feat: make demo concepts permission-first - #8

Summary

• add a structured permission-first security contract to the 21 curated demo concepts
• define a concept-specific threat scenario, control boundary, and measurable proof requirement for each demo
• surface security-case coverage in discovery cards and full security cases on detail pages
• preserve existing idea IDs, slugs, routes, authentication, RLS, and aggregate/privacy behavior
• expand the landing page around six idea categories, practical participation,
  and proof-before-scale questions while removing crypto-first framing
• keep catalog and detail routes available during migration rollout by retrying
  a legacy projection only for the three specifically missing security columns
• restrict both themes to black, white, neutral grays, and #ff5a1f bright orange
• render catalog/editorial imagery in grayscale without altering member avatars,
  and keep small text contrast-safe

Database

• add nullable threat_scenario, control_boundary, and proof_required columns
• constrain populated values to meaningful 40–500 character statements
• populate all 21 deterministic published demos without replacing their records
• add pgTAP coverage for schema, completeness, uniqueness, and public visibility

Verification

• hermes verify --json — passed, including runtime readiness HTTP 200
• npm run check — passed: 190 tests across 30 files
• npm run build — passed
• npm run format:check — passed
• npx supabase test db supabase/tests/database --local — passed: 225 assertions across 9 files
• npx supabase db lint --local --level warning — passed
• git diff --cached --check — passed
• compiled CSS palette audit — passed: no chromatic colors beyond #ff5a1f
• independent fail-closed reviews — contrast, inverse-surface, image-scope, and palette-test blockers were fixed and regression-tested

Notes

• Local browser QA against the current remote Supabase database confirmed all
  21 catalog entries and a detail route load through the compatibility path.
• The expanded home page was visually checked in light and dark modes.
• This remains exploration-mode content. No custody, operational authority, fundraising, or expansion is represented as live.