fix(cli): default demo-mode file picker to cwd, not ~/Downloads

`micasa demo` wires the document file picker to the system Downloads
folder by default. In tape recordings, tutorials, and manual demos,
that surfaces whatever happens to live in the recorder's real
Downloads — producing non-reproducible captures and risking leaked
PII in committed demo videos.

In demo mode, prefer the current working directory when no explicit
`documents.file_picker_dir` / `MICASA_DOCUMENTS_FILE_PICKER_DIR` is
set. Explicit config still wins, and production behavior is unchanged.

Author: cpcloud

cmd/micasa/main.go

@@ -207,10 +207,16 @@ func launchTUI(dbPath string, seed *seedOpts) error {
 		return fmt.Errorf("resolve currency: %w", err)
 	}
 
+	pickerDir := cfg.Documents.ResolvedFilePickerDir()
+	if seed != nil {
+		// Demo mode: prefer cwd so tapes and tutorials aren't at the
+		// mercy of whatever's in the recorder's ~/Downloads.
+		pickerDir = cfg.Documents.ResolvedFilePickerDirForDemo()
+	}
 	appOpts := app.Options{
 		DBPath:          dbPath,
 		ConfigPath:      config.Path(),
-		FilePickerDir:   cfg.Documents.ResolvedFilePickerDir(),
+		FilePickerDir:   pickerDir,
 		AddressAutofill: cfg.Address.IsAutofillEnabled(),
 		AddressCountry:  config.DetectCountry(),
 	}

internal/config/config.go

@@ -280,6 +280,30 @@ func (d Documents) ResolvedFilePickerDir() string {
 	return "."
 }
 
+// ResolvedFilePickerDirForDemo is like ResolvedFilePickerDir but prefers
+// the current working directory over the system Downloads folder when no
+// value is configured. Demo recordings and tutorials stage their fixtures
+// in cwd; falling back to ~/Downloads there would surface whatever files
+// happen to live in the recorder's real Downloads, making captures
+// non-reproducible and risking leaked PII in committed demo videos.
+// Explicit config still wins.
+func (d Documents) ResolvedFilePickerDirForDemo() string {
+	if d.FilePickerDir != "" {
+		if info, err := os.Stat(d.FilePickerDir); err == nil && info.IsDir() {
+			return d.FilePickerDir
+		}
+	}
+	if dir, err := os.Getwd(); err == nil {
+		return dir
+	}
+	if dir := xdg.UserDirs.Download; dir != "" {
+		if info, err := os.Stat(dir); err == nil && info.IsDir() {
+			return dir
+		}
+	}
+	return "."
+}
+
 // CacheTTLDuration returns the resolved cache TTL as a time.Duration.
 // Returns 0 to disable eviction.
 func (d Documents) CacheTTLDuration() time.Duration {

internal/config/config_test.go

@@ -1071,6 +1071,48 @@ func TestResolvedFilePickerDir_EmptyFallsBackToDownloadsOrCwd(t *testing.T) {
 	assert.NotEmpty(t, result)
 }
 
+func TestResolvedFilePickerDirForDemo_ConfiguredDirWins(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	d := Documents{FilePickerDir: dir}
+	assert.Equal(t, dir, d.ResolvedFilePickerDirForDemo(),
+		"explicit config should win in demo mode just like normal mode")
+}
+
+func TestResolvedFilePickerDirForDemo_EmptyPrefersCwdOverDownloads(t *testing.T) {
+	// Not parallel: we mutate cwd.
+	cwd := t.TempDir()
+	t.Chdir(cwd)
+
+	d := Documents{}
+	result := d.ResolvedFilePickerDirForDemo()
+
+	// Resolve symlinks on both sides: macOS returns /private/var/... for
+	// temp dirs via Getwd while t.TempDir reports /var/...
+	wantResolved, err := filepath.EvalSymlinks(cwd)
+	require.NoError(t, err)
+	gotResolved, err := filepath.EvalSymlinks(result)
+	require.NoError(t, err)
+	assert.Equal(t, wantResolved, gotResolved,
+		"demo mode with no config should resolve to cwd, "+
+			"not the user's Downloads folder")
+}
+
+func TestResolvedFilePickerDirForDemo_ConfiguredMissingFallsBackToCwd(t *testing.T) {
+	cwd := t.TempDir()
+	t.Chdir(cwd)
+
+	d := Documents{FilePickerDir: "/nonexistent/path/that/does/not/exist"}
+	result := d.ResolvedFilePickerDirForDemo()
+
+	wantResolved, err := filepath.EvalSymlinks(cwd)
+	require.NoError(t, err)
+	gotResolved, err := filepath.EvalSymlinks(result)
+	require.NoError(t, err)
+	assert.Equal(t, wantResolved, gotResolved,
+		"when configured dir is invalid, demo mode should fall back to cwd")
+}
+
 func TestFilePickerDir_FromTOML(t *testing.T) {
 	t.Parallel()
 	dir := t.TempDir()