feat(demo): add deep HTTP and browser validation layers

The existing smoke test only checked TCP port connectivity, which cannot
detect a service that accepts connections but returns errors or serves
the wrong content (exactly how the broken Kiwix slipped through).

Add two new validation layers:

1. validate-http.sh — curls every service's health/UI endpoint and
   asserts both the HTTP status code AND meaningful body content (JSON
   health fields like "database":"ok", XML markers, page strings). Also
   verifies Kiwix has a ZIM actually loaded via its OPDS catalog feed.

2. run-browser-tests.sh — drives a real headless Chromium via the
   official Playwright Docker image (no host Node install needed) to
   confirm pages render correctly after JavaScript execution and SPA
   hydration. Updated playwright-services.spec.ts with correct content
   tokens and a waitForFunction step that reliably handles SPA timing.

Both are wired into demo-test.sh (new `http` and `browser` subcommands)
and the full test suite. AGENTS.md and demo/AGENTS.md updated with the
new commands and protocols.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

demo/scripts/demo-test.sh

@@ -200,6 +200,7 @@ run_full_tests() {
     test_network_isolation || true
     test_volume_permissions || true
     test_security_compliance || true
+    bash "$SCRIPT_DIR/validate-http.sh" || true
     display_test_results
 }
 
@@ -227,6 +228,18 @@ run_network_tests() {
     display_test_results
 }
 
+run_http_tests() {
+    log_info "Running HTTP response validation..."
+    bash "$SCRIPT_DIR/validate-http.sh" || log_warning "Some HTTP checks failed"
+    display_test_results
+}
+
+run_browser_tests() {
+    log_info "Running browser (Playwright) validation..."
+    bash "$PROJECT_ROOT/tests/e2e/run-browser-tests.sh" || log_warning "Some browser checks failed"
+    display_test_results
+}
+
 display_test_results() {
     echo ""
     echo "===================================="
@@ -250,8 +263,10 @@ main() {
         security)    run_security_tests ;;
         permissions) run_permission_tests ;;
         network)     run_network_tests ;;
+        http)        run_http_tests ;;
+        browser)     run_browser_tests ;;
         help|--help|-h)
-            echo "Usage: $0 {full|security|permissions|network|help}"
+            echo "Usage: $0 {full|security|permissions|network|http|browser|help}"
             ;;
         *) log_error "Unknown: $1"; exit 1 ;;
     esac