chore(security): 凭据治理收口 — 清除硬编码DB账号/口令，脚本与API统一从 backend/.env 读取(无明文兜底)；取消跟踪 .pyc 构建产物 (credential-governance-20260912)

backend/scripts/verify_dashboard_isolation.py

@@ -5,6 +5,16 @@ import json
 import urllib.request
 import pymysql
 
+# 2026-09-12 库访问治理（ops）：凭据从 backend/.env 读取，无明文兜底
+import os
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env')
+except Exception:
+    pass
+if not os.getenv('CMA_DB_PASS'):
+    raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
+
 BASE = "http://127.0.0.1:8010"
 
 
@@ -39,7 +49,9 @@ def main():
     reminders = d.get("reminders", [])
     print(f"2. my-dashboard OK: action_plans={len(plans)} 条, reminders={len(reminders)} 条")
 
-    conn = pymysql.connect(host="127.0.0.1", user="cma_user", password="cma_pass_2026",
+    # 账号与口令同源（backend/.env）——硬编码 cma_user + 应用口令会账号/口令错配
+    conn = pymysql.connect(host="127.0.0.1", user=os.getenv("CMA_DB_USER", "cma_user"),
+                           password=os.environ.get("CMA_DB_PASS", ""),
                            database="cma", charset="utf8mb4")
     cur = conn.cursor()