fix: superadmin assignments show ENV badge, block UI revoke

Superadmin role (level 999) is managed via env config only. Hide X
button for superadmin assignments and show ENV badge instead. Filter
superadmin from assignable roles dropdown. Add envManaged translation
to all 4 locales.

src/locales/en.json

@@ -3227,6 +3227,7 @@
       "system": "System",
       "permanent": "Permanent",
       "expired": "expired",
+      "envManaged": "Managed via ADMIN_IDS / ADMIN_EMAILS in env",
       "revoke": "Revoke",
       "revokeAriaLabel": "Revoke role {{role}} from {{user}}",
       "table": {

src/locales/fa.json

@@ -2968,6 +2968,7 @@
       "system": "سیستم",
       "permanent": "دائمی",
       "expired": "منقضی شده",
+      "envManaged": "مدیریت از طریق ADMIN_IDS / ADMIN_EMAILS در env",
       "revoke": "لغو",
       "revokeAriaLabel": "لغو نقش {{role}} از {{user}}",
       "table": {

src/locales/ru.json

@@ -3773,6 +3773,7 @@
       "system": "Система",
       "permanent": "Бессрочно",
       "expired": "истекло",
+      "envManaged": "Управляется через ADMIN_IDS / ADMIN_EMAILS в env",
       "revoke": "Отозвать",
       "revokeAriaLabel": "Отозвать роль {{role}} у {{user}}",
       "table": {

src/locales/zh.json

@@ -2967,6 +2967,7 @@
       "system": "系统",
       "permanent": "永久",
       "expired": "已过期",
+      "envManaged": "通过 ADMIN_IDS / ADMIN_EMAILS 环境变量管理",
       "revoke": "撤销",
       "revokeAriaLabel": "撤销 {{user}} 的角色 {{role}}",
       "table": {

src/pages/AdminRoleAssign.tsx

@@ -79,6 +79,7 @@ const UserPlusIcon = () => (
 // === Constants ===
 
 const PAGE_SIZE = 10;
+const SUPERADMIN_LEVEL = 999;
 
 // === Sub-components ===
 
@@ -278,10 +279,10 @@ export default function AdminRoleAssign() {
     enabled: !!roles && roles.length > 0,
   });
 
-  // Available roles filtered by canManageRole
+  // Available roles filtered by canManageRole (superadmin excluded — env-only)
   const assignableRoles = useMemo(() => {
     if (!roles) return [];
-    return roles.filter((r) => r.is_active && canManageRole(r.level));
+    return roles.filter((r) => r.is_active && r.level < SUPERADMIN_LEVEL && canManageRole(r.level));
   }, [roles, canManageRole]);
 
   // Roles map for quick lookup
@@ -627,20 +628,29 @@ export default function AdminRoleAssign() {
 
                     {/* Actions */}
                     <div className="col-span-1 flex justify-end sm:justify-start">
-                      <PermissionGate permission="roles:assign">
-                        <button
-                          onClick={() => setRevokeConfirm(assignment.id)}
-                          disabled={!canRevoke}
-                          className="rounded-lg p-1.5 text-dark-400 transition-colors hover:bg-error-500/20 hover:text-error-400 disabled:cursor-not-allowed disabled:opacity-40"
-                          title={t('admin.roleAssign.revoke')}
-                          aria-label={t('admin.roleAssign.revokeAriaLabel', {
-                            user: assignment.user_first_name || assignment.user_id,
-                            role: assignment.role_name,
-                          })}
+                      {assignment.role_level >= SUPERADMIN_LEVEL ? (
+                        <span
+                          className="rounded px-1.5 py-0.5 text-[10px] font-medium text-dark-500"
+                          title={t('admin.roleAssign.envManaged')}
                         >
-                          <XCircleIcon />
-                        </button>
-                      </PermissionGate>
+                          ENV
+                        </span>
+                      ) : (
+                        <PermissionGate permission="roles:assign">
+                          <button
+                            onClick={() => setRevokeConfirm(assignment.id)}
+                            disabled={!canRevoke}
+                            className="rounded-lg p-1.5 text-dark-400 transition-colors hover:bg-error-500/20 hover:text-error-400 disabled:cursor-not-allowed disabled:opacity-40"
+                            title={t('admin.roleAssign.revoke')}
+                            aria-label={t('admin.roleAssign.revokeAriaLabel', {
+                              user: assignment.user_first_name || assignment.user_id,
+                              role: assignment.role_name,
+                            })}
+                          >
+                            <XCircleIcon />
+                          </button>
+                        </PermissionGate>
+                      )}
                     </div>
                   </div>
                 );