Add test coverage for demo token validation in non-production mode

[Copilot]

The test suite verified that old tokens are rejected but didn't validate that demo tokens work through the same validation path when VAULT_TOKENS env var is not set.

Changes:

• Added test_demo_tokens_work_when_env_var_not_set positioned after test_old_tokens_not_valid to validate the inverse case
• Uses pytest.skipif to explicitly skip in production environments where VAULT_TOKENS is configured

@pytest.mark.skipif(
    os.getenv("VAULT_TOKENS") is not None,
    reason="Test only applies when VAULT_TOKENS env var is not set (demo mode)"
)
def test_demo_tokens_work_when_env_var_not_set(self):
    """Demo tokens should pass validation when VAULT_TOKENS env var is not set."""
    rate_limiter._requests.clear()
    validate_token(DEMO_TOKEN)
    validate_token(DEMO_ADMIN_TOKEN)

This ensures demo tokens flow through validate_token() successfully in local/test environments, complementing the existing test that verifies old hardcoded tokens are rejected.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.