Hand out a narrow slice of the admin surface without touching the database.
Protected accounts cannot be removed or demoted. The protection lives in server configuration (PROTECTED_ADMIN_EMAILS), not in this page and not in a column on the row it guards — so it holds for a direct API call from a stolen session, not just for a missing button, and anything able to edit the roles table cannot clear it first.
If you lose access, recover through the email on the account: open the
sign-in page and use the “Forgot password?” link under the password field, with that address. The admin role is attached to the account, so regaining the login regains the role — there is no separate admin credential to lose. That is also why protection is matched on the email rather than a user id: the address is the thing you control and the thing recovery runs through.
Keep the address reachable. It is the only recovery route.