Add Settings -> Database viewer (Adminer) for local devs and any admin

Local dev gets an unauthenticated Adminer instance bound to loopback
only. In production, any account with is_admin=true can open it -
the app mints a short-lived token from a live admin session, which
Nginx's new db.ciagent.org block exchanges for a session cookie that
re-checks admin status on every request, instead of a shared static
password that wouldn't scale to multiple admins or revoke live.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

infrastructure/nginx/nginx.conf

@@ -28,7 +28,7 @@ http {
     # HTTPS at the edge, but the origin shouldn't 400 a direct :80 probe.
     server {
         listen 80;
-        server_name ciagent.org api.ciagent.org git.ciagent.org;
+        server_name ciagent.org api.ciagent.org git.ciagent.org db.ciagent.org;
         return 301 https://$host$request_uri;
     }
 
@@ -79,4 +79,49 @@ http {
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
     }
+
+    # Settings -> Database viewer (Adminer). Access isn't gated by a shared
+    # password - the app itself (app/api/v1/db_viewer.py) mints a short-lived
+    # token from a live admin session, which /_auth here exchanges for a
+    # session cookie that /_verify re-checks (including a fresh `is_admin`
+    # lookup) on every request via auth_request. See DEPLOYMENT.md.
+    server {
+        listen 443 ssl;
+        server_name db.ciagent.org;
+
+        ssl_certificate     /etc/nginx/certs/cloudflare-origin.pem;
+        ssl_certificate_key /etc/nginx/certs/cloudflare-origin.key;
+
+        # Adminer renders a raw SQL/data editor - not meant to be framed or
+        # MIME-sniffed as another content type.
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Content-Type-Options "nosniff" always;
+
+        # Optional extra hardening for admins with a static IP: uncomment
+        # and set your own address to additionally require it alongside a
+        # valid session (default `satisfy all` - both must pass, not either).
+        # allow 203.0.113.9;
+        # deny all;
+
+        location = /_verify {
+            internal;
+            proxy_pass http://api:8000/api/v1/db-viewer/verify;
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
+            proxy_set_header Cookie $http_cookie;
+        }
+
+        location = /_auth {
+            proxy_pass http://api:8000/api/v1/db-viewer/bootstrap;
+            proxy_set_header Host $host;
+        }
+
+        location / {
+            auth_request /_verify;
+            proxy_pass http://adminer:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+    }
 }