fix(auth): simplify registration navigation

frontend/src/components/email-otp-login.tsx

@@ -51,6 +51,10 @@ export function EmailOtpLogin({
   const [notice, setNotice] = useState("");
 
   const canUsePassword = provider === "self-hosted" && passwordEnabled;
+  const showLoginNavigation =
+    canUsePassword && (mode === "otp" || mode === "password");
+  const showBackToLogin =
+    canUsePassword && (mode === "register" || mode === "forgot");
 
   function chooseMode(nextMode: AuthMode, nextNotice = "") {
     setMode(nextMode);
@@ -257,7 +261,7 @@ export function EmailOtpLogin({
           <h1 id="login-title">{title}</h1>
           <p className="page-intro">{intro}</p>
 
-          {canUsePassword && (
+          {showLoginNavigation && (
             <nav className="auth-mode-nav" aria-label="登录方式">
               <div className="auth-mode-tabs">
                 <button
@@ -286,6 +290,14 @@ export function EmailOtpLogin({
             </nav>
           )}
 
+          {showBackToLogin && (
+            <nav className="auth-links" aria-label="返回登录">
+              <button type="button" onClick={() => chooseMode("otp")}>
+                返回登录
+              </button>
+            </nav>
+          )}
+
           {mode === "password" && step === "email" ? (
             <form
               key="password-login"

frontend/tests/identity-login-provider.test.ts

@@ -174,6 +174,16 @@ test("login UI preserves accessible OTP, password, registration, and reset input
   for (const label of ["验证码登录", "密码登录", "注册账号", "忘记密码"]) {
     assert.match(component, new RegExp(label));
   }
+  assert.match(
+    component,
+    /canUsePassword && \(mode === "otp" \|\| mode === "password"\)/,
+  );
+  assert.match(
+    component,
+    /canUsePassword && \(mode === "register" \|\| mode === "forgot"\)/,
+  );
+  assert.match(component, /\{showLoginNavigation && \(/);
+  assert.match(component, />\s*返回登录\s*</);
   for (const autocomplete of [
     "email",
     "current-password",

progress.md

@@ -987,3 +987,4 @@
 - 第 2 轮最终验证：兼容保留既有 selfHostedOtpActions/createSelfHostedOtpActions 导出后，identity 36/36、集成 1/1、staging 契约 20/20、ESLint、build、diff check 再次全绿。
 - 发布前：再次 fetch 后 main/staging 仍同为 f402e6f79c7c8c65de9137770b3041c6eb55da42，main 未受保护；允许范围审计通过，依赖/lockfile/migration/deploy/workflow diff=0。
 - 阻塞：执行环境无受控 staging 测试邮箱/收件箱，真实收信验收写入 BLOCKED.md；不使用他人邮箱，代码与部署继续。
+- 2026-07-27 UI 跟进：注册与忘记密码子流程不再显示“验证码登录 / 密码登录 / 注册账号 / 忘记密码”顶层导航，仅保留“返回登录”；聚焦测试 4/4、ESLint、diff check 通过。