fix: keep MANGA_WEB_HOST unset in .env.example and make no-op saves inert

Re-review of the fix wave found the .env.example edit defeated the fix
it belonged to: shipping MANGA_WEB_HOST=manga.example.com re-supplied
the value that ${MANGA_WEB_HOST:?} exists to reject, so a fresh
`cp .env.example .env` started fine and Traefik published the UI router
on a domain the operator does not own. Left commented, matching
MANGA_API_HOST; DEPLOY.md 1 now lists it among the required variables.

Also:
- uiChapter leaves last_chapter too, not only last_chapter_url, when the
  submitted number is unchanged. It used to rewrite the display string
  ("45.0" to "45") behind a frozen updated_at.
- Design spec 4.2 documents the two-secret key derivation.
- Corrected the pruneLocked aliasing rationale and the stale
  sessionKeyPurpose comment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/web_test.go

@@ -357,14 +357,16 @@ func TestChapterOverrideNoOpPreservesURLAndUpdatedAt(t *testing.T) {
 	srv, store := newWebTestServer(t, cfg)
 	before := seed(t, store, Bookmark{
 		Key: "asura:solo", Site: "asura", SeriesID: "solo",
-		Title: "Solo Leveling", LastChapter: "45", LastChapterNum: 45,
+		Title: "Solo Leveling", LastChapter: "45.0", LastChapterNum: 45,
 		LastChapterURL: "https://example.test/ch/45", SeriesURL: "https://example.test/solo",
 		UpdatedAt: 1_000_000,
 	})
 
 	// The chapter form is pre-filled with the current value, so tapping Save
-	// without editing resubmits the unchanged number. That must be a no-op:
-	// it must not silently clear last_chapter_url or move updated_at.
+	// without editing resubmits the unchanged number. That must be a no-op: it
+	// must not clear last_chapter_url, rewrite the last_chapter display string,
+	// or move updated_at. The seed stores "45.0" against 45 so the display
+	// string differs from what the form submits back.
 	rr := httptest.NewRecorder()
 	srv.ServeHTTP(rr, uiRequest(t, cfg, http.MethodPost,
 		"/ui/bookmarks/asura:solo/chapter", url.Values{"chapter": {"45"}}))
@@ -380,6 +382,10 @@ func TestChapterOverrideNoOpPreservesURLAndUpdatedAt(t *testing.T) {
 		t.Fatalf("LastChapterURL = %q, want preserved %q on a no-op save",
 			after.LastChapterURL, before.LastChapterURL)
 	}
+	if after.LastChapter != before.LastChapter {
+		t.Fatalf("LastChapter = %q, want preserved %q on a no-op save",
+			after.LastChapter, before.LastChapter)
+	}
 	if after.UpdatedAt != before.UpdatedAt {
 		t.Fatalf("UpdatedAt = %d, want unchanged %d on a no-op save",
 			after.UpdatedAt, before.UpdatedAt)