feat(userscript): Seed covers panel on MangaBaka series pages

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/PERMISSIONS.md

@@ -15,13 +15,14 @@ Run in this session. Only `worked` rows may appear in a tier, a tool file, or `A
 | `bun install --frozen-lockfile` | worked |
 | `bun test` | worked |
 | `bun run typecheck` (`tsc --noEmit`) | worked |
+| `bun run build` (`build:web`, `build:userscript`) | worked |
 | `bun run start` | worked (local smoke run) |
 
 ## Tiers
 
 | Tier | Commands | Why |
 |---|---|---|
-| Allow | `git status`, `git diff`, `git log`, `git show`, `git branch --list`, `git rev-parse`, `git add`, `git commit`; `bun install --frozen-lockfile`, `bun test`, `bun run typecheck` | Inspection and the dev loop; no prompt needed. |
+| Allow | `git status`, `git diff`, `git log`, `git show`, `git branch --list`, `git rev-parse`, `git add`, `git commit`; `bun install --frozen-lockfile`, `bun test`, `bun run typecheck`, `bun run build` | Inspection and the dev loop; no prompt needed. |
 | Ask | `git push`, `git merge`, `git rebase`, `git switch`, `git restore`, `git commit --amend`, `rm` (any); `bun add`, `bun remove`, `bun update`, `bun upgrade`; `bunx`, `npx` (download and run code, incl. `wrangler deploy`) | Leaves the machine, rewrites work, changes dependencies, or deploys — a human decides. |
 | Deny | `git push --force` / `-f` / `--force-with-lease`, `git reset --hard`, `git clean`, `git add -f` / `--force`, `git commit --no-verify` / `-n`, `rm -r` / `-R` / `-rf` / `-fr` / `-Rf` / `-fR` / `--recursive`, `sudo`; reading `.env`, `.env.*`, `.dev.vars`, `secrets/**` | Destroys work, skips checks, or exposes secrets. |
 

docs/TODO.md

@@ -32,6 +32,9 @@ Design: [specs/001-webtoons-covers.md](specs/001-webtoons-covers.md).
 - [ ] Manual smoke test against Tower of God (9999 / title_no 95).
 - [ ] Update README, `docs/ARCHITECTURE.md` and `PRODUCT.md`/`DESIGN.md` to match reality.
 
+- [ ] Userscript: fill MangaBaka's cover form for users without a token (spec §4.9) — needs the logged-in
+      form's markup and a check that it accepts programmatic input (spec §7.5). The panel offers copy-and-paste instead.
+
 ## Verify with real services (once possible)
 - [ ] Which of our servers and domain hosts it (`MBSEED_PUBLIC_URL`); where the covers folder lives.
 - [ ] Does catbox accept uploads from our server?