feat(screenshots): cropped shots, sizes for the site, a site check

- shots.py crops to a region (clip) or to what one or more elements cover
  (element, pad), per-shot viewport; capture.py writes the published sizes to
  src/data/screenshots.json so the page reserves the right space.
- anonymize.py no longer empties secrets that netOrk compares with each other
  (Wi-Fi keys on an SSID against the key read from the access point). Emptying
  them invented passphrase "drift" that never existed; a keyed hash keeps equal
  equal, reverses nothing, and its key lives for one run.
- scripts/check/site.py checks the built site in both languages at four widths:
  sideways overflow, one h1, images with alt and size, console errors, requests
  to other origins, links to unknown routes, old-URL redirects, language
  detection, and word counts against the budgets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/demo/README.md

@@ -16,6 +16,10 @@ Log in as `netork` / `netork-demo`.
 - Only the API and the UI run. There is no worker, no beat and no Redis, so
   nothing polls or reaches a device. Stored credentials are emptied, and the
   encryption key is random per start.
+- Secrets are emptied — except the ones netOrk compares with each other (Wi-Fi
+  keys on an SSID against the key read from the access point). Those become a
+  keyed hash, so equal stays equal and the drift view shows the real state
+  instead of invented deviations. The key exists only for one run.
 - The mapping from real to demo names lives outside the repo in
   `~/.config/netork-screenshots/demo-map.json`, because it lists the real names.
   Domains become `example.demo`.