refactor: move Vantage HQ out to the vantage-admin repository

admin/ and adminsite/ are extracted with their history to
gitea.hostxtra.co.uk/vantage/vantage-admin, where they are named server/
and web/ for what they are rather than for the services they run. Their
images move with them, to vantage/vantage-admin/{server,web}.

Nothing here imported them, so the cut is clean: the only coupling was
always at runtime, through admin writing into the control plane's
database. The parts of that contract this side enforces are unchanged and
still documented here — hq-sourced users, POST /license answering 409
cloud_managed, and FREE_INSTANCE_REAP_AFTER needing to match.

LICENSE_SIGNING_KEY now appears in no compose file in this repository.
Keeping it out used to be a rule someone had to remember; it is the
repository boundary now.

docker-compose.site.yml loses both services and gains a note on how the
host composes the three files together.

deploy/docker/docker-compose.site.yml

@@ -22,39 +22,18 @@ services:
             SMTP_PASSWORD: ${SMTP_PASSWORD:-}
             SMTP_FROM: ${SMTP_FROM:-}
             SMTP_TO: ${SMTP_TO:-support@hostxtra.co.uk}
-    admin:
-        image: gitea.hostxtra.co.uk/mrhid6/vantage/admin:latest
-        restart: unless-stopped
-        ports:
-            - 8083:8083
-        environment:
-            PORT: "8083"
-            ADMIN_MONGO_URI: ${ADMIN_MONGO_URI:-}
-            CONTROL_MONGO_URI: ${MONGO_URI:-}
-            REDIS_ADDR: ${REDIS_ADDR:-10.10.10.2:6379}
-            REDIS_USERNAME: ${REDIS_USERNAME:-}
-            REDIS_PASSWORD: ${REDIS_PASSWORD:-}
-            LICENSE_SIGNING_KEY: ${LICENSE_SIGNING_KEY:-}
-            PUBLIC_URL: ${ADMIN_PUBLIC_URL:-}
-            ADMIN_ORIGIN: ${ADMIN_ORIGIN:-}
-            TRUST_PROXY: ${TRUST_PROXY:-true}
-            SMTP_HOST: ${SMTP_HOST:-}
-            SMTP_PORT: ${SMTP_PORT:-587}
-            SMTP_USERNAME: ${SMTP_USERNAME:-}
-            SMTP_PASSWORD: ${SMTP_PASSWORD:-}
-            SMTP_FROM: ${SMTP_FROM:-}
-            APP_LOGIN_URL: ${APP_LOGIN_URL:-}
-            FREE_INSTANCE_REAP_AFTER: "336h"
-            PADDLE_ENV: ${PADDLE_ENV:-sandbox}
-            PADDLE_API_KEY: ${PADDLE_API_KEY:-}
-            PADDLE_WEBHOOK_SECRET: ${PADDLE_WEBHOOK_SECRET:-}
-    adminsite:
-        image: gitea.hostxtra.co.uk/mrhid6/vantage/adminsite:latest
-        restart: unless-stopped
-        ports:
-            - 3004:3000
-        depends_on:
-            - admin
+    # admin and adminsite are NOT here. They live in the vantage-admin
+    # repository, which carries its own fragment; the host composes all three
+    # files together:
+    #
+    #   docker compose \
+    #     -f vantage/deploy/docker/docker-compose.yml \
+    #     -f vantage/deploy/docker/docker-compose.site.yml \
+    #     -f vantage-admin/deploy/docker-compose.yml \
+    #     up -d
+    #
+    # LICENSE_SIGNING_KEY went with them, and must never appear in this file:
+    # admin is the only signer and the control plane must not hold the key.
     # Static docs, served by nginx at vantage.hostxtra.co.uk/docs through its own
     # proxy location. That location must sort ABOVE the catch-all forwarding to
     # site:3003, or Next serves its own 404 for /docs. The container serves from