feat(web): offer the userscripts as a download for mobile

Violentmonkey on mobile Chromium does not intercept navigation to a
.user.js URL, so the Install link renders the script as text and there is
no way to get it installed. Adding ?download=1 sets Content-Disposition:
attachment on the same session-gated endpoint, so the Reader saves the
file and adds it from Violentmonkey's own menu.

The plain link stays inline on purpose: the updater polls the /u/ path and
an attachment disposition there would break auto-update. The test asserts
both halves.

Refs #26

backend/internal/web/templates/setup.html

@@ -12,6 +12,13 @@
     <a class="ghost" href="/install/manga-bookmark.user.js">Install Manga script</a>
     <a class="ghost" href="/install/novel-bookmark.user.js">Install Novels script</a>
   </p>
+  <p class="setup-copy">On mobile, Violentmonkey does not pick up the install
+    links — the script opens as text. Download the file instead, then add it
+    from Violentmonkey's own menu.</p>
+  <p class="setup-links">
+    <a class="ghost" href="/install/manga-bookmark.user.js?download=1">Download Manga script</a>
+    <a class="ghost" href="/install/novel-bookmark.user.js?download=1">Download Novels script</a>
+  </p>
   {{if .Rotated}}
   <p class="setup-warn" role="status">Credential rotated — the old one no
     longer works. Reinstall both scripts on every device now, or they will