fix: manage panel stuck on 'Loading…' and visible to everyone

Three bugs, all in the previous commit.

1. `.grid2{display:grid}` outranks the UA stylesheet's [hidden]{display:none} and the sheet had no [hidden] rule, so panel.hidden=true never hid anything: the panel rendered for every visitor, signed in or not. Added [hidden]{display:none!important}.

2. loadManage() returned early on a non-OK response and left the 'Loading…' placeholder on screen permanently. It now hides the panel and writes a real message.

3. loadManage() ran only at page load, so signing in afterwards never populated it. setUser() now re-runs it when the session becomes the owner, and clears it on sign-out.

index.html

@@ -145,6 +145,10 @@ table.board tbody tr:hover td:nth-child(1),table.board tbody tr:hover td:nth-chi
 .note b{color:var(--ink-soft)}
 
 /* queue + submit */
+/* Author `display` rules (e.g. .grid2 below) outrank the UA stylesheet's
+   [hidden]{display:none}, so an element with class + hidden stays visible.
+   This restores the attribute as the last word. */
+[hidden]{display:none!important}
 .grid2{display:grid;grid-template-columns:1fr 1fr;gap:18px;margin-top:26px}
 .grid2.one{grid-template-columns:1fr}
 .panel{background:var(--surface);border:1px solid var(--border);border-radius:16px;padding:20px 22px}
@@ -705,6 +709,8 @@ function setUser(u,isOwner){
     for(const id of ['visField','maxField','subtaskField']){
       const el=document.getElementById(id); if(el)el.hidden=!isOwner;
     }
+    // Signing in after page load must reveal the panel without a hard reload.
+    if(isOwner&&typeof loadManage==='function')loadManage();
     if(!isOwner){
       const vs=document.getElementById('f-vis'); if(vs)vs.value='public';
       const mx=document.getElementById('f-max'); if(mx)mx.value='';
@@ -716,6 +722,7 @@ function setUser(u,isOwner){
     for(const id of ['sourceField','visField','maxField','subtaskField']){
       const el0=document.getElementById(id); if(el0)el0.hidden=true;
     }
+    const mp=document.getElementById('managePanel'); if(mp)mp.hidden=true;
     signinView.hidden=false; submitForm.hidden=true;
   }
 }
@@ -787,15 +794,22 @@ function mmsg(t,kind){const e=document.getElementById('manageMsg');
 
 async function loadManage(){
   const panel=document.getElementById('managePanel');
+  const list=document.getElementById('manageList');
   try{
     const r=await fetch('/api/manage',{credentials:'same-origin'});
-    if(!r.ok){panel.hidden=true;return;}          // not the owner
+    if(!r.ok){
+      // 401/403 = not signed in, or not the maintainer. Hide rather than explain:
+      // this panel simply does not exist for anyone else.
+      panel.hidden=true;
+      list.innerHTML='<div class="mrow" style="color:var(--ink-mute)">Sign in as the maintainer to manage models.</div>';
+      return;
+    }
     const d=await r.json();
     panel.hidden=false;
-    document.getElementById('manageCount').textContent=`${d.models.length} submitted`;
-    const list=document.getElementById('manageList');
-    if(!d.models.length){list.innerHTML='<div class="mrow" style="color:var(--ink-mute)">Nothing submitted yet.</div>';return;}
-    list.innerHTML=d.models.map(m=>{
+    const models=Array.isArray(d.models)?d.models:[];
+    document.getElementById('manageCount').textContent=`${models.length} submitted`;
+    if(!models.length){list.innerHTML='<div class="mrow" style="color:var(--ink-mute)">Nothing submitted yet.</div>';return;}
+    list.innerHTML=models.map(m=>{
       const s=(m.status||'').toUpperCase();
       const cls=s==='RUNNING'?'b-running':(s==='FAILED'||s==='REJECTED')?'b-failed':'b-pending';
       const tags=[`<span class="badge ${cls}">${s}</span>`];
@@ -808,7 +822,10 @@ async function loadManage(){
         <button class="mbtn danger" data-act="delete">Delete</button>
       </div>`;}).join('');
     list.querySelectorAll('button[data-act]').forEach(b=>b.onclick=()=>manageAct(b));
-  }catch(e){panel.hidden=true;}
+  }catch(e){
+    panel.hidden=true;
+    list.innerHTML=`<div class="mrow" style="color:var(--ink-mute)">Could not load (${esc(String(e))}).</div>`;
+  }
 }
 
 async function manageAct(btn){