test(word-addin): live full-stack demo suite + real Word-on-the-web driver

WHY THIS MATTERS
The hermetic e2e suite proves the task pane against a mocked Office.js
host with mocked backends - fast and deterministic, but it can never
answer "does the real integration work?". This adds the opposite end of
the testing spectrum: everything real except what physically cannot be
real in the environment.

WHAT'S IN THE BOX
1. playwright.live.config.ts + e2e-live/live-demo.spec.ts - LIVE runs:
   real Supabase sign-in through the dev server's HTTPS proxy, real Mike
   backend, real streamed model responses; only the Word JS API surface
   is shimmed (a plain browser has no Office host). Assertions target
   the redline CONTRACT (parseable edits → Apply button → recorded
   TrackAll replacements), not exact model wording, so the suite
   tolerates model nondeterminism. Video recording is always on - the
   runs double as review reels.
2. e2e-live/word-web-session.mjs - drives the add-in inside REAL Word
   on the web. Word online needs a signed-in Microsoft account no
   automation can create, so a persistent profile splits the work:
   --login opens office.com for a one-time manual sign-in (detected by
   the marketing page's Sign-in button disappearing - logged-out
   office.com does NOT redirect to login), --record then reuses the
   session to open a document, type a demo contract, sideload
   manifest.xml, sign into Mike, and apply chat-proposed redlines,
   recording video + step screenshots to the Desktop.
3. webpack.config.js: DEV_HTTPS_CERT/DEV_HTTPS_KEY serve existing cert
   files directly. office-addin-dev-certs otherwise installs its CA
   into the OS keychain via an admin prompt no automated environment
   can approve; the driving browser tolerates the untrusted cert with
   --ignore-certificate-errors instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>