Improve login page security by dynamically showing default credentials

Adds API endpoint to check default admin password status and hides credentials.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 91318273-c764-4fd4-be04-bdc12c38af32
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/0715008c-7244-40f4-befc-26c014852236/22c32c18-bf03-4830-a5c9-ef4544d0e27f.jpg

server/storage.ts

@@ -39,6 +39,7 @@ export interface IStorage {
   authenticateUser(username: string, password: string): Promise<User | null>;
   hashPassword(password: string): Promise<string>;
   initializeDefaults(): Promise<{ defaultAdminCredentials?: { username: string; password: string } }>;
+  isUsingDefaultPassword(): Promise<boolean>;
 }
 
 export class DatabaseStorage implements IStorage {
@@ -168,6 +169,17 @@ export class DatabaseStorage implements IStorage {
     return await bcrypt.hash(password, 12);
   }
 
+  // Check if admin still uses default password
+  async isUsingDefaultPassword(): Promise<boolean> {
+    const adminUser = await this.getUserByUsername('admin');
+    if (!adminUser) {
+      return false;
+    }
+    
+    // Check if the stored password hash matches the default password "admin123"
+    return await bcrypt.compare('admin123', adminUser.password);
+  }
+
   // Initialize default admin user and store if none exist
   async initializeDefaults(): Promise<{ defaultAdminCredentials?: { username: string; password: string } }> {
     const existingUsers = await this.getAllUsers();