Split backend into internal packages by responsibility

All Go files lived flat in backend/ as one package main. Move store,
latest-chapter polling, sessions, HTTP middleware, the JSON API, the
userscript handler, and the web UI (with its templates/static assets)
into backend/internal/{store,latest,session,httpmw,api,userscript,web},
each with an exported API. main.go becomes the composition root wiring
them into newRouter; root-level tests cover the assembled router while
package-local tests cover unit behavior. Update Dockerfile/.dockerignore
for the new internal/ tree and CLAUDE.md to describe the layout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -27,13 +27,24 @@ Violentmonkey userscript (isolated world, per-site adapters, localStorage cache)
 ```
 
 - **Backend** (`backend/`): stdlib `net/http` (handful routes, no framework) + `modernc.org/sqlite` (pure Go, `CGO_ENABLED=0` -> static binary -> distroless/scratch image). Reverse proxy terminates TLS; Go service listens plain `:8080`.
+  Single binary, split into packages under `backend/internal/`: `store`
+  (Bookmark type, SQLite persistence, migrations), `latest` (background
+  poller, site parsers, TLS fetcher), `session` (cookie signing, login
+  rate limiter), `httpmw` (Auth/Gzip/CORS middleware), `api` (JSON
+  bookmark handlers), `userscript` (userscript-serving handler), `web`
+  (browser UI handler + `templates/` + `static/`, `go:embed`-ed).
+  `backend/main.go` is the composition root — the only place that wires
+  packages together into `newRouter`. Root-level `*_test.go` hold
+  integration tests that exercise the full router; unit tests for a
+  package live beside it under `internal/`.
 - **Single-user store.** One `bookmarks` table keyed `<site>:<series_id>` (`asura`|`demonic`). Sync **last-write-wins**. Schema and endpoint list in plan.
 - **Endpoints:** `GET /bookmarks`, `PUT /bookmarks/{key}` (upsert; see `updated_at` rule below), `DELETE /bookmarks/{key}`, `GET /healthz` (no auth).
 - **Web UI:** same binary serve password-gated browser UI on second
   hostname — `GET /` (list, or login page when no session),
   `POST /login`, `POST /logout`, `GET /static/*`, htmx fragment endpoints
-  under `/ui/*`. Templates + assets `go:embed`-ed, so `backend/Dockerfile`
-  must copy `templates/` and `static/` plus `*.go`. Sessions stateless
+  under `/ui/*`. Templates + assets `go:embed`-ed under
+  `backend/internal/web/`, so `backend/Dockerfile` must copy the whole
+  `internal/` tree, not just `*.go`. Sessions stateless
   HMAC cookies keyed off `API_TOKEN`; `WEB_PASSWORD` gates them, and when empty,
   web routes not registered at all. UI mutations read-modify-write
   through `Store.Get` + `Store.Upsert` so `updated_at` rule stays one
@@ -43,9 +54,9 @@ Violentmonkey userscript (isolated world, per-site adapters, localStorage cache)
   stylesheet href with `path.resolve(fileDir, href)`, drops directory
   on leading `/` and silently skip file. Relative href don't help
   either: template's directory isn't its served path. So
-  `detect.mjs backend/templates` reports **false clean** — always pass
-  `backend/static` too. One finding there, `overused-font` on "Instrument
-  Serif", deliberate identity choice, not debt.
+  `detect.mjs backend/internal/web/templates` reports **false clean** —
+  always pass `backend/internal/web/static` too. One finding there,
+  `overused-font` on "Instrument Serif", deliberate identity choice, not debt.
 - **Every action that moves series out of list is confirm-gated.**
   Archive, finish, remove each open own `.confirm-row` disclosure
   (`toggleConfirmRow(key, kind)` in `filter.js`, `kind` ∈
@@ -162,7 +173,7 @@ Smoke test: `curl` endpoints with `Authorization: Bearer <token>`; confirm `OPTI
 Web UI + userscript panel follow **Cinder**, rules in `docs/design-system.md`
 — source of truth Claude Design project `mangaBookmark Web UI`
 (`969ac210-fe02-4c01-ae1b-9a271dcc779a`). Read it before touching
-`backend/static/style.css`, `backend/templates/*`, or userscript
+`backend/internal/web/static/style.css`, `backend/internal/web/templates/*`, or userscript
 `TEMPLATE`/`CSS`. Core law: **ember means new chapter only** — no other
 state (busy, error, destruction) may use `--ember`; destruction gets
 `--danger`. No cards/corners/shadows, one `--measure: 760px` column, tokens