feat!: remove the shared demo account

The demo account — one shared user that whitelisted emails entered from
the login page, reset on a schedule — goes end to end (owner decision,
E34): demo.py and the reset job, users.is_demo and demo_whitelist
(migration 0098 deletes the demo user, its audit rows, the reset job's
override and notices, then drops the column and table; the downgrade
restores the empty schema), the /auth/demo entry, the admin whitelist and
reset, the Demo tab, the banner, the login page's "Try the demo", and
every is_demo branch in routes, userscope, scheduler and the UI.

require_human only ever refused the demo account, so its 87 uses become
current_user (owner-approved); require_write_scope keeps its own check.
The login page's "or" divider now shows only beside the Google button:
without the demo entry under it, an instance without Google would have
said "or" to nothing.

A contract test (removedFeatures) fails on the word anywhere in the
backend, frontend, e2e or scripts — seen red on a planted hit. Size
ceilings tightened for the modules that shrank; admin.py is back under
the limit.

backend/tests/test_diagnostics.py

@@ -1,8 +1,8 @@
 """E22 S5 — a user's consented diagnostics level, and the browser log it lets in.
 
 Three parts:
-  * the level itself: the server computes its expiry, a lapsed one reads as the base, the demo
-    account cannot raise it (DB lane, through the real routes);
+  * the level itself: the server computes its expiry, a lapsed one reads as the base (DB lane,
+    through the real routes);
   * `POST /api/diagnostics/events`: refused at the base level, and nothing in a batch is trusted —
     the account comes from the session, everything is redacted again, events under the consented
     level are dropped, sizes and pace are capped (DB lane);
@@ -93,13 +93,6 @@ def test_only_the_three_levels_can_be_chosen(db, make_user, as_user):
         assert client.put("/api/me/diagnostics", json={"level": bogus}).status_code == 422
 
 
-def test_the_demo_account_can_return_to_the_base_but_never_raise_it(db, make_user, as_user):
-    client = as_user(make_user(is_demo=True))
-    r = client.put("/api/me/diagnostics", json={"level": "TRACE"})
-    assert r.status_code == 403 and r.json()["detail"]["code"] == "demo"
-    assert client.put("/api/me/diagnostics", json={"level": "INFO"}).status_code == 200
-
-
 def test_preferences_must_be_a_json_object(db, make_user, as_user):
     client = as_user(make_user())
     assert client.put("/api/me/preferences", json=["not", "an", "object"]).status_code == 422