/* ============================================================
   Shared app core: API client (CSRF), auth guard, layout chrome,
   toasts, modals, confirm dialogs, helpers.
   ============================================================ */
"use strict";

/* ---------- tiny DOM helpers ---------- */
const $ = (sel, root) => (root || document).querySelector(sel);
const $$ = (sel, root) => Array.from((root || document).querySelectorAll(sel));
function el(tag, attrs = {}, ...children) {
  const node = document.createElement(tag);
  for (const [k, v] of Object.entries(attrs)) {
    if (k === "class") node.className = v;
    else if (k === "html") node.innerHTML = v;
    else if (k.startsWith("on") && typeof v === "function") node.addEventListener(k.slice(2), v);
    else if (v !== null && v !== undefined) node.setAttribute(k, v);
  }
  for (const c of children) {
    if (c === null || c === undefined) continue;
    node.append(c instanceof Node ? c : document.createTextNode(String(c)));
---check how JS is referenced in HTML---
static/index.html:36:<script src="/static/js/app.js"></script>
static/index.html:37:<script src="/static/js/pages/index.js?v=2"></script>
static/login.html:52:<script src="/static/js/app.js"></script>
static/login.html:53:<script src="/static/js/pages/login.js?v=2"></script>