security: remove hardcoded admin credentials

backend/src/scripts/createAdmin.js

@@ -1,9 +1,15 @@
+require('dotenv').config()
+
 const bcrypt = require('bcrypt')
 const prisma = require('../config/prisma')
 
 async function createAdmin() {
-  const email = 'admin@thetiptop.fr'
-  const password = 'Admin@TipTop2026!'
+  const email = process.env.ADMIN_EMAIL
+  const password = process.env.ADMIN_PASSWORD
+
+  if (!email || !password) {
+    throw new Error('ADMIN_EMAIL et ADMIN_PASSWORD doivent être définis')
+  }
 
   const existing = await prisma.user.findUnique({ where: { email } })