feat(demo): add demo manifest, Dutch demo entry, permanent badge and About page

Adds GET /api/v1/demo/manifest as a single source of truth for the demo's
fictional org identity (Northstar Mobility -- surfacing the project's
already-locked tenant name), synthetic-data/reset state, and live scenario
readiness. Rewrites the login screen in Dutch with an honest, no-password
demo entry and a guided-demo entry point, replaces the loud full-width
demo banner with a subtle badge + popover, and adds a compact About page
explaining what's real vs. synthetic vs. not yet connected.

PROJECT_STATE.md

@@ -548,3 +548,40 @@ scenarios, demo manifest, About page). Gap audit: `docs/demo-release/current-dem
   `http://192.168.10.150:1236/` returns 200.
 - Exact next action: `GET /api/v1/demo/manifest` + Dutch demo entry screen + permanent
   demo badge (task #30), then the Demo Guide + scenario overview (task #31).
+
+### Batch 2 — demo manifest, Dutch demo entry, permanent demo badge, About page (complete)
+
+- `GET /api/v1/demo/manifest` (unauthenticated): single source of truth for demo org
+  identity, synthetic-data flag, reset allowance/timestamp/anchor date, guide
+  availability, and the 5 named scenarios with **live** readiness (queries the actual
+  `BK-DEMO-RETURN`/`DQ-DEMO-DUPLICATE`/`DQ-DEMO-OVERLAP`/seeded-failed-event/knowledge-
+  provider records — not hardcoded), plus plain-language integration summaries. Backed by
+  new `backend/app/services/demo_manifest.py`. Refactored the n8n status derivation out of
+  `integration_status.py` into a shared `services/integration_status.py` so the manifest
+  and the existing authenticated `/integrations/status` endpoint reuse one implementation.
+- New settings (`backend/app/core/config.py`, wired through `compose.yaml`/`.env.example`):
+  `DEMO_ORGANIZATION_NAME` (default "Northstar Mobility" — surfaces the project's already-
+  locked fictitious tenant, previously only used internally as the `ragcore_tenant` slug),
+  `DEMO_TIMEZONE`, `DEMO_ALLOW_RESET` (a safety valve — `false` makes `POST
+  /api/v1/demo/reset` return 403 regardless of role; the now-dead `demo_today` setting
+  removed in Batch 1 stays removed).
+- Rewrote `Login.tsx` in Dutch: names the fictional org, one-sentence explanation sourced
+  from the manifest, no password shown/copyable anywhere, "Start begeleide demo" primary
+  CTA (logs in as Operations Manager, navigates to `/dashboard?guide=start` for task #31 to
+  consume) plus "Verken als Operations Manager"/"Verken als Rental Employee" secondary
+  actions. Added a permanent demo badge (topbar pill + popover: synthetic notice,
+  "workflows are real" reassurance, last-reset timestamp, link to `/about`) replacing the
+  old full-width static `.demo-banner` bar — subtle by design per the brief, not a warning
+  bar. New `/about`
+  page (`AboutDemo.tsx`) covering the fictional problem, what's really implemented, what's
+  synthetic, honest per-integration labels (via the manifest), and a reset pointer —
+  reachable from the badge popover, not added to primary nav (preserves the existing Control
+  Rail nav per the "not a redesign" constraint). Frontend nav/design otherwise untouched.
+- Evidence: `pytest` **127 passed**, `ruff check .` clean, `mypy app` clean (48 files);
+  frontend `tsc -b` clean, `npm run build` clean; full Playwright suite **41 passed**
+  (37 existing + 4 new `demo-entry.spec.ts` covering entry copy/no-password, guided-demo
+  login redirect, badge popover content + About link, and Escape/outside-click close).
+  Updated stale English login-button aria-labels and login-copy assertions across the
+  existing specs to match the new Dutch copy.
+- Exact next action: Demo Guide (collapsible panel, 8 steps) + scenario overview (5 cards
+  on the dashboard, consuming `/api/v1/demo/manifest`'s `scenarios` array) — task #31.