admin: front console via NPM + add purge-test-users CLI

Networking: the superadmin console now mirrors `app` instead of a
loopback-only host port. Base compose drops the host port; the dev
override binds 127.0.0.1:8091; the prod overlay joins the `intranet`
network and listens on :80 with --proxy-headers so NPM can proxy it.

CLI: add `purge-test-users` (dry-run by default, --commit to delete,
--keep allow-list defaulting to the real accounts). Deletes child rows
explicitly (DB-agnostic) plus email-keyed OTPs, so smoke-test signups
that were pointed at prod can be cleaned repeatably instead of via
ad-hoc SQL. Covered by 6 new tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

admin/README.md

@@ -8,18 +8,20 @@ that **never** runs migrations or the scheduler and only ever issues `SELECT`s.
 
 ## Access model
 
-- Bound to **`127.0.0.1:8091`** on the host — never exposed publicly, not on
-  the `intranet`/NPM network. Reach it over an SSH tunnel:
-
-  ```sh
-  ssh -L 8091:localhost:8091 <vps>
-  # then open http://localhost:8091
-  ```
-
+- **Dev:** bound to **`127.0.0.1:8091`** on the host (loopback only, from
+  `docker-compose.override.yml`). Open <http://localhost:8091>.
+- **Prod:** no host port. The container joins the `intranet` network and
+  listens on port 80, so **Nginx Proxy Manager** fronts it like the main app
+  (upstream `readmarkets-admin-1:80`). Point an NPM proxy host at it and,
+  ideally, add an NPM access list / basic-auth as a second layer.
 - Gated by a single shared password, `ADMIN_CONSOLE_PASSWORD` (in `.env`).
   Empty password ⇒ every login is refused (closed by default). The login sets
   a 12-hour signed cookie (`admin_console_session`).
 
+> The console is now reachable on whatever public hostname NPM maps to it —
+> it is no longer air-gapped behind an SSH tunnel. Keep `ADMIN_CONSOLE_PASSWORD`
+> strong and prefer adding an NPM access rule in front of it.
+
 ## Pages
 
 - `/` — overview: totals, tier split, paid-active, signups 7/30d, sync count,
@@ -41,6 +43,8 @@ overlay:
 # 1. set ADMIN_CONSOLE_PASSWORD in .env
 # 2. build + create just the admin container (leaves app/scheduler/db running)
 docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build admin
+# 3. in Nginx Proxy Manager: add a proxy host → forward to readmarkets-admin-1
+#    port 80 (both containers are on the `intranet` network).
 ```
 
 ## Tests