fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

frontend/src/views/Login.vue

@@ -30,7 +30,7 @@
 </template>
 
 <script setup lang="ts">
-import { ref, reactive, computed, onMounted } from 'vue'
+import { ref, reactive, computed } from 'vue'
 import { useRouter } from 'vue-router'
 import { ElMessage } from 'element-plus'
 import { authApi } from '../api/index'
@@ -39,7 +39,9 @@ import { isFixedEntity, getFixedEntityId } from '../utils/entity'
 const router = useRouter()
 const loading = ref(false)
 const entities = ref<any[]>([])
-const form = reactive({ username: 'admin', password: 'admin123', entity_id: undefined as number | undefined })
+// 凭据面收口（2026-09-14 cma-defaultcred-code-fix）：不再预填默认口令。
+// 演示包若确需"一键登录"便利，只能以构建期开关（如 VITE_DEMO_PREFILL，默认关闭）恢复，不在源码里留默认口令。
+const form = reactive({ username: '', password: '', entity_id: undefined as number | undefined })
 
 // ── 固定企业模式（Phase C）：构建期锁定单一企业，隐藏下拉、登录直接带固定 entity_id ──
 const fixedMode = isFixedEntity()
@@ -89,7 +91,9 @@ async function handleLogin() {
   loading.value = false
 }
 
-onMounted(() => loadEntities(form.username))
+// 凭据面收口：不在挂载时用硬编码用户名（原 'admin'）触发企业枚举
+// （login-entities 是公开端点，以固定用户名预取＝给匿名访客做用户名存在性探测）。
+// 企业列表仅在用户输入用户名时由 onUsernameChange 加载；固定企业版展示走 fixedEntityLabel 的"企业 #id"兜底。
 </script>
 
 <style scoped>