docs(website): demo hero editor previews but does not publish (DM21)

DEMO_MODE.md: hero_layout joins the "Settings that reach a lock" row, a
paragraph under "Settings stay open" says what the hero editor does on the
demo, DM21 records the decision, and the step-5 walk checks it.
BACKEND_DESIGN.md: the protected-keys list in the demo section.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

website/BACKEND_DESIGN.md

@@ -1825,7 +1825,8 @@ it.
   - the target of `/admin/users/:id…` is a demo account;
   - the caller of `/auth/me/…` is signed in as one;
   - the `PUT /admin/settings` body names a protected key (`site_mode*`, `module_source_hosts`,
-    `teams_voice_*`, `demo_*`).
+    `teams_voice_*`, `demo_*`, `hero_layout`). `hero_layout_draft` stays open, so the hero
+    editor previews but cannot publish (DM21).
 
   A condition that cannot decide refuses.
 - **Event steps** (`MODULE_API` 1.19.0, DM18). `POST /admin/events`, `PUT /admin/events/:id` and