Previously, seed.ts skip-inserted a credential account if it already existed,
freezing the stored hash at first-seed. Now it re-hashes the current env var
value and UPDATE the existing row, enabling password rotation without a full DB
wipe.
- AC-8: re-seeding with a changed SEED_UAT_*_PASSWORD updates the stored hash
- AC-5 still passes: re-seeding with the same password is idempotent (no new rows)
- All 540 tests pass
Co-Authored-By: Paperclip <noreply@paperclip.ing>