demo: ask-your-own-agent story for try.visiban.com (MCP enabled, scoped read-only PAT, documented)

Problem

The 1.2 headline includes "ask your own agent about it". No demo board shows this today. The demo fence blocks MCP writes (mcp_server/server.py) and does not let the visitor mint a PAT (visiban/demo.py), and values-demo.yaml does not enable MCP. Found by the completeness audit on #1889 (closed).

Decision needed

Publishing a token on a public demo is a security decision. Options: a visible, documented read-only PAT scoped to the demo boards; a copy-paste local-instance walkthrough instead; or leave out and say so on the site.

Acceptance criteria

Decision recorded (threat-model if a token is published)
Demo shows or documents the MCP path, read-only
Tests and docs (docs/administration/demo-data.md) in the same MR