feat(sandbox): add demo seed accounts via a context-gated liquibase changeset

[tiana-code]

Adds demo seed data so a fresh sandbox stack is immediately explorable (E-06, #235).

What

• New idempotent Liquibase changeset (ledger/.../db/changelog/demo/001-demo-accounts.sql) inserting 5 generic chart-of-accounts demo rows (INSERT ... ON CONFLICT (id) DO NOTHING, fixed UUIDs, dbms:postgresql, context:demo). Data lives only in the migration, per the Data Integrity Rules - no seed.sh, no client hardcode.
• Gating: ledger spring.liquibase.contexts defaults to production (a non-demo sentinel), so production and Helm deployments skip the demo changeset. The compose sandbox opts in with SPRING_LIQUIBASE_CONTEXTS=production,demo.
• The schema-test harness (LedgerSchemaTestDb.migrate()) now migrates with the production context so the schema integration tests mirror production and never load demo rows.

Why the context default matters

Liquibase runs every changeset when no runtime context is set, so a context:demo changeset alone would still load in prod. Defaulting the runtime contexts to production activates the filter; demo then loads only when demo is in the runtime contexts. No-context schema changesets always run, so this is back-compat for the existing schema.

Verification

• Docker is unavailable in WSL, so the container replay could not run locally. The binding gate is CI Compose smoke: ledger boots with production,demo, so the demo changeset must apply cleanly against the real schema (every value validated against the accounts CHECK constraints) for readiness to pass.
• Idempotency is guaranteed by ON CONFLICT DO NOTHING plus Liquibase changeset tracking; production-skip is enforced by the context default (prod profile and Helm inject no demo context).
• Local ledger gates green: detekt, spotlessCheck, compileIntegrationTestKotlin.

Gate chain

• critic: GO-WITH-CHANGES (3 must-fixes applied: dbms:postgresql, explicit NOT NULL column list, master-changelog replay).
• security-auditor (opus): PASS - prod provably never loads demo (prod profile + Helm + base sentinel), §5.3 clean, idempotent, non-destructive.
• code-reviewer: surfaced the empty-Contexts() harness impurity, fixed to Contexts("production").
• evaluator: PASS (0.888 >= 0.80).

Closes #235