feat(security): implement bcrypt hashing for admin password and cleanup Dockerfile

app/api/admin/login/route.ts

@@ -1,16 +1,21 @@
 import { NextResponse } from 'next/server';
+import bcrypt from 'bcryptjs';
 
 export async function POST(request: Request) {
     try {
         const { password } = await request.json();
-        const adminPassword = process.env.ADMIN_PASSWORD || 'admin123'; // Default for dev if not set
+        // Default is hash for 'admin123'
+        const adminPasswordHash = process.env.ADMIN_PASSWORD || '$2b$10$SHOt9G1qUNIvHoWre7499.eEtp5PtOII0daOQGNV.dhDEuPmOUdsq';
 
-        if (password === adminPassword) {
+        const isValid = await bcrypt.compare(password, adminPasswordHash);
+
+        if (isValid) {
             return NextResponse.json({ success: true });
         } else {
             return NextResponse.json({ error: 'Invalid password' }, { status: 401 });
         }
     } catch (error) {
+        console.error('Login error:', error);
         return NextResponse.json({ error: 'Internal Server Error' }, { status: 500 });
     }
 }