fix: prevent auth bypass after onboarding (#151)

The 'no password' auth bypass check was meant for fresh installs only,
but it also fired after onboarding was complete if the password row
was missing from the database (e.g. after DB migration in v1.6.3).

Fix: Added !settings.setupComplete guard so the bypass only applies
before onboarding is done. Once setupComplete=true, auth is always
required regardless of whether the password key exists in the DB.

Files changed:
- src/proxy.ts (dashboard middleware)
- src/shared/utils/apiAuth.ts (isAuthRequired)

src/proxy.ts

@@ -131,9 +131,9 @@ export async function proxy(request) {
       if (settings.requireLogin === false) {
         return response;
       }
-      // Skip auth if no password has been set yet (fresh install with no env override)
-      // This prevents an unresolvable loop where requireLogin=true but no password exists
-      if (!settings.password && !process.env.INITIAL_PASSWORD) {
+      // Skip auth ONLY for fresh installs (before onboarding) where no password exists yet.
+      // Once setupComplete is true, always require auth — prevents bypass if password row is lost (#151)
+      if (!settings.setupComplete && !settings.password && !process.env.INITIAL_PASSWORD) {
         return response;
       }
     } catch (err) {

src/shared/utils/apiAuth.ts

@@ -134,8 +134,10 @@ export async function isAuthRequired(): Promise<boolean> {
   try {
     const settings = await getSettings();
     if (settings.requireLogin === false) return false;
-    // If no password set and no env override, don't require auth (fresh install)
-    if (!settings.password && !process.env.INITIAL_PASSWORD) return false;
+    // Only skip auth for fresh installs (not yet onboarded) with no password.
+    // Once setupComplete is true, always require auth — prevents bypass if password row is lost (#151)
+    if (!settings.setupComplete && !settings.password && !process.env.INITIAL_PASSWORD)
+      return false;
     return true;
   } catch {
     // On error, require auth (secure by default)