fix: enable header-based tenant routing for demo and register CurrentAccountService (#1248)

Cloudflare does not proxy *.demo.meridianhub.cloud subdomains, so the
production subdomain-based transport fails with 503 in the demo env.
Switch to header-based routing (X-Tenant-Slug) when VITE_DEMO_MODE is
set, matching dev mode behaviour. Requires LOCAL_DEV_MODE=true on the
demo server (already applied).

Separately, CurrentAccountService was excluded from the Vanguard
transcoder due to REST route conflicts with InternalAccountService.
The comment claimed it was "still reachable via Connect protocol" but
this was incorrect — unregistered services are 404 for all HTTP
protocols. Adding it to serviceNames allows Connect-protocol requests
to route correctly; REST lien routes continue to resolve to
InternalAccountService (registered first).

Co-authored-by: Ben Coombs <bjcoombs@users.noreply.github.com>

Author: bjcoombs

cmd/meridian/main.go

@@ -745,9 +745,11 @@ var serviceNames = []string{
 	"meridian.financial_accounting.v1.FinancialAccountingService",
 	"meridian.position_keeping.v1.PositionKeepingService",
 	"meridian.forecasting.v1.ForecastingService",
-	// CurrentAccountService excluded from Vanguard: its REST routes (/v1/liens/*)
-	// conflict with InternalAccountService. Still reachable via Connect protocol
-	// (/{package}.{Service}/{Method} paths don't conflict).
+	// CurrentAccountService shares REST routes (/v1/liens/*) with InternalAccountService.
+	// Vanguard resolves the conflict by routing REST lien requests to whichever service
+	// was registered first (InternalAccountService above). Connect protocol paths
+	// (/{package}.{Service}/{Method}) are unique per service and never conflict.
+	"meridian.current_account.v1.CurrentAccountService",
 	"meridian.payment_order.v1.PaymentOrderService",
 	"meridian.reconciliation.v1.AccountReconciliationService",
 	"meridian.saga.v1.SagaRegistryService",

frontend/src/api/transport.ts

@@ -12,11 +12,13 @@ export function createTenantTransport(
   getToken: TokenGetter,
   getTenantSlug: TenantSlugGetter,
 ): Transport {
-  // In development, keep the base URL and route via X-Tenant-Slug header
+  // In development or demo mode, keep the base URL and route via X-Tenant-Slug header
   // (the gateway's LOCAL_DEV_MODE resolves tenants from the header).
   // In production, use subdomain-based URL for tenant routing.
+  const useHeaderRouting =
+    import.meta.env.DEV || import.meta.env.VITE_DEMO_MODE === 'true'
   const baseUrl =
-    tenantSlug && !import.meta.env.DEV ? buildTenantBaseUrl(tenantSlug) : apiConfig.baseUrl
+    tenantSlug && !useHeaderRouting ? buildTenantBaseUrl(tenantSlug) : apiConfig.baseUrl
 
   return createConnectTransport({
     baseUrl,