chore: build, route, and document the web UI

Fix backend/Dockerfile to COPY templates/ and static/ (the go:embed
assets from Tasks 5-7) alongside *.go, plus backend/.dockerignore which
was silently excluding both directories from the build context — the
Dockerfile fix alone still failed the build. Wire WEB_PASSWORD through
docker-compose.yml, add a second Traefik router (mangaweb) plus explicit
service labels on both routers in docker-compose.prod.yml, and document
the new variables and deploy steps in .env.example, DEPLOY.md, and
CLAUDE.md.

.env.example

@@ -16,3 +16,13 @@ ALLOWED_ORIGINS=https://asuracomic.net,https://asurascans.com,https://demonicsca
 # Traefik HTTPS entrypoint + cert resolver names, if yours differ from these.
 # TRAEFIK_ENTRYPOINT=websecure
 # TRAEFIK_CERTRESOLVER=le
+
+# --- Web UI ---
+# Password for the browser UI at https://$MANGA_WEB_HOST. Leave unset to
+# disable the web UI entirely (the routes are not registered at all).
+# Generate one: openssl rand -base64 18
+WEB_PASSWORD=
+
+# Subdomain Traefik routes to the browser UI (prod override only). The same
+# container also answers on MANGA_API_HOST for the userscript's API.
+# MANGA_WEB_HOST=manga.example.com