Reset all three companies to the published demo baseline

Owner/admin route. Requires the single-use token from reset-preview and confirmed=true. The reset serializes per workspace, prepares statement objects before changing rows, rebuilds all three companies transactionally with stable ids, validates balances/counts, preserves login/access/sponsorship/audit evidence, and never scopes outside the caller's demo firm.