Harden auth/vault path sanitization and clean WeKnora docs

scripts/task-pi-lab-warmup-binding-smoke.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 
+const { loginViaAuthForm } = require('./lib/browser-auth-login');
 const assert = require("node:assert");
 const fs = require("node:fs");
 const os = require("node:os");
@@ -41,13 +42,30 @@ async function requestJson(page, url, options = {}) {
 }
 
 async function quickLogin(page) {
-  await page.goto(`${BASE}/auth`, { waitUntil: "commit", timeout: TIMEOUT });
-  const quickLoginButton = page.getByRole("button", { name: "测试账号快速登录" });
-  if (!(await quickLoginButton.isVisible({ timeout: 4000 }).catch(() => false))) return;
-  await Promise.all([
-    page.waitForURL((url) => !url.toString().includes("/auth"), { timeout: TIMEOUT }).catch(() => null),
-    quickLoginButton.click(),
-  ]);
+  // 7-76 P0: 标准表单登录（无测试快速登录按钮）
+  const base =
+    (typeof BASE_URL !== "undefined" && BASE_URL) ||
+    (typeof baseUrl !== "undefined" && baseUrl) ||
+    process.env.MNOTE_UI_BASE_URL ||
+    "http://127.0.0.1:3000";
+  const timeout =
+    (typeof UI_TIMEOUT_MS !== "undefined" && UI_TIMEOUT_MS) ||
+    (typeof TIMEOUT !== "undefined" && TIMEOUT) ||
+    30_000;
+  if (!String(page.url() || "").includes("/auth")) {
+    await page.goto(String(base).replace(/\/+$/, "") + "/auth", {
+      waitUntil: "commit",
+      timeout,
+    });
+  }
+  await loginViaAuthForm(page, {
+    baseUrl: base,
+    timeoutMs: timeout,
+    gotoAuth: false,
+  });
+  await page
+    .waitForURL((url) => !String(url).includes("/auth"), { timeout })
+    .catch(() => {});
 }
 
 async function cleanupPreviousSmokeSession(page) {