feat(demo): demo-account schema + reusable rate limiter

Add the shared demo-account plumbing: users.is_demo marks the single
shared demo user, demo_whitelist holds the admin-curated emails that may
enter it without Google sign-in, and a small in-process RateLimiter
(generic groundwork) for throttling the demo-login endpoint per IP.

backend/app/models.py

@@ -28,6 +28,12 @@ class User(Base):
     display_name: Mapped[str | None] = mapped_column(String(255))
     avatar_url: Mapped[str | None] = mapped_column(String(1024))
     role: Mapped[str] = mapped_column(String(16), default="user", server_default="user")
+    # The single shared "demo" account: signed into without Google OAuth (via a whitelisted
+    # email on the login page), has no OAuth token / YouTube scope, and its per-user state is
+    # shared by everyone who enters this way. Exactly one such row is expected.
+    is_demo: Mapped[bool] = mapped_column(
+        Boolean, default=False, server_default="false", index=True
+    )
     # Free-form UI preferences (theme, color scheme, font scale, default filters…).
     preferences: Mapped[dict | None] = mapped_column(JSON)
     created_at: Mapped[datetime] = mapped_column(
@@ -81,6 +87,22 @@ class Invite(Base):
     decided_by: Mapped[str | None] = mapped_column(String(320))  # admin email
 
 
+class DemoWhitelist(Base):
+    """Emails that may enter the shared demo account from the login page (no Google OAuth).
+    A hidden, admin-curated list of "keys to the same door" — every entry logs into the one
+    shared demo user. Distinct from Invite (which gates real Google sign-in)."""
+
+    __tablename__ = "demo_whitelist"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    email: Mapped[str] = mapped_column(String(320), unique=True, index=True)
+    note: Mapped[str | None] = mapped_column(Text)
+    added_by: Mapped[str | None] = mapped_column(String(320))  # admin email
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now()
+    )
+
+
 class Channel(Base):
     """A YouTube channel. Shared across all users (one channel's videos are the same
     for everyone), so its expensive metadata is fetched and stored only once."""