feat: bootstrap SuperAdmin from env and lock one-time seeding

Production creates the SuperAdmin from env credentials, and dashboard seeding is authenticated, SuperAdmin-only, and locked after the first run.

app.js

@@ -78,20 +78,7 @@ app.get('/api/health', (req, res) => {
 });
 
 const seedDatabase = require('./seed');
-const { successResponse, errorResponse } = require('./utils/apiResponse');
-
-const handleSeedRequest = async (req, res) => {
-  try {
-    const result = await seedDatabase({ disconnectOnComplete: false });
-    return successResponse(res, 200, 'Database seeded successfully', result);
-  } catch (error) {
-    return errorResponse(res, 500, 'SEED_FAILED', error.message);
-  }
-};
-
-app.post('/api/seed', handleSeedRequest);
-app.get('/api/seed', handleSeedRequest);
-
+const seedRoutes = require('./components/seed/seedRoutes');
 
 app.use('/api/auth', authRoutes);
 app.use('/api/users', userRoutes);
@@ -107,6 +94,7 @@ app.use('/api/files', fileRoutes);
 app.use('/api/dashboard', dashboardRoutes);
 app.use('/api/activity-logs', activityLogRoutes);
 app.use('/api/contact-inquiries', contactInquiryRoutes);
+app.use('/api/seed', seedRoutes);
 
 // ── Error Handlers ────────────────────────────────────────────────────────────
 app.use(notFoundHandler);
@@ -118,6 +106,11 @@ const PORT = config.PORT || 3000;
 const startServer = async () => {
   await connectDB();
 
+  if (config.NODE_ENV === 'production') {
+    logger.info('Running production bootstrap (roles + SuperAdmin from env)');
+    await seedDatabase({ disconnectOnComplete: false });
+  }
+
   const registerEventListeners = require('./events/eventListeners');
   const { startPaymentReminderJob } = require('./jobs/paymentReminderJob');
   const { startNotificationRetryJob } = require('./jobs/notificationRetryJob');