Consider integrating django-read-only

[toolness]

To make sure we don't accidentally do writes on the production db from e.g. our terminal:

https://adamj.eu/tech/2020/10/12/prevent-unintended-data-modification-with-django-read-only/

I think another option is just to use a DATABASE_URL that uses a user with read-only permissions to the DB.

[toolness]

When we added support for django-sql-dashboard in #2103, we created a read-only user in production. Although it doesn't have access to really sensitive fields like password hashes, it's useful for almost any kind of analytics task.