<%- include('head') %>
<div class="shell">
  <nav class="rail">
    <div class="rail-head">
      <a href="/app"><img src="/img/lockup-light.png" alt="OTENEX" class="logo"></a>
      <div class="rail-org"><%= user.org_name %> · QR</div>
    </div>
    <div class="rail-nav">
      <a href="/app" class="<%= path === '/app' ? 'on' : '' %>">Codes</a>
      <% if (['owner','superadmin'].includes(user.role)) { %>
        <a href="/app/team" class="<%= path.startsWith('/app/team') ? 'on' : '' %>">Team</a>
        <a href="/app/audit" class="<%= path.startsWith('/app/audit') ? 'on' : '' %>">Activity</a>
      <% } %>
    </div>
    <div class="rail-foot">
      <div class="who"><%= user.name %></div>
      <div class="role"><%= user.role %><%= user.totp_enabled ? ' · 2FA' : '' %></div>
      <div class="rail-actions">
        <%- include('theme-toggle') %>
        <form method="post" action="/logout">
          <input type="hidden" name="_csrf" value="<%= csrfToken %>">
          <button type="submit">Sign out</button>
        </form>
      </div>
    </div>
  </nav>
  <div class="main">
