Add the missing XHR JSON echo fixture

[noise64]

• adds a real JSON echo endpoint that consumes accepted request bodies before responding
• makes the XHR example reject transport errors, non-200 responses, invalid JSON, and mismatched echoed fields
• replaces a permissive runtime assertion with exact successful-response validation
• contains the audited P2 CI failure without claiming to fix the underlying Wasmtime/Hyper lifecycle defect