Initial vibeproxy implementation

Self-contained HTTP/HTTPS/TCP/UDP reverse proxy manager written in Go,
with SQLite storage, a Bootstrap 5 admin UI (Go templates, no JS
framework), and a REST API under /api/v1.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QTXFrNP1imCW7jtfL5SZrw

internal/auth/password_test.go

@@ -0,0 +1,54 @@
+package auth
+
+import "testing"
+
+func TestHashAndVerifyPassword(t *testing.T) {
+	hash, err := HashPassword("correct horse battery staple")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ok, err := VerifyPassword("correct horse battery staple", hash)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !ok {
+		t.Fatal("expected password to verify")
+	}
+	ok, err = VerifyPassword("wrong password", hash)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ok {
+		t.Fatal("expected wrong password to fail verification")
+	}
+}
+
+func TestGenerateRandomPassword(t *testing.T) {
+	p1, err := GenerateRandomPassword()
+	if err != nil {
+		t.Fatal(err)
+	}
+	p2, err := GenerateRandomPassword()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p1 == p2 {
+		t.Fatal("expected distinct random passwords")
+	}
+	if len(p1) < 20 {
+		t.Fatalf("password too short: %q", p1)
+	}
+}
+
+func TestAPITokenRoundTrip(t *testing.T) {
+	plaintext, hash, prefix, err := GenerateAPIToken()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if HashAPIToken(plaintext) != hash {
+		t.Fatal("hash mismatch")
+	}
+	if len(prefix) != 8 {
+		t.Fatalf("expected 8-char prefix, got %q", prefix)
+	}
+}