fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

docs/account-mode-dev-spec.md

@@ -80,9 +80,12 @@ get_entity_id 解析链（backend/app/deps.py）：
 
 ```bash
 # 1. 隔离验证：登录账套A → 全系统只显示A的数据
+# 凭据见 600 密钥文件（CMA_ADMIN_USER / CMA_ADMIN_PASS），默认落点
+# /root/.hermes/profiles/wecom-ops/.secrets/cma-admin.env
+set -a; . "${CMA_ADMIN_ENV:-/root/.hermes/profiles/wecom-ops/.secrets/cma-admin.env}"; set +a
 curl -s -X POST http://127.0.0.1:8010/api/cma/auth/login \
   -H "Content-Type: application/json" \
-  -d '{"username":"admin","password":"admin123","entity_id":2}'
+  -d "{\"username\":\"$CMA_ADMIN_USER\",\"password\":\"$CMA_ADMIN_PASS\",\"entity_id\":2}"
 # → token；用该token访问 /api/cma/kpis 只返回博海数据
 
 # 2. 越权验证：未授权entity请求返回403