demo skill: read the dev port from config; make deps installs JS packages

The skill assumed port 4000, but config/dev.exs serves on 8056 (and honours
$PORT), so a fresh demo run failed its liveness check and every rodney URL
pointed at the wrong port.

- demo skill: resolve DEMO_PORT from the app config with
  `mix run --no-start -e 'Application.get_env(:firehose,
  FirehoseWeb.Endpoint)[:http][:port]'` (Endpoint.config/1 raises without a
  started endpoint), derive $DEMO_BASE_URL from it, start the server on that
  port from app/, and use $DEMO_BASE_URL in every rodney example. The skill
  also points at .tmp/phx-demo.log and names the assets/node_modules
  highlight.js failure as a diagnosable cause.
- app/Makefile: new `assets` target that runs `npm install` only when
  node_modules/.package-lock.json is missing, and `deps` now depends on it.
  A fresh clone gets a working JS bundle from `make deps`/`make test`; later
  runs never touch the network, so offline runs keep working.

Verified: guard skips with node_modules present and installs after moving it
aside; the skill's DEMO_PORT command prints 8056 and follows PORT=9999;
make check and make test (179 + 162) green.

app/Makefile

@@ -3,7 +3,7 @@
 MISE_BIN ?= mise
 MISE_EXEC = $(MISE_BIN) exec --
 
-.PHONY: check precommit deps compile test test.coverage coverage format credo verify
+.PHONY: check precommit deps assets compile test test.coverage coverage format credo verify
 
 # Run all static analysis checks (no database required)
 check: credo format
@@ -11,8 +11,18 @@ check: credo format
 # Precommit target for CI/pre-commit hooks
 precommit: check compile
 
-# Sync dependencies
-deps:
+# Install JS dependencies (esbuild bundle, playwright). `mix phx.server` and
+# `mix assets.deploy` need them: without `assets/node_modules` the bundle fails
+# to resolve highlight.js and LiveView never loads.
+#
+# Guarded on npm's own install marker, so a clone pays for it once and later
+# runs never touch the network: `make test` keeps working offline.
+assets:
+	@test -f assets/node_modules/.package-lock.json || \
+		(echo "==> assets: npm install (first run)"; cd assets && npm install)
+
+# Sync dependencies (Hex packages + JS packages)
+deps: assets
 	$(MISE_EXEC) mix deps.get
 
 # Compile the project