Address review findings on the cover-path deletion (#63)

- Move the kagane cover URL shape into the extraction module (sites.go):
  browserOnlyCoverURL + kaganeImageURLRe now own the claim; the byte-fetch
  router and BrowserFetcher.Image reference it. One shape gate for producer
  and fetcher (the id regex is folded into the full-URL match), so no Site
  name appears in a cover path outside the extraction module and the
  producer cannot emit an address the fetch would refuse.
- Restore the serving-boundary guarantee: GET /covers/{addr} re-checks the
  stored media type via store.CoverContentType and 404s a poisoned row;
  TestPublicCoverNeverEchoesNonImage now seeds one directly behind the
  write gate and pins the refusal where bytes leave.
- Restore the SSRF rationale (client-supplied stored URL, headless browser
  as a strong primitive) on the URL regex.

backend/cover_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"database/sql"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -72,18 +73,34 @@ func TestPublicCoverRejectsUnknownAddress(t *testing.T) {
 
 // A content type outside the image set is never echoed back. The old kagane
 // proxy could fetch text/html from a challenged fetch and had to refuse it;
-// the general route's only input is what the store accepted, and the store
-// refuses to record anything that is not an image, so the address that would
-// name one is a miss, not a served body.
+// the general route's only input is the store, and the store refuses to
+// record anything that is not an image — but the guarantee is pinned at the
+// serving boundary, not the write gate, so a poisoned row (migrated data, a
+// writer that skips the gate) is also never served.
 func TestPublicCoverNeverEchoesNonImage(t *testing.T) {
 	const sourceURL = "https://cdn.example/cover"
-	srv, st := newWebTestServer(t, testConfig())
+	st, dsn := newTestStoreURL(t)
+	// The write gate refuses non-image content types outright.
 	if err := st.PutCover(sourceURL, []byte("<script>"), "text/html"); err == nil {
 		t.Fatal("PutCover accepted a non-image content type")
 	}
-	rr := getCover(t, srv, "/covers/"+store.CoverAddress(sourceURL), nil)
+	// A legitimate row, then the content type flipped behind the store's back:
+	// the bytes exist at the address, so only the type is hostile.
+	address := store.CoverAddress(sourceURL)
+	if err := st.SetSeriesCover("asura", "solo", sourceURL, []byte("<script>"), "image/png"); err != nil {
+		t.Fatalf("seed row: %v", err)
+	}
+	db, err := sql.Open("pgx", dsn)
+	if err != nil {
+		t.Fatalf("open %s: %v", dsn, err)
+	}
+	defer db.Close()
+	if _, err := db.Exec(`UPDATE covers SET content_type = 'text/html' WHERE address = $1`, address); err != nil {
+		t.Fatalf("poison row: %v", err)
+	}
+	rr := getCover(t, newRouter(st, testConfig()), "/covers/"+address, nil)
 	if rr.Code == http.StatusOK {
-		t.Fatalf("status = 200, want nothing served for a cover the store refused")
+		t.Fatalf("status = 200, want a refusal for a non-image row (body %q)", rr.Body.String())
 	}
 }