feat: manga bookmark sync backend + Bromite userscript

Backend (Go, stdlib net/http + modernc.org/sqlite, CGO-free static binary):
- GET/PUT/DELETE /bookmarks{,/key} + /healthz
- bearer auth (constant-time), CORS origin reflection + 204 preflight
- SQLite store keyed <site>:<series_id>, last-write-wins, server-set updated_at
- httptest + temp-sqlite tests (auth, CORS, round-trip); go vet clean
- multi-stage Dockerfile (distroless static nonroot) + compose (base + prod proxy override)

Userscript (single Bromite-compatible IIFE, no GM_* APIs):
- Asura + Demonic adapters, URL-regex ids + og: title/cover
- Shadow-DOM floating UI, localStorage cache, optimistic sync
- auto-progress (no regress) + manual override; framework-agnostic nav watcher

Live-verified adapters (Playwright, 2026-07-24): asurascans.com /comics/<slug-hash>,
demonicscans.org /manga/<slug> + /title/<slug>/chapter/<n> — corrects the plan's
assumed /series/ paths and asuracomic.net domain.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,12 @@
+# Copy to .env and fill in. Never commit the real .env.
+
+# Long random secret shared with the userscript's API_TOKEN. Generate one:
+#   openssl rand -hex 32
+API_TOKEN=changeme-generate-a-long-random-token
+
+# Comma-separated origins allowed to call the API (CORS). Both Asura domains
+# plus Demonic. Add/remove as the sites' hostnames change.
+ALLOWED_ORIGINS=https://asuracomic.net,https://asurascans.com,https://demonicscans.org
+
+# Only needed for the prod override, if your proxy network isn't named "proxy".
+# PROXY_NETWORK=proxy