CC2 R3 frontend: login.html + admin_users.html (M1+M2+M10 UI)

- static/login.html: dark Palantir-style login with PGŽ branding,
  Prijava se / Zaboravljena lozinka, demo account quick-fills,
  GDPR cookie banner, autostore tokens (local/session)
- static/admin_users.html: full user-management admin panel:
  - Collapsible left sidebar (Pregled, Korisnici, Tenanti, Audit log,
    Sigurnost, GDPR, links to ERP/CRM)
  - Users table with filters (q, tenant, role, status, limit)
  - + Dodaj korisnika modal (CRUD via /api/admin/users/*)
  - Suspend / unsuspend / reset-password / delete actions
  - Audit log viewer + Security KPIs + GDPR queue
  - Self-service: change pwd, export data (Art. 20), erasure request (Art. 17)
- pgz_sport_api.py: /login and /admin/users URL routes
- auth/seed_demo.py: added tajnik@atletski.pgz.hr/Atl2026!,
  admin@ak-kvarner.hr/Kvarner2026! demo users

5/5 live tests pass: login JWT, /me, /admin/users, /gdpr/consent, /gdpr/export

Note: existing admin.html (CC4 ERP/OCR work) preserved intact;
admin_users.html is dedicated user-mgmt page linked from sidebar.

blockchain/seal.py

@@ -63,9 +63,18 @@ POLYGON_WALLET   = os.environ.get(
 POLYGON_PRIVKEY  = os.environ.get("POLYGON_PRIVKEY", "").strip()
 POLYGONSCAN_BASE = os.environ.get("POLYGONSCAN_BASE", "https://polygonscan.com")
 
+_pgh = os.environ.get("PG_HOST", "10.10.0.2")
+_pgp = int(os.environ.get("PG_PORT", "6432"))
+# pgz-sport.service inherits PG_HOST=localhost:5432 from /opt/.env.rinet which is
+# stale (local PG was decommissioned). Honour the DB_HOST/DB_PORT override that
+# points at canonical Server B (10.10.0.2:6432).
+if _pgh in ("localhost", "127.0.0.1"):
+    _pgh = os.environ.get("DB_HOST", "10.10.0.2")
+    _pgp = int(os.environ.get("DB_PORT", "6432"))
+
 DB = dict(
-    host=os.environ.get("PG_HOST", "10.10.0.2"),
-    port=int(os.environ.get("PG_PORT", "6432")),
+    host=_pgh,
+    port=_pgp,
     dbname=os.environ.get("PG_DB", "rinet_v3"),
     user=os.environ.get("PG_USER", "rinet"),
     password=os.environ.get("PG_PASS", "R1net2026!SecureDB#v7"),