rebrand: MangaBM → BookmarkManager, add novel library support (#15)

Two intertwined changes — the rebrand and the novel library were developed on
the same branch because the novel UI plumbing is part of the new "Bookmark
Manager" wordmark in the web shell.

## What it does

- **Rebrand**: MangaBM → BookmarkManager across the Go module, compose stack,
  env vars, Traefik hostnames, container/image names, userscript storage
  prefixes (`mangabm:cache` → `bmgr:manga:cache`, `mangabm:queue` → `bmgr:manga:queue`),
  and docs.
- **Novel library**: same backend, two libraries. New `kind` column splits
  bookmarks into `manga` / `novel`; PUT validates it. Two userscripts:
  - `manga-bookmark.user.js` — unchanged behaviour, just stamps its own `kind`.
  - `novel-bookmark.user.js` — separate Violentmonkey install with adapters
    for **novelfull.com** (polled via headless browser — Cloudflare JS
    challenge) and **lightnovelworld.net** (polled via plain TLS).
- **Web UI**: library switch on the app shell. Login art, libswitch, and
  novel-site colours from the Cinder design snapshot.

## Plumbing

- `addedColumns` ALTER for `kind` runs on first start after upgrade; every
  pre-existing row is backfilled to `'manga'`. No manual SQL, no down-time.
- `ALLOWED_ORIGINS` gains the two novel sites.
- New `NOVEL_USERSCRIPT_PATH` env (default `/userscript/novel-bookmark.user.js`),
  bindmounted alongside the manga script.
- Traefik router names `mangabm*` → `bmapi*` / `bmweb*`.

## Test status

- `go test ./...` — green
- `node --test userscript/test/logic.test.js` — 34 pass
- `node --test userscript/test/novel-logic.test.js` — 11 pass
- `node --check` on both userscripts — clean

## Notes for the redeploy

.env keys were renamed (`MANGA_API_HOST` → `BOOKMARK_API_HOST`,
`MANGA_WEB_HOST` → `BOOKMARK_WEB_HOST`). Update DNS / Traefik labels on the
prod override before pulling, otherwise the public hostnames go dark.
See the redeploy instructions I'll post next to this PR.

Reviewed-on: #15
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/latest/poller_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"mangabm/backend/internal/store"
+	"bookmarkmanager/backend/internal/store"
 )
 
 // newTestStore opens a fresh SQLite store in a temp dir.
@@ -453,3 +453,49 @@ func TestKaganeUsesBrowserFetcher(t *testing.T) {
 		t.Errorf("LatestChapterNum = %v, want 41", got.LatestChapterNum)
 	}
 }
+
+func TestFetcherForRoutesNovelSites(t *testing.T) {
+	tls := &fakeFetcher{}
+	browser := &fakeFetcher{}
+	p := &Poller{Fetch: tls, BrowserFetch: browser}
+
+	cases := []struct {
+		site string
+		want Fetcher
+	}{
+		{"asura", tls},
+		{"lightnovelworld", tls},
+		{"kagane", browser},
+		{"novelfull", browser},
+	}
+	for _, tc := range cases {
+		t.Run(tc.site, func(t *testing.T) {
+			if got := p.fetcherFor(tc.site); got != tc.want {
+				t.Fatalf("fetcherFor(%q) = %v, want %v", tc.site, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestFetchableSeriesURLPinsNovelHosts(t *testing.T) {
+	cases := []struct {
+		name string
+		site string
+		url  string
+		want bool
+	}{
+		{"novelfull on its own host", "novelfull", "https://novelfull.com/reverend-insanity.html", true},
+		{"novelfull on a foreign host", "novelfull", "https://evil.example/x.html", false},
+		{"novelfull over http", "novelfull", "http://novelfull.com/x.html", false},
+		{"lightnovelworld on its own host", "lightnovelworld", "https://lightnovelworld.net/novel/a-will-eternal/", true},
+		{"lightnovelworld on a foreign host", "lightnovelworld", "https://evil.example/novel/x/", false},
+		{"unknown site", "webnovel", "https://webnovel.com/x", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := fetchableSeriesURL(tc.site, tc.url); got != tc.want {
+				t.Fatalf("fetchableSeriesURL(%q, %q) = %v, want %v", tc.site, tc.url, got, tc.want)
+			}
+		})
+	}
+}