2333a145cc
god_admin now exists at boot (seeded by docker-entrypoint), so the canonical cross-resource super group nested into every resource's _admin group is god_admin, not the legacy app_super_admin. docker-entrypoint no longer seeds or nests app_super_admin (god_admin nests into the app_sso_* groups directly). isSuperAdmin still recognizes a pre-existing app_super_admin as a migration alias until rebuild.