admin: front console via NPM + add purge-test-users CLI

Networking: the superadmin console now mirrors `app` instead of a
loopback-only host port. Base compose drops the host port; the dev
override binds 127.0.0.1:8091; the prod overlay joins the `intranet`
network and listens on :80 with --proxy-headers so NPM can proxy it.

CLI: add `purge-test-users` (dry-run by default, --commit to delete,
--keep allow-list defaulting to the real accounts). Deletes child rows
explicitly (DB-agnostic) plus email-keyed OTPs, so smoke-test signups
that were pointed at prod can be cleaned repeatably instead of via
ad-hoc SQL. Covered by 6 new tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -45,10 +45,19 @@ services:
       REDIS_URL: redis://readmarkets-redis-1:6379/0
 
   admin:
-    # Same DNS-collision reasoning as app/scheduler: use the project-prefixed
-    # container name for the DB. The console stays OFF the intranet network —
-    # it is internal-only (127.0.0.1:8091 host port from the base file), so it
-    # never needs to be reachable by NPM.
+    # Fronted by NPM like `app`: listen on 80 and join the `intranet` network
+    # so the proxy can reach it as `readmarkets-admin-1:80`. No host port.
+    # --proxy-headers so redirect/asset URLs honour X-Forwarded-Proto from NPM.
+    # Still gated by ADMIN_CONSOLE_PASSWORD; add an NPM access rule in front for
+    # a second layer. Project-prefixed DB name avoids the shared-network `db`
+    # DNS collision (same reason as app/scheduler).
+    command: ["uvicorn", "admin.main:app", "--host", "0.0.0.0", "--port", "80",
+              "--workers", "1", "--proxy-headers", "--forwarded-allow-ips=*"]
+    expose:
+      - "80"
+    networks:
+      - default
+      - intranet
     environment:
       DATABASE_URL: mysql+aiomysql://${MARIADB_USER:-cassandra}:${MARIADB_PASSWORD:-changeme}@readmarkets-db-1:3306/${MARIADB_DATABASE:-cassandra}