chore(settings): sync superadmin key lists to controlpanel_user

Extend template sync script to generate frontend allow/deny lists so
ProgramSettingsPage can hide can_edit=1 keys before API purge deploys.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/sync-superadmin-setting-template.mjs

@@ -4,6 +4,7 @@
  * خروجی:
  *   - prisma/setting-templates-from-deploy.json  (فقط can_edit=0 نهایی)
  *   - src/program-settings/deploy-setting-catalog-keys.ts
+ *   - ../controlpanel_user/src/config/superAdminSettingKeys.ts
  */
 import { readFileSync, writeFileSync } from 'fs';
 import { dirname, join } from 'path';
@@ -120,5 +121,27 @@ ${editableRows.map((r) => `  ${JSON.stringify(r.key)},`).join('\n')}
 writeFileSync(join(root, 'prisma/setting-templates-from-deploy.json'), `${JSON.stringify(jsonOut, null, 2)}\n`);
 writeFileSync(join(root, 'src/program-settings/deploy-setting-catalog-keys.ts'), `${tsKeys}\n`);
 
+const userTs = `/**
+ * کلیدهای تنظیمات سوپرادمین — هم‌تراز deploy_settings_const.sql
+ * تولید خودکار: controlpanel_server/scripts/sync-superadmin-setting-template.mjs
+ */
+export const SUPERADMIN_SYSTEM_SETTING_KEYS = new Set<string>([
+${systemRows.map((r) => `  ${JSON.stringify(r.key)},`).join('\n')}
+]);
+
+export const SUPERADMIN_EDITABLE_SETTING_KEYS = new Set<string>([
+${editableRows.map((r) => `  ${JSON.stringify(r.key)},`).join('\n')}
+]);
+
+export function isSuperAdminSystemSettingKey(key?: string | null): boolean {
+  const k = String(key || '').trim();
+  if (!k) return false;
+  if (SUPERADMIN_EDITABLE_SETTING_KEYS.has(k)) return false;
+  return SUPERADMIN_SYSTEM_SETTING_KEYS.has(k);
+}
+`;
+
+writeFileSync(join(root, '../controlpanel_user/src/config/superAdminSettingKeys.ts'), `${userTs}\n`);
+
 console.log(`system keys (can_edit=0): ${systemRows.length}`);
 console.log(`editable keys (can_edit=1): ${editableRows.length}`);