Protect the default admin account

Closes #276

Summary

Protects the configured default administrator from being edited through Admin → Users in both standalone and Union deployments.

Changes

• Reliably identifies the configured default admin using its username and identity provider.
• Supports standalone national accounts, legacy accounts, and Union ITDB accounts.
• Handles username casing differences between configuration and persisted accounts.
• Rejects edit and activation-status requests with 403 Forbidden.
• Disables all fields and Submit on the edit screen.
• Displays an informational protection message.
• Shows a Default admin badge in the Users table.

Testing

• Backend account/controller tests: 20 passed.
• Admin frontend tests: 2 passed.
• ESLint passed.
• Production build passed.
• Verified locally in both Union and GB standalone deployments.

Screenshots

• Screenshot showing the Default admin badge
• Screenshot showing the protected edit form attached