Stop committing the alerting-evaluator service password

reset-demo.sh carried EVALUATOR_PASSWORD as a literal, which put a
working service-account password in the repository. Anyone who could
read the source could log in as alerting-evaluator against the live demo
and mint an ALERTING_SERVICE_TOKEN whenever they liked -- so rotating
the token was theatre while the password that mints it stayed published.

Nothing needed it to be a constant. The account exists only to mint that
token a few lines later, and `docker compose down -v` earlier in the
same script has already destroyed the previous account, so the value
never outlives a single reset. Generated per run instead.

DEMO_PASSWORD directly above is deliberately left alone: it is a public
demo credential, prefilled on the login page and baked into the web
bundle at build time from the demo host's compose override. Randomising
it would break the demo's own login form, and it protects nothing.

hack/demo-seed/reset-demo.sh

@@ -33,7 +33,20 @@ ADMIN_PASSWORD_FILE="$DEMO_ROOT/.admin-password"
 # demo host's docker-compose.override.yml. Change one without the other
 # and the demo's own login form stops working.
 DEMO_PASSWORD='CairnDemo_2026!'
-EVALUATOR_PASSWORD='REDACTED_ROTATED_CREDENTIAL'
+# Generated fresh every run, never committed. This account exists only
+# to mint the ALERTING_SERVICE_TOKEN a few lines below, and `docker
+# compose down -v` above has already destroyed the previous one, so the
+# value never needs to outlive a single reset -- there is nothing to
+# remember and therefore no reason to hardcode it. It used to be a
+# literal in this file, which put a working service-account password in
+# the repo: anyone who could read the source could mint an
+# alerting-evaluator token against the live demo at will, and rotating
+# the token achieved nothing while the password that mints it stayed
+# published.
+#
+# Unlike DEMO_PASSWORD above, this one is never shown to a user and is
+# not baked into the web bundle, so randomising it breaks nothing.
+EVALUATOR_PASSWORD="$(openssl rand -base64 24)"
 
 echo "=== $(date -u +%FT%TZ) reset starting ==="