fix(system): constrain stretched layout, real save icon, de-Caddy copy, SSH-reset hint

System page capped to a readable width; Speichern gets a proper save glyph (added
save/eye/eye-off/user-plus to the icon set); operator-facing 'Caddy' softened to
neutral wording; added a 'fully locked out -> SSH + clusev:reset-admin' hint. Settings
email field to type=text.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lang/de/system.php

@@ -25,6 +25,7 @@ return [
     'domain_invalid' => 'Bitte eine gültige Domain eingeben (z. B. panel.example.com) — ohne http://, Port oder Pfad.',
     'access_address' => 'Zugriffsadresse',
     'access_bare_ip' => 'HTTP (Bare-IP)',
+    'ssh_reset_hint' => 'Komplett ausgesperrt? Per SSH auf den Host einloggen und `clusev:reset-admin` ausführen, um den Zugang zurückzusetzen.',
 
     // Change-domain confirmation modal
     'change_domain_heading' => 'Domain ändern',
@@ -56,14 +57,14 @@ return [
 
     // TLS-mode selector
     'tls_mode_title' => 'TLS-Terminierung',
-    'tls_mode_caddy' => 'Caddy (Let\'s Encrypt, automatisch)',
+    'tls_mode_caddy' => 'Eingebautes TLS (Let\'s Encrypt, automatisch)',
     'tls_mode_caddy_desc' => 'Das Panel holt selbst ein Zertifikat für die Domain.',
     'tls_mode_external' => 'Externer Reverse-Proxy',
     'tls_mode_external_desc' => 'Ein Proxy davor (z. B. Zoraxy) terminiert TLS; das Panel liefert HTTP.',
-    'tls_external_hint' => 'Externer Proxy: setze TRUSTED_PROXY_CIDR auf die Adresse deines Proxys und schütze den HTTP-Port per Firewall, sodass er nur vom Proxy erreichbar ist. Caddy holt dann kein Zertifikat.',
+    'tls_external_hint' => 'Externer Proxy: setze TRUSTED_PROXY_CIDR auf die Adresse deines Proxys und schütze den HTTP-Port per Firewall, sodass er nur vom Proxy erreichbar ist. Das Panel holt dann kein Zertifikat.',
     'change_tls_heading' => 'TLS-Modus ändern',
-    'change_tls_body_external' => 'Auf „Externer Reverse-Proxy" umstellen? Caddy holt kein Zertifikat mehr; TLS muss der Proxy davor liefern. Gilt nach Neustart des Stacks.',
+    'change_tls_body_external' => 'Auf „Externer Reverse-Proxy" umstellen? Das Panel holt kein Zertifikat mehr; TLS muss der Proxy davor liefern. Gilt nach Neustart des Stacks.',
-    'change_tls_body_caddy' => 'Auf „Caddy (Let\'s Encrypt)" umstellen? Das Panel holt wieder selbst ein Zertifikat. Gilt nach Neustart des Stacks.',
+    'change_tls_body_caddy' => 'Auf „Eingebautes TLS (Let\'s Encrypt)" umstellen? Das Panel holt wieder selbst ein Zertifikat. Gilt nach Neustart des Stacks.',
     'change_tls_confirm' => 'Umstellen',
     'tls_saved_notify' => 'TLS-Modus gespeichert — Stack neu starten, um zu übernehmen.',
 

lang/en/system.php

@@ -25,6 +25,7 @@ return [
     'domain_invalid' => 'Please enter a valid domain (e.g. panel.example.com) — without http://, port or path.',
     'access_address' => 'Access address',
     'access_bare_ip' => 'HTTP (bare IP)',
+    'ssh_reset_hint' => 'Fully locked out? SSH into the host and run `clusev:reset-admin` to reset dashboard access.',
 
     // Change-domain confirmation modal
     'change_domain_heading' => 'Change domain',
@@ -56,14 +57,14 @@ return [
 
     // TLS-mode selector
     'tls_mode_title' => 'TLS termination',
-    'tls_mode_caddy' => 'Caddy (Let\'s Encrypt, automatic)',
+    'tls_mode_caddy' => 'Built-in TLS (Let\'s Encrypt, automatic)',
     'tls_mode_caddy_desc' => 'The panel fetches its own certificate for the domain.',
     'tls_mode_external' => 'External reverse proxy',
     'tls_mode_external_desc' => 'A proxy in front (e.g. Zoraxy) terminates TLS; the panel serves HTTP.',
-    'tls_external_hint' => 'External proxy: set TRUSTED_PROXY_CIDR to your proxy\'s address and firewall the HTTP port so it is only reachable from the upstream proxy. Caddy will not fetch a certificate.',
+    'tls_external_hint' => 'External proxy: set TRUSTED_PROXY_CIDR to your proxy\'s address and firewall the HTTP port so it is only reachable from the upstream proxy. The panel will not fetch a certificate.',
     'change_tls_heading' => 'Change TLS mode',
-    'change_tls_body_external' => 'Switch to "External reverse proxy"? Caddy will no longer fetch a certificate; TLS must be provided by the proxy in front. Takes effect after a stack restart.',
+    'change_tls_body_external' => 'Switch to "External reverse proxy"? The panel will no longer fetch a certificate; TLS must be provided by the proxy in front. Takes effect after a stack restart.',
-    'change_tls_body_caddy' => 'Switch to "Caddy (Let\'s Encrypt)"? The panel will fetch its own certificate again. Takes effect after a stack restart.',
+    'change_tls_body_caddy' => 'Switch to "Built-in TLS (Let\'s Encrypt)"? The panel will fetch its own certificate again. Takes effect after a stack restart.',
     'change_tls_confirm' => 'Switch',
     'tls_saved_notify' => 'TLS mode saved — restart the stack to apply.',
 

resources/views/components/icon.blade.php

@@ -28,6 +28,10 @@
         'rotate'     => '<path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"/><path d="M3 3v5h5"/>',
         'trash'      => '<path d="M3 6h18"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/><path d="M10 11v6"/><path d="M14 11v6"/>',
         'settings'   => '<path d="M12.22 2h-.44a2 2 0 0 0-2 2v.18a2 2 0 0 1-1 1.73l-.43.25a2 2 0 0 1-2 0l-.15-.08a2 2 0 0 0-2.73.73l-.22.38a2 2 0 0 0 .73 2.73l.15.1a2 2 0 0 1 1 1.72v.51a2 2 0 0 1-1 1.74l-.15.09a2 2 0 0 0-.73 2.73l.22.38a2 2 0 0 0 2.73.73l.15-.08a2 2 0 0 1 2 0l.43.25a2 2 0 0 1 1 1.73V20a2 2 0 0 0 2 2h.44a2 2 0 0 0 2-2v-.18a2 2 0 0 1 1-1.73l.43-.25a2 2 0 0 1 2 0l.15.08a2 2 0 0 0 2.73-.73l.22-.39a2 2 0 0 0-.73-2.73l-.15-.08a2 2 0 0 1-1-1.74v-.5a2 2 0 0 1 1-1.74l.15-.09a2 2 0 0 0 .73-2.73l-.22-.38a2 2 0 0 0-2.73-.73l-.15.08a2 2 0 0 1-2 0l-.43-.25a2 2 0 0 1-1-1.73V4a2 2 0 0 0-2-2z"/><circle cx="12" cy="12" r="3"/>',
+        'save'       => '<path d="M15.2 3a2 2 0 0 1 1.4.6l3.8 3.8a2 2 0 0 1 .6 1.4V19a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2z"/><path d="M17 21v-7a1 1 0 0 0-1-1H8a1 1 0 0 0-1 1v7"/><path d="M7 3v4a1 1 0 0 0 1 1h7"/>',
+        'eye'        => '<path d="M2.062 12.348a1 1 0 0 1 0-.696 10.75 10.75 0 0 1 19.876 0 1 1 0 0 1 0 .696 10.75 10.75 0 0 1-19.876 0"/><circle cx="12" cy="12" r="3"/>',
+        'eye-off'    => '<path d="M10.733 5.076a10.744 10.744 0 0 1 11.205 6.575 1 1 0 0 1 0 .696 10.747 10.747 0 0 1-1.444 2.49"/><path d="M14.084 14.158a3 3 0 0 1-4.242-4.242"/><path d="M17.479 17.499a10.75 10.75 0 0 1-15.417-5.151 1 1 0 0 1 0-.696 10.75 10.75 0 0 1 4.446-5.143"/><path d="m2 2 20 20"/>',
+        'user-plus'  => '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><line x1="19" x2="19" y1="8" y2="14"/><line x1="22" x2="16" y1="11" y2="11"/>',
     ];
 @endphp
 <svg {{ $attributes->merge(['class' => $class]) }} viewBox="0 0 24 24" fill="none" stroke="currentColor"

resources/views/livewire/settings/index.blade.php

@@ -60,7 +60,7 @@
                         </div>
                         <div>
                             <label class="{{ $label }}">{{ __('settings.email') }}</label>
-                            <input wire:model="email" type="email" class="{{ $field }} font-mono" />
+                            <input wire:model="email" type="text" class="{{ $field }} font-mono" />
                             @error('email') <p class="{{ $err }}"><x-icon name="alert" class="h-3.5 w-3.5 shrink-0" />{{ $message }}</p> @enderror
                         </div>
                         <div class="flex justify-end">

resources/views/livewire/system/index.blade.php

@@ -1,4 +1,4 @@
-<div class="space-y-5">
+<div class="mx-auto max-w-3xl space-y-5">
     {{-- Header --}}
     <div class="flex flex-wrap items-center gap-4 rounded-xl border border-line bg-surface p-5 shadow-panel">
         <span class="grid h-14 w-14 shrink-0 place-items-center rounded-xl border border-accent/25 bg-accent/10 text-accent">
@@ -41,6 +41,12 @@
             </div>
         @endif
 
+        {{-- Last-resort recovery: SSH into the host and reset admin access. --}}
+        <div class="mb-4 flex items-start gap-2.5 text-ink-4">
+            <x-icon name="shield" class="mt-0.5 h-4 w-4 shrink-0" />
+            <p class="font-mono text-[11px] leading-relaxed">{{ __('system.ssh_reset_hint') }}</p>
+        </div>
+
         {{-- Restart-required notice (shown after a successful save) --}}
         @if ($restartPending)
             <div class="mb-4 flex items-start gap-3 rounded-md border border-warning/30 bg-warning/10 p-3">
@@ -65,7 +71,7 @@
                            placeholder="{{ __('system.domain_placeholder') }}"
                            class="h-9 w-full rounded-md border border-line bg-inset px-3 font-mono text-sm text-ink placeholder:text-ink-4 focus:border-accent/40 focus:outline-none" />
                     <x-btn variant="secondary" wire:click="confirmDomain" wire:loading.attr="disabled" class="shrink-0">
-                        <x-icon name="check" class="h-3.5 w-3.5" /> {{ __('common.save') }}
+                        <x-icon name="save" class="h-3.5 w-3.5" /> {{ __('common.save') }}
                     </x-btn>
                 </div>
                 @error('domainInput')