Move the browser off the VPS to its own unit (#46)

The headless browser leaves the API stack. It becomes its own compose unit
(chrome/docker-compose.yml) deployed on the home machine and reached over the
tailnet, returning 471 MiB of working set to a 1974 MiB VPS that has no swap.
No fallback sidecar is left behind.

The backend needs no code change: BROWSER_WS_URL was already the only coupling,
so relocation is one environment variable. Its default is now empty rather than
a pinned Docker IP — an unreachable or unconfigured browser degrades exactly as
it always has, with plain-TLS libraries unaffected, kagane and novelfull logged
and skipped, and stored covers still served.

The browser unit publishes CDP on ${BROWSER_BIND_ADDR} with no default, because
CDP authenticates nothing and the home machine has a real LAN: an unset value
must fail the deploy rather than silently expose an endpoint that is remote code
execution for anything that reaches it. Resource limits are sized against the
measured 645 MiB untuned peak and the CI runner that already holds 1.2 GiB of
that box.

bookmark-api gains the default network. Dropping `browser` left it on `db`
alone, which is internal: true — that meant no published port and, worse, no
egress for the poller at all. Caught by bringing the stack up.

Docs: ADR-0006 for the topology, DEPLOY.md §7 for first-time setup of the
browser machine, REDEPLOY.md §8 for its independent update cadence, plus the
architecture diagrams, config tables and troubleshooting rows.

backend/internal/latest/browser.go

@@ -53,19 +53,22 @@ var kaganeImageIDRe = regexp.MustCompile(`^[0-9a-f-]{36}$`)
 type BrowserFetcher struct {
 	allocCtx context.Context
 	cancel   context.CancelFunc
-	// One page at a time: caps the sidecar's memory and keeps series from
-	// sharing page state.
+	// One page at a time: caps the browser's memory — it runs under a hard
+	// cgroup cap on a shared machine — and keeps series from sharing page state.
 	mu sync.Mutex
 }
 
 var _ Fetcher = (*BrowserFetcher)(nil)
 
-// NewBrowserFetcher connects to a headless-shell over CDP. wsURL must name the
-// sidecar by IP, e.g. ws://172.28.0.10:9222 — not by Docker DNS name. Chrome's
-// DevTools HTTP handler 500s any /json/version request whose Host header
-// isn't an IP or "localhost" (confirmed 2026-08-03 against
-// chromedp/headless-shell:stable), so the compose network pins the sidecar's
-// address for this to resolve at all.
+// NewBrowserFetcher connects to a Chrome over CDP. The browser is not a
+// sidecar: it runs on a separate machine and is reached over the tailnet
+// (ADR-0006), so wsURL is that machine's tailnet address, e.g.
+// ws://100.64.0.5:9222.
+//
+// It must be an IP, never a hostname — not MagicDNS, not a Docker service
+// name. Chrome's DevTools HTTP handler 500s any /json/version request whose
+// Host header isn't an IP or "localhost" (confirmed 2026-08-03), so a name
+// fails at discovery and surfaces as a dead site rather than a bad URL.
 //
 // Do not add chromedp.NoModifyURL here: that option skips the /json/version
 // discovery request entirely and dials wsURL as if it were already the full
@@ -73,8 +76,10 @@ var _ Fetcher = (*BrowserFetcher)(nil)
 // /devtools/browser/<uuid>, a path chosen fresh at every Chrome start — dialing
 // the bare host:port 404s. The default (discovery) path works precisely
 // because Chrome's /json/version response echoes back the Host header of the
-// discovery request in webSocketDebuggerUrl, so as long as wsURL is a
-// container-reachable IP, the URL chromedp gets back already points at it.
+// discovery request in webSocketDebuggerUrl, so as long as wsURL is an IP this
+// process can reach, the URL chromedp gets back already points at it. That is
+// also why a Chrome restarted behind a stable endpoint needs no reconnect
+// here: the fresh UUID arrives with the next discovery.
 func NewBrowserFetcher(wsURL string) (*BrowserFetcher, error) {
 	if wsURL == "" {
 		return nil, fmt.Errorf("empty browser websocket url")

backend/internal/latest/smoke_image_test.go

@@ -9,11 +9,14 @@ import (
 )
 
 // TestSmokeKaganeImage is the live proof that the cover proxy's fetch actually
-// clears Cloudflare and returns image bytes. It needs a real headless Chrome
+// clears Cloudflare and returns image bytes. It needs the real browser unit
 // with outbound network, so it runs only when SMOKE_BROWSER_WS_URL is set:
 //
-//	docker run --rm --shm-size=1gb -p 19222:9222 chromedp/headless-shell:stable
-//	SMOKE_BROWSER_WS_URL=ws://127.0.0.1:19222 go test -run TestSmokeKaganeImage ./internal/latest
+//	cd chrome && BROWSER_BIND_ADDR=127.0.0.1 docker compose up -d --build
+//	SMOKE_BROWSER_WS_URL=ws://127.0.0.1:9222 go test -run TestSmokeKaganeImage ./internal/latest
+//
+// Not chromedp/headless-shell: its challenge never clears (see chrome/Dockerfile),
+// so a red run there proves nothing about kagane.
 func TestSmokeKaganeImage(t *testing.T) {
 	ws := os.Getenv("SMOKE_BROWSER_WS_URL")
 	if ws == "" {