Serve the userscript from the backend; card + loading fixes (#8)

Serves the userscript from the backend so Violentmonkey auto-updates it, plus two panel fixes.

## Backend: `GET /u/{token}/manga-bookmark.user.js`

The script is read off disk per request from `USERSCRIPT_PATH` and streamed back with its `@version` line rewritten.

- **Token in the path, not a header.** Violentmonkey's update poll sends no `Authorization` header, and the script embeds `API_TOKEN` in plain text — an open URL would hand that token to anyone who guessed it. Compare is constant-time.
- **404, never 401**, for both a wrong token and a missing file: a prober learns nothing about whether the route exists.
- Registered outside `withAuth` and outside the `WEB_PASSWORD` gate, so the script is installable on a deployment that never enabled the web UI.
- Stdlib only (`crypto/subtle`, `os`, `regexp`) — no new Go dependencies.

**The served `@version` is derived from the file's mtime** (`YYYY.MM.DD.HHMM`, UTC), discarding whatever the file body says. Violentmonkey only updates when the served version sorts higher than the installed one, so a body-derived version means one typo or accidental downgrade freezes updates forever. An mtime-derived version is monotonic by construction. A file with no `@version` line is served byte-identical. `os.Stat` runs before `os.ReadFile`, so a concurrent edit can only serve new content under an old stamp — which self-heals on the next poll — never the reverse.

## Bindmount

`./userscript` is bindmounted read-only at `/userscript`. The script is deliberately **not** copied into the image: the build context stays `./backend`, and widening it would churn every `COPY` path for a file the mount always supplies. Editing the file on the VPS is live on the next poll — no rebuild, no restart. `git pull` restores the committed version, so a redeploy always ships the repo's script; checkout sets mtime to now, so even a rollback serves a *higher* version and is adopted. Without the mount the endpoint 404s and logs it; bookmark sync is unaffected.

`@downloadURL` / `@updateURL` are literal URLs in the metadata block — it is parsed before any JS runs, so `API_BASE`/`API_TOKEN` cannot be interpolated. The token was already committed in this file, so this adds no new exposure.

## Userscript UI

- **Card actions moved under the subtitle.** Only the cover and the title continue reading now; the subtitle and the action row are inert siblings in the text column. A thumb that misses ★ lands on nothing, and Remove is never inside a link.
- **Loading spinner** while the first fetch is in flight — the panel used to read as frozen on the first open after a cold start. It draws only when there is nothing cached to draw instead, so a populated list never flaps.

## Verification

- `go test -count=1 ./...` — ok, 7.070s
- `node --check` clean; `node --test userscript/test/logic.test.js` — 14/14
- Live `docker compose` smoke: `/healthz` 200, wrong token 404, script served with a stamped `@version 2026.07.28.1057` and both metadata URLs present; `touch`ing the file advanced the served version to `2026.07.28.1100` with no restart.

Layout and spinner are verified on-device — there is deliberately no DOM test harness.

Reviewed-on: #8
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/main.go

@@ -21,6 +21,9 @@ type Config struct {
 	Port           string
 	// WebPassword gates the browser UI. Empty disables the web routes entirely.
 	WebPassword string
+	// UserscriptPath is the file served at /u/{token}/manga-bookmark.user.js.
+	// Supplied by a bindmount so the script can be edited without a rebuild.
+	UserscriptPath string
 	// LatestPoll configures the background latest-chapter fetcher.
 	LatestPoll LatestPoll
 }
@@ -128,11 +131,12 @@ func loadLatestPoll() LatestPoll {
 
 func loadConfig() Config {
 	c := Config{
-		Token:       os.Getenv("API_TOKEN"),
-		DBPath:      envOr("DB_PATH", "/data/bookmarks.db"),
-		Port:        envOr("PORT", "8080"),
-		WebPassword: os.Getenv("WEB_PASSWORD"),
-		LatestPoll:  loadLatestPoll(),
+		Token:          os.Getenv("API_TOKEN"),
+		DBPath:         envOr("DB_PATH", "/data/bookmarks.db"),
+		Port:           envOr("PORT", "8080"),
+		WebPassword:    os.Getenv("WEB_PASSWORD"),
+		UserscriptPath: envOr("USERSCRIPT_PATH", "/userscript/manga-bookmark.user.js"),
+		LatestPoll:     loadLatestPoll(),
 	}
 	for _, o := range strings.Split(os.Getenv("ALLOWED_ORIGINS"), ",") {
 		if o = strings.TrimSpace(o); o != "" {
@@ -149,6 +153,11 @@ func newRouter(store *Store, cfg Config) http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /healthz", healthz)
 
+	// Outside withAuth (the updater sends no Authorization header) and outside
+	// the WEB_PASSWORD gate (the script must be installable either way). The
+	// path segment carries the token instead.
+	mux.HandleFunc("GET /u/{token}/manga-bookmark.user.js", userscriptHandler(cfg.Token, cfg.UserscriptPath))
+
 	h := &bookmarkHandler{store: store}
 	protected := http.NewServeMux()
 	protected.HandleFunc("GET /bookmarks", h.list)
@@ -170,7 +179,22 @@ func newRouter(store *Store, cfg Config) http.Handler {
 		web.register(mux)
 	}
 
-	return withCORS(cfg.AllowedOrigins, mux)
+	return withCORS(cfg.AllowedOrigins, guardEmptyUserscriptToken(mux))
+}
+
+// guardEmptyUserscriptToken heads off ServeMux's own path-cleaning redirect:
+// an empty {token} segment makes the request path "/u//manga-bookmark.user.js",
+// and ServeMux 307s that to "/u/manga-bookmark.user.js" before pattern
+// matching ever runs. The endpoint's contract is 404 for any wrong token,
+// including this one, so catch it ahead of the mux.
+func guardEmptyUserscriptToken(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasPrefix(r.URL.Path, "/u//") {
+			http.NotFound(w, r)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
 }
 
 func main() {