Add Settings -> Database viewer (Adminer) for local devs and any admin

Local dev gets an unauthenticated Adminer instance bound to loopback
only. In production, any account with is_admin=true can open it -
the app mints a short-lived token from a live admin session, which
Nginx's new db.ciagent.org block exchanges for a session cookie that
re-checks admin status on every request, instead of a shared static
password that wouldn't scale to multiple admins or revoke live.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/api/app/models/enums.py

@@ -153,6 +153,7 @@ class SecurityEventType(StrEnum):
     EMAIL_VERIFIED = "email_verified"
     SERVER_SECRET_UPDATED = "server_secret_updated"
     API_KEY_UPDATED = "api_key_updated"
+    DB_VIEWER_SESSION_CREATED = "db_viewer_session_created"
 
 
 class ApiKeyProvider(StrEnum):