Acceptance key handling after #44: reject whitespace keys, demo key off by default, fail on invalid env key #53

REA's after-the-fact check of main 9809cc7 (#44) FAILED (seq 683, REA-CHECK-PR44-9809cc7.md). The fallback key itself is gone, and old demo-key signatures are rejected. Two bars fail.

Keys item. Merging needs Marcus Richards' own yes plus an independent REA check.

Owner: Launch. Due: Oct 22.

Pass bar (written before the work)

1. The verifier and ledger constructors reject a whitespace-only key, including one of 32 bytes or more, with a test.
2. The demo key is an explicit opt-in flag, off by default. server.py in mock mode (including --db), demo.py, demos/*, python -m permit and trace.py exit with a non-zero code when no valid key is set and the flag is absent, with a test for each entry point.
3. A key set through env but invalid (missing, 31 bytes, or whitespace) raises an error even when the demo flag is on.
4. In --db mode with the demo flag, the key does not change silently across a restart. It either persists in a 0600 file or refuses to start, and the docs say which.
5. The stale docstring at ledger.py:13 is fixed, and the sign_acceptance API change is noted in the CHANGELOG or README.
6. The full suite passes plain and under -O. Every new test fails on 9809cc7 and passes on the fix.

Also: the README license badge says MIT, but LICENSE is Apache-2.0 (#51). Fix the badge in the same PR or a separate docs PR.