fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

backend/tests/test_kr_full_fix.py

@@ -9,6 +9,7 @@ from datetime import date
 
 from tests.conftest import (
     create_test_user, get_token_for_user, auth_header, create_test_kpi,
+    TEST_USER_PASSWORD,
 )
 from app.models import Objective, KR, KPIDefinition, Entity
 
@@ -253,7 +254,7 @@ class TestMultiTenant:
         # 用 entity 2 登录
         ent2_user = create_test_user(db, username="user2", role="ceo")
         resp2 = client.post("/api/cma/auth/login", json={
-            "username": "user2", "password": "admin123", "entity_id": 2})
+            "username": "user2", "password": TEST_USER_PASSWORD, "entity_id": 2})
         token2 = resp2.json().get("token")
         assert token2