Harden public Odoo startup credentials

[cbusillo]

Summary

• fail public/non-local Odoo startup when the master password uses a default value
• require an explicit admin password for public runtimes before startup proceeds
• always run the active admin/default-password check for public runtimes
• document the public runtime credential boundary

Refs #32
Refs cbusillo/launchplane#492
Refs cbusillo/odoo-tenant-cm#29

Validation

• uv run ruff check docker/scripts/run_odoo_startup.py tests/test_odoo_startup.py
• uv run ruff format --check docker/scripts/run_odoo_startup.py tests/test_odoo_startup.py
• uv run python -m unittest discover -s tests