Maintenance scripts load .env, so they reach the site's real database

scripts/backfill_vendor_from_model.py

@@ -33,9 +33,22 @@ Dry run by default; nothing is written without --commit.
 import argparse
 import os
 import sys
+from pathlib import Path
 
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
+from dotenv import load_dotenv
+
+# Load .env before anything reads config. wsgi.py does this for the served app
+# and the `flask` CLI does it for itself, but a plain `python scripts/...` run
+# gets neither: DATABASE_URL stays unset, FLASK_ENV defaults to development,
+# and config falls back to a hardcoded root@localhost URL. That fails on a real
+# deployment with a bare 1045 Access denied for 'root', naming a user the site
+# does not use - and on a box where those root credentials happen to work, it
+# is worse, because the script silently reads or WRITES the wrong database.
+load_dotenv(Path(__file__).resolve().parent.parent / '.env')
+
+
 # Each asset table that carries both a model link and its own vendor, with the
 # column that identifies a row in reports and logs.
 TARGETS = [