[DEMO] Run vulnerable demo target locally

[hasan-malik]

The agent needs something to scan during the live demo.

Steps

1. Install Docker Desktop if you don't have it.
2. `cd demo-target && docker compose up -d`
3. Replace the placeholder jQuery file so nuclei's tech-detect template fires reliably:
   ```
   curl -L https://code.jquery.com/jquery-1.6.4.min.js \
   -o demo-target/planted/assets/jquery-1.6.4.min.js
   ```
4. Verify the planted vulns are reachable:
   ```
   curl http://localhost:8081/.env
   curl http://localhost:8081/
   curl http://localhost:3000/ # Juice Shop
   ```
5. Sign a scope grant for the demo target:
   ```
   DEMO_TARGET_URL=http://localhost:8081 npm run sign-scope
   ```
6. Boot the worker in a second terminal: `npm run agent`
7. Verify findings start arriving in the dashboard at http://localhost:3000.

Done when

• 3+ planted vulns appear as real findings on the dashboard (not mock)
• Findings include the exposed `.env`, leaked Stripe key in HTML comment, and outdated jQuery