feat(auth): bootstrap protected support and first owner users

packages/db/prisma/migrations/20260210190000_system_user_guards/migration.sql

@@ -0,0 +1,8 @@
+-- AlterTable
+ALTER TABLE "user"
+ADD COLUMN "isSystem" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN "isHidden" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN "isProtected" BOOLEAN NOT NULL DEFAULT false;
+
+-- CreateIndex
+CREATE INDEX "user_role_idx" ON "user"("role");

packages/db/prisma/schema.prisma

@@ -28,10 +28,14 @@ model User {
   updatedAt     DateTime  @updatedAt
   role          String    @default("editor")
   isBanned      Boolean   @default(false)
+  isSystem      Boolean   @default(false)
+  isHidden      Boolean   @default(false)
+  isProtected   Boolean   @default(false)
   sessions      Session[]
   accounts      Account[]
 
   @@unique([email])
+  @@index([role])
   @@map("user")
 }