fix(backend): bind session key to both secrets and guard no-op chapter saves

Final-review fix wave over the web UI branch.

- sessionKey now derives from API_TOKEN and WEB_PASSWORD with a \x00
  separator, so rotating the password logs every browser out too.
- uiChapter only clears last_chapter_url when the number actually
  changes. The form is pre-filled, so a bare tap of Save resubmits the
  same value; that used to destroy the chapter URL silently while
  updated_at stayed put, degrading Continue to the series index page.
- MANGA_WEB_HOST is now required by the prod override rather than
  falling back to manga.example.com, matching MANGA_API_HOST.
- Comment fixes: static cache rationale, pruneLocked aliasing
  invariant, and the stale "3 routes" line in CLAUDE.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -23,6 +23,7 @@ ALLOWED_ORIGINS=https://asuracomic.net,https://asurascans.com,https://demonicsca
 # Generate one: openssl rand -base64 18
 WEB_PASSWORD=
 
-# Subdomain Traefik routes to the browser UI (prod override only). The same
-# container also answers on MANGA_API_HOST for the userscript's API.
-# MANGA_WEB_HOST=manga.example.com
+# Subdomain Traefik routes to the browser UI (required by the prod override
+# whenever the web UI is enabled). The same container also answers on
+# MANGA_API_HOST for the userscript's API.
+MANGA_WEB_HOST=manga.example.com