feat: password-gated web UI on the same backend (#1)

Adds a password-gated browser UI for the bookmark list, served by the same Go
binary and container as the userscript API.

## What

- `GET /` — list page, or the login page when there is no session (200, no redirect).
- `POST /login`, `POST /logout` — stateless HMAC session cookie, 60-day Max-Age.
- `GET /ui/list?tab=all|fav`, `POST /ui/bookmarks/{key}/favorite`,
  `POST /ui/bookmarks/{key}/chapter`, `DELETE /ui/bookmarks/{key}` — htmx fragments.
- `GET /static/*` — embedded `style.css`, `htmx.min.js`, `filter.js`.

Mobile-first dark CSS, 2–3 column grid at ≥900px, "Continue reading" strip of the
five most recent series, NEW badge, client-side title search, no build step.

## Stack

Go `html/template` + htmx 2.0.4 (vendored, 50 KB) + plain CSS. No npm, no bundler.
Templates and assets are `go:embed`-ed, so `CGO_ENABLED=0` and the distroless
image still hold.

## Auth

`WEB_PASSWORD` gates the UI; unset means the web routes are never registered and
`/` returns 404. Session cookie is `HttpOnly`, `SameSite=Lax`, `Secure` when the
request is HTTPS. The signing key derives from `API_TOKEN` + `WEB_PASSWORD`, so
rotating either logs every browser out. Login is rate-limited to 10 failures per
20 minutes per client IP, keyed on the **rightmost** `X-Forwarded-For` entry
(Traefik appends the observed peer, so the leftmost is client-spoofable). CGNAT
lockout is a known, accepted limitation — the window self-heals.

## Invariants preserved

- A session cookie never authenticates `/bookmarks*`. That API stays JSON +
  bearer token, unchanged, as does the userscript.
- `Store.Upsert` is byte-for-byte unmodified. Every UI write goes
  read-modify-write through the new `Store.Get`, so the conditional-`updated_at`
  rule (favouriting must not reorder the list, a chapter override must) lives in
  exactly one function.

## Deployment

`docker-compose.prod.yml` gains a second Traefik router on `MANGA_WEB_HOST`
pointing at the same service — one container, one certificate resolver, no second
service. Both `MANGA_API_HOST` and `MANGA_WEB_HOST` are required (`:?`), with no
example fallback in `.env.example`: a placeholder there would make Traefik
silently publish the UI on a domain you do not own. Needs a DNS A/AAAA record for
`manga.<domain>`. See `DEPLOY.md` §1b.

## Docs

- Design: `docs/superpowers/specs/2026-07-25-web-ui-design.md`
- Plan: `plans/2026-07-25-web-ui-implementation-plan.md`

## Verification

`gofmt` clean, `go vet`, `go test -race ./...`, `CGO_ENABLED=0 go build`, a real
`docker build` + curl smoke test, and a Playwright pass covering login
reject/accept, favourite-without-reorder, chapter edit, delete-with-confirm,
search, tab switch + back button, 390px with no horizontal overflow, and zero JS
console errors.

Reviewed-on: #1
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

DEPLOY.md

@@ -38,8 +38,11 @@ API_TOKEN=<paste output of: openssl rand -hex 32>
 # CORS allowlist — leave as-is unless a site changes hostname.
 ALLOWED_ORIGINS=https://asuracomic.net,https://asurascans.com,https://demonicscans.org
 
-# Required for the Traefik override.
+# Required for the Traefik override. Both have no fallback — compose refuses
+# to start without them. MANGA_WEB_HOST is required even if you never set
+# WEB_PASSWORD; see 1b.
 MANGA_API_HOST=manga-api.violetcrown.my.id
+MANGA_WEB_HOST=manga.violetcrown.my.id
 
 # Only if your Traefik setup differs from these defaults:
 # PROXY_NETWORK=proxy
@@ -60,6 +63,49 @@ grep -E '^API_TOKEN=' .env   # copy this — the userscript needs the same value
 
 ---
 
+## 1b. Web UI
+
+The browser UI is served by the same container on a second hostname.
+
+1. Add a DNS `A`/`AAAA` record for `manga.<yourdomain>` pointing at the server —
+   the same address as `manga-api.<yourdomain>`.
+
+2. Set both variables in `.env`:
+
+   ```ini
+   MANGA_WEB_HOST=manga.violetcrown.my.id
+   WEB_PASSWORD=<paste output of: openssl rand -base64 18>
+   ```
+
+   Generate and insert in one line:
+
+   ```bash
+   sed -i "s|^WEB_PASSWORD=.*|WEB_PASSWORD=$(openssl rand -base64 18)|" .env
+   grep -E '^WEB_PASSWORD=' .env   # this is what you type into the site
+   ```
+
+3. Redeploy and check:
+
+   ```bash
+   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d --build
+   curl -s -o /dev/null -w '%{http_code}\n' https://manga.violetcrown.my.id/
+   ```
+
+   Expected `200`, serving the login page.
+
+Leaving `WEB_PASSWORD` unset is safe: the web routes are not registered and `/`
+returns 404. The userscript's API on `MANGA_API_HOST` is unaffected either way.
+
+`MANGA_WEB_HOST` itself is required by the prod override regardless — like
+`MANGA_API_HOST`, its Traefik label has no fallback, so `docker compose up`
+refuses to start without it even if `WEB_PASSWORD` is unset and the web UI is
+otherwise dormant.
+
+Sessions are signed with a key derived from `API_TOKEN` and `WEB_PASSWORD`, so
+rotating either one logs every browser out. The session cookie lasts 60 days.
+
+---
+
 ## 2. Build + start
 
 ```bash