Use inline JS styles (applySearchLayout) instead of CSS-only approach
for search panel layout - fixes Firefox compatibility where cross-origin
Material stylesheets override !important rules. Adds explicit height,
flex layout, z-index, and background on search elements. Also fixes
click-to-exit by deferring DOM queries to DOMContentLoaded. Syncs
header-builder.service.ts with main.html changes.
Bunker Admin
The collapsed Material header (height: 0, overflow: visible) left the
search input reachable but the __search checkbox was never toggled when
users typed directly into it. This prevented both Material's native CSS
and our custom CSS from revealing the results panel (opacity stayed 0,
scrollwrap max-height stayed 0).
- Add focusin/input event delegation to check __search on direct input
- Add search icon, dark mode toggle, and docs sidebar toggle to header
- Add CSS for hidden Material header, search positioning, palette, tabs
- Avoid Jinja2 block syntax inside JS comments (parsed as directives)
Bunker Admin
- Replace postMessage wildcard ('*') with explicit parent origin passed
via ?origin= parameter to prevent auth state disclosure to arbitrary
embedders
- Tighten frame-ancestors CSP: production restricts to self + DOMAIN,
dev restricts to localhost origins (was frame-ancestors *)
- Remove deprecated X-Frame-Options ALLOW-FROM header (CSP
frame-ancestors is the modern replacement)
- Validate targetOrigin with URL constructor before use
Bunker Admin
ScheduleOutlined was missing from the ANT_ICON_TO_MATERIAL mapping in
header-builder.service.ts, causing Material Icons to render raw text
characters ("S", "O") instead of a clock icon for the Shifts nav item.
Added the missing mapping and a toMaterialIcon() fallback that converts
any unmapped Ant Design icon name to snake_case Material Icons format.
Bunker Admin
