feat: password-gated web UI on the same backend (#1)

Adds a password-gated browser UI for the bookmark list, served by the same Go
binary and container as the userscript API.

## What

- `GET /` — list page, or the login page when there is no session (200, no redirect).
- `POST /login`, `POST /logout` — stateless HMAC session cookie, 60-day Max-Age.
- `GET /ui/list?tab=all|fav`, `POST /ui/bookmarks/{key}/favorite`,
  `POST /ui/bookmarks/{key}/chapter`, `DELETE /ui/bookmarks/{key}` — htmx fragments.
- `GET /static/*` — embedded `style.css`, `htmx.min.js`, `filter.js`.

Mobile-first dark CSS, 2–3 column grid at ≥900px, "Continue reading" strip of the
five most recent series, NEW badge, client-side title search, no build step.

## Stack

Go `html/template` + htmx 2.0.4 (vendored, 50 KB) + plain CSS. No npm, no bundler.
Templates and assets are `go:embed`-ed, so `CGO_ENABLED=0` and the distroless
image still hold.

## Auth

`WEB_PASSWORD` gates the UI; unset means the web routes are never registered and
`/` returns 404. Session cookie is `HttpOnly`, `SameSite=Lax`, `Secure` when the
request is HTTPS. The signing key derives from `API_TOKEN` + `WEB_PASSWORD`, so
rotating either logs every browser out. Login is rate-limited to 10 failures per
20 minutes per client IP, keyed on the **rightmost** `X-Forwarded-For` entry
(Traefik appends the observed peer, so the leftmost is client-spoofable). CGNAT
lockout is a known, accepted limitation — the window self-heals.

## Invariants preserved

- A session cookie never authenticates `/bookmarks*`. That API stays JSON +
  bearer token, unchanged, as does the userscript.
- `Store.Upsert` is byte-for-byte unmodified. Every UI write goes
  read-modify-write through the new `Store.Get`, so the conditional-`updated_at`
  rule (favouriting must not reorder the list, a chapter override must) lives in
  exactly one function.

## Deployment

`docker-compose.prod.yml` gains a second Traefik router on `MANGA_WEB_HOST`
pointing at the same service — one container, one certificate resolver, no second
service. Both `MANGA_API_HOST` and `MANGA_WEB_HOST` are required (`:?`), with no
example fallback in `.env.example`: a placeholder there would make Traefik
silently publish the UI on a domain you do not own. Needs a DNS A/AAAA record for
`manga.<domain>`. See `DEPLOY.md` §1b.

## Docs

- Design: `docs/superpowers/specs/2026-07-25-web-ui-design.md`
- Plan: `plans/2026-07-25-web-ui-implementation-plan.md`

## Verification

`gofmt` clean, `go vet`, `go test -race ./...`, `CGO_ENABLED=0 go build`, a real
`docker build` + curl smoke test, and a Playwright pass covering login
reject/accept, favourite-without-reorder, chapter edit, delete-with-confirm,
search, tab switch + back button, 390px with no horizontal overflow, and zero JS
console errors.

Reviewed-on: #1
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/store_test.go

@@ -34,6 +34,16 @@ func newTestServer(t *testing.T) http.Handler {
 	return newRouter(store, testConfig())
 }
 
+func newTestStore(t *testing.T) *Store {
+	t.Helper()
+	store, err := OpenStore(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("OpenStore: %v", err)
+	}
+	t.Cleanup(func() { store.Close() })
+	return store
+}
+
 func auth(req *http.Request) *http.Request {
 	req.Header.Set("Authorization", "Bearer "+testToken)
 	return req
@@ -433,3 +443,88 @@ func TestOpenStoreMigratesLegacySchema(t *testing.T) {
 	}
 	store2.Close()
 }
+
+func TestStoreGet(t *testing.T) {
+	store := newTestStore(t)
+	if _, err := store.Upsert(Bookmark{
+		Key: "asura:solo", Site: "asura", SeriesID: "solo",
+		Title: "Solo Leveling", LastChapterNum: 45, UpdatedAt: 1000,
+	}); err != nil {
+		t.Fatalf("Upsert: %v", err)
+	}
+
+	got, ok, err := store.Get("asura:solo")
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if !ok {
+		t.Fatal("Get ok = false, want true")
+	}
+	if got.Title != "Solo Leveling" || got.LastChapterNum != 45 {
+		t.Fatalf("Get = %+v, want title/chapter preserved", got)
+	}
+}
+
+func TestStoreGetMissing(t *testing.T) {
+	store := newTestStore(t)
+	_, ok, err := store.Get("asura:nope")
+	if err != nil {
+		t.Fatalf("Get missing returned error %v, want nil", err)
+	}
+	if ok {
+		t.Fatal("Get ok = true for missing key, want false")
+	}
+}
+
+func TestBookmarkHasNewChapter(t *testing.T) {
+	num := func(f float64) *float64 { return &f }
+	cases := []struct {
+		name string
+		b    Bookmark
+		want bool
+	}{
+		{"latest ahead", Bookmark{LastChapterNum: 45, LatestChapterNum: num(47)}, true},
+		{"latest equal", Bookmark{LastChapterNum: 45, LatestChapterNum: num(45)}, false},
+		{"latest behind", Bookmark{LastChapterNum: 45, LatestChapterNum: num(44)}, false},
+		{"latest unknown", Bookmark{LastChapterNum: 45}, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.b.HasNewChapter(); got != tc.want {
+				t.Fatalf("HasNewChapter() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestBookmarkContinueURL(t *testing.T) {
+	cases := []struct {
+		name string
+		b    Bookmark
+		want string
+	}{
+		{"chapter url present", Bookmark{LastChapterURL: "/ch/45", SeriesURL: "/series"}, "/ch/45"},
+		{"falls back to series", Bookmark{SeriesURL: "/series"}, "/series"},
+		{"both empty", Bookmark{}, ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := tc.b.ContinueURL(); got != tc.want {
+				t.Fatalf("ContinueURL() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestLoadConfigWebPassword(t *testing.T) {
+	t.Setenv("API_TOKEN", "token-abc")
+	t.Setenv("WEB_PASSWORD", "hunter2")
+	if got := loadConfig().WebPassword; got != "hunter2" {
+		t.Fatalf("WebPassword = %q, want hunter2", got)
+	}
+
+	t.Setenv("WEB_PASSWORD", "")
+	if got := loadConfig().WebPassword; got != "" {
+		t.Fatalf("WebPassword = %q with the variable unset, want empty", got)
+	}
+}