fix: enforce strong hashes in maintenance tools

tools/smoke/real-env-smoke.mjs

@@ -14,11 +14,13 @@ const email = 'smoke-client@example.com';
 const phone = '13800138099';
 const password = 'SmokePass123!';
 
-function hashPassword(value) {
+function hashApplicationSecret(value) {
   return createHash('sha256').update(value).digest('hex');
 }
 
 async function ensureSmokeData() {
+  const { hashPassword } = await import('../../api/dist/auth/password-hasher.js');
+  const userPasswordHash = await hashPassword(password);
   const tenant = await prisma.tenant.upsert({
     where: { code: tenantCode },
     update: { name: 'Smoke Test Enterprise', status: 'active' },
@@ -36,7 +38,7 @@ async function ensureSmokeData() {
         email,
         phone,
         displayName: 'Smoke Client Admin',
-        passwordHash: hashPassword(password),
+        passwordHash: userPasswordHash,
         status: 'active',
         failedLoginCount: 0,
         lockedUntil: null,
@@ -50,7 +52,7 @@ async function ensureSmokeData() {
         email,
         phone,
         displayName: 'Smoke Client Admin',
-        passwordHash: hashPassword(password),
+        passwordHash: userPasswordHash,
         status: 'active',
       },
     });
@@ -130,7 +132,7 @@ async function ensureSmokeData() {
         tenantId: tenant.id,
         name: 'Smoke SMS App',
         scene: 'smoke',
-        secretHash: hashPassword('smoke-secret'),
+        secretHash: hashApplicationSecret('smoke-secret'),
         dailyLimit: 100000,
         customerUnitPrice: 5,
         maxPhonesPerTask: 100000,