chore: drop asuracomic.net from the userscript, CORS allowlist and docs (#96)

The old domain's deep links 301 to the asurascans.com root, discarding the
path, so a page on it never yields a series document and a stored address on
it never yields a series page. #94 pinned each Site to one hostname, which
already rejects such an address server-side; this removes the remaining
references so nothing invites a Reader onto the dead host.

Live deploys still carry the origin in their own .env and must drop it there
too - the allowlist is read from the environment, not from these defaults.

userscript/manga-bookmark.user.js

@@ -6,7 +6,6 @@
 // @author       you
 // @downloadURL  https://bookmark-api.violetcrown.my.id/u/__API_TOKEN__/manga-bookmark.user.js
 // @updateURL    https://bookmark-api.violetcrown.my.id/u/__API_TOKEN__/manga-bookmark.user.js
-// @match        https://asuracomic.net/*
 // @match        https://asurascans.com/*
 // @match        https://demonicscans.org/*
 // @match        https://comix.to/*
@@ -112,12 +111,10 @@
 
   const asura = {
     site: "asura",
-    // asuracomic.net deep links 301 to the asurascans.com *root*, dropping the
-    // path, and that happens at the edge before this script gets a document —
-    // so those URLs cannot be handled here at all (checked 2026-07-25). It stays
-    // matched in case the redirect starts preserving paths again; until then,
-    // reach series through asurascans.com.
-    matches: (loc) => /(^|\.)asurascans\.com$|(^|\.)asuracomic\.net$/.test(loc.hostname),
+    // asuracomic.net is not matched: its deep links 301 to the asurascans.com
+    // *root* at the edge, discarding the path, so this script never sees a
+    // series document there (re-checked 2026-07-25).
+    matches: (loc) => /(^|\.)asurascans\.com$/.test(loc.hostname),
     detect(loc) {
       const path = loc.pathname;
       // /comics/<slug-hash>/chapter/<n>

userscript/test/logic.test.js

@@ -120,6 +120,14 @@ test("asura.detect returns other for non-series paths", () => {
   assert.equal(asura.detect(loc("https://asurascans.com/bookmarks")).type, "other");
 });
 
+test("asura.matches accepts only asurascans.com", () => {
+  assert.equal(asura.matches({ hostname: "asurascans.com" }), true);
+  assert.equal(asura.matches({ hostname: "www.asurascans.com" }), true);
+  // Dead domain: deep links 301 to the asurascans.com root, discarding the path.
+  assert.equal(asura.matches({ hostname: "asuracomic.net" }), false);
+  assert.equal(asura.matches({ hostname: "asurascans.com.evil.example" }), false);
+});
+
 test("asura.latestChapterFromAnchors takes the highest and skips the First Chapter shortcut", () => {
   const best = asura.latestChapterFromAnchors([
     { href: "/comics/solo-leveling-059befe1/chapter/1", text: "Chapter 1" },