fix: add fallback password for server-side auth validation

Client-side used 'cz-2025' as fallback but server-side getDefaultPassword()
returned undefined when env vars weren't set, causing auth failures after
registration.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/lib/auth/session.ts

@@ -82,8 +82,8 @@ export function parseBasicAuthHeader(authHeader: string): { username: string; pa
 
 /**
  * Get the user password from environment
- * Returns undefined if not set
+ * Falls back to 'cz-2025' if not set
  */
-export function getDefaultPassword(): string | undefined {
-  return process.env.BASIC_AUTH_PASSWORD || process.env.NEXT_PUBLIC_DEFAULT_PASSWORD;
+export function getDefaultPassword(): string {
+  return process.env.BASIC_AUTH_PASSWORD || process.env.NEXT_PUBLIC_DEFAULT_PASSWORD || 'cz-2025';
 }