Superadmin

Separate, 2FA-protected credential for site administration - entirely independent of regular accounts.

A separate credential, not an elevated regular account

Site administration runs on its own login, kept in its own store and always behind two-factor authentication - it isn't a regular account with an "admin" flag flipped on, so a compromised user password can't lead anywhere near site administration.