- replace legacy ADMIN_PORT usage with ADMINFRONT_PORT - add policy test to prevent compose variable drift