lighting: dynamic-only lights so no lighting build is required

The editor warned 'LIGHTING NEEDS TO BE REBUILT' (Build Lighting Only /
BuildLighting) because the sun and sky were Stationary with no baked lightmap.
The demo is a fixed daytime scene lit entirely dynamically, so:

- Config/DefaultEngine.ini: r.AllowStaticLighting=False - nothing to build.
- DemoMap + ReviewMap builders: sun, sky light, height fog and the staged
  mesh components are set to ComponentMobility.MOVABLE.

Also clears the Android File Server SecurityToken in DefaultEngine.ini: the
plugin is disabled and excluded from shipping, and the value is a credential
that must not be committed.

All 14 screenshots re-rendered; no lighting warnings in the build or run logs.

MEMORY.md

@@ -183,3 +183,5 @@ Scope: facts and traps that cost time to establish. Planned work lives in [TODO.
 - **One band per object loses geometry downstream.** `crossing_band()` created `Crossing_Markings` each call, so Blender renamed the second and third to `.001`/`.002`; `site_assembly.py` appends by exact name, so only one crossing ever reached the game. Build all bands into a single mesh instead of one object per band.
 - **Street arc length -> UE X:** s=0 is the west end of the block (UE X −27966 cm) and s increases eastward, so the designated mid-block crossing at s=130.1 m is UE X ≈ −14956, not the −24291 used by an earlier camera (that is the s=36.6 crossing).
 - **Camera placement in the demo map needs the mesh bounds, not intuition.** The hero façade body spans UE Y −1457..−200, so a "street level" camera at Y −400 is *inside* the building and renders its unlit back face. Read `get_bounding_box()` on the staged meshes before choosing a camera.
+- **"LIGHTING NEEDS TO BE REBUILT" (Build Lighting Only / `BuildLighting`) appears whenever a map has Stationary/Static lights and no baked lightmap.** For a fully dynamic scene the clean fix is `r.AllowStaticLighting=False` in `Config/DefaultEngine.ini` plus `set_mobility(ComponentMobility.MOVABLE)` on the directional light, sky light and height fog (and MOVABLE on the staged mesh components). Nothing to build, warning gone. Note the cvar is read at startup, so each new commandlet/game run picks it up.
+- The Android File Server `SecurityToken` kept reappearing in `Config/DefaultEngine.ini`; the plugin is disabled and excluded from shipping, so the value is cleared and must stay empty — it is a credential and must not be committed.