chore: build, route, and document the web UI

Fix backend/Dockerfile to COPY templates/ and static/ (the go:embed
assets from Tasks 5-7) alongside *.go, plus backend/.dockerignore which
was silently excluding both directories from the build context — the
Dockerfile fix alone still failed the build. Wire WEB_PASSWORD through
docker-compose.yml, add a second Traefik router (mangaweb) plus explicit
service labels on both routers in docker-compose.prod.yml, and document
the new variables and deploy steps in .env.example, DEPLOY.md, and
CLAUDE.md.

DEPLOY.md

@@ -60,6 +60,44 @@ grep -E '^API_TOKEN=' .env   # copy this — the userscript needs the same value
 
 ---
 
+## 1b. Web UI
+
+The browser UI is served by the same container on a second hostname.
+
+1. Add a DNS `A`/`AAAA` record for `manga.<yourdomain>` pointing at the server —
+   the same address as `manga-api.<yourdomain>`.
+
+2. Set both variables in `.env`:
+
+   ```ini
+   MANGA_WEB_HOST=manga.violetcrown.my.id
+   WEB_PASSWORD=<paste output of: openssl rand -base64 18>
+   ```
+
+   Generate and insert in one line:
+
+   ```bash
+   sed -i "s|^WEB_PASSWORD=.*|WEB_PASSWORD=$(openssl rand -base64 18)|" .env
+   grep -E '^WEB_PASSWORD=' .env   # this is what you type into the site
+   ```
+
+3. Redeploy and check:
+
+   ```bash
+   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
+   curl -s -o /dev/null -w '%{http_code}\n' https://manga.violetcrown.my.id/
+   ```
+
+   Expected `200`, serving the login page.
+
+Leaving `WEB_PASSWORD` unset is safe: the web routes are not registered and `/`
+returns 404. The userscript's API on `MANGA_API_HOST` is unaffected either way.
+
+Sessions are signed with a key derived from `API_TOKEN`, so rotating the token
+logs every browser out. The session cookie lasts 60 days.
+
+---
+
 ## 2. Build + start
 
 ```bash