Pin the demo to terdut-server v0.48.0

v0.43.0 predates v0.47.2, which lets the instance service account list a
team's dead man's switches. Without it GET /api/teams/{id}/deadman/switches
404s for the operator's key, so a TerdutTeam never becomes ready against the
demo's server. The demo is meant to track the current release.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

examples/demo/01-server.yaml

@@ -15,7 +15,7 @@ spec:
   image:
     repository: git.ryuvia.com/niklas/terdut-server
     # v0.36.0 is the floor now that replicas below is 2 (this demo pins
-    # the current release, v0.43.0, so it shows the current web UI too): that
+    # the current release, v0.48.0, so it shows the current web UI too): that
     # release put the sweeper, the notifier and the migration runner each
     # behind a Postgres advisory lock, and gave incident creation its own
     # conflict resolution, which is what makes a second replica safe
@@ -24,7 +24,7 @@ spec:
     # can adopt/rotate a key on a team-scoped account it didn't just create
     # in the same call -- without which terdutteam-* can wedge permanently
     # on the crash-window race this demo hit live, niklas/terdut-operator#3.)
-    tag: v0.43.0
+    tag: v0.48.0
   # Matches this CRD's own spec.replicas default (v0.4.0) -- stated
   # explicitly, like every other field in this file, rather than left to
   # the default. RollingUpdate follows automatically; this operator does