feat: public landing page with magic login, brand palette and demo build flag

Adds a public funnel landing at `/` and moves the login to `/login`, rebuilt
around the panel's own colors instead of an invented palette.

Landing (`src/components/landing/`, one section per file, no props):
- Seven funnel sections composed by `LandingPage`. The hero's eight swatches are
  literally `PIE_COLORS` from `DashboardPage`, the same hex values the seed hands
  to avatars and services, so "your colors become your numbers" is literal.
- `BrandMark` becomes the single source for the logo, replicating
  `public/favicon.svg`. Blue is the action surface, orange only ever marks.
- `NotebookVisual` is the one deliberate exception to the palette: it is what the
  product replaces.
- Copy drops all system vocabulary; motion comes from `src/lib/motion.ts` with a
  single easing, and reduced-motion resolves `initial` to the final state so a
  never-firing `whileInView` cannot leave a section invisible forever.

Routing and bundle:
- `homePathFor` is the single definition of each role's destination.
- Landing, login, dashboard and calendar load lazily. Eager, the login dragged
  framer-motion (~40 KB gz) into every panel load and the landing downloaded
  recharts + FullCalendar (~187 KB gz) without charting anything. `clsx` is
  pinned to the `react` chunk because Rollup otherwise assigns it to `charts`,
  making the entry import 111 KB gz for a 200-byte utility.

Responsiveness (iPhone/iPad), verified with `npm run audit:responsive`:
- No touch form field below 16px, `dvh` height utilities, safe-area insets, and
  40px touch targets keyed off `pointer: coarse` rather than `sm:`.
- New `.ld-gutter`: `.safe-x` lives outside `@layer` and beats Tailwind's `px-*`,
  so it left the login's side padding at 0 on anything but an iPhone in
  landscape. No overflow check could see it — there was no overflow, just zero
  margin. The audit now guards it with a `gutter` check.
- `shell-height` no longer fires on pages that legitimately scroll; the static
  `raw-viewport-unit` scan covers those instead.

Production build:
- The Dockerfile now sets `VITE_DEMO_UI=1` as a build arg. `DEMO` is a build-time
  constant, so without it Vite eliminated the magic login and the "Ver como…"
  switcher: the deployed landing promised "no registration" and led to an empty
  form. Verified by building both ways and diffing the bundle.
- Service worker cache bumped to v2 so the orphaned pre-landing chunks get purged
  from returning visitors' caches.

Verified: typecheck clean; unit 39/39, e2e 33/33, admin 17/17, booking 12/12,
landing 13/13 (WebKit), PWA passed against the real production build.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

visual-audit.mjs

@@ -13,7 +13,9 @@ const VIEWPORTS = [
 ];
 
 const PAGES = [
-  { name: "login", path: "/", login: false },
+  // `/` ahora sirve la landing pública; el login vive en `/login`.
+  { name: "landing", path: "/", login: false },
+  { name: "login", path: "/login", login: false },
   { name: "dashboard", path: "/dashboard", login: true, role: "owner" },
   { name: "calendar-week", path: "/calendar", login: true, role: "owner", waitFor: ".fc" },
   { name: "employees", path: "/employees", login: true, role: "owner" },
@@ -26,7 +28,9 @@ const PAGES = [
   { name: "emp-calendar", path: "/calendar", login: true, role: "employee", waitFor: ".fc" },
   { name: "admin-overview", path: "/admin", login: true, role: "admin" },
   { name: "admin-businesses", path: "/admin/businesses", login: true, role: "admin" },
-  { name: "public-booking", path: "/b/lumiere-estetica-spa", login: false },
+  // El slug del negocio demo es "negocio" (businesses.slug); con el slug anterior
+  // la API devolvía 404 y esta página se auditaba en su estado de error.
+  { name: "public-booking", path: "/b/negocio", login: false },
 ];
 
 const results = [];
@@ -39,7 +43,7 @@ async function login(browser, viewport, role) {
     if (m.type() === "error") consoleErrors.push({ where: "login", text: m.text() });
   });
   page.on("pageerror", (e) => pageErrors.push({ where: "login", text: e.message }));
-  await page.goto(`${BASE}/`, { waitUntil: "networkidle" });
+  await page.goto(`${BASE}/login`, { waitUntil: "networkidle" });
   await page.waitForTimeout(400);
   const email =
     role === "admin"