Harden auth/vault path sanitization and clean WeKnora docs

scripts/qa-block-handle-menu.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 
+const { loginViaAuthForm } = require('./lib/browser-auth-login');
 const path = require("path");
 const { chromium } = require("playwright");
 
@@ -68,18 +69,15 @@ async function ensureAuthenticated(page, requestContext) {
 
   await page.goto(`${BASE_URL}/auth`, { waitUntil: "domcontentloaded", timeout: TIMEOUT_MS });
   await page.waitForTimeout(1000);
-  const btn = page.getByRole("button", { name: "测试账号快速登录" });
-  if (await btn.isVisible().catch(() => false)) {
-    await btn.click();
-    await page.waitForURL("**/documents/**", { timeout: TIMEOUT_MS }).catch(() => {});
-    await page.waitForTimeout(2000);
-  } else {
-    await page.getByLabel("邮箱").fill(TEST_EMAIL);
-    await page.getByLabel("密码").fill(TEST_PASSWORD);
-    await page.getByRole("button", { name: /登录|Login|Sign in/i }).click();
-    await page.waitForURL("**/documents/**", { timeout: TIMEOUT_MS }).catch(() => {});
-    await page.waitForTimeout(2000);
-  }
+  await loginViaAuthForm(page, {
+    baseUrl: BASE_URL,
+    email: TEST_EMAIL,
+    password: TEST_PASSWORD,
+    timeoutMs: TIMEOUT_MS,
+    gotoAuth: false,
+  });
+  await page.waitForURL((url) => !String(url).includes("/auth"), { timeout: TIMEOUT_MS }).catch(() => {});
+  await page.waitForTimeout(2000);
   return null;
 }