admin: internal-only superadmin console (users, payments, DB stats)

New independent `admin` service (admin.main:app) on the same image, reusing
app.db/app.models read-only. Never runs migrations or the scheduler; issues
SELECTs only.

- Password-gated (ADMIN_CONSOLE_PASSWORD) with a 12h signed cookie; closed by
  default when the password is empty.
- Bound to 127.0.0.1:8091 (SSH-tunnel access); off the intranet/NPM network.
- Pages: overview stats, user list + search, per-user history/payment detail,
  DB usage (information_schema size + row estimates).
- Compose: base `admin` service (+prod DB-host override, test mount); Dockerfile
  bakes admin/ into runtime + test stages.
- Tests: tests/test_admin_console.py (auth, queries, page wiring) — 12 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -77,6 +77,33 @@ services:
       redis:
         condition: service_healthy
 
+  # Superadmin console — independent read-only operator dashboard. Same
+  # image (reuses app.db/app.models) but runs admin.main:app instead of the
+  # public app, and NEVER runs migrations. Bound to 127.0.0.1 only: it is
+  # reached over an SSH tunnel, never exposed publicly (no intranet/NPM).
+  admin:
+    build: .
+    restart: unless-stopped
+    command: ["uvicorn", "admin.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]
+    env_file: .env
+    environment:
+      DATABASE_URL: mysql+aiomysql://${MARIADB_USER:-cassandra}:${MARIADB_PASSWORD:-changeme}@db:3306/${MARIADB_DATABASE:-cassandra}
+    volumes:
+      - ./config:/app/config:ro
+      - ./app:/app/app
+      - ./admin:/app/admin
+    ports:
+      # Host-loopback only — access via `ssh -L 8091:localhost:8091 <vps>`.
+      - "127.0.0.1:8091:8000"
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:8000/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+    depends_on:
+      db:
+        condition: service_healthy
+
   backup:
     image: mariadb:11
     restart: unless-stopped