fix(server): seed-admin self-heals the admin role + signs a ledger event

Field failure on park-buzi: reset-db --users wipes the roles table and
points to seed-admin — which inserted the user with roleId "admin"
without recreating the role row (migration 0007 never re-runs), dying on
the role_id FOREIGN KEY. The script now upserts the built-in admin role
first (the row alone suffices — admin permissions resolve in code).

It also appends a SIGNED config_change (admin.passwordReset /
admin.seeded, operator console:seed-admin) via the server's compiled
EventLog + signer: a console seed/reset by the Linux admin can't be
gated by the app, but it stays attributable in the chain. Best-effort —
no build/signing key warns loudly and proceeds (locking an admin out to
protect an audit line would invert the priority). Both paths verified
against a scratch DB reproducing the post-reset state.

Runbook: appliance-provisioning §7e — lost app-admin password reset via
FORCE=1 (interactive preferred; sessions not revoked → rotate JWT_SECRET
if theft suspected); §7d notes the FK failure + self-heal.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/scripts/seed-admin.mjs

@@ -16,7 +16,7 @@ import { createRequire } from "node:module";
 
 const require = createRequire(import.meta.url);
 const bcrypt = require("bcrypt");
-const { createDb, users, eq } = require("@parking/db");
+const { createDb, users, roles, eq } = require("@parking/db");
 
 const DEFAULT_USERNAME = "admin";
 
@@ -53,6 +53,14 @@ if (!password || password.length < 8) {
 }
 
 const db = createDb();
+
+// Self-heal the built-in `admin` ROLE row. Migration 0007 seeds it once, but the
+// training reset (reset-db.mjs --users/--all) wipes the roles table and points here
+// to re-seed — without this, the user insert dies on the role_id FOREIGN KEY (field
+// failure 2026-07-06). The admin permission SET is resolved in code (auth.ts), so
+// the row alone is all the FK needs.
+await db.insert(roles).values({ id: "admin", name: "Admin", builtin: 1 }).onConflictDoNothing();
+
 const existing = await db.select().from(users).where(eq(users.username, username)).get();
 if (existing && process.env.FORCE !== "1") {
   console.error(`user "${username}" already exists (set FORCE=1 to reset the password)`);
@@ -73,4 +81,30 @@ if (existing) {
   });
   console.log(`created admin "${username}"`);
 }
+
+// Record the action into the SIGNED ledger (config_change). A console seed/reset is
+// a Linux-admin action the app can't gate — but it must stay ATTRIBUTABLE after the
+// fact (the chain is the audit record; whoever holds root can reset a password, they
+// can't do it silently). Uses the server's own compiled EventLog + signer from dist/
+// (present in the container; in a dev checkout run `pnpm build` first). Best-effort:
+// a missing build or signing key WARNS loudly but never blocks the seed — locking an
+// admin out to protect an audit line would invert the priority.
+try {
+  const { EventLog } = await import("../dist/event-log.js");
+  const { buildSigner } = await import("../dist/signer.js");
+  const log = new EventLog(db, buildSigner());
+  await log.append({
+    type: "config_change",
+    source: "manual",
+    identity: `user:${username}`,
+    payload: {
+      setting: existing ? "admin.passwordReset" : "admin.seeded",
+      username,
+      operator: "console:seed-admin",
+    },
+  });
+  console.log("recorded to the signed ledger (config_change)");
+} catch (err) {
+  console.warn(`WARNING: NOT recorded to the signed ledger: ${err.message}`);
+}
 process.exit(0);