Add Super Admin login flag and expose web tenant onboarding

issuperadmin on app_users (schema change already applied to the DB)
is now returned by AppLogin/TenantWebLogin's login response, gated
server-side rather than via a client-supplied roleid. Fixes the login
enrichment query (GetTenantUserById) to LEFT JOIN app_location instead
of INNER JOIN — a tenantless super-admin row was previously silently
dropped, so the login "succeeded" but returned an empty struct.

Also exposes createtenantuser on the web route group (was mob-only).
No repository changes were needed for location auto-provisioning:
GORM was already inserting the nested tenantlocations association on
tenant creation, it just wasn't reachable from the web.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

models/users.go

@@ -59,6 +59,7 @@ type User struct {
 	Applocationid int    `json:"applocationid"`
 	Status        string `json:"status"`
 	Shiftid       int    `json:"shiftid"`
+	Issuperadmin  bool   `json:"issuperadmin"`
 }
 
 type TenantUserInfo struct {
@@ -99,4 +100,5 @@ type TenantUserInfo struct {
 	Categoryid     int    `json:"categoryid"`
 	Categoryname   string `json:"categoryname"`
 	Subcategoryid  int    `json:"subcategoryid"`
+	Issuperadmin   bool   `json:"issuperadmin"`
 }