Harden auth/vault path sanitization and clean WeKnora docs

scripts/qa-block-handle-menu-smoke.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 
+const { loginViaAuthForm } = require('./lib/browser-auth-login');
 /**
  * Minimal Browser QA: Block handle menu icon/layout check
  * Scope: open editor → hover paragraph handle → click handle → check menu
@@ -61,15 +62,13 @@ async function run() {
 
   try {
     // ── Step 1: Login ──
-    let s1 = step("login", "Login via quick-login button");
+    let s1 = step("login", "Login via standard auth form (7-76 P0)");
     console.log(`\n🔍 Step 1: ${s1.desc}`);
     await page.goto(`${BASE}/auth`, { waitUntil: "networkidle", timeout: 15000 });
-    const loginBtn = page.getByRole("button", { name: "测试账号快速登录" });
-    await loginBtn.waitFor({ state: "visible", timeout: 8000 });
-    await Promise.all([
-      page.waitForURL((url) => !url.pathname.includes("/auth"), { timeout: 15000 }),
-      loginBtn.click(),
-    ]);
+    await loginViaAuthForm(page, { baseUrl: BASE, timeoutMs: 15000, gotoAuth: false });
+    await page
+      .waitForURL((url) => !url.pathname.includes("/auth"), { timeout: 15000 })
+      .catch(() => {});
     await page.waitForTimeout(2000);
     const afterLogin = page.url();
     s1.status = afterLogin.includes("/auth") ? "FAIL" : "PASS";