fix(security): eliminate default admin password vulnerability

BREAKING CHANGE: Admin password is now auto-generated on first setup

Security improvements:
- Remove hardcoded 'admin123' password completely
- Generate secure random password on first installation
- Save credentials to ADMIN_CREDENTIALS.txt (git-ignored)
- Force password change on first login
- Implement strong password requirements (12+ chars, mixed case, numbers, special)
- Add password strength validation
- Increase bcrypt rounds from 10 to 12

New features:
- Password generator utility with secure random generation
- Human-readable password format (e.g., SwiftEagle3847\!)
- Password reset script for existing installations
- Comprehensive admin setup documentation
- Must-change-password flag in database

Migration guide:
- New installations: Check ADMIN_CREDENTIALS.txt for generated password
- Existing installations: Run scripts/reset-admin-password.js
- All users must change password on first login after update

This fixes a critical vulnerability where all installations used the same
default admin password, allowing unauthorized access.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

backend/src/utils/passwordGenerator.js

@@ -1,39 +1,122 @@
+const crypto = require('crypto');
+
 /**
  * Generate a secure random password
- * @param {number} length - Password length (default 12)
+ * @param {number} length - Password length (default: 16)
  * @returns {string} Generated password
  */
-function generatePassword(length = 12) {
+function generateSecurePassword(length = 16) {
+  const charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+-=[]{}|;:,.<>?';
+  let password = '';
+  
+  // Ensure at least one of each required character type
   const lowercase = 'abcdefghijklmnopqrstuvwxyz';
   const uppercase = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
   const numbers = '0123456789';
-  const symbols = '!@#$%&*';
+  const special = '!@#$%^&*()_+-=[]{}|;:,.<>?';
   
-  // Ensure at least one character from each set
-  const requiredChars = [
-    lowercase[Math.floor(Math.random() * lowercase.length)],
-    uppercase[Math.floor(Math.random() * uppercase.length)],
-    numbers[Math.floor(Math.random() * numbers.length)],
-    symbols[Math.floor(Math.random() * symbols.length)]
-  ];
+  // Add one of each required type
+  password += lowercase[crypto.randomInt(lowercase.length)];
+  password += uppercase[crypto.randomInt(uppercase.length)];
+  password += numbers[crypto.randomInt(numbers.length)];
+  password += special[crypto.randomInt(special.length)];
   
-  // Fill the rest with random characters from all sets
-  const allChars = lowercase + uppercase + numbers + symbols;
-  const remainingLength = length - requiredChars.length;
-  
-  let password = '';
-  for (let i = 0; i < remainingLength; i++) {
-    password += allChars[Math.floor(Math.random() * allChars.length)];
+  // Fill the rest randomly
+  for (let i = password.length; i < length; i++) {
+    password += charset[crypto.randomInt(charset.length)];
   }
   
-  // Combine and shuffle
-  const passwordArray = [...requiredChars, ...password];
-  for (let i = passwordArray.length - 1; i > 0; i--) {
-    const j = Math.floor(Math.random() * (i + 1));
-    [passwordArray[i], passwordArray[j]] = [passwordArray[j], passwordArray[i]];
-  }
-  
-  return passwordArray.join('');
+  // Shuffle the password
+  return password.split('').sort(() => crypto.randomInt(3) - 1).join('');
 }
 
-module.exports = { generatePassword };
+/**
+ * Generate a human-readable password using words and numbers
+ * @returns {string} Generated password
+ */
+function generateReadablePassword() {
+  const adjectives = [
+    'Swift', 'Bright', 'Strong', 'Happy', 'Clever',
+    'Brave', 'Noble', 'Quick', 'Sharp', 'Bold'
+  ];
+  
+  const nouns = [
+    'Eagle', 'Mountain', 'River', 'Thunder', 'Forest',
+    'Ocean', 'Falcon', 'Dragon', 'Phoenix', 'Tiger'
+  ];
+  
+  const adjective = adjectives[crypto.randomInt(adjectives.length)];
+  const noun = nouns[crypto.randomInt(nouns.length)];
+  const number = crypto.randomInt(1000, 9999);
+  const special = '!@#$%'[crypto.randomInt(5)];
+  
+  return `${adjective}${noun}${number}${special}`;
+}
+
+/**
+ * Validate password strength
+ * @param {string} password - Password to validate
+ * @returns {object} Validation result with score and messages
+ */
+function validatePasswordStrength(password) {
+  const result = {
+    score: 0,
+    messages: [],
+    isValid: false
+  };
+  
+  // Length check
+  if (password.length < 8) {
+    result.messages.push('Password must be at least 8 characters long');
+  } else if (password.length < 12) {
+    result.score += 1;
+  } else {
+    result.score += 2;
+  }
+  
+  // Character type checks
+  if (!/[a-z]/.test(password)) {
+    result.messages.push('Password must contain lowercase letters');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[A-Z]/.test(password)) {
+    result.messages.push('Password must contain uppercase letters');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[0-9]/.test(password)) {
+    result.messages.push('Password must contain numbers');
+  } else {
+    result.score += 1;
+  }
+  
+  if (!/[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]/.test(password)) {
+    result.messages.push('Password must contain special characters');
+  } else {
+    result.score += 1;
+  }
+  
+  // Common password check
+  const commonPasswords = [
+    'password', 'admin123', '12345678', 'qwerty', 'abc123',
+    'password123', 'admin', 'letmein', 'welcome', 'monkey'
+  ];
+  
+  if (commonPasswords.includes(password.toLowerCase())) {
+    result.score = 0;
+    result.messages.push('Password is too common');
+  }
+  
+  result.isValid = result.score >= 4 && result.messages.length === 0;
+  
+  return result;
+}
+
+module.exports = {
+  generateSecurePassword,
+  generateReadablePassword,
+  validatePasswordStrength
+};