fix: protect demo account settings

[Croxy-Z]

Changes

• Identify the public demo user through User#demo_account?
• Route Devise registrations through a custom controller
• Prevent the demo account from being updated or deleted
• Preserve the standard registration flow for regular users
• Add request specs for update and destroy scenarios
• Updated vulnerable sanitizer dependencies and linter fixes