fix(api,web): corrections auth — gestion d'erreur login, messages explicites

- web: auth/errors (+ tests), LoginPage, client API
- api: auth controller/service

Refs: #14

apps/api/src/auth/auth.controller.ts

@@ -19,7 +19,7 @@ export class AuthController {
   constructor(private readonly auth: AuthService) {}
 
   @Get("status")
-  status() {
+  async status() {
     return this.auth.status();
   }
 

apps/api/src/auth/auth.service.ts

@@ -33,12 +33,23 @@ export class AuthService implements OnModuleInit {
     return this.createUser({ ...input, role: "admin" });
   }
 
-  status() {
+  async status() {
     const existing = this.database.db.select({ id: users.id }).from(users).limit(1).get();
+    const initialAdmin = this.database.db
+      .select({ passwordHash: users.passwordHash, role: users.role })
+      .from(users)
+      .where(eq(users.email, this.database.config.initialAdminEmail.toLowerCase()))
+      .get();
+    const initialAdminPasswordIsDefault =
+      Boolean(initialAdmin) &&
+      initialAdmin?.role === "admin" &&
+      this.database.config.initialAdminPasswordIsDefault &&
+      (await argon2.verify(initialAdmin.passwordHash, this.database.config.initialAdminPassword));
+
     return {
       hasUsers: Boolean(existing),
       initialAdminEmail: this.database.config.initialAdminEmail.toLowerCase(),
-      initialAdminPasswordIsDefault: this.database.config.initialAdminPasswordIsDefault
+      initialAdminPasswordIsDefault
     };
   }