Add an explicit ArgoCD sync and health-poll script

apps/auth-service/src/config.ts

@@ -6,8 +6,6 @@ export interface Settings {
   postgresDsn: string;
   jwtSecret: string;
   jwtExpiresIn: string;
-  adminSeedPassword: string;
-  demoSeedPassword: string;
 }
 
 export function loadSettings(): Settings {
@@ -28,10 +26,5 @@ export function loadSettings(): Settings {
       "postgresql://duoc_thu:duoc_thu@localhost:5432/duoc_thu",
     jwtSecret,
     jwtExpiresIn: process.env.JWT_EXPIRES_IN ?? "12h",
-    // Default "1" only exists for local/Compose dev, which never sets these.
-    // A real deployment sets them via the Helm Secret — see
-    // secret.adminSeedPassword in infra/helm/medical-chatbot/values.yaml.
-    adminSeedPassword: process.env.ADMIN_SEED_PASSWORD ?? "1",
-    demoSeedPassword: process.env.DEMO_SEED_PASSWORD ?? "1",
   };
 }

apps/auth-service/src/seed.ts

@@ -3,25 +3,23 @@
  * persona). Idempotent (ON CONFLICT DO NOTHING) — safe to run on every
  * deploy alongside migrate.ts.
  *
- * Passwords come from ADMIN_SEED_PASSWORD / DEMO_SEED_PASSWORD, defaulting
- * to "1" only when unset (local/Compose dev). Because ON CONFLICT DO NOTHING
- * means whichever password lands on the first run is permanent, any
- * deployment where `/admin` is actually reachable must set both env vars to
- * real values — see secret.adminSeedPassword in
- * infra/helm/medical-chatbot/values.yaml, which the chart requires
- * explicitly once authService.seed.enabled is true.
+ * SECURITY: both passwords are "1", set explicitly for local/dev use. Do
+ * not run this against a deployment `/admin` is actually reachable from
+ * without rotating them first — see docs/operations.md and the plan this
+ * was built from.
  */
 import * as bcrypt from "bcrypt";
 import { createPool } from "./db";
 import { loadSettings } from "./config";
 
+const SEED_USERS: Array<{ username: string; password: string; role: "user" | "admin" }> = [
+  { username: "admin", password: "1", role: "admin" },
+  { username: "demo", password: "1", role: "user" },
+];
+
 async function main() {
   const settings = loadSettings();
   const pool = createPool(settings.postgresDsn);
-  const SEED_USERS: Array<{ username: string; password: string; role: "user" | "admin" }> = [
-    { username: "admin", password: settings.adminSeedPassword, role: "admin" },
-    { username: "demo", password: settings.demoSeedPassword, role: "user" },
-  ];
   for (const seed of SEED_USERS) {
     const passwordHash = await bcrypt.hash(seed.password, 12);
     await pool.query(