fix: keep MANGA_WEB_HOST unset in .env.example and make no-op saves inert

Re-review of the fix wave found the .env.example edit defeated the fix
it belonged to: shipping MANGA_WEB_HOST=manga.example.com re-supplied
the value that ${MANGA_WEB_HOST:?} exists to reject, so a fresh
`cp .env.example .env` started fine and Traefik published the UI router
on a domain the operator does not own. Left commented, matching
MANGA_API_HOST; DEPLOY.md 1 now lists it among the required variables.

Also:
- uiChapter leaves last_chapter too, not only last_chapter_url, when the
  submitted number is unchanged. It used to rewrite the display string
  ("45.0" to "45") behind a frozen updated_at.
- Design spec 4.2 documents the two-secret key derivation.
- Corrected the pruneLocked aliasing rationale and the stale
  sessionKeyPurpose comment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

DEPLOY.md

@@ -38,8 +38,11 @@ API_TOKEN=<paste output of: openssl rand -hex 32>
 # CORS allowlist — leave as-is unless a site changes hostname.
 ALLOWED_ORIGINS=https://asuracomic.net,https://asurascans.com,https://demonicscans.org
 
-# Required for the Traefik override.
+# Required for the Traefik override. Both have no fallback — compose refuses
+# to start without them. MANGA_WEB_HOST is required even if you never set
+# WEB_PASSWORD; see 1b.
 MANGA_API_HOST=manga-api.violetcrown.my.id
+MANGA_WEB_HOST=manga.violetcrown.my.id
 
 # Only if your Traefik setup differs from these defaults:
 # PROXY_NETWORK=proxy