Fix Live Activity lock screen rendering and polish multi-account auth.

Flatten widget layouts and use system colors so banner and expanded regions render on vibrant lock screens; migrate auth sessions per account to prevent double sign-in; scope app lock PIN to accounts; default clock description to "Clock In"; add architecture docs and deferred form validation on auth screens.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/server-mode.ts

@@ -0,0 +1,35 @@
+import { DEFAULT_API_URL } from "@/lib/config";
+import { normalizeInstanceUrl } from "@/lib/instance-url";
+
+export type ServerMode = "official" | "self-hosted";
+
+export const SERVER_MODE_OPTIONS: { value: ServerMode; label: string }[] = [
+  { value: "official", label: "Official" },
+  { value: "self-hosted", label: "Self-hosted" },
+];
+
+export function isOfficialServerUrl(url: string): boolean {
+  return url.replace(/\/$/, "") === DEFAULT_API_URL.replace(/\/$/, "");
+}
+
+export function resolveServerMode(url: string): ServerMode {
+  return isOfficialServerUrl(url) ? "official" : "self-hosted";
+}
+
+export function formatServerHost(url: string): string {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  }
+}
+
+export function isServerConfigValid(mode: ServerMode, selfHostedUrl: string): boolean {
+  if (mode === "official") return true;
+  return normalizeInstanceUrl(selfHostedUrl) !== null;
+}
+
+export function resolveServerUrl(mode: ServerMode, selfHostedUrl: string): string | null {
+  if (mode === "official") return DEFAULT_API_URL;
+  return normalizeInstanceUrl(selfHostedUrl);
+}