Add contact form DB storage and hidden staff inbox

- contact.php now inserts submissions into MySQL via PDO prepared
  statements; raw values stored (htmlspecialchars moved to output only)
- www/includes/db.php: shared PDO helper with auto-migration that adds
  the is_read column to existing deployments without a full DB reset
- docker/mysql/init.sql: added is_read TINYINT column to contacts table
  for fresh deploys
- www/pages/admin-inbox.php: self-contained staff inbox at /staff-portal
  with session-based password login, per-message mark-as-read, and
  mark-all-read; unread count shown in browser tab title
- index.php: routes /staff-portal before public header/footer so the
  admin page is fully standalone
- docker-compose.yml: ADMIN_PASS env var wired to web container

Set ADMIN_PASS in .env (gitignored) before deploying.
If the DB volume already exists, the auto-migration in db.php will
add the is_read column automatically on first request.

https://claude.ai/code/session_015wpwmheufcxkBuXivrSHhd

www/index.php

@@ -2,6 +2,12 @@
 // Simple front controller — expand routing here later
 $path = trim($_GET['path'] ?? '', '/');
 
+// Staff inbox — self-contained, no public header/footer
+if ($path === 'staff-portal') {
+    require __DIR__ . '/pages/admin-inbox.php';
+    exit;
+}
+
 // Map paths to page includes
 $pages = [
     ''          => 'pages/home.php',