Let the differ demo run alongside sibling-repo demos

[JonJagger]

Until now `make demo` and `make run-tests` brought the client/server up on
fixed container names and fixed host ports, and the cleanup step ran a
global `docker rm --force $(docker ps -aq)` that destroyed EVERY container
on the machine - including any sibling repo's running demo (eg web). So a
differ demo or test run could not coexist with another repo's demo: they
fought over host ports and nuked each other. This mirrors the equivalent
web (#358), creator and dashboard changes for differ.

  - Each demo/test run is its own docker-compose project (COMPOSE_PROJECT_NAME, default differ), so container names are namespaced per project.
  - Publish no host ports at all. The demo execs into the client container and the client reaches the server over the project's private network (by the `server` service name), so nothing needs a host port and nothing collides. - Replace containers_down's global `docker rm --force` nuke with a project-scoped `docker compose down`, so tearing down differ no longer kills the other repos' demos.

The demo/test helpers no longer assume fixed container names; they resolve a container by compose project+service label via a shared service_container() in lib.sh.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>