feat(demo): add deep HTTP and browser validation layers

The existing smoke test only checked TCP port connectivity, which cannot
detect a service that accepts connections but returns errors or serves
the wrong content (exactly how the broken Kiwix slipped through).

Add two new validation layers:

1. validate-http.sh — curls every service's health/UI endpoint and
   asserts both the HTTP status code AND meaningful body content (JSON
   health fields like "database":"ok", XML markers, page strings). Also
   verifies Kiwix has a ZIM actually loaded via its OPDS catalog feed.

2. run-browser-tests.sh — drives a real headless Chromium via the
   official Playwright Docker image (no host Node install needed) to
   confirm pages render correctly after JavaScript execution and SPA
   hydration. Updated playwright-services.spec.ts with correct content
   tokens and a waitForFunction step that reliably handles SPA timing.

Both are wired into demo-test.sh (new `http` and `browser` subcommands)
and the full test suite. AGENTS.md and demo/AGENTS.md updated with the
new commands and protocols.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

demo/AGENTS.md

@@ -254,6 +254,10 @@ screen -S demo-deploy-$(date +%Y%m%d-%H%M%S) -dm -L -Logfile deploy-$(date +%Y%m
 ./scripts/demo-test.sh security    # Security compliance validation
 ./scripts/demo-test.sh permissions # File ownership validation
 ./scripts/demo-test.sh network     # Network isolation validation
+./scripts/demo-test.sh http        # HTTP response validation (status + content)
+./scripts/demo-test.sh browser     # Browser validation via Playwright Docker image
+./scripts/validate-http.sh         # Standalone HTTP validation
+./tests/e2e/run-browser-tests.sh   # Standalone browser validation
 ```
 
 ### Automated Validation Suite
@@ -262,6 +266,8 @@ screen -S demo-deploy-$(date +%Y%m%d-%H%M%S) -dm -L -Logfile deploy-$(date +%Y%m
 - **Docker Group**: Confirm docker group access for socket proxy
 - **Service Health**: All services passing health checks
 - **Port Accessibility**: Verify all ports accessible from host
+- **HTTP Response Validation**: `validate-http.sh` confirms every service returns correct HTTP status code AND expected body content (JSON health fields, XML markers, page strings)
+- **Browser Validation**: `run-browser-tests.sh` drives a real headless Chromium via the Playwright Docker image to confirm pages render with expected content (executes JavaScript, waits for SPA hydration)
 - **Network Isolation**: Confirm services isolated in demo network
 - **Volume Permissions**: Validate Docker volume permissions
 - **Security Compliance**: Docker socket proxy restrictions enforced