qa(evidence): live production verification report

Captured against https://canvas.flow-master.ai with browser-style
probes + Playwright dogfood + raw fetches:

- Every /api/* through canvas's nginx returns 502 (proxy broken).
- demo.flow-master.ai upstream is alive (200/401 direct).
- Frontend calls auth routes that return 404 even direct on demo:
  /api/v1/auth/dev-login-config, /api/v1/auth/microsoft/login.
- User's 'GETs all 200' hypothesis was wrong — they're 502s.
- Zero EA2 traffic reaches the backend.

Repros in qa/evidence/_*.mjs. Screenshots + JSON dumps + full
report in qa/evidence/.

qa/evidence/_endpoint_probe.mjs

@@ -0,0 +1,44 @@
+// Direct curl-style probe through the live nginx of every endpoint canvas's
+// frontend code calls. Goal: prove which ones return real EA2 JSON vs 502.
+import { writeFileSync, mkdirSync } from "node:fs";
+
+const OUT = "/tmp/canvas-evidence";
+mkdirSync(OUT, { recursive: true });
+
+const ROOT = "https://canvas.flow-master.ai";
+const endpoints = [
+  ["GET", "/api/v1/auth/dev-login-config", null],
+  ["POST", "/api/v1/auth/dev-login", { email: "dev@flow-master.ai" }],
+  ["GET", "/api/v1/auth/me", null],
+  ["GET", "/api/v1/auth/microsoft/login", null],
+  ["GET", "/api/ea2/work-items", null],
+  ["GET", "/api/ea2/flow/processes?limit=10", null],
+  ["GET", "/api/ea2/process-definitions", null],
+  ["GET", "/api/runtime/transactions", null],
+];
+
+const out = [];
+let token = null;
+
+for (const [method, path, body] of endpoints) {
+  const headers = { "content-type": "application/json" };
+  if (token) headers["authorization"] = `Bearer ${token}`;
+  const init = { method, headers };
+  if (body) init.body = JSON.stringify(body);
+  try {
+    const res = await fetch(`${ROOT}${path}`, init);
+    const text = await res.text();
+    const sample = text.slice(0, 200).replace(/\s+/g, " ");
+    let json = null;
+    try { json = JSON.parse(text); } catch { /* not json */ }
+    if (path === "/api/v1/auth/dev-login" && json?.access_token) token = json.access_token;
+    out.push({ method, path, status: res.status, len: text.length, sample, ctype: res.headers.get("content-type") });
+    console.log(`${method.padEnd(4)} ${path.padEnd(46)} ${res.status}  ${sample.slice(0, 80)}`);
+  } catch (e) {
+    out.push({ method, path, error: e.message });
+    console.log(`${method.padEnd(4)} ${path.padEnd(46)} ERR  ${e.message}`);
+  }
+}
+
+writeFileSync(`${OUT}/endpoint-probe.json`, JSON.stringify(out, null, 2));
+console.log(`\n→ ${OUT}/endpoint-probe.json`);