fix: protect demo users from deletion and password changes

apps/docs/docs/management/mcp.mdx

@@ -63,10 +63,11 @@ Tools use the permissions of the API key owner or OAuth user. Queries read data;
 Inspect the **AI / MCP** tab or your client's tool list for available actions.
 
 Custom Widget and Workshop authoring tools, prompts, and resources require administrator access.
-For Custom Widgets, follow [Connect an agent](./custom-widgets/agent-authoring).
-Secret values are configured in Homarr and are never returned through MCP.
+For Custom Widgets, install the official skill and follow the preview-and-evidence workflow described in
+[Connect an agent](./custom-widgets/agent-authoring). Secret values are configured in Homarr and are never returned
+through MCP.
 
-The built-in [Assistant](./assistant) shares the MCP tool catalog, uses your Homarr session, and asks for approval
+The built-in [Assistant](./assistant) uses the same tool catalog with the current Homarr session and asks for approval
 before mutations by default.
 
 ## Verify the connection

apps/docs/docs/management/users/index.mdx

@@ -18,6 +18,9 @@ password. Decimal units are the default. Change them from the user form or **Com
 Preferences → Data size units**. Byte rates follow the same preference; bit rates stay decimal and use labels such as
 Mb/s. Deleting a user does not delete boards they created.
 
+In demo mode (`DEMO_MODE=true`), user deletion and password changes are disabled for everyone, including administrators,
+even when `DEMO_READ_ONLY=false` allows other changes. This applies to the UI and API.
+
 ![The Users management page](../img/users.png)
 
 ## Groups

packages/api/src/router/user.ts

@@ -497,6 +497,13 @@ export const userRouter = createTRPCRouter({
       mcp: { enabled: true, description: "Delete a user by ID. REQUIRED: userId (string)" },
     })
     .mutation(async ({ input, ctx }) => {
+      if (isDemoMode) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "User deletion is disabled in demo mode",
+        });
+      }
+
       // Only admins and user itself can delete a user
       if (ctx.session.user.id !== input.userId && !ctx.session.user.permissions.includes("admin")) {
         throw new TRPCError({
@@ -519,6 +526,13 @@ export const userRouter = createTRPCRouter({
       },
     })
     .mutation(async ({ ctx, input }) => {
+      if (isDemoMode) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "Password changes are disabled in demo mode",
+        });
+      }
+
       const user = ctx.session.user;
       // Only admins can change other users' passwords
       if (!user.permissions.includes("admin") && user.id !== input.userId) {