proxy: add /ideas to protectedRoutes; verify demo-guard for /api/ideas (M12 T-501)

- proxy.ts: /ideas added to protectedRoutes — unauthenticated users get
  redirected to /login when navigating to /ideas or /ideas/[id]
- existing demo-guard catch-all (\`/api/* + non-GET\`) already blocks
  POST/PATCH/DELETE /api/ideas* with 403 — confirmed via 3 new tests
- server-action endpoints (start-grill / start-make-plan / materialize /
  promote-to-idea) carry their own \`session.isDemo\` checks inside
  actions/ideas.ts and actions/todos.ts (defense in depth)

Tests: 9/9 in proxy demo-guard suite (added 3 idea cases).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

proxy.ts

@@ -3,7 +3,7 @@ import type { NextRequest } from 'next/server'
 import { unsealData } from 'iron-session'
 import { sessionOptions, type SessionData } from '@/lib/session'
 
-const protectedRoutes = ['/dashboard', '/products', '/todos', '/settings', '/solo']
+const protectedRoutes = ['/dashboard', '/products', '/todos', '/ideas', '/settings', '/solo']
 const authRoutes = ['/login', '/register']
 
 const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])