feat: bootstrap SuperAdmin from env and lock one-time seeding

Production creates the SuperAdmin from env credentials, and dashboard seeding is authenticated, SuperAdmin-only, and locked after the first run.

utils/superAdmin.js

@@ -0,0 +1,23 @@
+// /utils/superAdmin.js
+const config = require('../config/config');
+
+const usernamesMatch = (left, right) => {
+  if (!left || !right) return false;
+  return String(left).trim().toLowerCase() === String(right).trim().toLowerCase();
+};
+
+const isBootstrapSuperAdmin = (userOrUsername) => {
+  const username = typeof userOrUsername === 'string'
+    ? userOrUsername
+    : userOrUsername?.username;
+  return usernamesMatch(username, config.SUPERADMIN_USERNAME);
+};
+
+const isBootstrapSuperAdminDisabled = (userOrUsername) => {
+  return !config.SUPERADMIN_ENABLED && isBootstrapSuperAdmin(userOrUsername);
+};
+
+module.exports = {
+  isBootstrapSuperAdmin,
+  isBootstrapSuperAdminDisabled
+};