Maintenance scripts load .env, so they reach the site's real database

scripts/reclassify_servers_to_network.py

@@ -19,10 +19,23 @@ Usage (on the target instance, in the app dir):
 import argparse
 import os
 import sys
+from pathlib import Path
 
 # Run from anywhere: put the repo root (parent of scripts/) on the path.
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
+from dotenv import load_dotenv
+
+# Load .env before anything reads config. wsgi.py does this for the served app
+# and the `flask` CLI does it for itself, but a plain `python scripts/...` run
+# gets neither: DATABASE_URL stays unset, FLASK_ENV defaults to development,
+# and config falls back to a hardcoded root@localhost URL. That fails on a real
+# deployment with a bare 1045 Access denied for 'root', naming a user the site
+# does not use - and on a box where those root credentials happen to work, it
+# is worse, because the script silently reads or WRITES the wrong database.
+load_dotenv(Path(__file__).resolve().parent.parent / '.env')
+
+
 from shopdb import create_app
 from shopdb.api import db
 from shopdb.core.models import Asset, AssetType