feat(demo): add deep HTTP and browser validation layers

The existing smoke test only checked TCP port connectivity, which cannot
detect a service that accepts connections but returns errors or serves
the wrong content (exactly how the broken Kiwix slipped through).

Add two new validation layers:

1. validate-http.sh — curls every service's health/UI endpoint and
   asserts both the HTTP status code AND meaningful body content (JSON
   health fields like "database":"ok", XML markers, page strings). Also
   verifies Kiwix has a ZIM actually loaded via its OPDS catalog feed.

2. run-browser-tests.sh — drives a real headless Chromium via the
   official Playwright Docker image (no host Node install needed) to
   confirm pages render correctly after JavaScript execution and SPA
   hydration. Updated playwright-services.spec.ts with correct content
   tokens and a waitForFunction step that reliably handles SPA timing.

Both are wired into demo-test.sh (new `http` and `browser` subcommands)
and the full test suite. AGENTS.md and demo/AGENTS.md updated with the
new commands and protocols.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

demo/scripts/validate-all.sh

@@ -47,9 +47,11 @@ validate_shell_scripts() {
         "scripts/demo-stack.sh"
         "scripts/demo-test.sh"
         "scripts/validate-all.sh"
+        "scripts/validate-http.sh"
         "tests/unit/test_env_validation.sh"
         "tests/integration/test_service_communication.sh"
         "tests/e2e/test_deployment_workflow.sh"
+        "tests/e2e/run-browser-tests.sh"
     )
     for shell_file in "${shell_files[@]}"; do
         if [[ -f "$DEMO_DIR/$shell_file" ]]; then