test: storyline 2/3/4 exploratory test results + BUG-009/010

Storyline 2 (Teacher): 3 PASS, 1 FAIL (BUG-008 confirmed)
Storyline 3 (Tech user): SSE verified, model switch OK, BUG-009 middleware bypass
Storyline 4 (Mom): 3 PASS, scene 4.3 anomalous BUG-008 behavior with kimi

New findings:
- BUG-009 (P1): SaaS Relay bypasses all 14 middleware layers
- BUG-010 (P3): No cancel button during streaming

docs/test-results/2026-04-09-exploratory/bug-tracker.md

@@ -13,6 +13,8 @@
 | BUG-006 | 启动 | P2 | WebMCP 注册失败 TypeError: Required member is undefined | KNOWN | 需 Chrome 146+ flag |
 | BUG-007 | Admin | P2 | Admin V2 authStore 测试 19 个失败 (113 passed) | OPEN | 测试代码与实现不同步 |
 | BUG-008 | 场景1.6 | P1 | SaaS Relay 模式只发送当前消息，不发送对话历史 (无上下文记忆) | FIXED | 9442471 |
+| BUG-009 | 场景3.6 | P1 | SaaS Relay 模式绕过全部14层中间件链 (DataMasking/ButlerRouter等) | OPEN | — |
+| BUG-010 | 场景3.4 | P3 | 流式响应无明确取消按钮 (用户无法中止长响应) | OPEN | — |
 
 ## BUG-001 详细