qa(evidence): live production verification report

Captured against https://canvas.flow-master.ai with browser-style
probes + Playwright dogfood + raw fetches:

- Every /api/* through canvas's nginx returns 502 (proxy broken).
- demo.flow-master.ai upstream is alive (200/401 direct).
- Frontend calls auth routes that return 404 even direct on demo:
  /api/v1/auth/dev-login-config, /api/v1/auth/microsoft/login.
- User's 'GETs all 200' hypothesis was wrong — they're 502s.
- Zero EA2 traffic reaches the backend.

Repros in qa/evidence/_*.mjs. Screenshots + JSON dumps + full
report in qa/evidence/.

qa/evidence/network-report.json

@@ -0,0 +1,14 @@
+{
+  "ts": "2026-06-14T21:18:38.314Z",
+  "url": "https://canvas.flow-master.ai/",
+  "total": 0,
+  "byStatus": {},
+  "byHost": {},
+  "byPath": {},
+  "ea2Calls": 0,
+  "ea2Ok": 0,
+  "authCalls": 0,
+  "authOk": 0,
+  "first10": [],
+  "last10": []
+}