chore: retire demo technical debt

backend/app/core/config.py

@@ -86,10 +86,10 @@ class Settings(BaseSettings):
         description="Socket timeout in seconds for Sentinel clients",
     )
 
-    # Admin console
-    enable_admin_console: bool = False
-    admin_username: str = "admin"
-    admin_password: str = "admin123"  # 建议通过环境变量覆盖
+    # Admin console
+    enable_admin_console: bool = False
+    admin_username: str = "admin"
+    admin_password: str = ""
 
     # CORS
     cors_origins: list[str] = Field(default_factory=lambda: ["http://localhost:5173"])
@@ -101,11 +101,17 @@ class Settings(BaseSettings):
             missing.append("SECRET_KEY")
         if not self.database_url:
             missing.append("DATABASE_URL")
-        if self.redis_sentinel_enabled and not self.redis_sentinel_nodes.strip():
-            missing.append("REDIS_SENTINEL_NODES")
-        if missing:
-            raise ValueError(f"Missing required settings: {', '.join(missing)}")
-        return self
+        if self.redis_sentinel_enabled and not self.redis_sentinel_nodes.strip():
+            missing.append("REDIS_SENTINEL_NODES")
+        if missing:
+            raise ValueError(f"Missing required settings: {', '.join(missing)}")
+        if self.enable_admin_console:
+            weak_admin_passwords = {"", "admin", "admin123", "password", "change-me"}
+            if not self.debug and self.admin_password in weak_admin_passwords:
+                raise ValueError(
+                    "ADMIN_PASSWORD must be set to a strong value when admin console is enabled"
+                )
+        return self
 
     @property
     def redis_sentinel_hosts(self) -> list[tuple[str, int]]: