feat: one registry entry per Site, one shared Series-page read (#95)

Closes #94.

## What

Two phases per the spec, in three feature commits plus two review-fix commits:

**Phase one — one registry entry per Site** (`2d134fb`)
The six per-site comparison points that used to live across three files collapse
into one `sites` map in `backend/internal/latest/sites.go`: Latest Chapter parse,
Cover parse, browser-backed list, fetcher route, host pins, and the browser
payload read all become lookups into it. `browserBackedSites()` is derived from
the registry (sorted, deterministic); `fetcherFor` and `fetchableSeriesURL` keep
their signatures and become lookups; `BrowserFetcher.Get` dispatches through the
entries' `Read`/`Done` while the tab lifecycle stays in `BrowserFetcher.run`.

**Phase two — one shared Series-page read** (`f215130`)
`readSeriesPage` (new `read.go`) performs the read the Poll and the Acquisition
have in common: gate, route, fetch, parse Latest Chapter, parse Cover address.
It returns facts only — polling and persistence policies (stamp order, cooldowns,
cover policy) stay with the callers; `acquire.go` gained the comment naming the
deliberate post-fetch stamp order. The poll's legacy cover heal and the
no-chapter byte-count diagnostic were restored after review (`d998f87`) so the
claims "the Poll keeps its own Cover policy" and "pinning is the only
behavioural change" both hold.

## Behaviour

- All six Sites now pin their host exactly; asura/demonic/comix previously
  accepted any https host. For asura this is a strict improvement: its dead old
  domain redirects deep links to the site root and would parse the wrong
  document.
- Everything else is unchanged: existing parse tables, the challenge-body table
  and the gate table pass unmodified except the one deliberate exception — the
  gate table gains the three new pin cases.

## Security invariants preserved

- The address gate is recognisably the same rule, now a single registry lookup:
  `https` + exact hostname match, all callers route through it. No fetch path
  was widened; asura/demonic/comix were narrowed.
- The second host pin inside each browser entry's Read is retained deliberately
  (browser = strong SSRF primitive, `series_url` is client-supplied) and is not
  deduplicated against the shared gate.
- Review hardening: `fetcherFor` now fails closed for unknown site strings
  (previously fell through to the TLS fetcher on an unreachable path), and the
  browser dispatch iterates a sorted list so outcomes cannot depend on map order.
- The security review's log-injection finding was checked against Go's
  `url.Parse` and does not hold: control characters are rejected anywhere in a
  URL, so a client-supplied value in a log line cannot carry a newline.

## Review

Reviewed on three axes (spec, standards, security) by read-only subagents over
`672c16f..f1b26f4`. No blocking findings; all minor/nit findings addressed in
`d998f87` and `700de20`. Verified end to end with `go test ./...` (Docker
Postgres per test package) on every commit.

## Out of scope (tracked separately)

- Dropping asuracomic.net (CORS allowlist, userscript match, API fixtures,
  live env) — separate issue, per spec.

Reviewed-on: #95
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/latest/browser.go

@@ -86,46 +86,59 @@ func (f *BrowserFetcher) Close() {
 	f.cancel()
 }
 
-// Get navigates to seriesURL, lets any challenge resolve, then reads either the
-// site's JSON API (kagane) from inside the page so the request carries the
-// clearance cookie, or the served HTML itself (novelfull) — see
-// novelfullSeriesURL for the latter case. The returned body is whatever the
-// site's chapter list lives in, which is what latestChapterFrom's per-site
-// switch expects.
+// Get navigates to seriesURL, lets any challenge resolve, then reads the
+// payload the Site's registry entry describes — kagane's chapter-list API from
+// inside the page so the request carries the clearance cookie, novelfull's
+// served HTML. The returned body is whatever the Site's chapter list lives in,
+// which is what the entry's LatestChapter parse expects.
 func (f *BrowserFetcher) Get(ctx context.Context, seriesURL string) (string, int, error) {
-	apiURL, isKagane := kaganeAPIURL(seriesURL)
-	if !isKagane && !novelfullSeriesURL(seriesURL) {
-		return "", 0, fmt.Errorf("not a fetchable browser series url: %q", seriesURL)
-	}
-
 	var body string
-	// kagane's chapter list is only in its JSON API, which must be called from
-	// inside the page so the request carries the clearance cookie. novelfull
-	// renders its chapters into the HTML, so the cleared DOM is the answer.
-	// chromedp.OuterHTML returns a QueryAction and chromedp.Evaluate an
-	// EvaluateAction, so the variable has to be the interface both implement.
-	var read chromedp.Action = chromedp.OuterHTML("html", &body, chromedp.ByQuery)
-	if isKagane {
-		read = chromedp.Evaluate(
-			`fetch(`+jsString(apiURL)+`).then(r => r.ok ? r.text() : "")`,
-			&body,
-			awaitPromise,
-		)
-	}
-
-	// novelfull's payload is the DOM itself, and the interstitial has a DOM
-	// too, so "we have an answer" has to exclude it explicitly. kagane's
-	// in-page fetch just fails while challenged, which is already the signal.
-	done := func() bool { return body != "" && (isKagane || !isInterstitial(body)) }
-	if err := f.run(ctx, seriesURL, read, done); err != nil {
-		// Challenge never cleared, or the API refused. Indistinguishable from
-		// here and handled identically by the caller.
-		if errors.Is(err, errChallengeHeld) {
-			return "", 403, nil
+	// Sorted order (browserBackedSites sorts) makes dispatch deterministic:
+	// entries' Read funcs are expected to refuse any address owned by another
+	// Site, and the loop must not depend on that staying true.
+	for _, name := range browserBackedSites() {
+		s := sites[name]
+		read, ok := s.Browser.Read(seriesURL, &body)
+		if !ok {
+			continue
 		}
-		return "", 0, fmt.Errorf("browser fetch %q: %w", seriesURL, err)
+		if err := f.run(ctx, seriesURL, read,
+			func() bool { return s.Browser.Done(body) }); err != nil {
+			// Challenge never cleared, or the payload was refused.
+			// Indistinguishable from here and handled identically by the caller.
+			if errors.Is(err, errChallengeHeld) {
+				return "", 403, nil
+			}
+			return "", 0, fmt.Errorf("browser fetch %q: %w", seriesURL, err)
+		}
+		return body, 200, nil
 	}
-	return body, 200, nil
+	return "", 0, fmt.Errorf("not a fetchable browser series url: %q", seriesURL)
+}
+
+// kaganeRead builds the in-tab fetch of kagane's chapter-list API: the
+// request must be made from inside the page so it carries the clearance
+// cookie, and the API is the only place the list exists. Refusing any other
+// address is the per-Site half of the SSRF gate, kept deliberately behind
+// fetchableSeriesURL (see browserRead.Read).
+func kaganeRead(seriesURL string, out *string) (chromedp.Action, bool) {
+	apiURL, ok := kaganeAPIURL(seriesURL)
+	if !ok {
+		return nil, false
+	}
+	return chromedp.Evaluate(
+		`fetch(`+jsString(apiURL)+`).then(r => r.ok ? r.text() : "")`,
+		out, awaitPromise), true
+}
+
+// novelfullRead reads the cleared DOM. novelfull renders its chapter list
+// into the served HTML, so there is no API to call from inside the page — the
+// challenge-cleared DOM is the payload.
+func novelfullRead(seriesURL string, out *string) (chromedp.Action, bool) {
+	if !novelfullSeriesURL(seriesURL) {
+		return nil, false
+	}
+	return chromedp.OuterHTML("html", out, chromedp.ByQuery), true
 }
 
 // Image retrieves one cover's bytes through the browser sidecar, and its