docs(auth): record unified sign-in evidence

docs/audits/evidence/ux-001/README.md

@@ -0,0 +1,9 @@
+# UX-001 browser evidence
+
+Synthetic/local evidence only. No credentials, tokens or personal data are present.
+
+- `login-dark-375.png` — local sign-in form at 375 × 812.
+- `login-dark-768.png` — local sign-in form at 768 × 900.
+- `login-dark-1440.png` — local sign-in form at 1440 × 1000.
+
+The isolated browser had no API configuration service, so configured Google/Microsoft alternatives were covered by mocked component tests rather than these captures. The browser used its dark system theme. A full-page capture mode produced an invalid rendering artifact and was discarded; the retained viewport captures match computed DOM bounds and visible browser state.

docs/audits/verification-log.md

@@ -139,3 +139,6 @@ Output was reduced to filenames and commit counts. The token artifact appears un
 | V-101 | Bounded `rg`/`Get-Content` trace of Strategy button, Focus Plan tab/cache, controller/model calls, owner filters, proxy/queue/routing configuration and tests | Repository root | Revalidate AI-003 complete execution path before design | PASS — one UI action could start candidate fit plus four sequential synchronous focus-plan model calls; Pro and owner filters existed, durable state did not | Live timeout reproduction blocked; this is code-path evidence | Application-related |
 | V-102 | `dotnet test ... --filter "...StrategySnapshotOperationTests|...AiWorkspaceNotePersistenceTests|...AiOperationQueueTests|...ProEntitlementAuthorizationTests"`; `npm.cmd test -- job-details-generated-drafts.test.tsx --runInBand --forceExit` | Repository root / `job-tracker-ui` | Focused 202/handler/cache/tenant/provider-shape and queued/cancel/fail/retry UI checks | PASS — backend 34/34; frontend 6/6 | Fake model only; Jest reports the existing force-exit/open-handle notice | N/A |
 | V-103 | Full `dotnet test ... --no-restore`; full `npm.cmd test -- --runInBand --forceExit`; `npm.cmd run build`; `git diff --check` | Repository root / `job-tracker-ui` | AI-003 regression, TypeScript production build and patch hygiene | PASS — backend 592/592; frontend 47/47 suites, 160/160; build; no whitespace errors | Initial sandboxed build attempted blocked NuGet restore; previously approved build path restored from existing cache and passed. Line-ending notices only | Environmental command path corrected |
+| V-108 | Bounded source trace of `LoginPage`, Google/Microsoft account cards, auth API/config, translations and login tests | Repository root | Revalidate UX-001 local/provider execution and identity boundaries | PASS — backend already accepts username or email; UI imposed email-only validation and separate provider tabs; provider exchange and account-link endpoints are distinct | No identity/config/schema behavior changed | N/A |
+| V-109 | `npm.cmd test -- --runInBand --forceExit src/login-page.test.tsx`; full `npm.cmd test -- --runInBand --forceExit`; `npm.cmd run build`; `git diff --check` | `job-tracker-ui` / repository root | Verify unified form, invalid credentials, provider cancellation/return, full regression, TypeScript and patch hygiene | PASS — focused 13/13; full 47/47 suites and 166/166 tests; production build; no whitespace errors | Jest reports its existing force-exit/open-handle notice; provider tokens are synthetic mocks | N/A |
+| V-110 | In-app browser at `http://localhost:3000/login`; dark-theme viewport/DOM checks and screenshots at 375×812, 768×900, 1440×1000 | Local frontend | Verify running local form, accessible names and responsive layout | PASS/PARTIAL — local form readable; viewport and document widths match with no overflow; evidence captured | API config service absent, so provider alternatives were mocked only; light/System and real-provider paths not run. Full-page screenshot mode produced an artifact and was discarded | Environmental/provider limitation |