fix(rbac): protect built-in administrator from losing access

docs/en-US/rbac.md

@@ -53,6 +53,8 @@ Frontend button hiding is only a usability feature. The server is the security b
 
 System roles cannot be edited or deleted. Their grants are rebuilt from the current permission catalog during upgrade, preventing stale grants from older versions. Create custom roles for different job functions.
 
+The built-in `admin` account is the permanent management fallback. It cannot be disabled, deleted, or stripped of its system `admin` role. These updates are rejected through both the UI and API, preserving the account details, permissions, and valid sessions. Display name and password updates, and role changes that retain `admin`, remain available. Other accounts can still be disabled or have their roles changed. This protection does not automatically repair previously missing role bindings.
+
 An account without a role can still authenticate but has almost no business capability; do not treat “no role” as a complete job profile.
 
 ---

docs/zh-CN/rbac.md

@@ -53,6 +53,8 @@ AI 测试角色不是安全授权边界。即使选择了“渗透测试”角
 
 系统角色不可修改或删除，升级时会按当前版本的权限目录重新构建授权，避免旧版本残留权限。需要不同组合时创建自定义角色。
 
+内置管理员账号 `admin` 是保底管理入口，不能停用、删除或移除其系统管理员角色。通过界面或 API 提交此类更新都会被拒绝，原账号资料、权限和有效会话保持不变；仍可修改显示名称、密码以及保留 `admin` 角色的其他角色配置。普通账号的启用状态和角色仍可按需调整。此保护不自动修复历史上已丢失的角色绑定。
+
 没有分配任何角色的账号仍可登录，但基本没有业务权限；不要依赖“无角色”作为完整岗位配置。
 
 ---