Doc: Actor maybe_load_role comment; ActorIsAdmin system user = admin

lib/mv/authorization/actor.ex

@@ -133,6 +133,8 @@ defmodule Mv.Authorization.Actor do
     SystemActor.system_user?(actor) or permission_set_name(actor) in ["admin", :admin]
   end
 
+  # Load role only when it is nil (e.g. actor from session without role). ensure_loaded/1
+  # already handles %Ash.NotLoaded{}, so we do not double-load in the normal Ash path.
   defp maybe_load_role(%Mv.Accounts.User{role: nil} = user) do
     case Ash.load(user, :role, domain: Mv.Accounts, authorize?: false) do
       {:ok, loaded} -> loaded