write down how to handle the server password

روشی که این جلسه استفاده شد حالا نوشته شده تا هر کسی (آدم یا ایجنت) همان را
تکرار کند: رمز در یک فایلِ chmod 600 در پوشه‌ی موقت، ورود با sshpass -f و
sudo -S از ورودی، و shred -u بلافاصله بعدِ کار.

دلیلِ هر قدم هم نوشته شد، چون بدونِ دلیل قدم‌ها تشریفات به‌نظر می‌رسند و کنار
گذاشته می‌شوند. مهم‌ترینش: رمز هیچ‌وقت در خطِ فرمان نیاید — روی این سرور چند
تیمِ دیگر حساب دارند و ps دستورِ هر پروسه را به همه نشان می‌دهد.

و صریح نوشته شد که رمز فقط از خودِ کاربر در همان جلسه می‌آید؛ جایی ذخیره
نمی‌شود و نباید بشود. اگر در گفتگو نبود، باید پرسید نه گشت.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -263,6 +263,37 @@ Rules that follow from this, and are not negotiable:
    113 GB volume). Check `df -h /` before anything that writes a lot — a full disk on
    this machine takes the mail server and Gitea down with us, not just our app.
 
+### Handling the server password (every agent, every time)
+
+Access is a password for the shared `administrator` account, not a key. Handle it exactly
+like this — the steps exist for reasons, not ceremony:
+
+```bash
+printf '%s' '<password>' > "$SCRATCH/.pw"   # scratchpad, never the repo
+chmod 600 "$SCRATCH/.pw"
+sshpass -f "$SCRATCH/.pw" ssh administrator@78.38.35.249 '<command>'
+ssh administrator@78.38.35.249 'sudo -S -p "" <command>' < "$SCRATCH/.pw"
+shred -u "$SCRATCH/.pw"                      # immediately after, not "later"
+```
+
+- **Never put the password in the command line.** `ps` on this box shows every process's
+  full argv to every logged-in user, and several other teams have accounts here.
+- **Never write it into the repo, a memory file, a commit, or a note.** The scratchpad
+  only, and only for as long as the commands take.
+- **`shred -u` as soon as the work is done**, not at the end of the session. Recreate it
+  if more work comes; that costs nothing.
+- **Never echo it back into the conversation**, even partially, and never paste `.env`
+  values either.
+- Do not create SSH keys, edit `sshd_config`, or change the password unless the user asks
+  for that specifically. It is a shared account; changing it locks the admin out.
+
+The password reaches an agent only because the user supplies it in that session. If it is
+not in the conversation, it is not available — say so and ask, rather than hunting for it
+on disk. If the user wants to stop pasting it into chat, the macOS Keychain is the local
+fix (`security add-generic-password -s tadrisino-server -a administrator -w`, then read it
+back with `security find-generic-password -s tadrisino-server -w`), and an SSH key is the
+real one.
+
 `DEBUG` must never be `1` on this server: it turns on `DEV_MASTER_OTP` (`0000`), which
 accepts any phone number as a valid login, and renders tracebacks with settings in them.
 `DJANGO_DEBUG` belongs in `.env` only — not in the systemd unit, where it once sat as