fix(security): eliminate default admin password vulnerability

BREAKING CHANGE: Admin password is now auto-generated on first setup

Security improvements:
- Remove hardcoded 'admin123' password completely
- Generate secure random password on first installation
- Save credentials to ADMIN_CREDENTIALS.txt (git-ignored)
- Force password change on first login
- Implement strong password requirements (12+ chars, mixed case, numbers, special)
- Add password strength validation
- Increase bcrypt rounds from 10 to 12

New features:
- Password generator utility with secure random generation
- Human-readable password format (e.g., SwiftEagle3847\!)
- Password reset script for existing installations
- Comprehensive admin setup documentation
- Must-change-password flag in database

Migration guide:
- New installations: Check ADMIN_CREDENTIALS.txt for generated password
- Existing installations: Run scripts/reset-admin-password.js
- All users must change password on first login after update

This fixes a critical vulnerability where all installations used the same
default admin password, allowing unauthorized access.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/migrations/add_must_change_password.js

@@ -0,0 +1,25 @@
+const { db } = require('../src/database/db');
+
+async function addMustChangePasswordColumn() {
+  try {
+    // Check if the column already exists
+    const hasMustChangePassword = await db.schema.hasColumn('admin_users', 'must_change_password');
+    
+    if (!hasMustChangePassword) {
+      await db.schema.table('admin_users', (table) => {
+        table.boolean('must_change_password').defaultTo(false);
+      });
+      
+      console.log('✅ Added must_change_password column to admin_users table');
+    } else {
+      console.log('ℹ️  must_change_password column already exists');
+    }
+    
+    process.exit(0);
+  } catch (error) {
+    console.error('❌ Migration failed:', error);
+    process.exit(1);
+  }
+}
+
+addMustChangePasswordColumn();

backend/migrations/init.js

@@ -1,5 +1,8 @@
 const bcrypt = require('bcrypt');
 const { db, initializeDatabase } = require('../src/database/db');
+const { generateReadablePassword } = require('../src/utils/passwordGenerator');
+const fs = require('fs').promises;
+const path = require('path');
 
 async function runMigrations() {
   console.log('Running database migrations...');
@@ -11,19 +14,54 @@ async function runMigrations() {
     // Create default admin user if none exists
     const adminExists = await db('admin_users').first();
     if (!adminExists) {
-      const defaultPassword = 'admin123'; // Change this!
-      const passwordHash = await bcrypt.hash(defaultPassword, 10);
+      // Generate a secure random password
+      const generatedPassword = generateReadablePassword();
+      const passwordHash = await bcrypt.hash(generatedPassword, 12); // Increased rounds for better security
       
       await db('admin_users').insert({
         username: 'admin',
         email: 'admin@example.com',
-        password_hash: passwordHash
+        password_hash: passwordHash,
+        must_change_password: true, // Flag for forcing password change
+        created_at: new Date()
       });
       
-      console.log('Default admin user created:');
+      // Save the generated password to a file for the user to retrieve
+      const setupInfoPath = path.join(__dirname, '..', '..', 'ADMIN_CREDENTIALS.txt');
+      const setupInfo = `
+========================================
+PicPeak Admin Credentials
+========================================
+
+Your admin account has been created with these credentials:
+
+Username: admin
+Password: ${generatedPassword}
+
+IMPORTANT SECURITY NOTES:
+1. You MUST change this password on first login
+2. This file will be created only once
+3. Store these credentials securely
+4. Delete this file after noting the password
+
+Login URL: ${process.env.ADMIN_URL || 'http://localhost:3001'}/admin
+
+Generated on: ${new Date().toISOString()}
+========================================
+`;
+      
+      await fs.writeFile(setupInfoPath, setupInfo, 'utf8');
+      
+      console.log('\n========================================');
+      console.log('✅ Admin user created successfully!');
+      console.log('========================================');
       console.log('Username: admin');
-      console.log('Password: admin123');
-      console.log('⚠️  Please change this password immediately!');
+      console.log(`Password: ${generatedPassword}`);
+      console.log('\n⚠️  IMPORTANT:');
+      console.log('1. Save these credentials securely');
+      console.log('2. You will be required to change the password on first login');
+      console.log('3. Credentials are also saved in: ADMIN_CREDENTIALS.txt');
+      console.log('========================================\n');
     }
     
     // Create default email templates if none exist