feat: cont demo public cu resetare automată a datelor la 3 ore

- Cont demo (demo@example.com/demo1234) activ implicit, identificat prin
  settings.demo_email — fără configurare în env; DEMO_EMAIL="" îl dezactivează
- Contul demo nu poate fi modificat prin API (email/parolă/status blocate 403)
- reset_demo.py: șterge idempotent toate datele demo și recrează proprietatea
  demo cu 3 spații și 5 rezervări exemplu cu date relative la ziua curentă
- entrypoint.sh: reset la boot + buclă la 3h (DEMO_RESET_INTERVAL)
- start.sh (dev): reset la fiecare pornire
- Login.vue: hint cu credențialele demo (click = precompletare) și mesajul
  de resetare la 3 ore

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/app/api/users.py

@@ -5,6 +5,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel
 from sqlalchemy.orm import Session
 
+from app.core.demo import DEMO_LOCKED_DETAIL, is_demo_user
 from app.core.deps import get_current_admin, get_current_manager_or_superadmin, get_current_user, get_db
 from app.core.security import get_password_hash
 from app.models.user import User
@@ -160,6 +161,9 @@ def update_user(
             detail="User not found",
         )
 
+    if is_demo_user(user):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=DEMO_LOCKED_DETAIL)
+
     # Check if new email conflicts with another user
     if user_data.email and user_data.email != user.email:
         existing = db.query(User).filter(User.email == user_data.email).first()
@@ -232,6 +236,9 @@ def update_user_status(
             detail="User not found",
         )
 
+    if is_demo_user(user):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=DEMO_LOCKED_DETAIL)
+
     setattr(user, "is_active", status_data.is_active)
 
     db.commit()
@@ -259,6 +266,9 @@ def reset_user_password(
             detail="User not found",
         )
 
+    if is_demo_user(user):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=DEMO_LOCKED_DETAIL)
+
     setattr(user, "hashed_password", get_password_hash(reset_data.new_password))
 
     db.commit()

backend/app/core/config.py

@@ -47,6 +47,13 @@ class Settings(BaseSettings):
     # Frontend
     frontend_url: str = "http://localhost:5173"
 
+    # Demo account (public playground), enabled by default. The account
+    # cannot be modified through the API and its data is recreated by
+    # reset_demo.py (scheduled from entrypoint.sh, every 3 hours).
+    # Set DEMO_EMAIL="" in the environment to disable the feature.
+    demo_email: str = "demo@example.com"
+    demo_password: str = "demo1234"
+
     # Google Calendar OAuth
     google_client_id: str = ""
     google_client_secret: str = ""

backend/app/core/demo.py

@@ -0,0 +1,17 @@
+"""Helpers for the public demo account.
+
+The demo account is identified by email (settings.demo_email, env DEMO_EMAIL)
+so no schema change is needed. Its credentials and profile are locked through
+the API and its data is recreated daily by reset_demo.py.
+"""
+from app.core.config import settings
+from app.models.user import User
+
+DEMO_LOCKED_DETAIL = "Contul demo nu poate fi modificat."
+
+
+def is_demo_user(user: User | None) -> bool:
+    """Return True if the given user is the configured demo account."""
+    if user is None or not settings.demo_email:
+        return False
+    return user.email == settings.demo_email