feat: wire headless-shell sidecar for challenge-gated polling

Also bumps backend/Dockerfile's build stage to golang:1.26-alpine —
chromedp v0.16.0 and cdproto both require go 1.26, and the pinned
1.24-alpine base no longer builds the module.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -17,6 +17,10 @@ services:
   manga-api:
     # Traffic arrives over the Traefik network, not a published port.
     ports: !reset []
+    environment:
+      BROWSER_WS_URL: ${BROWSER_WS_URL:-ws://headless-shell:9222}
+    depends_on:
+      - headless-shell
     networks:
       - proxy
     labels:
@@ -36,6 +40,12 @@ services:
       - "traefik.http.routers.mangaweb.tls.certresolver=${TRAEFIK_CERTRESOLVER:-le}"
       - "traefik.http.routers.mangaweb.service=mangabm"
 
+  # manga-api only joins `proxy` in this override (see above), so headless-shell
+  # has to follow it there too or DNS resolution of headless-shell:9222 breaks.
+  headless-shell:
+    networks:
+      - proxy
+
 networks:
   proxy:
     external: true