Add a test server so e2e can check real playground requests

[arpit-bruno]

Every e2e request today is faked inside the browser with page.route, so nothing checks what the playground actually sends or how it handles a request the browser blocks.

This adds a small Node server (no dependencies) that Playwright starts next to the app on its own port, so real CORS rules apply.

• /echo returns what it received (method, path, query, headers, body)
• /cors/deny sends no CORS headers, so the browser blocks it
• /health is for Playwright's readiness check

Two tests use it: collection and request headers reach the server, and a CORS-blocked request shows "Request blocked". Existing stubbed tests are unchanged. No ci.yml change, npm run test:e2e starts it.

/cors/allow from the ticket is dropped: CORS is on by default, so /echo is already the allowed case.

Ref: BRU-4702

[changeset-bot]

🦋 Changeset detected

Latest commit: 93ecfa4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR