fix(demo): never leak the release-server IP in the public demo

- Companion QR overlay: demo builds encode the demo's own origin
  (/packages/archipelago-companion.apk ships in the web image) instead of
  the vps2 raw URL.
- Dockerfile.web/.backend: build-time scrub replaces every remaining
  occurrence of the release-server address with registry.demo.internal and
  fails the build if any survives.
- Mock backend update-mirror list, sideload help text, and changelog prose
  no longer name the server address.
- Copy demo-images workflow into .gitea/workflows/ — Gitea ignores
  .github/workflows when .gitea/workflows exists, so the CI never ran.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

neode-ui/Dockerfile.backend

@@ -24,6 +24,19 @@ COPY docker/fedimint-ui /docker/fedimint-ui
 COPY demo/files /demo/files
 COPY demo/content /demo/content
 
+# This image only ever serves the public demo — scrub the private release/registry
+# server address from everything it serves (mock data, catalog.json, demo assets)
+# and fail the build if any occurrence survives.
+RUN find /app /docker /demo -type f \( -name '*.js' -o -name '*.mjs' -o -name '*.cjs' \
+      -o -name '*.css' -o -name '*.html' -o -name '*.json' -o -name '*.md' -o -name '*.txt' \
+      -o -name '*.yml' -o -name '*.yaml' \) -not -path '*/node_modules/*' \
+      -exec sed -i \
+        -e 's#146\.59\.87\.168:3000/lfg2025#registry.demo.internal/archy#g' \
+        -e 's#146\.59\.87\.168:3000#registry.demo.internal#g' \
+        -e 's#146\.59\.87\.168#registry.demo.internal#g' {} + && \
+    if grep -rq '146\.59\.87\.168' /app/mock-backend.js /app/public /docker /demo; then \
+      echo 'LEAK: release-server IP still in demo image'; exit 1; fi
+
 # Expose port
 EXPOSE 5959