Add Settings -> Database viewer (Adminer) for local devs and any admin

Local dev gets an unauthenticated Adminer instance bound to loopback
only. In production, any account with is_admin=true can open it -
the app mints a short-lived token from a live admin session, which
Nginx's new db.ciagent.org block exchanges for a session cookie that
re-checks admin status on every request, instead of a shared static
password that wouldn't scale to multiple admins or revoke live.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

docker-compose.prod.yml

@@ -106,6 +106,7 @@ services:
       args:
         NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
         NEXT_PUBLIC_GIT_REPO_URL: ${NEXT_PUBLIC_GIT_REPO_URL:-}
+        NEXT_PUBLIC_DB_VIEWER_URL: ${NEXT_PUBLIC_DB_VIEWER_URL:-}
     restart: unless-stopped
     depends_on:
       - api
@@ -150,6 +151,19 @@ services:
       - "2222:22"
     logging: *default-logging
 
+  # Settings -> Database viewer: internal-only, reached through nginx's
+  # db.ciagent.org block (app/api/v1/db_viewer.py issues the credential -
+  # see that module's docstring). No host port published.
+  adminer:
+    image: adminer:4.8.1-standalone
+    restart: unless-stopped
+    environment:
+      ADMINER_DEFAULT_SERVER: postgres
+    depends_on:
+      postgres:
+        condition: service_healthy
+    logging: *default-logging
+
   nginx:
     image: nginx:1.27-alpine
     restart: unless-stopped
@@ -157,6 +171,7 @@ services:
       - web
       - api
       - gitea
+      - adminer
     volumes:
       - ./infrastructure/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
       # Cloudflare Origin CA cert/key, generated once via the Cloudflare