feat: one registry entry per Site, one shared Series-page read (#95)

Closes #94.

## What

Two phases per the spec, in three feature commits plus two review-fix commits:

**Phase one — one registry entry per Site** (`2d134fb`)
The six per-site comparison points that used to live across three files collapse
into one `sites` map in `backend/internal/latest/sites.go`: Latest Chapter parse,
Cover parse, browser-backed list, fetcher route, host pins, and the browser
payload read all become lookups into it. `browserBackedSites()` is derived from
the registry (sorted, deterministic); `fetcherFor` and `fetchableSeriesURL` keep
their signatures and become lookups; `BrowserFetcher.Get` dispatches through the
entries' `Read`/`Done` while the tab lifecycle stays in `BrowserFetcher.run`.

**Phase two — one shared Series-page read** (`f215130`)
`readSeriesPage` (new `read.go`) performs the read the Poll and the Acquisition
have in common: gate, route, fetch, parse Latest Chapter, parse Cover address.
It returns facts only — polling and persistence policies (stamp order, cooldowns,
cover policy) stay with the callers; `acquire.go` gained the comment naming the
deliberate post-fetch stamp order. The poll's legacy cover heal and the
no-chapter byte-count diagnostic were restored after review (`d998f87`) so the
claims "the Poll keeps its own Cover policy" and "pinning is the only
behavioural change" both hold.

## Behaviour

- All six Sites now pin their host exactly; asura/demonic/comix previously
  accepted any https host. For asura this is a strict improvement: its dead old
  domain redirects deep links to the site root and would parse the wrong
  document.
- Everything else is unchanged: existing parse tables, the challenge-body table
  and the gate table pass unmodified except the one deliberate exception — the
  gate table gains the three new pin cases.

## Security invariants preserved

- The address gate is recognisably the same rule, now a single registry lookup:
  `https` + exact hostname match, all callers route through it. No fetch path
  was widened; asura/demonic/comix were narrowed.
- The second host pin inside each browser entry's Read is retained deliberately
  (browser = strong SSRF primitive, `series_url` is client-supplied) and is not
  deduplicated against the shared gate.
- Review hardening: `fetcherFor` now fails closed for unknown site strings
  (previously fell through to the TLS fetcher on an unreachable path), and the
  browser dispatch iterates a sorted list so outcomes cannot depend on map order.
- The security review's log-injection finding was checked against Go's
  `url.Parse` and does not hold: control characters are rejected anywhere in a
  URL, so a client-supplied value in a log line cannot carry a newline.

## Review

Reviewed on three axes (spec, standards, security) by read-only subagents over
`672c16f..f1b26f4`. No blocking findings; all minor/nit findings addressed in
`d998f87` and `700de20`. Verified end to end with `go test ./...` (Docker
Postgres per test package) on every commit.

## Out of scope (tracked separately)

- Dropping asuracomic.net (CORS allowlist, userscript match, API fixtures,
  live env) — separate issue, per spec.

Reviewed-on: #95
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/latest/acquire.go

@@ -2,6 +2,7 @@ package latest
 
 import (
 	"context"
+	"errors"
 	"log"
 	"sync"
 	"time"
@@ -97,51 +98,49 @@ func (a *Acquirer) acquire(ctx context.Context, sr store.Series) {
 	if a.Fetch == nil && a.BrowserFetch == nil {
 		return
 	}
-	// series_url arrives in a client-supplied PUT body, so the same gate the
-	// poller uses applies here — without it a token-holder chooses what the
-	// server fetches from its own network position.
-	if !fetchableSeriesURL(sr.Site, sr.SeriesURL) {
-		log.Printf("acquire %q: not fetchable: site=%q url=%q", sr.Key(), sr.Site, sr.SeriesURL)
-		return
-	}
-
-	f := fetcherFor(sr.Site, a.BrowserFetch, a.Fetch)
-	if f == nil {
-		log.Printf("acquire %q: no fetcher for site %q", sr.Key(), sr.Site)
-		return
-	}
-	body, status, err := f.Get(ctx, sr.SeriesURL)
+	facts, err := readSeriesPage(ctx, sr.Site, sr.SeriesURL, a.BrowserFetch, a.Fetch)
 	if err != nil {
-		log.Printf("acquire %q: fetch %s: %v", sr.Key(), sr.SeriesURL, err)
-		return
-	}
-	if status != 200 {
-		log.Printf("acquire %q: fetch %s: status %d", sr.Key(), sr.SeriesURL, status)
+		switch {
+		case errors.Is(err, errNotFetchable):
+			// series_url arrives in a client-supplied PUT body, so without the
+			// gate a token-holder chooses what the server fetches from its own
+			// network position.
+			log.Printf("acquire %q: not fetchable: site=%q url=%q", sr.Key(), sr.Site, sr.SeriesURL)
+		case errors.Is(err, errNoFetcher):
+			log.Printf("acquire %q: no fetcher for site %q", sr.Key(), sr.Site)
+		default:
+			log.Printf("acquire %q: %v", sr.Key(), err)
+		}
 		return
 	}
 
 	// This page just served the same purpose a poll tick would have; without
 	// the stamp the row stays due and the poller refetches it immediately.
+	//
+	// Stamped after success — the reverse of the poller, which stamps before
+	// the fetch: the Reader is here, watching the Series they just created, so
+	// a failed acquisition must leave the row due for a fast retry rather than
+	// consuming the cooldown. The stamp happens even when the page read
+	// succeeded but produced no facts to persist.
 	if err := a.Store.MarkLatestChecked(sr.Site, sr.SeriesID, time.Now().UnixMilli()); err != nil {
 		log.Printf("acquire %q: mark checked: %v", sr.Key(), err)
 	}
 
-	if latest, ok := latestChapterFrom(sr.Site, sr.SeriesURL, body); ok {
-		if err := a.Store.SetLatestChapter(sr.Site, sr.SeriesID, latest.Label, latest.Num); err != nil {
+	if facts.HasLatest {
+		if err := a.Store.SetLatestChapter(sr.Site, sr.SeriesID, facts.Latest.Label, facts.Latest.Num); err != nil {
 			log.Printf("acquire %q: set latest chapter: %v", sr.Key(), err)
 		}
 	}
 
-	cover, ok := coverFrom(sr.Site, sr.SeriesURL, body)
-	if !ok {
+	if !facts.HasCover {
 		return
 	}
-	bytes, contentType, err := fetchCoverBytes(ctx, cover, a.BrowserCoverFetch, a.Covers)
+	bytes, contentType, err := fetchCoverBytes(ctx, facts.Cover, a.BrowserCoverFetch, a.Covers)
 	if err != nil {
-		log.Printf("acquire %q: fetch cover %s: %v", sr.Key(), cover, err)
+		log.Printf("acquire %q: fetch cover %s: %v", sr.Key(), facts.Cover, err)
 		return
 	}
-	if err := a.Store.SetSeriesCover(sr.Site, sr.SeriesID, cover, bytes, contentType); err != nil {
+	if err := a.Store.SetSeriesCover(sr.Site, sr.SeriesID, facts.Cover, bytes, contentType); err != nil {
 		log.Printf("acquire %q: persist cover: %v", sr.Key(), err)
 	}
 }