feat(education): complete student core loop delivery

tools/education-student-harness/README.md

@@ -0,0 +1,22 @@
+# Browser acceptance harness
+
+This directory contains a local-only student client and an acceptance suite. It has no lockfile or vendored browser binaries: do not install from the network during normal repository checks.
+
+## Commands
+
+From this directory:
+
+```bash
+npm run smoke                 # dependency-free route smoke test
+npm run contract              # dependency-free HTTP and adapter tests
+npm run browser:if-available  # runs Playwright only when it is already resolvable
+npm run browser               # explicit Playwright command, requires an existing install
+```
+
+The browser suite starts `server.js` itself, uses Chromium headlessly, and writes screenshots/traces to `artifacts/` (gitignored). It is intentionally not reported as passing when Playwright or its browser binary is unavailable.
+
+To run against a real application instead of the deterministic local server, set `BASE_URL`; the server is then not started and the supplied token must be accepted by that application.
+
+Required coverage includes desktop and H5 viewport core loops, timeout-after-commit with same-key retry, reload/current recovery, submit/report/wrong/favorite, logout, tenant/student isolation, and a request guard installed before navigation. The guard aborts every non-loopback request and any URL containing Scalar, Supabase, or provider-token patterns.
+
+The dependency-free smoke route uses only Node built-ins and starts the local harness on loopback. It is the minimum check for environments without Playwright.