Address review findings on the cover-path deletion (#63)

- Move the kagane cover URL shape into the extraction module (sites.go):
  browserOnlyCoverURL + kaganeImageURLRe now own the claim; the byte-fetch
  router and BrowserFetcher.Image reference it. One shape gate for producer
  and fetcher (the id regex is folded into the full-URL match), so no Site
  name appears in a cover path outside the extraction module and the
  producer cannot emit an address the fetch would refuse.
- Restore the serving-boundary guarantee: GET /covers/{addr} re-checks the
  stored media type via store.CoverContentType and 404s a poisoned row;
  TestPublicCoverNeverEchoesNonImage now seeds one directly behind the
  write gate and pins the refusal where bytes leave.
- Restore the SSRF rationale (client-supplied stored URL, headless browser
  as a strong primitive) on the URL regex.

backend/internal/api/handlers.go

@@ -150,6 +150,14 @@ func (h *Handler) Cover(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
+	// Refuse anything the write gate would not have recorded: a poisoned row
+	// (migrated data, a writer that skips the gate) must never be echoed back
+	// as bytes of a type no Cover may have.
+	if _, ok := store.CoverContentType(contentType); !ok {
+		log.Printf("cover %s: refusing non-image content type %q", r.PathValue("address"), contentType)
+		http.NotFound(w, r)
+		return
+	}
 	w.Header().Set("Content-Type", contentType)
 	// Content-addressed, so the bytes at this URL can never change. Public
 	// rather than private: no credential gates the route.