feat(infra): add pgAdmin4 web sidecar pointed at pgbouncer

Phase 2 of the pgbouncer + pgAdmin rollout. pgAdmin4 runs as a Coolify-
managed container on the same Docker network as pgbouncer, with a
pre-registered server entry so the tracksolid_db (via pgbouncer) tree
appears immediately on first login.

Net effect: admin tooling moves on-VM (low latency, persistent workspace
in pgadmin-data volume) and connects through pgbouncer:6432 in transaction
mode, so opening many Query Tool tabs no longer exhausts max_connections.
The desktop pgAdmin can be retired once this is verified live, after
which host port 5433 can also be closed.

Requires PGADMIN_DEFAULT_EMAIL and PGADMIN_DEFAULT_PASSWORD in the
Coolify env, plus a subdomain mapping to this service on port 80.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yaml

@@ -115,6 +115,26 @@ services:
       timeout: 5s
       retries: 3
 
+  pgadmin:
+    # Web pgAdmin4, connecting to tracksolid_db through pgbouncer.
+    # Runbook: 260507_pgbouncer_deployment.md (Phase 2)
+    # Coolify UI maps a subdomain to this service on internal port 80.
+    image: dpage/pgadmin4
+    restart: always
+    depends_on:
+      pgbouncer:
+        condition: service_healthy
+    env_file: .env
+    environment:
+      - PGADMIN_DEFAULT_EMAIL=${PGADMIN_DEFAULT_EMAIL}
+      - PGADMIN_DEFAULT_PASSWORD=${PGADMIN_DEFAULT_PASSWORD}
+      - PGADMIN_CONFIG_SERVER_MODE=True
+      - PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED=False
+      - PGADMIN_DISABLE_POSTFIX=True
+    volumes:
+      - pgadmin-data:/var/lib/pgadmin
+      - ./pgadmin/servers.json:/pgadmin4/servers.json:ro
+
   db_backup:
     build:
       context: ./backup
@@ -141,3 +161,5 @@ volumes:
     name: timescale-data
   grafana-data:
     name: grafana-data
+  pgadmin-data:
+    name: pgadmin-data

pgadmin/servers.json

@@ -0,0 +1,17 @@
+{
+  "Servers": {
+    "1": {
+      "Name": "tracksolid_db (via pgbouncer)",
+      "Group": "Servers",
+      "Host": "pgbouncer",
+      "Port": 6432,
+      "MaintenanceDB": "tracksolid_db",
+      "Username": "postgres",
+      "SSLMode": "disable",
+      "ConnectionParameters": {
+        "sslmode": "disable",
+        "connect_timeout": 10
+      }
+    }
+  }
+}