fix(security): eliminate default admin password vulnerability

BREAKING CHANGE: Admin password is now auto-generated on first setup

Security improvements:
- Remove hardcoded 'admin123' password completely
- Generate secure random password on first installation
- Save credentials to ADMIN_CREDENTIALS.txt (git-ignored)
- Force password change on first login
- Implement strong password requirements (12+ chars, mixed case, numbers, special)
- Add password strength validation
- Increase bcrypt rounds from 10 to 12

New features:
- Password generator utility with secure random generation
- Human-readable password format (e.g., SwiftEagle3847\!)
- Password reset script for existing installations
- Comprehensive admin setup documentation
- Must-change-password flag in database

Migration guide:
- New installations: Check ADMIN_CREDENTIALS.txt for generated password
- Existing installations: Run scripts/reset-admin-password.js
- All users must change password on first login after update

This fixes a critical vulnerability where all installations used the same
default admin password, allowing unauthorized access.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.gitignore

@@ -11,6 +11,12 @@ yarn-error.log*
 .env.test.local
 .env.production.local
 
+# Security - Never commit credentials
+ADMIN_CREDENTIALS.txt
+ADMIN_PASSWORD_RESET.txt
+*_CREDENTIALS.txt
+*_PASSWORD_RESET.txt
+
 # Storage and data
 storage/events/active/*
 storage/events/archived/*