admin: internal-only superadmin console (users, payments, DB stats)

New independent `admin` service (admin.main:app) on the same image, reusing
app.db/app.models read-only. Never runs migrations or the scheduler; issues
SELECTs only.

- Password-gated (ADMIN_CONSOLE_PASSWORD) with a 12h signed cookie; closed by
  default when the password is empty.
- Bound to 127.0.0.1:8091 (SSH-tunnel access); off the intranet/NPM network.
- Pages: overview stats, user list + search, per-user history/payment detail,
  DB usage (information_schema size + row estimates).
- Compose: base `admin` service (+prod DB-host override, test mount); Dockerfile
  bakes admin/ into runtime + test stages.
- Tests: tests/test_admin_console.py (auth, queries, page wiring) — 12 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

admin/templates/partials_users_table.html

@@ -0,0 +1,39 @@
+{# expects `recent` (overview) or `rows` (users list) — normalise to `rows` #}
+{% set rows = rows if rows is defined else recent %}
+<table>
+  <thead>
+    <tr>
+      <th>ID</th><th>Email</th><th>Tier</th><th>Paid</th><th>Created</th>
+      <th>Last login</th><th>Lang</th><th>Sync</th><th>Refs</th><th>Billing</th>
+    </tr>
+  </thead>
+  <tbody>
+  {% for u in rows %}
+    <tr>
+      <td>{{ u.id }}</td>
+      <td><a href="/users/{{ u.id }}">{{ u.email }}</a></td>
+      <td>{{ u.tier }}</td>
+      <td>
+        {% if u.paid_active %}
+          <span class="pill good">yes{% if u.paid_source == 'credit' %} · {{ u.credit_days }}d{% endif %}</span>
+        {% else %}
+          <span class="pill mute">no</span>
+        {% endif %}
+        {% if u.trialing %}<span class="pill warn">trial</span>{% endif %}
+      </td>
+      <td class="muted">{{ u.created_at|dt }}</td>
+      <td class="muted">{{ u.last_login_at|dt }}</td>
+      <td>{{ u.lang }}</td>
+      <td>{% if u.has_sync %}<span class="pill good">on</span>{% else %}<span class="muted">—</span>{% endif %}</td>
+      <td>{{ u.referrals }}</td>
+      <td>
+        {% if u.on_stripe %}<span class="pill">stripe</span>{% endif %}
+        {% if u.on_polar %}<span class="pill">polar</span>{% endif %}
+        {% if not u.on_stripe and not u.on_polar %}<span class="muted">—</span>{% endif %}
+      </td>
+    </tr>
+  {% else %}
+    <tr><td colspan="10" class="muted">No users.</td></tr>
+  {% endfor %}
+  </tbody>
+</table>