Merge origin/dev into feat/rag-clinical-guidelines

Conflict in app/api/routes.py: /demo/personas keeps the dev version (demo console, DB patients
with scenarios); the patient app gets its own /patient/demo-personas (synthetic ЕМИАС accounts).
Anonymous sign-in now always creates a doctor-less pseudonymous profile, since the dialog API
of #12 serves known profiles only.

Refs #77

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/src/api/client.ts

@@ -44,7 +44,7 @@ export const api = {
   signInEmias: (code: string) => post<AuthResult>("/auth/emias", { code }),
   signInEmiasDemo: (personaToken: string) => post<AuthResult>("/auth/emias/demo", { persona_token: personaToken }),
   signInAnonymous: (focus: Focus) => post<AuthResult>("/auth/anonymous", { focus }),
-  demoPersonas: () => request<DemoPersona[]>("/demo/personas"),
+  demoPersonas: () => request<DemoPersona[]>("/patient/demo-personas"),
   crisisResources: () => request<CrisisResource[]>("/crisis/resources"),
   catalog: () => request<Catalog>("/instruments/catalog"),
   medsReference: () => request<MedsReference>("/meds/reference"),