The dashboard had a 'Set up 2FA' banner link to /security/totp that
bypassed the settings button guard entirely. Three fixes:
- Dashboard: hide the 2FA nudge banner completely in demo mode
- TwoFactorSetupPage: redirect to /settings on mount if isDemo, and
disable the setup query so no API call fires even briefly
- This covers both the UI entry point and direct URL navigation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>