fix(onboarding): no shared-provider offer where the grant cannot be made

The done screen's one-tap button posts `POST /api/consent/ai/web`, a path the
demo instance's edge allowlist refuses — correctly, since the demo is a single
shared account and a receipt one visitor minted would turn the operator's
provider on for everyone after them. The button was offered anyway, so a
visitor who took it got the generic "give it another try in a moment" toast on
the one screen whose whole purpose is not to say things it cannot back.

The route withholds the offer under `DEMO_MODE`, which leaves the panel in its
neutral form, claiming nothing either way.

docs/api/openapi.yaml

@@ -44505,7 +44505,8 @@ components:
           description: "Whether the shared provider may honestly be offered to this caller in one tap. True only when all of: the
             operator's provider is the one that would serve them (`managedBy: \"server\"`), `serverProviderHealth` is
             `healthy`, the operator's assistant master + coach flags are on, the acting record holds its own credentials
-            (a managed profile never does), and the caller holds no receipt yet. Anything unknown makes it false."
+            (a managed profile never does), the caller holds no receipt yet, and the instance is not running in demo
+            mode (where the grant the tap makes is refused at the edge). Anything unknown makes it false."
         serverProviderConsent:
           type: boolean
           description: Whether this caller already holds an active `ai_full` / `ai_coach` receipt — the grant `POST