fix(super-admin): move routes to JWT-only scope to bypass tenant extension

Super-admin routes need cross-org Prisma access. The previous registration
inside the tenant-guarded scope called runWithTenant('xamle-admin-org'),
which caused the Prisma extension to silently filter all User, Message,
WalletTransaction and other queries to a single org.

Moving to a separate scope with JWT-only auth (no runWithTenant) means
getOrganizationId() returns null inside these handlers, so the tenant
extension skips filtering — enabling true cross-org stats and queries.

apps/api/src/app.ts

@@ -95,6 +95,14 @@ export async function buildApp() {
         scope.register(billingRoutes, { prefix: '/v1/billing' });
         scope.register(notificationRoutes, { prefix: '/v1/notifications' });
         scope.register(campaignRoutes, { prefix: '/v1/organizations' });
+    });
+
+    // Super-admin routes — JWT-only scope, deliberately NO runWithTenant so Prisma
+    // queries are cross-org (tenant extension only filters when AsyncLocalStorage is set).
+    server.register(async (scope) => {
+        scope.addHook('preHandler', async (request, reply) => {
+            await verifyJwt(request, reply);
+        });
         scope.register(superAdminRoutes, { prefix: '/v1/super-admin' });
     });