The sandbox login stops being guessable

/v1/bank/config answers demoLogin: true with demoEmail: [email protected]
to anyone who asks, and the deployed build falls back to a hardcoded
password when BANK_DEMO_PASSWORD is unset. That fallback is the estate's
documented org convention, so the advertised email and the password were
a pair anyone could assemble -- from the moment api.lux.financial was
routed, which was an hour ago.

The value is a Secret in the namespace, not a line in this file: the
reference belongs in git and the credential does not. It should move to
KMS with the rest.

This keeps the demo working. Turning BANK_SANDBOX off would close the
same door by removing the thing the host exists to show.

Co-authored-by: Hanzo AI <[email protected]>

deploy/lux-bank/bankd.yaml

@@ -24,6 +24,19 @@ args:
 env:
 - name: BANKD_DIR
   value: /data
+# The sandbox login is advertised in public: /v1/bank/config answers
+# `demoLogin: true` with `demoEmail: "[email protected]"` to anyone. The deployed
+# build falls back to a hardcoded password when this is unset -- and that
+# fallback is the estate's documented org convention, so the pair was
+# guessable the moment the host was routed.
+#
+# The value is a Secret in the namespace and is not written here. The
+# reference belongs in git; the credential does not.
+- name: BANK_DEMO_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: bankd-demo
+      key: password
 - name: JWT_SECRET
   valueFrom:
     secretKeyRef: