feat!: remove the shared demo account

The demo account — one shared user that whitelisted emails entered from
the login page, reset on a schedule — goes end to end (owner decision,
E34): demo.py and the reset job, users.is_demo and demo_whitelist
(migration 0098 deletes the demo user, its audit rows, the reset job's
override and notices, then drops the column and table; the downgrade
restores the empty schema), the /auth/demo entry, the admin whitelist and
reset, the Demo tab, the banner, the login page's "Try the demo", and
every is_demo branch in routes, userscope, scheduler and the UI.

require_human only ever refused the demo account, so its 87 uses become
current_user (owner-approved); require_write_scope keeps its own check.
The login page's "or" divider now shows only beside the Google button:
without the demo entry under it, an instance without Google would have
said "or" to nothing.

A contract test (removedFeatures) fails on the word anywhere in the
backend, frontend, e2e or scripts — seen red on a planted hit. Size
ceilings tightened for the modules that shrank; admin.py is back under
the limit.

backend/app/routes/me.py

@@ -1,6 +1,6 @@
 from typing import Any
 
-from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Request
+from fastapi import APIRouter, BackgroundTasks, Depends, Request
 from pydantic import BaseModel, RootModel
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
@@ -131,7 +131,6 @@ def get_me(
         "display_name": user.display_name,
         "avatar_url": user.avatar_url,
         "role": user.role,
-        "is_demo": user.is_demo,
         "has_google": user.google_sub is not None,
         # The address Google answers with, when it DIFFERS from the account's own. Same string for
         # most people, and then this is None so no surface has to decide whether to show it — the
@@ -141,7 +140,7 @@ def get_me(
         ),
         "has_password": user.password_hash is not None,
         # The account's latest sign-in on any device — shown in Settings → Account, so a sign-in the
-        # user does not recognise is something they can see (null: none since 0.88, or the demo).
+        # user does not recognise is something they can see (null: none since 0.88).
         "last_login_at": iso(user.last_login_at),
         # Instance-wide: whether Google sign-in / YouTube connect is available at all (the UI hides
         # YouTube-access affordances and the onboarding nudge when it isn't configured).
@@ -184,15 +183,8 @@ def delete_my_account(
     """GDPR self-service erasure: permanently delete the signed-in account and ALL its personal
     data — OAuth tokens, subscriptions, tags, watch/save/hide states, playlists, notifications —
     which all cascade on the users row. Quota-audit events are kept but anonymised (FK SET NULL).
-    The shared demo account can't be deleted, and the last remaining admin can't delete itself
-    (that would lock everyone out of the admin surfaces)."""
-    # Structured, like the other three demo refusals: `req` leaves 403 to the caller and
-    # `notifyActionError` discards a plain-string detail in favour of the caller's translated
-    # fallback, so a hand-written English sentence here reaches a Hungarian UI as a generic
-    # "couldn't do that" — or, on this affordance, as nothing at all. `reason` distinguishes it
-    # from the other sites' bare `{code: "demo"}` so the UI can say what specifically is refused.
-    if user.is_demo:
-        raise HTTPException(status_code=403, detail={"code": "demo", "reason": "delete_account"})
+    The last remaining admin can't delete itself (that would lock everyone out of the admin
+    surfaces)."""
     if user.role == "admin" and count_admins(db) <= 1:
         raise refused(400, "only_admin_delete")
     user_id = user.id
@@ -242,10 +234,7 @@ def update_diagnostics(
 ) -> dict:
     """Raise the diagnostics level (the user consented in Settings → Diagnosztika) or return to the
     base. The expiry is the server's: a raised level always lapses after
-    `diagnostics.ELEVATION_HOURS`, whatever the client asks. The shared demo account cannot raise
-    it — its log would interleave every visitor's session under one account."""
-    if user.is_demo and body.level != diagnostics.BASE:
-        raise HTTPException(status_code=403, detail={"code": "demo", "reason": "diagnostics"})
+    `diagnostics.ELEVATION_HOURS`, whatever the client asks."""
     diagnostics.set_level(user, body.level)
     db.commit()
     # The rest of THIS request, and the process's elevation registry, follow the new level now.