Add comix.to and kagane.to support (#13)

Tracks read progress on comix.to and kagane.to alongside asura and demonic, in both the userscript and the backend.

Implements `docs/superpowers/plans/2026-08-03-comix-kagane-support.md`.

## Userscript

- `comix` adapter — `/title/<id>-<slug>`; only the id prefix is identity (the slug follows the title). No `og:image`, so the cover is matched by `alt`.
- `kagane` adapter — reader URLs are uuids with no chapter number, so it comes out of `og:title`; anchor scanning is structurally impossible, replaced by `latestChapterFromApi` against kagane's same-origin JSON API.
- `seriesId` threaded through `latestChapterFromAnchors` so comix can scope its scan to its own series and a recommendation strip cannot win the maximum.
- `@match` for both hosts, panel chips, v1.6.0.

## Backend

- `latestChapterFrom` cases: comix parses the SSR JSON state blob (`latestChapterUrl`, scoped to the series id); kagane parses API JSON (`chapter_no`).
- Poller allowlist extended; `Poller.BrowserFetch` with `fetcherFor(site)` routes kagane to a browser fetcher. Nil means kagane is not polled at all — never a fallback to the TLS fetcher, which would only ever retrieve a challenge page.
- `BrowserFetcher`: chromedp against a `headless-shell` sidecar. kagane sits behind a Cloudflare JS challenge that no TLS fingerprint clears, and the request is made inside the page rather than by replaying `cf_clearance`.
- `BROWSER_WS_URL` wiring, sidecar in both compose files (no `ports:`, dedicated non-external network), Dockerfile on `golang:1.26-alpine` — chromedp requires go 1.26.
- Web UI `--comix` / `--kagane` tokens in both colour branches.

## Notes for review

- `series_url` is client-supplied and a headless browser is a strong SSRF primitive, so kagane's host is pinned twice: in `fetchableSeriesURL` and again in `kaganeAPIURL`.
- Three chained defects found during verification made the browser path dead under Compose (sidecar flag collision, Chrome's Host-header DNS-rebinding check, the wrong chromedp option). Fixed; the compose comments record the wrong configurations too, so they don't get "simplified" back.
- `ALLOWED_ORIGINS` now includes both new origins. Without it every write from comix/kagane silently fails CORS preflight, parks in the retry queue, and drops at the cap.

## Verification

221 backend tests, 32 userscript tests, static `CGO_ENABLED=0` build, both compose configs.

Two gaps, both real:

1. The userscript on live pages via Violentmonkey needs a human browser profile — not run. Check: comix series page (title/cover, no chapter), comix chapter page (records the number; an *older* chapter must not regress it), comix SPA navigation without reload, kagane series page (og:image cover), kagane reader (number from `og:title`), both chips opening the right sites.
2. The kagane browser path has not completed end-to-end anywhere. Dial/navigate/fetch is confirmed, but Cloudflare 403'd headless-shell's Chrome on every attempt from the dev sandbox, and comix's poll-through-Docker was blocked by that environment's TLS interception. Both environment-dependent rather than branch defects — the first real deploy is the actual verification.

Reviewed-on: #13
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/api/handlers.go

@@ -0,0 +1,116 @@
+package api
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"mangabm/backend/internal/store"
+)
+
+// Handler serves the userscript-facing JSON bookmark API.
+type Handler struct {
+	Store *store.Store
+}
+
+func writeJSON(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if v != nil {
+		if err := json.NewEncoder(w).Encode(v); err != nil {
+			log.Printf("encode response: %v", err)
+		}
+	}
+}
+
+// List returns all bookmarks. GET /bookmarks
+func (h *Handler) List(w http.ResponseWriter, r *http.Request) {
+	items, err := h.Store.List()
+	if err != nil {
+		log.Printf("list: %v", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	writeJSON(w, http.StatusOK, items)
+}
+
+// Put upserts one bookmark. PUT /bookmarks/{key}
+func (h *Handler) Put(w http.ResponseWriter, r *http.Request) {
+	key := r.PathValue("key")
+	if key == "" {
+		http.Error(w, "missing key", http.StatusBadRequest)
+		return
+	}
+
+	var b store.Bookmark
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<16)).Decode(&b); err != nil {
+		http.Error(w, "invalid JSON body", http.StatusBadRequest)
+		return
+	}
+
+	// Path key is authoritative; derive site/series_id from it when the body
+	// omits them so the stored row is always self-consistent.
+	b.Key = key
+	if b.Site == "" || b.SeriesID == "" {
+		if site, series, ok := strings.Cut(key, ":"); ok {
+			if b.Site == "" {
+				b.Site = site
+			}
+			if b.SeriesID == "" {
+				b.SeriesID = series
+			}
+		}
+	}
+
+	// An empty status is "no opinion" and Upsert keeps the stored bucket.
+	// Finishing a series is a web-UI decision, so the JSON API refuses it
+	// rather than trusting every client to leave it alone.
+	switch b.Status {
+	case "", store.StatusReading, store.StatusArchived:
+	case store.StatusFinished:
+		http.Error(w, "status "+store.StatusFinished+" can only be set from the web UI",
+			http.StatusBadRequest)
+		return
+	default:
+		http.Error(w, "invalid status", http.StatusBadRequest)
+		return
+	}
+
+	// Candidate timestamp, not a decision: Upsert keeps the stored one unless
+	// reading progress actually moved. Any client value is ignored.
+	b.UpdatedAt = time.Now().UnixMilli()
+
+	stored, err := h.Store.Upsert(b)
+	if err != nil {
+		log.Printf("upsert: %v", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	// Echo the stored row: clients adopt this as their cached copy, so it must
+	// carry the authoritative updated_at rather than the candidate above.
+	writeJSON(w, http.StatusOK, stored)
+}
+
+// Delete removes one bookmark. DELETE /bookmarks/{key}
+func (h *Handler) Delete(w http.ResponseWriter, r *http.Request) {
+	key := r.PathValue("key")
+	if key == "" {
+		http.Error(w, "missing key", http.StatusBadRequest)
+		return
+	}
+	if err := h.Store.Delete(key); err != nil {
+		log.Printf("delete: %v", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// Healthz answers the unauthenticated liveness check. GET /healthz
+func Healthz(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "text/plain")
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write([]byte("ok"))
+}