feat(demo): add demo manifest, Dutch demo entry, permanent badge and About page

Adds GET /api/v1/demo/manifest as a single source of truth for the demo's
fictional org identity (Northstar Mobility -- surfacing the project's
already-locked tenant name), synthetic-data/reset state, and live scenario
readiness. Rewrites the login screen in Dutch with an honest, no-password
demo entry and a guided-demo entry point, replaces the loud full-width
demo banner with a subtle badge + popover, and adds a compact About page
explaining what's real vs. synthetic vs. not yet connected.

backend/app/api/routers/demo.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import time
 import uuid
 
-from fastapi import APIRouter, Depends, Request, Response
+from fastapi import APIRouter, Depends, HTTPException, Request, Response, status
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
@@ -11,14 +11,23 @@ from app.api.deps import get_current_user, get_db, require_operations_manager
 from app.core.config import get_settings
 from app.core.security import SessionPayload, create_session_token, read_session_token
 from app.models.user import User
-from app.schemas import CurrentUser, DemoLoginRequest
+from app.schemas import CurrentUser, DemoLoginRequest, DemoManifestOut
 from app.seed_loader import reset_and_seed
 from app.services.audit import record_audit_event
+from app.services.demo_manifest import build_demo_manifest
 
 router = APIRouter(prefix="/api/v1/demo", tags=["demo"])
 settings = get_settings()
 
 
+@router.get("/manifest", response_model=DemoManifestOut)
+def demo_manifest(db: Session = Depends(get_db)) -> DemoManifestOut:
+    # Deliberately unauthenticated: the demo-entry screen and the permanent demo badge
+    # both need this before any session exists. Nothing here is sensitive — it's the same
+    # honest "what is this demo" summary a logged-in user would see.
+    return build_demo_manifest(db)
+
+
 @router.post("/login", response_model=CurrentUser)
 def demo_login(
     body: DemoLoginRequest, response: Response, db: Session = Depends(get_db)
@@ -92,6 +101,11 @@ def demo_reset(
     db: Session = Depends(get_db),
     user: CurrentUser = Depends(require_operations_manager),
 ) -> dict:
+    if not settings.demo_allow_reset:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Demo reset is disabled on this deployment.",
+        )
     result = reset_and_seed(db)
     record_audit_event(
         db,

backend/app/api/routers/integration_status.py

@@ -1,75 +1,28 @@
 from __future__ import annotations
 
-from typing import Literal
-
 from fastapi import APIRouter, Depends
-from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
 from app.api.deps import get_db, require_operations_manager
 from app.core.config import get_settings
-from app.models.outbox import OutboxEvent
 from app.schemas import (
     CurrentUser,
     IntegrationStatusOut,
     McpHubIntegrationStatus,
-    N8nIntegrationStatus,
 )
+from app.services.integration_status import derive_n8n_status
 
 router = APIRouter(prefix="/api/v1/integrations", tags=["integrations"])
 settings = get_settings()
 
 
-def _n8n_status(db: Session) -> N8nIntegrationStatus:
-    counts: dict[str, int] = dict(
-        db.execute(
-            select(OutboxEvent.delivery_status, func.count()).group_by(OutboxEvent.delivery_status)
-        ).all()  # type: ignore[arg-type]
-    )
-    pending = counts.get("pending", 0)
-    delivering = counts.get("delivering", 0)
-    failed = counts.get("failed", 0)
-    succeeded = counts.get("succeeded", 0)
-
-    latest_success_at = db.scalar(
-        select(func.max(OutboxEvent.updated_at)).where(OutboxEvent.delivery_status == "succeeded")
-    )
-    latest_failure_at = db.scalar(
-        select(func.max(OutboxEvent.updated_at)).where(OutboxEvent.delivery_status == "failed")
-    )
-
-    state: Literal["disabled", "unavailable", "degraded", "operational", "no_evidence"]
-    if not settings.n8n_dispatch_enabled:
-        state = "disabled"
-    elif failed > 0 and succeeded == 0:
-        state = "unavailable"
-    elif failed > 0:
-        state = "degraded"
-    elif succeeded > 0 or pending > 0 or delivering > 0:
-        state = "operational"
-    else:
-        state = "no_evidence"
-
-    return N8nIntegrationStatus(
-        configured=bool(settings.n8n_webhook_url),
-        dispatch_enabled=settings.n8n_dispatch_enabled,
-        state=state,
-        pending=pending,
-        delivering=delivering,
-        failed=failed,
-        succeeded=succeeded,
-        latest_success_at=latest_success_at,
-        latest_failure_at=latest_failure_at,
-    )
-
-
 @router.get("/status", response_model=IntegrationStatusOut)
 def integration_status(
     db: Session = Depends(get_db),
     _user: CurrentUser = Depends(require_operations_manager),
 ) -> IntegrationStatusOut:
     return IntegrationStatusOut(
-        n8n=_n8n_status(db),
+        n8n=derive_n8n_status(db),
         mcp_hub=McpHubIntegrationStatus(
             registration_enabled=settings.mcp_hub_registration_enabled,
             state="configured" if settings.mcp_hub_registration_enabled else "not_configured",