feat!: remove the shared demo account

The demo account — one shared user that whitelisted emails entered from
the login page, reset on a schedule — goes end to end (owner decision,
E34): demo.py and the reset job, users.is_demo and demo_whitelist
(migration 0098 deletes the demo user, its audit rows, the reset job's
override and notices, then drops the column and table; the downgrade
restores the empty schema), the /auth/demo entry, the admin whitelist and
reset, the Demo tab, the banner, the login page's "Try the demo", and
every is_demo branch in routes, userscope, scheduler and the UI.

require_human only ever refused the demo account, so its 87 uses become
current_user (owner-approved); require_write_scope keeps its own check.
The login page's "or" divider now shows only beside the Google button:
without the demo entry under it, an instance without Google would have
said "or" to nothing.

A contract test (removedFeatures) fails on the word anywhere in the
backend, frontend, e2e or scripts — seen red on a planted hit. Size
ceilings tightened for the modules that shrank; admin.py is back under
the limit.

frontend/src/components/AdminUsers.dom.test.tsx

@@ -44,7 +44,6 @@ const row = {
   email: "gone@x",
   role: "user",
   is_suspended: false,
-  is_demo: false,
   email_verified: true,
   is_active: true,
 } as unknown as AdminUserRow;
@@ -83,7 +82,6 @@ describe("the last sign-in column (E22 S1)", () => {
     vi.spyOn(api, "adminUsers").mockResolvedValue([
       { ...row, id: 3, email: "seen@x", last_login_at: at },
       { ...row, id: 4, email: "never@x", last_login_at: null },
-      { ...row, id: 5, email: "demo@x", is_demo: true, last_login_at: null },
     ] as never);
     render(
       <QueryClientProvider
@@ -94,7 +92,7 @@ describe("the last sign-in column (E22 S1)", () => {
     );
 
     expect(await screen.findByText(relativeTime(at, "en"))).toBeTruthy();
-    expect(screen.getAllByText("—")).toHaveLength(2);
+    expect(screen.getAllByText("—")).toHaveLength(1);
   });
 });