feat(demo): the public demo's module-side locks and seed hook

website/DEMO_MODE.md §3.2, §3.4, §3.5, §7.3 and §7.5 (step 2 of §10).
Nothing changes off the demo; everything below sits behind ctx.demoMode.

- demoLocks in module.json: PUT and DELETE /admin/rust/servers/:id.
- The console-command deny list (DM11): quit, restart, oxide.unload,
  oxide.reload, rcon.*, fps.limit and server.tickrate, by first word,
  with global. stripped and o. read as oxide. Refused at save through
  core's demoRefuses (MODULE_API 1.19.0, DM18) and again at run, with
  retry: false, before the rig is asked. Teardown commands too.
- The config editor (DM14): the bridge's files are left out of the
  list and refused for reading, writing and in the write history, by
  name (canonicalised) and by the catalogue's self. Other plugins'
  credential fields are redacted in the text and the form and made
  read-only; raw-JSON saves are refused; a file that does not parse is
  withheld. The admin server list leaves out the sidecar URL.
- onDemoSeed (DM15): upserts the rig's server row with an encrypted
  token and demo-player's stand-in Steam link.
- The release's install manifest carries protocol, read from
  PROTOCOL_VERSION, for the wipe's bundle match (DM12).

coreApi is ^1.19.0; ci/core-ref.json pins website#224's head.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/model/servers/servers.model.js

@@ -203,7 +203,9 @@ async function listForAdmin(now = Date.now()) {
       // The public shape first, so the admin-only fields below cannot be
       // overwritten by a key the public shape happens to share.
       ...shapePublic(row, state, now),
-      sidecarBaseUrl: row.sidecarBaseUrl,
+      // Left out on the public demo, so the screen gives nothing away that helps
+      // someone reach the sidecar (DEMO_MODE.md §3.5); editing the link is locked.
+      ...(core.demoMode ? {} : { sidecarBaseUrl: row.sidecarBaseUrl }),
       hasToken: Boolean(row.sidecarTokenEnc),
       protocol: Number(row.protocol),
       enabled: Boolean(row.enabled),