SUPERADMIN takeover via Skool-provider JWT forgery

Attackers can exploit the skool-provider JWT sign process to generate a JWT token with isSuperAdmin: true

Postiz's Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware trusted every claim in that JWT without re-resolving the user from the database. Any authenticated Postiz user could forge a SUPERADMIN session and impersonate arbitrary organizations.