fix: address issues found in end-to-end verification

Chained defects made the kagane browser-fetch path completely non-functional
in Docker Compose: headless-shell's compose command re-declared
--remote-debugging-port, colliding with the image's own entrypoint/socat
proxy (EOF on every dial); the sidecar was then only reachable by Docker DNS
name, which Chrome's DevTools HTTP handler rejects with a 500
(Host-header/DNS-rebinding check); and NewBrowserFetcher's NoModifyURL option
skipped /json/version discovery entirely, dialing a bare host:port that
Chrome 404s since /devtools/browser/<uuid> is minted fresh per Chrome start.
Fixed by trimming the redundant command flags, pinning headless-shell to a
static IP so BROWSER_WS_URL can name it directly, and removing NoModifyURL so
chromedp's discovery (which echoes the request's Host back into
webSocketDebuggerUrl) does the right thing on its own.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yml

@@ -31,7 +31,13 @@ services:
       LATEST_CHAPTER_POLL_STAGGER: ${LATEST_CHAPTER_POLL_STAGGER:-20s}
       # CDP endpoint for sites behind a JavaScript challenge (kagane). Unset
       # disables browser polling for those sites; the userscript still covers them.
-      BROWSER_WS_URL: ${BROWSER_WS_URL:-ws://headless-shell:9222}
+      # Must be an IP, not the "headless-shell" DNS name: Chrome's DevTools HTTP
+      # handler rejects the discovery request (GET /json/version) with a 500
+      # unless the Host header is an IP address or "localhost" — confirmed
+      # 2026-08-03 against chromedp/headless-shell:stable, independent of
+      # chromedp's own dial logic. The sidecar's static address below exists so
+      # this URL survives container recreation.
+      BROWSER_WS_URL: ${BROWSER_WS_URL:-ws://172.28.0.10:9222}
     depends_on:
       - headless-shell
     volumes:
@@ -58,13 +64,22 @@ services:
     init: true
     # Deliberately no `ports:` — an exposed CDP endpoint is remote code
     # execution. Only manga-api, via the `browser` network below, may reach it.
+    # Don't pass --remote-debugging-address/--remote-debugging-port here: the
+    # image's own entrypoint (/headless-shell/run.sh) already starts Chrome on
+    # 127.0.0.1:9223 and fronts it with a socat proxy listening on 0.0.0.0:9222.
+    # Redeclaring the port flag here overrides Chrome's, so it binds 9222
+    # directly (IPv6 loopback only) instead of 9223 — collides with socat's own
+    # bind on 9222 and leaves nothing listening on 9223, so every external
+    # connection to headless-shell:9222 fails with EOF. Only pass flags the
+    # entrypoint doesn't already set.
     command:
-      - --remote-debugging-address=0.0.0.0
-      - --remote-debugging-port=9222
       - --disable-gpu
       - --no-sandbox
     networks:
-      - browser
+      browser:
+        # Pinned so BROWSER_WS_URL can name an IP (required, see above) that
+        # survives `docker compose up` recreating this container.
+        ipv4_address: 172.28.0.10
 
 volumes:
   bookmarks-data:
@@ -74,3 +89,6 @@ networks:
   # kagane.to. Isolation here comes from membership (only manga-api and
   # headless-shell join it), not from cutting egress.
   browser:
+    ipam:
+      config:
+        - subnet: 172.28.0.0/24