{{/* The userscript install panel. Each link serves the script rendered
     with the acting Reader's credential inside it, so the credential never
     appears in this page's markup, the address bar, or a redirect. Rotation
     is confirm-gated because it invalidates every installed copy at once;
     the response swaps this same panel open with the reinstall warning. */}}
{{define "setup"}}
<details class="setup" id="setup"{{if .Rotated}} open{{end}}>
  <summary>Userscripts</summary>
  <p class="setup-copy">Install each script once per device. They keep your
    bookmarks in sync across every site and update themselves from here.</p>
  <p class="setup-links">
    <a class="ghost" href="/install/manga-bookmark.user.js">Install Manga script</a>
    <a class="ghost" href="/install/novel-bookmark.user.js">Install Novels script</a>
  </p>
  <p class="setup-copy">On mobile, Violentmonkey does not pick up the install
    links — the script opens as text. Download the file instead, then add it
    from Violentmonkey's own menu.</p>
  <p class="setup-links">
    <a class="ghost" href="/install/manga-bookmark.user.js?download=1">Download Manga script</a>
    <a class="ghost" href="/install/novel-bookmark.user.js?download=1">Download Novels script</a>
  </p>
  {{if .Rotated}}
  <p class="setup-warn" role="status">Credential rotated — the old one no
    longer works. Reinstall both scripts on every device now, or they will
    silently stop syncing.</p>
  {{else}}
  <form class="setup-rotate" hx-post="/rotate-token" hx-target="#setup"
        hx-swap="outerHTML"
        hx-confirm="Rotation invalidates the current credential on every device immediately. You will have to reinstall both scripts everywhere. Rotate?">
    <button type="submit" class="ghost">Rotate credential</button>
  </form>
  {{end}}
</details>
{{end}}