feat: bootstrap SuperAdmin from env and lock one-time seeding

Production creates the SuperAdmin from env credentials, and dashboard seeding is authenticated, SuperAdmin-only, and locked after the first run.

components/seed/seedService.js

@@ -0,0 +1,45 @@
+// /components/seed/seedService.js
+'use strict';
+
+const { SeedLock, SEED_LOCK_KEY } = require('./seedLockModel');
+const seedDatabase = require('../../seed');
+const AppError = require('../../utils/AppError');
+
+const getStatus = async () => {
+  const doc = await SeedLock.findOne({ key: SEED_LOCK_KEY }).lean();
+  return {
+    locked: Boolean(doc?.locked),
+    lockedAt: doc?.lockedAt || null
+  };
+};
+
+const runSeed = async (userId) => {
+  const existing = await SeedLock.findOne({ key: SEED_LOCK_KEY });
+  if (existing?.locked) {
+    throw new AppError('SEED_LOCKED');
+  }
+
+  const result = await seedDatabase({ disconnectOnComplete: false });
+
+  await SeedLock.findOneAndUpdate(
+    { key: SEED_LOCK_KEY },
+    {
+      $set: {
+        locked: true,
+        lockedAt: new Date(),
+        lockedBy: userId || undefined
+      }
+    },
+    { upsert: true, new: true }
+  );
+
+  return {
+    ...result,
+    locked: true
+  };
+};
+
+module.exports = {
+  getStatus,
+  runSeed
+};