feat!: remove the shared demo account

The demo account — one shared user that whitelisted emails entered from
the login page, reset on a schedule — goes end to end (owner decision,
E34): demo.py and the reset job, users.is_demo and demo_whitelist
(migration 0098 deletes the demo user, its audit rows, the reset job's
override and notices, then drops the column and table; the downgrade
restores the empty schema), the /auth/demo entry, the admin whitelist and
reset, the Demo tab, the banner, the login page's "Try the demo", and
every is_demo branch in routes, userscope, scheduler and the UI.

require_human only ever refused the demo account, so its 87 uses become
current_user (owner-approved); require_write_scope keeps its own check.
The login page's "or" divider now shows only beside the Google button:
without the demo entry under it, an instance without Google would have
said "or" to nothing.

A contract test (removedFeatures) fails on the word anywhere in the
backend, frontend, e2e or scripts — seen red on a planted hit. Size
ceilings tightened for the modules that shrank; admin.py is back under
the limit.

frontend/src/components/AppCommandPalette.dom.test.tsx

@@ -68,7 +68,6 @@ import AppCommandPalette from "./AppCommandPalette";
 const user = (over: Record<string, unknown> = {}) => ({
   id: 1,
   role: "user",
-  is_demo: false,
   plex_enabled: false,
   ...over,
 });
@@ -143,7 +142,7 @@ describe("AppCommandPalette", () => {
     expect(requestSurprise).toHaveBeenCalledTimes(1);
   });
 
-  it("offers the debug recorder by its state, and not to the demo account", () => {
+  it("offers the debug recorder by its state", () => {
     const recorder = () => ids("actions").filter((id) => id.startsWith("action:recorder:"));
     mount();
     expect(recorder()).toEqual(["action:recorder:start"]);
@@ -153,10 +152,5 @@ describe("AppCommandPalette", () => {
     me = user({ debug_session: { id: "0123456789abcdef", until, ended_at: null } });
     mount();
     expect(recorder()).toEqual(["action:recorder:step", "action:recorder:stop"]);
-
-    cleanup();
-    me = user({ is_demo: true });
-    mount();
-    expect(recorder()).toEqual([]);
   });
 });