fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

docs/财务Bot网银流水自助入库流程.md

@@ -53,12 +53,13 @@
 
 ## 三、curl 命令示例
 
-### 1. 登录拿 token（admin/admin123，账套 entity_id=1 酣客）
+### 1. 登录拿 token（凭据见 600 密钥文件 CMA_ADMIN_USER / CMA_ADMIN_PASS，账套 entity_id=1 酣客）
 
 ```bash
+set -a; . "${CMA_ADMIN_ENV:-/root/.hermes/profiles/wecom-ops/.secrets/cma-admin.env}"; set +a
 TOKEN=$(curl -s -X POST http://127.0.0.1:8010/api/cma/auth/login \
   -H "Content-Type: application/json" \
-  -d '{"username":"admin","password":"admin123","entity_id":1}' \
+  -d "{\"username\":\"$CMA_ADMIN_USER\",\"password\":\"$CMA_ADMIN_PASS\",\"entity_id\":1}" \
   | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")
 
 echo "$TOKEN"   # 响应字段含 token/entity_id/entity_name/user