feat: bootstrap SuperAdmin from env and lock one-time seeding

Production creates the SuperAdmin from env credentials, and dashboard seeding is authenticated, SuperAdmin-only, and locked after the first run.

components/auth/authService.js

@@ -5,6 +5,7 @@ const bcrypt = require('bcryptjs');
 const User = require('../users/userModel');
 const config = require('../../config/config');
 const AppError = require('../../utils/AppError');
+const { isBootstrapSuperAdminDisabled } = require('../../utils/superAdmin');
 
 const generateTokens = (user) => {
   const payload = {
@@ -26,7 +27,7 @@ const generateTokens = (user) => {
 
 const login = async (username, password) => {
   const user = await User.findOne({ username }).populate('role');
-  if (!user || !user.isActive) {
+  if (!user || !user.isActive || isBootstrapSuperAdminDisabled(user)) {
     throw new AppError('INVALID_CREDENTIALS');
   }
 
@@ -63,7 +64,7 @@ const refreshToken = async (refreshTokenString) => {
   }
 
   const user = await User.findById(decoded.id).populate('role');
-  if (!user || !user.isActive) {
+  if (!user || !user.isActive || isBootstrapSuperAdminDisabled(user)) {
     throw new AppError('INVALID_REFRESH_TOKEN');
   }