feat(demo): run a simulated review end to end in mock mode

[Ayinkx]

Adds a safe, self-contained demo so the deployed app can be exercised without a GitHub App, credentials or an AI provider.

• app/services/demo.py: idempotent seeding of the demo user, installation and simulated repository (mock + AUTO_INIT_DB only; never in real mode) and run_demo_review(), which reuses analyze()/persist_outcome() against the in-memory mock client, skips publishing and AI, records the real running -> succeeded/failed job, and labels the result as simulated.
• app/main.py: POST /demo/review (authenticated, CSRF-protected, mock-only, quota-enforced, 403 in real mode), seeding on startup and on the dashboard, and a fix so ?code=mock cannot authenticate anyone when GITHUB_MODE=real.
• Dashboard: a "Run demo review" action; recent reviews show files; the review detail page shows a simulated badge.
• pyproject: ruff and bandit are runtime dependencies, because the pipeline executes those binaries at runtime and the serverless demo needs them to produce findings.
• docs/vercel.md: the demo workflow, exact environment variables, limitations.
• tests: seeding, idempotency across sessions, real-mode rejection, persisted result/findings/job, no publishing, mock-client-only, quota enforcement, repeated runs, and the route's auth/CSRF/mode/429 behaviour.

Tests: 126 passed; ruff check, ruff format --check and bandit all clean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
codeyinkx	Ready	Preview	Oct 17, 2026 2:28am UTC