Make portfolio demo actions safe

[DevCalebR]

Summary

• Disables portfolio demo lead status actions on /app and /app/leads/[leadId] with clear demo-only messaging.
• Adds server-action guards so demo lead status posts and settings saves redirect with an honest disabled message before any database mutation.
• Disables portfolio demo billing checkout and portal buttons, and guards the Stripe checkout/portal routes before Clerk, database, or Stripe work.
• Adds regression coverage proving demo actions are disabled or guarded before real writes/services.

Demo action audit

• /app: navigation and simulator links remain active; Call now remains a safe tel: link; Mark contacted and Mark booked are disabled in portfolio demo mode.
• /app/leads: list/filter/open-lead links only; no mutation controls found.
• /app/leads/[leadId]: Call now remains a safe tel: link; Mark contacted, Mark booked, and Mark lost are disabled in portfolio demo mode and the server action is guarded.
• /app/conversations: conversation rows only link to lead detail; no mutation controls found.
• /app/settings: Save settings and the settings fieldset are disabled in portfolio demo mode; direct posts are guarded before database writes.
• /app/call-flow: navigation and tel: test-call links only; no database mutation controls found.
• /app/billing: Stripe checkout and portal actions are disabled in portfolio demo mode; direct API posts redirect with the demo-disabled message before touching Stripe.

Validation

• ./node_modules/.bin/tsx --test tests/portfolio-demo-actions.test.ts
• npm run typecheck
• npm run lint
• npm run test
• npm run build