fix(security): demo sends nothing, hidden SMTP password, body limits (FLAW-33..38)

- Demo: senders for mail, Discord and webhooks refuse, no alarm ticker;
  test alarm, SMTP test, server settings, backups, account and session
  changes of the shared demo accounts answer 403; the session list only
  shows the own device. The UI shows the notices and disables the controls.
- SMTP password is never sent back (smtpPassSet), empty keeps it.
- ?token= on webhook ingest accepts only API keys.
- Request bodies capped at 2 MB (sync 8 MB, imports 101 MB).
- Deleting an account removes its server backups.
- Backup downloads, exports and import uploads get 30 minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/alarms.go

@@ -13,6 +13,9 @@ import (
 // --- MULTI-CHANNEL ALARM DISPATCHER (EMAIL, DISCORD, CUSTOM WEBHOOK) ---
 
 func (s *Server) sendEmailNotification(toEmail, subject, bodyText string) error {
+	if s.cfg.DemoMode {
+		return errDemoOutgoing
+	}
 	cfg, err := s.smtpSettings()
 	if err != nil {
 		return err
@@ -29,6 +32,9 @@ func (s *Server) sendEmailNotification(toEmail, subject, bodyText string) error
 }
 
 func (s *Server) sendDiscordNotification(webhookURL, title, description, dueDate, priority string) error {
+	if s.cfg.DemoMode {
+		return errDemoOutgoing
+	}
 	allowPrivate := s.allowPrivateWebhooks()
 	if err := validateWebhookURL(webhookURL, true, allowPrivate); err != nil {
 		return err
@@ -63,6 +69,9 @@ func (s *Server) sendDiscordNotification(webhookURL, title, description, dueDate
 }
 
 func (s *Server) sendCustomWebhookNotification(webhookURL, event, title, notes, dueDate, priority string) error {
+	if s.cfg.DemoMode {
+		return errDemoOutgoing
+	}
 	allowPrivate := s.allowPrivateWebhooks()
 	if err := validateWebhookURL(webhookURL, false, allowPrivate); err != nil {
 		return err