@php
    $h = 'font-display text-base font-semibold text-ink';
    $p = 'text-sm leading-relaxed text-ink-2';
    $li = 'text-sm leading-relaxed text-ink-2';
    $code = 'rounded bg-inset px-1.5 py-0.5 font-mono text-[12px] text-accent-text';
    $pre = 'overflow-x-auto rounded-md border border-line bg-inset p-3 font-mono text-[11px] leading-relaxed text-ink-2';
@endphp

<div class="space-y-3">
    <h3 class="{{ $h }}">Account recovery</h3>
    <p class="{{ $p }}">Several ways back in if you are locked out — from most convenient to last resort:</p>
    <ul class="ml-4 list-disc space-y-1.5">
        <li class="{{ $li }}"><span class="text-ink">Forgot password:</span> the "Forgot password" screen offers an <span class="text-ink">e-mail reset link</span> (when SMTP is configured, valid 15 min) or a <span class="text-ink">2FA-proof reset</span> (e-mail + TOTP or a backup code → new password).</li>
        <li class="{{ $li }}"><span class="text-ink">Bare-IP access:</span> <code class="{{ $code }}">http://&lt;server-ip&gt;</code> always stays reachable — in case the domain (DNS/cert/proxy) is currently down. Note: no security key over this path, only TOTP or a backup code (see "Security &amp; 2FA").</li>
    </ul>
</div>

<div class="space-y-3">
    <h3 class="{{ $h }}">Completely locked out (last resort)</h3>
    <p class="{{ $p }}">Lost password and 2FA, no SMTP? Recover from the host — SSH into the server and run:</p>
    <pre class="{{ $pre }}">clusev reset-admin</pre>
    <p class="{{ $p }}"><code class="{{ $code }}">clusev reset-admin</code> clears the second factor so you can set a new password on the next login. (Under the hood it runs <code class="{{ $code }}">docker compose exec app php artisan clusev:reset-admin</code> — see "Commands / CLI".)</p>
</div>