Add Mock Reference Demo Instance

The current /sandbox is a useful static walkthrough, but it does not provide the reviewer experience we actually need: a hosted, credential-free reference instance that feels like the real dashboard and exposes callable AS/RS-shaped APIs. Internal reviewers, implementers, and agents should be able to explore PDPP end to end without Docker, .env.local, connector auth, or private owner data.

The current /sandbox now demonstrates one PDPP story with client-side state and inspectable JSON. That is useful as pedagogy, but it is not the experience Tim is asking for. The missing experience is closer to a Stripe test-mode account or an OAuth playground: a hosted, credential-free reference instance where the dashboard and callable APIs behave like the real reference stack, but all state is deterministic and fictional.

The public sandbox SHALL provide a mock reference demo instance that presents dashboard-like reference behavior backed by deterministic fictional AS/RS state. The demo SHALL be usable without Docker, .env.local, connector credentials, a local SQLite database, or a running reference server.

Any public sandbox surface SHALL be mock-backed, resettable, and clearly labeled as simulated. It SHALL teach protocol flows, API shapes, and reference-instance behavior without collecting real platform credentials or presenting itself as a live owner reference instance. A sandbox route family MAY include both lightweight guided walkthroughs and a mock reference demo instance, but it SHALL keep both distinct from the live /dashboard/** operator surface.

Website routes that expose mock AS/RS behavior for the public sandbox SHALL remain sandbox-prefixed, deterministic, and explicitly demo-only. They SHALL NOT redefine the primary reference contract or become required by the live reference dashboard.