feat: add platform admin permissions

scripts/production-readiness-check.js

@@ -394,6 +394,27 @@ async function validateDatabase() {
       pass('db.provider_public_config', 'Active provider public configs do not contain secret-like keys');
     }
 
+    const platformAdminsWithoutPermissions = await pool.query(`
+      select id, username, phone
+      from public.platform_users
+      where primary_role = 'platform_admin'
+        and (platform_permissions is null or platform_permissions = '{}'::jsonb)
+      order by created_at asc
+      limit 20
+    `);
+    if (platformAdminsWithoutPermissions.rowCount > 0) {
+      block('db.platform_admin_permissions', 'Platform admin users must have explicit platform_permissions', {
+        count: platformAdminsWithoutPermissions.rowCount,
+        samples: platformAdminsWithoutPermissions.rows.map(row => ({
+          id: row.id,
+          username: row.username,
+          phone: row.phone ? `${String(row.phone).slice(0, 3)}****${String(row.phone).slice(-4)}` : null,
+        })),
+      });
+    } else {
+      pass('db.platform_admin_permissions', 'Platform admin users have explicit permission maps');
+    }
+
     const missingAuthSecretRows = await pool.query(`
       select p.tenant_id, p.provider
       from public.tenant_auth_providers p