feat(demo): reset the demo instance every 20 minutes with a countdown

DEMO_RESET_MINUTES (default 20, 0 = off) resets the database to the
sample data. Demo accounts get fixed IDs so sessions survive; requests
hold a read lock so the reset never runs under a half-finished request
(streams excluded). DEMO_RESET goes to every connection, /auth/status
announces the next reset. The app shows "✨ Demo · Reset in MM:SS" in
place of the version, then clears cached answers, remounts the views,
reloads in the background and shows a short notice; if no event
arrives (long polling) it asks the server after the countdown.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_auth.go

@@ -37,7 +37,7 @@ func (s *Server) handleAuthStatus(w http.ResponseWriter, r *http.Request) {
 			instanceName = sys.InstanceName
 		}
 	}
-	writeJSON(w, http.StatusOK, map[string]interface{}{
+	status := map[string]interface{}{
 		"needsSetup":        count == 0,
 		"allowRegistration": allowReg,
 		"instanceName":      instanceName,
@@ -51,7 +51,14 @@ func (s *Server) handleAuthStatus(w http.ResponseWriter, r *http.Request) {
 			"privacyUrl":        s.cfg.Legal.PrivacyURL,
 			"hasPrivacyContent": s.cfg.Legal.PrivacyContent != "",
 		},
-	})
+	}
+	// Countdown to the next demo reset; seconds as well, so client clocks do not matter
+	if next := s.demoNextReset(); !next.IsZero() {
+		status["demoNextReset"] = next.UTC().Format(time.RFC3339)
+		status["demoResetInSeconds"] = int(time.Until(next).Seconds())
+		status["demoResetMinutes"] = s.cfg.DemoResetMinutes
+	}
+	writeJSON(w, http.StatusOK, status)
 }
 
 // handleLegalText serves the configured Markdown of the imprint or privacy notice (public, no login).