fix(banlist): surface demo download in the player drawer

[Rushaway]

Problem

Upstream issue sbpp#1554: the button to download a banned
player's demo is missing. In SourceBans 1.x the sliding ban panel showed
a "Review Demo" link; the 2.0 player drawer never rendered one.

Root cause

api_bans_detail returns demo_count, but renderOverviewPane() in
web/themes/default/js/theme.js never used it — the drawer Overview pane
had no demo affordance at all. getdemo.php?type=B&id=<bid> already
serves ban demos; nothing linked to it from the review surface.

Fix

Add a "Download demo" button to the drawer Overview pane (ban-focal only,
comm-blocks have no demo column) when demo_count > 0, linking to
getdemo.php?type=B&id=<bid>. New data-testid="drawer-demo-download".

Adds BanDrawerDemoDownloadTest pinning the wiring.

🤖 Generated with Claude Code

[Rushaway]

Review (Sonnet — Opus quota exhausted, resets 19:00 Europe/Paris)

Verdict: LGTM, no code changes needed. CI green (PHPUnit / Playwright+axe / static / tsc all pass).

Verified:

• bans.detail genuinely carries demo_count (web/api/handlers/bans.php:862 subquery → :1013 (int) cast) and top-level bid (web/scripts/api-contract.js typedef + __snapshots__/bans/detail_*.json). The > 0 guard coerces string/undefined safely.
• Ban-focal only is correct — comms.detail has no demo column, and isComm is in scope in renderOverviewPane.
• Markup escaping fine (escapeHtml(demoUrl), bid through encodeURIComponent); Lucide re-init runs via showDrawer() → lucide.createIcons().
• Button visibility matches existing fork behaviour: web/pages/page.banlist.php:1050-1052 already builds demo_link/demo_quick for any banlist viewer when demo_count > 0.

Note (pre-existing, not introduced here): web/getdemo.php performs no auth/authorization check — any caller who knows a bid can fetch the ban demo. This PR only makes the existing link more discoverable in the drawer. If ban demos should be admin-only, that's a separate hardening ticket on getdemo.php itself.

[maxijabase]

LGTM!