improve demo snapshots and import actions

[matveynator]

What changed

• let demo configuration copy either one specified page or the whole linked site
• show when the current demo snapshot was created, its size, and when demo content was last restored
• record restore timestamps after snapshot restoration and expired-session cleanup
• choose the first usable imported page when / is a SiteBrush soft 404, and keep a usable welcome page when source import fails
• reject SiteBrush soft-404 HTML as a valid external import source
• make the recommended Continue and Finish actions green while keeping Retry as a secondary outline action
• mark SiteBrush missing pages explicitly with metadata for reliable detection
• remove the obsolete root security_invariants_test.go file and stop referencing its removed tests in the security workflow

Integration with current main

The original working tree was eight commits behind origin/main. This branch was rebased onto current main and the only overlap was in four HTML download success paths. The resolution keeps both the UTF-8 encoding diagnostics already merged in PR #42 and the new soft-404 rejection. The merged NetChan dependency and clean --version behavior remain unchanged.

Checks

• targeted demo, snapshot, soft-404, billing refresh, and version-command tests
• GOCACHE=/private/tmp/sitebrush-gocache go test ./pkg/...
• the updated security workflow test selection
• git diff origin/main --check