feat(screenshots): real netOrk screenshots from an anonymized demo copy

The site has shown hand-built JSX mockups of the UI so far. This adds the
tooling to replace them with screenshots of the real application:

- scripts/demo/up.sh restores a pg_dump of a production database into a
  local Postgres and starts netOrk (a pinned release, default v0.28.0) with
  only the API and the UI: no worker, no beat, no Redis, a random encryption
  key. Nothing polls and nothing can reach a device.
- scripts/demo/anonymize.py rewrites every text, JSON and address column of
  every table: domains to example.demo, private IPv4 per /16 with the host
  part kept, public addresses into the documentation ranges, MACs with the
  vendor prefix kept, e-mail addresses and configured names. Secrets are
  emptied by column name, one admin "netork" is left. It refuses non-local
  databases and ends with a leak report. The real-to-demo name map lives
  outside the repo.
- scripts/screenshots/capture.py drives headless Chromium through a
  declarative list of pages, logs in to the demo copy by itself, and aborts
  every non-GET API request, so taking screenshots cannot change anything.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/demo/up.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Local netOrk demo instance for website screenshots.
+#
+#   up.sh restore <dump>   fresh demo DB from a pg_dump -Fc file, then anonymize
+#   up.sh start            API on :8000 and UI on :5173 (foreground, Ctrl-C stops)
+#   up.sh stop             stop the demo database container
+#
+# Only the API and the UI run: no Celery worker, no beat, no Redis. Nothing
+# polls, nothing reboots, nothing reaches a device. Stored credentials are
+# emptied by anonymize.py and the encryption key is a fresh random one, so
+# even a leftover value could not be decrypted.
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+DEMO="${NETORK_DEMO_DIR:-$HOME/.cache/netork-demo}"
+SRC="$DEMO/src"
+VENV="${NETORK_VENV:-$HOME/dev/NetOrk/.venv}"
+VERSION="${NETORK_DEMO_VERSION:-v0.28.0}"
+NETORK_REPO="${NETORK_REPO:-$HOME/dev/NetOrk}"
+DB=netork-demo-db
+PORT=55432
+
+ensure_src() {
+  if [ ! -d "$SRC/netork" ]; then
+    mkdir -p "$SRC"
+    git -C "$NETORK_REPO" archive "$VERSION" | tar -x -C "$SRC"
+  fi
+}
+
+ensure_db() {
+  if ! docker ps --format '{{.Names}}' | grep -qx "$DB"; then
+    docker start "$DB" 2>/dev/null || docker run -d --name "$DB" \
+      -p 127.0.0.1:$PORT:5432 -e POSTGRES_DB=netork -e POSTGRES_USER=netork \
+      -e POSTGRES_PASSWORD=demo -v netork-demo-pg:/var/lib/postgresql/data postgres:16-alpine
+    until docker exec "$DB" pg_isready -U netork -q; do sleep 1; done
+  fi
+}
+
+case "${1:-}" in
+  restore)
+    dump="${2:?usage: up.sh restore <dump file>}"
+    ensure_src; ensure_db
+    docker exec "$DB" psql -U netork -d postgres -q \
+      -c "DROP DATABASE IF EXISTS netork WITH (FORCE)" -c "CREATE DATABASE netork"
+    docker exec -i "$DB" pg_restore -U netork -d netork --no-owner --no-privileges < "$dump" \
+      || echo "pg_restore reported errors (often only missing roles/extensions); checking ..."
+    got=$(docker exec "$DB" psql -U netork -tA -c "SELECT version_num FROM alembic_version")
+    want=$(cd "$SRC" && PATH="$VENV/bin:$PATH" alembic heads 2>/dev/null | awk '{print $1}')
+    echo "dump schema: $got   $VERSION head: $want"
+    [ "$got" = "$want" ] || echo "WARNING: schema differs from $VERSION; screens may not match the release."
+    "$VENV/bin/python" "$HERE/anonymize.py"
+    ;;
+  start)
+    ensure_src; ensure_db
+    [ -d "$SRC/ui/node_modules" ] || (cd "$SRC/ui" && npm ci --no-audit --no-fund)
+    export DATABASE_URL="postgresql+asyncpg://netork:demo@127.0.0.1:$PORT/netork"
+    export ENVIRONMENT=development
+    export SECRET_KEY="$(openssl rand -hex 32)"
+    export CREDENTIAL_ENCRYPTION_KEY="$("$VENV/bin/python" -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())')"
+    # Nothing listens on port 1: no task can be queued, so no worker could act.
+    export REDIS_URL=redis://127.0.0.1:1/0 CELERY_BROKER_URL=redis://127.0.0.1:1/0 CELERY_RESULT_BACKEND=redis://127.0.0.1:1/1
+    cd "$SRC"
+    "$VENV/bin/uvicorn" netork.api.main:app --host 127.0.0.1 --port 8000 &
+    api=$!
+    trap 'kill $api 2>/dev/null' EXIT
+    cd ui && npx vite --host 127.0.0.1 --port 5173 --strictPort
+    ;;
+  stop)
+    docker stop "$DB"
+    ;;
+  *)
+    sed -n '2,12p' "$0"; exit 1 ;;
+esac