fix: address final-review findings on the latest-chapter poller

Wires the five poll env vars into docker-compose (the documented kill
switch was inert), skips fetching unknown sites and non-https URLs
before spending a request, and makes runOnce's summary log fire on
empty and cancelled ticks. Records the accepted non-atomic Get+Upsert
window and the one-interval startup delay in the docs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -51,6 +51,11 @@ Bromite userscript (isolated world, per-site adapters, localStorage cache)
   Fetches use `bogdanfinn/tls-client` with a Chrome profile as defence in depth
   against fingerprint-based blocking; any failure logs and skips. See
   `docs/superpowers/specs/2026-07-26-server-latest-chapter-polling-design.md`.
+  The poller's `Store.Get` + `Store.Upsert` is not wrapped in a transaction, so
+  a userscript `PUT` that commits between the two can be overwritten by the
+  poller's stale re-read — reverting that read progress and, since the stored
+  value now differs, moving `updated_at` and reordering the list. This is a
+  known, accepted limitation for a single-user deployment, not a bug to fix.
 - **`updated_at` drives list order, so it moves only on real reading progress:** the server applies its timestamp when the row is new or `last_chapter_num` changes, and otherwise keeps the stored value — favouriting a series or recording a newly published chapter must not reorder the list. `PUT` therefore returns the row **as stored**, and clients must adopt that response rather than their own payload. See `plans/2026-07-25-bookmark-list-favorites-design.md` §4.
 - **Config via env:** `API_TOKEN`, `ALLOWED_ORIGINS` (comma list), `DB_PATH`
   (default `/data/bookmarks.db`), `PORT` (default `8080`), `WEB_PASSWORD`