bugfix: proxy /api/* through the SvelteKit container

The compose deploy was unreachable because frontend code reads its
API base from `import.meta.env.VITE_API_BASE` at build time, but the
shipped image baked in the fallback `/api` and never picked up the
`PUBLIC_API_BASE` env var. The browser then hit
http://localhost:3000/api/...which the Node adapter doesn't serve, so
every request 404'd.

Fix the topology at the right layer: hooks.server.ts proxies /api/*
requests through to the backend container over docker's internal
network. The browser only ever talks to :3000, cookies stay
same-origin, and CORS can stay empty.

- frontend/src/hooks.server.ts: new proxy. Reads BACKEND_URL (defaults
  to http://localhost:8080 for ad-hoc node builds). Strips `host` and
  `content-length` so the backend sees the real client request and
  recomputes the length. Sets `duplex: 'half'` for streamed POST
  bodies. GET/HEAD have no body. Non-/api paths fall through to
  SvelteKit normally.
- docker-compose.yml: drop the host port mapping on the backend
  (browser doesn't reach it directly anymore — use `ports:` instead of
  `expose:` if you want curl access). Set BACKEND_URL=http://backend:8080
  on the frontend service. Drop PUBLIC_API_BASE which was unused.
- .env.example: replace PUBLIC_API_BASE with BACKEND_URL, with a note
  on what it does.
- README: explain the new topology in Quick start, update the bot
  curl examples to hit :3000 (since that's the only published port in
  the default deploy), and call out that the TLS terminator only needs
  one upstream now.

Lockstep version bump to 0.9.1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -35,15 +35,21 @@ services:
       MAX_FILE_BYTES: ${MAX_FILE_BYTES:-20971520}
     volumes:
       - storage-data:/var/lib/mangalord/storage
-    ports:
-      - "8080:8080"
+    # No host port mapping in the default setup — the frontend proxies
+    # /api/* through its hooks.server.ts. Expose :8080 only if you want
+    # to hit the API directly from the host (e.g., bot scripts during
+    # development).
+    expose:
+      - "8080"
 
   frontend:
     build: ./frontend
     depends_on:
       - backend
     environment:
-      PUBLIC_API_BASE: ${PUBLIC_API_BASE:-http://localhost:8080/api}
+      # SvelteKit's hooks.server.ts proxies /api/* to this URL so the
+      # browser only ever talks to :3000 and cookies stay same-origin.
+      BACKEND_URL: http://backend:8080
     ports:
       - "3000:3000"