Seed: bridge LobeChat default signup accounts to enterprise roles

- admin@eg.local  -> super_admin
- user1@eg.local  -> customer (customer_id=CUST-0001)

Makes the admin-only model-config UI lock take effect out of the box
after docker compose up + bootstrap-lobechat-users.sh.

.omc/project-memory.json

@@ -69,8 +69,8 @@
     },
     {
       "path": "gateway/prisma/seed.ts",
-      "accessCount": 20,
-      "lastAccessed": 1776763220682,
+      "accessCount": 23,
+      "lastAccessed": 1776775293304,
       "type": "file"
     },
     {

.omc/state/idle-notif-cooldown.json

@@ -1,3 +1,3 @@
 {
-  "lastSentAt": "2026-04-21T12:33:30.508Z"
+  "lastSentAt": "2026-04-21T12:40:13.486Z"
 }

gateway/prisma/seed.ts

@@ -332,6 +332,32 @@ async function ensureModels() {
   console.log('[seed] models/model-permissions/model-policy ensured');
 }
 
+// Bridge the default LobeChat signup accounts to enterprise roles so the UI
+// admin-lock takes effect immediately out of the box. This is idempotent.
+async function ensureLobeChatBridgeUsers() {
+  const bridges = [
+    { email: 'admin@eg.local', username: 'admin-lobe', displayName: 'Admin (LobeChat)', role: 'super_admin', metadata: {} as any },
+    { email: 'user1@eg.local', username: 'user1-lobe', displayName: 'User One (LobeChat)', role: 'customer', metadata: { customer_id: 'CUST-0001' } as any },
+  ];
+  for (const b of bridges) {
+    const role = await prisma.enterpriseRole.findUnique({ where: { key: b.role } });
+    if (!role) continue;
+    let user = await prisma.enterpriseUser.findUnique({ where: { username: b.username } });
+    if (!user) {
+      user = await prisma.enterpriseUser.create({
+        data: { username: b.username, displayName: b.displayName, email: b.email, metadata: b.metadata },
+      });
+    }
+    const existing = await prisma.enterpriseUserRole.findFirst({
+      where: { userId: user.id, roleId: role.id },
+    });
+    if (!existing) {
+      await prisma.enterpriseUserRole.create({ data: { userId: user.id, roleId: role.id } });
+    }
+  }
+  console.log('[seed] lobechat bridge users ensured');
+}
+
 async function ensureSystemDiscoverer() {
   const superRole = await prisma.enterpriseRole.findUnique({ where: { key: 'super_admin' } });
   if (!superRole) return;
@@ -385,6 +411,7 @@ async function main() {
     await ensureToolInputSchemas();
     await ensureModels();
     await ensureRoleToolGrants();
+    await ensureLobeChatBridgeUsers();
     return;
   }