feat(demo): launch IndeeHub in the in-app iframe via the :2101 proxy

- useDemoIntro: replace DEMO_EXTERNAL_URLS (external-tab workaround) with
  DEMO_PROXY_PORTS; demoAppUrl('indeedhub') now resolves to
  <protocol>//<current-hostname>:2101/ at runtime (no hardcoded host/IP);
  isDemoExternal returns false (kept exported so call sites compile
  unchanged); isDemoApp still true for indeedhub so the NEW_TAB bypass
  keeps it in the in-app session
- useAppIdentity: suppress the identity-picker modal under IS_DEMO — the
  embedded IndeeHub is already signed in via the seeded throwaway demo
  account; real-node picker behavior untouched (IS_DEMO compile-time false)

Verified: 195 unit tests green (IS_DEMO=false path); VITE_DEMO=1 build
bundle contains the :2101 launch logic.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

neode-ui/src/views/appSession/useAppIdentity.ts

@@ -2,6 +2,7 @@
 
 import { type Ref } from 'vue'
 import { rpcClient } from '@/api/rpc-client'
+import { IS_DEMO } from '@/composables/useDemoIntro'
 
 const IDENTITY_KEY = 'archipelago_app_identity_'
 
@@ -54,6 +55,11 @@ export function useAppIdentity(
 
   /** Called on iframe load to inject identity if the app supports it */
   function onIframeLoadIdentity() {
+    // Public demo: never interrupt the visitor with the identity picker —
+    // the embedded IndeeHub is already signed in via the seeded throwaway
+    // demo account (see docker/indee-demo-signin.js). Real-node behavior is
+    // untouched (IS_DEMO is compile-time false there).
+    if (IS_DEMO) return
     if (isIdentityAwareApp(appId.value)) {
       const stored = getStoredIdentity()
       if (stored) sendIdentity(stored)
@@ -63,6 +69,7 @@ export function useAppIdentity(
 
   /** Handle identity request messages from iframe */
   function handleIdentityRequest() {
+    if (IS_DEMO) return
     const stored = getStoredIdentity()
     if (stored) sendIdentity(stored)
     else showIdentityPicker.value = true