Merge admin panel into the port-80 webtools site under /admin/

webtools' nginx now reverse-proxies /admin/ to the webadmin container
(docker/conf/webtools-nginx.conf), which no longer publishes its own
port -- everything is reachable through port 80 alongside the GM
toolbox. Added a link to it in webtools/index.html's sidebar.

Flask needs to know it's mounted under /admin/ to generate correct
url_for()/redirect() targets, so app.py now wraps the app in
werkzeug's ProxyFix (x_prefix/x_proto/x_for/x_host) reading the
X-Forwarded-Prefix header nginx sets; verified redirects, form
actions, and links all come back /admin/-prefixed end to end through
port 80.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -88,6 +88,9 @@ services:
       - "80:80"
     volumes:
       - "./webtools:/usr/share/nginx/html:ro"
+      - "./docker/conf/webtools-nginx.conf:/etc/nginx/conf.d/default.conf:ro"
+    depends_on:
+      - webadmin
 
   webadmin:
     build:
@@ -101,8 +104,8 @@ services:
       DB_NAME: ${DB_NAME:-ktrose}
       ADMIN_SECRET_KEY: ${ADMIN_SECRET_KEY:-change-me-too}
       ADMIN_MIN_ACCESSLEVEL: ${ADMIN_MIN_ACCESSLEVEL:-900}
-    ports:
-      - "8081:8080"
+    expose:
+      - "8080"
     depends_on:
       db:
         condition: service_healthy