feat: wire headless-shell sidecar for challenge-gated polling

Also bumps backend/Dockerfile's build stage to golang:1.26-alpine —
chromedp v0.16.0 and cdproto both require go 1.26, and the pinned
1.24-alpine base no longer builds the module.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -37,7 +37,7 @@ Violentmonkey userscript (isolated world, per-site adapters, localStorage cache)
   packages together into `newRouter`. Root-level `*_test.go` hold
   integration tests that exercise the full router; unit tests for a
   package live beside it under `internal/`.
-- **Single-user store.** One `bookmarks` table keyed `<site>:<series_id>` (`asura`|`demonic`). Sync **last-write-wins**. Schema and endpoint list in plan.
+- **Single-user store.** One `bookmarks` table keyed `<site>:<series_id>` (`asura`|`demonic`|`comix`|`kagane`). Sync **last-write-wins**. Schema and endpoint list in plan.
 - **Endpoints:** `GET /bookmarks`, `PUT /bookmarks/{key}` (upsert; see `updated_at` rule below), `DELETE /bookmarks/{key}`, `GET /healthz` (no auth).
 - **Web UI:** same binary serve password-gated browser UI on second
   hostname — `GET /` (list, or login page when no session),
@@ -75,7 +75,10 @@ Violentmonkey userscript (isolated world, per-site adapters, localStorage cache)
   cooldown instead of retrying every tick, and writes go through
   `Store.Get` + `Store.Upsert` so new chapter never reorders list.
   Fetches use `bogdanfinn/tls-client` with Chrome profile as defence in depth
-  against fingerprint-based blocking; any failure log and skip. See
+  against fingerprint-based blocking; any failure log and skip. kagane sits
+  behind a Cloudflare JavaScript challenge the TLS client can't clear, so it is
+  browser-only: fetched over CDP via `BROWSER_WS_URL`, and simply not polled
+  when that's unset. See
   `docs/superpowers/specs/2026-07-26-server-latest-chapter-polling-design.md`.
   Poller's `Store.Get` + `Store.Upsert` not wrapped in transaction, so
   userscript `PUT` that commits between the two can get overwritten by
@@ -100,6 +103,8 @@ Violentmonkey userscript (isolated world, per-site adapters, localStorage cache)
   (background latest-chapter poller; defaults on, `1h`/`10m`/`14`/`20s`).
   `USERSCRIPT_PATH` (file served at `/u/{token}/manga-bookmark.user.js`,
   default `/userscript/manga-bookmark.user.js`, supplied by bindmount).
+  `BROWSER_WS_URL` (headless-shell CDP endpoint for kagane; unset disables
+  browser polling and leaves that site to the userscript alone).
 
 ### Userscript structure (single IIFE, `manga-bookmark.user.js`)