Roles: seed only SuperAdmin, Admin and User, and let HR come with demo content

Every host is seeded with a role named `HR` ("Human Resources - manage attendance"), `barakoCMS/Data/DataSeeder.cs:92`. The role seeding runs outside the `Seed:DemoContent` gate at `DataSeeder.cs:30`, so production installs get it too. It cannot be deleted (`barakoCMS/Models/SystemRoles.cs:23`) and its name is reserved (`SystemRoles.cs:39`).

### Why it is too specific

HR belongs to the attendance demo, not to a CMS. A school site, a bakery shop or an agency's client site still starts with an undeletable HR role in its role list, and none of them can name a custom role HR for their own use.

### The general concept

The core seeds only SuperAdmin, Admin and User. Demo roles like HR come with the demo content behind `Seed:DemoContent`, or from a blueprint that needs them.

### Where it lives

Core: `DataSeeder` and `SystemRoles`.

### Compatibility

Released. Existing databases keep their HR role and nothing deletes it. New installs without demo content just do not get one. `DataSeeder.HRRoleId` and `SystemRoles.HRRoleId` are public, so they stay, marked `[Obsolete]` with a removal version one major away. Until the Sensitive default stops naming HR (filed from the same sweep), a new install without demo content shows Sensitive fields only to SuperAdmin, so either land that first or say so in the pull request.

### Done when

- A fresh install with `Seed:DemoContent` off has exactly SuperAdmin, Admin and User, and a test showing that fails before the change.
- With demo content on, HR is still seeded.
- An existing database that already has HR keeps it, and it still cannot be deleted.

Found in the too specific sweep of 15 September 2026.

Start in barakoCMS/Data/DataSeeder.cs at the role seeding and Seed:DemoContent gate, then read barakoCMS/Models/SystemRoles.cs for HR protection and public identifiers. Add coverage for fresh installs with demo content off and on, while preserving HR for existing databases; also check the Sensitive default dependency before considering the work done.

Written by the indexing model from the issue text.