feat: replace UI mockups with real netOrk screenshots

The homepage showed seven hand-built JSX imitations of the netOrk UI. They
are gone; every image is now a screenshot of netOrk v0.28.0 itself, taken
from an anonymized copy of a production database (scripts/demo) with
scripts/screenshots/capture.py and published as WebP (~630 KB for all eight).

- Hero: the device inventory. Walkthrough: device detail, VLANs, the Security
  tab, the vulnerability triage queue (replacing the config-diff row), the
  dashboard and service checks (new row 6). NIS2: the audit log, filtered to
  what people did.
- Copy follows the images: row 3 describes the security assessment, row 4 the
  triage queue; row 2 no longer claims corrections are always automatic;
  18 widgets. Alt texts in both languages.
- Also fixed on the homepage: the NIS2 teaser for Art. 21 (2e) and the
  container list of a deployment (three worker pools, plus Flower, registry,
  APT cache and the Signal gateway).
- Demo tooling hardened on the real dump: secrets inside JSON (Wi-Fi keys),
  reverse DNS zones, glued identifiers, tens of thousands of CrowdSec
  addresses, a schema newer than the release (anonymize, then downgrade),
  MFA-enforcing roles, and click steps for view filters.
- DESIGN.md: real screenshots only. PAGES.md: the six rows as they are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/demo/up.sh

@@ -47,8 +47,24 @@ case "${1:-}" in
     got=$(docker exec "$DB" psql -U netork -tA -c "SELECT version_num FROM alembic_version")
     want=$(cd "$SRC" && PATH="$VENV/bin:$PATH" alembic heads 2>/dev/null | awk '{print $1}')
     echo "dump schema: $got   $VERSION head: $want"
-    [ "$got" = "$want" ] || echo "WARNING: schema differs from $VERSION; screens may not match the release."
+    # Anonymize first: it empties every secret, so a downgrade that would
+    # have to decrypt something (with a key we do not have) finds nothing.
     "$VENV/bin/python" "$HERE/anonymize.py"
+    if [ "$got" != "$want" ]; then
+      # The production instance runs a newer build. Walk the copy back to the
+      # release with the newer code's own downgrade migrations.
+      NEWER="${NETORK_NEWER_REF:-origin/main}"
+      echo "migrating the copy from $got back to $want with $NEWER's migrations"
+      rm -rf "$DEMO/src-newer"; mkdir -p "$DEMO/src-newer"
+      git -C "$NETORK_REPO" archive "$NEWER" | tar -x -C "$DEMO/src-newer"
+      # Rows the older schema cannot hold: CrowdSec blocklist alerts whose scope
+      # is a list name, longer than the column they go back into.
+      docker exec "$DB" psql -U netork -q -c \
+        "DELETE FROM crowdsec_alerts WHERE length(source_scope) > 32" 2>/dev/null || true
+      (cd "$DEMO/src-newer" && PATH="$VENV/bin:$PATH" \
+        DATABASE_URL="postgresql+asyncpg://netork:demo@127.0.0.1:$PORT/netork" alembic downgrade "$want")
+      "$VENV/bin/python" "$HERE/anonymize.py" --report-only
+    fi
     ;;
   start)
     ensure_src; ensure_db