Add public demo mode with auto-seeding, hourly reset, and Portainer deploy guide

- DEMO_MODE=true env flag: disables password changes and backup endpoints (403),
  exposes GET /demo/status for frontend detection
- Auto-seed on first startup: creates demo user (demo@mymidas.app / demo123)
  with 6 months of transactions, investments, budgets, subscriptions, and tax
  payslips; takes a pg_dump snapshot immediately after for hourly restore
- Hourly reset: resetter Alpine container with cron restores DB from snapshot
  and purges uploaded attachments every hour on the hour
- Frontend: amber demo banner on all pages, login page shows credentials,
  password change disabled with notice, backups section replaced with notice
- demo/ directory: self-contained docker-compose.yml (ports 4001/8091),
  .env.example, reset.sh, and step-by-step Portainer DEPLOY.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/main.py

@@ -35,6 +35,18 @@ async def lifespan(app: FastAPI):
         await seed_system_categories(db)
         await db.commit()
 
+    # Demo mode: seed demo data on first startup, then snapshot
+    if settings.is_demo:
+        from app.demo.seed import is_seeded, seed_demo
+        from app.demo.snapshot import create_snapshot
+        async with session_factory() as db:
+            if not await is_seeded(db):
+                await seed_demo(db)
+                await db.commit()
+                logger.info("demo_seed_complete")
+                await create_snapshot()
+                logger.info("demo_snapshot_created")
+
     # Background scheduler
     from app.workers.scheduler import start_scheduler, stop_scheduler
     await start_scheduler()
@@ -78,6 +90,10 @@ def create_app() -> FastAPI:
     async def health():
         return {"status": "ok"}
 
+    @app.get("/demo/status")
+    async def demo_status():
+        return {"demo_mode": settings.is_demo}
+
     # API routers
     from app.api.router import router
     app.include_router(router, prefix="/api/v1")