fix(deploy): 明确提示初始管理员密码

scripts/test-deployment-public-url.sh

@@ -98,10 +98,29 @@ DEPLOY_NON_INTERACTIVE=1 \
     DEPLOY_DRY_RUN=1 \
     DEPLOY_ACCESS=ip \
     DEPLOY_IP=10.0.0.8 \
-    bash start.sh >/dev/null
+    bash start.sh > "$TMP_DIR/first-install.log"
 grep -qx 'NUXT_PUBLIC_BASE_APIURL=http://10.0.0.8:4100' .env
 grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://10.0.0.8:4100' .env
 grep -qx 'SERVER_HTTP_BIND_IP=0.0.0.0' .env
+initial_admin_password="$(awk -F= '$1 == "CONFIG_INITIAL_ADMIN_PASSWORD" { print $2; exit }' .env)"
+[ "${#initial_admin_password}" -ge 12 ] || {
+    echo "Initial admin password was not generated" >&2
+    exit 1
+}
+grep -Fq '登录账号: admin' "$TMP_DIR/first-install.log"
+grep -Fq "登录密码: ${initial_admin_password}" "$TMP_DIR/first-install.log"
+grep -Fq '生命周期: 仅在数据库首次创建 admin 时使用；创建后修改 .env 不会重置密码。' "$TMP_DIR/first-install.log"
+grep -Fq '有效期: 初始密码没有独立过期时间，在管理员修改密码前持续有效。' "$TMP_DIR/first-install.log"
+DEPLOY_NON_INTERACTIVE=1 \
+    DEPLOY_DRY_RUN=1 \
+    DEPLOY_ACCESS=ip \
+    DEPLOY_IP=10.0.0.8 \
+    bash start.sh > "$TMP_DIR/existing-env.log"
+grep -Fq '管理员账号: admin（本次部署不会生成或重置已有密码）' "$TMP_DIR/existing-env.log"
+if grep -Fq "登录密码: ${initial_admin_password}" "$TMP_DIR/existing-env.log"; then
+    echo "Existing-env deployment must not report CONFIG_INITIAL_ADMIN_PASSWORD as the current login password" >&2
+    exit 1
+fi
 if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
     assert_compose_exposure 0.0.0.0
     assert_canvas_ws_auth_config