Security: remove hardcoded credentials, require DB_PASSWORD, delete .bak file, warn on secrets template

k8s/bootstrap-secrets.yaml

@@ -1,3 +1,4 @@
+# WARNING: Replace CHANGE_ME_* values before applying
 apiVersion: v1
 kind: Secret
 metadata:

scripts/migrate-images.js

@@ -11,7 +11,11 @@ const pool = new Pool({
   port: 5432,
   database: 'lahuasca',
   user: 'lahuasca',
-  password: process.env.DB_PASSWORD || 'lahuasca123',
+  password: (() => {
+    const p = process.env.DB_PASSWORD;
+    if (!p) throw new Error('DB_PASSWORD env var is required');
+    return p;
+  })(),
 });
 
 async function convertToWebP(base64Data) {

src/hooks/useAuth.ts

@@ -18,17 +18,8 @@ export function useAuth() {
   }, []);
 
   const login = useCallback((username: string, password: string): boolean => {
+    // TODO: Implement server-side authentication via API call
     if (typeof window === 'undefined') return false;
-    if (username === 'admin' && password === 'admin') {
-      localStorage.setItem(ROLE_KEY, 'admin');
-      setRole('admin');
-      return true;
-    }
-    if (username === 'user' && password === 'user') {
-      localStorage.setItem(ROLE_KEY, 'user');
-      setRole('user');
-      return true;
-    }
     return false;
   }, []);