diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index d7a61b5..03bcb08 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -1,11 +1,13 @@
 <template>
-  <div>
+  <div class="app-shell">
     <StatusMessage />
-    <LoginView v-if="store.currentView === 'login'" />
-    <ProfileView v-if="store.currentView === 'profile'" />
-    <DeviceLinkView v-if="store.currentView === 'device-link'" />
-    <ResetView v-if="store.currentView === 'reset'" />
-    <PermissionDeniedView v-if="store.currentView === 'permission-denied'" />
+    <main class="app-main">
+      <LoginView v-if="store.currentView === 'login'" />
+      <ProfileView v-if="store.currentView === 'profile'" />
+      <DeviceLinkView v-if="store.currentView === 'device-link'" />
+      <ResetView v-if="store.currentView === 'reset'" />
+      <PermissionDeniedView v-if="store.currentView === 'permission-denied'" />
+    </main>
   </div>
 </template>
 
diff --git a/frontend/src/admin/AdminApp.vue b/frontend/src/admin/AdminApp.vue
index 9cbb234..51b56e7 100644
--- a/frontend/src/admin/AdminApp.vue
+++ b/frontend/src/admin/AdminApp.vue
@@ -20,15 +20,13 @@ const userLinkExpires = ref(null)
 const authStore = useAuthStore()
 const addingOrgForPermission = ref(null)
 const PERMISSION_ID_PATTERN = '^[A-Za-z0-9:._~-]+$'
-const showCreatePermission = ref(false)
-const newPermId = ref('')
-const newPermName = ref('')
 const editingPermId = ref(null)
 const renameIdValue = ref('')
+const editingPermDisplay = ref(null)
+const renameDisplayValue = ref('')
 const dialog = ref({ type: null, data: null, busy: false, error: '' })
 const safeIdRegex = /[^A-Za-z0-9:._~-]/g
 
-function sanitizeNewId() { if (newPermId.value) newPermId.value = newPermId.value.replace(safeIdRegex, '') }
 function sanitizeRenameId() { if (renameIdValue.value) renameIdValue.value = renameIdValue.value.replace(safeIdRegex, '') }
 
 function handleGlobalClick(e) {
@@ -79,25 +77,7 @@ const permissionSummary = computed(() => {
   return display
 })
 
-function availableOrgsForPermission(pid) {
-  return orgs.value.filter(o => !o.permissions.includes(pid))
-}
-
-function renamePermissionDisplay(p) { openDialog('perm-display', { permission: p }) }
-
-function startRenamePermissionId(p) { editingPermId.value = p.id; renameIdValue.value = p.id }
-function cancelRenameId() { editingPermId.value = null; renameIdValue.value = '' }
-async function submitRenamePermissionId(p) {
-  const newId = renameIdValue.value.trim()
-  if (!newId || newId === p.id) { cancelRenameId(); return }
-  try {
-    const body = { old_id: p.id, new_id: newId, display_name: p.display_name }
-    const res = await fetch('/auth/admin/permission/rename', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) })
-    let data; try { data = await res.json() } catch(_) { data = {} }
-    if (!res.ok || data.detail) throw new Error(data.detail || data.error || `Failed (${res.status})`)
-    await refreshPermissionsContext(); cancelRenameId()
-  } catch (e) { authStore.showMessage(e?.message || 'Rename failed') }
-}
+function renamePermissionDisplay(p) { openDialog('perm-display', { permission: p, id: p.id, display_name: p.display_name }) }
 
 async function refreshPermissionsContext() {
   // Reload both lists so All Permissions table shows new associations promptly.
@@ -258,16 +238,6 @@ function deleteRole(role) {
 }
 
 // Permission actions
-async function submitCreatePermission() {
-  const id = newPermId.value.trim()
-  const name = newPermName.value.trim()
-  if (!id || !name) return
-  const res = await fetch('/auth/admin/permissions', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ id, display_name: name }) })
-  const data = await res.json(); if (data.detail) { authStore.showMessage(data.detail); return }
-  await loadPermissions(); newPermId.value=''; newPermName.value=''; showCreatePermission.value=false
-}
-function cancelCreatePermission() { newPermId.value=''; newPermName.value=''; showCreatePermission.value=false }
-
 function updatePermission(p) { openDialog('perm-display', { permission: p }) }
 
 function deletePermission(p) {
@@ -371,26 +341,24 @@ function permissionDisplayName(id) {
   return permissions.value.find(p => p.id === id)?.display_name || id
 }
 
-async function toggleRolePermission(role, permId, checked) {
+async function toggleOrgPermission(org, permId, checked) {
   // Build next permission list
-  const has = role.permissions.includes(permId)
+  const has = org.permissions.includes(permId)
   if (checked && has) return
   if (!checked && !has) return
-  const next = checked ? [...role.permissions, permId] : role.permissions.filter(p => p !== permId)
+  const next = checked ? [...org.permissions, permId] : org.permissions.filter(p => p !== permId)
   // Optimistic update
-  const prev = [...role.permissions]
-  role.permissions = next
+  const prev = [...org.permissions]
+  org.permissions = next
   try {
-  const res = await fetch(`/auth/admin/orgs/${role.org_uuid}/roles/${role.uuid}`, {
-      method: 'PUT',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ display_name: role.display_name, permissions: next })
-    })
+    const params = new URLSearchParams({ permission_id: permId })
+    const res = await fetch(`/auth/admin/orgs/${org.uuid}/permission?${params.toString()}`, { method: checked ? 'POST' : 'DELETE' })
     const data = await res.json()
     if (data.detail) throw new Error(data.detail)
+    await loadOrgs()
   } catch (e) {
-    authStore.showMessage(e.message || 'Failed to update role permission')
-    role.permissions = prev // revert
+    authStore.showMessage(e.message || 'Failed to update organization permission')
+    org.permissions = prev // revert
   }
 }
 
@@ -438,10 +406,31 @@ async function submitDialog() {
       const res = await fetch(`/auth/admin/orgs/${org.uuid}/users`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ display_name: name, role: role.display_name }) })
       const d = await res.json(); if (d.detail) throw new Error(d.detail); await loadOrgs()
     } else if (t === 'perm-display') {
-      const { permission } = dialog.value.data; const display = dialog.value.data.display_name?.trim(); if (!display) throw new Error('Display name required')
-      const params = new URLSearchParams({ permission_id: permission.id, display_name: display })
-      const res = await fetch(`/auth/admin/permission?${params.toString()}`, { method: 'PUT' })
-      const d = await res.json(); if (d.detail) throw new Error(d.detail); await loadPermissions()
+      const { permission } = dialog.value.data
+      const newId = dialog.value.data.id?.trim()
+      const newDisplay = dialog.value.data.display_name?.trim()
+      if (!newDisplay) throw new Error('Display name required')
+      if (!newId) throw new Error('ID required')
+      
+      if (newId !== permission.id) {
+        // ID changed, use rename endpoint
+        const body = { old_id: permission.id, new_id: newId, display_name: newDisplay }
+        const res = await fetch('/auth/admin/permission/rename', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) })
+        let data; try { data = await res.json() } catch(_) { data = {} }
+        if (!res.ok || data.detail) throw new Error(data.detail || data.error || `Failed (${res.status})`)
+      } else if (newDisplay !== permission.display_name) {
+        // Only display name changed
+        const params = new URLSearchParams({ permission_id: permission.id, display_name: newDisplay })
+        const res = await fetch(`/auth/admin/permission?${params.toString()}`, { method: 'PUT' })
+        const d = await res.json(); if (d.detail) throw new Error(d.detail)
+      }
+      await loadPermissions()
+    } else if (t === 'perm-create') {
+      const id = dialog.value.data.id?.trim(); if (!id) throw new Error('ID required')
+      const name = dialog.value.data.name?.trim(); if (!name) throw new Error('Display name required')
+      const res = await fetch('/auth/admin/permissions', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ id, display_name: name }) })
+      const data = await res.json(); if (data.detail) throw new Error(data.detail)
+      await loadPermissions(); dialog.value.data.id = ''; dialog.value.data.name = ''
     } else if (t === 'confirm') {
       const action = dialog.value.data.action; if (action) await action()
     }
@@ -453,435 +442,454 @@ async function submitDialog() {
 </script>
 
 <template>
-  <div class="container">
-    <h1>{{ pageHeading }}</h1>
-    <Breadcrumbs :entries="breadcrumbEntries" />
-    <div v-if="loading">Loading…</div>
-    <div v-else-if="error" class="error">{{ error }}</div>
-    <div v-else>
-      <div v-if="!info?.authenticated">
-        <p>You must be authenticated.</p>
-      </div>
-      <div v-else-if="!(info?.is_global_admin || info?.is_org_admin)">
-        <p>Insufficient permissions.</p>
-      </div>
-      <div v-else>
+  <div class="app-shell admin-shell">
+    <StatusMessage />
+    <main class="app-main">
+      <section class="view-root view-admin">
+        <div class="view-content view-content--wide">
+          <header class="view-header">
+            <h1>{{ pageHeading }}</h1>
+            <Breadcrumbs :entries="breadcrumbEntries" />
+            <p class="view-lede" v-if="info?.authenticated">
+              Manage organizations, roles, permissions, and passkeys for your relying party.
+            </p>
+          </header>
 
-        
-        
-  <div v-if="!selectedUser && !selectedOrg && (info.is_global_admin || info.is_org_admin)" class="card">
-          <h2>Organizations</h2>
-          <div class="actions">
-            <button @click="createOrg" v-if="info.is_global_admin">+ Create Org</button>
-          </div>
-          <table class="org-table">
-            <thead>
-              <tr>
-                <th>Name</th>
-                <th>Roles</th>
-                 <th>Members</th>
-                <th v-if="info.is_global_admin">Actions</th>
-              </tr>
-            </thead>
-            <tbody>
-              <tr v-for="o in orgs" :key="o.uuid">
-                <td><a href="#org/{{o.uuid}}" @click.prevent="openOrg(o)">{{ o.display_name }}</a></td>
-                <td>{{ o.roles.length }}</td>
-                <td>{{ o.roles.reduce((acc,r)=>acc + r.users.length,0) }}</td>
-                <td v-if="info.is_global_admin">
-                  <button @click="updateOrg(o)" class="icon-btn" aria-label="Rename organization" title="Rename organization">✏️</button>
-                  <button @click="deleteOrg(o)" class="icon-btn delete-icon" aria-label="Delete organization" title="Delete organization">❌</button>
-                </td>
-              </tr>
-            </tbody>
-          </table>
-        </div>
-        <div v-if="selectedUser" class="card user-detail">
-          <UserBasicInfo
-            v-if="userDetail && !userDetail.error"
-            :name="userDetail.display_name || selectedUser.display_name"
-            :visits="userDetail.visits"
-            :created-at="userDetail.created_at"
-            :last-seen="userDetail.last_seen"
-            :loading="loading"
-            :org-display-name="userDetail.org.display_name"
-            :role-name="userDetail.role"
-            :update-endpoint="`/auth/admin/orgs/${selectedUser.org_uuid}/users/${selectedUser.uuid}/display-name`"
-            @saved="onUserNameSaved"
-          />
-          <div v-else-if="userDetail?.error" class="error small">{{ userDetail.error }}</div>
-          <template v-if="userDetail && !userDetail.error">
-            <h3 class="cred-title">Registered Passkeys</h3>
-            <CredentialList :credentials="userDetail.credentials" :aaguid-info="userDetail.aaguid_info" />
-          </template>
-          <div class="actions">
-            <button @click="generateUserRegistrationLink(selectedUser)">Generate Registration Token</button>
-            <button @click="goOverview" v-if="info.is_global_admin" class="icon-btn" title="Overview">🏠</button>
-            <button @click="openOrg(selectedOrg)" v-if="selectedOrg" class="icon-btn" title="Back to Org">↩️</button>
-          </div>
-          <p class="matrix-hint muted">Use the token dialog to register a new credential for the member.</p>
-          <RegistrationLinkModal
-            v-if="showRegModal"
-            :endpoint="`/auth/admin/orgs/${selectedUser.org_uuid}/users/${selectedUser.uuid}/create-link`"
-            :auto-copy="false"
-            @close="showRegModal = false"
-            @copied="onLinkCopied"
-          />
-        </div>
-
-        
-        <div v-else-if="selectedOrg" class="card">
-          <h2 class="org-title" :title="selectedOrg.uuid">
-            <span class="org-name">{{ selectedOrg.display_name }}</span>
-            <button @click="updateOrg(selectedOrg)" class="icon-btn" aria-label="Rename organization" title="Rename organization">✏️</button>
-          </h2>
-          <div class="org-actions"></div>
-
-          <div class="matrix-wrapper">
-            <div class="matrix-scroll">
-              <div
-                class="perm-matrix-grid"
-                :style="{ gridTemplateColumns: 'minmax(180px, 1fr) ' + selectedOrg.roles.map(()=> '2.2rem').join(' ') + ' 2.2rem' }"
-              >
-                
-                <div class="grid-head perm-head">Permission</div>
-                <div
-                  v-for="r in selectedOrg.roles"
-                  :key="'head-' + r.uuid"
-                  class="grid-head role-head"
-                  :title="r.display_name"
-                >
-                  <span>{{ r.display_name }}</span>
+          <section class="section-block admin-section">
+            <div class="section-body admin-section-body">
+              <div v-if="loading" class="surface surface--tight">Loading…</div>
+              <div v-else-if="error" class="surface surface--tight error">{{ error }}</div>
+              <template v-else>
+                <div v-if="!info?.authenticated" class="surface surface--tight">
+                  <p>You must be authenticated.</p>
                 </div>
-                <div class="grid-head role-head add-role-head" title="Add role" @click="createRole(selectedOrg)" role="button">➕</div>
+                <div v-else-if="!(info?.is_global_admin || info?.is_org_admin)" class="surface surface--tight">
+                  <p>Insufficient permissions.</p>
+                </div>
+                <div v-else class="admin-panels">
+                  <div v-if="!selectedUser && !selectedOrg && (info.is_global_admin || info.is_org_admin)" class="permissions-section">
+                    <h2>Organizations</h2>
+                    <div class="actions">
+                      <button v-if="info.is_global_admin" @click="createOrg">+ Create Org</button>
+                    </div>
+                    <table class="org-table">
+                      <thead>
+                        <tr>
+                          <th>Name</th>
+                          <th>Roles</th>
+                          <th>Members</th>
+                          <th v-if="info.is_global_admin">Actions</th>
+                        </tr>
+                      </thead>
+                      <tbody>
+                        <tr v-for="o in orgs" :key="o.uuid">
+                          <td>
+                            <a href="#org/{{o.uuid}}" @click.prevent="openOrg(o)">{{ o.display_name }}</a>
+                            <button v-if="info.is_global_admin" @click="updateOrg(o)" class="icon-btn edit-org-btn" aria-label="Rename organization" title="Rename organization">✏️</button>
+                          </td>
+                          <td>{{ o.roles.length }}</td>
+                          <td>{{ o.roles.reduce((acc,r)=>acc + r.users.length,0) }}</td>
+                          <td v-if="info.is_global_admin">
+                            <button @click="deleteOrg(o)" class="icon-btn delete-icon" aria-label="Delete organization" title="Delete organization">❌</button>
+                          </td>
+                        </tr>
+                      </tbody>
+                    </table>
+                  </div>
 
-                
-                <template v-for="pid in selectedOrg.permissions" :key="pid">
-                  <div class="perm-name" :title="pid">{{ permissionDisplayName(pid) }}</div>
-                  <div
-                    v-for="r in selectedOrg.roles"
-                    :key="r.uuid + '-' + pid"
-                    class="matrix-cell"
-                  >
-                    <input
-                      type="checkbox"
-                      :checked="r.permissions.includes(pid)"
-                      @change="e => toggleRolePermission(r, pid, e.target.checked)"
+                  <div v-if="selectedUser" class="card surface user-detail">
+                    <UserBasicInfo
+                      v-if="userDetail && !userDetail.error"
+                      :name="userDetail.display_name || selectedUser.display_name"
+                      :visits="userDetail.visits"
+                      :created-at="userDetail.created_at"
+                      :last-seen="userDetail.last_seen"
+                      :loading="loading"
+                      :org-display-name="userDetail.org.display_name"
+                      :role-name="userDetail.role"
+                      :update-endpoint="`/auth/admin/orgs/${selectedUser.org_uuid}/users/${selectedUser.uuid}/display-name`"
+                      @saved="onUserNameSaved"
+                    />
+                    <div v-else-if="userDetail?.error" class="error small">{{ userDetail.error }}</div>
+                    <template v-if="userDetail && !userDetail.error">
+                      <h3 class="cred-title">Registered Passkeys</h3>
+                      <CredentialList :credentials="userDetail.credentials" :aaguid-info="userDetail.aaguid_info" />
+                    </template>
+                    <div class="actions">
+                      <button @click="generateUserRegistrationLink(selectedUser)">Generate Registration Token</button>
+                      <button @click="goOverview" v-if="info.is_global_admin" class="icon-btn" title="Overview">🏠</button>
+                      <button @click="openOrg(selectedOrg)" v-if="selectedOrg" class="icon-btn" title="Back to Org">↩️</button>
+                    </div>
+                    <p class="matrix-hint muted">Use the token dialog to register a new credential for the member.</p>
+                    <RegistrationLinkModal
+                      v-if="showRegModal"
+                      :endpoint="`/auth/admin/orgs/${selectedUser.org_uuid}/users/${selectedUser.uuid}/create-link`"
+                      :auto-copy="false"
+                      @close="showRegModal = false"
+                      @copied="onLinkCopied"
                     />
                   </div>
-                  <div class="matrix-cell add-role-cell" />
-                </template>
-              </div>
-            </div>
-            <p class="matrix-hint muted">Toggle which permissions each role grants.</p>
-          </div>
-          <div class="roles-grid">
-            <div
-              v-for="r in selectedOrg.roles"
-              :key="r.uuid"
-              class="role-column"
-              @dragover="onRoleDragOver"
-              @drop="e => onRoleDrop(e, selectedOrg, r)"
-            >
-              <div class="role-header">
-                <strong class="role-name" :title="r.uuid">
-                  <span>{{ r.display_name }}</span>
-                  <button @click="updateRole(r)" class="icon-btn" aria-label="Edit role" title="Edit role">✏️</button>
-                </strong>
-                <div class="role-actions">
-                  <button @click="createUserInRole(selectedOrg, r)" class="plus-btn" aria-label="Add user" title="Add user">➕</button>
-                </div>
-              </div>
-              <template v-if="r.users.length > 0">
-                <ul class="user-list">
-                  <li
-                    v-for="u in r.users"
-                    :key="u.uuid"
-                    class="user-chip"
-                    draggable="true"
-                    @dragstart="e => onUserDragStart(e, u, selectedOrg.uuid)"
-                    @click="openUser(u)"
-                    :title="u.uuid"
-                  >
-                    <span class="name">{{ u.display_name }}</span>
-                    <span class="meta">{{ u.last_seen ? new Date(u.last_seen).toLocaleDateString() : '—' }}</span>
-                  </li>
-                </ul>
-              </template>
-              <div v-else class="empty-role">
-                <p class="empty-text muted">No members</p>
-                <button @click="deleteRole(r)" class="icon-btn delete-icon" aria-label="Delete empty role" title="Delete role">❌</button>
-              </div>
-            </div>
-          </div>
-        </div>
+                  <div v-else-if="selectedOrg" class="card surface">
+                    <h2 class="org-title" :title="selectedOrg.uuid">
+                      <span class="org-name">{{ selectedOrg.display_name }}</span>
+                      <button @click="updateOrg(selectedOrg)" class="icon-btn" aria-label="Rename organization" title="Rename organization">✏️</button>
+                    </h2>
+                    <div class="org-actions"></div>
 
-        <div v-if="!selectedUser && !selectedOrg && (info.is_global_admin || info.is_org_admin)" class="card">
-          <h2>All Permissions</h2>
-          <div class="actions">
-            <button v-if="!showCreatePermission" @click="showCreatePermission = true">+ Create Permission</button>
-            <form v-else class="inline-form" @submit.prevent="submitCreatePermission">
-              <input v-model="newPermId" @input="sanitizeNewId" required :pattern="PERMISSION_ID_PATTERN" placeholder="permission id" title="Allowed: A-Za-z0-9:._~-" />
-              <input v-model="newPermName" required placeholder="display name" />
-              <button type="submit">Save</button>
-              <button type="button" @click="cancelCreatePermission">Cancel</button>
-            </form>
-          </div>
-          <div class="permission-grid">
-            <div class="perm-grid-head">Permission</div>
-            <div class="perm-grid-head">Orgs</div>
-            <div class="perm-grid-head center">Members</div>
-            <div class="perm-grid-head center">Actions</div>
-            <template v-for="p in [...permissions].sort((a,b)=> a.id.localeCompare(b.id))" :key="p.id">
-              <div class="perm-cell perm-name" :title="p.id">
-                <div class="perm-title-line">{{ p.display_name }}</div>
-                <div class="perm-id-line muted">{{ p.id }}</div>
-              </div>
-              <div class="perm-cell perm-orgs" :title="permissionSummary[p.id]?.orgs?.map(o=>o.display_name).join(', ') || ''">
-                <template v-if="permissionSummary[p.id]">
-                  <span class="org-pill" v-for="o in permissionSummary[p.id].orgs" :key="o.uuid">
-                    {{ o.display_name }}
-                    <button class="pill-x" @click.stop="detachPermissionFromOrg(p.id, o.uuid)" aria-label="Remove">×</button>
-                  </span>
-                </template>
-                <span class="org-add-wrapper">
-                  <button
-                    v-if="availableOrgsForPermission(p.id).length && addingOrgForPermission !== p.id"
-                    class="add-org-btn"
-                    @click.stop="addingOrgForPermission = p.id"
-                    aria-label="Add organization"
-                    title="Add organization"
-                  >➕</button>
-                  <div
-                    v-if="addingOrgForPermission === p.id"
-                    class="org-add-menu"
-                    tabindex="0"
-                    @keydown.escape.stop.prevent="addingOrgForPermission = null"
-                  >
-                    <div class="org-add-list">
-                      <button
-                        v-for="o in availableOrgsForPermission(p.id)"
-                        :key="o.uuid"
-                        class="org-add-item"
-                        @click.stop="attachPermissionToOrg(p.id, o.uuid); addingOrgForPermission = null"
-                      >{{ o.display_name }}</button>
+                    <div class="matrix-wrapper">
+                      <div class="matrix-scroll">
+                        <div
+                          class="perm-matrix-grid"
+                          :style="{ gridTemplateColumns: 'minmax(180px, 1fr) ' + selectedOrg.roles.map(()=> '2.2rem').join(' ') + ' 2.2rem' }"
+                        >
+                          <div class="grid-head perm-head">Permission</div>
+                          <div
+                            v-for="r in selectedOrg.roles"
+                            :key="'head-' + r.uuid"
+                            class="grid-head role-head"
+                            :title="r.display_name"
+                          >
+                            <span>{{ r.display_name }}</span>
+                          </div>
+                          <div class="grid-head role-head add-role-head" title="Add role" @click="createRole(selectedOrg)" role="button">➕</div>
+
+                          <template v-for="pid in selectedOrg.permissions" :key="pid">
+                            <div class="perm-name" :title="pid">{{ permissionDisplayName(pid) }}</div>
+                            <div
+                              v-for="r in selectedOrg.roles"
+                              :key="r.uuid + '-' + pid"
+                              class="matrix-cell"
+                            >
+                              <input
+                                type="checkbox"
+                                :checked="r.permissions.includes(pid)"
+                                @change="e => toggleRolePermission(r, pid, e.target.checked)"
+                              />
+                            </div>
+                            <div class="matrix-cell add-role-cell" />
+                          </template>
+                        </div>
+                      </div>
+                      <p class="matrix-hint muted">Toggle which permissions each role grants.</p>
                     </div>
-                    <div class="org-add-footer">
-                      <button class="org-add-cancel" @click.stop="addingOrgForPermission = null" aria-label="Cancel">Cancel</button>
+                    <div class="roles-grid">
+                      <div
+                        v-for="r in selectedOrg.roles"
+                        :key="r.uuid"
+                        class="role-column"
+                        @dragover="onRoleDragOver"
+                        @drop="e => onRoleDrop(e, selectedOrg, r)"
+                      >
+                        <div class="role-header">
+                          <strong class="role-name" :title="r.uuid">
+                            <span>{{ r.display_name }}</span>
+                            <button @click="updateRole(r)" class="icon-btn" aria-label="Edit role" title="Edit role">✏️</button>
+                          </strong>
+                          <div class="role-actions">
+                            <button @click="createUserInRole(selectedOrg, r)" class="plus-btn" aria-label="Add user" title="Add user">➕</button>
+                          </div>
+                        </div>
+                        <template v-if="r.users.length > 0">
+                          <ul class="user-list">
+                            <li
+                              v-for="u in r.users"
+                              :key="u.uuid"
+                              class="user-chip"
+                              draggable="true"
+                              @dragstart="e => onUserDragStart(e, u, selectedOrg.uuid)"
+                              @click="openUser(u)"
+                              :title="u.uuid"
+                            >
+                              <span class="name">{{ u.display_name }}</span>
+                              <span class="meta">{{ u.last_seen ? new Date(u.last_seen).toLocaleDateString() : '—' }}</span>
+                            </li>
+                          </ul>
+                        </template>
+                        <div v-else class="empty-role">
+                          <p class="empty-text muted">No members</p>
+                          <button @click="deleteRole(r)" class="icon-btn delete-icon" aria-label="Delete empty role" title="Delete role">❌</button>
+                        </div>
+                      </div>
                     </div>
                   </div>
-                </span>
-              </div>
-              <div class="perm-cell perm-users center">{{ permissionSummary[p.id]?.userCount || 0 }}</div>
-              <div class="perm-cell perm-actions center">
-                <div class="perm-actions-inner" :class="{ editing: editingPermId === p.id }">
-                  <div class="actions-view">
-                    <button @click="renamePermissionDisplay(p)" class="icon-btn" aria-label="Change display name" title="Change display name">✏️</button>
-                    <button @click="startRenamePermissionId(p)" class="icon-btn" aria-label="Change id" title="Change id">🆔</button>
-                    <button @click="deletePermission(p)" class="icon-btn delete-icon" aria-label="Delete permission" title="Delete permission">❌</button>
+
+                  <div v-if="!selectedUser && !selectedOrg && (info.is_global_admin || info.is_org_admin)" class="permissions-section">
+                    <h2>Permissions</h2>
+                    <div class="matrix-wrapper">
+                      <div class="matrix-scroll">
+                        <div
+                          class="perm-matrix-grid"
+                          :style="{ gridTemplateColumns: 'minmax(180px, 1fr) ' + orgs.map(()=> '2.2rem').join(' ') }"
+                        >
+                          <div class="grid-head perm-head">Permission</div>
+                          <div
+                            v-for="o in [...orgs].sort((a,b)=> a.display_name.localeCompare(b.display_name))"
+                            :key="'head-' + o.uuid"
+                            class="grid-head org-head"
+                            :title="o.display_name"
+                          >
+                            <span>{{ o.display_name }}</span>
+                          </div>
+
+                          <template v-for="p in [...permissions].sort((a,b)=> a.id.localeCompare(b.id))" :key="p.id">
+                            <div class="perm-name" :title="p.id">
+                              <span class="display-text">{{ p.display_name }}</span>
+                            </div>
+                            <div
+                              v-for="o in [...orgs].sort((a,b)=> a.display_name.localeCompare(b.display_name))"
+                              :key="o.uuid + '-' + p.id"
+                              class="matrix-cell"
+                            >
+                              <input
+                                type="checkbox"
+                                :checked="o.permissions.includes(p.id)"
+                                @change="e => toggleOrgPermission(o, p.id, e.target.checked)"
+                              />
+                            </div>
+                          </template>
+                        </div>
+                      </div>
+                      <p class="matrix-hint muted">Toggle which permissions each organization can grant to its members.</p>
+                    </div>
+                    <div class="actions">
+                      <button v-if="info.is_global_admin" @click="openDialog('perm-create', {})">+ Create Permission</button>
+                    </div>
+                    <table class="org-table">
+                        <thead>
+                          <tr>
+                            <th scope="col">Permission</th>
+                            <th scope="col" class="center">Members</th>
+                            <th scope="col" class="center">Actions</th>
+                          </tr>
+                        </thead>
+                        <tbody>
+                          <tr v-for="p in [...permissions].sort((a,b)=> a.id.localeCompare(b.id))" :key="p.id">
+                            <td class="perm-name-cell">
+                              <div class="perm-title">
+                                <span class="display-text">{{ p.display_name }}</span>
+                                <button @click="renamePermissionDisplay(p)" class="icon-btn edit-display-btn" aria-label="Edit display name" title="Edit display name">✏️</button>
+                              </div>
+                              <div class="perm-id-info">
+                                <span class="id-text">{{ p.id }}</span>
+                                <button @click="renamePermissionDisplay(p)" class="icon-btn edit-id-btn" aria-label="Edit id" title="Edit id">🆔</button>
+                              </div>
+                            </td>
+                            <td class="perm-members center">{{ permissionSummary[p.id]?.userCount || 0 }}</td>
+                            <td class="perm-actions center">
+                              <button @click="deletePermission(p)" class="icon-btn delete-icon" aria-label="Delete permission" title="Delete permission">❌</button>
+                            </td>
+                          </tr>
+                        </tbody>
+                      </table>
                   </div>
-                  <form class="inline-id-form overlay" @submit.prevent="submitRenamePermissionId(p)">
-                    <input v-model="renameIdValue" @input="sanitizeRenameId" required :pattern="PERMISSION_ID_PATTERN" class="id-input" title="Allowed: A-Za-z0-9:._~-" />
-                    <button type="submit" class="icon-btn" aria-label="Save">✔</button>
-                    <button type="button" class="icon-btn" @click="cancelRenameId" aria-label="Cancel">✖</button>
-                  </form>
                 </div>
-              </div>
-            </template>
-          </div>
+              </template>
+            </div>
+          </section>
         </div>
-      </div>
-    </div>
-  </div>
-  <StatusMessage />
-  <div v-if="dialog.type" class="modal-overlay" @keydown.esc.prevent.stop="closeDialog" tabindex="-1">
-    <div class="modal" role="dialog" aria-modal="true">
-      <h3 class="modal-title">
-        <template v-if="dialog.type==='org-create'">Create Organization</template>
-        <template v-else-if="dialog.type==='org-update'">Rename Organization</template>
-        <template v-else-if="dialog.type==='role-create'">Create Role</template>
-        <template v-else-if="dialog.type==='role-update'">Edit Role</template>
-        <template v-else-if="dialog.type==='user-create'">Add User To Role</template>
-        <template v-else-if="dialog.type==='perm-display'">Edit Permission Display</template>
-        <template v-else-if="dialog.type==='confirm'">Confirm</template>
-      </h3>
-      <form @submit.prevent="submitDialog" class="modal-form">
-        <template v-if="dialog.type==='org-create' || dialog.type==='org-update'">
-          <label>Name
-            <input v-model="dialog.data.name" :placeholder="dialog.type==='org-update'? dialog.data.org.display_name : 'Organization name'" required />
-          </label>
-        </template>
-        <template v-else-if="dialog.type==='role-create'">
-          <label>Role Name
-            <input v-model="dialog.data.name" placeholder="Role name" required />
-          </label>
-        </template>
-        <template v-else-if="dialog.type==='role-update'">
-          <label>Role Name
-            <input v-model="dialog.data.name" :placeholder="dialog.data.role.display_name" required />
-          </label>
-          <label>Permissions (comma separated)
-            <textarea v-model="dialog.data.perms" rows="2" placeholder="perm:a, perm:b"></textarea>
-          </label>
-        </template>
-        <template v-else-if="dialog.type==='user-create'">
-          <p class="small muted">Role: {{ dialog.data.role.display_name }}</p>
-          <label>Display Name
-            <input v-model="dialog.data.name" placeholder="User display name" required />
-          </label>
-        </template>
-        <template v-else-if="dialog.type==='perm-display'">
-          <p class="small muted">ID: {{ dialog.data.permission.id }}</p>
+      </section>
+    </main>
+    <div v-if="dialog.type" class="modal-overlay" @keydown.esc.prevent.stop="closeDialog" tabindex="-1">
+      <div class="modal" role="dialog" aria-modal="true">
+        <h3 class="modal-title">
+          <template v-if="dialog.type==='org-create'">Create Organization</template>
+          <template v-else-if="dialog.type==='org-update'">Rename Organization</template>
+          <template v-else-if="dialog.type==='role-create'">Create Role</template>
+          <template v-else-if="dialog.type==='role-update'">Edit Role</template>
+          <template v-else-if="dialog.type==='user-create'">Add User To Role</template>
+          <template v-else-if="dialog.type==='perm-create'">Create Permission</template>
+          <template v-else-if="dialog.type==='perm-display'">Edit Permission Display</template>
+          <template v-else-if="dialog.type==='confirm'">Confirm</template>
+        </h3>
+        <form @submit.prevent="submitDialog" class="modal-form">
+          <template v-if="dialog.type==='org-create' || dialog.type==='org-update'">
+            <label>Name
+              <input v-model="dialog.data.name" :placeholder="dialog.type==='org-update'? dialog.data.org.display_name : 'Organization name'" required />
+            </label>
+          </template>
+          <template v-else-if="dialog.type==='role-create'">
+            <label>Role Name
+              <input v-model="dialog.data.name" placeholder="Role name" required />
+            </label>
+          </template>
+          <template v-else-if="dialog.type==='role-update'">
+            <label>Role Name
+              <input v-model="dialog.data.name" :placeholder="dialog.data.role.display_name" required />
+            </label>
+            <label>Permissions (comma separated)
+              <textarea v-model="dialog.data.perms" rows="2" placeholder="perm:a, perm:b"></textarea>
+            </label>
+          </template>
+          <template v-else-if="dialog.type==='user-create'">
+            <p class="small muted">Role: {{ dialog.data.role.display_name }}</p>
+            <label>Display Name
+              <input v-model="dialog.data.name" placeholder="User display name" required />
+            </label>
+          </template>
+          <template v-else-if="dialog.type==='perm-create'">
+            <label>Permission ID
+              <input v-model="dialog.data.id" placeholder="permission id" required :pattern="PERMISSION_ID_PATTERN" title="Allowed: A-Za-z0-9:._~-" />
+            </label>
+            <label>Display Name
+              <input v-model="dialog.data.name" placeholder="display name" required />
+            </label>
+          </template>
+          <template v-else-if="dialog.type==='perm-display'">
+            <label>Permission ID
+              <input v-model="dialog.data.id" :placeholder="dialog.data.permission.id" required :pattern="PERMISSION_ID_PATTERN" title="Allowed: A-Za-z0-9:._~-" />
+            </label>
             <label>Display Name
               <input v-model="dialog.data.display_name" :placeholder="dialog.data.permission.display_name" required />
             </label>
-        </template>
-        <template v-else-if="dialog.type==='confirm'">
-          <p>{{ dialog.data.message }}</p>
-        </template>
-        <div v-if="dialog.error" class="error small">{{ dialog.error }}</div>
-        <div class="modal-actions">
-          <button type="submit" :disabled="dialog.busy">{{ dialog.type==='confirm' ? 'OK' : 'Save' }}</button>
-          <button type="button" @click="closeDialog" :disabled="dialog.busy">Cancel</button>
-        </div>
-      </form>
+          </template>
+          <template v-else-if="dialog.type==='confirm'">
+            <p>{{ dialog.data.message }}</p>
+          </template>
+          <div v-if="dialog.error" class="error small">{{ dialog.error }}</div>
+          <div class="modal-actions">
+            <button type="submit" :disabled="dialog.busy">{{ dialog.type==='confirm' ? 'OK' : 'Save' }}</button>
+            <button type="button" @click="closeDialog" :disabled="dialog.busy">Cancel</button>
+          </div>
+        </form>
+      </div>
     </div>
   </div>
 </template>
 
 <style scoped>
-.container { max-width: 960px; margin: 2rem auto; padding: 0 1rem; }
-.subtitle { color: #888 }
-.card { margin: 1rem 0; padding: 1rem; border: 1px solid #eee; border-radius: 8px; }
-.error { color: #a00 }
-.actions { margin-bottom: .5rem }
-.org { border-top: 1px dashed #eee; padding: .5rem 0 }
-.org-header { display: flex; gap: .5rem; align-items: baseline }
-.user-item { display: flex; gap: .5rem; margin: .15rem 0 }
-.users-table { width: 100%; border-collapse: collapse; margin-top: .25rem; }
-.users-table th, .users-table td { padding: .25rem .4rem; text-align: left; border-bottom: 1px solid #eee; font-weight: normal; }
-.users-table th { font-size: .75rem; text-transform: uppercase; letter-spacing: .05em; color: #555; }
-.users-table tbody tr:hover { background: #fafafa; }
-.org-actions, .role-actions, .perm-actions { display: flex; gap: .5rem; margin: .25rem 0 }
-.muted { color: #666 }
-.small { font-size: .9em }
-.pill-list { display: flex; flex-wrap: wrap; gap: .25rem }
-.pill { background: #f3f3f3; border: 1px solid #e2e2e2; border-radius: 999px; padding: .1rem .5rem; display: inline-flex; align-items: center; gap: .25rem }
-.pill-x { background: transparent; border: none; color: #900; cursor: pointer }
-button { padding: .25rem .5rem; border-radius: 6px; border: 1px solid #ddd; background: #fff; cursor: pointer }
-button:hover { background: #f7f7f7 }
-/* Avoid global button 100% width from frontend main styles */
-button, .perm-actions button, .org-actions button, .role-actions button { width: auto; }
-.roles-grid { display: flex; flex-wrap: wrap; gap: 1rem; align-items: stretch; padding: .5rem 0; }
-.role-column { background: #fafafa; border: 1px solid #eee; border-radius: 8px; padding: .5rem; min-width: 200px; flex: 1 1 240px; display: flex; flex-direction: column; max-width: 300px; }
-.role-header { display: flex; justify-content: space-between; align-items: center; margin-bottom: .25rem }
-.user-list { list-style: none; padding: 0; margin: 0; display: flex; flex-direction: column; gap: .25rem; flex: 1 1 auto; }
-.user-chip { background: #fff; border: 1px solid #ddd; border-radius: 6px; padding: .25rem .4rem; display: flex; justify-content: space-between; gap: .5rem; cursor: grab; }
-.user-chip:active { cursor: grabbing }
-.user-chip .name { font-weight: 500 }
-.user-chip .meta { font-size: .65rem; color: #666 }
-.role-column.drag-over { outline: 2px dashed #66a; }
-.org-table { width: 100%; border-collapse: collapse; }
-.org-table th, .org-table td { padding: .4rem .5rem; border-bottom: 1px solid #eee; text-align: left; }
-.org-table th { font-size: .75rem; text-transform: uppercase; letter-spacing: .05em; color: #555; }
-.org-table a { text-decoration: none; color: #0366d6; }
+.view-admin { padding-bottom: var(--space-3xl); }
+.view-header { display: flex; flex-direction: column; gap: var(--space-sm); }
+.admin-section { margin-top: var(--space-xl); }
+.admin-section-body { display: flex; flex-direction: column; gap: var(--space-xl); }
+.admin-panels { display: flex; flex-direction: column; gap: var(--space-xl); }
+.permissions-section { margin-bottom: var(--space-xl); }
+.permissions-section h2 { margin-bottom: var(--space-md); }
+.actions { display: flex; flex-wrap: wrap; gap: var(--space-sm); align-items: center; }
+.actions button { width: auto; }
+.org-table a { text-decoration: none; color: var(--color-link); }
 .org-table a:hover { text-decoration: underline; }
-.nav-link { font-size: .6em; margin-left: .5rem; background: #eee; padding: .25em .6em; border-radius: 999px; border: 1px solid #ccc; text-decoration: none; }
-.nav-link:hover { background: #ddd; }
-.back-link { font-size: .5em; margin-left: .75rem; text-decoration: none; background: #eee; padding: .25em .6em; border-radius: 999px; border: 1px solid #ccc; vertical-align: middle; line-height: 1.2; }
-.back-link:hover { background: #ddd; }
-.matrix-wrapper { margin: 1rem 0; text-align: left; }
-.matrix-scroll { overflow-x: auto; text-align: left; }
-.perm-matrix-grid { display: inline-grid; gap: 0; align-items: stretch; margin-right: 4rem; }
-.perm-matrix-grid > * { background: #fff; border: none; padding: .35rem .4rem; font-size: .75rem; }
-.perm-matrix-grid .grid-head { background: transparent; border: none; font-size: .65rem; letter-spacing: .05em; font-weight: 600; text-transform: uppercase; display: flex; justify-content: center; align-items: flex-end; padding-bottom: .25rem; }
-.perm-matrix-grid .perm-head { justify-content: flex-start; align-items: flex-end; }
-.perm-matrix-grid .role-head span { writing-mode: vertical-rl; transform: rotate(180deg); font-size: .6rem; line-height: 1; }
-.perm-matrix-grid .perm-name { font-weight: 500; white-space: nowrap; text-align: left; }
-.perm-matrix-grid .matrix-cell { display: flex; justify-content: center; align-items: center; }
-.perm-matrix-grid .matrix-cell input { cursor: pointer; }
-.matrix-hint { font-size: .7rem; margin-top: .25rem; }
-/* Add role column styles */
-.add-role-head { cursor: pointer; color: #2a6; font-size: 1rem; display:flex; justify-content:center; align-items:flex-end; }
-.add-role-head:hover { color:#1c4; }
-/* Removed add-role placeholder styles */
-/* Inline organization title with icon */
-.org-title { display: flex; align-items: center; gap: .4rem; }
-.org-title .org-name { flex: 0 1 auto; }
-/* Plus button for adding users */
-.plus-btn { background: none; border: none; font-size: 1.15rem; line-height: 1; padding: 0 .1rem; cursor: pointer; opacity: .6; }
-.plus-btn:hover, .plus-btn:focus { opacity: 1; outline: none; }
-.plus-btn:focus-visible { outline: 2px solid #555; outline-offset: 2px; }
-.empty-role { display: flex; flex-direction: column; gap: .4rem; align-items: flex-start; padding: .35rem .25rem; /* removed flex grow & width for natural size */ }
-.empty-role .empty-text { font-size: .7rem; margin: 0; }
-.delete-icon { color: #c00; }
-.delete-icon:hover, .delete-icon:focus { color: #ff0000; }
-.user-detail .user-link-box { margin-top: .75rem; font-size: .7rem; background: #fff; border: 1px dashed #ccc; padding: .5rem; border-radius: 6px; cursor: pointer; word-break: break-all; }
-.user-detail .user-link-box:hover { background: #f9f9f9; }
-.user-detail .user-link-box .expires { font-size: .6rem; margin-top: .25rem; color: #555; }
-/* Minimal icon button for rename/edit actions */
-.icon-btn { background: none; border: none; padding: 0 .15rem; margin-left: .15rem; cursor: pointer; font-size: .8rem; line-height: 1; opacity: .55; vertical-align: middle; }
-.icon-btn:hover, .icon-btn:focus { opacity: .95; outline: none; }
-.icon-btn:focus-visible { outline: 2px solid #555; outline-offset: 2px; }
-.icon-btn:active { transform: translateY(1px); }
-.org-title { display: flex; align-items: baseline; gap: .25rem; }
-.role-name { display: inline-flex; align-items: center; gap: .15rem; font-weight: 600; }
-.perm-name-line { display: flex; align-items: center; gap: .15rem; }
-.user-meta { margin-top: .25rem; }
-.cred-title { margin-top: .75rem; font-size: .85rem; }
-.cred-list { list-style: none; padding: 0; margin: .25rem 0 .5rem; display: flex; flex-direction: column; gap: .35rem; }
-.cred-item { background: #fff; border: 1px solid #eee; border-radius: 6px; padding: .35rem .5rem; font-size: .65rem; }
-.cred-line { display: flex; flex-direction: column; gap: .15rem; }
-.cred-line .dates { color: #555; font-size: .6rem; }
-/* Permission grid */
-.permission-grid { display: grid; grid-template-columns: minmax(220px,2fr) minmax(160px,3fr) 70px 90px; gap: 2px; margin-top: .5rem; }
-.permission-grid .perm-grid-head { font-size: .6rem; text-transform: uppercase; letter-spacing: .05em; font-weight: 600; padding: .35rem .4rem; background: #f3f3f3; border: 1px solid #e1e1e1; }
-.permission-grid .perm-cell { background: #fff; border: 1px solid #eee; padding: .35rem .4rem; font-size: .7rem; display: flex; align-items: center; gap: .4rem; }
-.permission-grid .perm-name { flex-direction: row; flex-wrap: wrap; }
-.permission-grid .perm-name { flex-direction: column; align-items: flex-start; gap:2px; }
-.permission-grid .perm-title-line { font-weight:600; line-height:1.1; }
-.permission-grid .perm-id-line { font-size:.55rem; line-height:1.1; word-break:break-all; }
-.permission-grid .center { justify-content: center; }
-.permission-grid .perm-actions { gap: .25rem; }
-.permission-grid .perm-actions .icon-btn { font-size: .9rem; }
-/* Inline edit overlay to avoid layout shift */
-.perm-actions-inner { position: relative; display:flex; width:100%; justify-content:center; }
-.perm-actions-inner .inline-id-form.overlay { position:absolute; inset:0; display:none; align-items:center; justify-content:center; gap:.25rem; background:rgba(255,255,255,.9); backdrop-filter:blur(2px); padding:0 .15rem; }
-.perm-actions-inner.editing .inline-id-form.overlay { display:inline-flex; }
-.perm-actions-inner.editing .actions-view { visibility:hidden; }
-/* Inline forms */
-.inline-form, .inline-id-form { display:inline-flex; gap:.25rem; align-items:center; }
-.inline-form input, .inline-id-form input { padding:.25rem .4rem; font-size:.6rem; border:1px solid #ccc; border-radius:4px; }
-.inline-form button, .inline-id-form button { font-size:.6rem; padding:.3rem .5rem; }
-.inline-id-form .id-input { width:120px; }
-/* Modal */
-.modal-overlay { position:fixed; inset:0; background:rgba(0,0,0,.4); display:flex; justify-content:center; align-items:flex-start; padding-top:8vh; z-index:200; }
-.modal { background:#fff; border-radius:10px; padding:1rem 1.1rem; width: min(420px, 90%); box-shadow:0 10px 30px rgba(0,0,0,.25); animation:pop .18s ease; }
-@keyframes pop { from { transform:translateY(10px); opacity:0 } to { transform:translateY(0); opacity:1 } }
-.modal-title { margin:0 0 .65rem; font-size:1rem; }
-.modal-form { display:flex; flex-direction:column; gap:.65rem; }
-.modal-form label { display:flex; flex-direction:column; font-size:.65rem; gap:.25rem; font-weight:600; }
-.modal-form input, .modal-form textarea { border:1px solid #ccc; border-radius:6px; padding:.45rem .55rem; font-size:.7rem; font-weight:400; font-family:inherit; }
-.modal-form textarea { resize:vertical; }
-.modal-actions { display:flex; gap:.5rem; justify-content:flex-end; margin-top:.25rem; }
-.modal-actions button { font-size:.65rem; }
-/* Org pill editing */
-.perm-orgs { flex-wrap: wrap; gap: .25rem; }
-.perm-orgs .org-pill { background:#eef4ff; border:1px solid #d0dcf0; padding:2px 6px; border-radius:999px; font-size:.55rem; display:inline-flex; align-items:center; gap:4px; }
-.perm-orgs .org-pill .pill-x { background:none; border:none; cursor:pointer; font-size:.7rem; line-height:1; padding:0; margin:0; color:#555; }
-.perm-orgs .org-pill .pill-x:hover { color:#c00; }
-.add-org-btn { background:none; border:none; cursor:pointer; font-size:.7rem; padding:0 2px; line-height:1; opacity:.55; display:inline; }
-.add-org-btn:hover, .add-org-btn:focus { opacity:1; }
-.add-org-btn:focus-visible { outline:2px solid #555; outline-offset:2px; }
-.org-add-wrapper { position:relative; display:inline-block; }
-.org-add-menu { position:absolute; top:100%; left:0; z-index:20; margin-top:4px; min-width:160px; background:#fff; border:1px solid #e2e6ea; border-radius:6px; padding:.3rem .35rem; box-shadow:0 4px 10px rgba(0,0,0,.08); display:flex; flex-direction:column; gap:.25rem; font-size:.6rem; }
-.org-add-menu:before { content:""; position:absolute; top:-5px; left:10px; width:8px; height:8px; background:#fff; border-left:1px solid #e2e6ea; border-top:1px solid #e2e6ea; transform:rotate(45deg); }
-.org-add-list { display:flex; flex-direction:column; gap:0; max-height:180px; overflow-y:auto; scrollbar-width:thin; }
-.org-add-item { background:transparent; border:none; padding:.25rem .4rem; font-size:.6rem; border-radius:4px; cursor:pointer; line-height:1.1; text-align:left; width:100%; color:#222; }
-.org-add-item:hover, .org-add-item:focus { background:#f2f5f9; }
-.org-add-item:active { background:#e6ebf0; }
-.org-add-footer { margin-top:.25rem; display:flex; justify-content:flex-end; }
-.org-add-cancel { background:transparent; border:none; font-size:.55rem; padding:.15rem .35rem; cursor:pointer; color:#666; border-radius:4px; }
-.org-add-cancel:hover, .org-add-cancel:focus { background:#f2f5f9; color:#222; }
-.org-add-cancel:active { background:#e6ebf0; }
+.perm-name-cell { display: flex; flex-direction: column; gap: 0.3rem; }
+.perm-title { font-weight: 600; color: var(--color-heading); }
+.perm-id-info { font-size: 0.8rem; color: var(--color-text-muted); }
+.plus-btn { background: var(--color-accent-soft); color: var(--color-accent); border: none; border-radius: var(--radius-sm); padding: 0.25rem 0.45rem; font-size: 1.1rem; cursor: pointer; }
+.plus-btn:hover { background: rgba(37, 99, 235, 0.18); }
+.user-list { list-style: none; padding: 0; margin: 0; display: flex; flex-direction: column; gap: var(--space-xs); }
+.user-chip { background: var(--color-surface); border: 1px solid var(--color-border); border-radius: var(--radius-md); padding: 0.45rem 0.6rem; display: flex; justify-content: space-between; gap: var(--space-sm); cursor: grab; }
+.user-chip .meta { font-size: 0.7rem; color: var(--color-text-muted); }
+.empty-role { border: 1px dashed var(--color-border-strong); border-radius: var(--radius-md); padding: var(--space-sm); display: flex; flex-direction: column; gap: var(--space-xs); align-items: flex-start; }
+.icon-btn { background: none; border: none; color: var(--color-text-muted); padding: 0.2rem; border-radius: var(--radius-sm); cursor: pointer; transition: background 0.2s ease, color 0.2s ease; }
+.icon-btn:hover { color: var(--color-heading); background: var(--color-surface-muted); }
+.delete-icon { color: var(--color-danger); }
+.delete-icon:hover { background: var(--color-danger-bg); color: var(--color-danger-text); }
+.matrix-wrapper { margin: var(--space-md) 0; padding: var(--space-lg); }
+.matrix-scroll { overflow-x: auto; }
+.matrix-hint { font-size: 0.8rem; color: var(--color-text-muted); }
+.perm-matrix-grid { display: inline-grid; gap: 0.25rem; align-items: stretch; }
+.perm-matrix-grid > * { padding: 0.35rem 0.45rem; font-size: 0.75rem; }
+.perm-matrix-grid .grid-head { color: var(--color-text-muted); text-transform: uppercase; font-weight: 600; letter-spacing: 0.05em; }
+.perm-matrix-grid .perm-head { display: flex; align-items: flex-end; justify-content: flex-start; padding: 0.35rem 0.45rem; font-size: 0.75rem; }
+.perm-matrix-grid .role-head { display: flex; align-items: flex-end; justify-content: center; }
+.perm-matrix-grid .role-head span { writing-mode: vertical-rl; transform: rotate(180deg); font-size: 0.65rem; }
+.perm-matrix-grid .org-head { display: flex; align-items: flex-end; justify-content: center; }
+.perm-matrix-grid .org-head span { writing-mode: vertical-rl; transform: rotate(180deg); font-size: 0.65rem; }
+.perm-matrix-grid .add-role-head,
+.perm-matrix-grid .add-permission-head { cursor: pointer; }
+.perm-name { font-weight: 600; color: var(--color-heading); padding: 0.35rem 0.45rem; font-size: 0.75rem; }
+.perm-orgs { gap: 0.5rem; }
+.perm-orgs-list { display: flex; flex-wrap: wrap; gap: 0.4rem; }
+.org-pill { display: inline-flex; align-items: center; gap: 0.3rem; padding: 0.2rem 0.55rem; border-radius: 999px; background: var(--color-surface-muted); border: 1px solid var(--color-border); font-size: 0.75rem; }
+.pill-x { background: none; border: none; color: var(--color-danger); cursor: pointer; }
+.pill-x:hover { color: var(--color-danger-text); }
+.org-add-wrapper { display: inline-flex; align-items: center; gap: var(--space-xs); position: relative; }
+.add-org-btn { background: var(--color-accent-soft); color: var(--color-accent); border: none; border-radius: var(--radius-sm); padding: 0.2rem 0.4rem; cursor: pointer; }
+.add-org-btn:hover { background: rgba(37, 99, 235, 0.18); }
+.org-add-menu { position: absolute; top: calc(100% + var(--space-xs)); right: 0; background: var(--color-surface); border: 1px solid var(--color-border); border-radius: var(--radius-md); box-shadow: var(--shadow-lg); padding: var(--space-xs); min-width: 220px; z-index: 20; }
+.org-add-list { display: flex; flex-direction: column; gap: var(--space-xs); max-height: 240px; overflow-y: auto; }
+.org-add-item { background: none; border: 1px solid transparent; border-radius: var(--radius-sm); padding: 0.45rem 0.6rem; text-align: left; cursor: pointer; }
+.org-add-item:hover { background: var(--color-surface-muted); border-color: var(--color-border-strong); }
+.org-add-footer { display: flex; justify-content: flex-end; margin-top: var(--space-xs); }
+.org-add-cancel { background: none; border: none; color: var(--color-text-muted); cursor: pointer; }
+.display-text { margin-right: var(--space-xs); }
+.edit-display-btn { padding: 0.1rem 0.2rem; font-size: 0.8rem; }
+.edit-org-btn { padding: 0.1rem 0.2rem; font-size: 0.8rem; margin-left: var(--space-xs); }
+.perm-actions { text-align: center; }
+.small { font-size: 0.9rem; }
+.muted { color: var(--color-text-muted); }
+.error { color: var(--color-danger-text); }
+
+.modal-overlay {
+  position: fixed;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  background: rgba(0, 0, 0, 0.5);
+  backdrop-filter: blur(.1rem);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  z-index: 1000;
+}
+
+.modal {
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-xl);
+  padding: var(--space-lg);
+  max-width: 500px;
+  width: 90%;
+  max-height: 90vh;
+  overflow-y: auto;
+}
+
+.modal-title {
+  margin: 0 0 var(--space-md) 0;
+  font-size: 1.25rem;
+  font-weight: 600;
+  color: var(--color-heading);
+}
+
+.modal-form {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-md);
+}
+
+.modal-form label {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-xs);
+  font-weight: 500;
+}
+
+.modal-form input,
+.modal-form textarea {
+  padding: var(--space-sm);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-sm);
+  background: var(--color-surface);
+  color: var(--color-text);
+}
+
+.modal-form input:focus,
+.modal-form textarea:focus {
+  outline: none;
+  border-color: var(--color-accent);
+  box-shadow: 0 0 0 2px rgba(37, 99, 235, 0.1);
+}
+
+.modal-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: var(--space-sm);
+  margin-top: var(--space-lg);
+}
+
+@media (max-width: 720px) {
+  .card.surface { padding: var(--space-md); }
+  .actions { flex-direction: column; align-items: flex-start; }
+  .roles-grid { flex-direction: column; }
+  .org-add-menu { left: 0; right: auto; }
+}
 </style>
diff --git a/frontend/src/assets/style.css b/frontend/src/assets/style.css
index f30ef3c..775b263 100644
--- a/frontend/src/assets/style.css
+++ b/frontend/src/assets/style.css
@@ -1,486 +1,599 @@
-/* Passkey Authentication - Main Styles */
+/* Passkey Authentication – Unified Layout */
+
+:root {
+  color-scheme: light dark;
+  --font-sans: "Inter", "Inter var", "Segoe UI", system-ui, -apple-system, "Helvetica Neue", sans-serif;
+  --font-mono: "DM Mono", "JetBrains Mono", "SFMono-Regular", Menlo, Monaco, Consolas, "Liberation Mono", monospace;
+  --color-canvas: #f5f6f8;
+  --color-surface: #ffffff;
+  --color-surface-subtle: #f1f3f7;
+  --color-border: #d0d5dd;
+  --color-border-strong: #9aa2af;
+  --color-heading: #101828;
+  --color-text: #1f2933;
+  --color-text-muted: #52616b;
+  --color-link: #2563eb;
+  --color-link-hover: #1d4ed8;
+  --color-accent: #2563eb;
+  --color-accent-strong: #1e3faa;
+  --color-accent-contrast: #ffffff;
+  --color-success-text: #0f5132;
+  --color-success-bg: #d1fadf;
+  --color-error-text: #b42318;
+  --color-error-bg: #ffe3e3;
+  --color-info-text: #0f609b;
+  --color-info-bg: #d6ecff;
+  --color-danger: #dc2626;
+  --shadow-soft: 0 10px 30px rgba(15, 23, 42, 0.08);
+  --radius-none: 0;
+  --radius-sm: 4px;
+  --radius-md: 6px;
+  --radius-lg: 10px;
+  --space-xxs: 0.25rem;
+  --space-xs: 0.5rem;
+  --space-sm: 0.75rem;
+  --space-md: 1rem;
+  --space-lg: 1.5rem;
+  --space-xl: 2.25rem;
+  --space-xxl: 3.5rem;
+  --layout-max-width: 1080px;
+  --layout-padding: clamp(1.5rem, 3vw + 1rem, 3.25rem);
+  --transition-base: 160ms ease;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    color-scheme: dark;
+    --color-canvas: #0f172a;
+    --color-surface: #141b2f;
+    --color-surface-subtle: #1b243b;
+    --color-border: #25304a;
+    --color-border-strong: #3d4d6b;
+    --color-heading: #f8fafc;
+    --color-text: #e2e8f0;
+    --color-text-muted: #94a3b8;
+    --color-link: #60a5fa;
+    --color-link-hover: #93c5fd;
+    --color-accent: #60a5fa;
+    --color-accent-strong: #3b82f6;
+    --color-accent-contrast: #0b1120;
+    --color-success-text: #34d399;
+    --color-success-bg: rgba(34, 197, 94, 0.12);
+    --color-error-text: #fca5a5;
+    --color-error-bg: rgba(248, 113, 113, 0.16);
+    --color-info-text: #bae6fd;
+    --color-info-bg: rgba(59, 130, 246, 0.16);
+    --color-danger: #f87171;
+    --shadow-soft: 0 0 0 rgba(0, 0, 0, 0);
+  }
+}
+
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+}
+
+html,
+body {
+  height: 100%;
+}
 
 body {
-    font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
-    margin: 0;
-    padding: 0;
-    background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
-    min-height: 100vh;
-    display: flex;
-    align-items: center;
-    justify-content: center;
+  margin: 0;
+  font-family: var(--font-sans);
+  background: var(--color-canvas);
+  color: var(--color-text);
+  line-height: 1.55;
+  -webkit-font-smoothing: antialiased;
 }
 
-a, a:visited {
-    text-decoration: none;
+body,
+#app,
+#admin-app {
+  display: flex;
+  flex-direction: column;
+  min-height: 100vh;
 }
 
-.container {
-    background: white;
-    padding: 40px;
-    border-radius: 15px;
-    box-shadow: 0 10px 30px rgba(0,0,0,0.2);
-    width: 100%;
-    max-width: 400px;
-    text-align: center;
+#app,
+#admin-app {
+  flex: 1;
 }
 
-.view {
-    display: none;
+a,
+a:visited {
+  color: var(--color-link);
+  text-decoration: none;
 }
 
-.view.active {
-    display: block;
+a:hover,
+a:focus-visible {
+  color: var(--color-link-hover);
+  text-decoration: underline;
 }
 
-h1 {
-    color: #333;
-    margin-bottom: 30px;
-    font-weight: 300;
-    font-size: 28px;
+a:focus-visible {
+  outline: 2px solid var(--color-accent);
+  outline-offset: 2px;
+  border-radius: var(--radius-sm);
 }
 
-h2 {
-    color: #555;
-    margin-bottom: 20px;
-    font-weight: 400;
-    font-size: 22px;
+.app-shell {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  min-height: 100vh;
+  background: var(--color-canvas);
 }
 
-input[type="text"] {
-    width: 100%;
-    padding: 15px;
-    border: 2px solid #e1e5e9;
-    border-radius: 8px;
-    font-size: 16px;
-    margin-bottom: 20px;
-    box-sizing: border-box;
-    transition: border-color 0.3s ease;
+.app-main {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
 }
 
-input[type="text"]:focus {
-    outline: none;
-    border-color: #667eea;
+.view-root {
+  flex: 1;
+  width: 100%;
+  display: flex;
+  padding: var(--layout-padding);
+  box-sizing: border-box;
+}
+
+.view-content {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  gap: 2rem;
+  margin: 0 auto;
+  width: min(100%, var(--layout-max-width));
+}
+
+.view-content--wide {
+  width: min(100%, 1200px);
+}
+
+.view-header {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+.view-header h1 {
+  margin: 0;
+  font-size: clamp(1.85rem, 2.5vw + 1rem, 2.6rem);
+  font-weight: 600;
+  color: var(--color-heading);
+}
+
+.view-lede {
+  margin: 0;
+  color: var(--color-text-muted);
+  font-size: 1rem;
+}
+
+.section-block {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.section-block h2 {
+  margin: 0;
+  font-size: clamp(1.25rem, 1.5vw + 1rem, 1.65rem);
+  font-weight: 600;
+  color: var(--color-heading);
+}
+
+.section-body {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.button-row {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.75rem;
+  justify-content: flex-start;
+}
+
+.surface {
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+  padding: var(--space-lg);
+  box-shadow: var(--shadow-soft);
+}
+
+.surface--tight {
+  padding: var(--space-md);
 }
 
 button {
-    width: 100%;
-    padding: 15px;
-    margin-bottom: 15px;
-    font-size: 16px;
-    font-weight: 500;
-    cursor: pointer;
-    border: none;
-    border-radius: 8px;
-    transition: all 0.3s ease;
+  font-family: inherit;
+  font-size: 1rem;
+  font-weight: 500;
+  border-radius: var(--radius-sm);
+  border: 1px solid transparent;
+  padding: 0.65rem 1.1rem;
+  cursor: pointer;
+  transition: all var(--transition-base);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.4rem;
+  background: var(--color-surface);
+  color: var(--color-text);
 }
 
-.btn-primary {
-    background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
-    color: white;
-}
-
-.btn-primary:hover:not(:disabled) {
-    transform: translateY(-2px);
-    box-shadow: 0 5px 15px rgba(102, 126, 234, 0.4);
-}
-
-.btn-secondary {
-    background: transparent;
-    color: #667eea;
-    border: 2px solid #667eea;
-}
-
-.btn-secondary:hover:not(:disabled) {
-    background: #667eea;
-    color: white;
-}
-
-.btn-danger {
-    background: #dc3545;
-    color: white;
-}
-
-.btn-danger:hover:not(:disabled) {
-    background: #c82333;
+button:focus-visible {
+  outline: 2px solid var(--color-accent);
+  outline-offset: 2px;
 }
 
 button:disabled {
-    background: #ccc !important;
-    cursor: not-allowed !important;
-    transform: none !important;
-    box-shadow: none !important;
+  opacity: 0.6;
+  cursor: not-allowed;
 }
 
-.status {
-    padding: 10px;
-    margin: 15px 0;
-    border-radius: 5px;
-    font-size: 14px;
+.btn-primary {
+  background: var(--color-accent);
+  color: var(--color-accent-contrast);
+  border-color: var(--color-accent);
+  box-shadow: var(--shadow-soft);
 }
 
-.status.success {
-    background: #d4edda;
-    color: #155724;
-    border: 1px solid #c3e6cb;
+.btn-primary:hover:not(:disabled) {
+  background: var(--color-accent-strong);
+  border-color: var(--color-accent-strong);
 }
 
-.status.error {
-    background: #f8d7da;
-    color: #721c24;
-    border: 1px solid #f5c6cb;
+.btn-secondary {
+  background: transparent;
+  color: var(--color-text);
+  border-color: var(--color-border);
 }
 
-.status.info {
-    background: #d1ecf1;
-    color: #0c5460;
-    border: 1px solid #bee5eb;
+.btn-secondary:hover:not(:disabled) {
+  border-color: var(--color-border-strong);
+  background: var(--color-surface-subtle);
 }
 
-.credential-list {
-    max-height: 300px;
-    overflow-y: auto;
-    margin: 20px 0;
+.btn-danger {
+  background: var(--color-danger);
+  color: var(--color-accent-contrast);
+  border-color: transparent;
 }
 
-.credential-item {
-    background: #f8f9fa;
-    border: 1px solid #e9ecef;
-    border-radius: 8px;
-    padding: 15px;
-    margin: 10px 0;
-    text-align: left;
+.btn-danger:hover:not(:disabled) {
+  filter: brightness(0.92);
 }
 
-.credential-item.current-session {
-    border: 2px solid #007bff;
-    background: #f8f9ff;
-    box-shadow: 0 2px 8px rgba(0, 123, 255, 0.2);
+input[type="text"],
+input[type="search"],
+input[type="email"],
+textarea,
+select {
+  font: inherit;
+  width: 100%;
+  padding: 0.65rem 0.75rem;
+  border-radius: var(--radius-sm);
+  border: 1px solid var(--color-border);
+  background: var(--color-surface);
+  color: var(--color-text);
+  transition: border-color var(--transition-base), box-shadow var(--transition-base);
 }
 
-.credential-item.current-session .credential-info h4 {
-    color: #0056b3;
+input:focus-visible,
+textarea:focus-visible,
+select:focus-visible {
+  border-color: var(--color-accent);
+  box-shadow: 0 0 0 3px rgba(37, 99, 235, 0.15);
+  outline: none;
 }
 
-.credential-header {
-    display: grid;
-    grid-template-columns: 32px 1fr auto auto;
-    gap: 12px;
-    align-items: center;
-    margin-bottom: 10px;
+label {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  color: var(--color-text);
 }
 
-.credential-icon {
-    width: 32px;
-    height: 32px;
-    display: flex;
-    align-items: center;
-    justify-content: center;
+p {
+  margin: 0;
+  color: var(--color-text);
 }
 
-.auth-icon {
-    border-radius: 4px;
-    width: 32px;
-    height: 32px;
+small {
+  color: var(--color-text-muted);
 }
 
-.auth-emoji {
-    font-size: 24px;
-    display: block;
-    text-align: center;
+.table-wrapper {
+  overflow-x: auto;
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
 }
 
-.credential-info {
-    min-width: 0;
+table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.95rem;
 }
 
-.credential-info h4 {
-    margin: 0;
-    color: #333;
-    font-size: 16px;
+thead tr {
+  background: var(--color-surface-subtle);
+  color: var(--color-text-muted);
 }
 
-.credential-dates {
-    text-align: right;
-    flex-shrink: 0;
-    margin-left: 20px;
-    display: grid;
-    grid-template-columns: auto auto;
-    gap: 5px 10px;
-    align-items: center;
+td,
+th {
+  padding: 0.65rem 0.75rem;
+  border-bottom: 1px solid var(--color-border);
+  text-align: left;
 }
 
-.date-label {
-    color: #666;
-    font-weight: normal;
-    font-size: 12px;
-    text-align: right;
+.center {
+  text-align: center;
 }
 
-.date-value {
-    color: #333;
-    font-size: 12px;
-    text-align: left;
+.badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.35rem;
+  padding: 0.2rem 0.6rem;
+  border-radius: var(--radius-sm);
+  background: var(--color-surface-subtle);
+  border: 1px solid var(--color-border);
+  color: var(--color-text-muted);
+  font-size: 0.75rem;
 }
 
-.user-info {
-    background: #e7f3ff;
-    border: 1px solid #bee5eb;
-    border-radius: 8px;
-    padding: 15px;
-    margin: 20px 0;
-}
-
-.user-info h3 {
-    margin: 0 0 10px 0;
-    color: #0c5460;
-}
-
-.user-info p {
-    margin: 5px 0;
-    color: #0c5460;
-}
-
-.toggle-link {
-    color: #667eea;
-    text-decoration: underline;
-    cursor: pointer;
-    font-size: 14px;
-}
-
-.toggle-link:hover {
-    color: #764ba2;
-}
-
-.hidden {
-    display: none;
-}
-
-.credential-actions {
-    display: flex;
-    align-items: center;
-}
-
-.btn-delete-credential {
-    background: none;
-    border: none;
-    cursor: pointer;
-    padding: 4px 8px;
-    border-radius: 4px;
-    font-size: 16px;
-    color: #dc3545;
-    transition: background-color 0.2s;
-}
-
-.btn-delete-credential:hover:not(:disabled) {
-    background-color: #f8d7da;
-}
-
-.btn-delete-credential:disabled {
-    opacity: 0.3;
-    cursor: not-allowed;
-}
-
-.token-info {
-    background: #f5f5f5;
-    padding: 15px;
-    border-radius: 8px;
-    margin: 15px 0;
-    text-align: left;
-}
-
-.token-info strong {
-    color: #333;
-}
-
-.token-info code {
-    background: #e9ecef;
-    padding: 4px 8px;
-    border-radius: 4px;
-    font-family: monospace;
-}
-
-.qr-container {
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    margin: 20px 0;
-}
-
-.qr-code {
-    border: 1px solid #ddd;
-    border-radius: 8px;
-    padding: 10px;
-    background: white;
-    margin: 10px 0;
-}
-
-.link-container {
-    background: #f8f9fa;
-    border: 1px solid #e9ecef;
-    border-radius: 8px;
-    padding: 15px;
-    margin: 10px 0;
-    word-break: break-all;
-}
-
-.link-container .link-text {
-    font-family: monospace;
-    font-size: 14px;
-    color: #495057;
-    margin: 0;
-}
-
-/* Global Status Styles */
 .global-status {
-    position: fixed;
-    top: 20px;
-    left: 50%;
-    transform: translateX(-50%);
-    z-index: 10000;
-    min-width: 300px;
-    max-width: 600px;
-    display: none;
-    animation: slideDown 0.3s ease-out;
+  position: fixed;
+  top: 1.5rem;
+  left: 50%;
+  transform: translateX(-50%);
+  z-index: 1200;
+  min-width: min(520px, calc(100vw - 2rem));
+  display: none;
 }
 
 .global-status .status {
-    margin: 0;
-    box-shadow: 0 4px 12px rgba(0,0,0,0.15);
-    border-width: 2px;
-    font-weight: 500;
-    padding: 12px 20px;
-    border-radius: 8px;
-    text-align: center;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0.85rem 1.25rem;
+  border-radius: var(--radius-sm);
+  border-width: 1px;
+  border-style: solid;
+  background: var(--color-surface);
+  box-shadow: var(--shadow-soft);
+  font-weight: 550;
 }
 
 .status.info {
-    background: #d1ecf1;
-    color: #0c5460;
-    border-color: #bee5eb;
+  border-color: rgba(14, 96, 155, 0.28);
+  color: var(--color-info-text);
+  background: var(--color-info-bg);
 }
 
 .status.success {
-    background: #d4edda;
-    color: #155724;
-    border-color: #c3e6cb;
+  border-color: rgba(6, 118, 71, 0.22);
+  color: var(--color-success-text);
+  background: var(--color-success-bg);
 }
 
 .status.error {
-    background: #f8d7da;
-    color: #721c24;
-    border-color: #f5c6cb;
+  border-color: rgba(180, 35, 24, 0.28);
+  color: var(--color-error-text);
+  background: var(--color-error-bg);
 }
 
-@keyframes slideDown {
-    from {
-        transform: translateX(-50%) translateY(-100%);
-        opacity: 0;
-    }
-    to {
-        transform: translateX(-50%) translateY(0);
-        opacity: 1;
-    }
-}
-
-/* Vue-specific styles */
-[v-cloak] {
-    display: none;
-}
-
-/* Dialog overlay and modal styles */
 .dialog-overlay {
-    position: fixed;
-    top: 0;
-    left: 0;
-    width: 100%;
-    height: 100%;
-    background: rgba(0, 0, 0, 0.5);
-    z-index: 1000;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    animation: fadeIn 0.3s ease-out;
+  position: fixed;
+  inset: 0;
+  background: rgba(9, 14, 24, 0.55);
+  backdrop-filter: blur(6px);
+  z-index: 1100;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 1.5rem;
 }
 
-.device-dialog {
-    background: white;
-    padding: 30px;
-    border-radius: 15px;
-    box-shadow: 0 10px 30px rgba(0,0,0,0.3);
-    width: 90%;
-    max-width: 500px;
-    max-height: 90vh;
-    overflow-y: auto;
-    border: none;
-    animation: slideUp 0.3s ease-out;
+.device-dialog,
+.modal {
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-md);
+  width: min(520px, 100%);
+  max-height: calc(100vh - 3rem);
+  overflow-y: auto;
+  padding: 1.75rem;
+  box-shadow: var(--shadow-soft);
+  color: var(--color-text);
 }
 
-.device-link-section {
-    margin: 20px 0;
+.qr-container {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 0.75rem;
+  text-align: center;
+  color: var(--color-text-muted);
 }
 
+.qr-code {
+  border: 1px solid var(--color-border);
+  padding: 0.75rem;
+  background: var(--color-surface);
+}
+
+.link-container,
+.token-display,
 .token-info {
-    text-align: center;
+  background: var(--color-surface-subtle);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-sm);
+  padding: 0.75rem;
+  color: var(--color-text);
 }
 
-.token-display {
-    margin: 15px 0;
-    padding: 10px;
-    background: #f8f9fa;
-    border-radius: 8px;
+.credential-list {
+  width: 100%;
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
+  gap: 1rem 1.25rem;
+  align-items: stretch;
 }
 
-.token-display code {
-    font-size: 16px;
-    font-weight: bold;
-    color: #495057;
+.credential-item {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+  padding: 0.85rem 1rem;
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-sm);
+  background: var(--color-surface);
+  height: 100%;
 }
 
-@keyframes fadeIn {
-    from { opacity: 0; }
-    to { opacity: 1; }
+.credential-item.current-session {
+  border-color: var(--color-accent);
+  background: rgba(37, 99, 235, 0.08);
 }
 
-@keyframes slideUp {
-    from {
-        transform: translateY(50px);
-        opacity: 0;
-    }
-    to {
-        transform: translateY(0);
-        opacity: 1;
-    }
+.credential-header {
+  display: flex;
+  gap: 1rem;
+  align-items: flex-start;
+  flex-wrap: wrap;
+  flex: 1 1 auto;
 }
 
-/* Responsive improvements */
-@media (max-width: 600px) {
-    .container {
-        margin: 20px;
-        padding: 30px 20px;
-        max-width: none;
-    }
-
-    .device-dialog {
-        margin: 20px;
-        padding: 20px;
-        max-width: none;
-    }
-
-    .global-status {
-        left: 20px;
-        right: 20px;
-        transform: none;
-        min-width: auto;
-    }
-
-    .credential-header {
-        flex-direction: column;
-        align-items: flex-start;
-        gap: 10px;
-    }
-
-    .credential-dates {
-        width: 100%;
-    }
+.credential-icon {
+  width: 40px;
+  height: 40px;
+  display: grid;
+  place-items: center;
+}
+
+.credential-info {
+  flex: 1 1 auto;
+}
+
+.credential-info h4 {
+  margin: 0;
+  font-size: 1rem;
+  font-weight: 600;
+  color: var(--color-heading);
+}
+
+.credential-dates {
+  display: grid;
+  grid-auto-flow: row;
+  grid-template-columns: auto 1fr;
+  gap: 0.35rem 0.5rem;
+  font-size: 0.75rem;
+  color: var(--color-text-muted);
+  align-items: center;
+}
+
+.date-label {
+  font-weight: 500;
+  color: inherit;
+}
+
+.date-value {
+  color: var(--color-text);
+}
+
+.credential-actions {
+  margin-left: auto;
+  display: flex;
+  align-items: center;
+}
+
+.btn-delete-credential {
+  background: transparent;
+  border: none;
+  color: var(--color-danger);
+  padding: 0.25rem 0.35rem;
+  font-size: 1.05rem;
+}
+
+.btn-delete-credential:hover:not(:disabled) {
+  background: rgba(220, 38, 38, 0.08);
+}
+
+.btn-delete-credential:disabled {
+  opacity: 0.35;
+  cursor: not-allowed;
+}
+
+.user-info {
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-sm);
+  padding: 1.1rem 1.25rem;
+  display: grid;
+  grid-template-columns: auto 1fr;
+  gap: 0.75rem 1.25rem;
+}
+
+.user-info h3 {
+  margin: 0;
+  grid-column: span 2;
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 1.15rem;
+  font-weight: 600;
+}
+
+.user-info span {
+  text-align: left;
+  color: var(--color-text);
+}
+
+.toggle-link {
+  color: var(--color-link);
+  cursor: pointer;
+}
+
+.toggle-link:hover {
+  color: var(--color-link-hover);
+}
+
+.token-info code {
+  font-family: var(--font-mono);
+}
+
+@media (max-width: 720px) {
+  .view-root {
+    padding: clamp(1rem, 3vw + 0.75rem, 2rem);
+  }
+
+  .view-content {
+    gap: 1.75rem;
+  }
+
+  .credential-dates {
+    grid-auto-flow: row;
+    grid-template-columns: auto auto;
+  }
+
+  button {
+    width: 100%;
+  }
+
+  .button-row {
+    flex-direction: column;
+  }
+
+  .global-status {
+    top: 1rem;
+  }
 }
diff --git a/frontend/src/components/Breadcrumbs.vue b/frontend/src/components/Breadcrumbs.vue
index 6abfc0f..1c5bece 100644
--- a/frontend/src/components/Breadcrumbs.vue
+++ b/frontend/src/components/Breadcrumbs.vue
@@ -29,14 +29,10 @@ const crumbs = computed(() => {
 </template>
 
 <style scoped>
-.breadcrumbs { margin: .25rem 0 .5rem; line-height:1.2; }
-.breadcrumbs ol { list-style: none; padding: 0; margin: 0; display: flex; flex-wrap: wrap; align-items: center; }
-.breadcrumbs li { display: inline-flex; align-items: center; }
-.breadcrumbs a { text-decoration: none; color: #0366d6; padding: 0 .15rem; border-radius:4px; }
-.breadcrumbs a:hover, .breadcrumbs a:focus { text-decoration: underline; }
-.breadcrumbs .sep { color: #888; margin: 0 .1rem; }
-@media (prefers-color-scheme: dark) {
-  .breadcrumbs a { color: #4ea3ff; }
-  .breadcrumbs .sep { color: #aaa; }
-}
+.breadcrumbs { margin: .25rem 0 .5rem; line-height:1.2; color: var(--color-text-muted); }
+.breadcrumbs ol { list-style: none; padding: 0; margin: 0; display: flex; flex-wrap: wrap; align-items: center; gap: .25rem; }
+.breadcrumbs li { display: inline-flex; align-items: center; gap: .25rem; font-size: .9rem; }
+.breadcrumbs a { text-decoration: none; color: var(--color-link); padding: 0 .25rem; border-radius:4px; transition: color 0.2s ease, background 0.2s ease; }
+.breadcrumbs a:hover, .breadcrumbs a:focus-visible { text-decoration: underline; color: var(--color-link-hover); outline: none; }
+.breadcrumbs .sep { color: var(--color-text-muted); margin: 0; }
 </style>
diff --git a/frontend/src/components/CredentialList.vue b/frontend/src/components/CredentialList.vue
index af7d5f1..6b32f4f 100644
--- a/frontend/src/components/CredentialList.vue
+++ b/frontend/src/components/CredentialList.vue
@@ -2,7 +2,7 @@
   <div class="credential-list">
     <div v-if="loading"><p>Loading credentials...</p></div>
     <div v-else-if="!credentials?.length"><p>No passkeys found.</p></div>
-    <div v-else>
+    <template v-else>
       <div
         v-for="credential in credentials"
         :key="credential.credential_uuid"
@@ -39,7 +39,7 @@
           </div>
         </div>
       </div>
-    </div>
+    </template>
   </div>
 </template>
 
@@ -69,16 +69,119 @@ const getCredentialAuthIcon = (credential) => {
 </script>
 
 <style scoped>
-.credential-list { display: flex; flex-direction: column; gap: .75rem; margin-top: .5rem; }
-.credential-item { border: 1px solid #ddd; border-radius: 8px; padding: .5rem .75rem; background: #fff; }
-.credential-header { display: flex; align-items: center; gap: 1rem; }
-.credential-icon { width: 40px; height: 40px; display: flex; align-items: center; justify-content: center; }
-.auth-icon { border-radius: 6px; }
-.credential-info { flex: 1 1 auto; }
-.credential-info h4 { margin: 0; font-size: .9rem; }
-.credential-dates { display: grid; grid-auto-flow: column; gap: .4rem; font-size: .65rem; align-items: center; }
-.date-label { font-weight: 600; }
-.credential-actions { margin-left: auto; }
-.btn-delete-credential { background: none; border: none; cursor: pointer; font-size: .9rem; }
-.btn-delete-credential:disabled { opacity: .3; cursor: not-allowed; }
+.credential-list {
+  width: 100%;
+  margin-top: var(--space-sm);
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
+  gap: 1rem 1.25rem;
+  align-items: stretch;
+}
+
+.credential-item {
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-sm);
+  padding: 0.85rem 1rem;
+  background: var(--color-surface);
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+  width: 28rem;
+  height: 100%;
+  transition: border-color 0.2s ease, box-shadow 0.2s ease, transform 0.2s ease;
+}
+
+.credential-item:hover {
+  border-color: var(--color-border-strong);
+  box-shadow: 0 10px 24px rgba(15, 23, 42, 0.12);
+  transform: translateY(-1px);
+}
+
+.credential-item.current-session {
+  border-color: var(--color-accent);
+  background: rgba(37, 99, 235, 0.08);
+}
+
+.credential-header {
+  display: flex;
+  align-items: flex-start;
+  gap: 1rem;
+  flex-wrap: wrap;
+  flex: 1 1 auto;
+}
+
+.credential-icon {
+  width: 40px;
+  height: 40px;
+  display: grid;
+  place-items: center;
+  background: var(--color-surface-subtle, transparent);
+  border-radius: var(--radius-sm);
+  border: 1px solid var(--color-border);
+}
+
+.auth-icon {
+  border-radius: var(--radius-sm);
+}
+
+.credential-info {
+  flex: 1 1 150px;
+  min-width: 0;
+}
+
+.credential-info h4 {
+  margin: 0;
+  font-size: 1rem;
+  font-weight: 600;
+  color: var(--color-heading);
+}
+
+.credential-dates {
+  display: grid;
+  grid-auto-flow: row;
+  grid-template-columns: auto 1fr;
+  gap: 0.35rem 0.5rem;
+  font-size: 0.75rem;
+  align-items: center;
+  color: var(--color-text-muted);
+}
+
+.date-label {
+  font-weight: 600;
+}
+
+.date-value {
+  color: var(--color-text);
+}
+
+.credential-actions {
+  margin-left: auto;
+  display: flex;
+  align-items: center;
+}
+
+.btn-delete-credential {
+  background: none;
+  border: none;
+  cursor: pointer;
+  font-size: 1rem;
+  color: var(--color-danger);
+  padding: 0.25rem 0.35rem;
+  border-radius: var(--radius-sm);
+}
+
+.btn-delete-credential:hover:not(:disabled) {
+  background: rgba(220, 38, 38, 0.08);
+}
+
+.btn-delete-credential:disabled {
+  opacity: 0.35;
+  cursor: not-allowed;
+}
+
+@media (max-width: 600px) {
+  .credential-list {
+    grid-template-columns: 1fr;
+  }
+}
 </style>
diff --git a/frontend/src/components/DeviceLinkView.vue b/frontend/src/components/DeviceLinkView.vue
index 7655dfa..78f8bdd 100644
--- a/frontend/src/components/DeviceLinkView.vue
+++ b/frontend/src/components/DeviceLinkView.vue
@@ -1,39 +1,48 @@
 <template>
-  <div class="container">
-    <div class="view active">
-      <h1>📱 Add Another Device</h1>
-      <div class="device-link-section">
-        <div class="qr-container">
-          <a :href="url" id="deviceLinkText" @click="copyLink">
-            <canvas id="qrCode" class="qr-code"></canvas>
-            <p v-if="url">
-              {{ url.replace(/^[^:]+:\/\//, '') }}
-            </p>
-            <p v-else>
-              <em>Generating link...</em>
-            </p>
-          </a>
-          <p>
-            <strong>Scan and visit the URL on another device.</strong><br>
-            <small>⚠️ Expires in 24 hours and can only be used once.</small>
-          </p>
+  <section class="view-root view-device-link">
+    <div class="view-content view-content--narrow">
+      <header class="view-header">
+        <h1>📱 Add Another Device</h1>
+        <p class="view-lede">Generate a one-time link to set up passkeys on a new device.</p>
+      </header>
+      <section class="section-block">
+        <div class="section-body">
+          <div class="device-link-section">
+            <div class="qr-container">
+              <a :href="url" class="qr-link" @click="copyLink">
+                <canvas ref="qrCanvas" class="qr-code"></canvas>
+                <p v-if="url">
+                  {{ url.replace(/^[^:]+:\/\//, '') }}
+                </p>
+                <p v-else>
+                  <em>Generating link...</em>
+                </p>
+              </a>
+              <p>
+                <strong>Scan and visit the URL on another device.</strong><br>
+                <small>⚠️ Expires in 24 hours and can only be used once.</small>
+              </p>
+            </div>
+          </div>
+          <div class="button-row">
+            <button @click="authStore.currentView = 'profile'" class="btn-secondary">
+              Back to Profile
+            </button>
+          </div>
         </div>
-      </div>
-
-      <button @click="authStore.currentView = 'profile'" class="btn-secondary">
-        Back to Profile
-      </button>
+      </section>
     </div>
-  </div>
+  </section>
 </template>
 
 <script setup>
-import { ref, onMounted } from 'vue'
+import { ref, onMounted, nextTick } from 'vue'
 import { useAuthStore } from '@/stores/auth'
 import QRCode from 'qrcode/lib/browser'
 
 const authStore = useAuthStore()
 const url = ref(null)
+const qrCanvas = ref(null)
 
 const copyLink = async (event) => {
   event.preventDefault()
@@ -44,24 +53,56 @@ const copyLink = async (event) => {
   }
 }
 
+async function drawQr() {
+  if (!url.value || !qrCanvas.value) return
+  await nextTick()
+  QRCode.toCanvas(qrCanvas.value, url.value, { scale: 8 }, (error) => {
+    if (error) console.error('Failed to generate QR code:', error)
+  })
+}
+
 onMounted(async () => {
   try {
-  const response = await fetch('/auth/api/create-link', { method: 'POST' })
+    const response = await fetch('/auth/api/create-link', { method: 'POST' })
     const result = await response.json()
     if (result.detail) throw new Error(result.detail)
 
     url.value = result.url
-
-    // Generate QR code
-    const qrCodeElement = document.getElementById('qrCode')
-    if (qrCodeElement) {
-      QRCode.toCanvas(qrCodeElement, url.value, {scale: 8 }, error => {
-        if (error) console.error('Failed to generate QR code:', error)
-      })
-    }
+    await drawQr()
   } catch (error) {
     authStore.showMessage(`Failed to create device link: ${error.message}`, 'error')
     authStore.currentView = 'profile'
   }
 })
+
 </script>
+
+<style scoped>
+.view-content--narrow {
+  max-width: 540px;
+}
+
+.view-lede {
+  margin: 0;
+  color: var(--color-text-muted);
+}
+
+.qr-link {
+  text-decoration: none;
+  color: var(--color-text);
+}
+
+.button-row {
+  justify-content: flex-start;
+}
+
+@media (max-width: 720px) {
+  .button-row {
+    flex-direction: column;
+  }
+
+  .button-row button {
+    width: 100%;
+  }
+}
+</style>
diff --git a/frontend/src/components/LoginView.vue b/frontend/src/components/LoginView.vue
index 0c50804..fb990b7 100644
--- a/frontend/src/components/LoginView.vue
+++ b/frontend/src/components/LoginView.vue
@@ -1,34 +1,36 @@
 <template>
-  <div class="container">
-    <div class="view active">
-  <h1>🔐 {{ (authStore.settings?.rp_name || 'Passkey') + ' Login' }}</h1>
-      <form @submit.prevent="handleLogin">
-        <button
-          type="submit"
-          class="btn-primary"
-          :disabled="authStore.isLoading"
-        >
-          {{ authStore.isLoading ? 'Authenticating...' : 'Login with Your Device' }}
-        </button>
-      </form>
+  <section class="view-root view-login">
+    <div class="view-content view-content--narrow">
+      <header class="view-header">
+        <h1>🔐 {{ (authStore.settings?.rp_name || 'Passkey') + ' Login' }}</h1>
+        <p class="view-lede">Sign in securely with a device you trust.</p>
+      </header>
+      <section class="section-block">
+        <form class="section-body" @submit.prevent="handleLogin">
+          <button
+            type="submit"
+            class="btn-primary"
+            :disabled="authStore.isLoading"
+          >
+            {{ authStore.isLoading ? 'Authenticating...' : 'Login with Your Device' }}
+          </button>
+        </form>
+      </section>
     </div>
-  </div>
+  </section>
 </template>
 
 <script setup>
 import { useAuthStore } from '@/stores/auth'
-import { computed } from 'vue'
 
 const authStore = useAuthStore()
 
 const handleLogin = async () => {
   try {
-    console.log('Login button clicked')
     authStore.showMessage('Starting authentication...', 'info')
     await authStore.authenticate()
     authStore.showMessage('Authentication successful!', 'success', 2000)
     if (authStore.restrictedMode) {
-      // Restricted mode: reload so the app re-mounts and selectView() applies (will become permission denied)
       location.reload()
     } else if (location.pathname === '/auth/') {
       authStore.currentView = 'profile'
@@ -40,3 +42,24 @@ const handleLogin = async () => {
   }
 }
 </script>
+
+<style scoped>
+.view-content--narrow {
+  max-width: 420px;
+}
+
+.view-lede {
+  margin: 0;
+  color: var(--color-text-muted);
+}
+
+.view-login .section-body {
+  gap: 1.5rem;
+}
+
+@media (max-width: 720px) {
+  button {
+    width: 100%;
+  }
+}
+</style>
diff --git a/frontend/src/components/PermissionDeniedView.vue b/frontend/src/components/PermissionDeniedView.vue
index ba5764c..7ad5fcc 100644
--- a/frontend/src/components/PermissionDeniedView.vue
+++ b/frontend/src/components/PermissionDeniedView.vue
@@ -1,19 +1,27 @@
 <template>
-  <div class="container">
-    <div class="view active">
-      <h1>🚫 Forbidden</h1>
-      <div v-if="authStore.userInfo?.authenticated" class="user-header">
-        <span class="user-emoji" aria-hidden="true">{{ userEmoji }}</span>
-        <span class="user-name">{{ displayName }}</span>
-      </div>
-      <p>You lack the permissions required for this page.</p>
-      <div class="actions">
-        <button class="btn-secondary" @click="back">Back</button>
-        <button class="btn-primary" @click="goAuth">Account</button>
-        <button class="btn-danger" @click="logout">Logout</button>
-      </div>
+  <section class="view-root view-denied">
+    <div class="view-content view-content--narrow">
+      <header class="view-header">
+        <h1>🚫 Forbidden</h1>
+        <p class="view-lede">You don’t have the permissions required to view this page.</p>
+      </header>
+      <section class="section-block">
+        <div class="section-body">
+          <div v-if="authStore.userInfo?.authenticated" class="user-header">
+            <span class="user-emoji" aria-hidden="true">{{ userEmoji }}</span>
+            <span class="user-name">{{ displayName }}</span>
+          </div>
+          <p>You lack the permissions required for this page.</p>
+          <div class="button-row">
+            <button class="btn-secondary" @click="back">Back</button>
+            <button class="btn-primary" @click="goAuth">Account</button>
+            <button class="btn-danger" @click="logout">Logout</button>
+          </div>
+          <p class="hint">If you believe this is an error, contact your administrator.</p>
+        </div>
+      </section>
     </div>
-  </div>
+  </section>
 </template>
 <script setup>
 import { useAuthStore } from '@/stores/auth'
@@ -35,9 +43,55 @@ async function logout() {
 }
 </script>
 <style scoped>
-.user-header { display:flex; align-items:center; gap:.5rem; font-size:1.1rem; margin-bottom:.75rem; }
-.user-emoji { font-size:1.5rem; line-height:1; }
-.user-name { font-weight:600; }
-.actions { margin-top:1.5rem; display:flex; gap:.5rem; flex-wrap:nowrap; }
-.hint { font-size:.9rem; opacity:.85; }
+.view-content--narrow {
+  max-width: 540px;
+}
+
+.view-lede {
+  margin: 0;
+  color: var(--color-text-muted);
+}
+
+.user-header {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 1.1rem;
+}
+
+.user-emoji {
+  font-size: 1.5rem;
+  line-height: 1;
+}
+
+.user-name {
+  font-weight: 600;
+  color: var(--color-heading);
+}
+
+.button-row {
+  width: 100%;
+  justify-content: stretch;
+}
+
+.button-row button {
+  flex: 1 1 0;
+}
+
+.hint {
+  font-size: 0.9rem;
+  color: var(--color-text-muted);
+  margin: 0;
+}
+
+@media (max-width: 720px) {
+  .button-row {
+    flex-direction: column;
+  }
+
+  .button-row button {
+    width: 100%;
+    flex: 1 1 auto;
+  }
+}
 </style>
diff --git a/frontend/src/components/ProfileView.vue b/frontend/src/components/ProfileView.vue
index 5d656e3..6806902 100644
--- a/frontend/src/components/ProfileView.vue
+++ b/frontend/src/components/ProfileView.vue
@@ -1,91 +1,67 @@
 <template>
-  <div class="container">
-    <div class="view active">
-      <h1>👋 Welcome!</h1>
-      <Breadcrumbs :entries="[{ label: 'Auth', href: '/auth/' }, ...(isAdmin ? [{ label: 'Admin', href: '/auth/admin/' }] : [])]" />
-      <UserBasicInfo
-        v-if="authStore.userInfo?.user"
-        :name="authStore.userInfo.user.user_name"
-        :visits="authStore.userInfo.user.visits || 0"
-        :created-at="authStore.userInfo.user.created_at"
-        :last-seen="authStore.userInfo.user.last_seen"
-        :loading="authStore.isLoading"
-        update-endpoint="/auth/api/user/display-name"
-        @saved="authStore.loadUserInfo()"
-      />
+  <section class="view-root" data-view="profile">
+    <div class="view-content">
+      <header class="view-header">
+        <h1>👋 Welcome!</h1>
+        <Breadcrumbs :entries="[{ label: 'Auth', href: '/auth/' }, ...(isAdmin ? [{ label: 'Admin', href: '/auth/admin/' }] : [])]" />
+        <p class="view-lede">Manage your account details and passkeys.</p>
+      </header>
 
-      <h2>Your Passkeys</h2>
-      <div class="credential-list">
-        <div v-if="authStore.isLoading">
-          <p>Loading credentials...</p>
+      <section class="section-block">
+        <UserBasicInfo
+          v-if="authStore.userInfo?.user"
+          :name="authStore.userInfo.user.user_name"
+          :visits="authStore.userInfo.user.visits || 0"
+          :created-at="authStore.userInfo.user.created_at"
+          :last-seen="authStore.userInfo.user.last_seen"
+          :loading="authStore.isLoading"
+          update-endpoint="/auth/api/user/display-name"
+          @saved="authStore.loadUserInfo()"
+        />
+      </section>
+
+      <section class="section-block">
+        <div class="section-header">
+          <h2>Your Passkeys</h2>
+          <p class="section-description">Keep at least one trusted passkey so you can always sign in.</p>
         </div>
-        <div v-else-if="authStore.userInfo?.credentials?.length === 0">
-          <p>No passkeys found.</p>
-        </div>
-        <div v-else>
-          <div
-            v-for="credential in authStore.userInfo?.credentials || []"
-            :key="credential.credential_uuid"
-            :class="['credential-item', { 'current-session': credential.is_current_session }]"
-          >
-            <div class="credential-header">
-              <div class="credential-icon">
-                <img
-                  v-if="getCredentialAuthIcon(credential)"
-                  :src="getCredentialAuthIcon(credential)"
-                  :alt="getCredentialAuthName(credential)"
-                  class="auth-icon"
-                  width="32"
-                  height="32"
-                >
-                <span v-else class="auth-emoji">🔑</span>
-              </div>
-              <div class="credential-info">
-                <h4>{{ getCredentialAuthName(credential) }}</h4>
-              </div>
-              <div class="credential-dates">
-                <span class="date-label">Created:</span>
-                <span class="date-value">{{ formatDate(credential.created_at) }}</span>
-                <span class="date-label">Last used:</span>
-                <span class="date-value">{{ formatDate(credential.last_used) }}</span>
-              </div>
-              <div class="credential-actions">
-                <button
-                  @click="deleteCredential(credential.credential_uuid)"
-                  class="btn-delete-credential"
-                  :disabled="credential.is_current_session"
-                  :title="credential.is_current_session ? 'Cannot delete current session credential' : ''"
-                >
-                  🗑️
-                </button>
-              </div>
-            </div>
+        <div class="section-body">
+          <CredentialList
+            :credentials="authStore.userInfo?.credentials || []"
+            :aaguid-info="authStore.userInfo?.aaguid_info || {}"
+            :loading="authStore.isLoading"
+            allow-delete
+            @delete="handleDelete"
+          />
+          <div class="button-row">
+            <button @click="addNewCredential" class="btn-primary">
+              Add New Passkey
+            </button>
+            <button @click="authStore.currentView = 'device-link'" class="btn-secondary">
+              Add Another Device
+            </button>
           </div>
         </div>
-      </div>
+      </section>
 
-      <div class="button-group" style="display: flex; gap: 10px;">
-        <button @click="addNewCredential" class="btn-primary">
-          Add New Passkey
-        </button>
-        <button @click="authStore.currentView = 'device-link'" class="btn-primary">
-          Add Another Device
-        </button>
-      </div>
-      <button @click="logout" class="btn-danger" style="width: 100%;">
-        Logout
-      </button>
+      <section class="section-block">
+        <div class="button-row">
+          <button @click="logout" class="btn-danger logout-button">
+            Logout
+          </button>
+        </div>
+      </section>
     </div>
-  </div>
+  </section>
 </template>
 
 <script setup>
 import { ref, onMounted, onUnmounted, computed } from 'vue'
 import Breadcrumbs from '@/components/Breadcrumbs.vue'
-import { useAuthStore } from '@/stores/auth'
-import { formatDate } from '@/utils/helpers'
-import passkey from '@/utils/passkey'
+import CredentialList from '@/components/CredentialList.vue'
 import UserBasicInfo from '@/components/UserBasicInfo.vue'
+import { useAuthStore } from '@/stores/auth'
+import passkey from '@/utils/passkey'
 
 const authStore = useAuthStore()
 const updateInterval = ref(null)
@@ -105,20 +81,6 @@ onUnmounted(() => {
   }
 })
 
-const getCredentialAuthName = (credential) => {
-  const authInfo = authStore.userInfo?.aaguid_info?.[credential.aaguid]
-  return authInfo ? authInfo.name : 'Unknown Authenticator'
-}
-
-const getCredentialAuthIcon = (credential) => {
-  const authInfo = authStore.userInfo?.aaguid_info?.[credential.aaguid]
-  if (!authInfo) return null
-
-  const isDarkMode = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches
-  const iconKey = isDarkMode ? 'icon_dark' : 'icon_light'
-  return authInfo[iconKey] || null
-}
-
 const addNewCredential = async () => {
   try {
     authStore.isLoading = true
@@ -134,7 +96,9 @@ const addNewCredential = async () => {
   }
 }
 
-const deleteCredential = async (credentialId) => {
+const handleDelete = async (credential) => {
+  const credentialId = credential?.credential_uuid
+  if (!credentialId) return
   if (!confirm('Are you sure you want to delete this passkey?')) return
   try {
     await authStore.deleteCredential(credentialId)
@@ -152,19 +116,31 @@ const isAdmin = computed(() => !!(authStore.userInfo?.is_global_admin || authSto
 </script>
 
 <style scoped>
-/* Removed inline user info styles; now provided by UserBasicInfo component */
-.admin-link {
-  font-size: 0.6em;
-  margin-left: 0.75rem;
-  text-decoration: none;
-  background: var(--color-background-soft, #eee);
-  padding: 0.2em 0.6em;
-  border-radius: 999px;
-  border: 1px solid var(--color-border, #ccc);
-  vertical-align: middle;
-  line-height: 1.2;
+.view-lede {
+  margin: 0;
+  color: var(--color-text-muted);
+  font-size: 1rem;
 }
-.admin-link:hover {
-  background: var(--color-background-mute, #ddd);
+
+.section-header {
+  display: flex;
+  flex-direction: column;
+  gap: 0.4rem;
+}
+
+.section-description {
+  margin: 0;
+  color: var(--color-text-muted);
+}
+
+.logout-button {
+  align-self: flex-start;
+}
+
+@media (max-width: 720px) {
+  .logout-button {
+    width: 100%;
+  }
 }
 </style>
+
diff --git a/frontend/src/components/ResetView.vue b/frontend/src/components/ResetView.vue
index 4da1bcb..6c129b5 100644
--- a/frontend/src/components/ResetView.vue
+++ b/frontend/src/components/ResetView.vue
@@ -1,28 +1,37 @@
 <template>
-  <div class="container">
-    <div class="view active">
-      <h1>🔑 Add New Credential</h1>
-      <label class="name-edit">
-        <span>👤 Name:</span>
-        <input
-          type="text"
-          v-model="user_name"
-          :placeholder="authStore.userInfo?.user?.user_name || 'Your name'"
-          :disabled="authStore.isLoading"
-          maxlength="64"
-          @keyup.enter="register"
-        />
-      </label>
-      <p>Proceed to complete {{authStore.userInfo?.session_type}}:</p>
-      <button
-        class="btn-primary"
-        :disabled="authStore.isLoading"
-        @click="register"
-      >
-        {{ authStore.isLoading ? 'Registering...' : 'Register Passkey' }}
-      </button>
+  <section class="view-root view-reset">
+    <div class="view-content view-content--narrow">
+      <header class="view-header">
+        <h1>🔑 Add New Credential</h1>
+        <p class="view-lede">
+          Finish setting up your passkey to complete {{ authStore.userInfo?.session_type }}.
+        </p>
+      </header>
+      <section class="section-block">
+        <div class="section-body">
+          <label class="name-edit">
+            <span>👤 Name</span>
+            <input
+              type="text"
+              v-model="user_name"
+              :placeholder="authStore.userInfo?.user?.user_name || 'Your name'"
+              :disabled="authStore.isLoading"
+              maxlength="64"
+              @keyup.enter="register"
+            />
+          </label>
+          <p>Proceed to complete {{ authStore.userInfo?.session_type }}:</p>
+          <button
+            class="btn-primary"
+            :disabled="authStore.isLoading"
+            @click="register"
+          >
+            {{ authStore.isLoading ? 'Registering…' : 'Register Passkey' }}
+          </button>
+        </div>
+      </section>
     </div>
-  </div>
+  </section>
 </template>
 
 <script setup>
@@ -31,21 +40,20 @@ import passkey from '@/utils/passkey'
 import { ref } from 'vue'
 
 const authStore = useAuthStore()
-const user_name = ref('') // intentionally blank; original shown via placeholder
+const user_name = ref('')
 
 async function register() {
   authStore.isLoading = true
   authStore.showMessage('Starting registration...', 'info')
 
   try {
-  const result = await passkey.register(authStore.resetToken, user_name.value)
-  console.log("Result", result)
-  await authStore.setSessionCookie(result.session_token)
-  // resetToken cleared by setSessionCookie; ensure again
-  authStore.resetToken = null
-  authStore.showMessage('Passkey registered successfully!', 'success', 2000)
-  await authStore.loadUserInfo()
-  authStore.selectView()
+    const result = await passkey.register(authStore.resetToken, user_name.value)
+    console.log('Result', result)
+    await authStore.setSessionCookie(result.session_token)
+    authStore.resetToken = null
+    authStore.showMessage('Passkey registered successfully!', 'success', 2000)
+    await authStore.loadUserInfo()
+    authStore.selectView()
   } catch (error) {
     authStore.showMessage(`Registration failed: ${error.message}`, 'error')
   } finally {
@@ -53,3 +61,36 @@ async function register() {
   }
 }
 </script>
+
+<style scoped>
+.view-content--narrow {
+  max-width: 480px;
+}
+
+.view-lede {
+  margin: 0;
+  color: var(--color-text-muted);
+}
+
+.name-edit {
+  display: flex;
+  flex-direction: column;
+  gap: 0.45rem;
+  font-weight: 600;
+}
+
+.name-edit span {
+  color: var(--color-text-muted);
+  font-size: 0.9rem;
+}
+
+.section-body {
+  gap: 1.5rem;
+}
+
+@media (max-width: 720px) {
+  button {
+    width: 100%;
+  }
+}
+</style>
diff --git a/frontend/src/components/UserBasicInfo.vue b/frontend/src/components/UserBasicInfo.vue
index efd3cea..1d9b56a 100644
--- a/frontend/src/components/UserBasicInfo.vue
+++ b/frontend/src/components/UserBasicInfo.vue
@@ -83,19 +83,19 @@ watch(() => props.name, () => { if (!props.name) editingName.value = false })
 .user-info { display: grid; grid-template-columns: auto 1fr; gap: 10px; }
 .user-info h3 { grid-column: span 2; }
 .org-role-sub { grid-column: span 2; display:flex; flex-direction:column; margin: -0.15rem 0 0.25rem; }
-.org-line { font-size: .7rem; font-weight:600; line-height:1.1; }
-.role-line { font-size:.6rem; color:#555; line-height:1.1; }
+.org-line { font-size: .7rem; font-weight:600; line-height:1.1; color: var(--color-text-muted); text-transform: uppercase; letter-spacing: 0.05em; }
+.role-line { font-size:.65rem; color: var(--color-text-muted); line-height:1.1; }
 .user-info span { text-align: left; }
 .user-name-heading { display: flex; align-items: center; gap: 0.4rem; flex-wrap: wrap; margin: 0 0 0.25rem 0; }
 .user-name-row { display: inline-flex; align-items: center; gap: 0.35rem; max-width: 100%; }
 .user-name-row.editing { flex: 1 1 auto; }
 .icon { flex: 0 0 auto; }
 .display-name { font-weight: 600; font-size: 1.05em; line-height: 1.2; max-width: 14ch; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.name-input { width: auto; flex: 1 1 140px; min-width: 120px; padding: 6px 8px; font-size: 0.9em; border: 1px solid #a9c5d6; border-radius: 6px; }
+.name-input { width: auto; flex: 1 1 140px; min-width: 120px; padding: 6px 8px; font-size: 0.9em; border: 1px solid var(--color-border-strong); border-radius: 6px; background: var(--color-surface); color: var(--color-text); }
 .user-name-heading .name-input { width: auto; }
-.name-input:focus { outline: 2px solid #667eea55; border-color: #667eea; }
-.mini-btn { width: auto; padding: 4px 6px; margin: 0; font-size: 0.75em; line-height: 1; background: #eef5fa; border: 1px solid #b7d2e3; border-radius: 6px; cursor: pointer; transition: background 0.2s, transform 0.15s; }
-.mini-btn:hover:not(:disabled) { background: #dcecf6; }
+.name-input:focus { outline: none; border-color: var(--color-accent); box-shadow: var(--focus-ring); }
+.mini-btn { width: auto; padding: 4px 6px; margin: 0; font-size: 0.75em; line-height: 1; background: var(--color-surface-muted); border: 1px solid var(--color-border-strong); border-radius: 6px; cursor: pointer; transition: background 0.2s, transform 0.15s, color 0.2s ease; color: var(--color-text); }
+.mini-btn:hover:not(:disabled) { background: var(--color-accent-soft); color: var(--color-accent); }
 .mini-btn:active:not(:disabled) { transform: translateY(1px); }
 .mini-btn:disabled { opacity: 0.5; cursor: not-allowed; }
 @media (max-width: 480px) { .user-name-heading { flex-direction: column; align-items: flex-start; } .user-name-row.editing { width: 100%; } .display-name { max-width: 100%; } }