fix: close remaining security remediation gaps

go-backend/internal/security/password.go

@@ -23,3 +23,17 @@ func VerifyPassword(storedHash, plain string) (bool, bool) {
 	}
 	return false, false
 }
+
+func IsLegacyPasswordHash(storedHash string) bool {
+	storedHash = strings.TrimSpace(storedHash)
+	if len(storedHash) != 32 {
+		return false
+	}
+	for _, r := range storedHash {
+		if (r >= '0' && r <= '9') || (r >= 'a' && r <= 'f') || (r >= 'A' && r <= 'F') {
+			continue
+		}
+		return false
+	}
+	return true
+}

go-backend/internal/security/password_test.go

@@ -23,3 +23,16 @@ func TestVerifyPasswordAcceptsLegacyMD5(t *testing.T) {
 		t.Fatalf("VerifyPassword() = (%v,%v), want (true,true)", ok, legacy)
 	}
 }
+
+func TestIsLegacyPasswordHash(t *testing.T) {
+	if !IsLegacyPasswordHash("3c85cdebade1c51cf64ca9f3c09d182d") {
+		t.Fatal("expected 32-char hex MD5 hash to be legacy")
+	}
+	hash, err := HashPassword("admin_user")
+	if err != nil {
+		t.Fatalf("HashPassword() error = %v", err)
+	}
+	if IsLegacyPasswordHash(hash) {
+		t.Fatalf("expected bcrypt hash not to be legacy: %q", hash)
+	}
+}