Add local user authentication and admin capabilities

Implement local user authentication with password hashing, add admin roles for user management and audit log viewing, and introduce audit logging for critical actions.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 776963d0-f75d-42e2-a57b-cc36bdff8495
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 832a44ff-12ae-4096-8a0d-666ec083d536
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/0683fb79-a27c-485c-9333-5f4b288c4567/776963d0-f75d-42e2-a57b-cc36bdff8495/1p7jhzu
Replit-Helium-Checkpoint-Created: true

artifacts/api-server/src/index.ts

@@ -1,5 +1,8 @@
 import app from "./app";
 import { logger } from "./lib/logger";
+import bcrypt from "bcryptjs";
+import { db, usersTable } from "@workspace/db";
+import { sql } from "drizzle-orm";
 
 const rawPort = process.env["PORT"];
 
@@ -15,6 +18,30 @@ if (Number.isNaN(port) || port <= 0) {
   throw new Error(`Invalid PORT value: "${rawPort}"`);
 }
 
+async function seedAdminUser(): Promise<void> {
+  try {
+    const [row] = await db.select({ count: sql<number>`count(*)::int` }).from(usersTable);
+    if ((row?.count ?? 0) > 0) return;
+
+    const adminUsername = process.env.LOCAL_ADMIN_USERNAME || "admin";
+    const adminPassword = process.env.LOCAL_ADMIN_PASSWORD;
+    if (!adminPassword) {
+      logger.warn("LOCAL_ADMIN_PASSWORD is not set — skipping admin seed. Set it to enable local login.");
+      return;
+    }
+
+    const passwordHash = await bcrypt.hash(adminPassword, 10);
+    await db.insert(usersTable).values({
+      username: adminUsername,
+      passwordHash,
+      role: "admin",
+    });
+    logger.info({ username: adminUsername }, "Admin user created");
+  } catch (err) {
+    logger.error({ err }, "Failed to seed admin user");
+  }
+}
+
 app.listen(port, (err) => {
   if (err) {
     logger.error({ err }, "Error listening on port");
@@ -22,4 +49,5 @@ app.listen(port, (err) => {
   }
 
   logger.info({ port }, "Server listening");
+  seedAdminUser();
 });