feat!: remove the shared demo account

The demo account — one shared user that whitelisted emails entered from
the login page, reset on a schedule — goes end to end (owner decision,
E34): demo.py and the reset job, users.is_demo and demo_whitelist
(migration 0098 deletes the demo user, its audit rows, the reset job's
override and notices, then drops the column and table; the downgrade
restores the empty schema), the /auth/demo entry, the admin whitelist and
reset, the Demo tab, the banner, the login page's "Try the demo", and
every is_demo branch in routes, userscope, scheduler and the UI.

require_human only ever refused the demo account, so its 87 uses become
current_user (owner-approved); require_write_scope keeps its own check.
The login page's "or" divider now shows only beside the Google button:
without the demo entry under it, an instance without Google would have
said "or" to nothing.

A contract test (removedFeatures) fails on the word anywhere in the
backend, frontend, e2e or scripts — seen red on a planted hit. Size
ceilings tightened for the modules that shrank; admin.py is back under
the limit.

backend/tests/test_last_login.py

@@ -2,14 +2,13 @@
 
 The roadmap assumed stamping it in `_establish_session` would cover Google and password alike. It
 would not have: only password login called it, and the Google callback carried its own copy of the
-same four lines. So these pin BOTH doors through the real routes — plus the two that must not stamp
-(a refused password, the shared demo account) and the admin list that shows it.
+same four lines. So these pin BOTH doors through the real routes — plus the one that must not stamp
+(a refused password) and the admin list that shows it.
 """
 
 from datetime import datetime, timedelta, timezone
 
 from app.config import settings
-from app.models import DemoWhitelist
 from app.routes import auth as auth_routes
 
 _PW = "correct horse battery"
@@ -73,18 +72,6 @@ def test_a_google_sign_in_stamps_last_login(client, db, make_user, monkeypatch):
     assert client.get("/api/me").json()["id"] == user.id
 
 
-def test_the_demo_entry_does_not_stamp_the_shared_account(client, db):
-    db.add(DemoWhitelist(email="visitor@example.com"))
-    db.commit()
-
-    r = client.post("/auth/demo", json={"email": "visitor@example.com"})
-
-    assert r.json() == {"ok": True, "authenticated": True}
-    demo = auth_routes.get_or_create_demo_user(db)
-    db.refresh(demo)
-    assert demo.last_login_at is None
-
-
 def test_the_admin_user_list_carries_last_login(as_user, db, make_user):
     admin = make_user(email="boss@example.com", role="admin")
     never = make_user(email="never@example.com")