fix(home): address the demo's play/pause messages to our own origin

[cevheri]

Follow-up to #44.

Both walkthrough clips are served from public/demo/, so the play and pause messages have no reason to go out to '*'. Addressing them to window.location.origin means nothing is delivered to a frame that some other document has managed to navigate elsewhere.

-      win.postMessage(`libredb-demo:${verb}`, '*');
-      win.postMessage({ type: `om-demo-${verb}` }, '*');
+      win.postMessage(`libredb-demo:${verb}`, window.location.origin);
+      win.postMessage({ type: `om-demo-${verb}` }, window.location.origin);

Verified

Both clips, on Astro 7.2.4: plays on enter, parks off screen, resumes on re-entry (the desktop clip reloads, as #44 explains). The explicit origin changes nothing about delivery.

	desktop @1440px	phone @390px
distinct frames while in view	3	3
distinct frames while off screen	1 (parked)	1 (parked)
distinct frames after re-entry	2	3

Gate clean: 0 errors, prettier clean, oxlint clean, knip clean, 75 tests pass.

Note: the CodeQL alerts on public/demo/** are inside the vendored bundles, not this code, and are unaffected either way.