Add demo README and mention demo in main README

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -4,6 +4,8 @@ A self-hosted, single-user personal finance tracker built for security and compl
 
 Runs entirely on your own hardware via Docker Compose. Designed for LAN access with VPN for remote, behind an existing reverse proxy (nginx proxy manager, Caddy, etc.).
 
+A **public demo** is available with pre-loaded synthetic data that resets hourly. See [`demo/README.md`](demo/README.md) for deployment instructions.
+
 ---
 
 ## Features

demo/README.md

@@ -0,0 +1,78 @@
+# MyMidas — Public Demo
+
+This directory contains everything needed to run a public demo instance of MyMidas on a separate server. The demo is pre-loaded with realistic synthetic UK financial data and **resets automatically every hour** back to a clean state.
+
+---
+
+## What the demo includes
+
+| Area | Data |
+|---|---|
+| **Accounts** | Monzo Current, Marcus Savings, Amex Gold credit card, Freetrade ISA |
+| **Transactions** | ~180 transactions across 6 months (Oct 2025 – Mar 2026) — salary, rent, groceries, subscriptions, eating out, utilities, holidays, shopping |
+| **Subscriptions** | Netflix, Spotify, Amazon Prime, iCloud, GitHub, PureGym — all auto-detected as recurring |
+| **Investments** | VWRP ETF (50 shares), Apple stock (10 shares), Bitcoin (0.05 BTC) with buy history and dividends |
+| **Budgets** | Groceries, Eating Out, Transport, Entertainment, Utilities, Subscriptions, Shopping |
+| **Tax** | 2025/26 profile (code 1257L), 6 payslips (Apr–Sep 2025), manual CGT disposal showing £4,300 gain |
+| **Reports** | All 7 report types populated — Net Worth, Income/Expense, Cash Flow, Category Breakdown, Budget vs Actual, Investment Performance, Spending Trends |
+
+**Demo credentials:**
+```
+Email:    demo@mymidas.app
+Password: demo123
+```
+
+---
+
+## How it works
+
+- On first startup, the backend detects `DEMO_MODE=true` with an empty database, seeds all demo data, and saves a compressed database snapshot
+- A `resetter` container (Alpine with cron) restores from that snapshot at the top of every hour and purges any uploaded files
+- Password changes and backup download/restore are disabled in demo mode — a banner on every page and the login screen explains this
+
+---
+
+## Demo vs production differences
+
+| Feature | Production | Demo |
+|---|---|---|
+| Password change | Enabled | Disabled |
+| Backups | Nightly + manual | Disabled |
+| File uploads | Persistent | Wiped hourly |
+| AI receipt scanning | User-configured | Field available, no key pre-set |
+| Registration | Controlled by `ALLOW_REGISTRATION` | Disabled |
+| Data | Your real data | Synthetic, resets hourly |
+
+---
+
+## Deployment
+
+See **[DEPLOY.md](DEPLOY.md)** for the full step-by-step guide (Portainer Stacks).
+
+**Quick summary:**
+1. Clone the repo on the demo server
+2. Generate JWT keys (`secrets/jwt_private.pem` + `jwt_public.pem`)
+3. `cp demo/.env.example demo/.env` and fill in `ENCRYPTION_KEY`, `DB_PASSWORD`, `REDIS_PASSWORD`
+4. Deploy `demo/docker-compose.yml` as a Portainer stack with those env vars
+5. Wait ~60 s for first-time seeding — then point your reverse proxy at port `4001`
+
+No further manual steps. The hourly reset runs automatically inside the stack.
+
+---
+
+## Ports
+
+| Service | Port |
+|---|---|
+| Frontend (reverse proxy target) | `4001` |
+| Backend API (internal) | `8091` |
+| PostgreSQL | internal only |
+| Redis | internal only |
+
+---
+
+## Updating
+
+Pull the latest code and redeploy the stack in Portainer. Migrations run automatically on restart; the seed check is skipped if the demo user already exists (snapshot is preserved on the `demo_snapshot` Docker volume).
+
+To **force a full re-seed** after adding new demo data: delete the `demo_snapshot` volume in Portainer, then redeploy.