fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix)

- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue

scripts/sync_wecom_users.py

@@ -30,7 +30,21 @@ DB_PORT = 3306
 DB_USER = _CMA_DB_USER
 DB_PASS = _CMA_DB_PASS
 DB_NAME = "cma"
-DEFAULT_PASSWORD = "admin123"
+# 新建用户的初始口令不再硬编码（2026-09-14 cma-defaultcred-code-fix）：
+# 从 $CMA_DEFAULT_USER_PASSWORD 或 600 密钥文件同源读取；缺失 → 显式报错退出（禁止静默用默认口令）。
+DEFAULT_PASSWORD = _os_gov.getenv('CMA_DEFAULT_USER_PASSWORD', '')
+if not DEFAULT_PASSWORD:
+    for _p in (_os_gov.getenv('CMA_ADMIN_ENV'),
+               '/root/.hermes/profiles/wecom-ops/.secrets/cma-admin.env',
+               '/root/.hermes/profiles/wecom-fullstack/.secrets/cma-admin.env'):
+        if _p and _os_gov.path.isfile(_p):
+            for _line in open(_p, encoding='utf-8'):
+                _line = _line.strip()
+                if _line.startswith('CMA_DEFAULT_USER_PASSWORD='):
+                    DEFAULT_PASSWORD = _line.split('=', 1)[1].strip().strip('"').strip("'")
+if not DEFAULT_PASSWORD:
+    raise SystemExit("[错误] 未找到新建用户初始口令：请设 $CMA_DEFAULT_USER_PASSWORD，"
+                     "或在 600 密钥文件（$CMA_ADMIN_ENV / .secrets/cma-admin.env）里定义 CMA_DEFAULT_USER_PASSWORD")
 
 # ==== 工具函数 ====
 def mcp_call(name, arguments={}):