feat(v3): Caddy hardening, Watchtower, scrape fixes, docs diagrams

- Caddy: custom image with caddy-ratelimit plugin, security headers
  (X-Frame-Options, HSTS, CSP-adjacent, etc.), per-IP rate limiting on
  auth/scrape/global zones, static error pages (502/503/504), fix routing
  to remove /api/scrape/* and /api/chapter-text-preview/* direct-to-backend
  (were bypassing SvelteKit auth middleware)
- docker-compose: Caddy build context + error volume, Watchtower service
  (label-enable mode, 5 min poll), watchtower labels on backend/runner/ui
- Scraper: ScrapeChapterList uses retryGet (9 attempts, Retry-After backoff)
  to fix 429-induced chapter list failures; upTo param stops pagination early
  for range scrapes
- UI: Browse→Catalogue rename (routes, API, links), admin scrape page
  Continue/Retry buttons, +error.svelte branded error page, type cleanup
  (removed dead exports, added BookPreviewMeta/BookPreviewResponse to scraper.ts)
- Meilisearch: meta_updated field, sort=update fix, facet distribution
- Docs: reorganise into docs/d2/ and docs/mermaid/ subdirectories, update
  all diagrams to reflect Caddy/Watchtower/routing changes, add
  api-routing.d2 ownership map with auth-level colour coding, regenerate SVGs

v3/docker-compose.yml

@@ -8,8 +8,8 @@ x-infra-env: &infra-env
   MINIO_ACCESS_KEY: "${MINIO_ROOT_USER:-admin}"
   MINIO_SECRET_KEY: "${MINIO_ROOT_PASSWORD:-changeme123}"
   MINIO_USE_SSL: "false"
-  MINIO_PUBLIC_ENDPOINT: "${MINIO_PUBLIC_ENDPOINT:-}"
-  MINIO_PUBLIC_USE_SSL: "${MINIO_PUBLIC_USE_SSL:-false}"
+  MINIO_PUBLIC_ENDPOINT: "${MINIO_PUBLIC_ENDPOINT:-localhost}"
+  MINIO_PUBLIC_USE_SSL: "${MINIO_PUBLIC_USE_SSL:-true}"
   # PocketBase
   POCKETBASE_URL: "http://pocketbase:8090"
   POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL:-admin@libnovel.local}"
@@ -53,7 +53,7 @@ services:
         mc alias set local http://minio:9000 $${MINIO_ROOT_USER:-admin} $${MINIO_ROOT_PASSWORD:-changeme123};
         mc mb --ignore-existing local/libnovel-chapters;
         mc mb --ignore-existing local/libnovel-audio;
-        mc mb --ignore-existing local/libnovel-avatars;
+        mc mb --ignore-existing local/avatars;
         mc mb --ignore-existing local/libnovel-browse;
         echo 'buckets ready';
       "
@@ -135,6 +135,8 @@ services:
       args:
         VERSION: "${GIT_TAG:-dev}"
         COMMIT: "${GIT_COMMIT:-unknown}"
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
     restart: unless-stopped
     stop_grace_period: 35s
     depends_on:
@@ -170,6 +172,8 @@ services:
       args:
         VERSION: "${GIT_TAG:-dev}"
         COMMIT: "${GIT_COMMIT:-unknown}"
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
     restart: unless-stopped
     stop_grace_period: 135s
     depends_on:
@@ -215,6 +219,8 @@ services:
       args:
         BUILD_VERSION: "${GIT_TAG:-dev}"
         BUILD_COMMIT: "${GIT_COMMIT:-unknown}"
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
     restart: unless-stopped
     stop_grace_period: 35s
     depends_on:
@@ -238,7 +244,7 @@ services:
       POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL:-admin@libnovel.local}"
       POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD:-changeme123}"
       AUTH_SECRET: "${AUTH_SECRET:-dev_secret_change_in_production}"
-      PUBLIC_MINIO_PUBLIC_URL: "${MINIO_PUBLIC_ENDPOINT:-http://localhost:9000}"
+      PUBLIC_MINIO_PUBLIC_URL: "${MINIO_PUBLIC_ENDPOINT:-https://localhost}"
       # Valkey
       VALKEY_ADDR: "valkey:6379"
     healthcheck:
@@ -248,8 +254,11 @@ services:
       retries: 3
 
   # ─── Caddy (reverse proxy + automatic HTTPS) ──────────────────────────────────
+  # Custom build includes github.com/mholt/caddy-ratelimit.
   caddy:
-    image: caddy:2-alpine
+    build:
+      context: ./caddy
+      dockerfile: Dockerfile
     restart: unless-stopped
     depends_on:
       backend:
@@ -265,9 +274,24 @@ services:
       CADDY_ACME_EMAIL: "${CADDY_ACME_EMAIL:-}"
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - ./caddy/errors:/srv/errors:ro
       - caddy_data:/data
       - caddy_config:/config
 
+  # ─── Watchtower (auto-redeploy custom services on new images) ────────────────
+  # Only watches services labelled com.centurylinklabs.watchtower.enable=true.
+  # Third-party infra images (minio, pocketbase, meilisearch, etc.) are excluded.
+  watchtower:
+    image: containrrr/watchtower:latest
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    command: --label-enable --interval 300 --cleanup
+    environment:
+      WATCHTOWER_NOTIFICATIONS: "${WATCHTOWER_NOTIFICATIONS:-}"
+      WATCHTOWER_NOTIFICATION_URL: "${WATCHTOWER_NOTIFICATION_URL:-}"
+      DOCKER_API_VERSION: "1.44"
+
 volumes:
   minio_data:
   pb_data: