Disable alert create/save in demo mode and catch submit errors #SUPERLOG

[superlog-app]

Summary

Demo-exploring users navigating to /alerts/new (or /alerts/:id to edit) could click Create / Save and receive a silent 403: demo_read_only error. Because submit() is an async function passed directly as onClick, the rejected promise from create.mutateAsync() was never caught, causing a window.unhandledrejection event — recorded as a browser.exception span and surfaced as a monitoring incident.

Root cause

The demo overlay middleware blocks POST /api/projects/:projectId/alerts (and PATCH .../alerts/:id) for projects that are being served sample data, returning 403 demo_read_only. mutateAsync re-throws on non-2xx responses. The submit() async function had no try/catch, so clicking Create produced an unhandled rejection with no UI feedback.

Remediation

1. Detect demo mode via useDemoExploration().exploring (the same context already used by Settings.tsx and SetupTodos.tsx for demo-aware UI).
2. Disable the Create/Save button when demoExploring is true, and show an explanatory message in the footer: "You're exploring demo data — connect your app to create alerts."
3. Wrap mutateAsync in try/catch so that any unexpected server error (including 403 if the guard is bypassed) is surfaced via create.error/update.error in the UI rather than as an unhandled rejection.
4. Surface create/update errors in the footer so non-demo mutation failures are also visible to the user.

The alert preview endpoints (alerts/preview and alerts/preview-series) are correctly listed in POST_READ_SUBPATHS and are not affected — previews continue to work in demo mode.

---

Fixes incident luminous-hedgehog — Error: 403: demo_read_only on /alerts/new.

---

Was this PR helpful? Leave feedback — goes straight to the Superlog team.

---

Summary by cubic

Disable alert create/save in demo mode and surface submit errors to avoid unhandled promise rejections. Previously, clicking Create/Save in demo sent blocked requests (403 demo_read_only) and threw an unhandled rejection with no UI feedback; now the button is disabled in demo and errors are caught and shown.

• Detect demo mode via useDemoExploration().exploring, disable Create/Save, and show: "You're exploring demo data — connect your app to create alerts."
• Wrap create.mutateAsync/update.mutateAsync in try/catch and render create.error/update.error in the footer; no more window.unhandledrejection.
• Navigation behavior is unchanged: after create, go to the created alert; after save, go to the alerts list.
• Alert previews are unaffected (alerts/preview* remain allowed).

^{Written for commit dbc5b61. Summary will update on new commits.}