Update contact subject dropdown to match actual services; update README

Contact form subject options now match the five service lines on the site:
New Project Inquiry, Mesh Networking, Managed Services, Structured
Cabling, Access Control, IP Camera Systems, Technical Support, Other.
Removed the old ISP-generic options (billing, coverage, new-service).
Updated $subject_labels in admin-inbox.php to match.

README updates:
- ADMIN_PASS added to web container env vars table and env vars section
- Project structure updated to include db.php and admin-inbox.php
- Milestone 1 contact form item updated to note MySQL storage
- Milestone 4 marks contact DB storage and staff inbox as complete;
  email notification remains as the next open item

https://claude.ai/code/session_015wpwmheufcxkBuXivrSHhd

README.md

@@ -127,6 +127,7 @@ docker build -t alwisp_web:latest .
 | `DB_NAME` | `alwisp` |
 | `DB_USER` | `alwisp_user` |
 | `DB_PASS` | *(same password set in Step 3)* |
+| `ADMIN_PASS` | *(password for the staff inbox at `/staff-portal`)* |
 
 4. Add **Path/Volume Mappings**:
 
@@ -216,6 +217,7 @@ Because the web container has a dedicated LAN IP, reverse proxy setup is straigh
 | `DB_NAME` | Database name (default: `alwisp`) |
 | `DB_USER` | Application DB user (default: `alwisp_user`) |
 | `DB_PASS` | Application DB password — make this strong |
+| `ADMIN_PASS` | Password for the staff inbox (`/staff-portal`) — change before going live |
 
 ---
 
@@ -243,13 +245,15 @@ alwisp/
     ├── assets/                 # Logos, images
     ├── includes/
     │   ├── header.php          # Global nav
-    │   └── footer.php          # Global footer
+    │   ├── footer.php          # Global footer
+    │   └── db.php              # PDO helper (auto-migrates schema)
     └── pages/
         ├── home.php
         ├── services.php
         ├── coverage.php
         ├── about.php
-        ├── contact.php
+        ├── contact.php         # Stores submissions in MySQL
+        ├── admin-inbox.php     # Staff inbox at /staff-portal (password-gated)
         └── 404.php
 ```
 
@@ -262,7 +266,7 @@ alwisp/
 - [x] Front-controller PHP router
 - [x] Responsive site skeleton with brand design system
 - [x] Homepage: hero, stats bar, services preview, why section, coverage CTA
-- [x] Contact form with server-side validation
+- [x] Contact form with server-side validation and MySQL storage
 - [x] Stub pages for all top-level routes (services, coverage, about, contact, 404)
 - [x] Security headers, OPcache, and Apache hardening
 - [x] Unraid-ready deployment via Docker Compose
@@ -288,10 +292,11 @@ alwisp/
 ---
 
 ### Milestone 4 — Customer Portal (Phase 1)
+- [x] Contact form stores submissions in MySQL
+- [x] Staff inbox (`/staff-portal`) — password-gated, mark read/unread, no email required
+- [ ] Email notification on new submission (PHPMailer)
 - [ ] Customer account creation and login (PHP sessions)
 - [ ] Account dashboard — plan details, billing status, support tickets
-- [ ] Contact form wired to database and email notification (PHPMailer)
-- [ ] Admin panel — view and respond to contact submissions
 - [ ] Password reset via email token
 
 ---