fix(compose): standardize adminfront port env name

- replace legacy ADMIN_PORT usage with ADMINFRONT_PORT
- add policy test to prevent compose variable drift

test/adminfront_port_env_policy_test.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+EXPECTED_FILES=(
+  "$ROOT_DIR/docker-compose.yaml"
+  "$ROOT_DIR/docker/staging_pull_compose.template.yaml"
+  "$ROOT_DIR/docker/docker-compose.staging.template.yaml"
+)
+
+for file in "${EXPECTED_FILES[@]}"; do
+  if [[ ! -f "$file" ]]; then
+    echo "ERROR: expected file not found: $file"
+    exit 1
+  fi
+done
+
+legacy_refs="$(grep -R -n '\${ADMIN_PORT:-' "${EXPECTED_FILES[@]}" || true)"
+if [[ -n "$legacy_refs" ]]; then
+  echo "ERROR: legacy ADMIN_PORT references remain"
+  echo "$legacy_refs"
+  exit 1
+fi
+
+for file in "${EXPECTED_FILES[@]}"; do
+  if ! grep -q '\${ADMINFRONT_PORT:-5173}:5173' "$file"; then
+    echo "ERROR: ADMINFRONT_PORT mapping missing in $file"
+    exit 1
+  fi
+done
+
+echo "OK: AdminFront compose port policy uses ADMINFRONT_PORT only"