qa(evidence): live production verification report

Captured against https://canvas.flow-master.ai with browser-style
probes + Playwright dogfood + raw fetches:

- Every /api/* through canvas's nginx returns 502 (proxy broken).
- demo.flow-master.ai upstream is alive (200/401 direct).
- Frontend calls auth routes that return 404 even direct on demo:
  /api/v1/auth/dev-login-config, /api/v1/auth/microsoft/login.
- User's 'GETs all 200' hypothesis was wrong — they're 502s.
- Zero EA2 traffic reaches the backend.

Repros in qa/evidence/_*.mjs. Screenshots + JSON dumps + full
report in qa/evidence/.

qa/evidence/demo-direct-ea2-401.json

@@ -0,0 +1 @@
+{"error":{"code":401,"message":"Missing authentication token","request_id":"unknown"}}