Turn demo_api into a full showcase of the HTTP engine, fix bugs found…

[hilarex]

demo_api now demonstrates every HTTP engine capability (http_version, custom reason phrases, etags/conditional GET, deploy-time vars, form parsing, per-request templating, static files, error/unknown-method handling) so it can serve as the reference config for writing new skins.

Building it surfaced three real bugs in trapster/modules/http.py:

• .j2 was missing from the Jinja-renderable suffix list, so every .j2 template (including the pre-existing settings.j2/user.j2) was served as raw, unrendered source instead of being executed.
• per-request templates' etag()/deploy_seed globals silently used an empty seed instead of the real deploy-time one.
• the custom reason-phrase mechanism only worked for non-standard HTTP methods; standard methods run through FastAPI's @app.middleware("http"), which executes the endpoint in a separate task via Starlette's BaseHTTPMiddleware, breaking the contextvar it relied on. Replaced with the ASGI scope "state" extension, which survives that task split.

Also updated the README to document demo_api's purpose, and added a disclaimer (collapsed by default) that AI-generated responses are fingerprintable and meant for CTI research, not intrusion detection.