Merge admin panel into the port-80 webtools site under /admin/

webtools' nginx now reverse-proxies /admin/ to the webadmin container
(docker/conf/webtools-nginx.conf), which no longer publishes its own
port -- everything is reachable through port 80 alongside the GM
toolbox. Added a link to it in webtools/index.html's sidebar.

Flask needs to know it's mounted under /admin/ to generate correct
url_for()/redirect() targets, so app.py now wraps the app in
werkzeug's ProxyFix (x_prefix/x_proto/x_for/x_host) reading the
X-Forwarded-Prefix header nginx sets; verified redirects, form
actions, and links all come back /admin/-prefixed end to end through
port 80.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

webadmin/app.py

@@ -5,9 +5,14 @@ import hashlib
 import pymysql
 import pymysql.cursors
 from flask import Flask, request, session, redirect, url_for, render_template, flash
+from werkzeug.middleware.proxy_fix import ProxyFix
 
 app = Flask(__name__)
 app.secret_key = os.environ.get("ADMIN_SECRET_KEY", "dev-only-change-me")
+# Sits behind the webtools nginx container at /admin/ (see webtools/nginx.conf);
+# this reads X-Forwarded-Prefix/-Proto/-For so url_for()/redirect() produce
+# correct /admin/-prefixed URLs instead of root-relative ones.
+app.wsgi_app = ProxyFix(app.wsgi_app, x_prefix=1, x_proto=1, x_for=1, x_host=1)
 
 
 def hash_password(plaintext):