Closes P0 #3 from .convoys/ship-readiness.md. Removes the hardcoded
admin@tcgvault.com / admin123 credentials from scripts/setup-neon-db.js
(make it env-var-driven) and from README.md.
Single PR; small surface (2 files). No UI, no API, no migration. Auditor
cohort skipped (no UX/a11y/design-system surface).
P0 #3's third file (pages/api/setup-database.js) was already deleted by
fix-auth-bypass Brief 3.
Architect to address:
- Existing-admin rotation story (going-forward fix vs. forced reset)
- Confirm scripts/setup-neon-db.js no-go-zones rule applies to schema
changes only (this is operational)
- Whether to add vitest coverage for the env-var-required path
depends_on: bump-next-js (shipped), fix-auth-bypass (shipped)
Co-authored-by: Cursor <cursoragent@cursor.com>
