feat(v3): Caddy hardening, Watchtower, scrape fixes, docs diagrams

- Caddy: custom image with caddy-ratelimit plugin, security headers
  (X-Frame-Options, HSTS, CSP-adjacent, etc.), per-IP rate limiting on
  auth/scrape/global zones, static error pages (502/503/504), fix routing
  to remove /api/scrape/* and /api/chapter-text-preview/* direct-to-backend
  (were bypassing SvelteKit auth middleware)
- docker-compose: Caddy build context + error volume, Watchtower service
  (label-enable mode, 5 min poll), watchtower labels on backend/runner/ui
- Scraper: ScrapeChapterList uses retryGet (9 attempts, Retry-After backoff)
  to fix 429-induced chapter list failures; upTo param stops pagination early
  for range scrapes
- UI: Browse→Catalogue rename (routes, API, links), admin scrape page
  Continue/Retry buttons, +error.svelte branded error page, type cleanup
  (removed dead exports, added BookPreviewMeta/BookPreviewResponse to scraper.ts)
- Meilisearch: meta_updated field, sort=update fix, facet distribution
- Docs: reorganise into docs/d2/ and docs/mermaid/ subdirectories, update
  all diagrams to reflect Caddy/Watchtower/routing changes, add
  api-routing.d2 ownership map with auth-level colour coding, regenerate SVGs

v3/backend/internal/domain/domain.go

@@ -20,6 +20,10 @@ type BookMeta struct {
 	SourceURL     string   `json:"source_url"`
 	Ranking       int      `json:"ranking,omitempty"`
 	Rating        float64  `json:"rating,omitempty"`
+	// MetaUpdated is the Unix timestamp (seconds) when the book record was last
+	// updated in PocketBase. Populated on read; not sent on write (PocketBase
+	// manages its own updated field).
+	MetaUpdated int64 `json:"meta_updated,omitempty"`
 }
 
 // CatalogueEntry is a lightweight book reference returned by catalogue pages.