test: add endpoint coverage for healthz, metrics, estimate, demo Retry-After

Add four new testkit tests (T37–T40) covering self-serve endpoints:
- T37: GET /api/healthz extended fields (uptime_s, jobs_total)
- T38: GET /api/metrics full snapshot verification
- T39: GET /api/estimate cost-preview endpoint
- T40: Demo 429 Retry-After header (RFC 7231)

Also adds Retry-After header to the demo rate-limit 429 response.

Fixes #45

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

artifacts/api-server/src/routes/demo.ts

@@ -43,6 +43,7 @@ router.get("/demo", async (req: Request, res: Response) => {
   if (!allowed) {
     const secsUntilReset = Math.ceil((resetAt - Date.now()) / 1000);
     logger.warn("demo rate limited", { ip, retry_after_s: secsUntilReset });
+    res.setHeader("Retry-After", String(secsUntilReset));
     res.status(429).json({
       error: `Rate limit exceeded. Try again in ${secsUntilReset}s (5 requests per hour per IP).`,
     });