fix: remove all default credentials (#2)

- Gateway: admin user seeded from ADMIN_USERNAME/ADMIN_PASSWORD env vars
  (no more hardcoded admin/admin). Warns if not set.
- Trips: USERNAME/PASSWORD env vars no longer default to admin/admin.
  Warns if not set.
- Fitness: user seed requires USER{n}_USERNAME/PASSWORD env vars.
  No more "changeme" fallback. Skips seed if not set.
- /api/auth/register remains disabled (403)

Closes #2

services/fitness/server.py

@@ -511,22 +511,21 @@ def seed_default_users():
     conn = get_db()
     cursor = conn.cursor()
 
-    users = [
-        {
+    users = []
+    for i in [1, 2]:
+        username = os.environ.get(f"USER{i}_USERNAME")
+        password = os.environ.get(f"USER{i}_PASSWORD")
+        if not username or not password:
+            if i == 1:
+                print(f"[Fitness] WARNING: USER{i}_USERNAME/USER{i}_PASSWORD not set. Skipping user seed.", flush=True)
+            continue
+        users.append({
             "id": str(uuid.uuid4()),
-            "username": os.environ.get("USER1_USERNAME", "yusuf"),
-            "password": os.environ.get("USER1_PASSWORD", "changeme"),
-            "display_name": os.environ.get("USER1_DISPLAY_NAME", "Yusuf"),
-            "telegram_user_id": os.environ.get("USER1_TELEGRAM_ID"),
-        },
-        {
-            "id": str(uuid.uuid4()),
-            "username": os.environ.get("USER2_USERNAME", "madiha"),
-            "password": os.environ.get("USER2_PASSWORD", "changeme"),
-            "display_name": os.environ.get("USER2_DISPLAY_NAME", "Madiha"),
-            "telegram_user_id": os.environ.get("USER2_TELEGRAM_ID"),
-        },
-    ]
+            "username": username,
+            "password": password,
+            "display_name": os.environ.get(f"USER{i}_DISPLAY_NAME", username),
+            "telegram_user_id": os.environ.get(f"USER{i}_TELEGRAM_ID"),
+        })
 
     for user in users:
         existing = cursor.execute("SELECT id FROM users WHERE username = ?", (user["username"],)).fetchone()