JSON WAF Browser + Non-JS Client Test v4

Upload/extract so the root directory is:

json-test/

Main pages:
- /json-test/
- /json-test/php-curl-test.php
- /json-test/api-test.json

Changes in v4:
- Single-column layout.
- Request settings are at the top.
- Browser fetch test baked into the main page.
- Browser response panel shows the final response visible to JavaScript.
- HAR/DevTools instructions are included for proving the intermediate challenge flow.
- PHP cURL tester remains available for non-JS client tests with request sent, verbose trace, response headers, and response body.
