Looks like the server is MSSQL 2019. So, PostgREST won't work but hasura will work basically straight out of the box (Just, please no graphql..). Hasura is basically just a dbms client with tooling attached, so we don't necessarily need to figure out the schema beforehand.
Once connected to the prod db, we'd then just expose API-relevant data over API.
The big challenge, depending on the ZK Dev's threat model, is that hasura will need a read-only user that has certain sensitive tables blacklisted, just so they're not exposed through Hasura just so that me nor Killingtime or whoever works on this, can steal those tables.
Aquanim -- is that something you'd be comfortable with? AFAIK, we'd just need a read-only user, preferably with credential/moderator tables blacklisted.