fix(platform): isolate authentik admin styling

infra/synology/deploy-current.sh

@@ -30,6 +30,9 @@ rsync -av \
 rsync -av \
   "${PLATFORM_REPO}/infra/synology/deploy-current.sh" \
   "${PLATFORM_REPO}/infra/synology/backup-current.sh" \
+  "${PLATFORM_REPO}/infra/synology/apply-current-runtime.sh" \
+  "${PLATFORM_REPO}/infra/synology/verify-current-runtime.sh" \
+  "${PLATFORM_REPO}/infra/synology/clear-authentik-brand-css.sh" \
   "${NAS_ROOT}/platform/"
 
 if [[ "${SYNC_AUTHENTIK_TEMPLATES}" == "1" ]]; then
@@ -160,13 +163,23 @@ cat <<'EOF'
 
 Synced files to NAS mount. Run on Synology to apply runtime changes:
 
+cd /volume1/docker/nodedc-platform/platform
+sudo bash apply-current-runtime.sh
+
+If runtime was already applied and only verification is needed:
+
+cd /volume1/docker/nodedc-platform/platform
+sudo bash verify-current-runtime.sh
+
+Manual equivalent:
+
 cd /volume1/docker/nodedc-platform/platform
 sudo mkdir -p ../launcher/server-storage ../launcher/uploads
 sudo chown -R 1000:1000 ../launcher/server-storage ../launcher/uploads
 sudo chmod -R u+rwX,g+rwX ../launcher/server-storage ../launcher/uploads
 
 cd /volume1/docker/nodedc-platform/launcher/source
-sudo /usr/local/bin/docker build -t nodedc/launcher:local .
+sudo /usr/local/bin/docker build --no-cache -t nodedc/launcher:local .
 
 cd /volume1/docker/nodedc-platform/platform
 sudo /usr/local/bin/docker compose \
@@ -181,6 +194,12 @@ sudo /usr/local/bin/docker compose \
   -f /volume1/docker/nodedc-platform/platform/docker-compose.platform-http.yml \
   up -d --force-recreate --no-deps reverse-proxy authentik-server authentik-worker launcher
 
+After Authentik template rollout, clear global Brand custom CSS from the live DB.
+NODE.DC login CSS must be template-scoped, not stored in Brand.branding_custom_css:
+
+cd /volume1/docker/nodedc-platform/platform
+sudo bash clear-authentik-brand-css.sh
+
 Verify:
 
 sudo /usr/local/bin/docker exec nodedc-platform-launcher-1 sh -lc \
@@ -201,7 +220,44 @@ sudo /usr/local/bin/docker exec nodedc-platform-launcher-1 sh -lc '
 '
 
 curl -k -sS --compressed https://id.nodedc.ru/if/flow/default-authentication-flow/ \
-  | grep -aE 'hub.nodedc.ru|launcher.local|getLauncherBaseUrl|Запросить доступ'
+  | grep -aE 'syncFormFieldsBeforeSubmit|branding_custom_css = ""|hub.nodedc.ru|launcher.local|getLauncherBaseUrl|Запросить доступ'
+
+id_admin_status="$(
+  curl -k -sS -o /dev/null -w '%{http_code}' https://id.nodedc.ru/if/admin/
+)"
+if [[ "$id_admin_status" != "404" ]]; then
+  echo "public id admin is not closed: status=${id_admin_status}"
+  exit 1
+fi
+echo 'public-id-admin-closed-ok'
+
+auth_admin_page="$(
+  curl -k -fsS --compressed http://auth-admin.nas.nodedc:18080/if/admin/
+)"
+printf '%s' "$auth_admin_page" \
+  | grep -aE '<style data-id="brand-css"></style>|authentikBrand.branding_custom_css = ""'
+
+auth_admin_flow="$(
+  curl -k -fsS --compressed http://auth-admin.nas.nodedc:18080/if/flow/default-authentication-flow/
+)"
+if printf '%s' "$auth_admin_flow" | grep -aq '<style data-id="nodedc-auth-login-css">'; then
+  echo 'admin host still has NODE.DC auth CSS'
+  exit 1
+fi
+echo 'auth-admin-css-ok'
+
+launcher_asset="$(
+  curl -k -sS --compressed -H 'Accept: text/html' https://hub.nodedc.ru/ \
+    | grep -aoE 'index-[A-Za-z0-9_-]+\.js' \
+    | head -n 1
+)"
+test -n "$launcher_asset"
+if curl -k -sS --compressed "https://hub.nodedc.ru/assets/${launcher_asset}" \
+  | grep -aq 'Заявка ожидает подтверждения'; then
+  echo 'old pending gate still present'
+  exit 1
+fi
+echo 'launcher-pending-gate-ok'
 
 Optional Tasker apply after TASKER_REPO sync: