[stormer78]

Two documentation fixes to packages/demo-rp/README.md.

Restored paths. The scope move in #45 replaced every / in this README with @openvtc/pnm-, so it read http:@openvtc/pnm-@openvtc/pnm-127.0.0.1:4040@openvtc/pnm-api@openvtc/pnm-login instead of http://127.0.0.1:4040/api/login, and the same for every route, task URI and path. This puts them back. Compared against the README as first written (#15): the only remaining differences are the later CORS changes and the note below. The title is the package name, @openvtc/pnm-demo-rp.

VTA opt-in for the loopback login URL. VTI's vault proxy-login now admits a loopback or private loginUrl only when the VTA runs with VTA_ALLOW_PRIVATE_ENDPOINTS=1 (OpenVTC/verifiable-trust-infrastructure#2680); without it, vault/upsert refuses this demo's entry and vault/proxy-login refuses to post to it. The README now says so in the wallet-setup section and beside HOST. Until #2680 is released, the variable is harmless.

No code changes.

Pre-merge checklist

• No new reqwest::Client::new() / bare fetch(); all clients have finite timeouts (R1.2) — n/a, docs only
• No lock held across a network await (R1.3) — n/a
• No local state committed before its remote effect (R2.1) — n/a
• Every retry is bounded + backed off (R1.4) — n/a
• Accept/poll/listen loops survive transient errors (R1.5) — n/a
• Acks/deletes happen only after durable handoff (R1.6) — n/a
• New/changed wire types (R3.*) — n/a
• Config absence = most restrictive (R5.*) — documents the VTA's restrictive default
• Logs/status claim only what was verified (R6.*) — n/a
• "Process dies on the next line" (R2.1) — n/a
• Deviations flagged — none