[cport1]

The repo now has a short demonstration, but trying the SDK still required cloning and building the monorepo. Add a standalone Express playground that launches from StackBlitz and lets visitors send real requests, inspect local decisions and explicitly compare monitor mode with enforcement.

• Add a branded responsive UI with ordinary/decoy requests, actual HTTP status and SDK JSON, monitor mode by default, and a separate opt-in enforcement fixture.
• Pin published SDK packages with an independent lockfile and automatic dev-server startup. Keep this outside root workspaces so visitors do not need the monorepo build or an API key.
• Put the playground and the published 30-second demonstration near the top of the root README and link them from the core package README.
• Run the standalone install and HTTP checks through the existing Node 20/22 CI test command, without changing workflow permissions. Core SDK behavior and root dependency lockfile are unchanged.

Validation: installed published @webdecoy/node and @webdecoy/express 0.22.3 into a separate directory; HTTP assertions pass for ordinary requests in both modes, monitored decoy 404/DENY and enforced decoy 403. Native Chrome UI checks reproduced 200/ALLOW, 404/DENY and 403. Desktop layout reviewed; README local links and heading anchors pass; git diff --check passes. Signed-out StackBlitz import and live preview passed: clicked ordinary HTTP200/ALLOW, monitored decoy HTTP404/DENY/tripwire=true, and explicitly enforced decoy HTTP403. Both full Node20/22 CI jobs passed.

Controlled path requests demonstrate matching, not live attack detection accuracy. The fixture exposes decisions for inspection and does not send detections to the hosted dashboard.

Verified branch preview: https://stackblitz.com/github/WebDecoy/node/tree/0af010377b726ba3dfba3961f050cd3366158aba/playgrounds/express?file=app.mjs