Developer: DIFFAUDIT_DEMO_MODE=0 does not actually disable frontend demo mode

[DeliciousBuding]

Owner: Developer

问题

文档和治理口径说可以用 DIFFAUDIT_DEMO_MODE=0 关闭 frontend demo mode，但当前 server-side demo 判定只把 env 的 enabled values 当作强制开启；env 设置为 0 时不会显式返回 false，随后仍会在没有 demo cookie 的情况下默认 demo mode。

证据

• AGENTS.md:101 写明：要使用 Go backend demo data，应通过 DIFFAUDIT_DEMO_MODE=0 禁用 frontend demo mode。
• apps/web/src/lib/demo-mode.ts:11-20 只在 DIFFAUDIT_FORCE_DEMO_MODE 或 DIFFAUDIT_DEMO_MODE 为 1/true/yes/on/demo 时返回 true；0 没有被识别为 false。
• apps/web/src/lib/demo-mode.ts:37-50 在没有 cookie 明确设置时最终默认返回 true。
• apps/web/src/proxy.ts:9-19 有一份独立 demo 判定逻辑，同样不把 env 0 当 false，最终默认 true。

影响

部署或开发者按文档设置 DIFFAUDIT_DEMO_MODE=0 后，Next.js Route Handler 仍可能走 demo mode，导致 /api/v1 live proxy/auth 路径没有被使用。这会削弱 #33 的 live auth 修复，并让“关闭 demo 接 Go backend”的文档不可相信。

建议修复

• 统一 demo mode 判定逻辑，避免 proxy.ts 和 lib/demo-mode.ts 漂移。
• DIFFAUDIT_FORCE_DEMO_MODE 保持强制开启优先级。
• DIFFAUDIT_DEMO_MODE=0/false/no/off 应明确禁用 demo mode。
• 无显式 env/cookie 配置时可保留当前默认 demo behavior。
• 增加测试覆盖 env DIFFAUDIT_DEMO_MODE=0 时 /api/v1 无 session/fake session 不再走 demo。

验收标准

• DIFFAUDIT_DEMO_MODE=0 在 proxy 和 route handler demo 判定中都关闭 demo。
• DIFFAUDIT_FORCE_DEMO_MODE=1 仍可强制开启。
• Developer: /api/v1 live routes accept session-shaped fake cookies #33 的 live auth tests 不再依赖 cookie platform-demo-mode=0 才能进入 live path。

[DeliciousBuding]

Fix handoff for Developer

Branch: fix/platform-security-hardening
Worktree: D:\Code\DiffAudit\.worktrees\platform-security-hardening
Commits: 8994fd8, 7517972

What changed:

• DIFFAUDIT_DEMO_MODE=0/false/no/off now explicitly disables frontend demo mode.
• DIFFAUDIT_FORCE_DEMO_MODE=1 still has priority and keeps demo mode forced on.
• proxy.ts, server route demo checks, and settings initialization share the same demo-mode-flags.ts parsing rules, preventing middleware/server drift.
• Live-mode route tests now use env-level demo disable to prove fake/no session traffic reaches the live auth rejection path, which strengthens the Developer: /api/v1 live routes accept session-shaped fake cookies #33 regression coverage.

Verification I reran after the worker stopped:

• npm --prefix apps/web run test -> 70 files / 281 tests passed.
• npm --prefix apps/web run lint -> passed.
• npm --prefix apps/web run build -> passed.
• python scripts/check_public_boundary.py -> passed.
• go -C apps/api-go test ./... -> passed.
• git diff --check origin/main...HEAD -> passed.

This is ready for Developer review in the PR. The deployment-side check is to ensure production/live environments set DIFFAUDIT_DEMO_MODE=0 or an equivalent explicit off value when demo behavior must be disabled.

[DeliciousBuding]

PR is open for Developer review: #37

The PR includes this issue in its close keywords and carries the verification evidence in the PR body.