Implementation Notes

Approach

Backend exposes /api/auth/capabilities with non-secret email delivery readiness.
Email-login code and forgot-password code requests fail before account lookup when SMTP delivery is not configured, preserving account enumeration protection.
Verification email copy uses Chinese Beijing-time expiry wording instead of ISO UTC timestamps.
Normal browsers show Enterprise WeChat as an informational entry only; Enterprise WeChat WebView keeps one-click login as the primary CTA.
Frontend email-code login and forgot-password pages disable code sending when delivery is not ready.

Backend unit coverage for delivery capability, delivery-unavailable behavior and Beijing-time email wording.
Frontend E2E coverage for password visibility, PWA update prompt, email-code login, disabled email delivery state, forgot-password flow and Enterprise WeChat entry hierarchy.
Deployment checks report public auth capability status without printing SMTP values.