docs(website): demo mode step 2 built — DM18, MODULE_API 1.19.0

DM18 (org lead, 2026-10-24): core's event save never asked a module
about a step's params, so the console-command deny list's save-time
refusal is a new core hook, demoRefuses(params), asked at create, save
and publish on the demo. MODULE_API 1.19.0.

- DEMO_MODE.md: §3.4 says where the save-time check lives; DM18 row;
  step 2 marked built (website#224, Module-Rust#62) with the module's
  bridge recognition and fail-closed rules; the Rust fixture section.
- MODULE_API.md: 1.19.0 in §1.1, the changelog, the registerEventActions
  signature and the action rules.
- BACKEND_DESIGN.md §5.1: event steps on the demo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

website/BACKEND_DESIGN.md

@@ -1828,6 +1828,10 @@ it.
     `teams_voice_*`, `demo_*`).
 
   A condition that cannot decide refuses.
+- **Event steps** (`MODULE_API` 1.19.0, DM18). `POST /admin/events`, `PUT /admin/events/:id` and
+  `POST /admin/events/:id/publish` ask each step's action `demoRefuses(params)`, when it declares one.
+  A sentence back refuses the write `403 { code: "DEMO_LOCKED", message, errors }` with that sentence; a
+  hook that throws refuses too.
 - **Uploads.** Any request with a `multipart/*` content type is refused app-wide, before a router or
   multer sees it.
 - **Search engines.** Every response carries `X-Robots-Tag: noindex, nofollow`. `/robots.txt` is