{{define "body"}}<section class="card">
  <h1>Settings</h1>
  <p class="muted">Phase 1 exposes only the worker fields; web-app settings (theme, session timeout, basic-auth password rotate) land in later phases.</p>

  <h2>Worker</h2>
  <dl>
    <dt>Worker ID</dt><dd>{{.WorkerID}}</dd>
    <dt>Region</dt><dd>{{.RegionCode}}</dd>
    <dt>Version</dt><dd>{{.WorkerVersion}}</dd>
    <dt>Capabilities</dt><dd>
      {{if .Capabilities}}
        <ul>{{range .Capabilities}}<li><code>{{.}}</code></li>{{end}}</ul>
      {{else}}<span class="muted">—</span>{{end}}
    </dd>
    <dt>Last heartbeat ack</dt><dd>{{fmtTime .LastAckAt}}</dd>
  </dl>

  <h2>Token</h2>
  <p>
    Current token: <code>{{.TokenMasked}}</code><br>
    Last rotated: {{fmtTime .TokenRotatedAt}}
  </p>
  <form action="/settings/rotate-token" method="post">
    <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
    <button type="submit" class="danger"
      onclick="return confirm('Rotate the worker token? The old token will be invalidated immediately and the websocket will reconnect with the new one.')">
      Rotate token
    </button>
    <span class="muted">Issues a fresh token via the main app API and updates the in-memory runner config. On failure the old token is kept.</span>
  </form>
</section>{{end}}