feat(adminsite): image, compose service, image build and docs

Publishes adminsite on 3004 -- 3000 is web, 3003 is the marketing site since
the port shuffle -- and adds the sixth CI image.

CLAUDE.md gains both new services. admin/ was never documented there at all:
the backend plan's wiring task covered compose and CI but not the file every
session actually loads. So this records admin's whole REST surface, its
404-not-403 rule, the three visual identities and, most importantly, that
adminsite/ and site/ share one token set with nothing enforcing the match --
the same hazard shape as sitesvc's mirrored slug rules.

Also notes that admin's REDIS_ADDR reaches admin only, because the base
compose hardcodes redis:6379 for server.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/docker-compose.site.yml

@@ -3,7 +3,7 @@ services:
         image: gitea.hostxtra.co.uk/mrhid6/vantage/site:latest
         restart: unless-stopped
         ports:
-            - 3002:3000
+            - 3003:3000
         depends_on:
             - sitesvc
     sitesvc:
@@ -33,9 +33,9 @@ services:
             PORT: "8083"
             ADMIN_MONGO_URI: ${ADMIN_MONGO_URI:-}
             CONTROL_MONGO_URI: ${MONGO_URI:-}
-            REDIS_ADDR: ${ADMIN_REDIS_ADDR:-10.10.10.2:6379}
-            REDIS_USERNAME: ${ADMIN_REDIS_USERNAME:-}
-            REDIS_PASSWORD: ${ADMIN_REDIS_PASSWORD:-}
+            REDIS_ADDR: ${REDIS_ADDR:-10.10.10.2:6379}
+            REDIS_USERNAME: ${REDIS_USERNAME:-}
+            REDIS_PASSWORD: ${REDIS_PASSWORD:-}
             LICENSE_SIGNING_KEY: ${LICENSE_SIGNING_KEY:-}
             PUBLIC_URL: ${ADMIN_PUBLIC_URL:-}
             ADMIN_ORIGIN: ${ADMIN_ORIGIN:-}
@@ -45,4 +45,17 @@ services:
             SMTP_USERNAME: ${SMTP_USERNAME:-}
             SMTP_PASSWORD: ${SMTP_PASSWORD:-}
             SMTP_FROM: ${SMTP_FROM:-}
+
+    # The staff and customer console, served at vantage-hq.hostxtra.co.uk.
+    # ADMIN_API_URL is baked into the image at build time, not read here, so
+    # changing it needs a rebuild rather than a restart — and it must appear in
+    # admin's ADMIN_ORIGIN above or the browser blocks every request.
+    adminsite:
+        image: gitea.hostxtra.co.uk/mrhid6/vantage/adminsite:latest
+        restart: unless-stopped
+        ports:
+            # 3000 is web, 3003 is the marketing site; this takes 3004.
+            - 3004:3000
+        depends_on:
+            - admin
 networks: {}