fix(fix4): enforce runtime contract and orchestrator guardrails

orchestrator/src/config/env.ts

@@ -119,6 +119,7 @@ export function parseRuntimeEnv(content: string): RuntimeConfig {
     uiPort,
     adminUser: requireValue("HY2XS_ADMIN_USER", env.HY2XS_ADMIN_USER || "admin"),
     adminInitialPassword: valueOrGenerate(env.HY2XS_ADMIN_INITIAL_PASSWORD),
+    adminConPass: requireValue("HY2XS_ADMIN_CON_PASS", valueOrGenerate(env.HY2XS_ADMIN_CON_PASS)),
     forcePasswordChange: parseBool("HY2XS_FORCE_PASSWORD_CHANGE", env.HY2XS_FORCE_PASSWORD_CHANGE, true),
     tlsMode,
     acmeType,
@@ -202,6 +203,7 @@ export function renderRuntimeEnv(config: RuntimeConfig): string {
     `HY2XS_UI_PORT=${config.uiPort}`,
     `HY2XS_ADMIN_USER=${config.adminUser}`,
     `HY2XS_ADMIN_INITIAL_PASSWORD=${config.adminInitialPassword}`,
+    `HY2XS_ADMIN_CON_PASS=${config.adminConPass}`,
     `HY2XS_FORCE_PASSWORD_CHANGE=${config.forcePasswordChange}`,
     `HY2XS_TLS_MODE=${config.tlsMode}`,
     `HY2XS_ACME_TYPE=${config.acmeType}`,