feat(screenshots): real netOrk screenshots from an anonymized demo copy

The site has shown hand-built JSX mockups of the UI so far. This adds the
tooling to replace them with screenshots of the real application:

- scripts/demo/up.sh restores a pg_dump of a production database into a
  local Postgres and starts netOrk (a pinned release, default v0.28.0) with
  only the API and the UI: no worker, no beat, no Redis, a random encryption
  key. Nothing polls and nothing can reach a device.
- scripts/demo/anonymize.py rewrites every text, JSON and address column of
  every table: domains to example.demo, private IPv4 per /16 with the host
  part kept, public addresses into the documentation ranges, MACs with the
  vendor prefix kept, e-mail addresses and configured names. Secrets are
  emptied by column name, one admin "netork" is left. It refuses non-local
  databases and ends with a leak report. The real-to-demo name map lives
  outside the repo.
- scripts/screenshots/capture.py drives headless Chromium through a
  declarative list of pages, logs in to the demo copy by itself, and aborts
  every non-GET API request, so taking screenshots cannot change anything.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/demo/README.md

@@ -0,0 +1,25 @@
+# Demo instance for screenshots
+
+The website shows real netOrk screens, taken from a local copy of a production
+database with every hostname, domain, address, MAC and name replaced.
+
+```
+pg_dump -Fc ... > netork.dump                 # on the production host, by hand
+scripts/demo/up.sh restore netork.dump        # fresh local DB + anonymize.py
+scripts/demo/up.sh start                      # API :8000, UI http://127.0.0.1:5173
+scripts/screenshots/capture.py --list-devices
+scripts/screenshots/capture.py --var ap=<id> --var switch=<id> --var server=<id>
+```
+
+Log in as `netork` / `netork-demo`.
+
+- Only the API and the UI run. There is no worker, no beat and no Redis, so
+  nothing polls or reaches a device. Stored credentials are emptied, and the
+  encryption key is random per start.
+- The mapping from real to demo names lives outside the repo in
+  `~/.config/netork-screenshots/demo-map.json`, because it lists the real names.
+  Domains become `example.demo`.
+- `anonymize.py` ends with a leak report. Read it before taking screenshots,
+  and look at every image before committing it.
+- The dump file itself holds production data: keep it out of the repo and
+  delete it when done.