DEMO_BINDINGS: readonly RoleBinding[] = ...

Demo principals for demo login mode (flag cp.demoAuth). Real deployments use passkeys (WebAuthn) and short-lived sessions.