fix(docs): stop quick-reference boxes overlapping and double-numbering

src/components/docs/DocsQuickReference.astro

@@ -8,9 +8,9 @@ const { label, items } = Astro.props;
 ---
 
 <div class="rounded-xl border border-border bg-surface-tertiary p-5">
-  <h3 class="mb-4 font-primary text-[11px] font-semibold tracking-[0.8px] text-primary">
+  <div class="mb-4 font-primary text-[11px] font-semibold tracking-[0.8px] text-primary">
     {label}
-  </h3>
+  </div>
   <div class="space-y-2 font-mono text-[13px] text-foreground">
     {items.map((item, idx) => (
       <div>{String(idx + 1).padStart(2, "0")} &nbsp; {item}</div>

src/content/docs/agent-game-protocols.mdx

@@ -122,9 +122,9 @@ Module capabilities are the contract between the operator and the agent. To add
 <DocsQuickReference
   label="AGENT CONTRACT"
   items={[
-    "01  cd agent && go test ./...",
-    "02  agent/openapi.yaml   # contract source",
-    "03  GET /healthz · GET /metrics · WSS /console",
+    "cd agent && go test ./...",
+    "agent/openapi.yaml   # contract source",
+    "GET /healthz · GET /metrics · WSS /console",
   ]}
 />
 

src/content/docs/air-gapped-installation.mdx

@@ -350,9 +350,9 @@ If possible, disconnect the cluster from the public internet (or block all egres
 <DocsQuickReference
   label="OFFLINE ACCEPTANCE"
   items={[
-    "01  Mirror chart + images + modules + signatures + SBOMs by digest",
-    "02  Render offline; reject public hosts and mutable tags",
-    "03  Test install, server, backup, upgrade, rollback with egress blocked",
-    "04  Set api.telemetry.enabled=false (or an internal endpoint) so no report leaves the cluster",
+    "Mirror chart + images + modules + signatures + SBOMs by digest",
+    "Render offline; reject public hosts and mutable tags",
+    "Test install, server, backup, upgrade, rollback with egress blocked",
+    "Set api.telemetry.enabled=false (or an internal endpoint) so no report leaves the cluster",
   ]}
 />

src/content/docs/api-realtime-development.mdx

@@ -259,9 +259,9 @@ Run the test via `make test-integration`.
 <DocsQuickReference
   label="API CHANGE"
   items={[
-    "01  cd api && go test ./...",
-    "02  make test-integration",
-    "03  rg 'Mount|/ws/|/events' api/cmd api/internal",
+    "cd api && go test ./...",
+    "make test-integration",
+    "rg 'Mount|/ws/|/events' api/cmd api/internal",
   ]}
 />
 

src/content/docs/audit-observability-admin.mdx

@@ -57,9 +57,9 @@ Each sink is tested independently via the Dashboard form before saving. The API
 <DocsQuickReference
   label="INCIDENT EVIDENCE"
   items={[
-    "01  Record cluster, namespace, resource UID, time range, and actor when exporting audit records",
-    "02  Export audit records, Kubernetes events, API/operator logs, and backup status (if affected)",
-    "03  Test notification delivery and preserve version/build information for correlation",
+    "Record cluster, namespace, resource UID, time range, and actor when exporting audit records",
+    "Export audit records, Kubernetes events, API/operator logs, and backup status (if affected)",
+    "Test notification delivery and preserve version/build information for correlation",
   ]}
 />
 

src/content/docs/backup-destinations.mdx

@@ -190,9 +190,9 @@ kubectl get backupschedules -A -o jsonpath='{range .items[*]}{.metadata.name}{"\
 <DocsQuickReference
   label="DESTINATION ACCEPTANCE"
   items={[
-    "01  Reachable repository + labelled Secret in configured namespace",
-    "02  Add stable destination name + Secret/key reference",
-    "03  Manual backup + disposable restore before schedules depend on it",
+    "Reachable repository + labelled Secret in configured namespace",
+    "Add stable destination name + Secret/key reference",
+    "Manual backup + disposable restore before schedules depend on it",
   ]}
 />
 

src/content/docs/backup-repository-operations.mdx

@@ -169,9 +169,9 @@ This separation ensures that a compromised workload credential does not also com
 <DocsQuickReference
   label="REPOSITORY ACCEPTANCE"
   items={[
-    "01  Supported backend + least-privilege Secret + TLS/CA + key",
-    "02  Alert on failed/missed backup, locks, checks, prune, growth, expiry",
-    "03  Accept only after scheduled isolated restore meets RPO/RTO",
+    "Supported backend + least-privilege Secret + TLS/CA + key",
+    "Alert on failed/missed backup, locks, checks, prune, growth, expiry",
+    "Accept only after scheduled isolated restore meets RPO/RTO",
   ]}
 />
 

src/content/docs/backups-recovery.mdx

@@ -111,9 +111,9 @@ Restore into a new server for verification, or overwrite only after stopping wri
 <DocsQuickReference
   label="RESTORE CHECKLIST"
   items={[
-    "01  Verify source backup, checksum, destination, and available storage",
-    "02  Prefer a new server for validation; stop writes before overwrite",
-    "03  Start, inspect events and logs, then test world and player data",
+    "Verify source backup, checksum, destination, and available storage",
+    "Prefer a new server for validation; stop writes before overwrite",
+    "Start, inspect events and logs, then test world and player data",
   ]}
 />
 

src/content/docs/ci-releases-signing.mdx

@@ -73,9 +73,9 @@ A `v` tag builds and signs images, packages the OCI chart, creates release notes
 <DocsQuickReference
   label="RELEASE PATH"
   items={[
-    "01  go build ./... && npx tsc --noEmit  # Lightweight local compile checks",
-    "02  git tag vX.Y.Z && git push origin vX.Y.Z",
-    "03  cosign verify --key cosign.pub ghcr.io/gameplanepanel/gameplane/<image>@<digest>",
+    "go build ./... && npx tsc --noEmit  # Lightweight local compile checks",
+    "git tag vX.Y.Z && git push origin vX.Y.Z",
+    "cosign verify --key cosign.pub ghcr.io/gameplanepanel/gameplane/<image>@<digest>",
   ]}
 />
 

src/content/docs/cluster-nodes-kubeconfig.mdx

@@ -151,9 +151,9 @@ Mint a short-lived token for the intended cluster, run the generated join proced
 <DocsQuickReference
   label="CLUSTER OPS"
   items={[
-    "01  Read version, Ready, roles, pressure, pods, CPU, memory",
-    "02  Kubeconfig requires clusterOps.enabled; handle as admin secret",
-    "03  Join token → Ready + labels/taints/capacity + test workload",
+    "Read version, Ready, roles, pressure, pods, CPU, memory",
+    "Kubeconfig requires clusterOps.enabled; handle as admin secret",
+    "Join token → Ready + labels/taints/capacity + test workload",
   ]}
 />
 

src/content/docs/cluster-storage.mdx

@@ -75,9 +75,9 @@ Start with Kubernetes' built-in scheduler — it balances pods across nodes, res
 <DocsQuickReference
   label="CLUSTER PREFLIGHT"
   items={[
-    "01  Kubernetes and Helm supported; nodes Ready; DNS healthy",
-    "02  StorageClass present; expansion and reclaim policy understood",
-    "03  Ingress, certificates, load balancer, and backup destination tested",
+    "Kubernetes and Helm supported; nodes Ready; DNS healthy",
+    "StorageClass present; expansion and reclaim policy understood",
+    "Ingress, certificates, load balancer, and backup destination tested",
   ]}
 />
 

src/content/docs/console-events-logs.mdx

@@ -98,9 +98,9 @@ The game's primary log file is configured in the template's `spec.logPath` (e.g.
 <DocsQuickReference
   label="FAILED START TRIAGE"
   items={[
-    "01  Read Events for scheduling, image, volume, or probe failures",
-    "02  Follow container logs, then game logs when the process is ready",
-    "03  Export timestamps and context before restart or configuration changes",
+    "Read Events for scheduling, image, volume, or probe failures",
+    "Follow container logs, then game logs when the process is ready",
+    "Export timestamps and context before restart or configuration changes",
   ]}
 />
 

src/content/docs/contribution-design-workflow.mdx

@@ -78,10 +78,10 @@ Compile and commit focused changes with sign-off; CI verifies the full test, lin
 <DocsQuickReference
   label="CI VERIFICATION GATE"
   items={[
-    "01  Compilation checks (go build ./..., npx tsc --noEmit) — run locally",
-    "02  make generate && make manifests — if CRD/schema changes",
-    "03  Full test, lint, e2e suite runs in CI after push",
-    "04  Pencil exports synced; submodule changes committed separately",
+    "Compilation checks (go build ./..., npx tsc --noEmit) — run locally",
+    "make generate && make manifests — if CRD/schema changes",
+    "Full test, lint, e2e suite runs in CI after push",
+    "Pencil exports synced; submodule changes committed separately",
   ]}
 />
 

src/content/docs/create-a-server.mdx

@@ -52,8 +52,8 @@ Pick a service model, validate every port, then watch the GameServer reconcile t
 <DocsQuickReference
   label="CREATE FLOW"
   items={[
-    "01  Choose ClusterIP, NodePort, or LoadBalancer",
-    "02  Confirm ports, hostname, annotations, and CIDRs",
-    "03  Review YAML, create, then follow events to Ready",
+    "Choose ClusterIP, NodePort, or LoadBalancer",
+    "Confirm ports, hostname, annotations, and CIDRs",
+    "Review YAML, create, then follow events to Ready",
   ]}
 />

src/content/docs/credential-rotation.mdx

@@ -121,8 +121,8 @@ Revoke compromised material, invalidate sessions, preserve evidence, and test th
 <DocsQuickReference
   label="ROTATION ORDER"
   items={[
-    "01  New issued → dual trust/distribution → consumer validation",
-    "02  Test login, API, DB, agents, modules, backups, webhooks",
-    "03  Old revoked only after recovery and retained data remain usable",
+    "New issued → dual trust/distribution → consumer validation",
+    "Test login, API, DB, agents, modules, backups, webhooks",
+    "Old revoked only after recovery and retained data remain usable",
   ]}
 />

src/content/docs/dashboard-tour.mdx

@@ -75,8 +75,8 @@ A healthy workflow moves from intent to reconciliation, then closes the loop wit
 <DocsQuickReference
   label="FIRST OPERATING LOOP"
   items={[
-    "01  Choose a cluster and namespace",
-    "02  Create a server from a verified module",
-    "03  Watch events, logs, metrics, and backups",
+    "Choose a cluster and namespace",
+    "Create a server from a verified module",
+    "Watch events, logs, metrics, and backups",
   ]}
 />

src/content/docs/database-configuration.mdx

@@ -245,8 +245,8 @@ After restoring the database, verify:
 <DocsQuickReference
   label="DATABASE RUNBOOK"
   items={[
-    "01  Record engine/version, endpoint, TLS, Secret, schema, backup",
-    "02  Upgrade gate → backup + migration notes + connection headroom",
-    "03  Restore DB → matching release → validate schema, login, audit, settings",
+    "Record engine/version, endpoint, TLS, Secret, schema, backup",
+    "Upgrade gate → backup + migration notes + connection headroom",
+    "Restore DB → matching release → validate schema, login, audit, settings",
   ]}
 />

src/content/docs/database-migrations.mdx

@@ -181,9 +181,9 @@ Before committing a migration file:
 <DocsQuickReference
   label="MIGRATION LOOP"
   items={[
-    "01  api/internal/db/migrations/012_<description>.sql",
-    "02  cd api && go test ./internal/db",
-    "03  cd api && go test -tags postgres ./internal/db",
+    "api/internal/db/migrations/012_<description>.sql",
+    "cd api && go test ./internal/db",
+    "cd api && go test -tags postgres ./internal/db",
   ]}
 />
 

src/content/docs/extension-services.mdx

@@ -135,9 +135,9 @@ Maintain an independent module, tests, image, chart opt-in, health/metrics, boun
 <DocsQuickReference
   label="EXTENSION CHECK"
   items={[
-    "01  go test ./... inside the extension module",
-    "02  make image-audit-syslog image-telemetry-receiver image-mcp-server",
-    "03  Update Makefile + CI/release + chart values/templates together",
+    "go test ./... inside the extension module",
+    "make image-audit-syslog image-telemetry-receiver image-mcp-server",
+    "Update Makefile + CI/release + chart values/templates together",
   ]}
 />
 

src/content/docs/file-manager.mdx

@@ -98,9 +98,9 @@ Apply one concern, restart only when required, and validate Events and game logs
 <DocsQuickReference
   label="SAFE FILE CHANGE"
   items={[
-    "01  Confirm breadcrumb and selected path",
-    "02  Save/stop and back up world or configuration data",
-    "03  Change one concern, restart if needed, validate logs, restore on failure",
+    "Confirm breadcrumb and selected path",
+    "Save/stop and back up world or configuration data",
+    "Change one concern, restart if needed, validate logs, restore on failure",
   ]}
 />
 

src/content/docs/gametemplate-schema.mdx

@@ -165,9 +165,9 @@ Key sub-specs:
 <DocsQuickReference
   label="TEMPLATE MODEL"
   items={[
-    "01  spec.versions[] → image/tag + loader compatibility",
-    "02  spec.configSchema[] → env/args/config files",
-    "03  spec.storage + probes + ports → rendered workload",
+    "spec.versions[] → image/tag + loader compatibility",
+    "spec.configSchema[] → env/args/config files",
+    "spec.storage + probes + ports → rendered workload",
   ]}
 />
 

src/content/docs/general-server-settings.mdx

@@ -75,8 +75,8 @@ When you leave the image field blank, the server inherits the image selected by
 <DocsQuickReference
   label="IMAGE OVERRIDE"
   items={[
-    "01  Blank → inherit the installed template and selected version",
-    "02  Pin → repository + immutable tag/digest; save one change",
-    "03  Watch pull events, then verify game, files, ports, and backups",
+    "Blank → inherit the installed template and selected version",
+    "Pin → repository + immutable tag/digest; save one change",
+    "Watch pull events, then verify game, files, ports, and backups",
   ]}
 />

src/content/docs/high-availability.mdx

@@ -96,9 +96,9 @@ Drain or terminate one dependency at a time and measure:
 <DocsQuickReference
   label="HA TEST"
   items={[
-    "01  Replicate only components documented as replica-safe (Operator 2+; API stays at 1 with either database driver)",
-    "02  One domain loss (node/zone) leaves edge, control plane, database, storage, and capacity intact",
-    "03  Test leader loss, database crash, ingress restart, and node drain; record RTO/RPO",
+    "Replicate only components documented as replica-safe (Operator 2+; API stays at 1 with either database driver)",
+    "One domain loss (node/zone) leaves edge, control plane, database, storage, and capacity intact",
+    "Test leader loss, database crash, ingress restart, and node drain; record RTO/RPO",
   ]}
 />
 

src/content/docs/ingress-tls-access.mdx

@@ -211,8 +211,8 @@ The `$SESSION_TOKEN` comes from a prior dashboard login, not a Kubernetes token.
 <DocsQuickReference
   label="EDGE CHECK"
   items={[
-    "01  DNS → trusted HTTPS edge → Gameplane Service",
-    "02  Verify certificate, OIDC callback, console WS, upload, and API",
-    "03  Record host, Ingress class, issuer, proxy CIDRs, firewall, owner",
+    "DNS → trusted HTTPS edge → Gameplane Service",
+    "Verify certificate, OIDC callback, console WS, upload, and API",
+    "Record host, Ingress class, issuer, proxy CIDRs, firewall, owner",
   ]}
 />

src/content/docs/lifecycle-probes.mdx

@@ -98,9 +98,9 @@ Override timing one probe family at a time; startup protects boot, readiness gat
 <DocsQuickReference
   label="PROBE MODEL"
   items={[
-    "01  Auto-restart off → zero replicas, Suspended, data preserved",
-    "02  Grace period 0–600s; requires template stop sequence",
-    "03  Startup protects boot; readiness gates traffic; liveness recovers",
+    "Auto-restart off → zero replicas, Suspended, data preserved",
+    "Grace period 0–600s; requires template stop sequence",
+    "Startup protects boot; readiness gates traffic; liveness recovers",
   ]}
 />
 

src/content/docs/local-development-setup.mdx

@@ -74,8 +74,8 @@ Keep host and cluster registry addresses, kube context, namespaces, image tags,
 <DocsQuickReference
   label="LOCAL LOOP"
   items={[
-    "01  git submodule update --init --recursive",
-    "02  make dev-up && make web-dev",
-    "03  make dev-down   # or CLUSTER=remote make dev-up",
+    "git submodule update --init --recursive",
+    "make dev-up && make web-dev",
+    "make dev-down   # or CLUSTER=remote make dev-up",
   ]}
 />

src/content/docs/mod-registry-credentials.mdx

@@ -90,9 +90,9 @@ Run a compatible harmless search, diagnose without exposing the key, then rotate
 <DocsQuickReference
   label="REGISTRY CHECK"
   items={[
-    "01  Provider credential + compatible game/loader/module capability",
-    "02  Set/Replace stores Secret; Remove hides or disables provider",
-    "03  Test search → rotate → retest metadata/install → revoke old key",
+    "Provider credential + compatible game/loader/module capability",
+    "Set/Replace stores Secret; Remove hides or disables provider",
+    "Test search → rotate → retest metadata/install → revoke old key",
   ]}
 />
 

src/content/docs/mods-modpacks.mdx

@@ -74,8 +74,8 @@ Back up first, confirm the manifest, allow the required restart, and validate ev
 <DocsQuickReference
   label="MOD CHANGE"
   items={[
-    "01  Match game + loader + version; choose a trusted source",
-    "02  URL may update; upload never auto-updates; IDs persist in manifest",
-    "03  Backup → save manifest → restart → validate logs and joins",
+    "Match game + loader + version; choose a trusted source",
+    "URL may update; upload never auto-updates; IDs persist in manifest",
+    "Backup → save manifest → restart → validate logs and joins",
   ]}
 />

src/content/docs/modules-sources.mdx

@@ -93,9 +93,9 @@ Package metadata, templates, assets, and compatibility as versioned OCI content
 <DocsQuickReference
   label="MODULE RELEASE LOOP"
   items={[
-    "01  Validate schema, templates, capabilities, and supported versions",
-    "02  Build, sign, push, then verify the exact OCI digest",
-    "03  Sync the source, install, deploy a canary, and test rollback",
+    "Validate schema, templates, capabilities, and supported versions",
+    "Build, sign, push, then verify the exact OCI digest",
+    "Sync the source, install, deploy a canary, and test rollback",
   ]}
 />
 

src/content/docs/multi-cluster.mdx

@@ -132,9 +132,9 @@ Promote `Cluster` CRs, `GameTemplate`, and `Module` manifests through version co
 <DocsQuickReference
   label="BOUNDARY MODEL"
   items={[
-    "01  Control plane + DB + target cluster = operational boundary",
-    "02  Share GitOps/SSO policy, not live state or credentials",
-    "03  Move → export config + backup + restore + endpoint/owner validation",
+    "Control plane + DB + target cluster = operational boundary",
+    "Share GitOps/SSO policy, not live state or credentials",
+    "Move → export config + backup + restore + endpoint/owner validation",
   ]}
 />
 

src/content/docs/network-automation.mdx

@@ -107,9 +107,9 @@ A **BackupSchedule** CRD runs backups on a recurring cron schedule. Each schedul
 <DocsQuickReference
   label="AUTOMATION CHECK"
   items={[
-    "01  Validate cron timezone, target server, destination, and retention",
-    "02  Announce maintenance and save before a planned restart",
-    "03  Confirm the job, resulting backup, and audit entry completed",
+    "Validate cron timezone, target server, destination, and retention",
+    "Announce maintenance and save before a planned restart",
+    "Confirm the job, resulting backup, and audit entry completed",
   ]}
 />