Move the browser off the VPS to its own unit (#46) (#52)

Closes #46 once deployed.

The headless browser leaves the API stack and becomes its own compose unit
(`chrome/docker-compose.yml`) intended for the home machine, reached over the
tailnet. No fallback sidecar is left on the VPS.

The backend needs no code change — `BROWSER_WS_URL` was already the only
coupling. Its default is now empty rather than a pinned Docker IP, so an
unconfigured or unreachable browser degrades exactly as it always has: plain-TLS
libraries unaffected, kagane/novelfull logged and skipped, stored covers still
served.

### What shipped

- `chrome/docker-compose.yml` + `chrome/.env.example` — the browser unit, with
  the CDP port bound to `${BROWSER_BIND_ADDR}` (no default) and the resource
  limits from the epic: 512 MiB / 1 GiB memory+swap, `oom_score_adj 800`,
  halved CPU weight, shm 1 GiB -> 128 MiB.
- API stack drops the service, its `depends_on` and the `browser` network.
- `bookmark-api` gains the `default` network. Dropping `browser` had left it on
  `db` alone, which is `internal: true` — no published port and, worse, no
  egress for the poller at all. Caught by actually bringing the stack up.
- ADR-0006 for the topology; `DEPLOY.md` §7 for first-time setup of the browser
  machine; `REDEPLOY.md` §8 for its independent update cadence; architecture
  diagrams, config tables and troubleshooting rows across README/AGENTS/env.

### Verified locally

- Browser unit builds and runs: Chrome 151, UA carries no `HeadlessChrome`,
  all limits applied as declared.
- **Live smoke passes through the new unit**: `TestSmokeKaganeImage` fetched
  56710 bytes of `image/webp`, `TestSmokeKaganeGet` got a 200 with a real
  chapter list. The challenge cleared under the reduced 128 MiB shm.
- Bind isolation proven: refused on the host's non-loopback address, accepted
  on the configured one.
- 321 MiB peak of the 512 MiB cap after a full solve; 0 restarts, no OOM kill.
- API stack comes up clean, `/healthz` 200; egress confirmed present on
  `default` and absent on `db`.
- `go test ./...`, `go vet`, `gofmt` clean.

### Left to the operator

Provisioning the home machine, the Tailscale ACL, setting `BROWSER_WS_URL` in
production, and observing acceptance criteria 5-7 (covers with the machine off,
several days of zero OOM/restarts, VPS memory improvement). `DEPLOY.md` §7 now
carries the before/after `free -m` reading those need.

Reviewed-on: #52
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

REDEPLOY.md

@@ -59,7 +59,7 @@ network can reach it — so every command below goes in through the container:
 
 ```bash
 $COMPOSE exec -T postgres psql -U bookmarks -d bookmarks -c '\dt'
-# -> bookmarks, readers, schema_migrations, series, sessions
+# -> bookmarks, covers, readers, schema_migrations, series, sessions
 ```
 
 Inside the container that connects over the local socket as the `bookmarks`
@@ -99,10 +99,11 @@ you will act as though you have one:
 docker run --rm -v "$BACKUP_DIR":/backup postgres:17-alpine \
   pg_restore --list "/backup/bookmarks-$STAMP.dump" | grep 'TABLE DATA'
 # -> 1234; 0 0 TABLE DATA public bookmarks bookmarks
-# -> 1235; 0 0 TABLE DATA public readers bookmarks
-# -> 1236; 0 0 TABLE DATA public schema_migrations bookmarks
-# -> 1237; 0 0 TABLE DATA public series bookmarks
-# -> 1238; 0 0 TABLE DATA public sessions bookmarks
+# -> 1235; 0 0 TABLE DATA public covers bookmarks
+# -> 1236; 0 0 TABLE DATA public readers bookmarks
+# -> 1237; 0 0 TABLE DATA public schema_migrations bookmarks
+# -> 1238; 0 0 TABLE DATA public series bookmarks
+# -> 1239; 0 0 TABLE DATA public sessions bookmarks
 
 # 2. Sanity-check the live row count you just captured.
 $COMPOSE exec -T postgres psql -U bookmarks -d bookmarks \
@@ -387,6 +388,55 @@ panel works on the phone.
 
 ---
 
+## 8. The browser unit (separate machine, separate cadence)
+
+Everything above is the API stack on the VPS. The headless browser is its own
+compose unit on the home machine (ADR-0006, `DEPLOY.md` §7) and is redeployed
+on its own schedule — it holds no data you can lose, so there is nothing to
+back up and no ordering constraint against the API.
+
+```bash
+cd ~/mangaBookmark/chrome
+git pull --ff-only
+docker compose up -d --build
+```
+
+Then confirm it answers, and that a stopped-and-restarted Chrome is invisible
+to the API:
+
+```bash
+curl -s -m 15 http://$(tailscale ip -4):9222/json/version | head -c 120
+# -> {"Browser":"Chrome/1xx...","webSocketDebuggerUrl":"ws://...<new uuid>"}
+```
+
+The first call takes a few seconds: Chrome is not running until something
+connects, and it is reaped again after five idle minutes. The debugger UUID
+changes on every start and the API does not care — chromedp re-runs
+`/json/version` discovery per fetch, which is exactly why `chromedp.NoModifyURL`
+must never be added to `browser.go`.
+
+**Rebuild is the Chrome upgrade path.** The image installs
+`google-chrome-stable` unpinned on purpose: a stale browser is what Cloudflare
+turns away, and the pinned Chrome 124 in `zenika/alpine-chrome` is the worked
+example. The `chrome-profile` volume survives `--build`, so clearance cookies
+are reused rather than re-solved.
+
+Two things worth a glance after several days, both from the acceptance criteria
+of the move:
+
+```bash
+docker inspect bookmark-browser --format '{{.RestartCount}} {{.State.OOMKilled}}'
+# -> 0 false
+free -m                     # the Gitea runner should still have its headroom
+```
+
+Nothing here needs doing during an API redeploy. The API stack does not
+`depends_on` the browser, and an unreachable one degrades exactly as an unset
+`BROWSER_WS_URL`: plain-TLS libraries unaffected, kagane and novelfull logged
+and skipped, stored covers still served.
+
+---
+
 ## Troubleshooting
 
 | Symptom | Cause / fix |
@@ -404,6 +454,10 @@ panel works on the phone.
 | `pg_restore`: `cannot drop … other objects depend on it` / `being accessed by other users` | Live connections block `--clean`. `$COMPOSE stop bookmark-api` first (§6). If they persist: `$COMPOSE exec -T postgres psql -U bookmarks -d postgres -c "select pg_terminate_backend(pid) from pg_stat_activity where datname='bookmarks' and pid <> pg_backend_pid()"`. |
 | Dump is 0 bytes, or `pg_restore`: `did not find magic string in file header` | You ran `exec` without `-T`. The allocated TTY rewrites newlines in the binary stream and corrupts the archive in flight (§1). |
 | `git pull`: `could not read Username for 'https://…'` | The checkout's remote is the HTTPS clone URL and the server has no credential helper, so the pull prompts into a closed stdin. Switch it to SSH once — `git remote set-url origin ssh://git@gitea.violetcrown.my.id:2222/sulthan/mangaBookmark.git`. Gitea's SSH listens on **2222**, not 22; port 22 is the host's own sshd and answers `Permission denied (publickey)` no matter which key is registered. |
+| kagane rows stopped updating after a redeploy | Check `BROWSER_WS_URL` survived the `.env` edit and still names the home machine's tailnet **IP**. A hostname 500s at `/json/version`; an empty value disables the browser silently. Plain-TLS sites keep working either way, which is why this is easy to miss. |
+| kagane covers went blank in the web UI | They should not — covers are rows in `covers`, not an in-process cache. `$COMPOSE exec -T postgres psql -U bookmarks -d bookmarks -c 'select count(*) from covers'`. Zero after a restore means the dump predates the covers table; they refill on the next poll of each series. |
+| Browser unit will not start: `set BROWSER_BIND_ADDR to this machine's tailnet IP` | `chrome/.env` is missing or the variable is empty. It has no default on purpose — an unset value must fail the deploy rather than publish an unauthenticated CDP port to the LAN. |
+| `bookmark-browser` shows `OOMKilled true` | The cap did its job. Read `docker logs bookmark-browser` before raising it — the sizing and what the cap protects are in ADR-0006. |
 
 Full first-time setup: `DEPLOY.md`. The one-off SQLite→Postgres move:
 `CUTOVER.md`. Config reference and endpoints: `README.md`.