fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

backend/tests/test_security_knowledge_partition.py

@@ -16,7 +16,7 @@ from app.models import KPIDefinition, KPIAlert, Entity
 from app.models.knowledge import KnowledgeSummary, KnowledgeEvent
 from app.models.knowledge_article import KnowledgeArticle
 from app.services import knowledge_service
-from tests.conftest import create_test_kpi, create_test_user, get_token_for_user, auth_header
+from tests.conftest import create_test_kpi, create_test_user, get_token_for_user, auth_header, TEST_USER_PASSWORD
 
 SUMMARY_FIELDS = dict(
     level="daily", period_key="2026-09-01", content="测试摘要内容",
@@ -35,7 +35,7 @@ def _ensure_entity(db: Session, eid: int, name: str = None) -> Entity:
 
 
 def _login_token(client: TestClient, username: str = "testadmin",
-                 password: str = "admin123", entity_id: int = 1) -> str:
+                 password: str = TEST_USER_PASSWORD, entity_id: int = 1) -> str:
     """登录指定账套返回 token（conftest.get_token_for_user 固定 entity1，这里参数化）"""
     resp = client.post("/api/cma/auth/login", json={
         "username": username, "password": password, "entity_id": entity_id,