Add demo README and mention demo in main README

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

demo/README.md

@@ -0,0 +1,78 @@
+# MyMidas — Public Demo
+
+This directory contains everything needed to run a public demo instance of MyMidas on a separate server. The demo is pre-loaded with realistic synthetic UK financial data and **resets automatically every hour** back to a clean state.
+
+---
+
+## What the demo includes
+
+| Area | Data |
+|---|---|
+| **Accounts** | Monzo Current, Marcus Savings, Amex Gold credit card, Freetrade ISA |
+| **Transactions** | ~180 transactions across 6 months (Oct 2025 – Mar 2026) — salary, rent, groceries, subscriptions, eating out, utilities, holidays, shopping |
+| **Subscriptions** | Netflix, Spotify, Amazon Prime, iCloud, GitHub, PureGym — all auto-detected as recurring |
+| **Investments** | VWRP ETF (50 shares), Apple stock (10 shares), Bitcoin (0.05 BTC) with buy history and dividends |
+| **Budgets** | Groceries, Eating Out, Transport, Entertainment, Utilities, Subscriptions, Shopping |
+| **Tax** | 2025/26 profile (code 1257L), 6 payslips (Apr–Sep 2025), manual CGT disposal showing £4,300 gain |
+| **Reports** | All 7 report types populated — Net Worth, Income/Expense, Cash Flow, Category Breakdown, Budget vs Actual, Investment Performance, Spending Trends |
+
+**Demo credentials:**
+```
+Email:    demo@mymidas.app
+Password: demo123
+```
+
+---
+
+## How it works
+
+- On first startup, the backend detects `DEMO_MODE=true` with an empty database, seeds all demo data, and saves a compressed database snapshot
+- A `resetter` container (Alpine with cron) restores from that snapshot at the top of every hour and purges any uploaded files
+- Password changes and backup download/restore are disabled in demo mode — a banner on every page and the login screen explains this
+
+---
+
+## Demo vs production differences
+
+| Feature | Production | Demo |
+|---|---|---|
+| Password change | Enabled | Disabled |
+| Backups | Nightly + manual | Disabled |
+| File uploads | Persistent | Wiped hourly |
+| AI receipt scanning | User-configured | Field available, no key pre-set |
+| Registration | Controlled by `ALLOW_REGISTRATION` | Disabled |
+| Data | Your real data | Synthetic, resets hourly |
+
+---
+
+## Deployment
+
+See **[DEPLOY.md](DEPLOY.md)** for the full step-by-step guide (Portainer Stacks).
+
+**Quick summary:**
+1. Clone the repo on the demo server
+2. Generate JWT keys (`secrets/jwt_private.pem` + `jwt_public.pem`)
+3. `cp demo/.env.example demo/.env` and fill in `ENCRYPTION_KEY`, `DB_PASSWORD`, `REDIS_PASSWORD`
+4. Deploy `demo/docker-compose.yml` as a Portainer stack with those env vars
+5. Wait ~60 s for first-time seeding — then point your reverse proxy at port `4001`
+
+No further manual steps. The hourly reset runs automatically inside the stack.
+
+---
+
+## Ports
+
+| Service | Port |
+|---|---|
+| Frontend (reverse proxy target) | `4001` |
+| Backend API (internal) | `8091` |
+| PostgreSQL | internal only |
+| Redis | internal only |
+
+---
+
+## Updating
+
+Pull the latest code and redeploy the stack in Portainer. Migrations run automatically on restart; the seed check is skipped if the demo user already exists (snapshot is preserved on the `demo_snapshot` Docker volume).
+
+To **force a full re-seed** after adding new demo data: delete the `demo_snapshot` volume in Portainer, then redeploy.