Drop the external demo: the Widgets tab is the demo

The hamlab-demo site, its Widgets-tab button, the demo_url config key and the make publish
target that fed it are all gone, along with the public read-only token it needed. The
example stays in examples/external-demo as something to read. The installer one-liner
already comes from Gitea releases.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PLAN.md

@@ -186,7 +186,12 @@ something long in one, switch away and back, refresh — it's all still there.
   a URL), status sensors (services, updates, ZFS, SMART), a widget library, custom widgets
   on the Dashboard tab (briefly renamed "Monitors" 2026-09-19, back to "Dashboard"
   2026-09-20 at Mitchell's request; the view id and URL were always `dashboard`), and a
-  frameable `/embed/widget` for Glance and friends. The stock Dashboard modules and the Disks
+  frameable `/embed/widget` for Glance and friends. (An external demo page was deployed at
+  `hamlab-demo.bigham.dev` and linked from the Widgets tab 2026-09-19; **both removed
+  2026-09-23** at Mitchell's request — the Widgets tab shows the same thing against the
+  machine you are signed in to, so the second copy earned nothing and cost a public
+  read-only token, which was revoked with it. `examples/external-demo/` stays as an example
+  to read.) The stock Dashboard modules and the Disks
   tab read the sensor API too (`sampleAdapter.ts`); `/api/metrics` is retired.
   Also per-service and per-container sensors (memory and CPU from cgroups), tokens limited
   to ID patterns, and `/api/fleet/sensors/query` for the whole fleet in one request.
@@ -406,8 +411,7 @@ something long in one, switch away and back, refresh — it's all still there.
   still default to private. No token is needed by anything any more (the read-only one was
   revoked; only `hamlab-publish`, which creates releases, remains). Gitea resolves
   `releases/download/latest/<asset>`, so `install.sh` and `HAMLAB_URL` now point straight
-  at the newest release and never need changing; the rolling copy on
-  `hamlab-demo.bigham.dev` stays as a mirror. What is public is the source, the history,
+  at the newest release and never need changing. What is public is the source, the history,
   `BUGS.md` and this file — which describes the lab and names the console's hostname.
 - **Auth hardening** — WebAuthn passkeys (phone Face ID), TOTP fallback, optional NPM
   access list restricting to WireGuard/LAN.