修复认证验证码投递与登录入口体验 05-27-oa-auth-delivery-wecom-entry-fix

.trellis/tasks/05-27-oa-auth-delivery-wecom-entry-fix/implement.md

@@ -0,0 +1,15 @@
+# Implementation Notes
+
+## Approach
+
+- Backend exposes `/api/auth/capabilities` with non-secret email delivery readiness.
+- Email-login code and forgot-password code requests fail before account lookup when SMTP delivery is not configured, preserving account enumeration protection.
+- Verification email copy uses Chinese Beijing-time expiry wording instead of ISO UTC timestamps.
+- Normal browsers show Enterprise WeChat as an informational entry only; Enterprise WeChat WebView keeps one-click login as the primary CTA.
+- Frontend email-code login and forgot-password pages disable code sending when delivery is not ready.
+
+## Verification Focus
+
+- Backend unit coverage for delivery capability, delivery-unavailable behavior and Beijing-time email wording.
+- Frontend E2E coverage for password visibility, PWA update prompt, email-code login, disabled email delivery state, forgot-password flow and Enterprise WeChat entry hierarchy.
+- Deployment checks report public auth capability status without printing SMTP values.