Split backend into internal packages by responsibility

All Go files lived flat in backend/ as one package main. Move store,
latest-chapter polling, sessions, HTTP middleware, the JSON API, the
userscript handler, and the web UI (with its templates/static assets)
into backend/internal/{store,latest,session,httpmw,api,userscript,web},
each with an exported API. main.go becomes the composition root wiring
them into newRouter; root-level tests cover the assembled router while
package-local tests cover unit behavior. Update Dockerfile/.dockerignore
for the new internal/ tree and CLAUDE.md to describe the layout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/Dockerfile

@@ -8,12 +8,11 @@ WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 
-# Then source (changes often).
-# Source plus the go:embed'd assets. Missing either directory turns the embed
-# directive into a build error, so both must be copied before `go build`.
+# Then source (changes often). internal/web carries the go:embed'd
+# templates/static assets — missing them turns the embed directive into a
+# build error, so the whole tree must land before `go build`.
 COPY *.go ./
-COPY templates/ ./templates/
-COPY static/ ./static/
+COPY internal/ ./internal/
 
 # Static binary: pure-Go sqlite means CGO_ENABLED=0 -> no libc dependency.
 # -trimpath + -ldflags strip paths and debug info for a smaller image.