feat: manga bookmark sync backend + Bromite userscript

Backend (Go, stdlib net/http + modernc.org/sqlite, CGO-free static binary):
- GET/PUT/DELETE /bookmarks{,/key} + /healthz
- bearer auth (constant-time), CORS origin reflection + 204 preflight
- SQLite store keyed <site>:<series_id>, last-write-wins, server-set updated_at
- httptest + temp-sqlite tests (auth, CORS, round-trip); go vet clean
- multi-stage Dockerfile (distroless static nonroot) + compose (base + prod proxy override)

Userscript (single Bromite-compatible IIFE, no GM_* APIs):
- Asura + Demonic adapters, URL-regex ids + og: title/cover
- Shadow-DOM floating UI, localStorage cache, optimistic sync
- auto-progress (no regress) + manual override; framework-agnostic nav watcher

Live-verified adapters (Playwright, 2026-07-24): asurascans.com /comics/<slug-hash>,
demonicscans.org /manga/<slug> + /title/<slug>/chapter/<n> — corrects the plan's
assumed /series/ paths and asuracomic.net domain.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/Dockerfile

@@ -0,0 +1,31 @@
+# syntax=docker/dockerfile:1
+
+# --- build stage: compile a static, CGO-free binary ---
+FROM golang:1.23-alpine AS build
+WORKDIR /src
+
+# Dependencies first for layer caching (changes rarely).
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Then source (changes often).
+COPY *.go ./
+
+# Static binary: pure-Go sqlite means CGO_ENABLED=0 -> no libc dependency.
+# -trimpath + -ldflags strip paths and debug info for a smaller image.
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/server .
+
+# Data dir with the runtime user's ownership so the mounted volume inherits it.
+RUN mkdir -p /out/data
+
+# --- runtime stage: distroless static, non-root ---
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
+COPY --from=build /out/server /server
+COPY --from=build --chown=65532:65532 /out/data /data
+
+VOLUME ["/data"]
+EXPOSE 8080
+USER nonroot:nonroot
+ENV DB_PATH=/data/bookmarks.db PORT=8080
+ENTRYPOINT ["/server"]