feat: add superadmin

docs/security.md

@@ -22,10 +22,15 @@
 - `admin`: Full access, including users and pairing or unpairing terminals
 - `manager` (the people running the venue): products and their pictures, stock, tabs, planned customers and
   reminders. Accounts and tokens with the former role `viewer` are treated as managers
+- `superadmin` (KoolTap itself): everything an admin may do, in every venue, plus the KoolTap Admin page (`/admin`
+  endpoints). Only a superadmin can make someone a superadmin; the first one is made with
+  `pnpm --filter @kooltap/api run superadmin <email>`. A superadmin viewing a venue is recorded in that venue's audit log,
+  and every admin action is audited
+- Signing a user out from the admin page sets `sessionsRevokedAt`: access tokens issued before it are refused at once
 - Product pictures are public by id (`GET /images/:imageId`); the id is a SHA-256 hash, so it can't be guessed
 
 ### Venue Isolation
-- Every user and device is scoped to exactly one venue
+- Every user and device is scoped to exactly one venue; only a superadmin can reach other venues
 - All service methods validate venue context from authentication
 - Cross-venue access is blocked at the service layer