feat!: remove the shared demo account

The demo account — one shared user that whitelisted emails entered from
the login page, reset on a schedule — goes end to end (owner decision,
E34): demo.py and the reset job, users.is_demo and demo_whitelist
(migration 0098 deletes the demo user, its audit rows, the reset job's
override and notices, then drops the column and table; the downgrade
restores the empty schema), the /auth/demo entry, the admin whitelist and
reset, the Demo tab, the banner, the login page's "Try the demo", and
every is_demo branch in routes, userscope, scheduler and the UI.

require_human only ever refused the demo account, so its 87 uses become
current_user (owner-approved); require_write_scope keeps its own check.
The login page's "or" divider now shows only beside the Google button:
without the demo entry under it, an instance without Google would have
said "or" to nothing.

A contract test (removedFeatures) fails on the word anywhere in the
backend, frontend, e2e or scripts — seen red on a planted hit. Size
ceilings tightened for the modules that shrank; admin.py is back under
the limit.

frontend/src/components/AccountPanel.tsx

@@ -175,18 +175,14 @@ export default function AccountPanel({
               }
               tone={a.has_google ? "ok" : "muted"}
             />
-            {/* The exact moment; the list row beside it only says how long ago. Null has two different
-                meanings, so it says which: nothing recorded yet, or the shared demo account, which is
-                deliberately never stamped. */}
+            {/* The exact moment; the list row beside it only says how long ago. */}
             <AccessRow
               icon={LogIn}
               label={t("users.account.lastLogin")}
               value={
                 a.last_login_at
                   ? formatDateTime(a.last_login_at, lang)
-                  : a.is_demo
-                    ? t("users.account.lastLoginDemo")
-                    : t("users.account.lastLoginNone")
+                  : t("users.account.lastLoginNone")
               }
             />
             {/* The gate that explains a Google sign-in silently becoming a fresh access request. */}
@@ -223,9 +219,7 @@ export default function AccountPanel({
               icon={<Send />}
               loading={resend.isPending}
               onClick={() => resend.mutate()}
-              // The demo account's address is never confirmed, and the server refuses to mail it — as
-              // it refuses it a set-password link below (deep-review E11 round 3).
-              disabled={user.is_demo || !a.email_configured || a.email_verified}
+              disabled={!a.email_configured || a.email_verified}
             >
               <span className="flex-1 text-left">{t("users.account.resend")}</span>
               {/* Says WHY it is unavailable instead of just greying out — the no-mail case is the
@@ -243,7 +237,6 @@ export default function AccountPanel({
               fullWidth
               icon={<KeyRound />}
               loading={issue.isPending}
-              disabled={user.is_demo}
               onClick={() => issue.mutate()}
               className="border border-accent/40 text-accent"
             >