PR #12 opened: Ensure structural roles are seeded on every boot

Problem

Prod logs (post-Netcup migration) show:

production.ERROR: There is no role named `admin` for guard `web`
  Spatie\Permission\Exceptions\RoleDoesNotExist::named()

shop:ensure-admin runs on every boot and calls assignRole('admin'), but RolesSeeder only runs when AUTO_SEED=true. A production deploy ships AUTO_SEED=false, so it boots with no roles and ensure-admin throws.

Fix

Run the idempotent RolesSeeder in the entrypoint on every boot, before shop:ensure-admin and independent of AUTO_SEED (which still gates the demo catalogue). Roles are structural, not demo data.

• Fixes the observed admin failure.
• Pre-empts the same latent fault for staff/customer (used by registration).
• Idempotent (firstOrCreate), cheap, safe to run every boot.