────────────────────────────────────
       --auth-danger             the danger fill (expired-link header bar)
       --auth-danger-icon        a danger glyph
       --auth-danger-text        validation-summary ink
       --auth-danger-text-deep   the darker danger ink
       --auth-danger-link        a destructive/secondary link
       --auth-danger-bg          validation-summary fill
       --auth-danger-bg-soft     the lighter alert fill
       --auth-danger-bg-alt      the third alert fill (see "near neighbours")
       --auth-danger-border      alert hairline
       --auth-danger-border-soft the lighter alert hairline */
    --auth-danger: #dc2626;
    --auth-danger-icon: #ef4444;
    --auth-danger-text: #b91c1c;
    --auth-danger-text-deep: #991b1b;
    --auth-danger-link: #b02a37;
    --auth-danger-bg: #fee2e2;
    --auth-danger-bg-soft: #fff5f5;
    --auth-danger-bg-alt: #fff1f2;
    --auth-danger-border: #fca5a5;
    --auth-danger-border-soft: #fecaca;

    /* ── Success ────────────────────────────────────────────────────────────
       --auth-success             a success glyph
       --auth-success-text        success ink
       --auth-success-text-strong the emphasised success ink
       --auth-success-bg          success panel fill
       --auth-success-border      success panel hairline */
    --auth-success: #16a34a;
    --auth-success-text: #166534;
    --auth-success-text-strong: #15803d;
    --auth-success-bg: #f0fdf4;
    --auth-success-border: #bbf7d0;

    /* ── Warning ────────────────────────────────────────────────────────────
       --auth-warning-text    warning ink (the password-expired notice)
       --auth-warning-border  warning hairline
       --auth-warning-bg      warning fill */
    --auth-warning-text: #c2410c;
    --auth-warning-border: #fb923c;
    --auth-warning-bg: #fff7ed;

    /* ── Info ───────────────────────────────────────────────────────────────
       --auth-info-text          info-banner ink
       --auth-info-text-strong   the emphasised info ink
       --auth-info-border        info hairline
       --auth-info-border-strong the heavier info hairline
       --auth-info-bg            info fill
       --auth-link               an in-copy hyperlink */
    --auth-info-text: #3730a3;
    --auth-info-text-strong: #1d4ed8;
    --auth-info-border: #c7d2fe;
    --auth-info-border-strong: #60a5fa;
    --auth-info-bg: #eff6ff;
    --auth-link: #2563eb;
}

/* ── Near neighbours, deliberately NOT merged ────────────────────────────────
   These pairs are close enough to look like one colour typed twice. They are
   NOT the same colour, so each keeps its own token. Merging any pair would
   repaint a live page, and this change repaints nothing. If a designer later
   rules that a pair should converge, that is a colour decision made once,
   here, which is the whole point of this file.

     --auth-page-bg           #f8fafc   vs  --auth-page-bg-alt        #f4f6fb
     --auth-danger-text       #b91c1c   vs  --auth-danger-text-deep   #991b1b
     --auth-danger-bg-soft    #fff5f5   vs  --auth-danger-bg-alt      #fff1f2
     --auth-border-alt        #dbe3f0   vs  --auth-border-brand       #dbe4ff
     --auth-accent            #f26522   vs  --auth-accent-alt         #ff9f43
     --auth-text-muted        #6b7280   vs  --auth-text-muted-alt     #64748b

   Case folding WAS applied: the views spell white as both `#ffffff` and
   `#fff`, which are the same colour, so both collapsed onto --auth-surface /
   --auth-on-brand. No two spellings that differ by an actual digit were
   collapsed.

   NOT COVERED BY THIS FILE (and deliberately left as raw hex in the views):
     • the five <rect fill="#fff"/> in the inline SVG logo on Login.cshtml and
       SelectRole.cshtml — an SVG presentation attribute does not accept a
       var() reference, and currentColor was rejected because the surrounding
       .logo-zone does not already carry the right colour.
     • the six runtime theme definitions in the <script> of Login.cshtml and
       SelectRole.cshtml, and the SweetAlert button colours in Register.cshtml
       — a hex inside a JavaScript string literal is not a CSS value and no
       custom property can reach it.
   Both sets are enumerated as named exemptions in AuthPaletteTokenTests. */