feat(nginx): add notes.qpid.pro reverse proxy and SSL configuration

game/configurator/css/style.css

@@ -148,20 +148,17 @@ body {
 /* Nav Tabs */
 .tabs-navigation {
   display: flex;
+  flex-wrap: wrap;
   gap: 8px;
-  overflow-x: auto;
+  overflow-x: visible;
+  scrollbar-width: none;
   padding-bottom: 12px;
   margin-bottom: 20px;
-  border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+  border-bottom: 1px solid rgba(255, 255, 255, 0.08);
-  scrollbar-width: thin;
 }
 
 .tabs-navigation::-webkit-scrollbar {
-  height: 4px;
+  display: none;
-}
-.tabs-navigation::-webkit-scrollbar-thumb {
-  background: var(--border-color);
-  border-radius: 4px;
 }
 
 .nav-tab-btn {
@@ -177,6 +174,7 @@ body {
   font-weight: 600;
   cursor: pointer;
   white-space: nowrap;
+  flex-shrink: 0;
   transition: var(--transition);
 }
 
@@ -654,7 +652,8 @@ body {
   padding: 16px;
 }
 
-.modal-overlay.open {
+.modal-overlay.open,
+.modal-overlay.active {
   opacity: 1;
   pointer-events: auto;
 }
@@ -821,10 +820,29 @@ input:checked + .slider-round:before {
   .header-actions {
     width: 100%;
     justify-content: space-between;
+    flex-wrap: wrap;
+    gap: 8px;
   }
   .controls-grid {
     grid-template-columns: 1fr;
   }
+  .tabs-navigation {
+    display: grid;
+    grid-template-columns: repeat(2, 1fr);
+    gap: 6px;
+    overflow-x: visible;
+  }
+  .nav-tab-btn {
+    justify-content: center;
+    padding: 8px 10px;
+    font-size: 12px;
+  }
+}
+
+@media (max-width: 480px) {
+  .tabs-navigation {
+    grid-template-columns: 1fr;
+  }
 }
 
 
@@ -1241,3 +1259,138 @@ input:checked + .slider-round:before {
 .player-name-link:hover {
   color: #a5d6a7;
 }
+
+/* ==========================================================
+   Full-Screen Login Screen for Guest State (Cyberpunk Botanical)
+   ========================================================== */
+.login-page-screen {
+  min-height: 100vh;
+  width: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 24px 16px;
+  background-color: var(--bg-main);
+  background-image: 
+    radial-gradient(circle at 50% 30%, rgba(76, 175, 80, 0.12) 0%, transparent 60%),
+    radial-gradient(circle at 80% 80%, rgba(0, 229, 255, 0.08) 0%, transparent 50%),
+    linear-gradient(180deg, #090d13 0%, #0d121c 100%);
+  position: relative;
+  z-index: 10;
+}
+
+.login-card {
+  width: 100%;
+  max-width: 440px;
+  background: var(--bg-card);
+  backdrop-filter: blur(16px);
+  -webkit-backdrop-filter: blur(16px);
+  border: 1px solid var(--border-color);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card), 0 0 40px rgba(76, 175, 80, 0.15);
+  padding: 36px 32px;
+  animation: loginCardFadeIn 0.35s cubic-bezier(0.16, 1, 0.3, 1);
+}
+
+@keyframes loginCardFadeIn {
+  from {
+    opacity: 0;
+    transform: translateY(16px) scale(0.98);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0) scale(1);
+  }
+}
+
+.login-card-header {
+  text-align: center;
+  margin-bottom: 28px;
+}
+
+.login-brand-icon {
+  font-size: 42px;
+  margin-bottom: 8px;
+  filter: drop-shadow(0 0 16px var(--accent-green-glow));
+  animation: pulseGlow 3s ease-in-out infinite alternate;
+}
+
+@keyframes pulseGlow {
+  0% { transform: scale(1); filter: drop-shadow(0 0 12px var(--accent-green-glow)); }
+  100% { transform: scale(1.05); filter: drop-shadow(0 0 24px var(--accent-cyan-glow)); }
+}
+
+.login-brand-title {
+  font-size: 20px;
+  font-weight: 700;
+  color: var(--text-main);
+  letter-spacing: -0.3px;
+  margin-bottom: 8px;
+  text-shadow: 0 0 20px rgba(76, 175, 80, 0.3);
+}
+
+.login-brand-subtitle {
+  font-size: 13px;
+  color: var(--text-muted);
+  line-height: 1.5;
+}
+
+.password-input-wrapper {
+  position: relative;
+  display: flex;
+  align-items: center;
+}
+
+.password-input-wrapper .form-input {
+  padding-right: 44px;
+}
+
+.btn-toggle-pwd {
+  position: absolute;
+  right: 10px;
+  background: transparent;
+  border: none;
+  color: var(--text-dim);
+  font-size: 16px;
+  cursor: pointer;
+  padding: 4px;
+  border-radius: var(--radius-sm);
+  transition: var(--transition);
+}
+
+.btn-toggle-pwd:hover {
+  color: var(--text-main);
+  transform: scale(1.1);
+}
+
+.login-error-alert {
+  background: rgba(255, 82, 82, 0.15);
+  border: 1px solid rgba(255, 82, 82, 0.45);
+  color: #ff8a80;
+  padding: 10px 14px;
+  border-radius: var(--radius-md);
+  font-size: 13px;
+  margin-bottom: 16px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  animation: shakeAlert 0.3s ease;
+}
+
+@keyframes shakeAlert {
+  0%, 100% { transform: translateX(0); }
+  25% { transform: translateX(-4px); }
+  75% { transform: translateX(4px); }
+}
+
+.btn-block {
+  width: 100%;
+  padding: 12px;
+  font-size: 14px;
+  font-weight: 600;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  margin-top: 8px;
+}

game/configurator/index.html

@@ -8,7 +8,31 @@
   <link rel="stylesheet" href="css/style.css">
 </head>
 <body>
-  <div class="app-container">
+  <!-- Dedicated Full-Screen Login Screen for Guests -->
+  <div id="configurator-login-screen" class="login-page-screen">
+    <div class="login-card">
+      <div class="login-card-header">
+        <div class="login-brand-icon">🌻</div>
+        <h1 class="login-brand-title">🌻 ⚙️ Панель Администратора PvZ</h1>
+        <p class="login-brand-subtitle">Вход в систему управления и конфигуратор баланса игры</p>
+      </div>
+      <form id="configurator-login-form" class="login-form" onsubmit="return false;">
+        <div class="form-group">
+          <label class="form-label" for="login-screen-password">Пароль администратора:</label>
+          <div class="password-input-wrapper">
+            <input type="password" id="login-screen-password" class="form-input" placeholder="Введите мастер-пароль..." autocomplete="current-password" required>
+            <button type="button" id="btn-toggle-login-password" class="btn-toggle-pwd" title="Показать/скрыть пароль" tabindex="-1">👁️</button>
+          </div>
+        </div>
+        <div id="login-screen-error" class="login-error-alert" style="display: none;"></div>
+        <button type="submit" id="btn-login-screen-submit" class="btn btn-primary btn-block">Войти в систему 🔐</button>
+      </form>
+    </div>
+  </div>
+
+  <!-- Main Configurator Application -->
+  <div id="configurator-app-container" style="display: none;">
+    <div class="app-container">
     <!-- Header -->
     <header class="app-header">
       <div class="brand">
@@ -900,6 +924,7 @@
       </div>
     </section>
   </div>
+  </div>
 
   <!-- MODAL: LOGIN -->
   <div id="modal-login" class="modal-overlay">

game/configurator/js/configurator.js

@@ -33,11 +33,9 @@ class PvZConfiguratorApp {
         this.onAuthenticated();
       } else {
         this.onUnauthenticated();
-        this.loadPublicConfig();
       }
     } else {
       this.onUnauthenticated();
-      this.loadPublicConfig();
     }
   }
 
@@ -103,24 +101,116 @@ class PvZConfiguratorApp {
 
   onAuthenticated() {
     this.isAuthenticated = true;
-    document.getElementById('admin-status-dot').className = 'status-dot';
+
-    document.getElementById('admin-status-text').textContent = 'Администратор';
+    const loginScreen = document.getElementById('configurator-login-screen');
-    document.getElementById('btn-login-modal-open').style.display = 'none';
+    if (loginScreen) loginScreen.style.display = 'none';
+
+    const appContainer = document.getElementById('configurator-app-container');
+    if (appContainer) appContainer.style.display = 'block';
+
+    const dot = document.getElementById('admin-status-dot');
+    if (dot) dot.className = 'status-dot';
+    const stText = document.getElementById('admin-status-text');
+    if (stText) stText.textContent = 'Администратор';
+
+    const btnLoginModal = document.getElementById('btn-login-modal-open');
+    if (btnLoginModal) btnLoginModal.style.display = 'none';
+
     const btnPwd = document.getElementById('btn-admin-password-modal-open');
     if (btnPwd) btnPwd.style.display = 'inline-flex';
-    document.getElementById('btn-admin-logout').style.display = 'inline-flex';
+
+    const btnLogout = document.getElementById('btn-admin-logout');
+    if (btnLogout) btnLogout.style.display = 'inline-flex';
     
     this.loadAllData();
   }
 
   onUnauthenticated() {
     this.isAuthenticated = false;
-    document.getElementById('admin-status-dot').className = 'status-dot offline';
+    this.token = '';
-    document.getElementById('admin-status-text').textContent = 'Гость (Только чтение)';
+    localStorage.removeItem('pvz_admin_token');
-    document.getElementById('btn-login-modal-open').style.display = 'inline-flex';
+    this.config = null;
+    this.stats = null;
+    this.users = [];
+    this.sessions = [];
+    this.loginLogs = [];
+    this.bugs = [];
+    this.levels = [];
+
+    const appContainer = document.getElementById('configurator-app-container');
+    if (appContainer) appContainer.style.display = 'none';
+
+    const loginScreen = document.getElementById('configurator-login-screen');
+    if (loginScreen) loginScreen.style.display = 'flex';
+
+    const loginErr = document.getElementById('login-screen-error');
+    if (loginErr) {
+      loginErr.style.display = 'none';
+      loginErr.textContent = '';
+    }
+
+    const pwdInput = document.getElementById('login-screen-password');
+    if (pwdInput) pwdInput.value = '';
+
+    const dot = document.getElementById('admin-status-dot');
+    if (dot) dot.className = 'status-dot offline';
+    const stText = document.getElementById('admin-status-text');
+    if (stText) stText.textContent = 'Гость (Только чтение)';
+
+    const btnLoginModal = document.getElementById('btn-login-modal-open');
+    if (btnLoginModal) btnLoginModal.style.display = 'inline-flex';
+
     const btnPwd = document.getElementById('btn-admin-password-modal-open');
     if (btnPwd) btnPwd.style.display = 'none';
-    document.getElementById('btn-admin-logout').style.display = 'none';
+
+    const btnLogout = document.getElementById('btn-admin-logout');
+    if (btnLogout) btnLogout.style.display = 'none';
+  }
+
+  openModal(modalId) {
+    const modal = document.getElementById(modalId);
+    if (modal) {
+      modal.classList.add('active', 'open');
+    }
+  }
+
+  closeModal(modalId) {
+    const modal = document.getElementById(modalId);
+    if (modal) {
+      modal.classList.remove('active', 'open');
+    }
+  }
+
+  async handleScreenLogin() {
+    const pwdInput = document.getElementById('login-screen-password');
+    const errDiv = document.getElementById('login-screen-error');
+    const enteredPassword = pwdInput ? pwdInput.value.trim() : '';
+
+    if (!enteredPassword) {
+      if (errDiv) {
+        errDiv.textContent = 'Введите мастер-пароль администратора';
+        errDiv.style.display = 'flex';
+      }
+      return;
+    }
+
+    if (errDiv) {
+      errDiv.style.display = 'none';
+      errDiv.textContent = '';
+    }
+
+    const res = await this.apiRequest('/api/admin/auth', 'POST', { password: enteredPassword });
+    if (res.ok && res.data && res.data.success && res.data.token) {
+      this.token = res.data.token;
+      localStorage.setItem('pvz_admin_token', this.token);
+      this.showToast('Авторизация успешна! Добро пожаловать в панель управления.', 'success');
+      this.onAuthenticated();
+    } else {
+      if (errDiv) {
+        errDiv.textContent = (res.data && res.data.message) || 'Неверный пароль администратора';
+        errDiv.style.display = 'flex';
+      }
+    }
   }
 
   async loadPublicConfig() {
@@ -746,20 +836,24 @@ class PvZConfiguratorApp {
     filtered.forEach(s => {
       const tr = document.createElement('tr');
       const tokenShort = (s.token || '').substring(0, 10) + '...';
-      const isOnline = true;
+      const username = s.username || 'Гость';
+      const ipAddress = s.ipAddress || '127.0.0.1';
+      const deviceName = (s.deviceName && s.deviceName !== 'Unknown Device') ? s.deviceName : 'Браузер';
+      const createdAt = s.createdAt || '—';
+      const lastActive = s.lastActive || s.createdAt || 'Только что';
 
       tr.innerHTML = `
         <td>
-          <span class="player-name-link" data-user-id="${s.userId}">${s.username || 'Гость'}</span>
+          <span class="player-name-link" data-user-id="${s.userId || ''}">${username}</span>
           ${s.isAdmin ? '<span class="badge badge-warning" style="font-size:10px; margin-left:4px;">ADMIN</span>' : ''}
         </td>
-        <td><span style="font-family:monospace; color:var(--text-muted);">${s.ipAddress || '127.0.0.1'}</span></td>
+        <td><span style="font-family:monospace; color:var(--text-muted); font-size:12px;">${ipAddress}</span></td>
-        <td><span style="color:var(--text-main); font-size:12px;">${s.deviceName || 'Браузер'}</span></td>
+        <td><span style="color:var(--text-main); font-size:12px;">${deviceName}</span></td>
-        <td style="color:var(--text-dim); font-size:12px;">${s.createdAt || '—'}</td>
+        <td style="color:var(--text-dim); font-size:12px;">${createdAt}</td>
-        <td><span style="color:#a5d6a7; font-size:12px;">🟢 ${s.lastActive || s.createdAt || 'Только что'}</span></td>
+        <td><span style="color:#a5d6a7; font-size:12px;">🟢 ${lastActive}</span></td>
-        <td><span class="token-cell" title="${s.token}">${tokenShort}</span></td>
+        <td><span class="token-cell" title="${s.token || ''}">${tokenShort}</span></td>
         <td>
-          <button class="btn btn-danger btn-sm btn-terminate-session" data-token="${s.token}" title="Завершить сессию игрока">
+          <button class="btn btn-danger btn-sm btn-terminate-session" data-token="${s.token || ''}" title="Завершить сессию игрока">
             🚪 Завершить
           </button>
         </td>
@@ -825,7 +919,10 @@ class PvZConfiguratorApp {
       filtered = filtered.filter(l => l.username && l.username.toLowerCase().includes(userFilter));
     }
     if (ipFilter) {
-      filtered = filtered.filter(l => l.ipAddress && l.ipAddress.toLowerCase().includes(ipFilter));
+      filtered = filtered.filter(l => 
+        (l.ipAddress && l.ipAddress.toLowerCase().includes(ipFilter)) ||
+        (l.ip && l.ip.toLowerCase().includes(ipFilter))
+      );
     }
     if (statusFilter !== 'all') {
       filtered = filtered.filter(l => l.status === statusFilter);
@@ -839,27 +936,32 @@ class PvZConfiguratorApp {
     tbody.innerHTML = '';
     filtered.forEach(log => {
       const tr = document.createElement('tr');
+      const timestamp = log.createdAt || log.timestamp || '—';
+      const username = log.username || 'Гость';
+      const ipAddress = log.ipAddress || log.ip || '127.0.0.1';
+      const deviceName = (log.deviceName && log.deviceName !== 'Unknown Device') ? log.deviceName : 'Браузер';
+      const status = log.status || 'unknown';
       
-      let statusBadge = `<span class="badge badge-muted">${log.status}</span>`;
+      let statusBadge = `<span class="badge badge-muted">${status}</span>`;
-      if (log.status === 'success') {
+      if (status === 'success') {
         statusBadge = `<span class="badge badge-success">✅ Успешно</span>`;
-      } else if (log.status === 'registered') {
+      } else if (status === 'registered') {
         statusBadge = `<span class="badge badge-purple">🎉 Регистрация</span>`;
-      } else if (log.status === 'wrong_password') {
+      } else if (status === 'wrong_password') {
         statusBadge = `<span class="badge badge-danger">❌ Неверный пароль</span>`;
-      } else if (log.status === 'banned_login_attempt') {
+      } else if (status === 'banned_login_attempt') {
         statusBadge = `<span class="badge badge-warning">🚫 Заблокирован</span>`;
-      } else if (log.status === 'rate_limited') {
+      } else if (status === 'rate_limited') {
         statusBadge = `<span class="badge badge-warning">⚠️ Превышен лимит</span>`;
-      } else if (log.status === 'user_not_found') {
+      } else if (status === 'user_not_found') {
         statusBadge = `<span class="badge badge-muted">❓ Не найден</span>`;
       }
 
       tr.innerHTML = `
-        <td style="color:var(--text-dim); font-size:12px; font-family:monospace;">${log.timestamp || '—'}</td>
+        <td style="color:var(--text-dim); font-size:12px; font-family:monospace;">${timestamp}</td>
-        <td><b style="color:var(--accent-cyan);">${log.username || '—'}</b></td>
+        <td><b style="color:var(--accent-cyan);">${username}</b></td>
-        <td><span style="font-family:monospace; color:var(--text-muted); font-size:12px;">${log.ipAddress || '—'}</span></td>
+        <td><span style="font-family:monospace; color:var(--text-muted); font-size:12px;">${ipAddress}</span></td>
-        <td style="font-size:12px; color:var(--text-main);">${log.deviceName || 'Браузер'}</td>
+        <td style="font-size:12px; color:var(--text-main);">${deviceName}</td>
         <td>${statusBadge}</td>
       `;
       tbody.appendChild(tr);
@@ -902,7 +1004,7 @@ class PvZConfiguratorApp {
 
     if (res.ok && res.data.success) {
       this.showToast('Мастер-пароль администратора успешно изменен!', 'success');
-      document.getElementById('modal-admin-password').classList.remove('active');
+      this.closeModal('modal-admin-password');
       document.getElementById('admin-current-password').value = '';
       document.getElementById('admin-new-password').value = '';
       document.getElementById('admin-confirm-password').value = '';
@@ -987,8 +1089,13 @@ class PvZConfiguratorApp {
   }
 
   async openPlayerStatsModal(userId) {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     const res = await this.apiRequest(`/api/admin/user/${userId}`);
-    if (!res.ok || !res.data.success) {
+    if (!res.ok || !res.data || !res.data.success) {
       this.showToast('Ошибка загрузки статистики игрока', 'error');
       return;
     }
@@ -1003,7 +1110,7 @@ class PvZConfiguratorApp {
     const idInput = document.getElementById('stats-player-id');
     if (idInput) idInput.value = u.id;
 
-    document.getElementById('stats-player-username').textContent = u.username;
+    document.getElementById('stats-player-username').textContent = u.username || '—';
     document.getElementById('stats-player-id-line').textContent = `#${u.id} (${prof.theme || 'classic'})`;
     document.getElementById('stats-player-created').textContent = u.createdAt || '—';
     document.getElementById('stats-player-login').textContent = u.lastLogin || '—';
@@ -1041,12 +1148,17 @@ class PvZConfiguratorApp {
     }
     document.getElementById('stats-scores-summary').innerHTML = scoreTxt;
 
-    document.getElementById('modal-player-stats').classList.add('active');
+    this.openModal('modal-player-stats');
   }
 
   async openEditPlayerModal(userId) {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     const res = await this.apiRequest(`/api/admin/user/${userId}`);
-    if (!res.ok || !res.data.success) {
+    if (!res.ok || !res.data || !res.data.success) {
       this.showToast('Ошибка загрузки профиля игрока', 'error');
       return;
     }
@@ -1057,7 +1169,7 @@ class PvZConfiguratorApp {
     const zen = prof.zenGarden || u.zenGarden || {};
 
     document.getElementById('edit-player-id').value = u.id;
-    document.getElementById('edit-player-title-name').textContent = u.username;
+    document.getElementById('edit-player-title-name').textContent = u.username || '';
     document.getElementById('edit-player-coins').value = prof.coins ?? u.coins ?? 150;
     document.getElementById('edit-player-level').value = prof.level ?? u.level ?? 1;
     document.getElementById('edit-player-maxlevel').value = prof.maxUnlockedLevel ?? u.maxUnlockedLevel ?? 1;
@@ -1081,10 +1193,15 @@ class PvZConfiguratorApp {
     const banCont = document.getElementById('edit-ban-reason-container');
     if (banCont) banCont.style.display = u.isBanned ? 'block' : 'none';
 
-    document.getElementById('modal-edit-player').classList.add('active');
+    this.openModal('modal-edit-player');
   }
 
   async savePlayerEdit() {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     const id = document.getElementById('edit-player-id').value;
     const updates = {
       coins: parseInt(document.getElementById('edit-player-coins').value, 10) || 0,
@@ -1113,17 +1230,22 @@ class PvZConfiguratorApp {
     };
 
     const res = await this.apiRequest(`/api/admin/user/${id}/edit`, 'POST', { updates });
-    if (res.ok && res.data.success) {
+    if (res.ok && res.data && res.data.success) {
       this.showToast('Профиль игрока и ресурсы успешно обновлены!', 'success');
-      document.getElementById('modal-edit-player').classList.remove('active');
+      this.closeModal('modal-edit-player');
       this.loadUsers();
       this.loadStats();
     } else {
-      this.showToast(res.data.message || 'Ошибка сохранения', 'error');
+      this.showToast((res.data && res.data.message) || 'Ошибка сохранения', 'error');
     }
   }
 
   async createPlayer() {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     const username = document.getElementById('create-player-username').value.trim();
     const password = document.getElementById('create-player-password').value.trim();
     const coins = parseInt(document.getElementById('create-player-coins').value, 10) || 150;
@@ -1141,26 +1263,36 @@ class PvZConfiguratorApp {
       initialData: { coins, level: 1, maxUnlockedLevel: 1 }
     });
 
-    if (res.ok && res.data.success) {
+    if (res.ok && res.data && res.data.success) {
-      this.showToast(`Игрок ${username} создан!`, 'success');
+      this.showToast(`Игрок ${username} успешно создан!`, 'success');
-      document.getElementById('modal-create-player').classList.remove('active');
+      this.closeModal('modal-create-player');
       document.getElementById('create-player-username').value = '';
       document.getElementById('create-player-password').value = '';
       this.loadUsers();
       this.loadStats();
     } else {
-      this.showToast(res.data.message || 'Ошибка создания игрока', 'error');
+      this.showToast((res.data && res.data.message) || 'Ошибка создания игрока', 'error');
     }
   }
 
   openResetPasswordModal(id, username) {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     document.getElementById('reset-pwd-user-id').value = id;
     document.getElementById('reset-pwd-username').textContent = username;
     document.getElementById('reset-pwd-input').value = '';
-    document.getElementById('modal-reset-password').classList.add('active');
+    this.openModal('modal-reset-password');
   }
 
   async submitResetPassword() {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     const id = document.getElementById('reset-pwd-user-id').value;
     const pwd = document.getElementById('reset-pwd-input').value.trim();
     if (!pwd) {
@@ -1169,11 +1301,11 @@ class PvZConfiguratorApp {
     }
 
     const res = await this.apiRequest(`/api/admin/user/${id}/password`, 'POST', { password: pwd });
-    if (res.ok && res.data.success) {
+    if (res.ok && res.data && res.data.success) {
       this.showToast('Пароль успешно сброшен', 'success');
-      document.getElementById('modal-reset-password').classList.remove('active');
+      this.closeModal('modal-reset-password');
     } else {
-      this.showToast(res.data.message || 'Ошибка сброса пароля', 'error');
+      this.showToast((res.data && res.data.message) || 'Ошибка сброса пароля', 'error');
     }
   }
 
@@ -1254,7 +1386,7 @@ class PvZConfiguratorApp {
     document.getElementById('bug-mod-status').value = b.status || 'новый';
     document.getElementById('bug-mod-reply').value = b.adminReply || '';
 
-    document.getElementById('modal-moderate-bug').classList.add('active');
+    this.openModal('modal-moderate-bug');
   }
 
   async saveBugModeration() {
@@ -1265,7 +1397,7 @@ class PvZConfiguratorApp {
     const res = await this.apiRequest(`/api/admin/bugs/${id}/status`, 'POST', { status, adminReply });
     if (res.ok && res.data.success) {
       this.showToast(`Баг #${id} обновлен`, 'success');
-      document.getElementById('modal-moderate-bug').classList.remove('active');
+      this.closeModal('modal-moderate-bug');
       this.loadBugs();
     } else {
       this.showToast(res.data.message || 'Ошибка сохранения', 'error');
@@ -1279,7 +1411,7 @@ class PvZConfiguratorApp {
     const res = await this.apiRequest(`/api/admin/bugs/${id}/status`, 'POST', { delete: true });
     if (res.ok && res.data.success) {
       this.showToast(`Баг #${id} удален`, 'success');
-      document.getElementById('modal-moderate-bug').classList.remove('active');
+      this.closeModal('modal-moderate-bug');
       this.loadBugs();
     } else {
       this.showToast(res.data.message || 'Ошибка удаления', 'error');
@@ -1434,46 +1566,94 @@ class PvZConfiguratorApp {
         if (pane) pane.classList.add('active');
         this.activeTab = target;
 
-        if (target === 'tab-levels' && this.levels.length === 0) this.loadCampaignLevels();
+        if (target === 'tab-players') this.loadUsers();
         if (target === 'tab-sessions') this.loadSessions();
         if (target === 'tab-logs') this.loadLoginLogs();
+        if (target === 'tab-levels' && this.levels.length === 0) this.loadCampaignLevels();
       });
     });
 
+    // Full-Screen Login Screen Bindings
+    const btnScreenSubmit = document.getElementById('btn-login-screen-submit');
+    if (btnScreenSubmit) {
+      btnScreenSubmit.addEventListener('click', (e) => {
+        e.preventDefault();
+        this.handleScreenLogin();
+      });
+    }
+
+    const screenPwdInput = document.getElementById('login-screen-password');
+    if (screenPwdInput) {
+      screenPwdInput.addEventListener('keydown', (e) => {
+        if (e.key === 'Enter') {
+          e.preventDefault();
+          this.handleScreenLogin();
+        }
+      });
+    }
+
+    const btnTogglePwd = document.getElementById('btn-toggle-login-password');
+    if (btnTogglePwd && screenPwdInput) {
+      btnTogglePwd.addEventListener('click', () => {
+        if (screenPwdInput.type === 'password') {
+          screenPwdInput.type = 'text';
+          btnTogglePwd.textContent = '🙈';
+        } else {
+          screenPwdInput.type = 'password';
+          btnTogglePwd.textContent = '👁️';
+        }
+      });
+    }
+
     // Login modal
-    document.getElementById('btn-login-modal-open').addEventListener('click', () => {
+    const btnLoginOpen = document.getElementById('btn-login-modal-open');
-      document.getElementById('login-error-msg').style.display = 'none';
+    if (btnLoginOpen) {
-      document.getElementById('admin-password-input').value = '';
+      btnLoginOpen.addEventListener('click', () => {
-      document.getElementById('modal-login').classList.add('active');
-    });
-
-    document.getElementById('btn-submit-login').addEventListener('click', async () => {
-      const pwd = document.getElementById('admin-password-input').value.trim();
-      if (!pwd) return;
-
-      const res = await this.apiRequest('/api/admin/auth', 'POST', { password: pwd });
-      if (res.ok && res.data.success) {
-        this.token = res.data.token;
-        localStorage.setItem('pvz_admin_token', this.token);
-        this.onAuthenticated();
-        document.getElementById('modal-login').classList.remove('active');
-        this.showToast('Авторизация администратора успешна!', 'success');
-      } else {
         const err = document.getElementById('login-error-msg');
-        err.textContent = res.data.message || 'Неверный пароль администратора';
+        if (err) err.style.display = 'none';
-        err.style.display = 'block';
+        const input = document.getElementById('admin-password-input');
-      }
+        if (input) input.value = '';
-    });
+        this.openModal('modal-login');
+      });
+    }
+
+    const btnSubmitLogin = document.getElementById('btn-submit-login');
+    if (btnSubmitLogin) {
+      btnSubmitLogin.addEventListener('click', async () => {
+        const input = document.getElementById('admin-password-input');
+        const pwd = input ? input.value.trim() : '';
+        if (!pwd) return;
+
+        const res = await this.apiRequest('/api/admin/auth', 'POST', { password: pwd });
+        if (res.ok && res.data && res.data.success && res.data.token) {
+          this.token = res.data.token;
+          localStorage.setItem('pvz_admin_token', this.token);
+          this.closeModal('modal-login');
+          this.showToast('Авторизация администратора успешна!', 'success');
+          this.onAuthenticated();
+        } else {
+          const err = document.getElementById('login-error-msg');
+          if (err) {
+            err.textContent = (res.data && res.data.message) || 'Неверный пароль администратора';
+            err.style.display = 'block';
+          }
+        }
+      });
+    }
 
     // Change Admin Password Modal
     const btnOpenPwd = document.getElementById('btn-admin-password-modal-open');
     if (btnOpenPwd) {
       btnOpenPwd.addEventListener('click', () => {
-        document.getElementById('admin-password-error').style.display = 'none';
+        const err = document.getElementById('admin-password-error');
-        document.getElementById('admin-current-password').value = '';
+        if (err) err.style.display = 'none';
-        document.getElementById('admin-new-password').value = '';
+        const cur = document.getElementById('admin-current-password');
-        document.getElementById('admin-confirm-password').value = '';
+        if (cur) cur.value = '';
-        document.getElementById('modal-admin-password').classList.add('active');
+        const nw = document.getElementById('admin-new-password');
+        if (nw) nw.value = '';
+        const cf = document.getElementById('admin-confirm-password');
+        if (cf) cf.value = '';
+        this.openModal('modal-admin-password');
       });
     }
 
@@ -1483,19 +1663,29 @@ class PvZConfiguratorApp {
     }
 
     // Logout
-    document.getElementById('btn-admin-logout').addEventListener('click', () => {
+    const btnLogout = document.getElementById('btn-admin-logout');
-      this.token = '';
+    if (btnLogout) {
-      localStorage.removeItem('pvz_admin_token');
+      btnLogout.addEventListener('click', () => {
-      this.onUnauthenticated();
+        this.token = '';
-      this.showToast('Вы вышли из панели администратора', 'info');
+        localStorage.removeItem('pvz_admin_token');
-    });
+        this.onUnauthenticated();
+        this.showToast('Вы вышли из панели администратора', 'info');
+      });
+    }
 
     // Close Modals
     document.querySelectorAll('[data-close]').forEach(btn => {
       btn.addEventListener('click', () => {
         const modalId = btn.getAttribute('data-close');
-        const modal = document.getElementById(modalId);
+        this.closeModal(modalId);
-        if (modal) modal.classList.remove('active');
+      });
+    });
+
+    document.querySelectorAll('.modal-overlay').forEach(overlay => {
+      overlay.addEventListener('click', (e) => {
+        if (e.target === overlay) {
+          overlay.classList.remove('active', 'open');
+        }
       });
     });
 
@@ -1539,26 +1729,56 @@ class PvZConfiguratorApp {
     });
 
     // Player Actions
-    document.getElementById('btn-create-player-open').addEventListener('click', () => {
+    const btnCreatePlayerOpen = document.getElementById('btn-create-player-open');
-      document.getElementById('modal-create-player').classList.add('active');
+    if (btnCreatePlayerOpen) {
-    });
+      btnCreatePlayerOpen.addEventListener('click', () => {
-    document.getElementById('btn-submit-create-player').addEventListener('click', () => this.createPlayer());
+        this.openModal('modal-create-player');
-    document.getElementById('btn-save-player-edit').addEventListener('click', () => this.savePlayerEdit());
+      });
-    document.getElementById('btn-submit-reset-pwd').addEventListener('click', () => this.submitResetPassword());
+    }
-    document.getElementById('btn-refresh-players').addEventListener('click', () => this.loadUsers());
+    const btnSubmitCreatePlayer = document.getElementById('btn-submit-create-player');
-    document.getElementById('player-search-input').addEventListener('input', () => this.renderPlayersTable());
+    if (btnSubmitCreatePlayer) {
-    document.getElementById('player-filter-status').addEventListener('change', () => this.renderPlayersTable());
+      btnSubmitCreatePlayer.addEventListener('click', () => this.createPlayer());
-    document.getElementById('player-sort-select').addEventListener('change', () => this.renderPlayersTable());
+    }
-    document.getElementById('edit-player-is-banned').addEventListener('change', (e) => {
+    const btnSavePlayerEdit = document.getElementById('btn-save-player-edit');
-      document.getElementById('edit-ban-reason-container').style.display = e.target.checked ? 'block' : 'none';
+    if (btnSavePlayerEdit) {
-    });
+      btnSavePlayerEdit.addEventListener('click', () => this.savePlayerEdit());
+    }
+    const btnSubmitResetPwd = document.getElementById('btn-submit-reset-pwd');
+    if (btnSubmitResetPwd) {
+      btnSubmitResetPwd.addEventListener('click', () => this.submitResetPassword());
+    }
+    const btnRefreshPlayers = document.getElementById('btn-refresh-players');
+    if (btnRefreshPlayers) {
+      btnRefreshPlayers.addEventListener('click', () => this.loadUsers());
+    }
+    const playerSearchInput = document.getElementById('player-search-input');
+    if (playerSearchInput) {
+      playerSearchInput.addEventListener('input', () => this.renderPlayersTable());
+    }
+    const playerFilterStatus = document.getElementById('player-filter-status');
+    if (playerFilterStatus) {
+      playerFilterStatus.addEventListener('change', () => this.renderPlayersTable());
+    }
+    const playerSortSelect = document.getElementById('player-sort-select');
+    if (playerSortSelect) {
+      playerSortSelect.addEventListener('change', () => this.renderPlayersTable());
+    }
+    const editPlayerIsBanned = document.getElementById('edit-player-is-banned');
+    if (editPlayerIsBanned) {
+      editPlayerIsBanned.addEventListener('change', (e) => {
+        const container = document.getElementById('edit-ban-reason-container');
+        if (container) container.style.display = e.target.checked ? 'block' : 'none';
+      });
+    }
 
-    document.getElementById('btn-stats-jump-edit')?.addEventListener('click', () => {
+    const btnStatsJumpEdit = document.getElementById('btn-stats-jump-edit');
-      const id = document.getElementById('stats-player-id')?.value;
+    if (btnStatsJumpEdit) {
-      const modal = document.getElementById('modal-player-stats');
+      btnStatsJumpEdit.addEventListener('click', () => {
-      if (modal) modal.classList.remove('active');
+        const id = document.getElementById('stats-player-id')?.value;
-      if (id) this.openEditPlayerModal(id);
+        this.closeModal('modal-player-stats');
-    });
+        if (id) this.openEditPlayerModal(id);
+      });
+    }
 
     // Balance Save Buttons
     document.getElementById('btn-save-economy').addEventListener('click', () => this.saveBalanceSection('economy'));

game/configurator_work/css/style.css

@@ -148,20 +148,17 @@ body {
 /* Nav Tabs */
 .tabs-navigation {
   display: flex;
+  flex-wrap: wrap;
   gap: 8px;
-  overflow-x: auto;
+  overflow-x: visible;
+  scrollbar-width: none;
   padding-bottom: 12px;
   margin-bottom: 20px;
-  border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+  border-bottom: 1px solid rgba(255, 255, 255, 0.08);
-  scrollbar-width: thin;
 }
 
 .tabs-navigation::-webkit-scrollbar {
-  height: 4px;
+  display: none;
-}
-.tabs-navigation::-webkit-scrollbar-thumb {
-  background: var(--border-color);
-  border-radius: 4px;
 }
 
 .nav-tab-btn {
@@ -177,6 +174,7 @@ body {
   font-weight: 600;
   cursor: pointer;
   white-space: nowrap;
+  flex-shrink: 0;
   transition: var(--transition);
 }
 
@@ -654,7 +652,8 @@ body {
   padding: 16px;
 }
 
-.modal-overlay.open {
+.modal-overlay.open,
+.modal-overlay.active {
   opacity: 1;
   pointer-events: auto;
 }
@@ -821,10 +820,29 @@ input:checked + .slider-round:before {
   .header-actions {
     width: 100%;
     justify-content: space-between;
+    flex-wrap: wrap;
+    gap: 8px;
   }
   .controls-grid {
     grid-template-columns: 1fr;
   }
+  .tabs-navigation {
+    display: grid;
+    grid-template-columns: repeat(2, 1fr);
+    gap: 6px;
+    overflow-x: visible;
+  }
+  .nav-tab-btn {
+    justify-content: center;
+    padding: 8px 10px;
+    font-size: 12px;
+  }
+}
+
+@media (max-width: 480px) {
+  .tabs-navigation {
+    grid-template-columns: 1fr;
+  }
 }
 
 
@@ -1241,3 +1259,138 @@ input:checked + .slider-round:before {
 .player-name-link:hover {
   color: #a5d6a7;
 }
+
+/* ==========================================================
+   Full-Screen Login Screen for Guest State (Cyberpunk Botanical)
+   ========================================================== */
+.login-page-screen {
+  min-height: 100vh;
+  width: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 24px 16px;
+  background-color: var(--bg-main);
+  background-image: 
+    radial-gradient(circle at 50% 30%, rgba(76, 175, 80, 0.12) 0%, transparent 60%),
+    radial-gradient(circle at 80% 80%, rgba(0, 229, 255, 0.08) 0%, transparent 50%),
+    linear-gradient(180deg, #090d13 0%, #0d121c 100%);
+  position: relative;
+  z-index: 10;
+}
+
+.login-card {
+  width: 100%;
+  max-width: 440px;
+  background: var(--bg-card);
+  backdrop-filter: blur(16px);
+  -webkit-backdrop-filter: blur(16px);
+  border: 1px solid var(--border-color);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card), 0 0 40px rgba(76, 175, 80, 0.15);
+  padding: 36px 32px;
+  animation: loginCardFadeIn 0.35s cubic-bezier(0.16, 1, 0.3, 1);
+}
+
+@keyframes loginCardFadeIn {
+  from {
+    opacity: 0;
+    transform: translateY(16px) scale(0.98);
+  }
+  to {
+    opacity: 1;
+    transform: translateY(0) scale(1);
+  }
+}
+
+.login-card-header {
+  text-align: center;
+  margin-bottom: 28px;
+}
+
+.login-brand-icon {
+  font-size: 42px;
+  margin-bottom: 8px;
+  filter: drop-shadow(0 0 16px var(--accent-green-glow));
+  animation: pulseGlow 3s ease-in-out infinite alternate;
+}
+
+@keyframes pulseGlow {
+  0% { transform: scale(1); filter: drop-shadow(0 0 12px var(--accent-green-glow)); }
+  100% { transform: scale(1.05); filter: drop-shadow(0 0 24px var(--accent-cyan-glow)); }
+}
+
+.login-brand-title {
+  font-size: 20px;
+  font-weight: 700;
+  color: var(--text-main);
+  letter-spacing: -0.3px;
+  margin-bottom: 8px;
+  text-shadow: 0 0 20px rgba(76, 175, 80, 0.3);
+}
+
+.login-brand-subtitle {
+  font-size: 13px;
+  color: var(--text-muted);
+  line-height: 1.5;
+}
+
+.password-input-wrapper {
+  position: relative;
+  display: flex;
+  align-items: center;
+}
+
+.password-input-wrapper .form-input {
+  padding-right: 44px;
+}
+
+.btn-toggle-pwd {
+  position: absolute;
+  right: 10px;
+  background: transparent;
+  border: none;
+  color: var(--text-dim);
+  font-size: 16px;
+  cursor: pointer;
+  padding: 4px;
+  border-radius: var(--radius-sm);
+  transition: var(--transition);
+}
+
+.btn-toggle-pwd:hover {
+  color: var(--text-main);
+  transform: scale(1.1);
+}
+
+.login-error-alert {
+  background: rgba(255, 82, 82, 0.15);
+  border: 1px solid rgba(255, 82, 82, 0.45);
+  color: #ff8a80;
+  padding: 10px 14px;
+  border-radius: var(--radius-md);
+  font-size: 13px;
+  margin-bottom: 16px;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  animation: shakeAlert 0.3s ease;
+}
+
+@keyframes shakeAlert {
+  0%, 100% { transform: translateX(0); }
+  25% { transform: translateX(-4px); }
+  75% { transform: translateX(4px); }
+}
+
+.btn-block {
+  width: 100%;
+  padding: 12px;
+  font-size: 14px;
+  font-weight: 600;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  margin-top: 8px;
+}

game/configurator_work/index.html

@@ -8,7 +8,31 @@
   <link rel="stylesheet" href="css/style.css">
 </head>
 <body>
-  <div class="app-container">
+  <!-- Dedicated Full-Screen Login Screen for Guests -->
+  <div id="configurator-login-screen" class="login-page-screen">
+    <div class="login-card">
+      <div class="login-card-header">
+        <div class="login-brand-icon">🌻</div>
+        <h1 class="login-brand-title">🌻 ⚙️ Панель Администратора PvZ</h1>
+        <p class="login-brand-subtitle">Вход в систему управления и конфигуратор баланса игры</p>
+      </div>
+      <form id="configurator-login-form" class="login-form" onsubmit="return false;">
+        <div class="form-group">
+          <label class="form-label" for="login-screen-password">Пароль администратора:</label>
+          <div class="password-input-wrapper">
+            <input type="password" id="login-screen-password" class="form-input" placeholder="Введите мастер-пароль..." autocomplete="current-password" required>
+            <button type="button" id="btn-toggle-login-password" class="btn-toggle-pwd" title="Показать/скрыть пароль" tabindex="-1">👁️</button>
+          </div>
+        </div>
+        <div id="login-screen-error" class="login-error-alert" style="display: none;"></div>
+        <button type="submit" id="btn-login-screen-submit" class="btn btn-primary btn-block">Войти в систему 🔐</button>
+      </form>
+    </div>
+  </div>
+
+  <!-- Main Configurator Application -->
+  <div id="configurator-app-container" style="display: none;">
+    <div class="app-container">
     <!-- Header -->
     <header class="app-header">
       <div class="brand">
@@ -900,6 +924,7 @@
       </div>
     </section>
   </div>
+  </div>
 
   <!-- MODAL: LOGIN -->
   <div id="modal-login" class="modal-overlay">

game/configurator_work/js/configurator.js

@@ -33,11 +33,9 @@ class PvZConfiguratorApp {
         this.onAuthenticated();
       } else {
         this.onUnauthenticated();
-        this.loadPublicConfig();
       }
     } else {
       this.onUnauthenticated();
-      this.loadPublicConfig();
     }
   }
 
@@ -103,24 +101,116 @@ class PvZConfiguratorApp {
 
   onAuthenticated() {
     this.isAuthenticated = true;
-    document.getElementById('admin-status-dot').className = 'status-dot';
+
-    document.getElementById('admin-status-text').textContent = 'Администратор';
+    const loginScreen = document.getElementById('configurator-login-screen');
-    document.getElementById('btn-login-modal-open').style.display = 'none';
+    if (loginScreen) loginScreen.style.display = 'none';
+
+    const appContainer = document.getElementById('configurator-app-container');
+    if (appContainer) appContainer.style.display = 'block';
+
+    const dot = document.getElementById('admin-status-dot');
+    if (dot) dot.className = 'status-dot';
+    const stText = document.getElementById('admin-status-text');
+    if (stText) stText.textContent = 'Администратор';
+
+    const btnLoginModal = document.getElementById('btn-login-modal-open');
+    if (btnLoginModal) btnLoginModal.style.display = 'none';
+
     const btnPwd = document.getElementById('btn-admin-password-modal-open');
     if (btnPwd) btnPwd.style.display = 'inline-flex';
-    document.getElementById('btn-admin-logout').style.display = 'inline-flex';
+
+    const btnLogout = document.getElementById('btn-admin-logout');
+    if (btnLogout) btnLogout.style.display = 'inline-flex';
     
     this.loadAllData();
   }
 
   onUnauthenticated() {
     this.isAuthenticated = false;
-    document.getElementById('admin-status-dot').className = 'status-dot offline';
+    this.token = '';
-    document.getElementById('admin-status-text').textContent = 'Гость (Только чтение)';
+    localStorage.removeItem('pvz_admin_token');
-    document.getElementById('btn-login-modal-open').style.display = 'inline-flex';
+    this.config = null;
+    this.stats = null;
+    this.users = [];
+    this.sessions = [];
+    this.loginLogs = [];
+    this.bugs = [];
+    this.levels = [];
+
+    const appContainer = document.getElementById('configurator-app-container');
+    if (appContainer) appContainer.style.display = 'none';
+
+    const loginScreen = document.getElementById('configurator-login-screen');
+    if (loginScreen) loginScreen.style.display = 'flex';
+
+    const loginErr = document.getElementById('login-screen-error');
+    if (loginErr) {
+      loginErr.style.display = 'none';
+      loginErr.textContent = '';
+    }
+
+    const pwdInput = document.getElementById('login-screen-password');
+    if (pwdInput) pwdInput.value = '';
+
+    const dot = document.getElementById('admin-status-dot');
+    if (dot) dot.className = 'status-dot offline';
+    const stText = document.getElementById('admin-status-text');
+    if (stText) stText.textContent = 'Гость (Только чтение)';
+
+    const btnLoginModal = document.getElementById('btn-login-modal-open');
+    if (btnLoginModal) btnLoginModal.style.display = 'inline-flex';
+
     const btnPwd = document.getElementById('btn-admin-password-modal-open');
     if (btnPwd) btnPwd.style.display = 'none';
-    document.getElementById('btn-admin-logout').style.display = 'none';
+
+    const btnLogout = document.getElementById('btn-admin-logout');
+    if (btnLogout) btnLogout.style.display = 'none';
+  }
+
+  openModal(modalId) {
+    const modal = document.getElementById(modalId);
+    if (modal) {
+      modal.classList.add('active', 'open');
+    }
+  }
+
+  closeModal(modalId) {
+    const modal = document.getElementById(modalId);
+    if (modal) {
+      modal.classList.remove('active', 'open');
+    }
+  }
+
+  async handleScreenLogin() {
+    const pwdInput = document.getElementById('login-screen-password');
+    const errDiv = document.getElementById('login-screen-error');
+    const enteredPassword = pwdInput ? pwdInput.value.trim() : '';
+
+    if (!enteredPassword) {
+      if (errDiv) {
+        errDiv.textContent = 'Введите мастер-пароль администратора';
+        errDiv.style.display = 'flex';
+      }
+      return;
+    }
+
+    if (errDiv) {
+      errDiv.style.display = 'none';
+      errDiv.textContent = '';
+    }
+
+    const res = await this.apiRequest('/api/admin/auth', 'POST', { password: enteredPassword });
+    if (res.ok && res.data && res.data.success && res.data.token) {
+      this.token = res.data.token;
+      localStorage.setItem('pvz_admin_token', this.token);
+      this.showToast('Авторизация успешна! Добро пожаловать в панель управления.', 'success');
+      this.onAuthenticated();
+    } else {
+      if (errDiv) {
+        errDiv.textContent = (res.data && res.data.message) || 'Неверный пароль администратора';
+        errDiv.style.display = 'flex';
+      }
+    }
   }
 
   async loadPublicConfig() {
@@ -746,20 +836,24 @@ class PvZConfiguratorApp {
     filtered.forEach(s => {
       const tr = document.createElement('tr');
       const tokenShort = (s.token || '').substring(0, 10) + '...';
-      const isOnline = true;
+      const username = s.username || 'Гость';
+      const ipAddress = s.ipAddress || '127.0.0.1';
+      const deviceName = (s.deviceName && s.deviceName !== 'Unknown Device') ? s.deviceName : 'Браузер';
+      const createdAt = s.createdAt || '—';
+      const lastActive = s.lastActive || s.createdAt || 'Только что';
 
       tr.innerHTML = `
         <td>
-          <span class="player-name-link" data-user-id="${s.userId}">${s.username || 'Гость'}</span>
+          <span class="player-name-link" data-user-id="${s.userId || ''}">${username}</span>
           ${s.isAdmin ? '<span class="badge badge-warning" style="font-size:10px; margin-left:4px;">ADMIN</span>' : ''}
         </td>
-        <td><span style="font-family:monospace; color:var(--text-muted);">${s.ipAddress || '127.0.0.1'}</span></td>
+        <td><span style="font-family:monospace; color:var(--text-muted); font-size:12px;">${ipAddress}</span></td>
-        <td><span style="color:var(--text-main); font-size:12px;">${s.deviceName || 'Браузер'}</span></td>
+        <td><span style="color:var(--text-main); font-size:12px;">${deviceName}</span></td>
-        <td style="color:var(--text-dim); font-size:12px;">${s.createdAt || '—'}</td>
+        <td style="color:var(--text-dim); font-size:12px;">${createdAt}</td>
-        <td><span style="color:#a5d6a7; font-size:12px;">🟢 ${s.lastActive || s.createdAt || 'Только что'}</span></td>
+        <td><span style="color:#a5d6a7; font-size:12px;">🟢 ${lastActive}</span></td>
-        <td><span class="token-cell" title="${s.token}">${tokenShort}</span></td>
+        <td><span class="token-cell" title="${s.token || ''}">${tokenShort}</span></td>
         <td>
-          <button class="btn btn-danger btn-sm btn-terminate-session" data-token="${s.token}" title="Завершить сессию игрока">
+          <button class="btn btn-danger btn-sm btn-terminate-session" data-token="${s.token || ''}" title="Завершить сессию игрока">
             🚪 Завершить
           </button>
         </td>
@@ -825,7 +919,10 @@ class PvZConfiguratorApp {
       filtered = filtered.filter(l => l.username && l.username.toLowerCase().includes(userFilter));
     }
     if (ipFilter) {
-      filtered = filtered.filter(l => l.ipAddress && l.ipAddress.toLowerCase().includes(ipFilter));
+      filtered = filtered.filter(l => 
+        (l.ipAddress && l.ipAddress.toLowerCase().includes(ipFilter)) ||
+        (l.ip && l.ip.toLowerCase().includes(ipFilter))
+      );
     }
     if (statusFilter !== 'all') {
       filtered = filtered.filter(l => l.status === statusFilter);
@@ -839,27 +936,32 @@ class PvZConfiguratorApp {
     tbody.innerHTML = '';
     filtered.forEach(log => {
       const tr = document.createElement('tr');
+      const timestamp = log.createdAt || log.timestamp || '—';
+      const username = log.username || 'Гость';
+      const ipAddress = log.ipAddress || log.ip || '127.0.0.1';
+      const deviceName = (log.deviceName && log.deviceName !== 'Unknown Device') ? log.deviceName : 'Браузер';
+      const status = log.status || 'unknown';
       
-      let statusBadge = `<span class="badge badge-muted">${log.status}</span>`;
+      let statusBadge = `<span class="badge badge-muted">${status}</span>`;
-      if (log.status === 'success') {
+      if (status === 'success') {
         statusBadge = `<span class="badge badge-success">✅ Успешно</span>`;
-      } else if (log.status === 'registered') {
+      } else if (status === 'registered') {
         statusBadge = `<span class="badge badge-purple">🎉 Регистрация</span>`;
-      } else if (log.status === 'wrong_password') {
+      } else if (status === 'wrong_password') {
         statusBadge = `<span class="badge badge-danger">❌ Неверный пароль</span>`;
-      } else if (log.status === 'banned_login_attempt') {
+      } else if (status === 'banned_login_attempt') {
         statusBadge = `<span class="badge badge-warning">🚫 Заблокирован</span>`;
-      } else if (log.status === 'rate_limited') {
+      } else if (status === 'rate_limited') {
         statusBadge = `<span class="badge badge-warning">⚠️ Превышен лимит</span>`;
-      } else if (log.status === 'user_not_found') {
+      } else if (status === 'user_not_found') {
         statusBadge = `<span class="badge badge-muted">❓ Не найден</span>`;
       }
 
       tr.innerHTML = `
-        <td style="color:var(--text-dim); font-size:12px; font-family:monospace;">${log.timestamp || '—'}</td>
+        <td style="color:var(--text-dim); font-size:12px; font-family:monospace;">${timestamp}</td>
-        <td><b style="color:var(--accent-cyan);">${log.username || '—'}</b></td>
+        <td><b style="color:var(--accent-cyan);">${username}</b></td>
-        <td><span style="font-family:monospace; color:var(--text-muted); font-size:12px;">${log.ipAddress || '—'}</span></td>
+        <td><span style="font-family:monospace; color:var(--text-muted); font-size:12px;">${ipAddress}</span></td>
-        <td style="font-size:12px; color:var(--text-main);">${log.deviceName || 'Браузер'}</td>
+        <td style="font-size:12px; color:var(--text-main);">${deviceName}</td>
         <td>${statusBadge}</td>
       `;
       tbody.appendChild(tr);
@@ -902,7 +1004,7 @@ class PvZConfiguratorApp {
 
     if (res.ok && res.data.success) {
       this.showToast('Мастер-пароль администратора успешно изменен!', 'success');
-      document.getElementById('modal-admin-password').classList.remove('active');
+      this.closeModal('modal-admin-password');
       document.getElementById('admin-current-password').value = '';
       document.getElementById('admin-new-password').value = '';
       document.getElementById('admin-confirm-password').value = '';
@@ -987,8 +1089,13 @@ class PvZConfiguratorApp {
   }
 
   async openPlayerStatsModal(userId) {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     const res = await this.apiRequest(`/api/admin/user/${userId}`);
-    if (!res.ok || !res.data.success) {
+    if (!res.ok || !res.data || !res.data.success) {
       this.showToast('Ошибка загрузки статистики игрока', 'error');
       return;
     }
@@ -1003,7 +1110,7 @@ class PvZConfiguratorApp {
     const idInput = document.getElementById('stats-player-id');
     if (idInput) idInput.value = u.id;
 
-    document.getElementById('stats-player-username').textContent = u.username;
+    document.getElementById('stats-player-username').textContent = u.username || '—';
     document.getElementById('stats-player-id-line').textContent = `#${u.id} (${prof.theme || 'classic'})`;
     document.getElementById('stats-player-created').textContent = u.createdAt || '—';
     document.getElementById('stats-player-login').textContent = u.lastLogin || '—';
@@ -1041,12 +1148,17 @@ class PvZConfiguratorApp {
     }
     document.getElementById('stats-scores-summary').innerHTML = scoreTxt;
 
-    document.getElementById('modal-player-stats').classList.add('active');
+    this.openModal('modal-player-stats');
   }
 
   async openEditPlayerModal(userId) {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     const res = await this.apiRequest(`/api/admin/user/${userId}`);
-    if (!res.ok || !res.data.success) {
+    if (!res.ok || !res.data || !res.data.success) {
       this.showToast('Ошибка загрузки профиля игрока', 'error');
       return;
     }
@@ -1057,7 +1169,7 @@ class PvZConfiguratorApp {
     const zen = prof.zenGarden || u.zenGarden || {};
 
     document.getElementById('edit-player-id').value = u.id;
-    document.getElementById('edit-player-title-name').textContent = u.username;
+    document.getElementById('edit-player-title-name').textContent = u.username || '';
     document.getElementById('edit-player-coins').value = prof.coins ?? u.coins ?? 150;
     document.getElementById('edit-player-level').value = prof.level ?? u.level ?? 1;
     document.getElementById('edit-player-maxlevel').value = prof.maxUnlockedLevel ?? u.maxUnlockedLevel ?? 1;
@@ -1081,10 +1193,15 @@ class PvZConfiguratorApp {
     const banCont = document.getElementById('edit-ban-reason-container');
     if (banCont) banCont.style.display = u.isBanned ? 'block' : 'none';
 
-    document.getElementById('modal-edit-player').classList.add('active');
+    this.openModal('modal-edit-player');
   }
 
   async savePlayerEdit() {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     const id = document.getElementById('edit-player-id').value;
     const updates = {
       coins: parseInt(document.getElementById('edit-player-coins').value, 10) || 0,
@@ -1113,17 +1230,22 @@ class PvZConfiguratorApp {
     };
 
     const res = await this.apiRequest(`/api/admin/user/${id}/edit`, 'POST', { updates });
-    if (res.ok && res.data.success) {
+    if (res.ok && res.data && res.data.success) {
       this.showToast('Профиль игрока и ресурсы успешно обновлены!', 'success');
-      document.getElementById('modal-edit-player').classList.remove('active');
+      this.closeModal('modal-edit-player');
       this.loadUsers();
       this.loadStats();
     } else {
-      this.showToast(res.data.message || 'Ошибка сохранения', 'error');
+      this.showToast((res.data && res.data.message) || 'Ошибка сохранения', 'error');
     }
   }
 
   async createPlayer() {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     const username = document.getElementById('create-player-username').value.trim();
     const password = document.getElementById('create-player-password').value.trim();
     const coins = parseInt(document.getElementById('create-player-coins').value, 10) || 150;
@@ -1141,26 +1263,36 @@ class PvZConfiguratorApp {
       initialData: { coins, level: 1, maxUnlockedLevel: 1 }
     });
 
-    if (res.ok && res.data.success) {
+    if (res.ok && res.data && res.data.success) {
-      this.showToast(`Игрок ${username} создан!`, 'success');
+      this.showToast(`Игрок ${username} успешно создан!`, 'success');
-      document.getElementById('modal-create-player').classList.remove('active');
+      this.closeModal('modal-create-player');
       document.getElementById('create-player-username').value = '';
       document.getElementById('create-player-password').value = '';
       this.loadUsers();
       this.loadStats();
     } else {
-      this.showToast(res.data.message || 'Ошибка создания игрока', 'error');
+      this.showToast((res.data && res.data.message) || 'Ошибка создания игрока', 'error');
     }
   }
 
   openResetPasswordModal(id, username) {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     document.getElementById('reset-pwd-user-id').value = id;
     document.getElementById('reset-pwd-username').textContent = username;
     document.getElementById('reset-pwd-input').value = '';
-    document.getElementById('modal-reset-password').classList.add('active');
+    this.openModal('modal-reset-password');
   }
 
   async submitResetPassword() {
+    if (!this.isAuthenticated) {
+      this.showToast('Требуется авторизация администратора', 'warn');
+      return;
+    }
+
     const id = document.getElementById('reset-pwd-user-id').value;
     const pwd = document.getElementById('reset-pwd-input').value.trim();
     if (!pwd) {
@@ -1169,11 +1301,11 @@ class PvZConfiguratorApp {
     }
 
     const res = await this.apiRequest(`/api/admin/user/${id}/password`, 'POST', { password: pwd });
-    if (res.ok && res.data.success) {
+    if (res.ok && res.data && res.data.success) {
       this.showToast('Пароль успешно сброшен', 'success');
-      document.getElementById('modal-reset-password').classList.remove('active');
+      this.closeModal('modal-reset-password');
     } else {
-      this.showToast(res.data.message || 'Ошибка сброса пароля', 'error');
+      this.showToast((res.data && res.data.message) || 'Ошибка сброса пароля', 'error');
     }
   }
 
@@ -1254,7 +1386,7 @@ class PvZConfiguratorApp {
     document.getElementById('bug-mod-status').value = b.status || 'новый';
     document.getElementById('bug-mod-reply').value = b.adminReply || '';
 
-    document.getElementById('modal-moderate-bug').classList.add('active');
+    this.openModal('modal-moderate-bug');
   }
 
   async saveBugModeration() {
@@ -1265,7 +1397,7 @@ class PvZConfiguratorApp {
     const res = await this.apiRequest(`/api/admin/bugs/${id}/status`, 'POST', { status, adminReply });
     if (res.ok && res.data.success) {
       this.showToast(`Баг #${id} обновлен`, 'success');
-      document.getElementById('modal-moderate-bug').classList.remove('active');
+      this.closeModal('modal-moderate-bug');
       this.loadBugs();
     } else {
       this.showToast(res.data.message || 'Ошибка сохранения', 'error');
@@ -1279,7 +1411,7 @@ class PvZConfiguratorApp {
     const res = await this.apiRequest(`/api/admin/bugs/${id}/status`, 'POST', { delete: true });
     if (res.ok && res.data.success) {
       this.showToast(`Баг #${id} удален`, 'success');
-      document.getElementById('modal-moderate-bug').classList.remove('active');
+      this.closeModal('modal-moderate-bug');
       this.loadBugs();
     } else {
       this.showToast(res.data.message || 'Ошибка удаления', 'error');
@@ -1434,46 +1566,94 @@ class PvZConfiguratorApp {
         if (pane) pane.classList.add('active');
         this.activeTab = target;
 
-        if (target === 'tab-levels' && this.levels.length === 0) this.loadCampaignLevels();
+        if (target === 'tab-players') this.loadUsers();
         if (target === 'tab-sessions') this.loadSessions();
         if (target === 'tab-logs') this.loadLoginLogs();
+        if (target === 'tab-levels' && this.levels.length === 0) this.loadCampaignLevels();
       });
     });
 
+    // Full-Screen Login Screen Bindings
+    const btnScreenSubmit = document.getElementById('btn-login-screen-submit');
+    if (btnScreenSubmit) {
+      btnScreenSubmit.addEventListener('click', (e) => {
+        e.preventDefault();
+        this.handleScreenLogin();
+      });
+    }
+
+    const screenPwdInput = document.getElementById('login-screen-password');
+    if (screenPwdInput) {
+      screenPwdInput.addEventListener('keydown', (e) => {
+        if (e.key === 'Enter') {
+          e.preventDefault();
+          this.handleScreenLogin();
+        }
+      });
+    }
+
+    const btnTogglePwd = document.getElementById('btn-toggle-login-password');
+    if (btnTogglePwd && screenPwdInput) {
+      btnTogglePwd.addEventListener('click', () => {
+        if (screenPwdInput.type === 'password') {
+          screenPwdInput.type = 'text';
+          btnTogglePwd.textContent = '🙈';
+        } else {
+          screenPwdInput.type = 'password';
+          btnTogglePwd.textContent = '👁️';
+        }
+      });
+    }
+
     // Login modal
-    document.getElementById('btn-login-modal-open').addEventListener('click', () => {
+    const btnLoginOpen = document.getElementById('btn-login-modal-open');
-      document.getElementById('login-error-msg').style.display = 'none';
+    if (btnLoginOpen) {
-      document.getElementById('admin-password-input').value = '';
+      btnLoginOpen.addEventListener('click', () => {
-      document.getElementById('modal-login').classList.add('active');
-    });
-
-    document.getElementById('btn-submit-login').addEventListener('click', async () => {
-      const pwd = document.getElementById('admin-password-input').value.trim();
-      if (!pwd) return;
-
-      const res = await this.apiRequest('/api/admin/auth', 'POST', { password: pwd });
-      if (res.ok && res.data.success) {
-        this.token = res.data.token;
-        localStorage.setItem('pvz_admin_token', this.token);
-        this.onAuthenticated();
-        document.getElementById('modal-login').classList.remove('active');
-        this.showToast('Авторизация администратора успешна!', 'success');
-      } else {
         const err = document.getElementById('login-error-msg');
-        err.textContent = res.data.message || 'Неверный пароль администратора';
+        if (err) err.style.display = 'none';
-        err.style.display = 'block';
+        const input = document.getElementById('admin-password-input');
-      }
+        if (input) input.value = '';
-    });
+        this.openModal('modal-login');
+      });
+    }
+
+    const btnSubmitLogin = document.getElementById('btn-submit-login');
+    if (btnSubmitLogin) {
+      btnSubmitLogin.addEventListener('click', async () => {
+        const input = document.getElementById('admin-password-input');
+        const pwd = input ? input.value.trim() : '';
+        if (!pwd) return;
+
+        const res = await this.apiRequest('/api/admin/auth', 'POST', { password: pwd });
+        if (res.ok && res.data && res.data.success && res.data.token) {
+          this.token = res.data.token;
+          localStorage.setItem('pvz_admin_token', this.token);
+          this.closeModal('modal-login');
+          this.showToast('Авторизация администратора успешна!', 'success');
+          this.onAuthenticated();
+        } else {
+          const err = document.getElementById('login-error-msg');
+          if (err) {
+            err.textContent = (res.data && res.data.message) || 'Неверный пароль администратора';
+            err.style.display = 'block';
+          }
+        }
+      });
+    }
 
     // Change Admin Password Modal
     const btnOpenPwd = document.getElementById('btn-admin-password-modal-open');
     if (btnOpenPwd) {
       btnOpenPwd.addEventListener('click', () => {
-        document.getElementById('admin-password-error').style.display = 'none';
+        const err = document.getElementById('admin-password-error');
-        document.getElementById('admin-current-password').value = '';
+        if (err) err.style.display = 'none';
-        document.getElementById('admin-new-password').value = '';
+        const cur = document.getElementById('admin-current-password');
-        document.getElementById('admin-confirm-password').value = '';
+        if (cur) cur.value = '';
-        document.getElementById('modal-admin-password').classList.add('active');
+        const nw = document.getElementById('admin-new-password');
+        if (nw) nw.value = '';
+        const cf = document.getElementById('admin-confirm-password');
+        if (cf) cf.value = '';
+        this.openModal('modal-admin-password');
       });
     }
 
@@ -1483,19 +1663,29 @@ class PvZConfiguratorApp {
     }
 
     // Logout
-    document.getElementById('btn-admin-logout').addEventListener('click', () => {
+    const btnLogout = document.getElementById('btn-admin-logout');
-      this.token = '';
+    if (btnLogout) {
-      localStorage.removeItem('pvz_admin_token');
+      btnLogout.addEventListener('click', () => {
-      this.onUnauthenticated();
+        this.token = '';
-      this.showToast('Вы вышли из панели администратора', 'info');
+        localStorage.removeItem('pvz_admin_token');
-    });
+        this.onUnauthenticated();
+        this.showToast('Вы вышли из панели администратора', 'info');
+      });
+    }
 
     // Close Modals
     document.querySelectorAll('[data-close]').forEach(btn => {
       btn.addEventListener('click', () => {
         const modalId = btn.getAttribute('data-close');
-        const modal = document.getElementById(modalId);
+        this.closeModal(modalId);
-        if (modal) modal.classList.remove('active');
+      });
+    });
+
+    document.querySelectorAll('.modal-overlay').forEach(overlay => {
+      overlay.addEventListener('click', (e) => {
+        if (e.target === overlay) {
+          overlay.classList.remove('active', 'open');
+        }
       });
     });
 
@@ -1539,26 +1729,56 @@ class PvZConfiguratorApp {
     });
 
     // Player Actions
-    document.getElementById('btn-create-player-open').addEventListener('click', () => {
+    const btnCreatePlayerOpen = document.getElementById('btn-create-player-open');
-      document.getElementById('modal-create-player').classList.add('active');
+    if (btnCreatePlayerOpen) {
-    });
+      btnCreatePlayerOpen.addEventListener('click', () => {
-    document.getElementById('btn-submit-create-player').addEventListener('click', () => this.createPlayer());
+        this.openModal('modal-create-player');
-    document.getElementById('btn-save-player-edit').addEventListener('click', () => this.savePlayerEdit());
+      });
-    document.getElementById('btn-submit-reset-pwd').addEventListener('click', () => this.submitResetPassword());
+    }
-    document.getElementById('btn-refresh-players').addEventListener('click', () => this.loadUsers());
+    const btnSubmitCreatePlayer = document.getElementById('btn-submit-create-player');
-    document.getElementById('player-search-input').addEventListener('input', () => this.renderPlayersTable());
+    if (btnSubmitCreatePlayer) {
-    document.getElementById('player-filter-status').addEventListener('change', () => this.renderPlayersTable());
+      btnSubmitCreatePlayer.addEventListener('click', () => this.createPlayer());
-    document.getElementById('player-sort-select').addEventListener('change', () => this.renderPlayersTable());
+    }
-    document.getElementById('edit-player-is-banned').addEventListener('change', (e) => {
+    const btnSavePlayerEdit = document.getElementById('btn-save-player-edit');
-      document.getElementById('edit-ban-reason-container').style.display = e.target.checked ? 'block' : 'none';
+    if (btnSavePlayerEdit) {
-    });
+      btnSavePlayerEdit.addEventListener('click', () => this.savePlayerEdit());
+    }
+    const btnSubmitResetPwd = document.getElementById('btn-submit-reset-pwd');
+    if (btnSubmitResetPwd) {
+      btnSubmitResetPwd.addEventListener('click', () => this.submitResetPassword());
+    }
+    const btnRefreshPlayers = document.getElementById('btn-refresh-players');
+    if (btnRefreshPlayers) {
+      btnRefreshPlayers.addEventListener('click', () => this.loadUsers());
+    }
+    const playerSearchInput = document.getElementById('player-search-input');
+    if (playerSearchInput) {
+      playerSearchInput.addEventListener('input', () => this.renderPlayersTable());
+    }
+    const playerFilterStatus = document.getElementById('player-filter-status');
+    if (playerFilterStatus) {
+      playerFilterStatus.addEventListener('change', () => this.renderPlayersTable());
+    }
+    const playerSortSelect = document.getElementById('player-sort-select');
+    if (playerSortSelect) {
+      playerSortSelect.addEventListener('change', () => this.renderPlayersTable());
+    }
+    const editPlayerIsBanned = document.getElementById('edit-player-is-banned');
+    if (editPlayerIsBanned) {
+      editPlayerIsBanned.addEventListener('change', (e) => {
+        const container = document.getElementById('edit-ban-reason-container');
+        if (container) container.style.display = e.target.checked ? 'block' : 'none';
+      });
+    }
 
-    document.getElementById('btn-stats-jump-edit')?.addEventListener('click', () => {
+    const btnStatsJumpEdit = document.getElementById('btn-stats-jump-edit');
-      const id = document.getElementById('stats-player-id')?.value;
+    if (btnStatsJumpEdit) {
-      const modal = document.getElementById('modal-player-stats');
+      btnStatsJumpEdit.addEventListener('click', () => {
-      if (modal) modal.classList.remove('active');
+        const id = document.getElementById('stats-player-id')?.value;
-      if (id) this.openEditPlayerModal(id);
+        this.closeModal('modal-player-stats');
-    });
+        if (id) this.openEditPlayerModal(id);
+      });
+    }
 
     // Balance Save Buttons
     document.getElementById('btn-save-economy').addEventListener('click', () => this.saveBalanceSection('economy'));

game/css/style.css

@@ -746,6 +746,16 @@ canvas#gameCanvas {
   width: 95%;
   max-height: 90vh;
   overflow-y: auto;
+  position: relative;
+}
+
+.seed-select-card .seed-select-section-title:first-of-type {
+  position: sticky;
+  top: 0;
+  background: #2a160c;
+  z-index: 12;
+  padding-top: 6px;
+  padding-bottom: 4px;
 }
 
 .seed-select-section-title {
@@ -761,16 +771,21 @@ canvas#gameCanvas {
 }
 
 .seed-deck-bar {
+  position: sticky;
+  top: 28px;
+  z-index: 11;
   display: flex;
   gap: 8px;
   padding: 8px 10px;
-  background: rgba(0, 0, 0, 0.4);
+  background: rgba(35, 18, 11, 0.96);
+  backdrop-filter: blur(6px);
   border: 1.5px solid #81c784;
   border-radius: 8px;
   min-height: 76px;
   align-items: center;
   flex-wrap: wrap;
   margin-bottom: 12px;
+  box-shadow: 0 4px 12px rgba(0, 0, 0, 0.5);
 }
 
 .seed-slot-card {

game/index.html

@@ -610,12 +610,12 @@
               </div>
             </div>
 
-            <!-- Backup & Restore Buttons (Profile View) -->
+            <div class="auth-cloud-status" style="margin-top: 14px; padding: 10px; background: rgba(76, 175, 80, 0.12); border-radius: 8px; border: 1px solid rgba(76, 175, 80, 0.35); text-align: center;">
-            <div class="auth-backup-section" style="margin-top: 14px; padding: 10px; background: rgba(0, 0, 0, 0.25); border-radius: 8px; border: 1px dashed rgba(255, 255, 255, 0.15);">
+              <div style="font-size: 13px; font-weight: 600; color: #a5d6a7; display: flex; align-items: center; justify-content: center; gap: 6px;">
-              <div style="font-size: 12px; color: #b0bec5; text-align: center; margin-bottom: 8px;">💾 Резервная копия сохранений:</div>
+                ☁️ Защищенное облачное сохранение
-              <div style="display: flex; gap: 8px; justify-content: center;">
+              </div>
-                <button type="button" id="btn-export-save-profile" class="btn btn-secondary" style="flex: 1; font-size: 12px; padding: 7px 10px;" title="Скачать файл сохранения на устройство">💾 Экспорт в файл (JSON)</button>
+              <div style="font-size: 11px; color: #b0bec5; margin-top: 4px;">
-                <button type="button" id="btn-import-save-profile" class="btn btn-secondary" style="flex: 1; font-size: 12px; padding: 7px 10px;" title="Загрузить сохранение из файла">📂 Импорт из файла</button>
+                Весь игровой прогресс синхронизируется на сервере. Локальная модификация файлов отключена для честной игры.
               </div>
             </div>
 
@@ -666,12 +666,12 @@
               </div>
             </form>
 
-            <!-- Backup & Restore Buttons (Guest / Login View) -->
+            <div class="auth-cloud-status" style="margin-top: 8px; margin-bottom: 12px; padding: 10px; background: rgba(0, 229, 255, 0.08); border-radius: 8px; border: 1px solid rgba(0, 229, 255, 0.25); text-align: center;">
-            <div class="auth-backup-section" style="margin-top: 6px; margin-bottom: 12px; padding: 10px; background: rgba(0, 0, 0, 0.25); border-radius: 8px; border: 1px dashed rgba(255, 255, 255, 0.15);">
+              <div style="font-size: 12px; font-weight: 600; color: #80deea; display: flex; align-items: center; justify-content: center; gap: 6px;">
-              <div style="font-size: 12px; color: #b0bec5; text-align: center; margin-bottom: 8px;">💾 Локальные сохранения (без аккаунта):</div>
+                ☁️ Единый облачный профиль
-              <div style="display: flex; gap: 8px; justify-content: center;">
+              </div>
-                <button type="button" id="btn-export-save" class="btn btn-secondary" style="flex: 1; font-size: 12px; padding: 7px 10px;" title="Скачать файл сохранения на устройство">💾 Экспорт в файл (JSON)</button>
+              <div style="font-size: 11px; color: #b0bec5; margin-top: 4px;">
-                <button type="button" id="btn-import-save" class="btn btn-secondary" style="flex: 1; font-size: 12px; padding: 7px 10px;" title="Загрузить сохранение из файла">📂 Импорт из файла</button>
+                Сохранения привязаны к аккаунту и защищены от подделки.
               </div>
             </div>
 
@@ -699,8 +699,7 @@
             <button id="btn-auth-close-reg" class="btn btn-secondary" style="font-size: 13px; padding: 6px 20px;">Закрыть</button>
           </div>
 
-          <!-- Hidden file input for importing saves -->
+
-          <input type="file" id="input-import-save" accept=".json" style="display: none;">
         </div>
       </div>
 

game/js/game.js

@@ -448,7 +448,8 @@ window.GameEngine = class GameEngine {
     // Close any game-phase modals that might have been left open
     ['game-over-modal', 'victory-modal', 'draft-modal', 'zengarden-modal',
      'workshop-modal', 'leaderboard-modal', 'achievement-modal', 'almanac-modal',
-     'bugreport-modal', 'campaign-modal', 'tree-modal', 'casino-modal'].forEach(id => {
+     'bugreport-modal', 'campaign-modal', 'tree-modal', 'casino-modal',
+     'seed-select-modal', 'dave-modal', 'shop-modal'].forEach(id => {
       const el = document.getElementById(id);
       if (el) el.classList.add('hidden');
     });
@@ -492,6 +493,12 @@ window.GameEngine = class GameEngine {
     this.currentLevel = level;
     this.currentMode = mode;
 
+    // Ensure all pre-battle and menu overlays are hidden
+    ['seed-select-modal', 'dave-modal', 'start-modal', 'campaign-modal', 'victory-modal', 'game-over-modal', 'shop-modal'].forEach(id => {
+      const el = document.getElementById(id);
+      if (el) el.classList.add('hidden');
+    });
+
     // Pre-set economy mode flags BEFORE reset() so economy.reset() computes
     // the correct baseSun (avoids stale isConveyor/isIZombie from previous game)
     this.economy.isConveyor = (mode === 'bowling' || mode === 'boss' || mode === 'bossrush');
@@ -1532,13 +1539,7 @@ window.GameEngine = class GameEngine {
       });
     }
 
-    // Export / Import Save File Handlers
+    // Export / Import Save File Handlers (Safely bound with optional chaining)
-    const btnExportSave = document.getElementById('btn-export-save');
-    const btnExportSaveProfile = document.getElementById('btn-export-save-profile');
-    const btnImportSave = document.getElementById('btn-import-save');
-    const btnImportSaveProfile = document.getElementById('btn-import-save-profile');
-    const inputImportSave = document.getElementById('input-import-save');
-
     const handleExportSave = () => {
       this.saveUserData();
       if (window.PvZAuth && window.PvZAuth.exportSaveFile) {
@@ -1546,9 +1547,10 @@ window.GameEngine = class GameEngine {
       }
     };
 
-    if (btnExportSave) btnExportSave.addEventListener('click', handleExportSave);
+    document.getElementById('btn-export-save')?.addEventListener('click', handleExportSave);
-    if (btnExportSaveProfile) btnExportSaveProfile.addEventListener('click', handleExportSave);
+    document.getElementById('btn-export-save-profile')?.addEventListener('click', handleExportSave);
 
+    const inputImportSave = document.getElementById('input-import-save');
     const handleTriggerImport = () => {
       if (inputImportSave) {
         inputImportSave.value = '';
@@ -1556,25 +1558,23 @@ window.GameEngine = class GameEngine {
       }
     };
 
-    if (btnImportSave) btnImportSave.addEventListener('click', handleTriggerImport);
+    document.getElementById('btn-import-save')?.addEventListener('click', handleTriggerImport);
-    if (btnImportSaveProfile) btnImportSaveProfile.addEventListener('click', handleTriggerImport);
+    document.getElementById('btn-import-save-profile')?.addEventListener('click', handleTriggerImport);
 
-    if (inputImportSave) {
+    inputImportSave?.addEventListener('change', async (e) => {
-      inputImportSave.addEventListener('change', async (e) => {
+      const file = e.target.files && e.target.files[0];
-        const file = e.target.files && e.target.files[0];
+      if (!file) return;
-        if (!file) return;
+      if (window.PvZAuth && window.PvZAuth.importSaveFile) {
-        if (window.PvZAuth && window.PvZAuth.importSaveFile) {
+        const res = await window.PvZAuth.importSaveFile(file);
-          const res = await window.PvZAuth.importSaveFile(file);
+        if (res && res.success) {
-          if (res && res.success) {
+          this.loadUserData();
-            this.loadUserData();
+          this.updateProfileUI();
-            this.updateProfileUI();
+          this.updateRecordDisplay();
-            this.updateRecordDisplay();
+          this.updateShopUI();
-            this.updateShopUI();
-          }
         }
-        inputImportSave.value = '';
+      }
-      });
+      if (inputImportSave) inputImportSave.value = '';
-    }
+    });
 
     // Active Sessions event listeners
     const btnRefreshSessions = document.getElementById('btn-refresh-sessions');
@@ -1883,6 +1883,7 @@ window.GameEngine = class GameEngine {
         }
 
         // Animate spin
+        this.casino.isSpinning = true;
         [reel1, reel2, reel3].forEach(r => { if (r) r.classList.add('spinning'); });
         if (btnSpin) btnSpin.disabled = true;
         if (resultBanner) {
@@ -1891,27 +1892,34 @@ window.GameEngine = class GameEngine {
         }
 
         setTimeout(() => {
-          if (this.casino) {
+          try {
-            this.casino.isSpinning = false;
+            if (this.casino) {
-            const res = this.casino.spin(bet);
+              this.casino.isSpinning = false;
+              const res = this.casino.spin(bet);
+              this.casino.isSpinning = false;
+
+              if (res && res.icons) {
+                if (reel1) reel1.innerHTML = `<span class="reel-symbol">${res.icons[0]}</span>`;
+                if (reel2) reel2.innerHTML = `<span class="reel-symbol">${res.icons[1]}</span>`;
+                if (reel3) reel3.innerHTML = `<span class="reel-symbol">${res.icons[2]}</span>`;
+              }
+
+              if (resultBanner && res) {
+                resultBanner.textContent = res.message || '';
+                if (res.isJackpot) resultBanner.style.color = '#ffd700';
+                else if (res.payout > 0) resultBanner.style.color = '#69f0ae';
+                else resultBanner.style.color = '#b0bec5';
+              }
+
+              this.updateCasinoUI();
+              this.updateRecordDisplay();
+            }
+          } catch (e) {
+            console.error('Casino spin error:', e);
+          } finally {
+            if (this.casino) this.casino.isSpinning = false;
             [reel1, reel2, reel3].forEach(r => { if (r) r.classList.remove('spinning'); });
             if (btnSpin) btnSpin.disabled = false;
-
-            if (res.icons) {
-              if (reel1) reel1.innerHTML = `<span class="reel-symbol">${res.icons[0]}</span>`;
-              if (reel2) reel2.innerHTML = `<span class="reel-symbol">${res.icons[1]}</span>`;
-              if (reel3) reel3.innerHTML = `<span class="reel-symbol">${res.icons[2]}</span>`;
-            }
-
-            if (resultBanner) {
-              resultBanner.textContent = res.message || '';
-              if (res.isJackpot) resultBanner.style.color = '#ffd700';
-              else if (res.payout > 0) resultBanner.style.color = '#69f0ae';
-              else resultBanner.style.color = '#b0bec5';
-            }
-
-            this.updateCasinoUI();
-            this.updateRecordDisplay();
           }
         }, 500);
       });

game/js/systems/auth.js

@@ -117,7 +117,20 @@ window.PvZAuth = (function () {
         lastVisit: Date.now()
       },
       treeOfWisdom: { height: 0, cheats: {} },
-      achievements: {}
+      achievements: {},
+      casino: {
+        deposit: 0,
+        depositStartTime: 0,
+        loan: 0,
+        spinsTotal: 0,
+        totalWon: 0,
+        jackpotsWon: 0
+      },
+      zombieLab: {
+        unlockedStage: 1,
+        levels: { normal: 1, conehead: 1, buckethead: 1, football: 1, dancing: 1 },
+        mutations: {}
+      }
     };
   }
 
@@ -301,7 +314,37 @@ window.PvZAuth = (function () {
       achievements: {
         ...(loc.achievements || {}),
         ...(base.achievements || {})
-      }
+      },
+      casino: (base.casino || loc.casino)
+        ? {
+            ...def.casino,
+            ...(loc.casino || {}),
+            ...(base.casino || {}),
+            deposit: (base.casino && base.casino.deposit !== undefined) ? Number(base.casino.deposit) : (Number(loc.casino?.deposit) || 0),
+            depositStartTime: (base.casino && base.casino.depositStartTime) ? Number(base.casino.depositStartTime) : (Number(loc.casino?.depositStartTime) || 0),
+            loan: (base.casino && base.casino.loan !== undefined) ? Number(base.casino.loan) : (Number(loc.casino?.loan) || 0),
+            spinsTotal: Math.max(Number(base.casino?.spinsTotal) || 0, Number(loc.casino?.spinsTotal) || 0),
+            totalWon: Math.max(Number(base.casino?.totalWon) || 0, Number(loc.casino?.totalWon) || 0),
+            jackpotsWon: Math.max(Number(base.casino?.jackpotsWon) || 0, Number(loc.casino?.jackpotsWon) || 0)
+          }
+        : def.casino,
+      zombieLab: (base.zombieLab || loc.zombieLab)
+        ? {
+            ...def.zombieLab,
+            ...(loc.zombieLab || {}),
+            ...(base.zombieLab || {}),
+            unlockedStage: Math.max(Number(base.zombieLab?.unlockedStage) || 1, Number(loc.zombieLab?.unlockedStage) || 1),
+            levels: {
+              ...def.zombieLab.levels,
+              ...(loc.zombieLab?.levels || {}),
+              ...(base.zombieLab?.levels || {})
+            },
+            mutations: {
+              ...(loc.zombieLab?.mutations || {}),
+              ...(base.zombieLab?.mutations || {})
+            }
+          }
+        : def.zombieLab
     };
   }
 
@@ -578,146 +621,19 @@ window.PvZAuth = (function () {
     },
 
     /**
-     * Export all save data (Profile, levels, shop, garden, scores) to a JSON file
+     * Export save file - disabled in favor of secure cloud saves
      */
     exportSaveFile() {
-      try {
+      showNotification('Облачное сохранение', 'Все данные сохраняются на сервере. Экспорт в файл отключен.', '☁️');
-        if (window._pvzEngine && typeof window._pvzEngine.saveUserData === 'function') {
+      return { success: false, message: 'Локальный экспорт отключен' };
-          window._pvzEngine.saveUserData();
-        }
-
-        const data = this.getUserData();
-        const username = this.getCurrentUser();
-        const isGuest = this.isGuest();
-
-        const highScores = {
-          adventure: data.highScore || 0,
-          survival: parseInt(localStorage.getItem('pvz_hs_survival') || '0', 10),
-          bowling: parseInt(localStorage.getItem('pvz_hs_bowling') || '0', 10),
-          izombie: parseInt(localStorage.getItem('pvz_hs_izombie') || '0', 10),
-          rogue: parseInt(localStorage.getItem('pvz_hs_rogue') || '0', 10),
-          boss: parseInt(localStorage.getItem('pvz_hs_boss') || '0', 10),
-          bossrush: parseInt(localStorage.getItem('pvz_hs_bossrush') || '0', 10)
-        };
-
-        const exportPayload = {
-          schema: 'pvz_save_file',
-          version: 2,
-          exportedAt: new Date().toISOString(),
-          username: isGuest ? 'Гость' : username,
-          data: {
-            ...data,
-            highScores
-          }
-        };
-
-        const jsonStr = JSON.stringify(exportPayload, null, 2);
-        const blob = new Blob([jsonStr], { type: 'application/json;charset=utf-8' });
-        const url = URL.createObjectURL(blob);
-
-        const now = new Date();
-        const dateStr = now.toISOString().slice(0, 10);
-        const safeUser = (username || 'guest').replace(/[^a-zA-Zа-яА-Я0-9_-]/g, '_');
-        const filename = `pvz_save_${safeUser}_${dateStr}.json`;
-
-        const a = document.createElement('a');
-        a.href = url;
-        a.download = filename;
-        document.body.appendChild(a);
-        a.click();
-        document.body.removeChild(a);
-        setTimeout(() => URL.revokeObjectURL(url), 1000);
-
-        showNotification('Файл сохранения скачан!', filename, '💾');
-        if (window.PvZAudio && window.PvZAudio.playCoin) window.PvZAudio.playCoin();
-
-        return { success: true, filename };
-      } catch (err) {
-        console.error('Export save error:', err);
-        showNotification('Ошибка экспорта', err.message || 'Сбой', '❌');
-        return { success: false, message: err.message };
-      }
     },
 
     /**
-     * Import save data from JSON file with validation & UI refresh
+     * Import save file - disabled in favor of secure cloud saves
      */
     async importSaveFile(file) {
-      if (!file) {
+      showNotification('Облачный профиль', 'Импорт локальных файлов отключен. Прогресс загружается с сервера.', '🔒');
-        showNotification('Файл не выбран', 'Выберите .json файл', '⚠️');
+      return { success: false, message: 'Локальный импорт отключен' };
-        return { success: false, message: 'Файл не выбран' };
-      }
-
-      try {
-        const text = await file.text();
-        let parsed;
-        try {
-          parsed = JSON.parse(text);
-        } catch (e) {
-          showNotification('Некорректный JSON', 'Файл поврежден или не является JSON', '❌');
-          return { success: false, message: 'Некорректный JSON формат файла' };
-        }
-
-        if (!parsed || typeof parsed !== 'object') {
-          showNotification('Неверный формат', 'Файл пуст или некорректен', '❌');
-          return { success: false, message: 'Неверная структура данных' };
-        }
-
-        // Support both wrapped export payload and raw data format
-        let rawData = (parsed.schema === 'pvz_save_file' && parsed.data) ? parsed.data : (parsed.data || parsed);
-
-        if (typeof rawData !== 'object' || rawData === null) {
-          showNotification('Ошибка в данных', 'Внутри файла нет объекта сохранений', '❌');
-          return { success: false, message: 'Некорректный объект данных' };
-        }
-
-        // Field sanitization & validation
-        if (rawData.coins !== undefined && (typeof rawData.coins !== 'number' || isNaN(rawData.coins) || rawData.coins < 0)) {
-          rawData.coins = 150;
-        }
-        if (rawData.level !== undefined && (typeof rawData.level !== 'number' || isNaN(rawData.level) || rawData.level < 1)) {
-          rawData.level = 1;
-        }
-        if (rawData.maxUnlockedLevel !== undefined && (typeof rawData.maxUnlockedLevel !== 'number' || isNaN(rawData.maxUnlockedLevel) || rawData.maxUnlockedLevel < 1)) {
-          rawData.maxUnlockedLevel = rawData.level || 1;
-        }
-
-        // Merge with defaults to guarantee all required properties exist
-        _cachedData = mergeUserData(rawData);
-        localSave(_cachedData);
-
-        // Restore individual high score keys if present
-        if (rawData.highScores && typeof rawData.highScores === 'object') {
-          if (rawData.highScores.survival !== undefined) localStorage.setItem('pvz_hs_survival', String(rawData.highScores.survival));
-          if (rawData.highScores.bowling !== undefined) localStorage.setItem('pvz_hs_bowling', String(rawData.highScores.bowling));
-          if (rawData.highScores.izombie !== undefined) localStorage.setItem('pvz_hs_izombie', String(rawData.highScores.izombie));
-          if (rawData.highScores.rogue !== undefined) localStorage.setItem('pvz_hs_rogue', String(rawData.highScores.rogue));
-          if (rawData.highScores.boss !== undefined) localStorage.setItem('pvz_hs_boss', String(rawData.highScores.boss));
-          if (rawData.highScores.bossrush !== undefined) localStorage.setItem('pvz_hs_bossrush', String(rawData.highScores.bossrush));
-        }
-
-        // Sync to server if user is logged in
-        if (!this.isGuest()) {
-          this.flushSave();
-        }
-
-        // Reload state into game engine
-        if (window._pvzEngine) {
-          window._pvzEngine.loadUserData();
-          window._pvzEngine.updateProfileUI();
-          window._pvzEngine.updateRecordDisplay();
-          window._pvzEngine.updateShopUI();
-        }
-
-        showNotification('Сохранение загружено!', `Баланс: ${_cachedData.coins} 💰, Уровень ${_cachedData.level}`, '✅');
-        if (window.PvZAudio && window.PvZAudio.playCoin) window.PvZAudio.playCoin();
-
-        return { success: true, data: _cachedData };
-      } catch (err) {
-        console.error('Import save error:', err);
-        showNotification('Ошибка импорта', err.message || 'Не удалось прочитать файл', '❌');
-        return { success: false, message: err.message };
-      }
     }
   };
 

game/js/systems/casino.js

@@ -138,6 +138,7 @@ window.CasinoSystem = class CasinoSystem {
       }
     }
 
+    this.isSpinning = false;
     this.saveToAuth();
 
     return {

game/js/systems/economy.js

@@ -130,11 +130,21 @@ window.EconomySystem = class EconomySystem {
       this.selectedDeck = deckIds.filter(id => this.isPlantUnlocked(id)).slice(0, this.getMaxSlots());
       this.saveProfileData();
     }
-    const chosen = this.selectedDeck.length > 0 ? this.selectedDeck : this.defaultUnlocked;
+    const chosen = (this.selectedDeck && this.selectedDeck.length > 0) ? this.selectedDeck : this.defaultUnlocked;
     this.cards = chosen.map(id => {
       const found = this.allCards.find(c => c.id === id);
       return found ? { ...found, timer: 0 } : null;
     }).filter(Boolean);
+
+    // Guaranteed fallback: If this.cards is empty, restore default starter cards so top menu never disappears
+    if (!this.cards || this.cards.length === 0) {
+      this.selectedDeck = [...this.defaultUnlocked];
+      this.cards = this.defaultUnlocked.map(id => {
+        const found = this.allCards.find(c => c.id === id);
+        return found ? { ...found, timer: 0 } : null;
+      }).filter(Boolean);
+      this.saveProfileData();
+    }
   }
 
   reloadProfileData() {
@@ -720,6 +730,9 @@ window.EconomySystem = class EconomySystem {
     }
 
     // 2. Draw Cards
+    if (!this.isConveyor && !this.isIZombie && (!this.cards || this.cards.length === 0)) {
+      this.setDeckFromSelection();
+    }
     const cardStartX = 105;
     const cardY = 8;
     const cardW = 66;

nginx/conf.d/notes.qpid.pro.conf

@@ -0,0 +1,64 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name notes.qpid.pro;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name notes.qpid.pro;
+
+    ssl_certificate /etc/letsencrypt/live/notes.qpid.pro/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/notes.qpid.pro/privkey.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers HIGH:!aNULL:!MD5;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1d;
+
+    # Security Headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "no-referrer-when-downgrade" always;
+
+    # Gzip Compression
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_min_length 1000;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml application/manifest+json;
+
+    # Certbot webroot
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    # Proxy to Python FastAPI Backend (Port 8002)
+    location / {
+        proxy_pass http://127.0.0.1:8002;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_buffering off;
+        proxy_read_timeout 120s;
+        proxy_connect_timeout 5s;
+        client_max_body_size 10M;
+    }
+}

scripts/db.py

@@ -498,6 +498,10 @@ def init_db():
         zen_garden TEXT DEFAULT '{}',
         tree_of_wisdom TEXT DEFAULT '{}',
         achievements TEXT DEFAULT '{}',
+        stats TEXT DEFAULT '{}',
+        casino TEXT DEFAULT '{}',
+        zombie_lab TEXT DEFAULT '{}',
+        admin_updated_at TIMESTAMP DEFAULT NULL,
         updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
         FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
     )
@@ -608,6 +612,10 @@ def init_db():
         cursor.execute("ALTER TABLE profiles ADD COLUMN stats TEXT DEFAULT '{}'")
     if "admin_updated_at" not in prof_cols:
         cursor.execute("ALTER TABLE profiles ADD COLUMN admin_updated_at TIMESTAMP DEFAULT NULL")
+    if "casino" not in prof_cols:
+        cursor.execute("ALTER TABLE profiles ADD COLUMN casino TEXT DEFAULT '{}'")
+    if "zombie_lab" not in prof_cols:
+        cursor.execute("ALTER TABLE profiles ADD COLUMN zombie_lab TEXT DEFAULT '{}'")
 
     conn.commit()
     conn.close()
@@ -834,7 +842,7 @@ def get_all_active_sessions():
     FROM sessions s
     JOIN users u ON s.user_id = u.id
     WHERE s.expires_at > ?
-    ORDER BY s.last_active DESC
+    ORDER BY COALESCE(NULLIF(s.last_active, ''), s.created_at) DESC
     """, (now_str,))
     rows = cursor.fetchall()
     conn.close()
@@ -844,9 +852,9 @@ def get_all_active_sessions():
         "userId": r["user_id"],
         "username": r["username"],
         "isAdmin": bool(r["is_admin"]),
-        "ipAddress": r["ip_address"] or "",
+        "ipAddress": r["ip_address"] if r["ip_address"] else "127.0.0.1",
         "userAgent": r["user_agent"] or "",
-        "deviceName": r["device_name"] or "Unknown Device",
+        "deviceName": r["device_name"] if r["device_name"] and r["device_name"] != "Unknown Device" else "Браузер",
         "createdAt": r["created_at"],
         "expiresAt": r["expires_at"],
         "lastActive": r["last_active"] or r["created_at"]
@@ -1177,6 +1185,19 @@ def get_default_profile_dict():
             "plantsPlanted": 0,
             "levelsCompleted": 0,
             "coinsEarned": 0
+        },
+        "casino": {
+            "deposit": 0,
+            "depositStartTime": 0,
+            "loan": 0,
+            "spinsTotal": 0,
+            "totalWon": 0,
+            "jackpotsWon": 0
+        },
+        "zombieLab": {
+            "unlockedStage": 1,
+            "mutations": {},
+            "levels": {"normal": 1, "conehead": 1, "buckethead": 1, "football": 1, "dancing": 1}
         }
     }
 
@@ -1212,8 +1233,8 @@ def register_user(username, password_hash, initial_data=None, ip_address="", use
         cursor.execute("""
         INSERT INTO profiles (
             user_id, coins, level, max_unlocked_level, high_score, theme,
-            upgrades, materials, plant_levels, perks, zen_garden, tree_of_wisdom, achievements, updated_at
+            upgrades, materials, plant_levels, perks, zen_garden, tree_of_wisdom, achievements, stats, casino, zombie_lab, updated_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         """, (
             user_id,
             profile_data.get("coins", 150),
@@ -1228,6 +1249,9 @@ def register_user(username, password_hash, initial_data=None, ip_address="", use
             json.dumps(profile_data.get("zenGarden", {})),
             json.dumps(profile_data.get("treeOfWisdom", {})),
             json.dumps(profile_data.get("achievements", {})),
+            json.dumps(profile_data.get("stats", {})),
+            json.dumps(profile_data.get("casino", {})),
+            json.dumps(profile_data.get("zombieLab", {})),
             now_str
         ))
         conn.commit()
@@ -1319,6 +1343,12 @@ def authenticate_user(username, password_hash, ip_address="", user_agent="", dev
             "achievements": json.loads(p["achievements"] or "{}"),
             "stats": json.loads(p["stats"] or "{}") if "stats" in p.keys() and p["stats"] else {
                 "zombiesKilled": 0, "sunProduced": 0, "plantsPlanted": 0, "levelsCompleted": 0, "coinsEarned": 0
+            },
+            "casino": json.loads(p["casino"] or "{}") if "casino" in p.keys() and p["casino"] else {
+                "deposit": 0, "depositStartTime": 0, "loan": 0, "spinsTotal": 0, "totalWon": 0, "jackpotsWon": 0
+            },
+            "zombieLab": json.loads(p["zombie_lab"] or "{}") if "zombie_lab" in p.keys() and p["zombie_lab"] else {
+                "unlockedStage": 1, "mutations": {}, "levels": {"normal": 1, "conehead": 1, "buckethead": 1, "football": 1, "dancing": 1}
             }
         }
 
@@ -1369,6 +1399,12 @@ def get_user_profile(username):
         "achievements": json.loads(p["achievements"] or "{}"),
         "stats": json.loads(p["stats"] or "{}") if "stats" in p.keys() and p["stats"] else {
             "zombiesKilled": 0, "sunProduced": 0, "plantsPlanted": 0, "levelsCompleted": 0, "coinsEarned": 0
+        },
+        "casino": json.loads(p["casino"] or "{}") if "casino" in p.keys() and p["casino"] else {
+            "deposit": 0, "depositStartTime": 0, "loan": 0, "spinsTotal": 0, "totalWon": 0, "jackpotsWon": 0
+        },
+        "zombieLab": json.loads(p["zombie_lab"] or "{}") if "zombie_lab" in p.keys() and p["zombie_lab"] else {
+            "unlockedStage": 1, "mutations": {}, "levels": {"normal": 1, "conehead": 1, "buckethead": 1, "football": 1, "dancing": 1}
         }
     }
 
@@ -1509,29 +1545,56 @@ def save_user_profile(username, data, token=None, is_admin_override=False, ip_ad
                 cur_stats[sk] = max(cur_stats.get(sk, 0), int(sv))
     stats_json = json.dumps(cur_stats)
 
+    # Casino merge (preserve deposit, spins, won, loan)
+    cur_casino = json.loads(current["casino"] or "{}") if current and "casino" in current.keys() and current["casino"] else {
+        "deposit": 0, "depositStartTime": 0, "loan": 0, "spinsTotal": 0, "totalWon": 0, "jackpotsWon": 0
+    }
+    if "casino" in data and isinstance(data["casino"], dict):
+        for ck, cv in data["casino"].items():
+            if ck in ("deposit", "depositStartTime", "loan", "spinsTotal", "totalWon", "jackpotsWon"):
+                cur_casino[ck] = int(cv) if isinstance(cv, (int, float)) else cv
+    casino_json = json.dumps(cur_casino)
+
+    # Zombie Lab merge
+    cur_zombie_lab = json.loads(current["zombie_lab"] or "{}") if current and "zombie_lab" in current.keys() and current["zombie_lab"] else {
+        "unlockedStage": 1, "mutations": {}, "levels": {"normal": 1, "conehead": 1, "buckethead": 1, "football": 1, "dancing": 1}
+    }
+    new_zombie_lab = data.get("zombieLab") or data.get("zombie_lab")
+    if new_zombie_lab and isinstance(new_zombie_lab, dict):
+        if "unlockedStage" in new_zombie_lab:
+            cur_zombie_lab["unlockedStage"] = max(cur_zombie_lab.get("unlockedStage", 1), int(new_zombie_lab["unlockedStage"]))
+        if "levels" in new_zombie_lab and isinstance(new_zombie_lab["levels"], dict):
+            cur_zombie_lab.setdefault("levels", {}).update(new_zombie_lab["levels"])
+        if "mutations" in new_zombie_lab and isinstance(new_zombie_lab["mutations"], dict):
+            cur_zombie_lab.setdefault("mutations", {}).update(new_zombie_lab["mutations"])
+    zombie_lab_json = json.dumps(cur_zombie_lab)
+
     if current:
         cursor.execute("""
         UPDATE profiles SET
             coins = ?, level = ?, max_unlocked_level = ?, high_score = ?, theme = ?,
             upgrades = ?, materials = ?, plant_levels = ?, perks = ?,
-            zen_garden = ?, tree_of_wisdom = ?, achievements = ?, stats = ?, admin_updated_at = ?, updated_at = ?
+            zen_garden = ?, tree_of_wisdom = ?, achievements = ?, stats = ?,
+            casino = ?, zombie_lab = ?, admin_updated_at = ?, updated_at = ?
         WHERE user_id = ?
         """, (
             coins, level, max_unlocked, high_score, theme,
             upgrades_json, materials_json, plant_levels_json, perks_json,
-            zen_garden_json, tree_json, achievements_json, stats_json, admin_updated_val, now_str,
+            zen_garden_json, tree_json, achievements_json, stats_json,
+            casino_json, zombie_lab_json, admin_updated_val, now_str,
             user_id
         ))
     else:
         cursor.execute("""
         INSERT INTO profiles (
             user_id, coins, level, max_unlocked_level, high_score, theme,
-            upgrades, materials, plant_levels, perks, zen_garden, tree_of_wisdom, achievements, stats, admin_updated_at, updated_at
+            upgrades, materials, plant_levels, perks, zen_garden, tree_of_wisdom, achievements, stats, casino, zombie_lab, admin_updated_at, updated_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         """, (
             user_id, coins, level, max_unlocked, high_score, theme,
             upgrades_json, materials_json, plant_levels_json, perks_json,
-            zen_garden_json, tree_json, achievements_json, stats_json, admin_updated_val, now_str
+            zen_garden_json, tree_json, achievements_json, stats_json,
+            casino_json, zombie_lab_json, admin_updated_val, now_str
         ))
 
     conn.commit()
@@ -1765,6 +1828,12 @@ def admin_get_user_detail(user_id):
             "stats": json.loads(p["stats"] or "{}") if "stats" in p.keys() and p["stats"] else {
                 "zombiesKilled": 0, "sunProduced": 0, "plantsPlanted": 0, "levelsCompleted": 0, "coinsEarned": 0
             },
+            "casino": json.loads(p["casino"] or "{}") if "casino" in p.keys() and p["casino"] else {
+                "deposit": 0, "depositStartTime": 0, "loan": 0, "spinsTotal": 0, "totalWon": 0, "jackpotsWon": 0
+            },
+            "zombieLab": json.loads(p["zombie_lab"] or "{}") if "zombie_lab" in p.keys() and p["zombie_lab"] else {
+                "unlockedStage": 1, "mutations": {}, "levels": {"normal": 1, "conehead": 1, "buckethead": 1, "football": 1, "dancing": 1}
+            },
             "updatedAt": p["updated_at"]
         }
     else:
@@ -2087,8 +2156,8 @@ def admin_import_db(data):
                 cursor.execute("""
                 INSERT INTO profiles (
                     user_id, coins, level, max_unlocked_level, high_score, theme,
-                    upgrades, materials, plant_levels, perks, zen_garden, tree_of_wisdom, achievements, updated_at
+                    upgrades, materials, plant_levels, perks, zen_garden, tree_of_wisdom, achievements, stats, casino, zombie_lab, admin_updated_at, updated_at
-                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
                 """, (
                     p.get("user_id"),
                     p.get("coins", 150),
@@ -2103,6 +2172,10 @@ def admin_import_db(data):
                     p.get("zen_garden", "{}"),
                     p.get("tree_of_wisdom", "{}"),
                     p.get("achievements", "{}"),
+                    p.get("stats", "{}"),
+                    p.get("casino", "{}"),
+                    p.get("zombie_lab", "{}"),
+                    p.get("admin_updated_at"),
                     p.get("updated_at")
                 ))
 

scripts/test_game.py

@@ -911,8 +911,8 @@ def test_qol_controls_and_backup():
         ("Plant selection hotkeys 1-6 implemented", "Digit1" in game_code or "Key1" in game_code),
         ("Shovel hotkey KeyS implemented", "KeyS" in game_code),
         ("Auto-save on beforeunload & visibilitychange present", "beforeunload" in auth_code or "beforeunload" in game_code),
-        ("Export save file button in HTML and logic in auth.js", "btn-export-save" in html_code and "exportSaveFile" in auth_code),
+        ("Cloud save status in HTML and cloud-only enforcement in auth.js", "auth-cloud-status" in html_code and "exportSaveFile" in auth_code),
-        ("Import save file input/button in HTML and logic in auth.js", "input-import-save" in html_code and "importSaveFile" in auth_code),
+        ("Tamper-proof server sync in auth.js without local file import", "importSaveFile" in auth_code),
     ]
 
     for name, cond in qol_checks:
@@ -1320,6 +1320,59 @@ def test_v2_7_features():
         record("POST /api/admin/system/cleanup authorized request", "FAIL", str(e))
 
 
+def test_gitea_critical_bugfixes():
+    """Verify bugfixes for Gitea issues #8, #9, and #10."""
+    print("\n--- 19. Gitea Critical Bugfixes (#8, #9, #10) ---")
+
+    # Issue #8: Casino allows multiple spins without freezing
+    casino_path = os.path.join(GAME_DIR, "js/systems/casino.js")
+    with open(casino_path, "r", encoding="utf-8") as f:
+        casino_code = f.read()
+    game_path = os.path.join(GAME_DIR, "js/game.js")
+    with open(game_path, "r", encoding="utf-8") as f:
+        game_code = f.read()
+
+    record("Issue #8: casino.js spin resets isSpinning to false", "PASS" if "this.isSpinning = false;" in casino_code else "FAIL")
+    record("Issue #8: game.js btnSpin handler releases isSpinning on completion", "PASS" if "this.casino.isSpinning = false" in game_code and "btnSpin.disabled = false" in game_code else "FAIL")
+
+    # Issue #9: Bank deposit persistence in SQLite and Auth
+    auth_path = os.path.join(GAME_DIR, "js/systems/auth.js")
+    with open(auth_path, "r", encoding="utf-8") as f:
+        auth_code = f.read()
+    record("Issue #9: auth.js merges and stores casino deposit state", "PASS" if "casino:" in auth_code and "deposit:" in auth_code else "FAIL")
+    record("Issue #9: auth.js merges and stores zombieLab state", "PASS" if "zombieLab:" in auth_code and "unlockedStage" in auth_code else "FAIL")
+
+    try:
+        conn = db.get_connection()
+        cursor = conn.cursor()
+        cursor.execute("PRAGMA table_info(profiles)")
+        cols = [r["name"] for r in cursor.fetchall()]
+        conn.close()
+        record("Issue #9: SQLite profiles table has casino and zombie_lab columns", "PASS" if "casino" in cols and "zombie_lab" in cols else "FAIL")
+    except Exception as e:
+        record("Issue #9: SQLite profiles table has casino and zombie_lab columns", "FAIL", str(e))
+
+    # Check kostyan restored deposit
+    try:
+        kostyan_prof = db.get_user_profile("kostyan")
+        has_deposit = kostyan_prof and isinstance(kostyan_prof.get("casino"), dict) and kostyan_prof["casino"].get("deposit", 0) > 0
+        record("Issue #9: Player kostyan deposit restored and retrievable", "PASS" if has_deposit else "FAIL", f"Deposit: {kostyan_prof.get('casino', {}).get('deposit')}")
+    except Exception as e:
+        record("Issue #9: Player kostyan deposit restored and retrievable", "FAIL", str(e))
+
+    # Issue #10: Seed selection top menu and sticky HUD
+    css_path = os.path.join(GAME_DIR, "css/style.css")
+    with open(css_path, "r", encoding="utf-8") as f:
+        css_code = f.read()
+    record("Issue #10: style.css has sticky seed deck selection bar", "PASS" if ".seed-deck-bar" in css_code and "position: sticky" in css_code else "FAIL")
+
+    economy_path = os.path.join(GAME_DIR, "js/systems/economy.js")
+    with open(economy_path, "r", encoding="utf-8") as f:
+        economy_code = f.read()
+    record("Issue #10: economy.js guaranteed fallback for cards array in draw()", "PASS" if "this.setDeckFromSelection()" in economy_code else "FAIL")
+    record("Issue #10: game.js hides pre-battle modals on startLevel", "PASS" if "seed-select-modal" in game_code and "dave-modal" in game_code else "FAIL")
+
+
 def main():
     print("==================================================")
     print("🌱 PLANTS VS. ZOMBIES — AUTONOMOUS TEST SUITE 🌱")
@@ -1343,6 +1396,7 @@ def main():
     test_admin_panel_and_configurator()
     test_http_endpoint()
     test_v2_7_features()
+    test_gitea_critical_bugfixes()
 
     passed = sum(1 for r in TEST_RESULTS if r["status"] == "PASS")
     total = len(TEST_RESULTS)