Production creates the SuperAdmin from env credentials, and dashboard seeding is authenticated, SuperAdmin-only, and locked after the first run.
Express/MongoDB backend with JWT auth, RBAC, S3 uploads, notifications, and scheduled jobs.