Seed demo sandboxes in setup_demo

[elias-ba]

Description

Lightning.SetupUtils.setup_demo/1 now provisions three sandboxes after seeding the two demo projects: openhie-dev under OpenHIE, dhis2-dev under DHIS2, and dhis2-feature-x nested under dhis2-dev. This makes the sandbox UX (list, picker, breadcrumb truncation, nested provisioning) demonstrable on a fresh demo instance without any extra setup.

Closes #4774.

Validation steps

1. Lightning.SetupUtils.setup_demo(create_super: true) from IEx, or IS_RESETTABLE_DEMO=yes mix run priv/repo/demo.exs.
2. Sign in as Amy (demo@openfn.org / welcome12345). Visit DHIS2 → Sandboxes and OpenHIE → Sandboxes. Each shows its dev sandbox; DHIS2's also shows dhis2-feature-x nested under dhis2-dev.
3. Sign in as Sizwe (super@openfn.org). DHIS2 is not in the picker; OpenHIE → Sandboxes shows openhie-dev.

AI Usage

• I have used Claude Code
• I have used another model
• I have not used AI

Pre-submission checklist

• I have performed an AI review of my code
• I have implemented and tested all related authorization policies
• I have updated the changelog
• I have ticked a box in "AI usage" in this PR

[github-actions]

Security Review ✅

• S0 (project scoping): N/A — the diff only adds setup_demo/1 seed calls in lib/lightning/setup_utils.ex:78-108; no new queries or web-layer entrypoints are introduced.
• S1 (authorization): N/A — sandbox creation is delegated to Sandboxes.provision/3, which already gates on Permissions.can?(:sandboxes, :provision_sandbox, actor, parent) at lib/lightning/projects/sandboxes.ex:141.
• S2 (audit trail): N/A — no new config-resource write paths are added; seeding reuses the existing provision/3 flow, so any audit behaviour is unchanged.