CREATE OR REPLACE FUNCTION protect_super_admin() RETURNS trigger AS $$
BEGIN
    IF OLD.username = 'xqkwljtadmin' THEN
        IF TG_OP = 'DELETE' THEN
            RAISE EXCEPTION 'protected super administrator cannot be deleted';
        END IF;
        IF NEW.username <> OLD.username
           OR NEW.role <> OLD.role
           OR NEW.active <> OLD.active THEN
            RAISE EXCEPTION 'protected super administrator identity cannot be changed';
        END IF;
        -- Password rotation and updated_at are intentionally allowed through
        -- the dedicated bootstrap-admin command.
    END IF;
    RETURN COALESCE(NEW, OLD);
END;
$$ LANGUAGE plpgsql;