What is the default Android Root Password? What is the default password for the Android root account? Can I change the root password after rooting my android device by simply typing passwd?

How does the rooting process work? If I use a "one click root" app, what is it doing to my phone?
root in Linux (or any Unix-like system) is just the user with User ID 0. The su program (which actually stands for "Switch User", not "Super User") is just a program to start another program with a different user ID than the starting program (by default to uid 0, which is to user root). Android does not use the traditional /etc/passwd, however it still uses Linux User ID and Group ID for managing permissions. 

If you want to intercept su requests so you can ask for password or enforce other rules, you will need to replace /sbin/su with your own version of su. Alternative approach is the one described here: http://www.koushikdutta.com/2008/11/fixing-su-security-hole-on-modified.html though that will require applications to cooperate by firing an Intent when they want to switch user.

Android security framework is more or less like this: each installed application runs on its own User ID (selected at installation time), and application permissions is implemented as user groups. 


  Can i change the root password after rooting my android device by simply typing "passwd"?


Android does not use /etc/passwd so it also does not have passwd program.


  how is the rooting process working ? i mean what is the "one click root" apps doing to my phone?


I'm not quire sure with the exact process myself, you probably want to ask to rooting developers. However, my guess is it just reverts the security check that originally prevent developer from setuid 0.


  And im a developer, so how can i find hidden APIs (like iOS) for rooted app development ?


Since Android is open source, there is no truly hidden API in Android. However, there are some unpublicized or undocumented APIs, you can browse for this in Android's source code. However, these APIs are not about root developments, they're usually in-development APIs that are not ready yet or is too localized for specific purpose that is not useful for public developer (or perhaps Google just haven't realized their usefulness yet). You are not restricted from using these APIs, but since these are not an officially supported APIs, they may disappear or break backward compatibilities in the future. If you need to use these APIs make sure your app breaks gracefully.