fix(auth): reset demo password only outside production

Keep demo login predictable in development without overwriting stored hashes when NODE_ENV is production.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/auth/auth.service.ts

@@ -99,14 +99,25 @@ export class AuthService {
   }
 
   seedDemoAccount(): void {
+    const demoPasswordHash = bcrypt.hashSync('123456', 10)
     const demo = this.findAccountByUsername('demo')
-    if (demo) return
+
+    if (demo) {
+      // Dev DB may retain a stale hash after recovery/migration — keep demo login predictable.
+      if (process.env.NODE_ENV !== 'production') {
+        this.database
+          .getDb()
+          .prepare('UPDATE auth_accounts SET password_hash = ? WHERE username = ?')
+          .run(demoPasswordHash, 'demo')
+      }
+      return
+    }
 
     this.users.ensureUser('demo')
     const account: AuthAccount = {
       id: randomUUID(),
       username: 'demo',
-      passwordHash: bcrypt.hashSync('123456', 10),
+      passwordHash: demoPasswordHash,
       userId: 'demo',
       createdAt: new Date().toISOString(),
     }