feat!: remove the shared demo account

The demo account — one shared user that whitelisted emails entered from
the login page, reset on a schedule — goes end to end (owner decision,
E34): demo.py and the reset job, users.is_demo and demo_whitelist
(migration 0098 deletes the demo user, its audit rows, the reset job's
override and notices, then drops the column and table; the downgrade
restores the empty schema), the /auth/demo entry, the admin whitelist and
reset, the Demo tab, the banner, the login page's "Try the demo", and
every is_demo branch in routes, userscope, scheduler and the UI.

require_human only ever refused the demo account, so its 87 uses become
current_user (owner-approved); require_write_scope keeps its own check.
The login page's "or" divider now shows only beside the Google button:
without the demo entry under it, an instance without Google would have
said "or" to nothing.

A contract test (removedFeatures) fails on the word anywhere in the
backend, frontend, e2e or scripts — seen red on a planted hit. Size
ceilings tightened for the modules that shrank; admin.py is back under
the limit.

backend/app/routes/saved_views.py

@@ -4,15 +4,14 @@ from sqlalchemy import func, select, update
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
-from app.auth import require_human
+from app.auth import current_user
 from app.db import get_db
 from app.models import SavedView, User
 from app.routes._common import owned_or_404
 from app.refusal import refused
 
 # Saved "smart views": per-user named snapshots of a module's filters (feed or plex, keyed by
-# `source`). Gated behind require_human so the shared demo account can't pollute a communal list
-# (mirrors how other personal-state writes are scoped).
+# `source`).
 router = APIRouter(prefix="/api/saved-views", tags=["saved-views"])
 
 # The modules that own saved views. A view is scoped to exactly one; the default is "feed" so a caller
@@ -37,7 +36,7 @@ def _serialize(v: SavedView) -> dict:
 @router.get("")
 def list_views(
     source: str = "feed",
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> list[dict]:
     source = _norm_source(source)
@@ -81,7 +80,7 @@ class CreateViewIn(BaseModel):
 @router.post("")
 def create_view(
     body: CreateViewIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     name = body.name.strip()
@@ -124,7 +123,7 @@ class UpdateViewIn(BaseModel):
 def update_view(
     view_id: int,
     body: UpdateViewIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     view = owned_or_404(db, SavedView, view_id, user, what="view")
@@ -163,7 +162,7 @@ def update_view(
 @router.delete("/{view_id}")
 def delete_view(
     view_id: int,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     view = owned_or_404(db, SavedView, view_id, user, what="view")
@@ -179,7 +178,7 @@ class ReorderViewsIn(BaseModel):
 @router.post("/reorder")
 def reorder_views(
     body: ReorderViewsIn,
-    user: User = Depends(require_human),
+    user: User = Depends(current_user),
     db: Session = Depends(get_db),
 ) -> dict:
     ids = body.ids