fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

backend/tests/test_multitenant_ai_20260907.py

@@ -15,7 +15,7 @@ from sqlalchemy.orm import Session
 
 from app.models import KPIDefinition, KPIValue, KPIAlert, ActionPlan, AISuggestion, Entity, UserEntity, ActualCost
 from app.api import ai_analysis
-from tests.conftest import create_test_kpi, create_test_user, get_token_for_user, auth_header
+from tests.conftest import create_test_kpi, create_test_user, get_token_for_user, auth_header, TEST_USER_PASSWORD
 
 
 def _ensure_entity(db: Session, eid: int) -> Entity:
@@ -44,7 +44,7 @@ def _seed_user(db: Session, entity_id: int):
 def _token(client: TestClient, entity_id: int) -> str:
     """登录并返回指定账套的 token（get_token_for_user 固定 entity1，这里手动登录）"""
     resp = client.post("/api/cma/auth/login", json={
-        "username": "testadmin", "password": "admin123", "entity_id": entity_id,
+        "username": "testadmin", "password": TEST_USER_PASSWORD, "entity_id": entity_id,
     })
     assert resp.status_code == 200, f"登录 entity{entity_id} 失败: {resp.text[:300]}"
     return resp.json().get("token")