Make demo login gate backend-authoritative

Backend/README.md

@@ -111,5 +111,7 @@ Frontend app-wide demo gate:
 VITE_DEMO_GATE_ENABLED=true
 ```
 
-- `true`: the whole Vue app starts at `/login` until a session exists.
+- `true`: if `/api/public/site-status` is unavailable, the Vue app still starts at `/login` until a session exists.
-- unset or `false`: public pages such as `/` are visible without the initial demo login.
+- unset or `false`: if `/api/public/site-status` is unavailable, public pages such as `/` remain visible without the initial demo login.
+
+When `/api/public/site-status` is reachable, the backend `demoLoginEnabled` flag is authoritative.

README.md

@@ -23,7 +23,7 @@ cp .env.example .env
 npm run dev
 ```
 
-The frontend uses a lightweight local session flow for development:
+The frontend uses a lightweight demo session flow for development and preview deployments:
 
 - Sign in from the header
 - `Viewer Login` unlocks nomination and voting

frontend/src/router.ts

@@ -4,7 +4,7 @@ import { useAuthStore } from './stores/auth'
 import { useAwardsStore } from './stores/awards'
 import { routes } from './router/routes'
 
-const DEMO_GATE_HARD_DISABLED = import.meta.env.VITE_DEMO_GATE_ENABLED === 'false'
+const DEMO_GATE_FALLBACK_ENABLED = import.meta.env.VITE_DEMO_GATE_ENABLED !== 'false'
 const contentAdminRoutes = new Set(['admin-content', 'admin-settings'])
 
 const router = createRouter({
@@ -35,7 +35,9 @@ router.beforeEach(async (to) => {
   const isAdminRoute = to.path.startsWith('/admin')
   const isMaintenancePreview = isMaintenanceRoute && to.query.preview === 'true'
   const siteStatus = await loadSiteStatus()
-  const demoGateEnabled = !DEMO_GATE_HARD_DISABLED && siteStatus?.demoLoginEnabled !== false
+  const demoGateEnabled = siteStatus
+    ? siteStatus.demoLoginEnabled
+    : DEMO_GATE_FALLBACK_ENABLED
 
   if (isMaintenancePreview && !authStore.isAdmin) {
     return { name: 'login', query: { redirect: to.fullPath } }