Preview a firm-scoped demo reset

Creates a ten-minute, single-use confirmation token bound to the current workspace generation, template version, and baseline checksum. The response names all three companies and distinguishes preserved identity/access from discarded demo bookkeeping changes.