fix(site): move the demo module out of the page to satisfy CSP

script-src 'self' with no 'unsafe-inline' blocks inline module scripts, so the
demo initialized nothing on the deployed site while working perfectly locally —
the dev server sends no CSP, so only the real deployment showed it.

Extracted to assets/demo.js rather than relaxing the policy. Loosening CSP for
a page that renders moderation decisions would be the wrong trade.

.gitignore

@@ -12,3 +12,5 @@ coverage/
 
 # Built site output (Vercel builds it)
 packages/site/dist/
+.vercel
+.env*