Mobile "Publish to web" + anonymous demo publish (AI welcome, no auth)

Turns a no-login demo card into a real, scannable web profile with an optional
AI welcome — completing the owner side of the welcome feature without auth.

Backend:
- POST /v1/demo/publish (public, rate-limited 10/h/IP): creates a fresh
  password-less owner (so the profile shows the right name + fits the free-tier
  1-card limit), builds a card (contact title + profile links), optionally
  generates an AI welcome, and publishes. Returns { handle, profileUrl }.
- demo_service + handlers/demo; 2 tests (publish→public profile w/ welcome,
  name required). Gate green (120 tests). Verified live: publish → Astro renders
  the welcome hero + image (from MinIO) + We-Met form, 18KB page.

Mobile:
- publish.tsx: enter an optional AI welcome scene + message, Publish → shows the
  live cardclaws URL (Open/Done) and points the card's QR at it.
- demo.tsx: "Publish to web · AI welcome" button (saves, then opens publish).
- api.publishToWeb; LocalCard.publishedUrl.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

cardclaws-mobile/src/api/ai.ts

@@ -49,3 +49,23 @@ export async function pollVideo(operationId: string): Promise<VideoStatus> {
   );
   return res.data;
 }
+
+export interface PublishPayload {
+  name: string;
+  title?: string;
+  links: { label: string; url: string }[];
+  welcomePrompt?: string;
+  welcomeMessage?: string;
+}
+
+/** Publish a demo card to the web (no auth) → a real, scannable profile URL. */
+export async function publishToWeb(
+  payload: PublishPayload,
+): Promise<{ handle: string; profileUrl: string }> {
+  const res = await api.post<{ handle: string; profileUrl: string }>(
+    "/v1/demo/publish",
+    payload,
+    { timeout: 120000 },
+  );
+  return res.data;
+}