docs: correct admin gateway path ownership

docs/superpowers/plans/2026-07-17-stage-0-monorepo-foundation.md

@@ -223,7 +223,6 @@ git commit -m "refactor: migrate admin app into pnpm workspace"
 - Modify: `apps/admin/src/main.jsx`
 - Modify: `apps/admin/src/utils/request.js`
 - Modify: `apps/admin/src/utils/axios.js`
-- Modify: `apps/admin/src/pages/user-module/login/index.jsx`
 
 **Interfaces:**
 - Produces: `ADMIN_BASE_PATH`, `ADMIN_LOGIN_PATH`, `normalizeAdminApiPath(url)`, and `stripAdminGatewayPrefix(url)`.
@@ -248,6 +247,7 @@ test('admin login stays under the admin base path', () => {
 })
 
 test('legacy /api requests are normalized for the admin gateway', () => {
+  assert.equal(normalizeAdminApiPath('/api/admin/user/login'), '/user/login')
   assert.equal(normalizeAdminApiPath('/api/user/login'), '/user/login')
   assert.equal(normalizeAdminApiPath('/user/login'), '/user/login')
 })
@@ -263,7 +263,7 @@ test('gateway prefix is removed before backend signature calculation', () => {
 Add to `apps/admin/package.json` scripts:
 
 ```json
-"test": "node --test src/utils/*.test.js"
+"test": "node --test src/store/storage-import.test.mjs src/utils/*.test.js"
 ```
 
 - [ ] **Step 2: Run the tests and verify they fail**
@@ -285,6 +285,8 @@ export const ADMIN_BASE_PATH = '/admin'
 export const ADMIN_LOGIN_PATH = `${ADMIN_BASE_PATH}/login`
 
 export function normalizeAdminApiPath(url = '') {
+  if (url === '/api/admin') return '/'
+  if (url.startsWith('/api/admin/')) return url.slice('/api/admin'.length)
   if (url === '/api') return '/'
   if (url.startsWith('/api/')) return url.slice('/api'.length)
   return url
@@ -418,19 +420,21 @@ const httpRequest = axios.create({
 
 Import `ADMIN_LOGIN_PATH` and `normalizeAdminApiPath`, normalize `config.url` before signing, and replace direct `/login` redirects with `ADMIN_LOGIN_PATH`.
 
-- [ ] **Step 8: Fix login widget URLs that bypass the shared Axios clients**
+- [ ] **Step 8: Preserve login widget business paths behind the shared Axios client**
 
-Change the captcha props in `apps/admin/src/pages/user-module/login/index.jsx`:
+The captcha implementation imports `@/utils/request.js`, so its URLs are business paths consumed by the shared Axios client. Keep the existing props in `apps/admin/src/pages/user-module/login/index.jsx`:
 
 ```jsx
-initUrl="/api/admin/user/login/initData"
-verifyUrl="/api/admin/user/login/checkVerify"
+initUrl="/user/login/initData"
+verifyUrl="/user/login/checkVerify"
 ```
 
+Do not prefix these values with `/api/admin`; the Axios `baseURL` owns that gateway prefix. Adding it here would produce `/api/admin/api/admin/...`.
+
 Run this audit:
 
 ```bash
-rg -n "location\.(href|pathname) = '/login'|initUrl: '/user|verifyUrl: '/user" apps/admin/src
+rg -n "location\.(href|pathname) = '/login'|initUrl: '/api/admin|verifyUrl: '/api/admin" apps/admin/src
 ```
 
 Expected: no matches.