access-list: Hash basic-auth passwords and redact API reads

Access-list item passwords were stored and returned in plaintext.
Hash on write with bcrypt, compare hashes in the proxy engine (with
legacy plaintext fallback), and omit passwords from admin GET JSON.

internal/proxy/engine.go

@@ -1,6 +1,7 @@
 package proxy
 
 import (
+	"golang.org/x/crypto/bcrypt"
 	"context"
 	"crypto/tls"
 	"encoding/base64"
@@ -349,7 +350,7 @@ func (e *Engine) Handler() http.Handler {
 			user, pass := creds[0], creds[1]
 			authed := false
 			for _, item := range hcfg.AccessItems {
-				if item.Username == user && item.Password == pass { // demo: plain compare; real would hash
+				if item.Username == user && accessListPasswordOK(item.Password, pass) {
 					authed = true
 					break
 				}
@@ -1250,3 +1251,15 @@ func parseAdvancedConfig(adv string) (reqSets map[string]string, respAdds map[st
 	}
 	return
 }
+
+
+func accessListPasswordOK(stored, provided string) bool {
+	if stored == "" {
+		return false
+	}
+	if strings.HasPrefix(stored, "$2a$") || strings.HasPrefix(stored, "$2b$") || strings.HasPrefix(stored, "$2y$") {
+		return bcrypt.CompareHashAndPassword([]byte(stored), []byte(provided)) == nil
+	}
+	// Legacy plaintext rows until re-saved via admin API.
+	return stored == provided
+}