chore: ignore the go build artifact, mark two accepted limitations

`go build ./...` in backend/ emits `backend/backend` (the module is
`mangabm/backend`), but .gitignore only listed `backend/server` — the name
the Dockerfile uses for its container-internal build. The real artifact was
untracked and unignored, and came close to being committed twice. Keeps the
`server` entry, since a local `go build -o server` still matches the
Dockerfile's naming.

Also records two deliberate limitations as `ponytail:` comments so they are
greppable rather than living only in prose:

- latest.go: the poller's Store.Get + Store.Upsert is not wrapped in a
  transaction, so a client PUT committing between the two is lost to the
  stale re-read. Already documented in CLAUDE.md; the marker names the
  upgrade path (wrap in a tx) and the trigger (more than one user). Note
  this now costs a status change, not just read progress.
- web.go: a swapped card stays on screen when its new status no longer
  matches the active tab. The alternative is a full list round trip per
  toggle; the card showing its new state is the feedback that matters.

Comments only — no logic change. Tests pass, CGO_ENABLED=0 builds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -3,6 +3,7 @@
 *.db-shm
 *.db-wal
 backend/server
+backend/backend
 .playwright-mcp/
 graphify-out/
 plans/