Harden auth/vault path sanitization and clean WeKnora docs

scripts/task524-workspace-object-identity-matrix-smoke.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 
+const { loginViaAuthForm } = require('./lib/browser-auth-login');
 const assert = require("node:assert/strict");
 const fs = require("node:fs");
 const os = require("node:os");
@@ -48,12 +49,30 @@ function writeWorkspaceManifest(root, ownerId, workspaceId) {
 }
 
 async function quickLogin(page) {
-  await page.goto(`${BASE_URL}/auth`, { waitUntil: "domcontentloaded", timeout: UI_TIMEOUT_MS });
-  const quickLoginButton = page.getByRole("button", { name: "测试账号快速登录" });
-  if (await quickLoginButton.count()) {
-    await quickLoginButton.click({ timeout: UI_TIMEOUT_MS });
-    await page.waitForURL((url) => url.pathname !== "/auth", { timeout: UI_TIMEOUT_MS }).catch(() => undefined);
+  // 7-76 P0: 标准表单登录（无测试快速登录按钮）
+  const base =
+    (typeof BASE_URL !== "undefined" && BASE_URL) ||
+    (typeof baseUrl !== "undefined" && baseUrl) ||
+    process.env.MNOTE_UI_BASE_URL ||
+    "http://127.0.0.1:3000";
+  const timeout =
+    (typeof UI_TIMEOUT_MS !== "undefined" && UI_TIMEOUT_MS) ||
+    (typeof TIMEOUT !== "undefined" && TIMEOUT) ||
+    30_000;
+  if (!String(page.url() || "").includes("/auth")) {
+    await page.goto(String(base).replace(/\/+$/, "") + "/auth", {
+      waitUntil: "commit",
+      timeout,
+    });
   }
+  await loginViaAuthForm(page, {
+    baseUrl: base,
+    timeoutMs: timeout,
+    gotoAuth: false,
+  });
+  await page
+    .waitForURL((url) => !String(url).includes("/auth"), { timeout })
+    .catch(() => {});
 }
 
 async function filetreeRowState(page, relativePath) {