-- Initial super_admin account. Password hash below corresponds to
-- 'ChangeMe!2026' — must_change_password forces a reset on first login,
-- so this default never sits live in production.

INSERT IGNORE INTO users (role_id, username, email, password_hash, must_change_password, status)
SELECT id, 'superadmin', 'admin@example.com',
       '$2b$12$a.Tdu6770gGW6cRJZARsuefIg.DdvSWV3cIK5dkaEXoZmC1dueUHC',
       1, 'active'
FROM roles WHERE name = 'super_admin';