docs: document the userscript endpoint and its metadata lines

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

DEPLOY.md

@@ -166,6 +166,12 @@ const API_TOKEN = "<same token as .env>";
 The token sits in the userscript's isolated world — the manga sites' JS can't
 read it.
 
+Also edit the `@downloadURL`/`@updateURL` metadata lines near the top of the
+file — they ship hardcoded to this deployment's domain and token, so a
+deployer who skips them ends up auto-updating from someone else's backend.
+See "Installing / updating the userscript" below for how those two lines are
+used.
+
 ---
 
 ## 5. Install on Bromite
@@ -224,6 +230,9 @@ Backend config reference and endpoint list: see `README.md`.
 ## Installing / updating the userscript
 
 The backend serves the script itself, so Violentmonkey can auto-update it.
+Complements §4 above — that step points `API_BASE`/`API_TOKEN` at your
+backend; this one points `@downloadURL`/`@updateURL` at the same place so
+auto-updates come from it too.
 
 Install once, on the phone (Cromite + Violentmonkey):