fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

backend/scripts/verify_forecast_deviation_rules_e2e.py

@@ -15,8 +15,33 @@ import sys
 import urllib.request
 import urllib.error
 
+import os  # noqa: E402  (凭据加载器需要)
+# ---- 管理员凭据同源加载（2026-09-14 cma-defaultcred-code-fix）----
+# 生产凭据只存 600 密钥文件；禁止在脚本/文档/日志里硬编码口令。
+# 顺序：$CMA_ADMIN_ENV → wecom-ops 主副本（ops 轮换落点，权威） → 本 profile 副本。
+def _admin_creds():
+    """返回 (user, password, 来源文件)；未找到 → 显式报错退出（不静默退回默认口令）"""
+    for p in (os.environ.get("CMA_ADMIN_ENV"),
+              "/root/.hermes/profiles/wecom-ops/.secrets/cma-admin.env",
+              "/root/.hermes/profiles/wecom-fullstack/.secrets/cma-admin.env"):
+        if p and os.path.isfile(p):
+            kv = {}
+            for line in open(p, encoding="utf-8"):
+                line = line.strip()
+                if "=" in line and not line.startswith("#"):
+                    k, v = line.split("=", 1)
+                    kv[k.strip()] = v.strip().strip('"').strip("'")
+            if kv.get("CMA_ADMIN_USER") and kv.get("CMA_ADMIN_PASS"):
+                return kv["CMA_ADMIN_USER"], kv["CMA_ADMIN_PASS"], p
+    raise SystemExit("[错误] 未找到 CMA 管理员凭据：请设 $CMA_ADMIN_ENV，或准备 600 权限密钥文件 "
+                     ".secrets/cma-admin.env（键名 CMA_ADMIN_USER / CMA_ADMIN_PASS）")
+
+
+ADMIN_USER, ADMIN_PASS, CRED_SRC = _admin_creds()
+print(f"[creds] 来源={CRED_SRC} 账号={ADMIN_USER}（口令不回显）")
+
 BASE = "http://127.0.0.1:8010"
-ADMIN = {"username": "admin", "password": "admin123"}
+ADMIN = {"username": ADMIN_USER, "password": ADMIN_PASS}
 MARK = "【系统验证临时数据-验证后删除】"
 
 # 规则目标：酣客 → 应收账款周转天数(F_AR_DAYS, id=6，有 2026-09 预测日志)