rebrand: MangaBM → BookmarkManager, add novel library support (#15)

Two intertwined changes — the rebrand and the novel library were developed on
the same branch because the novel UI plumbing is part of the new "Bookmark
Manager" wordmark in the web shell.

## What it does

- **Rebrand**: MangaBM → BookmarkManager across the Go module, compose stack,
  env vars, Traefik hostnames, container/image names, userscript storage
  prefixes (`mangabm:cache` → `bmgr:manga:cache`, `mangabm:queue` → `bmgr:manga:queue`),
  and docs.
- **Novel library**: same backend, two libraries. New `kind` column splits
  bookmarks into `manga` / `novel`; PUT validates it. Two userscripts:
  - `manga-bookmark.user.js` — unchanged behaviour, just stamps its own `kind`.
  - `novel-bookmark.user.js` — separate Violentmonkey install with adapters
    for **novelfull.com** (polled via headless browser — Cloudflare JS
    challenge) and **lightnovelworld.net** (polled via plain TLS).
- **Web UI**: library switch on the app shell. Login art, libswitch, and
  novel-site colours from the Cinder design snapshot.

## Plumbing

- `addedColumns` ALTER for `kind` runs on first start after upgrade; every
  pre-existing row is backfilled to `'manga'`. No manual SQL, no down-time.
- `ALLOWED_ORIGINS` gains the two novel sites.
- New `NOVEL_USERSCRIPT_PATH` env (default `/userscript/novel-bookmark.user.js`),
  bindmounted alongside the manga script.
- Traefik router names `mangabm*` → `bmapi*` / `bmweb*`.

## Test status

- `go test ./...` — green
- `node --test userscript/test/logic.test.js` — 34 pass
- `node --test userscript/test/novel-logic.test.js` — 11 pass
- `node --check` on both userscripts — clean

## Notes for the redeploy

.env keys were renamed (`MANGA_API_HOST` → `BOOKMARK_API_HOST`,
`MANGA_WEB_HOST` → `BOOKMARK_WEB_HOST`). Update DNS / Traefik labels on the
prod override before pulling, otherwise the public hostnames go dark.
See the redeploy instructions I'll post next to this PR.

Reviewed-on: #15
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/latest/poller.go

@@ -6,7 +6,7 @@ import (
 	"net/url"
 	"time"
 
-	"mangabm/backend/internal/store"
+	"bookmarkmanager/backend/internal/store"
 )
 
 // Fetcher retrieves a series page. It exists as an interface so tests can inject
@@ -44,12 +44,13 @@ type Poller struct {
 }
 
 // fetcherFor returns the fetcher a site needs, or nil when the site cannot be
-// fetched at all right now. kagane sits behind a Cloudflare JavaScript
-// challenge that no TLS fingerprint clears — verified 2026-08-03 from the
-// deployment host with the same Chrome profile TLSFetcher uses — so it is
-// browser-only or nothing.
+// fetched at all right now. kagane and novelfull both sit behind a Cloudflare
+// JavaScript challenge that no TLS fingerprint clears — kagane verified
+// 2026-08-03, novelfull verified 2026-08-05, both against the same Chrome_133
+// profile TLSFetcher uses — so they are browser-only or nothing.
 func (p *Poller) fetcherFor(site string) Fetcher {
-	if site == "kagane" {
+	switch site {
+	case "kagane", "novelfull":
 		return p.BrowserFetch
 	}
 	return p.Fetch
@@ -212,13 +213,18 @@ func (p *Poller) checkOne(ctx context.Context, b store.Bookmark) {
 // a defence against the poller being used to probe arbitrary hosts from the
 // server's own network position, not just a check against wasted requests.
 //
-// kagane is held to a stricter rule: it is fetched by a headless browser, which
-// executes JavaScript and carries cookies, and is therefore a far stronger SSRF
-// primitive than an HTTP GET. Its host must match exactly, not merely be
-// non-empty.
+// Three sites are held to a stricter rule, each for a different reason:
+//
+//   - kagane and novelfull are fetched by a headless browser, which executes
+//     JavaScript and carries cookies, and is therefore a far stronger SSRF
+//     primitive than an HTTP GET. Their hosts must match exactly, not merely
+//     be non-empty.
+//   - lightnovelworld's parser regex hardcodes its host, so a URL anywhere
+//     else could never yield a match — reject it here rather than burn the
+//     request.
 func fetchableSeriesURL(site, seriesURL string) bool {
 	switch site {
-	case "asura", "demonic", "comix", "kagane":
+	case "asura", "demonic", "comix", "kagane", "novelfull", "lightnovelworld":
 	default:
 		return false
 	}
@@ -229,8 +235,17 @@ func fetchableSeriesURL(site, seriesURL string) bool {
 	if u.Scheme != "https" || u.Host == "" {
 		return false
 	}
-	if site == "kagane" {
+	switch site {
+	case "kagane":
 		return u.Hostname() == "kagane.to"
+	case "novelfull":
+		// Fetched by a real browser, same as kagane, so the host is pinned
+		// rather than merely non-empty.
+		return u.Hostname() == "novelfull.com"
+	case "lightnovelworld":
+		// Its parser regex hardcodes this host, so a URL anywhere else could
+		// never yield a match — reject it here rather than burn the request.
+		return u.Hostname() == "lightnovelworld.net"
 	}
 	return true
 }