feat: bootstrap SuperAdmin from env and lock one-time seeding

Production creates the SuperAdmin from env credentials, and dashboard seeding is authenticated, SuperAdmin-only, and locked after the first run.

seed.js

@@ -119,27 +119,71 @@ const seedDatabase = async ({ disconnectOnComplete = false } = {}) => {
     }
 
     let superAdminStatus = 'unchanged';
-    // Ensure SuperAdmin user exists
     const superAdminRole = await Role.findOne({ name: 'SuperAdmin' });
-    if (superAdminRole) {
-      const adminUser = await User.findOne({ username: config.SUPERADMIN_USERNAME });
+    const username = config.SUPERADMIN_USERNAME && String(config.SUPERADMIN_USERNAME).trim();
+
+    if (!superAdminRole) {
+      superAdminStatus = 'role_missing';
+    } else if (!config.SUPERADMIN_ENABLED) {
+      if (username) {
+        const adminUser = await User.findOne({ username });
+        if (adminUser && (adminUser.isActive || adminUser.refreshTokens.length > 0)) {
+          adminUser.isActive = false;
+          adminUser.refreshTokens = [];
+          await adminUser.save();
+          superAdminStatus = 'disabled';
+          console.log(`SuperAdmin user disabled (${username}).`);
+        } else {
+          superAdminStatus = adminUser ? 'already_disabled' : 'skipped_disabled';
+        }
+      } else {
+        superAdminStatus = 'skipped_disabled';
+      }
+    } else if (!username || !config.SUPERADMIN_PASSWORD) {
+      throw new Error('SUPERADMIN_USERNAME and SUPERADMIN_PASSWORD must be set in env when SUPERADMIN_ENABLED is true');
+    } else {
+      const adminUser = await User.findOne({ username });
       if (!adminUser) {
         const passwordHash = await bcrypt.hash(config.SUPERADMIN_PASSWORD, 10);
         await User.create({
           name: 'مدیر',
           surname: 'ارشد',
-          nationalId: config.SUPERADMIN_NATIONAL_ID,
-          phone: config.SUPERADMIN_PHONE,
-          email: config.SUPERADMIN_EMAIL,
-          username: config.SUPERADMIN_USERNAME,
+          nationalIdCode: config.SUPERADMIN_NATIONAL_ID,
+          phoneNumber: config.SUPERADMIN_PHONE,
+          email: config.SUPERADMIN_EMAIL || undefined,
+          username,
           passwordHash,
           role: superAdminRole._id,
           isActive: true
         });
         superAdminStatus = 'created';
-        console.log(`SuperAdmin user created (${config.SUPERADMIN_USERNAME}).`);
+        console.log(`SuperAdmin user created (${username}).`);
       } else {
-        superAdminStatus = 'already_exists';
+        let changed = false;
+        if (!adminUser.isActive) {
+          adminUser.isActive = true;
+          changed = true;
+        }
+
+        const passwordMatches = await bcrypt.compare(config.SUPERADMIN_PASSWORD, adminUser.passwordHash);
+        if (!passwordMatches) {
+          adminUser.passwordHash = await bcrypt.hash(config.SUPERADMIN_PASSWORD, 10);
+          adminUser.refreshTokens = [];
+          changed = true;
+        }
+
+        if (config.SUPERADMIN_EMAIL && adminUser.email !== config.SUPERADMIN_EMAIL.toLowerCase()) {
+          adminUser.email = config.SUPERADMIN_EMAIL;
+          changed = true;
+        }
+
+        if (changed) {
+          await adminUser.save();
+          superAdminStatus = 'updated';
+          console.log(`SuperAdmin user updated (${username}).`);
+        } else {
+          superAdminStatus = 'already_exists';
+        }
       }
     }