They can detain you indefinitely even if you're a US Citizen, but afterwards they will be sending you a rather sizable check to settle the lawsuit you file for getting your civil rights violated.
Unless you commit a crime crossing the border (like getting caught with drugs), CBP does not have the authority to detain a US citizen without probable cause. Refusing to provide a password is not probable cause.
