优化 PC 登录页桌面布局（07-30-pc-login-desktop-layout）

.trellis/spec/hyb-oa/frontend-react-vite-design.md

@@ -1664,7 +1664,10 @@ onNeedRefresh() {
 - Auth routes should use one shared auth panel for brand, page title, subtitle,
   content and optional footer links.
 - `AuthLayout` owns only the auth page shell: background, width constraint,
-  centering, PWA update prompt and route outlet.
+  centering, PWA update prompt and route outlet. Its default variant remains a
+  460px auth form; `/login` may explicitly select the `login` variant to allow
+  the approved desktop entry layout without widening password recovery or
+  forced password change pages.
 - Page implementations own only their form fields, submit actions, validation
   messages and route-specific login-entry choices.
 
@@ -1673,8 +1676,12 @@ onNeedRefresh() {
 - Do not nest a form card inside another login card.
 - Put the brand block inside the auth panel so logo, system name, title and
   form share one visual axis.
-- Keep the panel width stable around the current auth-shell width; auth pages
-  should feel like an OA workstation entry, not a marketing split hero.
+- Keep password recovery, forced password change and login fallback-only panels
+  stable around the 460px auth-shell width. When PC Enterprise WeChat login is
+  enabled, `/login` may expand to a functional desktop split up to roughly
+  920px: Enterprise WeChat entry on the left and a form column capped around
+  404px on the right. This remains one shared auth panel, not a marketing split
+  hero or nested form-card layout.
 - Place `忘记密码？` beside the password label or directly below the password
   input on the right; do not bury it in help text or page footer.
 - Keep the DOM/tab order aligned with the main form flow even when CSS places
@@ -1686,10 +1693,15 @@ onNeedRefresh() {
 
 ### 4. Login Entry Hierarchy
 
-- Normal browser: account/password or email-code login is primary. Enterprise
-  WeChat is shown as a boundary notice or secondary entry that tells users to
-  open OA from the Enterprise WeChat workbench; do not require a clickable OAuth
-  button in ordinary browsers.
+- Normal browser with `pcWebLoginEnabled=true` and a non-null `pcLoginUrl`:
+  Enterprise WeChat is the preferred desktop entry. At 1024px and above, show
+  it in the left functional column and keep account/password plus email-code in
+  the right fallback column. Below 1024px, preserve the existing single-column
+  form-first order and show the PC Enterprise WeChat entry afterward.
+- Normal browser without an available PC login URL: keep the existing 460px
+  single-column form and show only the workbench boundary notice or other
+  configured secondary provider; never render an empty desktop column or a
+  disabled PC login button.
 - Enterprise WeChat WebView: Enterprise WeChat one-click entry is primary;
   account/password login remains available as the fallback path.
 - Enterprise WeChat entry changes must remain frontend entry hierarchy changes
@@ -1706,7 +1718,10 @@ onNeedRefresh() {
   - keyboard Tab from the username/email field lands on the password input, not
     the forgot-password link;
   - password recovery request-code and reset flow on `/forgot-password`;
-  - normal-browser Enterprise WeChat boundary notice or secondary entry;
+  - 1024px and 1440px normal-browser PC Enterprise WeChat functional split,
+    including column position and controlled form width;
+  - 375px and 768px single-column form-first order without horizontal overflow;
+  - PC login configuration unavailable falling back to the 460px single column;
   - WeCom WebView Enterprise WeChat entry as primary CTA with password fallback.
 - UI design rules check and Playwright screenshot evidence when the auth layout
   changes visibly.