Add automated accessibility checks (axe-core + keyboard) for the demo pages - #773

The repository ships Jest and ESLint configs but has no CI, so
regressions surface only when someone runs the tools locally. This
workflow runs three jobs on every push and pull request:

- ESLint over scripts/ (npm run lint)
- the jsdom Jest project (55 tests; the puppeteer project needs a
  localhost:8000 demo server and a headed browser, so it is excluded
  for now)
- a Grunt + Rollup build with an artifact existence check, without
  committing build output (per contributing.md)

Node 22 with npm cache; read-only GITHUB_TOKEN permissions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

validate.test.cjs previously required a manually started server on
localhost:8000 and a headed browser (headless: false), so npm test
always failed 26 tests out of the box and the suite could not run in CI.

- jest-puppeteer.config.cjs: headless by default; HEADFUL=1 restores a
  visible browser for debugging; pass --no-sandbox in CI containers.
- validate.test.cjs: navigate to an intercepted http://ableplayer.test/
  origin fulfilled from memory instead of localhost:8000. A real http(s)
  origin is still required because isProtocolSafe() resolves relative
  URLs against window.location.origin (opaque on about:blank), but no
  server process is needed.
- ci.yml: new test-browser job runs the puppeteer project (after
  npm run build, which produces build/test/validate.umd.js).

npm test now passes 81/81 locally with zero setup. Build artifacts
intentionally omitted per contributing.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- The jsdom project's webvtt.test.cjs loads build/test/webvtt.umd.js, so
  without a build step the job exercised the committed bundle instead of
  the source under review. Build first, matching the puppeteer job.
- Cancel superseded runs on the same ref so a force-push to an open pull
  request does not leave stale jobs queued.
- Give every job an explicit timeout; the default is six hours, which a
  hung headless page load would otherwise occupy.
- jest-puppeteer: compare HEADFUL explicitly so HEADFUL=0 stays headless
  instead of launching a visible browser (any non-empty string is truthy).

…esting docs

- Only the puppeteer job launches a browser, but puppeteer's postinstall
  downloads a browser during npm ci in every job, and setup-node's npm
  cache does not cover that directory. Set PUPPETEER_SKIP_DOWNLOAD on the
  lint, jsdom and build jobs.
- contributing.md described adjusting the test runner's target URL and a
  default of http://localhost:8000. The suite now intercepts its own
  navigation and needs no server, so document that, and mention HEADFUL=1
  for watching the browser while debugging.

… pages

Adds a CI job that runs @axe-core/playwright WCAG 2.1 A/AA scans over a
representative demo set (video, audio, transcript, sign language,
described video, YouTube shell) plus keyboard operability checks (player
reachable by Tab, play/pause operable with Enter, visible focus
indicator), each at four viewports: 320x568, 768x1024, 1280x800,
3840x2160.

- e2e/serve.mjs: dependency-free static server for the repo root so the
  demos' relative ../build and ../media references resolve as deployed;
  supports single-range requests for media loading.
- playwright.config.js: four viewport projects; boots the server via
  webServer; scans wait for the initialized .able-wrapper so the audited
  DOM is the real player UI.
- Third-party iframes (YouTube) are excluded from the scan subtree --
  cross-origin content cannot be audited from the host page.
- New devDependencies: @playwright/test, @axe-core/playwright.
- npm run test:a11y runs the suite locally (npm run build first).

Automated checks cover only a fraction of WCAG success criteria; a green
run blocks a class of regressions and is not a conformance claim.

- e2e/serve.mjs binds 127.0.0.1 instead of 0.0.0.0, so a local run never
  exposes the repository to the local network.
- The root guard compares with a trailing separator, so a sibling
  directory cannot satisfy the prefix check.
- A suffix range longer than the file clamps to offset 0 rather than
  producing a negative start.
- keyboard.spec.js: describe the transparent-outline check accurately —
  Able Player's :focus rule paints a solid colour, so the check guards
  against a theme overriding it, rather than describing current styling.
- package-lock.json: restore the libc metadata on the pre-existing
  @rollup/rollup-linux-* entries, which a lockfile regeneration had
  dropped; the only intended change is the two new devDependencies.

- The YouTube/Vimeo exclusion is a policy choice, not a technical limit:
  axe can inject into frames, but provider-owned violations are not
  actionable here. Note the trade-off it carries — excluding the element
  also drops frame-title on the embed, which is ours.
- Record that the YouTube demo's embed does not currently initialize on
  develop (initSignLanguage throws when the media element has no <source>
  children), so that entry scans the page shell today.
- Drop the claim that the 320px project catches WCAG 1.4.10 reflow: axe
  has no reflow rule. The value of the four projects is running every
  other rule against each layout.