Replace demo admins with a single login and drop fake inbox seed.

Only 09128081392 / 123456 remains as admin; remove seeded internal messages and add a reset-admin script for production databases.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/reset-admin.mjs

@@ -0,0 +1,43 @@
+/**
+ * ادمین‌های قبلی را پاک می‌کند و فقط یک ادمین می‌سازد.
+ * داخل کانتینر API:
+ *   node scripts/reset-admin.mjs
+ * یا با DATABASE_URL محلی:
+ *   node scripts/reset-admin.mjs
+ */
+const { PrismaClient } = require('@prisma/client');
+const bcrypt = require('bcryptjs');
+
+const PHONE = process.env.ADMIN_PHONE || '09128081392';
+const PASSWORD = process.env.ADMIN_PASSWORD || '123456';
+const FULL_NAME = process.env.ADMIN_NAME || 'مدیر سیستم';
+
+async function main() {
+  const prisma = new PrismaClient();
+  try {
+    const passwordHash = await bcrypt.hash(PASSWORD, 10);
+    await prisma.$transaction([
+      prisma.adminUser.deleteMany({}),
+      prisma.adminUser.create({
+        data: {
+          id: 'usr-1',
+          fullName: FULL_NAME,
+          phone: PHONE,
+          email: 'admin@parche.ir',
+          passwordHash,
+          role: 'admin',
+          isActive: true,
+        },
+      }),
+      prisma.internalMessage.deleteMany({}),
+    ]);
+    console.log(`Admin reset OK: ${PHONE} / ${PASSWORD}`);
+  } finally {
+    await prisma.$disconnect();
+  }
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

scripts/smoke-order-flow.mjs

@@ -6,8 +6,8 @@
  */
 const BASE = process.env.SMOKE_BASE_URL || 'http://127.0.0.1:3999/api';
 const CUSTOMER_PHONE = '09121234567';
-const ADMIN_PHONE = '09121112222';
-const ADMIN_PASSWORD = 'admin123';
+const ADMIN_PHONE = '09128081392';
+const ADMIN_PASSWORD = '123456';
 
 let passed = 0;
 let failed = 0;