chore: build, route, and document the web UI

Fix backend/Dockerfile to COPY templates/ and static/ (the go:embed
assets from Tasks 5-7) alongside *.go, plus backend/.dockerignore which
was silently excluding both directories from the build context — the
Dockerfile fix alone still failed the build. Wire WEB_PASSWORD through
docker-compose.yml, add a second Traefik router (mangaweb) plus explicit
service labels on both routers in docker-compose.prod.yml, and document
the new variables and deploy steps in .env.example, DEPLOY.md, and
CLAUDE.md.

CLAUDE.md

@@ -29,8 +29,17 @@ Bromite userscript (isolated world, per-site adapters, localStorage cache)
 - **Backend** (`backend/`): stdlib `net/http` (3 routes, no framework) + `modernc.org/sqlite` (pure Go, `CGO_ENABLED=0` -> static binary -> distroless/scratch image). The reverse proxy terminates TLS; the Go service listens plain `:8080`.
 - **Single-user store.** One `bookmarks` table keyed `<site>:<series_id>` (`asura`|`demonic`). Sync is **last-write-wins**. Schema and endpoint list are in the plan.
 - **Endpoints:** `GET /bookmarks`, `PUT /bookmarks/{key}` (upsert; see `updated_at` rule below), `DELETE /bookmarks/{key}`, `GET /healthz` (no auth).
+- **Web UI:** the same binary serves a password-gated browser UI on a second
+  hostname — `GET /` (list, or login page when there is no session),
+  `POST /login`, `POST /logout`, `GET /static/*`, and htmx fragment endpoints
+  under `/ui/*`. Templates and assets are `go:embed`-ed, so `backend/Dockerfile`
+  must copy `templates/` and `static/` as well as `*.go`. Sessions are stateless
+  HMAC cookies keyed off `API_TOKEN`; `WEB_PASSWORD` gates them and, when empty,
+  the web routes are not registered at all. UI mutations read-modify-write
+  through `Store.Get` + `Store.Upsert` so the `updated_at` rule stays in one
+  place. See `docs/superpowers/specs/2026-07-25-web-ui-design.md`.
 - **`updated_at` drives list order, so it moves only on real reading progress:** the server applies its timestamp when the row is new or `last_chapter_num` changes, and otherwise keeps the stored value — favouriting a series or recording a newly published chapter must not reorder the list. `PUT` therefore returns the row **as stored**, and clients must adopt that response rather than their own payload. See `plans/2026-07-25-bookmark-list-favorites-design.md` §4.
-- **Config via env:** `API_TOKEN`, `ALLOWED_ORIGINS` (comma list), `DB_PATH` (default `/data/bookmarks.db`), `PORT` (default `8080`).
+- **Config via env:** `API_TOKEN`, `ALLOWED_ORIGINS` (comma list), `DB_PATH` (default `/data/bookmarks.db`), `PORT` (default `8080`), `WEB_PASSWORD` (gates the browser UI; unset disables it).
 
 ### Userscript structure (single IIFE, `manga-bookmark.user.js`)