Admin panel (:8767): config, profiles, service control, paper/live switch

New admin service — LAN-only, token-authed (ADMIN_TOKEN), card-based UI
matching the owner's preferred dashboard style. Capabilities:
- health: docker containers via /var/run/docker.sock (stdlib unix-socket
  HTTP client), DB heartbeat, Alpaca account/clock, Ollama, feed
- config: whitelisted strategy knobs (TRADING_/TRIGGER_/WATCHER_/...)
  edited via data/overrides.env, which every entrypoint now loads with
  override=True at boot (runtime/env_overrides.py) — so changes apply on
  container restart without touching the deployment YAML; secrets are
  presence-only and rejected server-side if edited
- profiles: named knob presets (seeded: validated-core, conservative,
  squeeze-hunter) applied in one click
- restart buttons per container; paper/live switch guarded behind
  ALPACA_LIVE_* keys existing
Verified live in docker: auth 401s, status/config/profiles/write paths,
secret-edit rejection, page serves. Added to both compose files.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/docker/truenas-compose.yml

@@ -102,6 +102,19 @@ services:
     <<: *app
     command: ["python", "-u", "-m", "youtube_claims.run", "run"]
 
+  admin:
+    <<: *app
+    command: ["python", "-u", "admin_api.py"]
+    environment:
+      <<: *app-env
+      ADMIN_PORT: "8767"
+      ADMIN_TOKEN: <FILL-ME-ADMIN-TOKEN>
+    ports:
+      - "8767:8767"
+    volumes:
+      - /mnt/volume/Apps/momentum/data:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock   # service status + restarts
+
   scheduler:
     <<: *app
     command: