feat: wire headless-shell sidecar for challenge-gated polling

Also bumps backend/Dockerfile's build stage to golang:1.26-alpine —
chromedp v0.16.0 and cdproto both require go 1.26, and the pinned
1.24-alpine base no longer builds the module.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yml

@@ -29,6 +29,11 @@ services:
       LATEST_CHAPTER_POLL_INTERVAL: ${LATEST_CHAPTER_POLL_INTERVAL:-10m}
       LATEST_CHAPTER_POLL_BATCH: ${LATEST_CHAPTER_POLL_BATCH:-14}
       LATEST_CHAPTER_POLL_STAGGER: ${LATEST_CHAPTER_POLL_STAGGER:-20s}
+      # CDP endpoint for sites behind a JavaScript challenge (kagane). Unset
+      # disables browser polling for those sites; the userscript still covers them.
+      BROWSER_WS_URL: ${BROWSER_WS_URL:-ws://headless-shell:9222}
+    depends_on:
+      - headless-shell
     volumes:
       - bookmarks-data:/data
       # The userscript is served from here, read fresh on every request. Editing
@@ -41,5 +46,21 @@ services:
     ports:
       - "127.0.0.1:8080:8080"
 
+  headless-shell:
+    image: chromedp/headless-shell:stable
+    restart: unless-stopped
+    # Chrome allocates shared memory per tab and dies on Docker's 64MB default.
+    shm_size: '1gb'
+    # Reaps zombie renderer processes, which otherwise accumulate for the
+    # container's lifetime.
+    init: true
+    # Deliberately no `ports:` — an exposed CDP endpoint is remote code
+    # execution. Only the backend on the internal network may reach it.
+    command:
+      - --remote-debugging-address=0.0.0.0
+      - --remote-debugging-port=9222
+      - --disable-gpu
+      - --no-sandbox
+
 volumes:
   bookmarks-data: