Captured against https://canvas.flow-master.ai with browser-style
probes + Playwright dogfood + raw fetches:
- Every /api/* through canvas's nginx returns 502 (proxy broken).
- demo.flow-master.ai upstream is alive (200/401 direct).
- Frontend calls auth routes that return 404 even direct on demo:
/api/v1/auth/dev-login-config, /api/v1/auth/microsoft/login.
- User's 'GETs all 200' hypothesis was wrong — they're 502s.
- Zero EA2 traffic reaches the backend.
Repros in qa/evidence/_*.mjs. Screenshots + JSON dumps + full
report in qa/evidence/.
