完成五人团队正式内用最小收口（07-18-small-team-internal-readiness）

server/prisma/migrations/20260718120000_add_system_admin_role/migration.sql

@@ -0,0 +1,2 @@
+-- Add the restricted OA operator role without changing any existing account.
+ALTER TYPE "RoleCode" ADD VALUE IF NOT EXISTS 'system_admin' BEFORE 'admin';