zero-js-admin-panellisted

# Zero-JavaScript admin panels This skill exists because **four builds** were needed to make one login work, and the winning build was the one with no client JavaScript at all. --- ## The diagnostic that matters > *"clicking Unlock does nothing, and no error either."* **That is the signature of the page's JavaScript never executing** — an extension, a script blocker, a corrupted cache — **not of a wrong password.** Three successive client-side builds treated it as a client bug and hardened the client: 1. **v1** — localStorage + `x-admin-key` header → nothing happens. 2. **v2** — hardened: one-click `?key=` link with `history.replaceState` scrubbing, paste sanitization against 7 corruption cases, show/hide + character counter, `autocomplete="off"` / `data-1p-ignore` against password managers, friendly errors for 401/503/network → still nothing. 3. **v3** — auth moved server-side (form POST + HttpOnly cookie) but `admin.js` kept for rendering → still nothing. 4. **v4** — **deleted `admin.js` entirely, server-rendered everything.** Works. **Rule: when a login silently does nothing, stop hardening the client. Render it on the server.** Confirm before rebuilding, with three commands: ```bash curl -H "x-admin-key: $K" $B/api/order-stats # expect 200 → auth + DB are fine curl -X POST $B/api/admin-login -d "key=$K" -i # expect 302 + Set-Cookie curl -s $B/admin | grep -c '<script' # expect 0 ``` If those pass, **the bug is in th