feat!: remove the shared demo account

The demo account — one shared user that whitelisted emails entered from
the login page, reset on a schedule — goes end to end (owner decision,
E34): demo.py and the reset job, users.is_demo and demo_whitelist
(migration 0098 deletes the demo user, its audit rows, the reset job's
override and notices, then drops the column and table; the downgrade
restores the empty schema), the /auth/demo entry, the admin whitelist and
reset, the Demo tab, the banner, the login page's "Try the demo", and
every is_demo branch in routes, userscope, scheduler and the UI.

require_human only ever refused the demo account, so its 87 uses become
current_user (owner-approved); require_write_scope keeps its own check.
The login page's "or" divider now shows only beside the Google button:
without the demo entry under it, an instance without Google would have
said "or" to nothing.

A contract test (removedFeatures) fails on the word anywhere in the
backend, frontend, e2e or scripts — seen red on a planted hit. Size
ceilings tightened for the modules that shrank; admin.py is back under
the limit.

backend/tests/test_upload.py

@@ -186,7 +186,7 @@ def test_an_anonymous_upload_is_refused_before_a_byte_of_it_is_read(client):
     """P1 — the defect E27 bounded but did not close.
 
     While the route declared `file: UploadFile = File(...)`, FastAPI parsed and spooled the body
-    BEFORE the first dependency ran, so `require_human` could not gate it: an unauthenticated
+    BEFORE the first dependency ran, so the auth dependency could not gate it: an unauthenticated
     caller could make the server write the whole per-file allowance (500 MiB by default) to temp,
     per request. SEC-20's ceiling capped the number; it could not stop the writing.
 
@@ -532,7 +532,6 @@ def _display_write_sites() -> dict[tuple[str, str], set[str]]:
 # file has transferred — so each of these has to be bounded, and each one here has been read.
 #
 # Bounded by `display_text` unless noted:
-#   auth.get_or_create_demo_user      a literal.
 #   service.redownload                CLEARS the field so the fresh metadata wins — `None` is the
 #                                     one value that needs no bound, and a clear is still a write.
 #   service.enqueue / enqueue_edit    `display_name` is already bounded by its caller; the fallback
@@ -544,7 +543,6 @@ def _display_write_sites() -> dict[tuple[str, str], set[str]]:
 # `not []` and enforcing nothing, which is how a drift guard dies quietly (round 3). This one fails
 # when a site appears, when one disappears, and when one changes what it writes.
 DISPLAY_WRITE_SITES = {
-    ("auth.py", "get_or_create_demo_user"): {"'Demo'"},
     ("downloads/service.py", "redownload"): {"None"},
     ("downloads/service.py", "enqueue"): {
         "display_name or (asset.title[:DISPLAY_TEXT_MAX] "