Admins can change passwords. Request user confirmation to open gate

src/static/app.js

@@ -28,7 +28,7 @@ async function apiFetch(method, path, body) {
   if (res.status === 401) {
     clearToken();
     showLogin();
-    throw new Error("Session expired - please log in again.");
+    throw new Error("Session expired or invalid keypass");
   }
   if (!res.ok) {
     const json = await res.json().catch(() => null);
@@ -71,7 +71,7 @@ function renderGates(gates) {
     btn.className = `gate-btn ${gate.gate_type}`;
     btn.dataset.gateId = gate.id;
     btn.innerHTML = `<span class="icon">${icon}</span><span>${gate.name}</span>`;
-    btn.addEventListener("click", () => handleOpenGate(btn, gate.id));
+    btn.addEventListener("click", () => handleOpenGate(btn, gate));
     grid.appendChild(btn);
   }
 }
@@ -87,7 +87,28 @@ async function loadGates() {
 }
 
 // ── Open gate action ──────────────────────────────────────────────────────────
-async function handleOpenGate(btn, gateId) {
+let _pendingGate = null;
+
+document.getElementById("confirm-cancel").addEventListener("click", () => {
+  document.getElementById("confirm-modal").classList.add("hidden");
+  _pendingGate = null;
+});
+document.getElementById("confirm-ok").addEventListener("click", () => {
+  document.getElementById("confirm-modal").classList.add("hidden");
+  if (_pendingGate) {
+    const { btn, gateId } = _pendingGate;
+    _pendingGate = null;
+    _doOpenGate(btn, gateId);
+  }
+});
+
+async function handleOpenGate(btn, gate) {
+  _pendingGate = { btn, gateId: gate.id };
+  document.getElementById("confirm-gate-name").textContent = gate.name;
+  document.getElementById("confirm-modal").classList.remove("hidden");
+}
+
+async function _doOpenGate(btn, gateId) {
   btn.disabled = true;
   btn.classList.add("loading");
   btn.classList.remove("ok", "fail");