记录 Day2 真实试运行巡检 05-26-oa-seven-day-trial-live-ops

.trellis/spec/hyb-oa/frontend-react-vite-design.md

@@ -87,6 +87,11 @@ or hidden according to the active Issue; do not silently re-enable them.
   - forgot-password flow calls request-code and reset endpoints;
   - auth-page PWA update prompt appears without clearing inputs.
 - UI design rules check when auth page layout changes.
+- Any Playwright test that renders `/login`, `/forgot-password` or another auth
+  route with mocked `/api/*` responses must mock `/api/auth/capabilities` with
+  `emailDelivery.ready`, `emailLoginCode.enabled` and `passwordReset.enabled`.
+  Returning `{}` for unknown auth APIs can crash auth pages before the visual or
+  navigation assertion actually runs.
 
 ### 7. Wrong vs Correct