admin: front console via NPM + add purge-test-users CLI

Networking: the superadmin console now mirrors `app` instead of a
loopback-only host port. Base compose drops the host port; the dev
override binds 127.0.0.1:8091; the prod overlay joins the `intranet`
network and listens on :80 with --proxy-headers so NPM can proxy it.

CLI: add `purge-test-users` (dry-run by default, --commit to delete,
--keep allow-list defaulting to the real accounts). Deletes child rows
explicitly (DB-agnostic) plus email-keyed OTPs, so smoke-test signups
that were pointed at prod can be cleaned repeatably instead of via
ad-hoc SQL. Covered by 6 new tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -79,8 +79,10 @@ services:
 
   # Superadmin console — independent read-only operator dashboard. Same
   # image (reuses app.db/app.models) but runs admin.main:app instead of the
-  # public app, and NEVER runs migrations. Bound to 127.0.0.1 only: it is
-  # reached over an SSH tunnel, never exposed publicly (no intranet/NPM).
+  # public app, and NEVER runs migrations. No host port here, mirroring `app`:
+  # dev adds a loopback port (docker-compose.override.yml) and prod joins the
+  # `intranet` network so NPM can proxy it (docker-compose.prod.yml). Still
+  # gated by ADMIN_CONSOLE_PASSWORD.
   admin:
     build: .
     restart: unless-stopped
@@ -92,14 +94,6 @@ services:
       - ./config:/app/config:ro
       - ./app:/app/app
       - ./admin:/app/admin
-    ports:
-      # Host-loopback only — access via `ssh -L 8091:localhost:8091 <vps>`.
-      - "127.0.0.1:8091:8000"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8000/healthz"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
     depends_on:
       db:
         condition: service_healthy