feat: Add initial admin password setup flow

src/app/api/auth/login/route.ts

@@ -52,19 +52,30 @@ export async function POST(request: NextRequest) {
   }
 
   // Verify password
-  const passwordHash = process.env.ADMIN_PASSWORD_HASH;
+  const setting = await prisma.setting.findUnique({
+    where: { key: "admin_password_hash" },
+  });
 
-  // For development: if no hash is set, accept any non-empty password
   let isValid = false;
-  if (!passwordHash) {
-    isValid = body.password.length > 0;
+
+  if (!setting) {
+    // Initial setup: hash and save the new password
+    const argon2 = await import("argon2");
+    const newHash = await argon2.hash(body.password);
+    await prisma.setting.create({
+      data: {
+        key: "admin_password_hash",
+        value: newHash,
+      },
+    });
+    isValid = true;
   } else {
-    // Dynamic import to avoid issues when argon2 isn't installed
+    // Verify existing password
+    const passwordHash = setting.value;
     try {
       const argon2 = await import("argon2");
       isValid = await argon2.verify(passwordHash, body.password);
     } catch {
-      // Fallback: direct comparison (only for development)
       isValid = body.password === passwordHash;
     }
   }

src/app/api/auth/setup-status/route.ts

@@ -0,0 +1,18 @@
+import { NextResponse } from "next/server";
+import { prisma } from "@/lib/db";
+
+export async function GET() {
+  try {
+    const setting = await prisma.setting.findUnique({
+      where: { key: "admin_password_hash" },
+    });
+
+    return NextResponse.json({ setupRequired: !setting });
+  } catch (error) {
+    console.error("Failed to check setup status:", error);
+    return NextResponse.json(
+      { error: "Failed to check setup status" },
+      { status: 500 }
+    );
+  }
+}