Add public demo mode with auto-seeding, hourly reset, and Portainer deploy guide

- DEMO_MODE=true env flag: disables password changes and backup endpoints (403),
  exposes GET /demo/status for frontend detection
- Auto-seed on first startup: creates demo user (demo@mymidas.app / demo123)
  with 6 months of transactions, investments, budgets, subscriptions, and tax
  payslips; takes a pg_dump snapshot immediately after for hourly restore
- Hourly reset: resetter Alpine container with cron restores DB from snapshot
  and purges uploaded attachments every hour on the hour
- Frontend: amber demo banner on all pages, login page shows credentials,
  password change disabled with notice, backups section replaced with notice
- demo/ directory: self-contained docker-compose.yml (ports 4001/8091),
  .env.example, reset.sh, and step-by-step Portainer DEPLOY.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

demo/reset.sh

@@ -0,0 +1,25 @@
+#!/bin/sh
+# Hourly demo reset — restore DB from snapshot, purge uploads, bounce backend.
+set -e
+
+SNAPSHOT="${DEMO_SNAPSHOT_PATH:-/snapshot/demo_snapshot.sql.gz}"
+UPLOADS_DIR="${UPLOADS_DIR:-/uploads}"
+DB_URL="${DATABASE_URL}"
+BACKEND="${BACKEND_URL:-http://backend:8000}"
+
+echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Starting demo reset"
+
+# 1. Restore database from snapshot
+if [ ! -f "$SNAPSHOT" ]; then
+  echo "ERROR: Snapshot not found at $SNAPSHOT — skipping reset"
+  exit 1
+fi
+
+gunzip -c "$SNAPSHOT" | psql --single-transaction -v ON_ERROR_STOP=1 "$DB_URL"
+echo "  DB restored from snapshot"
+
+# 2. Purge uploaded files (attachments added by demo users)
+find "$UPLOADS_DIR" -type f -not -name ".gitkeep" -delete 2>/dev/null || true
+echo "  Uploads purged"
+
+echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Demo reset complete"