Add recovery-only drain for gateway demo cutover

[randomblocker]

Summary

• adds an exact build-time recovery-only mode for the retiring Community-hosted buyer demo
• blocks every fresh run at both the UI and dispatch boundary
• preserves origin-scoped Check & resume recovery for an existing job/idempotency record
• adds a dedicated browser test proving recovery performs no new POST

Why

The gateway-owned demo must deploy before Community removes its old pages. Browser recovery state cannot move between origins, so the old Community page needs a bounded drain phase that stops new work without stranding an existing run.

Rollout

Keep this PR draft until the gateway-owned UI is deployed and smoke-tested. Then deploy Community with NEXT_PUBLIC_GATEWAY_DEMO_RECOVERY_ONLY=1, wait at least 12 minutes, reconcile outstanding jobs, and only then merge/deploy Community PR #84.

Validation

• unit/integration tests: 202 passed
• typecheck: passed
• production build with recovery flag: passed
• recovery-only Chromium test: passed
• three unrelated baseline timeout failures passed on immediate serial rerun
• git diff --check