[DEMO] Avatar di prodotto Fase 1 — fondazione backend (5 endpoint /api/demo/*)

product-demo-protocol v1.0.1, Modalita A. Additivo (zero impatto endpoint esistenti).

- DemoController: session-start, manifest, event, credentials, reset-dataset
  * demo_jwt scope=demo:read-only, org_id 996001 (range demo 996000-996999), TTL 30m
  * hmac_key_seed base64 44ch, rate-limit 5/min+50/h per IP, eventi idempotenti
- Migration 040: tabelle demo_sessions + demo_events
- Rotte 'demo' in index.php (chiavi camelCase: router camelCasa il segmento URL)
- docs/DEMO_AVATAR_NIS2.md: piano Fase1/Fase2, decisioni, punti integrazione AgileHub, gap protocollo

Smoke prod OK: session-start 201, manifest 200, credentials 200, event 204, reset 401(no key).
TODO Fase 1: read-only guard in requireAuth, dataset demo 996001, frontend demo-mode, manifest+mappe.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/sql/040_demo_sessions.sql

@@ -0,0 +1,31 @@
+-- NIS2 Agile — Migration 040: Demo Avatar (product-demo-protocol v1.0.1)
+-- Tabelle additive per la modalità demo guidata dall'avatar di prodotto.
+-- Range org demo riservato: 996000-996999 (org demo isolata = 996001).
+-- Idempotente: CREATE TABLE IF NOT EXISTS.
+
+CREATE TABLE IF NOT EXISTS demo_sessions (
+    session_id        VARCHAR(64)  NOT NULL PRIMARY KEY,        -- 'demo-<uuid>'
+    organization_id   INT          NOT NULL,                    -- org demo (996000-996999)
+    hmac_key_seed     VARCHAR(64)  NOT NULL,                    -- base64 standard 44 char
+    language          VARCHAR(5)   NOT NULL DEFAULT 'it',
+    tour_variant      VARCHAR(16)  NOT NULL DEFAULT 'full',
+    presentation_mode VARCHAR(16)  NOT NULL DEFAULT 'realtime',
+    referrer_url      VARCHAR(512) NULL,
+    user_agent        VARCHAR(512) NULL,
+    ip_hash           VARCHAR(64)  NULL,                        -- sha256(ip+DAILY_SALT), server-side
+    expires_at        DATETIME     NOT NULL,
+    created_at        DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    INDEX idx_demo_sessions_expires (expires_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE IF NOT EXISTS demo_events (
+    id                   INT          NOT NULL AUTO_INCREMENT PRIMARY KEY,
+    session_id           VARCHAR(64)  NOT NULL,
+    event_type           VARCHAR(40)  NOT NULL,                 -- step_completed | step_skipped | ...
+    step_id              INT          NULL,
+    metadata             JSON         NULL,
+    client_timestamp_iso VARCHAR(40)  NULL,
+    created_at           DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE KEY uk_demo_event_idem (session_id, event_type, step_id, client_timestamp_iso),
+    INDEX idx_demo_events_session (session_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;