docs: update CLAUDE.md for refactored auth module

- Clarify that auth module is pure with no environment access
- Document URL construction pattern for callers
- Update module structure documentation
- Emphasize caller responsibility for configuration

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -32,18 +32,18 @@ The project relies heavily on environment variables loaded from `.env` file in t
 - `ERP_PASSWORD` - Login password
 - `ERP_HEADLESS` - Whether to run browser in headless mode (true/false)
 - `ERP_IGNORE_HTTPS_ERRORS` - Whether to ignore HTTPS certificate errors (true/false)
-- `ERP_AUTO_CLOSE_BROWSER` - Whether to automatically close browser after operations (true/false)
+
+Note: Test scripts are responsible for loading environment variables and passing configuration to utility functions.
 
 ## Architecture
 
 ### Module Structure
 
-**`utils/auth.py`** - Core authentication module
-- `login()` - Handles Yonyou BIP login with automatic force-login popup detection
-- `logout()` - Performs logout with confirmation dialog handling
-- `close_session()` - Closes browser session with respect to auto-close configuration
-- Auto-loads environment variables from `.env` on module import
-- Returns tuple: `(browser, context, page, main_frame)` where `main_frame` is the forwardFrame iframe
+**`utils/auth.py`** - Core authentication module (pure functions)
+- `login(url, username, password, page)` - Handles Yonyou BIP login with automatic force-login popup detection. Requires all parameters explicitly.
+- `logout(page)` - Performs logout with confirmation dialog handling
+- Callers are responsible for browser lifecycle management (context.close(), browser.close())
+- Returns tuple: `(page, main_frame)` where `main_frame` is the forwardFrame iframe
 
 **`tests/`** - Test suite
 - All test files must add `PROJECT_ROOT` to `sys.path` to import `utils` modules
@@ -64,6 +64,14 @@ Yonyou BIP uses a nested iframe structure:
 
 The system automatically detects and handles a force-login confirmation dialog that appears after clicking the login button. The code checks for a "确定" (Confirm) button and clicks it if present.
 
+### URL Construction Pattern
+
+Callers must construct the complete login URL before passing to `login()`:
+
+```python
+url = f"{os.getenv('ERP_URL').rstrip('/')}/yonbip/resources/uap/rbac/login/main/index.html"
+```
+
 ## Common Commands
 
 ```bash
@@ -81,7 +89,7 @@ source .venv/Scripts/activate && python tests/<test_file>.py
 
 1. **English Only**: All user-facing output, docstrings, comments, and log messages must be in English. Chinese text is only used for Playwright element selectors matching the actual UI.
 
-2. **Environment-First**: All configuration values should default to reading from environment variables. No hardcoded URLs, credentials, or user-specific paths in code.
+2. **Environment-First**: Test scripts load environment variables and explicitly pass configuration to utility functions. No hardcoded values in code.
 
 3. **Error Handling**: Functions that depend on environment variables should raise clear `ValueError` exceptions when required variables are missing.