feat: Add initial admin password setup flow

src/app/api/auth/login/route.ts

@@ -52,19 +52,30 @@ export async function POST(request: NextRequest) {
   }
 
   // Verify password
-  const passwordHash = process.env.ADMIN_PASSWORD_HASH;
+  const setting = await prisma.setting.findUnique({
+    where: { key: "admin_password_hash" },
+  });
 
-  // For development: if no hash is set, accept any non-empty password
   let isValid = false;
-  if (!passwordHash) {
-    isValid = body.password.length > 0;
+
+  if (!setting) {
+    // Initial setup: hash and save the new password
+    const argon2 = await import("argon2");
+    const newHash = await argon2.hash(body.password);
+    await prisma.setting.create({
+      data: {
+        key: "admin_password_hash",
+        value: newHash,
+      },
+    });
+    isValid = true;
   } else {
-    // Dynamic import to avoid issues when argon2 isn't installed
+    // Verify existing password
+    const passwordHash = setting.value;
     try {
       const argon2 = await import("argon2");
       isValid = await argon2.verify(passwordHash, body.password);
     } catch {
-      // Fallback: direct comparison (only for development)
       isValid = body.password === passwordHash;
     }
   }