Address review findings on the cover-path deletion (#63)

- Move the kagane cover URL shape into the extraction module (sites.go):
  browserOnlyCoverURL + kaganeImageURLRe now own the claim; the byte-fetch
  router and BrowserFetcher.Image reference it. One shape gate for producer
  and fetcher (the id regex is folded into the full-URL match), so no Site
  name appears in a cover path outside the extraction module and the
  producer cannot emit an address the fetch would refuse.
- Restore the serving-boundary guarantee: GET /covers/{addr} re-checks the
  stored media type via store.CoverContentType and 404s a poisoned row;
  TestPublicCoverNeverEchoesNonImage now seeds one directly behind the
  write gate and pins the refusal where bytes leave.
- Restore the SSRF rationale (client-supplied stored URL, headless browser
  as a strong primitive) on the URL regex.

backend/internal/latest/sites.go

@@ -165,6 +165,23 @@ var singleQuotedMetaAttrRe = regexp.MustCompile(`(?is)([a-z][a-z0-9:_-]*)\s*=\s*
 // the target detail entry avoids matching posters from recommended results.
 var comixInitialDataRe = regexp.MustCompile(`(?is)<script\b[^>]*\bid\s*=\s*["']initial-data["'][^>]*>(.*?)</script>`)
 
+// kaganeImageURLRe matches the canonical compressed image route kagane's API
+// publishes — the only cover URL form the extractor emits and the browser
+// fetcher accepts. The URL is matched in full (scheme, host, id shape) rather
+// than trusted: the value a fetcher is pointed at may have been client-
+// supplied, and a headless browser is a strong SSRF primitive.
+var kaganeImageURLRe = regexp.MustCompile(`^https://kagane\.to/api/v2/image/([0-9a-f-]{36})/compressed$`)
+
+// browserOnlyCoverURL reports whether the browser sidecar is the only fetcher
+// for cover bytes at imageURL. kagane's image route answers a plain fetch with
+// a challenge and `cross-origin-resource-policy: same-origin`, so a TLS fetch
+// would only ever retrieve a challenge page and must not be attempted
+// (ADR-0007). This is the byte-fetch router's per-Site knowledge; it lives in
+// the extraction module, which owns kagane's URL shapes.
+func browserOnlyCoverURL(imageURL string) bool {
+	return kaganeImageURLRe.MatchString(imageURL)
+}
+
 // kagane's browser-fetched series response publishes cover image IDs under
 // series_covers. The API's canonical compressed image route is the only URL
 // form accepted by the store and browser fetcher; no rendition is guessed.
@@ -178,8 +195,12 @@ func kaganeCoverURL(body string) string {
 		return ""
 	}
 	for _, cover := range response.SeriesCovers {
-		if kaganeImageIDRe.MatchString(cover.ImageID) {
-			return "https://kagane.to/api/v2/image/" + cover.ImageID + "/compressed"
+		// Validate the assembled URL against the same regex the browser
+		// fetcher enforces, so the extractor can never emit an address the
+		// fetch would refuse.
+		imageURL := "https://kagane.to/api/v2/image/" + cover.ImageID + "/compressed"
+		if kaganeImageURLRe.MatchString(imageURL) {
+			return imageURL
 		}
 	}
 	return ""