Harden auth/vault path sanitization and clean WeKnora docs

scripts/task-pi-lab-rpc-browser-smoke.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+const { loginViaAuthForm } = require('./lib/browser-auth-login');
 // Pi Lab RPC browser smoke
 // 验证真实 Pi RPC + Omniroute/gpt-5.4-mini 在 MNote-native Pi Lab 抽屉中的可见 stream。
 // 需要 mnote-web 已以 MNOTE_PAGE_AI_PI_LAB_RUNTIME=rpc 启动，并配置 MNOTE_PAGE_AI_PI_BIN / Omniroute key。
@@ -67,12 +68,16 @@ async function addAuth(context) {
 async function quickLoginIfNeeded(page) {
   const authResponse = await page.goto(`${BASE}/auth`, { waitUntil: "domcontentloaded", timeout: UI_TIMEOUT_MS });
   if (!authResponse || authResponse.status() >= 400) return;
-  const quickLoginButton = page.getByRole("button", { name: "测试账号快速登录" });
-  if (!(await quickLoginButton.isVisible({ timeout: 4000 }).catch(() => false))) return;
-  await Promise.all([
-    page.waitForURL((url) => !url.toString().includes("/auth"), { timeout: UI_TIMEOUT_MS }).catch(() => null),
-    quickLoginButton.click(),
-  ]);
+  const accountReady = await page
+    .locator("#account")
+    .first()
+    .isVisible({ timeout: 4000 })
+    .catch(() => false);
+  if (!accountReady) return;
+  await loginViaAuthForm(page, { baseUrl: BASE, timeoutMs: UI_TIMEOUT_MS, gotoAuth: false });
+  await page
+    .waitForURL((url) => !url.toString().includes("/auth"), { timeout: UI_TIMEOUT_MS })
+    .catch(() => null);
 }
 
 async function main() {