- Move 374-line inline style block from login.php into assets/style.css (Phase 2 section)
- Add auth-page, auth-card, auth-tabs, auth-form, profile-shell and related
classes to the main stylesheet as the single source of truth for all styles
- Fix Firebase v10 compat SDK error code: auth/invalid-credential now handled
alongside legacy auth/wrong-password and auth/user-not-found codes
- Harden api/session.php: add Content-Type JSON header, email format validation,
and a full security documentation comment explaining the token trust model
- Add FOUC comment to partials/head.php clarifying dark-only design intent
smacks
01a6d0f00a