Fix review findings from the browser relocation (#46)

Compose merges `networks:` across override files rather than replacing them,
so the prod override's claim that it must re-name every network was false —
and the rationale built on it ("proxy carries the poller's egress") was false
too. Verified against `docker compose config`: the API renders on db, default
and proxy with only `proxy` named here. Egress comes from `default`, which is
now the thing a maintainer must not tidy away.

chrome/.env.example shipped BROWSER_BIND_ADDR=100.x.y.z as a live value, so
`cp .env.example .env && docker compose up` failed with Docker rejecting an
invalid IP instead of the guard message both troubleshooting tables promise.
Commented out, so the promised message is what you actually get.

DEPLOY §7 gains the two steps that were asserted but never instructed: a
Tailscale ACL, without which "Tailscale identity is the access control" is
aspirational and 9222 is open to every device on the tailnet; and a VPS
`free -m` reading before and after, without which the memory this move
reclaims cannot be shown.

Also drops a change-narration comment and three restatements of measured facts
that already have a canonical home.

chrome/docker-compose.yml

@@ -17,14 +17,10 @@ services:
     container_name: bookmark-browser
     restart: unless-stopped
     environment:
-      # A UTC clock is itself the bot signal: Cloudflare treats it as the
-      # datacenter default, and kagane's challenge then never clears. Measured
-      # 2026-08-08, identical container, one Indonesian egress IP: UTC never
-      # cleared in 60s (twice); Asia/Jakarta and America/New_York both cleared
-      # in 4s. So any real zone works and it need not match the IP's country —
-      # only UTC fails. Unset falls back to the host's /etc/timezone below,
-      # which is a real zone whenever the host clock is set to local time; set
-      # BROWSER_TZ when the host runs UTC.
+      # Any real zone works, but a UTC clock is itself the bot signal and the
+      # challenge then never clears — measurement in entrypoint.sh. Unset falls
+      # back to the host's /etc/timezone below, which is a real zone whenever
+      # the host clock is local; set BROWSER_TZ when the host runs UTC.
       TZ: ${BROWSER_TZ:-}
     volumes:
       # The zone *name*, which is what Chrome's ICU needs — see entrypoint.sh.