Improve login page security by dynamically showing default credentials

Adds API endpoint to check default admin password status and hides credentials.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 91318273-c764-4fd4-be04-bdc12c38af32
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/0715008c-7244-40f4-befc-26c014852236/22c32c18-bf03-4830-a5c9-ef4544d0e27f.jpg

replit.md

@@ -174,4 +174,10 @@ Preferred communication style: Simple, everyday language.
 - ✅ Backup files stored in server/backups/ directory with timestamped filenames
 - ✅ Enhanced administration interface showing backup statistics and manual backup creation
 - ✅ Real-time backup status monitoring with automatic stats refresh every 30 seconds
-- ✅ Initial backup creation on server startup if no backups exist
+- ✅ Initial backup creation on server startup if no backups exist
+
+### Security Improvements (January 9, 2025)
+- ✅ Enhanced login page to hide default admin credentials (admin/admin123) once password is changed
+- ✅ Added dynamic credential visibility based on whether default password is still in use
+- ✅ Security warning displayed when default credentials are shown
+- ✅ API endpoint to check default credential status with password hash comparison