feat: Page Data dev loop, adm Code Run UI, and customer order demo

Add verify→Aider→OpenHands dev loop, memindadm config/history UI, and john4
customer-order Page Data demo with scenario + verification scripts.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/agent-run-worker-rollout-runbook.md

@@ -37,6 +37,47 @@ runtime-slo-report.ok=true
 runtime-slo-report.failures=[]
 ```
 
+## Admin DB Policy (Phase 1.5)
+
+Code-run **user/taskType/client toggles** can be managed in memindadm instead of rebuilding H5 for every change.
+
+| Layer | Controls |
+|-------|----------|
+| **memindadm** (`h5_agent_code_run_config`) | `codeRun.enabled`, `clientEnabled`, allowlists, `pageDataDev.autodetect`, `generalAutodetect`, `requireValidation` |
+| **Portal env** | `MEMIND_TOOL_GATEWAY_ENABLED`, worker queue topology, emergency override via `MEMIND_CODE_RUN_POLICY_SOURCE=env` |
+| **H5 runtime** | `/auth/status.agentCodeRun` → client autodetect without `VITE_*` rebuild |
+
+Admin API (memind_adm `:8082`):
+
+```text
+GET/PATCH /admin-api/agent-code-run/config
+GET       /admin-api/agent-code-run/runtime
+```
+
+Ops UI: super-admin console → **Code Run** (`/ops/admin/agent-code-run`).
+
+One-time env → DB migration (dev/staging):
+
+```bash
+node scripts/migrate-agent-code-run-config-from-env.mjs --dry-run
+node scripts/migrate-agent-code-run-config-from-env.mjs --updated-by <admin-user-uuid>
+```
+
+Verify effective policy after save:
+
+```bash
+curl -fsS http://127.0.0.1:8081/auth/status -H "Cookie: h5_user=<token>" | jq '.agentCodeRun'
+curl -fsS http://127.0.0.1:8081/api/runtime/status | jq '.toolRuntime.codeRunPolicy'
+```
+
+Page Data dev loop (local only):
+
+```bash
+MEMIND_TOOL_GATEWAY_ENABLED=1 npm run dev:page-data-aider-loop -- --dry-run
+```
+
+See also: [help-code01.md](./help-code01.md), [help-code02.md](./help-code02.md).
+
 ## One-user Canary Profile
 
 Use only for a controlled john-user canary.