Fix admin bypass: defer closed overlay until after Google auth

The closed overlay (z-index 2000) was blocking Google sign-in from
firing, so the admin check never ran. Now the overlay is deferred
when Google auth is configured — checkAdmin() shows or bypasses
it after auth completes.

src/server/generate_form.py

@@ -136,6 +136,8 @@ function signOut() {
   isAdmin = false;
   var ab = document.getElementById('admin-btn');
   if (ab) ab.style.display = 'none';
+  var banner = document.getElementById('admin-closed-banner');
+  if (banner) banner.remove();
   googleCredential = null;
   googleUser = null;
   google.accounts.id.disableAutoSelect();
@@ -143,6 +145,7 @@ function signOut() {
   document.getElementById('app').style.display = 'none';
   var footer = document.getElementById('sticky-footer');
   if (footer) footer.style.display = 'none';
+  if (formClosed) showClosedOverlay();
 }
 """
     else:
@@ -454,6 +457,7 @@ const BULK_DISCOUNT = {bulk_discount};
 const COMPANY_SUBSIDY = {company_subsidy};
 const quantities = {{}};
 let formClosed = false;
+let formStatusData = null;
 let isAdmin = false;
 let adminWeeks = [];
 {
@@ -622,6 +626,14 @@ function updateTotal() {{
 }
 '''
     }
+function showClosedOverlay() {{
+  document.getElementById('closed-overlay').style.display = 'flex';
+  document.querySelectorAll('.qty-control button').forEach(b => b.disabled = true);
+  var submitBtn = document.getElementById('submit-btn');
+  if (submitBtn) submitBtn.disabled = true;
+  if (formStatusData) startCountdown(formStatusData);
+}}
+
 function adminBypassClosed() {{
   document.getElementById('closed-overlay').style.display = 'none';
   document.querySelectorAll('.qty-control button').forEach(b => b.disabled = false);
@@ -654,9 +666,13 @@ function checkAdmin() {{
         var ab = document.getElementById('admin-btn');
         if (ab) ab.style.display = 'inline-block';
         if (formClosed) adminBypassClosed();
+      }} else if (formClosed) {{
+        showClosedOverlay();
       }}
     }})
-    .catch(() => {{}});
+    .catch(() => {{
+      if (formClosed) showClosedOverlay();
+    }});
 }}
 
 function showAdmin() {{
@@ -862,14 +878,14 @@ async function checkFormStatus() {{
     const data = await res.json();
     if (data.status === 'closed') {{
       formClosed = true;
+      formStatusData = data;
       if (isAdmin) {{
         adminBypassClosed();
+      }} else if (typeof GOOGLE_CLIENT_ID !== 'undefined' && GOOGLE_CLIENT_ID) {{
+        // Defer overlay until after Google auth resolves — checkAdmin() will
+        // show the overlay for non-admins or bypass it for admins.
       }} else {{
-        document.getElementById('closed-overlay').style.display = 'flex';
+        showClosedOverlay();
-        document.querySelectorAll('.qty-control button').forEach(b => b.disabled = true);
-        const submitBtn = document.getElementById('submit-btn');
-        if (submitBtn) submitBtn.disabled = true;
-        startCountdown(data);
       }}
     }}
   }} catch (e) {{}}