v018-axios-cdntest: C is for cookie, not cryptojacking

It ships a self-described 'cryptojacker payload' that POSTs shares to a stratum port over XHR and mines exactly nothing — yet the cookie stealer bolted onto real axios works fine, and the README reads like a startup pitch deck.