fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

docs/account-mode-dev-spec.md

@@ -80,9 +80,12 @@ get_entity_id 解析链（backend/app/deps.py）：
 
 ```bash
 # 1. 隔离验证：登录账套A → 全系统只显示A的数据
+# 凭据见 600 密钥文件（CMA_ADMIN_USER / CMA_ADMIN_PASS），默认落点
+# /root/.hermes/profiles/wecom-ops/.secrets/cma-admin.env
+set -a; . "${CMA_ADMIN_ENV:-/root/.hermes/profiles/wecom-ops/.secrets/cma-admin.env}"; set +a
 curl -s -X POST http://127.0.0.1:8010/api/cma/auth/login \
   -H "Content-Type: application/json" \
-  -d '{"username":"admin","password":"admin123","entity_id":2}'
+  -d "{\"username\":\"$CMA_ADMIN_USER\",\"password\":\"$CMA_ADMIN_PASS\",\"entity_id\":2}"
 # → token；用该token访问 /api/cma/kpis 只返回博海数据
 
 # 2. 越权验证：未授权entity请求返回403

docs/manuals/budget-version.md

@@ -28,7 +28,7 @@
 
 ## ③ 验证路径
 - **自动脚本**：
-  1. 生产 API 双账套断言：`/root/cma-management/backend/scripts/verify_budget_versions_ui_fix.py`（`cd backend && venv/bin/python3 scripts/verify_budget_versions_ui_fix.py`；用 admin/admin123 分别登录 entity1/entity2，断言新字段存在 + active→draft 映射 + plan_count==kpi_count + last_updated==updated_at）
+  1. 生产 API 双账套断言：`/root/cma-management/backend/scripts/verify_budget_versions_ui_fix.py`（`cd backend && venv/bin/python3 scripts/verify_budget_versions_ui_fix.py`；凭据见 600 密钥文件 `CMA_ADMIN_USER` / `CMA_ADMIN_PASS`（脚本同源读取：`$CMA_ADMIN_ENV` 或 `.secrets/cma-admin.env`）分别登录 entity1/entity2，断言新字段存在 + active→draft 映射 + plan_count==kpi_count + last_updated==updated_at）
   2. 浏览器页面 DOM 实测：`/root/cma-management/backend/scripts/verify_budget_versions_ui_browser.py`（需先起 Chrome CDP 9224，命令见 cma-fullstack-ops 技能 references/budget-version-ui-field-state-fix-20260907.md 的 Chrome 起法；登录博海 entity2 断言 v2026H2 行=草稿/25条/462/最后更新非空/「提交审批」按钮，切酣客 entity1 断言 5 个 active 行有提交按钮 + 2026H2 approved「已批准」无按钮）
 - **期望输出**：两个脚本末尾均输出 `ALL_PASS` 且 exit 0
 - **已测基线**（最近一次验证日期+结果）：2026-09-07 复跑双脚本 ALL_PASS。实测数据：博海 entity2 `v2026H2 | status=active | approval_status=draft | plan_count=25 | total=462.0 | last_updated='2026-08-30 11:24'`；酣客 entity1 共 6 版本，5 个 active（v1.0/v2.0/incremental/flexible/zero_based-20260826）→ 草稿+「提交审批」按钮，2026H2 approved → 「已批准」无按钮

docs/财务Bot网银流水自助入库流程.md

@@ -53,12 +53,13 @@
 
 ## 三、curl 命令示例
 
-### 1. 登录拿 token（admin/admin123，账套 entity_id=1 酣客）
+### 1. 登录拿 token（凭据见 600 密钥文件 CMA_ADMIN_USER / CMA_ADMIN_PASS，账套 entity_id=1 酣客）
 
 ```bash
+set -a; . "${CMA_ADMIN_ENV:-/root/.hermes/profiles/wecom-ops/.secrets/cma-admin.env}"; set +a
 TOKEN=$(curl -s -X POST http://127.0.0.1:8010/api/cma/auth/login \
   -H "Content-Type: application/json" \
-  -d '{"username":"admin","password":"admin123","entity_id":1}' \
+  -d "{\"username\":\"$CMA_ADMIN_USER\",\"password\":\"$CMA_ADMIN_PASS\",\"entity_id\":1}" \
   | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")
 
 echo "$TOKEN"   # 响应字段含 token/entity_id/entity_name/user