fix: RBAC admin flag self-heal; await WS maintenance broadcast; scalable dataset discovery

- RBAC: ensure_admin_role() guarantees the Admin role carries is_admin=True
  (startup self-heal + create_admin promotion + role-is_admin UI checkbox in
  admin/roles); update_role refuses to strip is_admin from the last admin role.
- WS: broadcast_maintenance_event is now awaited (3 sites) so maintenance
  events actually reach clients (was an un-awaited coroutine RuntimeWarning).
- Pagination: MAX_PAGINATION_PAGES cap + clear error in fetch_paginated_data
  to stop runaway loops on huge environments.
- Discovery: find_affected_dashboards and translate datasource picker filter
  datasets/dashboards server-side (table_name/id filters, opr operator per
  Superset OpenAPI) instead of full scans that hit the pagination token cap;
  fallback to full scan when filters are rejected; virtual-dataset dedupe.

backend/src/app.py

@@ -171,11 +171,15 @@ async def lifespan(app: FastAPI):
             )
             from src.core.database import SessionLocal as _AuthDb
             from src.dependencies import get_plugin_loader
+            from src.core.auth.repository import AuthRepository
 
             _auth_db = _AuthDb()
             _plugin_loader = get_plugin_loader()
             _declared = discover_declared_permissions(plugin_loader=_plugin_loader)
             _inserted = sync_permission_catalog(db=_auth_db, declared_permissions=_declared)
+            # Self-heal: guarantee the Admin role carries is_admin=True so role-based admin
+            # bypass works even on DBs created before the flag existed (see Fix #3).
+            AuthRepository(_auth_db).ensure_admin_role()
             _auth_db.close()
             if _inserted > 0:
                 logger.reason(