security: harden public release defaults

[WaylandYang]

Summary

• fail closed on empty or weak first-run administrator credentials
• require an explicit PostgreSQL password and safely encode special characters
• apply one password policy to bootstrap, user creation, and password changes
• add Python/Node vulnerability audits, Bandit, and frontend lint to CI
• remove the unused 1.7 MB source hero image
• update bilingual deployment guidance and changelog

Validation

• 60 backend tests
• TBox guard regression
• OntoLearner regression
• Bandit high/medium scan
• pip-audit and pnpm audit
• frontend lint and production build
• Docker image build
• isolated fresh PostgreSQL/FastAPI/frontend startup
• health, initial-admin login, and missing-password failure smoke tests