refactor(auth): harden console credential validation

[nbmaiti]

Summary

• replace direct credential string comparisons with secure validation
• hash and verify admin passwords using bcrypt
• use constant-time comparison for CIRA credential checks

Testing

• go test ./cmd/app ./internal/controller/httpapi/v1 ./internal/controller/tcp/cira

[codecov]

Codecov Report

❌ Patch coverage is 75.36232% with 17 lines in your changes missing coverage. Please review.
✅ Project coverage is 51.34%. Comparing base (a9001c9) to head (fd8a2d1).

Files with missing lines	Patch %	Lines
cmd/app/main.go	68.51%	12 Missing and 5 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1237      +/-   ##
==========================================
+ Coverage   50.83%   51.34%   +0.50%     
==========================================
  Files         149      149              
  Lines       13874    13918      +44     
==========================================
+ Hits         7053     7146      +93     
+ Misses       6217     6160      -57     
- Partials      604      612       +8     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟡 Changes recommended

The current startup path generates an admin password but only persists/logs its bcrypt hash (locking operators out), and the CIRA “constant-time” check still short-circuits on username mismatch, leaking failure type via timing.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

cmd/app/main.go:427

• On first run (when cfg.AdminPassword is empty), a random admin password is generated, immediately hashed, and only the hash is persisted/logged. That leaves operators with no way to learn the generated password, effectively locking them out unless they already set AUTH_ADMIN_PASSWORD. Either refuse to start and require an explicit password, or print the generated password once (with a strong warning) before hashing.

		password, err := generateRandomPassword(adminPasswordLength)
		if err != nil {
			log.Fatalf("Failed to generate admin password: %v", err)
		}

• Files reviewed: 8/8 changed files
• Comments generated: 2
• Review effort level: Lite