fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

backend/tests/test_auth.py

@@ -4,7 +4,7 @@
 import pytest
 from fastapi.testclient import TestClient
 from sqlalchemy.orm import Session
-from tests.conftest import create_test_user, get_token_for_user, auth_header
+from tests.conftest import create_test_user, get_token_for_user, auth_header, TEST_USER_PASSWORD
 
 
 class TestAuth:
@@ -16,7 +16,7 @@ class TestAuth:
 
         resp = client.post("/api/cma/auth/login", json={
             "username": "testadmin",
-            "password": "admin123",
+            "password": TEST_USER_PASSWORD,
             "entity_id": 1,
         })
 
@@ -41,7 +41,7 @@ class TestAuth:
         """用户不存在"""
         resp = client.post("/api/cma/auth/login", json={
             "username": "nobody",
-            "password": "admin123",
+            "password": TEST_USER_PASSWORD,
         })
 
         assert resp.status_code == 401
@@ -89,7 +89,7 @@ class TestAuth:
 
         resp = client.post("/api/cma/auth/register", json={
             "username": "testadmin",
-            "password": "admin123",
+            "password": TEST_USER_PASSWORD,
             "name": "重复用户",
         })