Fold the sentinel into the scraper and drop the sentinel service (BL-0046)

The stall watchdog now runs inside the scraper (ScraperService.checkStalls,
every 30 s from the work loop): same rule as before, one checkpoint-safe
restart, quarantine on the second stall, missing checkpoint is no evidence,
and paused time no longer counts. Stalls are recorded as scraper incidents
(failure.kind 'stall'). The private /api/recovery endpoint is gone.

Dropped with the service: reader/scraper-unreachable incidents (supervisor
and Docker handle crashes; the health page shows "Scraper: unreachable"),
duplicate job-failure incidents and the unused /metrics endpoint.
The stack is now reader + scraper (+ optional peer-gateway).
The supervisor test moved to runtime/test (npm run test:runtime stays).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -2,8 +2,8 @@
 
 MangaCircus is a self-hosted reader for manga, comics and webtoons. The reader owns
 accounts/progress and a separate collection catalog. The scraper owns the persistent
-queue and chapter publication. Sentinel observes health/progress and requests bounded
-checkpoint recovery. Separate supervisors isolate service failures. All content remains
+queue and chapter publication, and its built-in stall watchdog requeues a stuck job
+once at a checkpoint. Separate supervisors isolate service failures. All content remains
 a plain folder tree; there is no database server or embedded autonomous LLM.
 
 Related documents:
@@ -48,12 +48,12 @@ Related documents:
 
 ## 3. Components
 
-Runtime topology (2026-10-05): native `tools/start-all.js` launches reader, scraper and
-Sentinel independently. In Compose, each container runs `runtime/launch.js <service>`
+Runtime topology (2026-10-22): native `tools/start-all.js` launches reader and scraper
+independently. In Compose, each container runs `runtime/launch.js <service>`
 and exactly one service child. A failure does not stop unrelated services. Exactly one
 reader and queue-owning scraper may write each shared state tree; do not scale replicas.
-The catalog and relation store is reader-owned `data/catalog.json`. Sentinel writes only
-`data/sentinel/`; it has no Docker socket or arbitrary code-repair authority.
+The catalog and relation store is reader-owned `data/catalog.json`. No service has a
+Docker socket or arbitrary code-repair authority.
 
 The admin browser never talks to the scraper daemon directly. Admin-only reader
 routes proxy commands to the daemon's private API, so its shared token stays on the
@@ -375,7 +375,7 @@ docker compose up -d --build
 |----------|--------------|-----|
 | Index the folder tree in place | Import into a DB / managed storage | Stays readable by any viewer and writable by any tool. Nothing to keep in sync |
 | No dependencies, no framework, no build | Express, React, bundler | Minimal code, maximum longevity, runs anywhere Node runs |
-| Built-in backup in the reader, queue paused, no container stop | Host job that stops the stack; backup in Sentinel | Only the reader sees all of `/data` and the in-memory `db.json`; the scraper's pause API gives a consistent point without downtime |
+| Built-in backup in the reader, queue paused, no container stop | Host job that stops the stack; backup in a separate service | Only the reader sees all of `/data` and the in-memory `db.json`; the scraper's pause API gives a consistent point without downtime |
 | JSON file for user data | SQLite (`node:sqlite` is still experimental in Node 22/24), Postgres | Zero dependencies, trivial backup, enough for the target size. Easy to swap: all access goes through the `db` object |
 | Page roles as file-name tags | Page lists in JSON | Visible in any file browser, survives copying, no second source of truth. Unknown tags are harmless |
 | Image sizes read on the server | Measure in the browser after load | Layout before load: exact scroll restore, zoom anchoring, auto-detected double pages, no layout jumps |