docs: record web credential rotation

.project-docs/30-worklog/task-history.md

@@ -4,6 +4,7 @@
 
 | Date | Task | Outcome | Docs Updated |
 |---|---|---|---|
+| 2026-07-31 | Rotate the ARR Web login credentials | Updated the two existing macOS Keychain-backed runtime values without storing them in source or process arguments, normalized the password item's account metadata and performed one controlled port-8766 restart under detached Screen. The prior pair returns 401, the new pair passes session/cookie/CSRF/logout plus desktop/H5 and all six readiness flags, and loopback/current LAN health return 200. Two read-only snapshots stayed at 30 daily jobs, 4 monthly versions and 4 company jobs; latest business records predate restart, nine focused tests pass and literal/process scans are clean. The requested password still equals the username, so the strength follow-up remains open | Current state/history, login-runtime evidence/index, stale items, commitments, scoped planning record |
 | 2026-07-31 | Allow early company-channel report generation and rename period states | Removed the old time-release gate from company-channel generation. Current-month incomplete periods now generate from the current committed Finance snapshot with the existing fixed C/O cutoff; historical months can rerun, while future months remain blocked. Replaced the permission-oriented state copy with `周期未结束` / `周期已结束` and added a confirmation warning that later data requires rerun. `node --check`, Python compilation, HTML parsing, 28 focused tests and the project-venv full discovery of 348 tests with 10 skips pass; no report or business data was generated | Business rules, current state/history, evidence topic/index, scoped planning record |
 | 2026-07-31 | Simplify company-channel period card labels | Removed the visible `第一期`/`第二期`/`第三期` copy and changed the three card headlines to `C/O:01-10`, `C/O:11-20`, plus a month-aware final range (`C/O:21-30` or `C/O:21-31`). Release status and opening time remain visible; internal period keys and generation requests are unchanged. JavaScript/HTML checks, 28 focused tests, 348-test discovery and isolated 1280×720/390×844 browser QA pass with no overflow or page-console warnings | Current state/history, module map, company-period evidence/index |
 | 2026-07-31 | Simplify company report result details | Collapsed duplicate review problems by type/code/period; replaced the user-facing `版本` column with `生成时间` from job completion time, with creation-time fallback. Internal `version_no` API data remains unchanged. JavaScript/HTML checks, 28 focused tests and targeted deduplication execution pass | Current state/history, module map, company-period evidence/index |