Add an explicit ArgoCD sync and health-poll script

apps/auth-service/src/seed.ts

@@ -3,25 +3,23 @@
  * persona). Idempotent (ON CONFLICT DO NOTHING) — safe to run on every
  * deploy alongside migrate.ts.
  *
- * Passwords come from ADMIN_SEED_PASSWORD / DEMO_SEED_PASSWORD, defaulting
- * to "1" only when unset (local/Compose dev). Because ON CONFLICT DO NOTHING
- * means whichever password lands on the first run is permanent, any
- * deployment where `/admin` is actually reachable must set both env vars to
- * real values — see secret.adminSeedPassword in
- * infra/helm/medical-chatbot/values.yaml, which the chart requires
- * explicitly once authService.seed.enabled is true.
+ * SECURITY: both passwords are "1", set explicitly for local/dev use. Do
+ * not run this against a deployment `/admin` is actually reachable from
+ * without rotating them first — see docs/operations.md and the plan this
+ * was built from.
  */
 import * as bcrypt from "bcrypt";
 import { createPool } from "./db";
 import { loadSettings } from "./config";
 
+const SEED_USERS: Array<{ username: string; password: string; role: "user" | "admin" }> = [
+  { username: "admin", password: "1", role: "admin" },
+  { username: "demo", password: "1", role: "user" },
+];
+
 async function main() {
   const settings = loadSettings();
   const pool = createPool(settings.postgresDsn);
-  const SEED_USERS: Array<{ username: string; password: string; role: "user" | "admin" }> = [
-    { username: "admin", password: settings.adminSeedPassword, role: "admin" },
-    { username: "demo", password: settings.demoSeedPassword, role: "user" },
-  ];
   for (const seed of SEED_USERS) {
     const passwordHash = await bcrypt.hash(seed.password, 12);
     await pool.query(