fix: is_admin fallback for legacy Admin roles + migration data fix

Migration now sets is_admin=true for existing Admin roles.
has_permission falls back to role.name == 'Admin' check if
is_admin flag is missing (backward compat for pre-migration roles).

backend/alembic/versions/86c7b1d6a710_add_is_admin_column_to_roles_table.py

@@ -19,8 +19,9 @@ depends_on: Union[str, Sequence[str], None] = None
 
 
 def upgrade() -> None:
-    """Add is_admin column to roles table."""
+    """Add is_admin column to roles table, set True for existing Admin roles."""
     op.add_column("roles", sa.Column("is_admin", sa.Boolean(), nullable=False, server_default=sa.text("false")))
+    op.execute("UPDATE roles SET is_admin = true WHERE name = 'Admin'")
 
 
 def downgrade() -> None: