-- Security audit L08: an owner account still on the old published starting password is locked (no password).
-- It is unlocked with OWNER_PASSWORD in .env (applied at the next start), scripts/create-owner.mjs, or
-- "Forgot your password?". Accounts whose password was changed are not touched.
UPDATE users SET password_hash = '!', must_change_password = false
 WHERE password_hash = 'scrypt$16384$8$1$V9EzRTnzi3asMzwWv2Sw+g==$YZHSvma12BeFFqc0Eifq0lPRkEt3nXybQGDJiVxoFLHxrqSdzXdtDCp32KlJBLGJF+LgpPb6yaFhmcGb9EdgZQ==';
DELETE FROM sessions WHERE user_id IN (SELECT id FROM users WHERE password_hash = '!');