Sanctum's statefulApi() runs same-origin API requests through the
web middleware stack, which enforces CSRF. Send X-CSRF-TOKEN from the
meta tag and credentials: same-origin so cookies travel with the
request.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Modern minimalist split-layout login (left brand panel, right form) at
/login. Sign-in posts to /api/v1/auth/login, stores the bearer token in
localStorage, redirects to /dashboard. Demo-account expander auto-fills
the form. Placeholder dashboard fetches /me, shows top nav + stat cards
(values pending), and supports sign-out.
AdminUserSeeder now seeds 4 demo admins (admin/ops/audit/demo @verde.local,
all "password"). Tailwind config gets a Verde green palette + Inter font;
component classes for buttons + form inputs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
