admin: internal-only superadmin console (users, payments, DB stats)

New independent `admin` service (admin.main:app) on the same image, reusing
app.db/app.models read-only. Never runs migrations or the scheduler; issues
SELECTs only.

- Password-gated (ADMIN_CONSOLE_PASSWORD) with a 12h signed cookie; closed by
  default when the password is empty.
- Bound to 127.0.0.1:8091 (SSH-tunnel access); off the intranet/NPM network.
- Pages: overview stats, user list + search, per-user history/payment detail,
  DB usage (information_schema size + row estimates).
- Compose: base `admin` service (+prod DB-host override, test mount); Dockerfile
  bakes admin/ into runtime + test stages.
- Tests: tests/test_admin_console.py (auth, queries, page wiring) — 12 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -16,6 +16,13 @@ OPENROUTER_API_KEY=       # OpenRouter (AI log generation)
 # --- App ---
 CASSANDRA_TOKEN=          # Bearer token required if set; LAN-only no-auth if empty
 CASSANDRA_PORT=8000
+
+# --- Superadmin console (internal-only, separate `admin` container) ---
+# Password for the read-only operator dashboard at 127.0.0.1:8091 (reach it
+# via `ssh -L 8091:localhost:8091 <vps>`). Empty = console refuses every
+# login (closed by default). Set a strong value in prod.
+ADMIN_CONSOLE_PASSWORD=
+ADMIN_CONSOLE_SESSION_SECRET=   # cookie signing key; falls back to CASSANDRA_SESSION_SECRET/TOKEN if empty
 CASSANDRA_BASE_CURRENCY=GBP
 CASSANDRA_ANCHOR_DATE=2026-03-04   # YYYY-MM-DD; used by market_pulse anchor column
 CASSANDRA_MOCK=0          # 1 = serve canned fixtures, skip live APIs