fix: allow system role updates when name is unchanged

The updateRoleHandler guard rejected any request where body.name matched
a system role, even when the name was not being changed. This blocked
editing a system role's description. Compare against the URL param to
only reject actual renames to reserved names.

packages/api/src/admin/roles.ts

@@ -111,7 +111,11 @@ export function createAdminRolesHandlers(deps: AdminRolesDeps) {
       ) {
         return res.status(400).json({ error: 'name must be a non-empty string' });
       }
-      if (body.name && SystemRoles[body.name.trim() as keyof typeof SystemRoles]) {
+      if (
+        body.name &&
+        body.name.trim() !== name &&
+        SystemRoles[body.name.trim() as keyof typeof SystemRoles]
+      ) {
         return res.status(409).json({ error: 'Cannot rename to a reserved system role name' });
       }