docs: add protected api mock verification steps

README.md

@@ -21,16 +21,53 @@ npm run build
 ## Current Scope
 
 - Adds two after-search-rate columns to the Xingtu market list
+- Adds a popup-based Logto auth entry
 - Hydrates the current page immediately
 - Provides plugin-owned filter, sort, and CSV export controls
+- Gates the market tools until auth is available
 - Triggers full-scan flow only when filter, sort, or export is used
 
+## Auth Configuration
+
+The Logto integration is wired with placeholder values in `src/shared/auth-config.ts`.
+Replace these before real sign-in testing:
+
+- `logtoEndpoint`
+- `appId`
+- `apiResource`
+- Any extra scopes beyond `openid`, `profile`, and `offline_access`
+
+The popup dev panel is controlled by `enableDevAuthPanel`.
+
+## Popup Behavior
+
+1. Load the unpacked extension from `dist/`
+2. Click the extension icon
+3. Confirm the popup shows `登录 Logto` when unauthenticated
+4. After real Logto config is added, use the popup to sign in and sign out
+
+## Protected API Mock Test
+
+1. Set `enableDevAuthPanel` to `true` in `src/shared/auth-config.ts`
+2. Run `npm run mock:protected-api`
+3. Run `npm run build`
+4. Reload the unpacked extension from `dist/`
+5. Open the popup and log in
+6. Click `测试受保护接口`
+7. Confirm the popup shows JSON containing `"source": "mock-protected-api"` and `"message": "authorized"`
+
+## Market Auth Gate
+
+When the market page is opened without a valid auth state, the content script renders
+`请先登录插件` and does not boot the filter, sort, or export toolbar.
+
 ## Manual Verification
 
 1. Load the unpacked extension from `dist/`
 2. Open `https://xingtu.cn/ad/creator/market`
-3. Confirm the two new columns appear
+3. Confirm the page shows the auth gate until login is available
-4. Confirm current-page rows move through loading and then render values or failure states
+4. After authentication is wired, confirm the two new columns appear
-5. Apply a threshold filter and confirm the list hides unmatched rows
+5. Confirm current-page rows move through loading and then render values or failure states
-6. Apply a sort and confirm row order changes
+6. Apply a threshold filter and confirm the list hides unmatched rows
-7. Export CSV and confirm the file includes plugin status and after-search-rate fields
+7. Apply a sort and confirm row order changes
+8. Export CSV and confirm the file includes plugin status and after-search-rate fields