fix: handle existing admin during deploy

tools/deploy/ensure-production-admin.mjs

@@ -20,7 +20,8 @@ function hashPassword(value) {
 
 async function main() {
   const existingUser = await prisma.user.findUnique({ where: { username } });
-  const password = configuredPassword || (existingUser ? undefined : randomBytes(18).toString('base64url'));
+  const createPassword = configuredPassword || randomBytes(18).toString('base64url');
+  const updatePassword = configuredPassword;
   const role = await prisma.role.upsert({
     where: { code: 'platform_admin' },
     update: { name: '平台管理员', scope: 'platform' },
@@ -31,7 +32,7 @@ async function main() {
     update: {
       email,
       displayName: '生产平台管理员',
-      ...(password ? { passwordHash: hashPassword(password) } : {}),
+      ...(updatePassword ? { passwordHash: hashPassword(updatePassword) } : {}),
       status: 'active',
       failedLoginCount: 0,
       lockedUntil: null,
@@ -42,7 +43,7 @@ async function main() {
       username,
       email,
       displayName: '生产平台管理员',
-      passwordHash: hashPassword(password),
+      passwordHash: hashPassword(createPassword),
       status: 'active',
     },
   });
@@ -56,7 +57,9 @@ async function main() {
     'CMPP production admin account',
     `username=${username}`,
     `email=${email}`,
-    password ? `password=${password}` : 'password=unchanged',
+    existingUser
+      ? (updatePassword ? `password=${updatePassword}` : 'password=unchanged')
+      : `password=${createPassword}`,
     `generatedAt=${new Date().toISOString()}`,
     '',
   ].join('\n');
@@ -65,7 +68,7 @@ async function main() {
   }
   console.log(`Production admin is ready: ${email}`);
   if (!credentialFile) {
-    console.log(`Temporary password: ${password}`);
+    console.log(existingUser && !updatePassword ? 'Password unchanged' : `Temporary password: ${existingUser ? updatePassword : createPassword}`);
   }
 }