feat: bootstrap SuperAdmin from env and lock one-time seeding

Production creates the SuperAdmin from env credentials, and dashboard seeding is authenticated, SuperAdmin-only, and locked after the first run.

components/seed/seedLockModel.js

@@ -0,0 +1,36 @@
+// /components/seed/seedLockModel.js
+'use strict';
+
+const mongoose = require('mongoose');
+
+const SEED_LOCK_KEY = 'database_seed';
+
+const seedLockSchema = new mongoose.Schema({
+  key: {
+    type: String,
+    required: true,
+    unique: true,
+    default: SEED_LOCK_KEY,
+    index: true
+  },
+  locked: {
+    type: Boolean,
+    default: false
+  },
+  lockedAt: {
+    type: Date
+  },
+  lockedBy: {
+    type: mongoose.Schema.Types.ObjectId,
+    ref: 'User'
+  }
+}, {
+  timestamps: true
+});
+
+const SeedLock = mongoose.model('SeedLock', seedLockSchema);
+
+module.exports = {
+  SeedLock,
+  SEED_LOCK_KEY
+};