admin: front console via NPM + add purge-test-users CLI

Networking: the superadmin console now mirrors `app` instead of a
loopback-only host port. Base compose drops the host port; the dev
override binds 127.0.0.1:8091; the prod overlay joins the `intranet`
network and listens on :80 with --proxy-headers so NPM can proxy it.

CLI: add `purge-test-users` (dry-run by default, --commit to delete,
--keep allow-list defaulting to the real accounts). Deletes child rows
explicitly (DB-agnostic) plus email-keyed OTPs, so smoke-test signups
that were pointed at prod can be cleaned repeatably instead of via
ad-hoc SQL. Covered by 6 new tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.override.yml

@@ -15,3 +15,9 @@ services:
       - ./app:/app/app
     ports:
       - "${CASSANDRA_PORT:-8000}:8000"
+
+  admin:
+    # Dev: reach the console at http://localhost:8091 (loopback only). Prod
+    # drops this and fronts it with NPM instead (docker-compose.prod.yml).
+    ports:
+      - "127.0.0.1:${CASSANDRA_ADMIN_PORT:-8091}:8000"