security: remove hardcoded credentials from scripts and docs

scripts/fast-deploy.sh

@@ -16,7 +16,7 @@ cd /a0/usr/workdir/leocrm-fix
 
 if [ "$MODE" = "full" ]; then
   echo "[Full Deploy] Triggering Coolify rebuild..."
-  COOLIFY_API_TOKEN='2|UnMMp2WYbXFJCrOuZ1yqSK96hMooPTAfAJPIXiQc1e47154e' \
+  COOLIFY_API_TOKEN="${COOLIFY_API_TOKEN:-}" \
   COOLIFY_APP_UUID='stvabl4vaqru7jclx4ittzr3' \
   COOLIFY_BASE_URL='https://server.media-on.de' \
   SSH_KEY="$SSH_KEY" \

scripts/fast-frontend-deploy.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Fast frontend-only deploy: build locally, copy to container, restart.
+# Usage: bash scripts/fast-frontend-deploy.sh
+# Skips Coolify rebuild entirely. ~20s total instead of ~2min.
+
+set -euo pipefail
+
+CONTAINER="stvabl4vaqru7jclx4ittzr3-153149570355"
+SERVER="root@46.225.91.159"
+SSH_KEY="${SSH_KEY:-/a0/usr/workdir/.ssh/coolify-01-root}"
+SSH_OPTS="-o StrictHostKeyChecking=no -i $SSH_KEY"
+
+echo "[1/4] Building frontend..."
+cd /a0/usr/workdir/leocrm-fix/frontend
+npm run build 2>&1 | tail -3
+
+echo "[2/4] Packaging & uploading..."
+tar czf /tmp/frontend-dist.tar.gz -C dist .
+scp $SSH_OPTS /tmp/frontend-dist.tar.gz $SERVER:/tmp/frontend-dist.tar.gz
+
+echo "[3/4] Copying into container..."
+ssh $SSH_OPTS $SERVER "docker cp /tmp/frontend-dist.tar.gz $CONTAINER:/tmp/ && docker exec $CONTAINER sh -c 'cd /app/frontend/dist && tar xzf /tmp/frontend-dist.tar.gz --overwrite && rm /tmp/frontend-dist.tar.gz' && rm /tmp/frontend-dist.tar.gz"
+
+echo "[4/4] Restarting container (clears service worker cache)..."
+ssh $SSH_OPTS $SERVER "docker restart $CONTAINER" 2>/dev/null || true
+sleep 3
+
+echo "✅ Fast deploy done (~20s). Container restarted."

scripts/seed_admin.py

@@ -5,7 +5,7 @@ Usage: python scripts/seed_admin.py
 
 Creates:
   - Tenant: "Default Org" (slug: default)
-  - Admin user: admin@media-on.de / Admin123!
+  - Admin user: admin@media-on.de / (password from ADMIN_PASSWORD env var)
 
 If tenant or user already exists, skips creation.
 """
@@ -52,7 +52,7 @@ async def seed():
                 tenant_id=tenant.id,
                 email="admin@media-on.de",
                 name="Administrator",
-                password_hash=hash_password("Admin123!"),
+                password_hash=hash_password(os.environ.get("ADMIN_PASSWORD", "changeme")),
                 role="admin",
                 is_active=True,
                 preferences={},
@@ -72,7 +72,7 @@ async def seed():
         print("\nSeed complete!")
         print(f"  Login URL: https://crm.media-on.de/login")
         print(f"  Email:     admin@media-on.de")
-        print(f"  Password:   Admin123!")
+        print(f"  Password:   (from ADMIN_PASSWORD env var)")
 
     await close_engine()