Restrict admin to system management

backend/src/migrations.ts

@@ -76,6 +76,9 @@ export async function migrate() {
 
   const adminId = await ensureMigrationAdmin();
 
+  await query("UPDATE users SET role = 'user', updated_at = now() WHERE role = 'admin' AND id <> $1;", [adminId]);
+  await query("CREATE UNIQUE INDEX IF NOT EXISTS idx_users_single_admin ON users ((role)) WHERE role = 'admin';");
+
   await query(`
     CREATE TABLE IF NOT EXISTS app_settings (
       key TEXT PRIMARY KEY,