feat: wire headless-shell sidecar for challenge-gated polling

Also bumps backend/Dockerfile's build stage to golang:1.26-alpine —
chromedp v0.16.0 and cdproto both require go 1.26, and the pinned
1.24-alpine base no longer builds the module.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

DEPLOY.md

@@ -116,6 +116,12 @@ This merges the base file (build/image/env/volume) with the prod override
 (no host port, Traefik network + router labels). Always pass **both** `-f`
 flags — the prod file is not standalone.
 
+Two services come up: `manga-api` (the backend) and `headless-shell`, a CDP
+sidecar the poller uses to fetch kagane (behind a Cloudflare JS challenge).
+It has no published port — only `manga-api` can reach it, over
+`BROWSER_WS_URL`. Missing or unreachable, the poller just skips kagane and
+logs it; nothing else is affected.
+
 Check it's up and healthy:
 
 ```bash