fix: canonicalize browser navigation after commit

scripts/real-browser-e2e.mjs

@@ -747,7 +747,7 @@ try {
       `${viewport.width}px phone and temperature geometry overlaps: ${JSON.stringify(layout)}`,
     );
     assert.equal(
-        layout.hardwareEntries.length === FLEET_FIXTURE_ITEMS.length * 2 &&
+      layout.hardwareEntries.length === FLEET_FIXTURE_ITEMS.length * 2 &&
         layout.hardwareEntries.every((entry) => entry.labelFits && entry.valueFits),
       true,
       `${viewport.width}px hardware facts overflow: ${JSON.stringify(layout.hardwareEntries)}`,
@@ -1034,7 +1034,17 @@ try {
     `document.querySelector('[role="tab"][aria-selected="true"]')?.textContent.trim() === '操作审计'`,
     '/audit alias did not select operation audit',
   );
-  await keyboardNavigate(cdp, '设置', '/settings/system', '密码保护');
+  await navigate(cdp, `${origin}/settings/instances`);
+  await eventually(
+    cdp,
+    `location.pathname === '/settings/system'`,
+    'Legacy settings route did not replace the browser pathname',
+  );
+  await eventually(
+    cdp,
+    `document.querySelector('h1')?.textContent.trim() === '密码保护'`,
+    'Legacy settings route did not render password protection',
+  );
 
   assert.deepEqual(failures, [], `Browser failures detected:\n${failures.join('\n')}`);
   console.log(`PASS real Chrome E2E (${chromeBinary})`);