refactor(ui): unify notice + toast styling, polish inline notices

Notices used to be styled only inside the toast stack — every inline
.notice on the login page, auth pages and admin edit screens fell back
to browser defaults and looked unstyled. The Stripe-style toast redesign
(icon pill + neutral text + soft card surface) now lives on the base
.notice rule, and .app-toast-stack adds the slide-in animation, soft
shadow, dismiss button and progress bar on top.

Inline notices auto-render the variant icon via a ::before pseudo using
the Bootstrap Icons codepoints, so all 30+ existing call sites get the
new look without markup changes. Toasts opt out of ::before via
:has(> .notice-icon) and keep their explicit icon span.

The previous app-flash.phtml partial is folded into app-toast-stack.phtml
(both create the same .app-toast-stack container — having both mounted
made two stacks fight for the same fixed corner). default/login/page
templates now mount the unified partial; the architecture contract is
updated to match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

templates/default.phtml

@@ -337,7 +337,6 @@ $componentPageConfig['moduleRuntimeComponents'] = $moduleRuntimeComponents;
 
   <script src="<?php e(assetVersion('vendor/fslightbox/fslightbox.js')); ?>"></script>
   <?php require __DIR__ . '/partials/app-confirm-dialog.phtml'; ?>
-  <?php require __DIR__ . '/partials/app-toast-stack.phtml'; ?>
   <?php if ($isLoggedIn): ?>
   <?php require __DIR__ . '/partials/app-search-dialog.phtml'; ?>
   <?php require __DIR__ . '/partials/app-session-warning-dialog.phtml'; ?>
@@ -360,7 +359,7 @@ $componentPageConfig['moduleRuntimeComponents'] = $moduleRuntimeComponents;
     ?>
   <?php endforeach; ?>
   <script type="application/json" id="page-config-app-components"><?php gridJsonForJs($componentPageConfig); ?></script>
-  <?php require __DIR__ . '/partials/app-flash.phtml'; ?>
+  <?php require __DIR__ . '/partials/app-toast-stack.phtml'; ?>
   <script type="module" src="<?php e(assetVersion('js/app-init.js')); ?>"></script>
 </body>
 

templates/login.phtml

@@ -65,7 +65,7 @@ $loginComponentConfig = [
   <?php require __DIR__ . '/partials/app-footer.phtml'; ?>
 
   <script type="application/json" id="page-config-login-components"><?php gridJsonForJs($loginComponentConfig); ?></script>
-  <?php require __DIR__ . '/partials/app-flash.phtml'; ?>
+  <?php require __DIR__ . '/partials/app-toast-stack.phtml'; ?>
   <script type="module" src="<?php e(assetVersion('js/app-login-init.js')); ?>"></script>
 </body>
 

templates/page.phtml

@@ -53,7 +53,7 @@ if ($bufferTitle !== '') {
     </main>
     <?php require __DIR__ . '/partials/app-footer.phtml'; ?>
   </div>
-  <?php require __DIR__ . '/partials/app-flash.phtml'; ?>
+  <?php require __DIR__ . '/partials/app-toast-stack.phtml'; ?>
 </body>
 
 </html>

templates/partials/app-flash.phtml

@@ -1,34 +0,0 @@
-<?php
-
-use MintyPHP\Http\Request;
-use MintyPHP\Session;
-
-$messages = is_array($appFlashMessages ?? null) ? $appFlashMessages : [];
-if (!$messages) {
-  return;
-}
-
-$returnTarget = Request::pathWithQuery();
-$timeouts = [
-  'success' => 5000,
-  'info' => 6000,
-  'warning' => 7000,
-  'error' => 0,
-];
-
-?>
-<div class="app-toast-stack" data-app-component="flash-auto-dismiss" aria-live="polite">
-  <?php foreach ($messages as $message) : ?>
-    <?php $type = $message['type'] ?? 'info'; ?>
-    <?php $timeout = $timeouts[$type] ?? 5000; ?>
-    <?php $isAssertive = $type === 'error' || $type === 'warning'; ?>
-    <div class="notice" data-variant="<?php e($type); ?>" data-flash-timeout="<?php e($timeout); ?>" role="<?php echo $isAssertive ? 'alert' : 'status'; // raw-html-ok: hardcoded ARIA role values ?>">
-      <span><?php e(t($message['message'] ?? '')); ?></span>
-      <form method="post" action="flash/dismiss/<?php e($message['id'] ?? ''); ?>">
-        <input type="hidden" name="return" value="<?php e($returnTarget); ?>">
-        <button type="submit" aria-label="<?php e(t('Dismiss')); ?>"><i class="bi bi-x-lg"></i></button>
-        <?php Session::getCsrfInput(); ?>
-      </form>
-    </div>
-  <?php endforeach; ?>
-</div>

templates/partials/app-toast-stack.phtml

@@ -1,12 +1,55 @@
 <?php
 
 /**
- * Async toast stack — global container for JS-triggered notifications.
+ * Async toast stack — global container for both server-rendered flash
+ * messages and JS-triggered notifications via showAsyncFlash().
  *
- * Mounted once at the bottom of the shell so any page can fire toasts via
- * showAsyncFlash() without the JS having to lazy-create the container.
- * Empty by default; toasts are appended/removed by web/js/components/app-async-flash.js.
+ * Mounted once at the bottom of the shell. Empty unless flash messages
+ * are pending, in which case they render inline and the auto-dismiss
+ * component (data-app-component="flash-auto-dismiss") fades them out.
  */
 
+use MintyPHP\Http\Request;
+use MintyPHP\Session;
+
+$messages = is_array($appFlashMessages ?? null) ? $appFlashMessages : [];
+$timeouts = [
+    'success' => 5000,
+    'info' => 6000,
+    'warning' => 7000,
+    'error' => 0,
+];
+$variantIcons = [
+    'success' => 'bi-check-circle-fill',
+    'error' => 'bi-x-octagon-fill',
+    'warning' => 'bi-exclamation-triangle-fill',
+    'info' => 'bi-info-circle-fill',
+];
+$returnTarget = Request::pathWithQuery();
+
 ?>
-<div class="app-toast-stack" aria-live="polite"></div>
+<div class="app-toast-stack" data-app-component="flash-auto-dismiss" aria-live="polite">
+  <?php foreach ($messages as $message): ?>
+    <?php
+    $type = (string) ($message['type'] ?? 'info');
+    $timeout = $timeouts[$type] ?? 5000;
+    $isAssertive = $type === 'error' || $type === 'warning';
+    $iconClass = $variantIcons[$type] ?? $variantIcons['info'];
+    ?>
+    <div class="notice" data-variant="<?php e($type); ?>"
+      data-flash-timeout="<?php e((string) $timeout); ?>"
+      role="<?php echo $isAssertive ? 'alert' : 'status'; // raw-html-ok: hardcoded ARIA role values ?>">
+      <span class="notice-icon" aria-hidden="true">
+        <i class="bi <?php e($iconClass); ?>"></i>
+      </span>
+      <span class="notice-content"><?php e(t($message['message'] ?? '')); ?></span>
+      <form method="post" action="flash/dismiss/<?php e((string) ($message['id'] ?? '')); ?>" class="notice-dismiss-form">
+        <input type="hidden" name="return" value="<?php e($returnTarget); ?>">
+        <button type="submit" class="notice-dismiss" aria-label="<?php e(t('Dismiss')); ?>">
+          <i class="bi bi-x-lg"></i>
+        </button>
+        <?php Session::getCsrfInput(); ?>
+      </form>
+    </div>
+  <?php endforeach; ?>
+</div>