fix: enforce strong hashes in maintenance tools

tools/deploy/ensure-production-admin.mjs

@@ -1,4 +1,4 @@
-import { createHash, randomBytes } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
 import { writeFileSync } from 'node:fs';
 import { PrismaPg } from '../../api/node_modules/@prisma/adapter-pg/dist/index.js';
 import { PrismaClient } from '../../api/node_modules/@prisma/client/index.js';
@@ -14,16 +14,16 @@ const email = process.env.PROD_ADMIN_EMAIL || 'admin@example.com';
 const configuredPassword = process.env.PROD_ADMIN_PASSWORD;
 const credentialFile = process.env.PROD_ADMIN_CREDENTIAL_FILE;
 
-function hashPassword(value) {
-  return createHash('sha256').update(value).digest('hex');
-}
-
 async function main() {
+  // production-deploy.sh builds the API before invoking this helper, so every
+  // administrative password write shares the same versioned hasher as runtime APIs.
+  const { hashPassword } = await import('../../api/dist/auth/password-hasher.js');
   const existingUser = await prisma.user.findFirst({
     where: { username, deletedAt: null },
   });
   const createPassword = configuredPassword || randomBytes(18).toString('base64url');
   const updatePassword = configuredPassword;
+  const passwordHash = await hashPassword(updatePassword || createPassword);
   const role = await prisma.role.upsert({
     where: { code: 'platform_admin' },
     update: { name: '平台管理员', scope: 'platform' },
@@ -32,7 +32,7 @@ async function main() {
   const userData = {
     email,
     displayName: '生产平台管理员',
-    ...(updatePassword ? { passwordHash: hashPassword(updatePassword) } : {}),
+    ...(updatePassword ? { passwordHash } : {}),
     status: 'active',
     failedLoginCount: 0,
     lockedUntil: null,
@@ -49,7 +49,7 @@ async function main() {
         username,
         email,
         displayName: '生产平台管理员',
-        passwordHash: hashPassword(createPassword),
+        passwordHash,
         status: 'active',
       },
     });