Harden auth/vault path sanitization and clean WeKnora docs

scripts/task-pi-lab-browser-smoke.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+const { loginViaAuthForm } = require('./lib/browser-auth-login');
 // Pi Lab browser smoke
 // 验证 Pi Lab 默认独立悬浮入口 + MNote-native drawer，不复用已退役 host drawer/provider tab/iframe。
 // 需要 mnote-web 已在运行；MNOTE_PAGE_AI_PI_LAB 默认开启，设为 0 时才强制关闭。
@@ -38,12 +39,16 @@ async function addAuth(context) {
 
 async function quickLoginIfNeeded(page) {
   await page.goto(`${BASE}/auth`, { waitUntil: "domcontentloaded", timeout: UI_TIMEOUT_MS });
-  const quickLoginButton = page.getByRole("button", { name: "测试账号快速登录" });
-  if (!(await quickLoginButton.isVisible({ timeout: 4000 }).catch(() => false))) return;
-  await Promise.all([
-    page.waitForURL((url) => !url.toString().includes("/auth"), { timeout: UI_TIMEOUT_MS }).catch(() => null),
-    quickLoginButton.click(),
-  ]);
+  const accountReady = await page
+    .locator("#account")
+    .first()
+    .isVisible({ timeout: 4000 })
+    .catch(() => false);
+  if (!accountReady) return;
+  await loginViaAuthForm(page, { baseUrl: BASE, timeoutMs: UI_TIMEOUT_MS, gotoAuth: false });
+  await page
+    .waitForURL((url) => !url.toString().includes("/auth"), { timeout: UI_TIMEOUT_MS })
+    .catch(() => null);
 }
 
 async function approveVisiblePiDialog(page) {