fix: treat SuperAdmin role name case-insensitively in permission checks

The seeded role is SuperAdmin, but the middleware only matched superAdmin, so SuperAdmin could be denied documents and other new permissions.

middlewares/permissionMiddleware.js

@@ -14,8 +14,8 @@ const requirePermission = (requiredPermission) => {
         return next(new AppError('FORBIDDEN'));
       }
 
-      // Check if user is superAdmin (by role name or system status)
-      if (role.name === 'superAdmin' || (role.isSystem && role.permissions.includes('*'))) {
+      const roleName = String(role.name || '').toLowerCase();
+      if (roleName === 'superadmin' || (role.isSystem && role.permissions.includes('*'))) {
         return next();
       }