Keep cover volume aligned with configured path

docker-compose.yml

@@ -11,7 +11,10 @@
 
 services:
   bookmark-api:
-    build: ./backend
+    build:
+      context: ./backend
+      args:
+        COVER_DIR: ${COVER_DIR:?set COVER_DIR in .env}
     image: bookmarkmanager-backend:latest
     container_name: bookmark-api
     restart: unless-stopped
@@ -26,8 +29,8 @@ services:
       # The bookmarks database. Host is the compose service name; the password
       # comes from .env so it is never committed.
       DATABASE_URL: ${DATABASE_URL:-postgres://bookmarks:${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}@postgres:5432/bookmarks?sslmode=disable}
-      # Required path inside the API. The image seeds ownership at /covers and
-      # the named volume below mounts there; keep COVER_DIR=/covers in .env.
+      # Required path inside the API. The build seeds ownership at this path
+      # and the named volume below mounts there.
       COVER_DIR: ${COVER_DIR:?set COVER_DIR in .env}
       PORT: "8080"
       # Log timestamps only. Go's `log` stamps lines in local time, and this
@@ -84,7 +87,7 @@ services:
       # is why a redeploy always ships the repo's script.
       - ./userscript:/userscript:ro
       # Content-addressed cover bytes survive API restarts and redeploys.
-      - cover-data:/covers
+      - cover-data:${COVER_DIR:?set COVER_DIR in .env}
     # Bound to loopback only: the proxy (or curl during smoke test) reaches it,
     # the public internet does not.
     ports: