feat!: remove the shared demo account

The demo account — one shared user that whitelisted emails entered from
the login page, reset on a schedule — goes end to end (owner decision,
E34): demo.py and the reset job, users.is_demo and demo_whitelist
(migration 0098 deletes the demo user, its audit rows, the reset job's
override and notices, then drops the column and table; the downgrade
restores the empty schema), the /auth/demo entry, the admin whitelist and
reset, the Demo tab, the banner, the login page's "Try the demo", and
every is_demo branch in routes, userscope, scheduler and the UI.

require_human only ever refused the demo account, so its 87 uses become
current_user (owner-approved); require_write_scope keeps its own check.
The login page's "or" divider now shows only beside the Google button:
without the demo entry under it, an instance without Google would have
said "or" to nothing.

A contract test (removedFeatures) fails on the word anywhere in the
backend, frontend, e2e or scripts — seen red on a planted hit. Size
ceilings tightened for the modules that shrank; admin.py is back under
the limit.

frontend/src/components/DiagnosticsSettings.dom.test.tsx

@@ -60,7 +60,6 @@ function mount(me: Partial<Me>) {
   const qc = new QueryClient();
   qc.setQueryData(qk.me(), {
     id: 1,
-    is_demo: false,
     preferences: {},
     diagnostics: { level: "INFO", until: null, retention_days: 7, session_minutes: 60 },
     ...me,
@@ -212,7 +211,6 @@ describe("DiagnosticsSettings", () => {
     await waitFor(() => expect(screen.getByTestId("diagnostics-status")).toBeTruthy());
     answerStale({
       id: 1,
-      is_demo: false,
       preferences: {},
       diagnostics: { level: "INFO", until: null, retention_days: 7, session_minutes: 60 },
     });
@@ -229,10 +227,4 @@ describe("DiagnosticsSettings", () => {
     );
     expect(screen.queryByTestId("diagnostics-status")).toBeNull();
   });
-
-  it("the shared demo account gets an explanation instead of the picker", () => {
-    mount({ is_demo: true });
-    expect(screen.queryByRole("group", { name: "settings.diagnostics.level" })).toBeNull();
-    expect(screen.getByText("settings.diagnostics.demo")).toBeTruthy();
-  });
 });