fix(seed): set is_system_admin=True and seed default workspace on startup

- Admin user was created without is_system_admin=True, causing sidebar
  to be empty (all permission checks failed)
- seed_default_workspace() was never called, so no workspaces existed
- Now seed_admin.py ensures is_system_admin=True for existing admins
  and creates a default workspace if none exists

Fixes: sidebar empty, settings inaccessible

scripts/seed_admin.py

@@ -78,6 +78,7 @@ async def seed():
                 name="Administrator",
                 password_hash=hash_password(os.environ.get("ADMIN_PASSWORD", "Admin123!")),
                 is_active=True,
+                is_system_admin=True,
                 preferences={},
             )
             db.add(user)
@@ -97,6 +98,19 @@ async def seed():
             print(f"Created user_tenant link with admin role")
         else:
             print(f"User exists: {user.email} (id: {user.id})")
+            # Ensure existing admin has is_system_admin=True
+            if not user.is_system_admin:
+                user.is_system_admin = True
+                await db.flush()
+                print(f"Updated is_system_admin=True for {user.email}")
+
+        # Seed default workspace if none exists for this tenant
+        from app.services.workspace_service import seed_default_workspace
+        ws_result = await seed_default_workspace(db, tenant.id, user.id)
+        if ws_result:
+            print(f"Created default workspace: {ws_result['name']} (id: {ws_result['id']})")
+        else:
+            print("Workspace already exists — skipping workspace seed")
 
         await db.commit()
         print("Seed completed successfully.")