feat!: remove the shared demo account

The demo account — one shared user that whitelisted emails entered from
the login page, reset on a schedule — goes end to end (owner decision,
E34): demo.py and the reset job, users.is_demo and demo_whitelist
(migration 0098 deletes the demo user, its audit rows, the reset job's
override and notices, then drops the column and table; the downgrade
restores the empty schema), the /auth/demo entry, the admin whitelist and
reset, the Demo tab, the banner, the login page's "Try the demo", and
every is_demo branch in routes, userscope, scheduler and the UI.

require_human only ever refused the demo account, so its 87 uses become
current_user (owner-approved); require_write_scope keeps its own check.
The login page's "or" divider now shows only beside the Google button:
without the demo entry under it, an instance without Google would have
said "or" to nothing.

A contract test (removedFeatures) fails on the word anywhere in the
backend, frontend, e2e or scripts — seen red on a planted hit. Size
ceilings tightened for the modules that shrank; admin.py is back under
the limit.

backend/tests/test_body_limit.py

@@ -120,7 +120,7 @@ def test_a_raised_ceiling_is_still_a_ceiling():
     """The difference between this and an exemption, and the reason the list is a mapping: a route
     that needs more bytes does not thereby get unlimited bytes. Left uncounted, the upload route
     would let an ANONYMOUS caller stream without bound — FastAPI parses a declared body before the
-    first dependency, so `require_human` has not run yet when the bytes land."""
+    first dependency, so the auth dependency has not run yet when the bytes land."""
     over = b"x" * (BIG[("POST", "/api/things/{tid}/blob")] + 1)
     r = _client(routes=BIG).post("/api/things/abc/blob", content=over)
     assert r.status_code == 413
@@ -514,7 +514,7 @@ def test_no_route_with_a_raised_ceiling_declares_a_body_parameter(method, templa
     A raised ceiling is only honest when the route's own cap applies to the bytes AS THEY ARRIVE.
     FastAPI reads and spools a DECLARED body (`= File(...)`, `= Form(...)`, a Pydantic model)
     BEFORE the first dependency resolves — so on such a route this middleware's ceiling is the only
-    thing between an anonymous caller and the whole allowance, `require_human` never gets a say, and
+    thing between an anonymous caller and the whole allowance, the auth dependency never gets a say, and
     the route's in-handler cap measures bytes that have already landed. That is exactly what P1
     closed on the upload route, which sat in `ROUTE_MAX_BODY_BYTES` with a 500 MiB ceiling and a
     `file: UploadFile = File(...)` body for one release.