Demo reset + dev banner suppression for DEMO company

- DemoController: company-code-gated reset action (DEMO only, CSRF protected)
- SeedDataService.Remove: FK-safe topological pre-sweep, all deletes scoped to companyId
- SeedDataService: clock entries, extra seed data, updated customer/worker/job-status seeders
- CompanySettingsController + Index.cshtml: Reset Demo Data button for DEMO company users
- ReportsController + FinancialReportService: supporting report fixes
- _Layout.cshtml: suppress env banner when current company is DEMO (all auth paths)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Infrastructure/Services/SeedDataService.Remove.cs

@@ -136,6 +136,12 @@ public partial class SeedDataService
 
                 // Tier 1 — pure leaf records (block nothing of their own)
                 await Sweep<JobTimeEntry>();            // FK → Jobs (Cascade by convention — sweep before jobs)
+                await Sweep<EmployeeClockEntry>();      // RESTRICT → ApplicationUser — must go before workers
+                await Sweep<JobNote>();                 // NO_ACTION → Jobs
+                await Sweep<CustomerNote>();            // NO_ACTION → Customers
+                await Sweep<ReworkRecord>();            // NO_ACTION → Jobs
+                await Sweep<Deposit>();                 // NO_ACTION → Customers, Jobs, Invoices, Quotes
+                await Sweep<BankReconciliation>();      // FK → Accounts (accounts stay, but sweep for clean reset)
                 await Sweep<OvenBatchItem>();           // NO_ACTION → Jobs, JobItems, JobItemCoats
                 await Sweep<PowderUsageLog>();          // NO_ACTION → Jobs, JobItems, JobItemCoats
                 await Sweep<InAppNotification>();       // NO_ACTION → Customers, Invoices, Quotes
@@ -653,6 +659,18 @@ public partial class SeedDataService
 
                 if (workerUsers.Any())
                 {
+                    // EmployeeClockEntry has DeleteBehavior.Restrict on UserId — delete
+                    // clock entries first so the user delete succeeds without a FK violation.
+                    var workerUserIds = workerUsers.Select(u => u.Id).ToList();
+                    var clockEntries  = await _context.Set<EmployeeClockEntry>().IgnoreQueryFilters()
+                        .Where(e => workerUserIds.Contains(e.UserId)).ToListAsync();
+                    if (clockEntries.Any())
+                    {
+                        _context.Set<EmployeeClockEntry>().RemoveRange(clockEntries);
+                        await _context.SaveChangesAsync();
+                        details.Add($"✓ Removed {clockEntries.Count} clock entry/entries");
+                    }
+
                     foreach (var wu in workerUsers)
                         await _userManager.DeleteAsync(wu);
                     totalRemoved += workerUsers.Count;