fix(auth): скрыть пароли от читателя и согласовать Portal

docs/ux-ui/acceptance/portal-live196-api-2026-10-13.json

@@ -0,0 +1,55 @@
+{
+  "date": "2026-10-13",
+  "block": "12.5.196",
+  "portalImage": "1.3.1",
+  "actualPortalTokens": true,
+  "cases": [
+    {
+      "name": "writer/admin credentials",
+      "editableCredentialsRetained": true
+    },
+    {
+      "name": "unauthenticated",
+      "status": 401
+    },
+    {
+      "name": "real portal admin",
+      "status": 200
+    },
+    {
+      "name": "reader credentials",
+      "listRedacted": true,
+      "detailRedacted": true
+    },
+    {
+      "name": "reader",
+      "read": 200,
+      "write": 403,
+      "serverWrites": 0
+    },
+    {
+      "name": "revocation boundary",
+      "revokedRefreshSessions": 1,
+      "disabledLogin": 401,
+      "portalMe": 401,
+      "oldMmAccessJwt": 200,
+      "bound": "MM validates self-contained JWT offline; Portal session/account revocation does not revoke issued MM JWT before exp"
+    },
+    {
+      "name": "no-app",
+      "read": 403,
+      "write": 403,
+      "serverWrites": 0
+    },
+    {
+      "name": "tampered signature",
+      "status": 401
+    }
+  ],
+  "userFixtureIds": [
+    "2b463ef5-cd53-4aa6-a68d-5e0485ed44c1",
+    "de4d888c-1890-4bde-90f8-dc35755f09d3"
+  ],
+  "cleaned": true,
+  "noPasswordsOrTokensPublished": true
+}

docs/ux-ui/acceptance/portal196-e2e-2026-10-13.json

@@ -0,0 +1,15 @@
+{
+  "date": "2026-10-13",
+  "block": "12.5.196",
+  "command": "playwright test portal-runtime-links page-header servers",
+  "passed": 41,
+  "duration": "1.4m",
+  "sourceFrontendTypeScript": true,
+  "scopedEslint": true,
+  "appSwitcherRuntimeUnitPassed": true,
+  "productionBuilds": [
+    "backend",
+    "frontend"
+  ],
+  "scope": "Ordinary API fixtures; live Portal/CHR read checks separately"
+}

docs/ux-ui/acceptance/portal196-live-ui-2026-10-13.json

@@ -0,0 +1,45 @@
+{
+  "date": "2026-10-13",
+  "block": "12.5.196",
+  "cases": [
+    {
+      "width": 1440,
+      "role": "reader",
+      "realPortalLogin": true,
+      "runtimePortalLink": true,
+      "writeControlAllowed": false,
+      "noOverflow": true,
+      "pageErrors": 0
+    },
+    {
+      "width": 1440,
+      "role": "admin",
+      "realPortalLogin": true,
+      "runtimePortalLink": true,
+      "writeControlAllowed": true,
+      "noOverflow": true,
+      "pageErrors": 0
+    },
+    {
+      "width": 320,
+      "role": "reader",
+      "realPortalLogin": true,
+      "runtimePortalLink": true,
+      "writeControlAllowed": false,
+      "noOverflow": true,
+      "pageErrors": 0
+    },
+    {
+      "width": 320,
+      "role": "admin",
+      "realPortalLogin": true,
+      "runtimePortalLink": true,
+      "writeControlAllowed": true,
+      "noOverflow": true,
+      "pageErrors": 0
+    }
+  ],
+  "apiMocks": false,
+  "serverWrites": 0,
+  "ownPortalUserRemoved": true
+}

docs/ux-ui/acceptance/portal196-runtime196-result.json

@@ -0,0 +1,25 @@
+{
+  "date": "2026-10-13",
+  "block": "12.5.196",
+  "secretEnvCopied": false,
+  "rollbackTags": {
+    "MMAPP_IMAGE_TAG": "ux-peak191",
+    "BACKEND_IMAGE_TAG": "ux-peak194"
+  },
+  "services": {
+    "backend": {
+      "image": "mmapp-test/backend:ux-peak196",
+      "imageId": "sha256:ed826f796c3682af02920cb5bab345505984d20183e1219d0431f9db93d3ce49",
+      "state": "running",
+      "health": "healthy",
+      "matchedVerifiedImage": true
+    },
+    "frontend": {
+      "image": "mmapp-test/frontend:ux-peak196",
+      "imageId": "sha256:1d16efa79e7e9c7bddb1771bf1fcc56862f5461a1ecd6d8c9f87490a0ead0b8f",
+      "state": "running",
+      "health": null,
+      "matchedVerifiedImage": true
+    }
+  }
+}

docs/ux-ui/acceptance/portal196-source196-result.json

@@ -0,0 +1,10 @@
+{
+  "date": "2026-10-13",
+  "block": "12.5.196",
+  "matched": {
+    "backend": 466,
+    "frontend": 525
+  },
+  "different": [],
+  "missing": []
+}

docs/ux-ui/acceptance/portal196-sql196-result.json

@@ -0,0 +1,29 @@
+{
+  "date": "2026-10-13",
+  "block": "12.5.196",
+  "passed": true,
+  "profiles": [
+    {
+      "date": "2026-10-13",
+      "block": "12.5.196",
+      "database": "mm_accept_166_1791879658920",
+      "scope": "ephemeral role and precreated owned database; no copied production credentials",
+      "tests": [
+        {
+          "command": "npm --prefix backend run test:server-privacy",
+          "passed": true,
+          "durationMs": 10996,
+          "roles": 3,
+          "endpointsPerRole": 2,
+          "storedPasswordPreserved": true,
+          "postgresUnavailableSkip": false
+        }
+      ],
+      "scopedRoleVerified": true,
+      "passed": true,
+      "databaseRemoved": true,
+      "roleRemoved": true,
+      "testContainerRemoved": true
+    }
+  ]
+}