First administrator setup

This one-time step creates the first Payroll Manager account and grants it the payroll administrator role. It closes permanently once an administrator exists, and the grant is written to the permanent role-change audit.

Checking setup status…