/* Neutral decoy styles (spec §7). Deliberately generic — a plain "service unavailable"
   page. No app branding, no "Possum", nothing that hints at what loads after the knock. */
* {
  box-sizing: border-box;
}
html,
body {
  margin: 0;
  height: 100%;
  background: #0e0f12;
  color: #b8bcc4;
  font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
}
.wrap {
  min-height: 100%;
  display: flex;
  align-items: center;
  justify-content: center;
  padding: 24px;
}
.box {
  max-width: 360px;
  width: 100%;
  text-align: center;
}
.ttl {
  font-size: 18px;
  font-weight: 600;
  color: #d6d9df;
  margin-bottom: 8px;
}
.sub {
  font-size: 14px;
  line-height: 1.5;
  color: #7d828c;
}
/* The catchphrase input is visually understated (a thin underline) so it reads as part of a
   dead page rather than an obvious login. It still works for a keyboard user. */
#g {
  margin-top: 22px;
}
#k {
  width: 100%;
  background: transparent;
  border: none;
  border-bottom: 1px solid #23262c;
  color: #b8bcc4;
  font-size: 15px;
  padding: 8px 4px;
  outline: none;
  text-align: center;
}
#k:focus {
  border-bottom-color: #3a3f48;
}
noscript {
  display: block;
  text-align: center;
  padding: 24px;
  color: #7d828c;
}
/* Neutral DEMO banner, only injected on a STAGING deploy (server-side, class-driven so the
   strict CSP holds — no inline style). Deliberately carries no app name. */
.env-banner {
  position: fixed;
  top: 0;
  left: 0;
  right: 0;
  z-index: 1000;
  text-align: center;
  padding: 6px 12px;
  font-size: 12px;
  font-weight: 600;
  letter-spacing: 0.08em;
  text-transform: uppercase;
  color: #0e0f12;
  background: #d6a200;
}