Move the browser off the VPS to its own unit (#46) (#52)

Closes #46 once deployed.

The headless browser leaves the API stack and becomes its own compose unit
(`chrome/docker-compose.yml`) intended for the home machine, reached over the
tailnet. No fallback sidecar is left on the VPS.

The backend needs no code change — `BROWSER_WS_URL` was already the only
coupling. Its default is now empty rather than a pinned Docker IP, so an
unconfigured or unreachable browser degrades exactly as it always has: plain-TLS
libraries unaffected, kagane/novelfull logged and skipped, stored covers still
served.

### What shipped

- `chrome/docker-compose.yml` + `chrome/.env.example` — the browser unit, with
  the CDP port bound to `${BROWSER_BIND_ADDR}` (no default) and the resource
  limits from the epic: 512 MiB / 1 GiB memory+swap, `oom_score_adj 800`,
  halved CPU weight, shm 1 GiB -> 128 MiB.
- API stack drops the service, its `depends_on` and the `browser` network.
- `bookmark-api` gains the `default` network. Dropping `browser` had left it on
  `db` alone, which is `internal: true` — no published port and, worse, no
  egress for the poller at all. Caught by actually bringing the stack up.
- ADR-0006 for the topology; `DEPLOY.md` §7 for first-time setup of the browser
  machine; `REDEPLOY.md` §8 for its independent update cadence; architecture
  diagrams, config tables and troubleshooting rows across README/AGENTS/env.

### Verified locally

- Browser unit builds and runs: Chrome 151, UA carries no `HeadlessChrome`,
  all limits applied as declared.
- **Live smoke passes through the new unit**: `TestSmokeKaganeImage` fetched
  56710 bytes of `image/webp`, `TestSmokeKaganeGet` got a 200 with a real
  chapter list. The challenge cleared under the reduced 128 MiB shm.
- Bind isolation proven: refused on the host's non-loopback address, accepted
  on the configured one.
- 321 MiB peak of the 512 MiB cap after a full solve; 0 restarts, no OOM kill.
- API stack comes up clean, `/healthz` 200; egress confirmed present on
  `default` and absent on `db`.
- `go test ./...`, `go vet`, `gofmt` clean.

### Left to the operator

Provisioning the home machine, the Tailscale ACL, setting `BROWSER_WS_URL` in
production, and observing acceptance criteria 5-7 (covers with the machine off,
several days of zero OOM/restarts, VPS memory improvement). `DEPLOY.md` §7 now
carries the before/after `free -m` reading those need.

Reviewed-on: #52
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

docker-compose.prod.yml

@@ -17,24 +17,12 @@ services:
   bookmark-api:
     # Traffic arrives over the Traefik network, not a published port.
     ports: !reset []
-    environment:
-      # Must be an IP, not the DNS name — see the base file's comment on this
-      # same key: Chrome's DevTools HTTP handler 500s any Host header that
-      # isn't an IP or "localhost".
-      BROWSER_WS_URL: ${BROWSER_WS_URL:-ws://172.28.0.10:9222}
-    depends_on:
-      headless-shell:
-        condition: service_started
-      postgres:
-        condition: service_healthy
-    # `networks:` here replaces the base file's list entirely, so all three must
-    # be named: `proxy` for Traefik routing, and `browser` / `db` (defined in
-    # the base file) to keep reaching headless-shell and Postgres without
-    # putting either on `proxy`.
+    # Compose *merges* this list with the base file's, so the service ends up on
+    # `default`, `db` and `proxy` — only the addition is named here. Do not
+    # "tidy" the base file down to `db` on the strength of `proxy` being present:
+    # `db` is `internal: true`, and egress comes from `default`.
     networks:
       - proxy
-      - browser
-      - db
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=${PROXY_NETWORK:-proxy}"
@@ -52,10 +40,12 @@ services:
       - "traefik.http.routers.bmweb.tls.certresolver=${TRAEFIK_CERTRESOLVER:-le}"
       - "traefik.http.routers.bmweb.service=bmapi"
 
-  # headless-shell is untouched here: it keeps its `browser` network membership
-  # from the base file and must never join `proxy` — that network is shared
-  # with whatever else sits behind Traefik on this host, and an exposed
-  # CDP endpoint on it would be remote code execution for any of them.
+  # No browser service here. It runs on the home machine as its own unit
+  # (chrome/docker-compose.yml) and is reached over the tailnet — see
+  # docs/adr/0006-browser-on-the-home-machine.md. It must never be given a
+  # service on this host: `proxy` is shared with whatever else sits behind
+  # Traefik, and an unauthenticated CDP endpoint on it is remote code
+  # execution for any of them.
 
 networks:
   proxy: