admin: internal-only superadmin console (users, payments, DB stats)

New independent `admin` service (admin.main:app) on the same image, reusing
app.db/app.models read-only. Never runs migrations or the scheduler; issues
SELECTs only.

- Password-gated (ADMIN_CONSOLE_PASSWORD) with a 12h signed cookie; closed by
  default when the password is empty.
- Bound to 127.0.0.1:8091 (SSH-tunnel access); off the intranet/NPM network.
- Pages: overview stats, user list + search, per-user history/payment detail,
  DB usage (information_schema size + row estimates).
- Compose: base `admin` service (+prod DB-host override, test mount); Dockerfile
  bakes admin/ into runtime + test stages.
- Tests: tests/test_admin_console.py (auth, queries, page wiring) — 12 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

admin/templates/overview.html

@@ -0,0 +1,22 @@
+{% extends "base.html" %}
+{% block title %}overview{% endblock %}
+{% block body %}
+<h1>Overview</h1>
+<div class="cards">
+  <div class="card"><div class="n">{{ stats.total_users }}</div><div class="l">Total users</div></div>
+  <div class="card"><div class="n">{{ stats.paid_active }}</div><div class="l">Paid-active</div></div>
+  <div class="card"><div class="n">{{ stats.free }}</div><div class="l">Free tier</div></div>
+  <div class="card"><div class="n">{{ stats.paid }}</div><div class="l">Paid tier</div></div>
+  <div class="card"><div class="n">{{ stats.enterprise }}</div><div class="l">Enterprise</div></div>
+  <div class="card"><div class="n">{{ stats.credit_active }}</div><div class="l">On credit</div></div>
+  <div class="card"><div class="n">{{ stats.signups_7d }}</div><div class="l">Signups · 7d</div></div>
+  <div class="card"><div class="n">{{ stats.signups_30d }}</div><div class="l">Signups · 30d</div></div>
+  <div class="card"><div class="n">{{ stats.active_30d }}</div><div class="l">Active · 30d</div></div>
+  <div class="card"><div class="n">{{ stats.sync_enabled }}</div><div class="l">Cloud-sync on</div></div>
+  <div class="card"><div class="n">{{ stats.referrals_converted }}/{{ stats.referrals_total }}</div><div class="l">Referrals conv.</div></div>
+</div>
+
+<h2>Newest users</h2>
+{% include "partials_users_table.html" %}
+<p><a href="/users">All users →</a></p>
+{% endblock %}