feat(docker): add batteries-included demo image (CPU)

[streamer45]

Summary

• Adds Dockerfile.demo and docker-skit-demo.toml to ship a CPU-only demo/preview image that works out of the box with core native plugins + required models (Helsinki OPUS-MT, Whisper, SenseVoice, Kokoro/Piper/Matcha, VAD), excluding NLLB.
• Removes sample pipelines that won't work in the demo image (NLLB- and WASM-dependent) and avoids copying the full samples/ tree; only samples/pipelines + small .ogg/.opus samples are bundled.
• Adds CI publishing job for demo tags in .github/workflows/docker.yml (:${VERSION}-demo and :latest-demo).
• Updates README.md, DOCKER.md, and docs/src/content/docs/deployment/docker.md with demo-image quickstart and safer OPENAI_API_KEY passing patterns (--env OPENAI_API_KEY, --env-file, and Compose env_file).