test(web): give browser server lifecycle one fixture owner

[TusanHomichi]

Problem

At f369981 each of the five files in web/e2e/ independently owns the same
server startup, health polling, setup-code subprocess, and teardown logic.
All use stdio: 'ignore', fixed ports 7781–7785, and a health-only readiness
check. Teardown sends SIGTERM without awaiting exit; scratch directories are
left behind. A healthy process already on the selected port can satisfy the
readiness check even if the newly spawned child fails to bind.

The five browser scenarios passed during the 2026-09-05 audit. This issue
tracks fixture ownership and failure diagnostics; it is not a report that
the observed test run failed.

Proposed ownership and acceptance

• Move child-process lifecycle and scratch-directory ownership into one
  Playwright fixture under web/e2e/; specs retain scenario-specific data and
  assertions. No production API, persistence, or record-format change.
• Prove readiness belongs to the spawned child, surface spawn/early-exit
  errors, and retain only redacted diagnostics on failures (startup output
  may contain a setup code).
• Await shutdown before releasing resources; define cleanup/retention of
  invented scratch data on pass/failure.
• Allocate collision-safe listeners or explicitly refuse an occupied port
  before any scenario writes. Verify behavior with a competing listener,
  missing binary, and early child exit, then run all five existing scenarios.

Found during the repository orientation audit (#53).