v0.72.0: fix admin login — re-seed scrypt digest computed by verifyPassword() call

lib/db/client.ts

@@ -79,7 +79,10 @@ CREATE TABLE IF NOT EXISTS sessions (
 
 // v0.71.0: the seeded admin's scrypt hash (salt$hex). The plaintext exists only in the
 // operator's head — never in code, tests or comments; login verifies against this string.
-const ADMIN_SEED_HASH = '8dbed630b49a15073e8be571367c1858$0e5207dae2e3c813a7172a5f610fd47a90e8ff17513180ab1e0a7779c3766ef0';
+// v0.72.0: recomputed with exactly the same call as verifyPassword() — salt passed as a
+// plain string, scryptSync(pw, saltHex, 32) — because the v0.71.0 digest used different
+// parameters and real logins failed with 401.
+const ADMIN_SEED_HASH = '339149a14282ff3a2ed94534f9722aa4$abaf94cf073c5aafc892b4a39dce97aaf53ab6f7c662a588815bda1bc1771caf';
 
 // v0.71.0: idempotent admin seed — runs on every open(), no-ops when the row exists, so
 // pre-existing production DBs gain exactly one admin row and never a duplicate.
@@ -90,6 +93,13 @@ function seedAdminUser(raw: RawSqlJsDatabase): void {
      WHERE NOT EXISTS (SELECT 1 FROM users WHERE username = 'kamilkrzywda')`,
     [ADMIN_SEED_HASH, Date.now()],
   );
+  // v0.72.0: v0.71.0 seeded an incompatible digest into production DBs and the INSERT above
+  // can't overwrite them (WHERE NOT EXISTS), so rotate any legacy row to the current digest
+  // at boot — a no-op once healed, durable on the next persist().
+  raw.run(
+    `UPDATE users SET password_hash = ? WHERE id = 'admin-kamilkrzywda' AND password_hash != ?`,
+    [ADMIN_SEED_HASH, ADMIN_SEED_HASH],
+  );
 }
 
 // v0.7.0: DBs created by earlier versions lack the new columns; CREATE TABLE IF