feat(demo): public multi-visitor demo sandbox for Portainer

Turn the mock backend + UI into a public, click-to-play demo deployable as a
Portainer stack, gated behind DEMO=1 (classic single-user mock unchanged when off).

Backend (neode-ui/mock-backend.js):
- Per-session state isolation via AsyncLocalStorage + Proxy: every visitor gets
  an isolated, deep-cloned copy of mockData/walletState/userState/etc., keyed by
  a demo_sid cookie. Per-session WebSocket fan-out, idle reaper, session cap.
- Real per-session file storage (upload/folder/rename/delete) with a 50MB quota,
  replacing the no-op filebrowser handlers; adds the missing app.filebrowser-token RPC.
- Force simulation mode (never touch a host Docker/Podman socket).
- Testnet (signet) flavor; shared login password "entertoexit".
- Report the real app version suffixed with -demo.

Frontend:
- VITE_DEMO build flag (useDemoIntro.ts): replay the intro once per calendar day
  per browser; prefill + show the "entertoexit" login hint.

Deploy:
- docker-compose.demo.yml wired for DEMO, UI on :2100 (build-from-repo).
- demo-deploy/ thin stack (prebuilt :demo image refs + .env.example + README).
- .github/workflows/demo-images.yml builds/pushes archy-demo-{web,backend} images.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

neode-ui/src/composables/useDemoIntro.ts

@@ -0,0 +1,49 @@
+/**
+ * Public-demo helpers.
+ *
+ * The demo build (VITE_DEMO=1) replays the intro/onboarding on each visit, but
+ * only once per calendar day per browser — tracked in localStorage so it
+ * survives the short-lived backend session. Also exposes the shared demo
+ * credentials shown on the login screen.
+ */
+
+export const IS_DEMO =
+  import.meta.env.VITE_DEMO === '1' || import.meta.env.VITE_DEMO === 'true'
+
+/** Memorable shared password for the public demo (must match the mock backend). */
+export const DEMO_PASSWORD = 'entertoexit'
+
+const INTRO_DATE_KEY = 'demo_intro_date'
+
+function todayKey(): string {
+  // Local calendar day, e.g. "2026-06-22".
+  const d = new Date()
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`
+}
+
+/** True if this browser already watched the intro earlier today. */
+export function demoIntroSeenToday(): boolean {
+  try {
+    return localStorage.getItem(INTRO_DATE_KEY) === todayKey()
+  } catch {
+    return false
+  }
+}
+
+/** Record that the intro has been seen today, so it won't replay until tomorrow. */
+export function markDemoIntroSeen(): void {
+  try {
+    localStorage.setItem(INTRO_DATE_KEY, todayKey())
+  } catch {
+    /* ignore (private mode / storage disabled) */
+  }
+}
+
+/** Forget today's "seen" marker so the intro plays again (e.g. "Replay Intro"). */
+export function clearDemoIntroSeen(): void {
+  try {
+    localStorage.removeItem(INTRO_DATE_KEY)
+  } catch {
+    /* ignore */
+  }
+}