fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

backend/tests/conftest.py

@@ -134,11 +134,15 @@ def client(db) -> Generator[TestClient, None, None]:
 
 # ── 测试数据工厂 ──
 
+# 测试夹具口令（仅内存 SQLite 测试库使用；不是生产默认口令——生产凭据只存 600 密钥文件
+# .secrets/cma-admin.env）。可用 $CMA_TEST_USER_PASSWORD 覆盖；用例一律从这里导入，禁止写字面量。
+TEST_USER_PASSWORD = os.environ.get("CMA_TEST_USER_PASSWORD", "test-fixture-pass")
+
 def create_test_user(db: Session, **kwargs) -> User:
     """创建测试用户"""
     defaults = {
         "username": "testadmin",
-        "password_hash": hashlib.sha256("admin123".encode()).hexdigest(),
+        "password_hash": hashlib.sha256(TEST_USER_PASSWORD.encode()).hexdigest(),
         "name": "测试管理员",
         "role": "ceo",
     }
@@ -150,7 +154,7 @@ def create_test_user(db: Session, **kwargs) -> User:
     return user
 
 
-def get_token_for_user(client: TestClient, username: str = "testadmin", password: str = "admin123") -> str:
+def get_token_for_user(client: TestClient, username: str = "testadmin", password: str = TEST_USER_PASSWORD) -> str:
     """获取测试用户的token（账套模式：需entity_id）"""
     resp = client.post("/api/cma/auth/login", json={
         "username": username,