chore(secrets): remove committed dev plaintext from docker central nodes + loose login files (ScadaBridge G-4 T5)

docker/central-node-a/appsettings.Central.json

@@ -18,8 +18,7 @@
       "MinNrOfMembers": 1
     },
     "Database": {
-      "ConfigurationDb": "Server=scadabridge-mssql,1433;Database=ScadaBridgeConfig;User Id=scadabridge_app;Password=ScadaBridge_Dev1#;TrustServerCertificate=true",
-      "MachineDataDb": "Server=scadabridge-mssql,1433;Database=ScadaBridgeMachineData;User Id=scadabridge_app;Password=ScadaBridge_Dev1#;TrustServerCertificate=true"
+      "_comment": "ConfigurationDb/MachineDataDb (which carry the dev SQL password) are supplied as ScadaBridge__Database__* whole-key env overrides in docker/docker-compose.yml (dev-only-insecure, mirroring the ApiKeyPepper convention). The same dev password already ships committed for the sibling scadabridge-mssql container (infra/docker-compose.yml MSSQL_SA_PASSWORD) — this is consolidation, not new exposure. Env overrides layer over JSON before the ${secret:} expander runs, so the dev cluster boots with no KEK/secret store. Real/prod config uses ${secret:} tokens in src/.../appsettings.Central.json (T4)."
     },
     "Security": {
       "Ldap": {
@@ -29,13 +28,13 @@
         "AllowInsecure": true,
         "SearchBase": "dc=zb,dc=local",
         "ServiceAccountDn": "cn=serviceaccount,dc=zb,dc=local",
-        "ServiceAccountPassword": "serviceaccount123"
+        "_comment_ServiceAccountPassword": "Supplied as ScadaBridge__Security__Ldap__ServiceAccountPassword env override in docker-compose.yml (dev-only-insecure)."
       },
       "Auth": {
         "DisableLogin": false,
         "User": "multi-role"
       },
-      "JwtSigningKey": "scadabridge-dev-jwt-signing-key-must-be-at-least-32-characters-long",
+      "_comment_JwtSigningKey": "Supplied as ScadaBridge__Security__JwtSigningKey env override in docker-compose.yml (dev-only-insecure).",
       "JwtExpiryMinutes": 15,
       "IdleTimeoutMinutes": 30,
       "RequireHttpsCookie": false,