chore: merge main into feat/M13-claude-job-queue

Resolves conflict in docs/scrum4me-architecture.md — main brought in
ST-1110 demo-user policy section, branch added ST-1111 Claude job queue
section. Both are independent topics; kept both in chronological order
(ST-1110 first, then ST-1111).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/api/auth/pair/claim/route.ts

@@ -80,6 +80,11 @@ export async function POST(request: Request) {
     return Response.json({ error: 'Pairing zonder user' }, { status: 500 })
   }
 
+  if (pairing.user?.is_demo) {
+    await clearPairCookie()
+    return Response.json({ error: 'Niet beschikbaar in demo-modus' }, { status: 403 })
+  }
+
   const session = await getIronSession<SessionData>(await cookies(), sessionOptions)
   session.userId = pairing.user_id
   session.isDemo = pairing.user?.is_demo ?? false

app/api/auth/pair/start/route.ts

@@ -9,6 +9,8 @@
 //
 // Rate-limit: 10 pogingen per IP per minuut (lib/rate-limit.ts → 'pair-start').
 
+import { getIronSession } from 'iron-session'
+import { cookies } from 'next/headers'
 import { prisma } from '@/lib/prisma'
 import {
   generateMobileSecret,
@@ -17,6 +19,7 @@ import {
 } from '@/lib/auth/pairing'
 import { setPairCookie } from '@/lib/auth/pair-cookie'
 import { checkRateLimit } from '@/lib/rate-limit'
+import { SessionData, sessionOptions } from '@/lib/session'
 
 export const runtime = 'nodejs'
 
@@ -34,6 +37,11 @@ function getClientIp(request: Request): string {
 }
 
 export async function POST(request: Request) {
+  const session = await getIronSession<SessionData>(await cookies(), sessionOptions)
+  if (session.isDemo) {
+    return Response.json({ error: 'Niet beschikbaar in demo-modus' }, { status: 403 })
+  }
+
   const ip = getClientIp(request)
   if (!checkRateLimit(`pair-start:${ip}`)) {
     return Response.json(