Fix e2e fallout from default-private profile_visibility

Three places assumed the old default-public model:

1. e2e/public-content.test.ts: "profile 404 when user has no public
   content" → updated to assert the new locked-account stub renders
   200 with "This profile is private" and the private route doesn't
   appear. The two follow-on tests (public-route profile, unlisted
   route) now flip the owner to public via a setProfileVisibilityPublic
   helper before the anon-visit assertions, since new users default to
   private.

2. e2e/demo-bot.test.ts: bruno is seeded with profile_visibility =
   'public' on insert (timestamped seed) and the existing-bruno path
   gets a follow-up UPDATE so the test's anon-visitor assertion
   (profile renders, public route is listed) holds regardless of which
   default he was first created under.

3. apps/journal/app/lib/demo-bot.server.ts ensureDemoUser: also pins
   profile_visibility = 'public' on insert. The demo persona is
   discoverable by design — that's the whole point.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/journal/app/lib/demo-bot.server.ts

@@ -279,6 +279,11 @@ export async function ensureDemoUser(
       displayName: persona.displayName,
       bio: persona.bio,
       domain,
+      // The demo persona is meant to be discoverable to anyone — its
+      // entire purpose is to populate empty instances with public
+      // content. Force `public` even though new accounts default to
+      // `private` (locked-account model).
+      profileVisibility: "public",
       termsAcceptedAt: new Date(),
       termsVersion: TERMS_VERSION,
     })