fix: accept role field when creating OrgAdmin

ValidationPipe forbids unknown properties; the UI sends role so the DTO
must declare it. Pass it through to the service so ORG_OWNER/ORG_ADMIN
is honoured on creation.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/modules/super-admin/admin-orgs.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Get, Param, Patch, Post, UseGuards } from '@nestjs/common';
-import { IsOptional, IsString, MinLength } from 'class-validator';
+import { IsEnum, IsOptional, IsString, MinLength } from 'class-validator';
+import { OrgAdminRole } from '@prisma/client';
 import { SuperAdminGuard } from './super-admin.guard';
 import { SuperAdminService } from './super-admin.service';
 
@@ -12,6 +13,7 @@ class CreateOrgAdminDto {
   @IsString() email!: string;
   @IsString() @IsOptional() name?: string;
   @IsString() @MinLength(8) password!: string;
+  @IsEnum(OrgAdminRole) @IsOptional() role?: OrgAdminRole;
 }
 
 class AssignTenantOrgDto {
@@ -40,7 +42,7 @@ export class AdminOrgsController {
 
   @Post('orgs/:id/admins')
   createOrgAdmin(@Param('id') id: string, @Body() body: CreateOrgAdminDto) {
-    return this.service.createOrgAdmin(id, body.email, body.name, body.password);
+    return this.service.createOrgAdmin(id, body.email, body.name, body.password, body.role);
   }
 
   @Patch('tenants/:id/org')

apps/api/src/modules/super-admin/super-admin.service.ts

@@ -77,7 +77,7 @@ export class SuperAdminService {
     return org;
   }
 
-  async createOrgAdmin(orgId: string, email: string, name: string | undefined, password: string) {
+  async createOrgAdmin(orgId: string, email: string, name: string | undefined, password: string, role?: string) {
     const org = await this.prisma.organization.findUnique({ where: { id: orgId } });
     if (!org) throw new NotFoundException('Organization not found');
 
@@ -88,7 +88,7 @@ export class SuperAdminService {
 
     const passwordHash = await bcrypt.hash(password, 10);
     const admin = await this.prisma.orgAdmin.create({
-      data: { organizationId: orgId, email, name, passwordHash },
+      data: { organizationId: orgId, email, name, passwordHash, ...(role ? { role: role as any } : {}) },
       select: { id: true, email: true, name: true, role: true, createdAt: true },
     });
     return admin;