fix(demo): refuse publishing the homepage hero (DM21)

Settings stay open on the demo (DM2), so the hero editor's Publish wrote
hero_layout, the hero every visitor sees. hero_layout joins the protected
settings keys: PUT /admin/settings naming it answers 403 DEMO_LOCKED with
keys: ['hero_layout']. The editor's draft autosave and Preview write only
hero_layout_draft and stay open; its uploads were already refused by the
multipart lock. Server lock only, as decided: the editor needs no change,
since its status line and the toast already show the demo sentence.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/src/demo/locks.js

@@ -65,8 +65,10 @@ async function callerIsDemo(req) {
 // keys, and a few keys are another door into something Tier A locks: `site_mode`
 // is what `PUT /admin/site-mode` writes, `module_source_hosts` what the Modules
 // screen's sources do, `teams_voice_*` the voice settings. `demo_*` is the
-// banner and the published logins, which the seed owns.
-const PROTECTED_SETTINGS = [/^site_mode/, /^module_source_hosts$/, /^teams_voice_/, /^demo_/]
+// banner and the published logins, which the seed owns. `hero_layout` is the
+// live homepage hero (DM21): the editor's draft (`hero_layout_draft`) and its
+// Preview stay open, its Publish is refused.
+const PROTECTED_SETTINGS = [/^site_mode/, /^module_source_hosts$/, /^teams_voice_/, /^demo_/, /^hero_layout$/]
 
 function protectedKeys(body) {
   if (!body || typeof body !== 'object' || Array.isArray(body)) return []