[rumblefrog]

Summary

./sbpp.sh db-seed previously stopped at empty :prefix_demos rows
and ban-only comments — the dev panel rendered with two visible-but-
empty surfaces on every fresh seed:

1. "Review Demo" link on the banlist rendered as a dead anchor.
   :prefix_demos was untouched, so the page handler never emitted
   the affordance and the surface was unreachable for manual
   exploration / acceptance audits / screenshot work without
   hand-uploading a demo first.
2. Moderation queues (admin submissions + protests) and the
   public banlist's per-row comment disclosure rendered empty
   threads — :prefix_comments only got type 'B' (ban-attached),
   so the C / S / P columns were structurally untestable.

This PR closes both gaps with one expansion of
Sbpp\Tests\Synthesizer:

• Demo seeding — insertDemos() writes ~80 rows at medium scale
  (64 ban-attached, 16 submission-attached — 80/20 split mirroring
  the panel's own bias toward bans-with-evidence) and lands a
  paired ~1 KiB opaque text payload on disk under SB_DEMOS
  (web/demos/ on the dev bind-mount). Filenames are
  md5(seed|demtype|demid) so re-seeds round-trip identically and
  the truncate-time wipe can find them by re-reading the table.
• Multi-type comments — insertComments() fans the comment
  budget across all four :prefix_comments.type values
  (B=60% / C=20% / S=10% / P=10%, medium → 120/40/20/20). Matches
  the overload contract in api_bans_add_comment's match($ctype)
  arms documented in AGENTS.md → "Add a comment-delete trash icon".
• Idempotency hardening — snapshot-then-truncate-then-unlink
  ordering (closes a transient "rows point at deleted files"
  window); scope is the snapshotted set so manual panel uploads +
  .gitkeep survive every seed.
• Paired host-side changes — .gitignore for web/demos/*
  (with the .gitkeep exception); sbpp.sh db-reset strips
  MD5-basename files from web/demos/ after the DB drop so
  post-volume orphans don't accumulate.

Issue #1483 was filed for the pre-existing tech-debt finding from
the adversarial review (bare letter codes for BanRemoval / LogType
column-typed fields in the seeder) — out of scope for this PR.

Test plan

Local default-seed run:

$ ./sbpp.sh db-seed
  demos                      80
  comments                  200
  ...

• PHPStan clean (./sbpp.sh phpstan — 253/253, no errors)
• Targeted PHPUnit (./sbpp.sh test tests/integration/ExportBundleWriterTest.php
  — the one test that touches :prefix_demos / :prefix_comments:
  3 tests / 426 assertions all green)
• Exact counts — demos=80 (B=64, S=16); comments=200 (B=120,
  C=40, S=20, P=20). Confirmed via SELECT type, COUNT(*) FROM sb_comments GROUP BY type and SELECT demtype, COUNT(*) FROM sb_demos GROUP BY demtype.
• FK orphan check — six LEFT-JOIN-NULL queries across
  demos.B/bans, demos.S/submissions, comments.B/C/S/P
  against bans/comms/submissions/protests: all return
  zero orphans.
• On-disk files — exactly 80 MD5-named files under
  web/demos/ after a fresh seed; basenames match the
  :prefix_demos.filename column byte-for-byte.
• Idempotency: filename stability — two consecutive seeds
  with the default seed produce identical filename sets
  (md5sum of sorted ls output: ce2189fe… both runs;
  diff returns empty).
• Idempotency: manual file preservation — touch web/demos/manual-decoy.dem; re-seed; the decoy survives
  (not referenced by :prefix_demos, not in the snapshot).
• .gitkeep preserved — .gitkeep is also not in
  :prefix_demos, so it survives every seed unchanged.
• db-reset cleanup — confirmed find … -regex '.*/[0-9a-f]{32}$' -delete matches both shapes the write
  path produces (synth + panel UploadHandler with
  renameToHash: true) while leaving .gitkeep and any
  non-MD5 manual uploads (icon / mapimg flows preserve
  original filenames) in place.
• AGENTS.md + docker/README.md updated with exact per-scale
  counts, demo payload caveat (not playable in the demoviewer),
  new wipe ordering contract, and db-reset cleanup behavior.
• Refusal guard intact — Synthesizer still refuses any
  DB_NAME other than sourcebans per the file's docblock, so
  sourcebans_test / sourcebans_e2e are unaffected.