Remove hardcoded credentials from db-reset.js

[legit-app-ci]

Summary

Fixes Password hashes should not be disclosed in artifacts/db-reset.js (lines 7–67).

The database reset script contained hardcoded plaintext passwords ("Admin_123", "User1_123", "User2_123") and commented-out bcrypt hashes committed to source control, exposing credentials to anyone with repository access.

Changes

• Removed all commented-out password hash lines
• Replaced plaintext password strings with environment variable lookups: process.env.ADMIN_PASSWORD, process.env.USER1_PASSWORD, process.env.USER2_PASSWORD
• Added validation to fail fast with a clear error message if required environment variables (ADMIN_PASSWORD, USER1_PASSWORD, USER2_PASSWORD) are missing
• Updated the file header comment to document required environment variables and provide usage example

Credentials must now be provided via environment variables at runtime and are no longer committed to version control.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud