Harden demo access and restore clean checks

drizzle/0027_disable_public_demo_password.sql

@@ -0,0 +1,17 @@
+-- The original App Review credential was committed publicly in migration 0014.
+-- Rotate it to an unknown value and invalidate its sessions. Use
+-- `bun run demo:provision` with a private DEMO_ACCOUNT_PASSWORD when review
+-- access is needed.
+UPDATE "beenvoice_user"
+SET "password" = '$2b$12$GyM6.bLv2.sZMsWytNz1L.j7pLwc79a55Nww6bSLQJ9OJarqY9oZW',
+    "updatedAt" = NOW()
+WHERE "id" = 'a0000000-0000-4000-8000-000000000001';
+
+UPDATE "beenvoice_account"
+SET "password" = '$2b$12$GyM6.bLv2.sZMsWytNz1L.j7pLwc79a55Nww6bSLQJ9OJarqY9oZW',
+    "updatedAt" = NOW()
+WHERE "userId" = 'a0000000-0000-4000-8000-000000000001'
+  AND "providerId" = 'credential';
+
+DELETE FROM "beenvoice_session"
+WHERE "userId" = 'a0000000-0000-4000-8000-000000000001';