feat(server): randomize the seeded admin initial password (#172)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

packages/landing/scripts/capture-blog-013-shots.mjs

@@ -45,6 +45,8 @@ const ROOT = path.resolve(HERE, "../../..");
 const OUT_DIR = path.resolve(HERE, "../.blog-assets");
 const MOCK_PORT = 8953; // Distinct from capture-shots (8940/8941) and blog-shots (8944).
 const SRV_PORT = 8952;
+// Pins the otherwise-random seeded admin password (PENGUIN_SEED_ADMIN_PASSWORD below).
+const ADMIN_PASSWORD = "penguin-0000";
 // The App is canonically served on `localhost` (127.0.0.1 is the Workspace-preview host).
 const BASE = `http://localhost:${SRV_PORT}`;
 const MOCK = `http://127.0.0.1:${MOCK_PORT}`;
@@ -932,6 +934,7 @@ const srv = spawn("node", [path.join(ROOT, "packages/server/dist/index.js")], {
     PENGUIN_WEB_DIST: path.join(ROOT, "packages/web/dist"),
     PORT: String(SRV_PORT),
     HOST: "127.0.0.1",
+    PENGUIN_SEED_ADMIN_PASSWORD: ADMIN_PASSWORD,
   },
   stdio: ["ignore", "pipe", "pipe"],
 });
@@ -950,7 +953,7 @@ try {
   await waitFor(`${BASE}/`);
   console.log(`[blog-013] server ready on ${BASE}`);
 
-  const adminCookie = await login("admin", "penguin-2026");
+  const adminCookie = await login("admin", ADMIN_PASSWORD);
   const browser = await chromium.launch();
 
   // WebP encoder: Chromium re-encodes the PNG screenshot via canvas (capture-shots convention).

packages/landing/scripts/capture-blog-shots.mjs

@@ -36,6 +36,8 @@ const ROOT = path.resolve(HERE, "../../..");
 // Gitignored staging dir: these images are hosted in the community repo, not committed here.
 const OUT_DIR = path.resolve(HERE, "../.blog-assets");
 const SRV_PORT = 8944; // Distinct from capture-shots.mjs (8940/8941) so both can run.
+// Pins the otherwise-random seeded admin password (PENGUIN_SEED_ADMIN_PASSWORD below).
+const ADMIN_PASSWORD = "penguin-0000";
 // On loopback binds the App is canonically served on `localhost`; the 127.0.0.1
 // counterpart is the Workspace-preview host, where /api deliberately answers 401
 // (see server app.ts's canonical-host guard).
@@ -113,6 +115,7 @@ const srv = spawn("node", [path.join(ROOT, "packages/server/dist/index.js")], {
     PENGUIN_WEB_DIST: path.join(ROOT, "packages/web/dist"),
     PORT: String(SRV_PORT),
     HOST: "127.0.0.1",
+    PENGUIN_SEED_ADMIN_PASSWORD: ADMIN_PASSWORD,
   },
   stdio: ["ignore", "pipe", "pipe"],
 });
@@ -127,7 +130,7 @@ try {
   await waitFor(`${BASE}/`);
   console.log(`[blog-shots] server ready on ${BASE}`);
 
-  const adminCookie = await login("admin", "penguin-2026");
+  const adminCookie = await login("admin", ADMIN_PASSWORD);
   const browser = await chromium.launch();
 
   // WebP encoder: Chromium re-encodes the PNG screenshot buffer via canvas (same

packages/landing/scripts/capture-shots.mjs

@@ -27,6 +27,8 @@ const OUT_DIR = path.resolve(HERE, "../src/assets/shots");
 const MOCK_PORT = 8941;
 const SRV_PORT = 8940;
 const BASE = `http://127.0.0.1:${SRV_PORT}`;
+// Pins the otherwise-random seeded admin password (PENGUIN_SEED_ADMIN_PASSWORD below).
+const ADMIN_PASSWORD = "penguin-0000";
 const MOCK = `http://127.0.0.1:${MOCK_PORT}`;
 
 // ---------------------------------------------------------------------------
@@ -523,6 +525,7 @@ const srv = spawn("node", [path.join(ROOT, "packages/server/dist/index.js")], {
     PENGUIN_WEB_DIST: path.join(ROOT, "packages/web/dist"),
     PORT: String(SRV_PORT),
     HOST: "127.0.0.1",
+    PENGUIN_SEED_ADMIN_PASSWORD: ADMIN_PASSWORD,
   },
   stdio: ["ignore", "pipe", "pipe"],
 });
@@ -542,7 +545,7 @@ try {
   await waitFor(`${BASE}/`);
   console.log(`[shots] server ready on ${BASE}`);
 
-  const admin = await login("admin", "penguin-2026");
+  const admin = await login("admin", ADMIN_PASSWORD);
   const browser = await chromium.launch();
 
   // WebP encoder: Chromium re-encodes the PNG screenshot buffer via canvas, which