systemAccount switch: the one field with no guardCovers on roles, active, preferences, supervisor, password resetUserController guards five fields before building the edit form; systemAccount was added later without one. A team lead's 22-byte PATCH flips it with HTTP 200, and the user disappears from the week, month and year user reports and the customer monthly projects report, which all call setSystemAccount(false). Kimai 2.57.0 gates the field behind an admin permission.