chore: ignore the go build artifact, mark two accepted limitations

`go build ./...` in backend/ emits `backend/backend` (the module is
`mangabm/backend`), but .gitignore only listed `backend/server` — the name
the Dockerfile uses for its container-internal build. The real artifact was
untracked and unignored, and came close to being committed twice. Keeps the
`server` entry, since a local `go build -o server` still matches the
Dockerfile's naming.

Also records two deliberate limitations as `ponytail:` comments so they are
greppable rather than living only in prose:

- latest.go: the poller's Store.Get + Store.Upsert is not wrapped in a
  transaction, so a client PUT committing between the two is lost to the
  stale re-read. Already documented in CLAUDE.md; the marker names the
  upgrade path (wrap in a tx) and the trigger (more than one user). Note
  this now costs a status change, not just read progress.
- web.go: a swapped card stays on screen when its new status no longer
  matches the active tab. The alternative is a full list round trip per
  toggle; the card showing its new state is the feedback that matters.

Comments only — no logic change. Tests pass, CGO_ENABLED=0 builds.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/latest.go

@@ -148,6 +148,13 @@ func (p *latestPoller) checkOne(ctx context.Context, b Bookmark) {
 
 	// Re-read: the row may have been updated or deleted while the fetch was in
 	// flight, and writing b back wholesale would undo that.
+	//
+	// ponytail: non-transactional read-modify-write, wrap Get+Upsert in a tx if
+	// this ever runs for more than one user. A client PUT that commits between
+	// these two statements is lost to the stale re-read — reverting read
+	// progress or a status change, and moving updated_at because the stored
+	// value now differs. Accepted for a single-user deployment: the window is
+	// milliseconds and the loser is one poll cycle.
 	cur, found, err := p.store.Get(b.Key)
 	if err != nil {
 		log.Printf("latest poll %q: reread: %v", b.Key, err)