fix(demo): refuse publishing the homepage hero (DM21)

Settings stay open on the demo (DM2), so the hero editor's Publish wrote
hero_layout, the hero every visitor sees. hero_layout joins the protected
settings keys: PUT /admin/settings naming it answers 403 DEMO_LOCKED with
keys: ['hero_layout']. The editor's draft autosave and Preview write only
hero_layout_draft and stay open; its uploads were already refused by the
multipart lock. Server lock only, as decided: the editor needs no change,
since its status line and the toast already show the demo sentence.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/src/demo/locks.js

@@ -65,8 +65,10 @@ async function callerIsDemo(req) {
 // keys, and a few keys are another door into something Tier A locks: `site_mode`
 // is what `PUT /admin/site-mode` writes, `module_source_hosts` what the Modules
 // screen's sources do, `teams_voice_*` the voice settings. `demo_*` is the
-// banner and the published logins, which the seed owns.
-const PROTECTED_SETTINGS = [/^site_mode/, /^module_source_hosts$/, /^teams_voice_/, /^demo_/]
+// banner and the published logins, which the seed owns. `hero_layout` is the
+// live homepage hero (DM21): the editor's draft (`hero_layout_draft`) and its
+// Preview stay open, its Publish is refused.
+const PROTECTED_SETTINGS = [/^site_mode/, /^module_source_hosts$/, /^teams_voice_/, /^demo_/, /^hero_layout$/]
 
 function protectedKeys(body) {
   if (!body || typeof body !== 'object' || Array.isArray(body)) return []

server/test/demoLocks.test.js

@@ -184,6 +184,18 @@ test('PUT /admin/settings is open for theme and nav', async () => {
   })
 })
 
+// DM21: the hero editor's autosave and Preview write only the draft; Publish
+// writes both, and the live key refuses the whole body.
+test('the hero draft is open, publishing the hero is refused', async () => {
+  await withLock(undefined, async (req) => {
+    await expectReached(await req('PUT', '/admin/settings', { hero_layout_draft: '{"v":1}' }))
+    const body = await expectLocked(
+      await req('PUT', '/admin/settings', { hero_layout: '{"v":1}', hero_layout_draft: '{"v":1}' }),
+    )
+    assert.deepEqual(body.keys, ['hero_layout'])
+  })
+})
+
 test('PUT /admin/settings naming a protected key is refused whole, with the keys named', async () => {
   await withLock(undefined, async (req) => {
     for (const key of ['site_mode', 'site_mode_changed_by', 'module_source_hosts', 'teams_voice_enabled', 'demo_state']) {