chore: build, route, and document the web UI

Fix backend/Dockerfile to COPY templates/ and static/ (the go:embed
assets from Tasks 5-7) alongside *.go, plus backend/.dockerignore which
was silently excluding both directories from the build context — the
Dockerfile fix alone still failed the build. Wire WEB_PASSWORD through
docker-compose.yml, add a second Traefik router (mangaweb) plus explicit
service labels on both routers in docker-compose.prod.yml, and document
the new variables and deploy steps in .env.example, DEPLOY.md, and
CLAUDE.md.

docker-compose.prod.yml

@@ -5,6 +5,7 @@
 #
 # Set in .env:
 #   MANGA_API_HOST=manga-api.example.com   # your subdomain (required)
+#   MANGA_WEB_HOST=manga.example.com        # browser UI subdomain, same container
 #   PROXY_NETWORK=proxy                     # Traefik's network name, if not "proxy"
 #   TRAEFIK_ENTRYPOINT=websecure            # your HTTPS entrypoint name
 #   TRAEFIK_CERTRESOLVER=le                 # your ACME/cert resolver name
@@ -26,6 +27,14 @@ services:
       - "traefik.http.routers.mangabm.tls=true"
       - "traefik.http.routers.mangabm.tls.certresolver=${TRAEFIK_CERTRESOLVER:-le}"
       - "traefik.http.services.mangabm.loadbalancer.server.port=8080"
+      # Second hostname for the browser UI, same container. Traefik needs the
+      # service named explicitly once more than one router targets it.
+      - "traefik.http.routers.mangabm.service=mangabm"
+      - "traefik.http.routers.mangaweb.rule=Host(`${MANGA_WEB_HOST:-manga.example.com}`)"
+      - "traefik.http.routers.mangaweb.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}"
+      - "traefik.http.routers.mangaweb.tls=true"
+      - "traefik.http.routers.mangaweb.tls.certresolver=${TRAEFIK_CERTRESOLVER:-le}"
+      - "traefik.http.routers.mangaweb.service=mangabm"
 
 networks:
   proxy: