fix(security): replace exposed admin credential with placeholder

rshen/Letmein was a live, checked-in cluster_admin credential in
auth.yaml. Renamed to a non-identifying username with a clearly-marked
placeholder password.

docs: add full ops deployment guide (src/docs/deployment.md)

Covers building and running all four daemons plus xceadmin, based on
direct source verification (CLI flags, config file shapes, TLS posture)
and a live single-node deploy. Documents real production gaps (no
process supervision, plaintext non-controller traffic, exposed dev
creds) rather than treating the repo as a finished runbook.

src/frontend/apiserver/config/auth.yaml

@@ -11,8 +11,8 @@ config_file:
     - username: admin
       password: admin
       roles: [cluster_admin]
-    - username: rshen
-      password: Letmein
+    - username: op7x2k9
+      password: CHANGE_ME_dev_only
       roles: [cluster_admin]
     - username: user1
       password: user1