{# T55 admin chrome partial — terminal-brutalist topbar + sidebar.

  Inputs:
  * active_nav  — one of: waitlist / users / templates / config / scans / models / dashboard
  * user_email  — operator's email
  * user_role   — 'admin' or 'super_admin' (rendered as a small badge)
  * csrf_token  — threaded into the sign-out form

  This partial is intentionally NOT a layout-extend point (no
  ``{% block %}``s). The terminal-brutalist pages each own their full
  HTML document and ``{% include %}`` this chrome inside the body.
#}
<header class="t55-topbar">
  <a href="/admin/waitlist" class="t55-brand">
    <span class="t55-brand-prompt">$</span>
    <span class="t55-brand-name">browser-recon</span>
    <span class="t55-brand-mode">admin</span>
  </a>
  <nav class="t55-topnav" aria-label="Admin sections">
    {% set nav_items = [
      ('waitlist',  'waitlist',  '/admin/waitlist'),
      ('users',     'users',     '/admin/users'),
      ('templates', 'templates', '/admin/templates'),
      ('config',    'config',    '/admin/config'),
      ('scans',     'scans',     '/admin/scans'),
      ('models',    'models',    '/admin/llm-models'),
      ('dashboard', 'kpis',      '/admin/dashboard'),
    ] %}
    {% for key, label, href in nav_items %}
      <a href="{{ href }}"
         class="t55-navitem {% if active_nav == key %}is-active{% endif %}"
         data-nav="{{ key }}">{{ label }}</a>
    {% endfor %}
  </nav>
  <div class="t55-meta">
    <span class="t55-meta-role">[{{ user_role }}]</span>
    <span class="t55-meta-email">{{ user_email }}</span>
    <form method="post" action="/dashboard/logout" class="t55-logout-form">
      <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
      <button type="submit" class="t55-logout-btn" title="sign out">exit</button>
    </form>
  </div>
</header>

{% if flash %}
<div class="t55-flash" role="status">
  <span class="t55-flash-tag">[ok]</span>
  <span class="t55-flash-msg">{{ flash }}</span>
</div>
{% endif %}