<?php /** Login screen — rendered by layout.php when $page === 'login'. */ ?>
<div class="login-wrap">
    <form class="login-card" method="post" action="?page=login">
        <input type="hidden" name="csrf" value="<?= h(csrf_token()) ?>">
        <div class="login-logo">N</div>
        <h1 class="login-title">NADIPLAY</h1>
        <p class="login-sub">Admin Panel · Sign In</p>

        <?php foreach ($flashes as $f): ?>
            <div class="flash flash-<?= h($f['type']) ?>"><?= h($f['msg']) ?></div>
        <?php endforeach; ?>

        <label class="field">
            <span>Username</span>
            <input type="text" name="username" autocomplete="username" required autofocus value="<?= h($_POST['username'] ?? '') ?>">
        </label>
        <label class="field">
            <span>Password</span>
            <input type="password" name="password" autocomplete="current-password" required>
        </label>
        <button type="submit" class="btn-primary">Sign In</button>
        <p class="login-hint">
            Default: <code>admin</code> / <code>admin123</code> (set in <code>../api/config.php</code>)
        </p>
    </form>
</div>
