feat(demo): the public demo's module-side locks and seed hook

website/DEMO_MODE.md §3.2, §3.4, §3.5, §7.3 and §7.5 (step 2 of §10).
Nothing changes off the demo; everything below sits behind ctx.demoMode.

- demoLocks in module.json: PUT and DELETE /admin/rust/servers/:id.
- The console-command deny list (DM11): quit, restart, oxide.unload,
  oxide.reload, rcon.*, fps.limit and server.tickrate, by first word,
  with global. stripped and o. read as oxide. Refused at save through
  core's demoRefuses (MODULE_API 1.19.0, DM18) and again at run, with
  retry: false, before the rig is asked. Teardown commands too.
- The config editor (DM14): the bridge's files are left out of the
  list and refused for reading, writing and in the write history, by
  name (canonicalised) and by the catalogue's self. Other plugins'
  credential fields are redacted in the text and the form and made
  read-only; raw-JSON saves are refused; a file that does not parse is
  withheld. The admin server list leaves out the sidecar URL.
- onDemoSeed (DM15): upserts the rig's server row with an encrypted
  token and demo-player's stand-in Steam link.
- The release's install manifest carries protocol, read from
  PROTOCOL_VERSION, for the wipe's bundle match (DM12).

coreApi is ^1.19.0; ci/core-ref.json pins website#224's head.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/index.js

@@ -168,6 +168,13 @@ module.exports = function register(ctx, api) {
   api.onIdentityLinking(links.checkSteamSignin)
   api.onIdentityLinked(links.linkFromSteamSignin)
 
+  // The public demo's seed (MODULE_API 1.18.0, DM15): the rig's server row and
+  // demo-player's Steam link, written by this module from its part of the
+  // fixture. Called only by `npm run seed:demo` on a DEMO_MODE deployment. The
+  // demo's other locks are `demoLocks` in module.json and `demo.js`.
+  const demoSeed = require('./demoSeed') // eslint-disable-line global-require
+  api.onDemoSeed(demoSeed.onDemoSeed)
+
   // The leases (PLAN.md §27, protocol 8): what an event may BORROW on a server
   // and must give back. Core's `core.lease` is the verb; these are the values it
   // may name and the four callables each ships. Every lease is targeted and the