fix: show hero image in thumbnail grid on hero gallery layout

backend/src/routes/adminEvents.js

@@ -1,7 +1,7 @@
 const express = require('express');
 const { body, query, validationResult } = require('express-validator');
 const { db, logActivity } = require('../database/db');
-const { adminAuth } = require('../middleware/auth');
+const { adminAuth } = require('../middleware/auth-enhanced-v2');
 const router = express.Router();
 const bcrypt = require('bcrypt');
 const crypto = require('crypto');
@@ -10,6 +10,7 @@ const path = require('path');
 const { archiveEvent } = require('../services/archiveService');
 const { escapeLikePattern } = require('../utils/sqlSecurity');
 const { formatDate } = require('../utils/dateFormatter');
+const { validatePasswordInContext, getBcryptRounds } = require('../utils/passwordValidation');
 
 // Create new event
 router.post('/', adminAuth, [
@@ -49,6 +50,20 @@ router.post('/', adminAuth, [
       upload_category_id = null
     } = req.body;
     
+    // Validate password strength
+    const passwordValidation = validatePasswordInContext(password, 'gallery', {
+      eventName: event_name
+    });
+    
+    if (!passwordValidation.valid) {
+      return res.status(400).json({ 
+        error: 'Password does not meet security requirements',
+        details: passwordValidation.errors,
+        score: passwordValidation.score,
+        feedback: passwordValidation.feedback
+      });
+    }
+    
     // Generate unique slug
     const baseSlug = `${event_type}-${event_name.toLowerCase().replace(/[^a-z0-9]/g, '-')}-${event_date}`;
     let slug = baseSlug;
@@ -63,8 +78,8 @@ router.post('/', adminAuth, [
     const shareToken = crypto.randomBytes(16).toString('hex');
     const shareLink = `${process.env.FRONTEND_URL}/gallery/${slug}/${shareToken}`;
     
-    // Hash password
-    const password_hash = await bcrypt.hash(password, 10);
+    // Hash password with configurable rounds
+    const password_hash = await bcrypt.hash(password, getBcryptRounds());
     
     // Calculate expiration date (days after event date)
     const expires_at = new Date(event_date);