Move the browser off the VPS to its own unit (#46)

The headless browser leaves the API stack. It becomes its own compose unit
(chrome/docker-compose.yml) deployed on the home machine and reached over the
tailnet, returning 471 MiB of working set to a 1974 MiB VPS that has no swap.
No fallback sidecar is left behind.

The backend needs no code change: BROWSER_WS_URL was already the only coupling,
so relocation is one environment variable. Its default is now empty rather than
a pinned Docker IP — an unreachable or unconfigured browser degrades exactly as
it always has, with plain-TLS libraries unaffected, kagane and novelfull logged
and skipped, and stored covers still served.

The browser unit publishes CDP on ${BROWSER_BIND_ADDR} with no default, because
CDP authenticates nothing and the home machine has a real LAN: an unset value
must fail the deploy rather than silently expose an endpoint that is remote code
execution for anything that reaches it. Resource limits are sized against the
measured 645 MiB untuned peak and the CI runner that already holds 1.2 GiB of
that box.

bookmark-api gains the default network. Dropping `browser` left it on `db`
alone, which is internal: true — that meant no published port and, worse, no
egress for the poller at all. Caught by bringing the stack up.

Docs: ADR-0006 for the topology, DEPLOY.md §7 for first-time setup of the
browser machine, REDEPLOY.md §8 for its independent update cadence, plus the
architecture diagrams, config tables and troubleshooting rows.

.env.example

@@ -85,29 +85,27 @@ LATEST_CHAPTER_POLL_STAGGER=20s         # delay between fetches in a batch
 # defaults. Beyond that the cadence stretches uniformly rather than breaking;
 # raise BATCH or lower INTERVAL. Keep BATCH x STAGGER under INTERVAL.
 
-# Headless-shell CDP endpoint for sites behind a JavaScript challenge (kagane).
-# Unset disables browser polling; those sites then rely on the userscript alone.
-# Leave commented — the compose files' own default (ws://172.28.0.10:9222) is
-# correct. Do NOT set this to the "headless-shell" DNS name: Chrome's DevTools
-# HTTP handler 500s any /json/version request whose Host header isn't an IP or
-# "localhost", which silently breaks every kagane poll.
-# BROWSER_WS_URL=ws://172.28.0.10:9222
-
-# Clock zone the headless browser reports. A UTC clock is itself the bot
-# signal — Cloudflare treats it as the datacenter default — and kagane's
-# challenge then never clears. Measured 2026-08-08, identical container, one
-# Indonesian egress IP: UTC never cleared in 60s (twice); Asia/Jakarta and
-# America/New_York both cleared in 4s. So any real zone works; it does not
-# have to match the IP's country, it just must not be UTC.
+# CDP endpoint of the browser, used for the two sites behind a Cloudflare
+# JavaScript challenge (kagane, novelfull) and by the web UI's kagane cover
+# proxy. Unset disables browser polling and serves 404 for covers not already
+# stored; those sites then rely on the userscript alone. That is also exactly
+# how an unreachable browser degrades, so a home machine that is off costs
+# chapter freshness and nothing else.
 #
-# Unset falls back to the host's /etc/timezone, which is a real zone whenever
-# the host clock is set to local time. Set this when the host runs UTC — a UTC
-# server is exactly the case that fails. Only the browser sidecar reads it —
-# the backend's own zone is API_TZ below, and is cosmetic.
-# BROWSER_TZ=Asia/Jakarta
+# The browser does NOT run in this stack. It is its own compose unit on the
+# home machine (chrome/docker-compose.yml, chrome/.env.example) and is reached
+# over the tailnet, so set this to that machine's tailnet address:
+#
+#   BROWSER_WS_URL=ws://100.x.y.z:9222
+#
+# It must be the tailnet **IP**, never a MagicDNS hostname and never the old
+# Docker service name: Chrome's DevTools HTTP handler 500s any /json/version
+# request whose Host header isn't an IP or "localhost", which silently breaks
+# every kagane poll. Left unset here on purpose — a wrong default would poll a
+# stranger's address, and "no browser" is a safe, self-announcing state.
+# BROWSER_WS_URL=ws://100.x.y.z:9222
 
-# Zone the backend stamps its log lines in. Cosmetic only — it exists so the
-# API's logs read on the same clock as the browser sidecar's. Nothing else in
+# Zone the backend stamps its log lines in. Cosmetic only. Nothing else in
 # the service has a zone: bookmark timestamps are unix ms, and the two real
 # time columns are timestamptz. Defaults to Asia/Jakarta; set to UTC for the
 # conventional server default.