Add Settings -> Database viewer (Adminer) for local devs and any admin

Local dev gets an unauthenticated Adminer instance bound to loopback
only. In production, any account with is_admin=true can open it -
the app mints a short-lived token from a live admin session, which
Nginx's new db.ciagent.org block exchanges for a session cookie that
re-checks admin status on every request, instead of a shared static
password that wouldn't scale to multiple admins or revoke live.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

.env.example

@@ -22,6 +22,14 @@ NEXT_PUBLIC_API_URL=http://localhost:8000
 # this if you run your own self-hosted git server and want the button to
 # point at your fork instead of upstream.
 NEXT_PUBLIC_GIT_REPO_URL=
+# "Open database viewer" link on the Settings page (local developers and
+# server admins only). Access is gated by a short-lived token minted from a
+# real admin login (see apps/api/app/api/v1/db_viewer.py), not a separate
+# password. Blank by default - deliberately NOT defaulted the way
+# NEXT_PUBLIC_GIT_REPO_URL is, since this points at your own deployment's
+# private Adminer instance. Set to https://db.ciagent.org (or your own
+# subdomain) once the db.ciagent.org Nginx block and DNS record exist.
+NEXT_PUBLIC_DB_VIEWER_URL=
 
 # --- Reverse proxy (only relevant once deployed behind Cloudflare/Nginx) -----
 # Empty = trust the direct connection for client-IP resolution (correct for