aKinderWellness Testing and Quality analysis

A non-superadmin user (Intakes Staff role) is able to create new admin accounts by directly calling the /api/admin/add-admin API endpoint.
This indicates missing backend authorization checks, as admin creation should be restricted to superadmin users only.

Steps to Reproduce

1. Login as a user with Intakes Staff role
2. Capture the JWT token
3. Send POST request to: /api/admin/add-admin
4. Observe that admin account is successfully created

Expected Result
Only Super Admin should be able to create admin users.

Actual Result
Non-superadmin user is able to create admin users successfully.

NOTE: A Postman request has been created and shared to demonstrate the issue for easier reproduction.