admin: internal-only superadmin console (users, payments, DB stats)

New independent `admin` service (admin.main:app) on the same image, reusing
app.db/app.models read-only. Never runs migrations or the scheduler; issues
SELECTs only.

- Password-gated (ADMIN_CONSOLE_PASSWORD) with a 12h signed cookie; closed by
  default when the password is empty.
- Bound to 127.0.0.1:8091 (SSH-tunnel access); off the intranet/NPM network.
- Pages: overview stats, user list + search, per-user history/payment detail,
  DB usage (information_schema size + row estimates).
- Compose: base `admin` service (+prod DB-host override, test mount); Dockerfile
  bakes admin/ into runtime + test stages.
- Tests: tests/test_admin_console.py (auth, queries, page wiring) — 12 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -32,10 +32,12 @@ RUN apt-get update \
 COPY --from=builder /opt/venv /opt/venv
 WORKDIR /app
 COPY app ./app
+COPY admin ./admin
 COPY alembic ./alembic
 COPY alembic.ini ./
 
-# Default command is the web app; scheduler container overrides via `command:`.
+# Default command is the web app; the scheduler and admin-console containers
+# override via `command:` (see docker-compose.yml).
 EXPOSE 8000
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]
 
@@ -57,6 +59,7 @@ COPY --from=builder /opt/venv /opt/venv
 WORKDIR /app
 COPY pyproject.toml requirements.lock ./
 COPY app ./app
+COPY admin ./admin
 COPY alembic ./alembic
 COPY alembic.ini ./
 # tests/ is excluded by .dockerignore (prod-correct: never bake tests into