feat: warn on /account.html when password is still default (#18)

On page load, /account.html now probes JSS's PUT /idp/credentials
with {currentPassword:"me", newPassword:"me"} via session.authFetch.
- 204 (current matches) → red warning banner above the password
  form: "You're using the default password. Change it below to
  claim your pod."
- 401 (current doesn't match) → no banner.

The probe is server-side truth (no localStorage state to go stale
across browsers). Side effect is a bcrypt re-hash of the same value
when the password is still default — rate-limited 10/min per IP by
JSS, no functional change.

After a successful password update, the warning is hidden
synchronously (no reload needed). On subsequent loads the probe
sees 401 and the warning stays gone.

Refs #1 #6

Author: melvincarvalho

account.html

@@ -49,6 +49,9 @@ <h2>Explore</h2>
   </div>
 
   <h2>Password</h2>
+  <div id="pw-default-warning" hidden style="background:#fff0f0;border:1px solid #f4a4a4;color:#a00;padding:.7em .9em;border-radius:8px;margin:.5em 0;font-size:.95em">
+    <strong>You're using the default password.</strong> Change it below to claim your pod.
+  </div>
   <p id="pw-hint" style="margin:.25em 0 .5em;color:#666;font-size:.9em">Climb from rung 1 (default <code>me</code>) to rung 2 (your password).</p>
   <button class="btn btn-secondary" id="pw-toggle" type="button">Change password</button>
   <form id="pw-form" hidden style="margin:.75em 0 0;display:grid;gap:.5em;max-width:360px">
@@ -127,6 +130,28 @@ <h2>Session</h2>
     // Profile link strips the fragment (WebID typically ends with #me)
     document.getElementById('profile-link').href = webid.replace(/#.*/, '');
     signedInEl.hidden = false;
+
+    // Background probe: is the password still the default rung-1 'me'?
+    // We send PUT /idp/credentials with {currentPassword:'me',newPassword:'me'}
+    // — JSS returns 204 when the current password matches (no-op re-hash),
+    // 401 when it doesn't. Show the climb warning only on 204.
+    // The probe runs fire-and-forget so the rest of the dashboard renders
+    // immediately; the warning fades in once we know.
+    (async () => {
+      try {
+        const res = await session.authFetch(new URL('./idp/credentials', window.location.href).href, {
+          method: 'PUT',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ currentPassword: 'me', newPassword: 'me' })
+        });
+        if (res.ok) {
+          document.getElementById('pw-default-warning').hidden = false;
+        }
+      } catch {
+        // Best-effort: rate-limited or transient. No warning shown.
+      }
+    })();
+
     document.getElementById('signout-btn').addEventListener('click', async () => {
       try {
         await session.logout();
@@ -195,6 +220,8 @@ <h2>Session</h2>
         }
         pwStatus('Password updated. You\'re on rung 2 now.');
         pwCurrent.value = pwNew.value = pwConfirm.value = '';
+        // Hide the default-password warning if it was showing.
+        document.getElementById('pw-default-warning').hidden = true;
       } catch (e) {
         pwStatus('Change failed: ' + (e.message || String(e)), true);
       } finally {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "jspod",
-  "version": "0.0.19",
+  "version": "0.0.20",
   "description": "JavaScript Solid Pod - Just works, batteries included",
   "type": "module",
   "main": "index.js",