fix(demo): never leak the release-server IP in the public demo

- Companion QR overlay: demo builds encode the demo's own origin
  (/packages/archipelago-companion.apk ships in the web image) instead of
  the vps2 raw URL.
- Dockerfile.web/.backend: build-time scrub replaces every remaining
  occurrence of the release-server address with registry.demo.internal and
  fails the build if any survives.
- Mock backend update-mirror list, sideload help text, and changelog prose
  no longer name the server address.
- Copy demo-images workflow into .gitea/workflows/ — Gitea ignores
  .github/workflows when .gitea/workflows exists, so the CI never ran.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

neode-ui/src/components/CompanionIntroOverlay.vue

@@ -77,12 +77,17 @@
 <script setup lang="ts">
 import { ref, onMounted, watch } from 'vue'
 import * as QRCode from 'qrcode'
+import { IS_DEMO } from '@/composables/useDemoIntro'
 
 const STORAGE_KEY = 'neode_companion_intro_seen'
 // Absolute URL so the QR works when scanned by a phone (a relative path has no
 // host to resolve). Points at the companion APK hosted on the 146 release server
 // (publicly reachable) rather than the local node's /packages copy.
-const DEFAULT_DOWNLOAD_URL = 'http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/neode-ui/public/packages/archipelago-companion.apk'
+// The demo serves the APK from its own public origin instead, so the QR never
+// exposes the release-server address.
+const DEFAULT_DOWNLOAD_URL = IS_DEMO
+  ? `${window.location.origin}/packages/archipelago-companion.apk`
+  : 'http://146.59.87.168:3000/lfg2025/archy/raw/branch/main/neode-ui/public/packages/archipelago-companion.apk'
 
 const visible = ref(false)
 const qrDataUrl = ref('')