Add public demo mode with auto-seeding, hourly reset, and Portainer deploy guide

- DEMO_MODE=true env flag: disables password changes and backup endpoints (403),
  exposes GET /demo/status for frontend detection
- Auto-seed on first startup: creates demo user (demo@mymidas.app / demo123)
  with 6 months of transactions, investments, budgets, subscriptions, and tax
  payslips; takes a pg_dump snapshot immediately after for hourly restore
- Hourly reset: resetter Alpine container with cron restores DB from snapshot
  and purges uploaded attachments every hour on the hour
- Frontend: amber demo banner on all pages, login page shows credentials,
  password change disabled with notice, backups section replaced with notice
- demo/ directory: self-contained docker-compose.yml (ports 4001/8091),
  .env.example, reset.sh, and step-by-step Portainer DEPLOY.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

demo/.env.example

@@ -0,0 +1,18 @@
+# MyMidas Demo — environment variables
+# Copy to .env and fill in every value before deploying.
+
+# ── Encryption ────────────────────────────────────────────────────────────────
+# 32-byte hex key for AES-256-GCM field encryption.
+# Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
+ENCRYPTION_KEY=
+
+# ── Database ──────────────────────────────────────────────────────────────────
+# Strong random password for the demo Postgres user.
+DB_PASSWORD=
+
+# ── Redis ─────────────────────────────────────────────────────────────────────
+REDIS_PASSWORD=
+
+# ── Environment ───────────────────────────────────────────────────────────────
+# Keep as "production" (hides /docs, enforces security headers).
+ENVIRONMENT=production