P1.5: убрать демо-бэкдор (публичный bypass-токен UI)

Удалены authenticateUIDemoToken, uiDemoToken/uiDemoTenantID/uiDemoEmail и их
константы (demo-ui-shared-sqs-ngcloud-2026) — публичный путь входа в UI мимо
JWT-валидации. seed.go теперь создаёт demo-тенанта со СЛУЧАЙНЫМИ кредами
(tenant.Create), без захардкоженного SecretKey в исходнике. Тест
TestJWTAuth_AllowsDemoToken заменён на TestJWTAuth_RejectsMissingToken.

app/admin/admin_test.go

@@ -1,7 +1,5 @@
 // app/admin/admin_test.go
 // Focused tests for UI auth and scoping
-// Created: 2026-04-12 09:28 MSK
-// Updated: 2026-04-12 09:28 MSK — demo UI token and tenant-scoped UI responses
 package admin
 
 import (
@@ -15,37 +13,18 @@ import (
 	"shared-sqs/app/tenant"
 )
 
-// TestJWTAuth_AllowsDemoToken verifies that the public demo token authenticates into the seeded demo tenant.
-func TestJWTAuth_AllowsDemoToken(t *testing.T) {
-	t.Setenv("SHARED_SQS_UI_DEMO_TOKEN", "demo-token-for-test")
-	t.Setenv("SHARED_SQS_UI_DEMO_TENANT_ID", "t-demo-test")
-
+// TestJWTAuth_RejectsMissingToken verifies jwtAuth rejects a request without a token.
+func TestJWTAuth_RejectsMissingToken(t *testing.T) {
 	store := tenant.NewTenantStore()
-	demoTenant, err := store.CreateFixed("demo-service", 10, "t-demo-test", "SSAK-demo-test", "demo-secret")
-	if err != nil {
-		t.Fatalf("CreateFixed(): %v", err)
-	}
-
 	h := NewHandler(store, "admin-token")
-	req := httptest.NewRequest(http.MethodPost, "/ui/api/auth", strings.NewReader(`{"token":"demo-token-for-test"}`))
+	req := httptest.NewRequest(http.MethodPost, "/ui/api/auth", strings.NewReader(`{}`))
 	req.Header.Set("Content-Type", "application/json")
 	w := httptest.NewRecorder()
 
 	h.jwtAuth(w, req)
 
-	if w.Code != http.StatusOK {
-		t.Fatalf("jwtAuth() status = %d, body = %s", w.Code, w.Body.String())
-	}
-
-	var resp map[string]any
-	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if got := resp["tenant_id"]; got != demoTenant.ID {
-		t.Fatalf("tenant_id = %v, want %s", got, demoTenant.ID)
-	}
-	if got := resp["access_key"]; got != demoTenant.AccessKey {
-		t.Fatalf("access_key = %v, want %s", got, demoTenant.AccessKey)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("jwtAuth() status = %d, want 400", w.Code)
 	}
 }