/* Unified admin panel client behaviour. * Lives in an external file because the site's enforced CSP (nginx) uses * script-src 'self' with no 'unsafe-inline' — inline