chore: drop asuracomic.net from the userscript, CORS allowlist and docs (#97)

Closes #96.

## What

Removes every reference that still invites a Reader onto `asuracomic.net`.
The domain's deep links 301 to the `asurascans.com` **root**, discarding the
path (re-checked 2026-07-25), so a page on it never yields a series document
client-side and a stored address on it never yields a series page server-side.
#95 already pinned each Site to one hostname, so the backend rejects such an
address cleanly; this is the cleanup around that.

| File | Change |
|---|---|
| `userscript/manga-bookmark.user.js` | drops the `@match`, narrows the asura adapter to `/(^\|\.)asurascans\.com$/` |
| `userscript/test/logic.test.js` | new test pinning the narrowed host match |
| `.env.example`, `docker-compose.yml` | origin dropped from the `ALLOWED_ORIGINS` default |
| `DEPLOY.md` | same, and the sample list gains the two novel origins it was missing |
| `backend/api_test.go` | CORS fixtures and round-trip seed move to `asurascans.com` |
| `README.md`, `AGENTS.md` | notes say the host is dropped, not "stays matched" |

## Behaviour

- A Reader landing on `asuracomic.net` gets no userscript UI. Previously the
  script loaded and could do nothing useful — the redirect had already
  discarded the path.
- A request whose `Origin` is `https://asuracomic.net` is no longer reflected
  by a deployment using the shipped defaults.
- No backend logic changed: the CORS rule, the address gate and the poller are
  untouched. `AllowedOrigins` is data, not code.

## Security invariant preserved

CORS still reflects `Origin` only when it appears in `ALLOWED_ORIGINS`, with
`GET,PUT,DELETE,OPTIONS` and a `204` preflight — `TestCORSPreflight` and
`TestCORSDisallowedOrigin` still pin both halves, now against a live origin.
This change only removes a value from the allowlist, which is a narrowing.

## Verification

- `go test ./...` — full backend suite green (real Postgres per package).
- `node --test test/*.test.js` — 66/66 green, up one from the new match test.

## Deploy note (does not happen on merge)

The live allowlist comes from the VPS `.env`, not from these defaults, so the
origin must be dropped there in the same deploy. The one-off row repair for any
stored `asuracomic.net` address is in #96.

Reviewed-on: #97
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

README.md

@@ -1,6 +1,6 @@
 # Manga Bookmark
 
-Track manga read-progress on **asurascans.com** (a.k.a. asuracomic.net),
+Track manga read-progress on **asurascans.com**,
 **demonicscans.org**, **comix.to**, and **kagane.to** from a phone (Bromite /
 mobile Chromium), synced to a self-hosted Go backend so bookmarks unify across
 all four sites and all devices.
@@ -274,11 +274,12 @@ the backend acquires, stores and serves every Cover from its own origin
 | **Kagane** (`kagane.to`) | `/series/<uuid>` | `/series/<uuid>/reader/<bookUuid>` | `<uuid>` |
 
 Notes:
-- **`asuracomic.net` deep links are dead (re-checked 2026-07-25).** They 301 to
-  the `asurascans.com` **root**, discarding the path, at the edge — before the
-  userscript gets a document — so nothing client-side can rescue them. Reach
-  series through `asurascans.com`. The host stays matched in case the redirect
-  starts preserving paths again.
+- **`asuracomic.net` is no longer matched (deep links dead, re-checked
+  2026-07-25).** They 301 to the `asurascans.com` **root**, discarding the path,
+  at the edge — before the userscript gets a document — so nothing client-side
+  can rescue them. The backend rejects stored addresses on that host too, since
+  the poller pins each Site to one hostname. Reach series through
+  `asurascans.com`.
 - Asura `og:title` carries a `Chapter N - Read Online \| Asura Scans` suffix that
   the adapter strips; Demonic chapter `og:title` is `<Title> Chapter N`.
 - Demonic's `<slug>` is identical on `/manga/…` and the canonical `/title/…`