feat: one registry entry per Site, one shared Series-page read (#95)

Closes #94.

## What

Two phases per the spec, in three feature commits plus two review-fix commits:

**Phase one — one registry entry per Site** (`2d134fb`)
The six per-site comparison points that used to live across three files collapse
into one `sites` map in `backend/internal/latest/sites.go`: Latest Chapter parse,
Cover parse, browser-backed list, fetcher route, host pins, and the browser
payload read all become lookups into it. `browserBackedSites()` is derived from
the registry (sorted, deterministic); `fetcherFor` and `fetchableSeriesURL` keep
their signatures and become lookups; `BrowserFetcher.Get` dispatches through the
entries' `Read`/`Done` while the tab lifecycle stays in `BrowserFetcher.run`.

**Phase two — one shared Series-page read** (`f215130`)
`readSeriesPage` (new `read.go`) performs the read the Poll and the Acquisition
have in common: gate, route, fetch, parse Latest Chapter, parse Cover address.
It returns facts only — polling and persistence policies (stamp order, cooldowns,
cover policy) stay with the callers; `acquire.go` gained the comment naming the
deliberate post-fetch stamp order. The poll's legacy cover heal and the
no-chapter byte-count diagnostic were restored after review (`d998f87`) so the
claims "the Poll keeps its own Cover policy" and "pinning is the only
behavioural change" both hold.

## Behaviour

- All six Sites now pin their host exactly; asura/demonic/comix previously
  accepted any https host. For asura this is a strict improvement: its dead old
  domain redirects deep links to the site root and would parse the wrong
  document.
- Everything else is unchanged: existing parse tables, the challenge-body table
  and the gate table pass unmodified except the one deliberate exception — the
  gate table gains the three new pin cases.

## Security invariants preserved

- The address gate is recognisably the same rule, now a single registry lookup:
  `https` + exact hostname match, all callers route through it. No fetch path
  was widened; asura/demonic/comix were narrowed.
- The second host pin inside each browser entry's Read is retained deliberately
  (browser = strong SSRF primitive, `series_url` is client-supplied) and is not
  deduplicated against the shared gate.
- Review hardening: `fetcherFor` now fails closed for unknown site strings
  (previously fell through to the TLS fetcher on an unreachable path), and the
  browser dispatch iterates a sorted list so outcomes cannot depend on map order.
- The security review's log-injection finding was checked against Go's
  `url.Parse` and does not hold: control characters are rejected anywhere in a
  URL, so a client-supplied value in a log line cannot carry a newline.

## Review

Reviewed on three axes (spec, standards, security) by read-only subagents over
`672c16f..f1b26f4`. No blocking findings; all minor/nit findings addressed in
`d998f87` and `700de20`. Verified end to end with `go test ./...` (Docker
Postgres per test package) on every commit.

## Out of scope (tracked separately)

- Dropping asuracomic.net (CORS allowlist, userscript match, API fixtures,
  live env) — separate issue, per spec.

Reviewed-on: #95
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/latest/poller.go

@@ -2,9 +2,9 @@ package latest
 
 import (
 	"context"
+	"errors"
 	"log"
 	"net/url"
-	"slices"
 	"time"
 
 	"bookmarkmanager/backend/internal/store"
@@ -57,25 +57,23 @@ type Poller struct {
 	Batch           int
 }
 
-var browserBackedSites = []string{"kagane", "novelfull"}
-
 // fillBlankCover gives a Series its Cover when it has none. The blank state is
 // what "no Cover yet" means on the wire (ADR-0007): permanently-blank rows
 // created before acquisition existed, and rows whose creation-time fetch
 // failed, both heal here. A non-blank CoverAddress is left alone — refetching
 // would add a request per Series per cycle and change artwork under the Reader
 // for no visible reason. A row that already carries a source URL is owned by
-// prefetchCover instead; this path only extracts from the series page.
+// prefetchCover instead; this path only records a Cover address already
+// extracted from the series page.
 //
 // Failures are logged against the Series and never returned: the chapter poll
 // must not notice. A failed fill is retried the next time this Series is due;
 // there is no separate retry queue.
-func (p *Poller) fillBlankCover(ctx context.Context, sr store.Series, body string) {
+func (p *Poller) fillBlankCover(ctx context.Context, sr store.Series, cover string) {
 	if sr.CoverAddress != "" || sr.Cover != "" {
 		return
 	}
-	cover, ok := coverFrom(sr.Site, sr.SeriesURL, body)
-	if !ok {
+	if cover == "" {
 		return
 	}
 	p.storeCover(ctx, sr, cover)
@@ -120,27 +118,29 @@ func (p *Poller) storeCover(ctx context.Context, sr store.Series, sourceURL stri
 }
 
 // fetcherFor returns the fetcher a site's page needs, or nil when the site
-// cannot be fetched at all right now. kagane and novelfull pages sit behind a
-// Cloudflare JavaScript challenge that no TLS fingerprint clears (kagane
-// verified 2026-08-03, novelfull verified 2026-08-05, both against the same
-// Chrome_133 profile TLSFetcher uses), so both prefer the browser; novelfull
-// alone falls back to the plain-TLS fetcher when no browser is configured,
-// because its challenge is a live time-varying fact (AGENTS.md) and its cover
-// bytes never need the browser. kagane never falls back: a plain fetch of a
-// kagane page or cover would only ever retrieve a challenge page. One routing
-// rule for the poll and the acquirer, so the two cannot drift apart.
+// cannot be fetched at all right now. A Site whose registry entry carries a
+// Browser read — kagane and novelfull, both behind a Cloudflare JavaScript
+// challenge no TLS fingerprint clears — prefers the browser; when it is
+// absent, the entry's Fallback decides whether plain TLS may take over. One
+// routing rule for the poll and the acquirer, so the two cannot drift apart.
 func fetcherFor(site string, browser, tls Fetcher) Fetcher {
-	switch {
-	case site == "kagane":
-		return browser
-	case slices.Contains(browserBackedSites, site): // novelfull
-		if browser != nil {
-			return browser
-		}
-		return tls
-	default:
+	s, known := sites[site]
+	if !known {
+		// No registry entry means nothing to fetch or parse; fail closed even
+		// though the only caller gates first, so a future caller that skips
+		// the gate cannot hand an arbitrary https URL to the TLS fetcher.
+		return nil
+	}
+	if s.Browser == nil {
 		return tls
 	}
+	if browser != nil {
+		return browser
+	}
+	if s.Browser.Fallback {
+		return tls
+	}
+	return nil
 }
 
 // Run polls until ctx is cancelled.
@@ -170,7 +170,7 @@ func (p *Poller) runOnce(ctx context.Context) {
 	now := p.Now()
 	cutoff := now.Add(-p.Cooldown).UnixMilli()
 	browserCutoff := now.Add(-p.BrowserCooldown).UnixMilli()
-	due, err := p.Store.DueForLatestCheck(cutoff, browserCutoff, browserBackedSites, p.Batch)
+	due, err := p.Store.DueForLatestCheck(cutoff, browserCutoff, browserBackedSites(), p.Batch)
 	if err != nil {
 		log.Printf("latest poll: due query: %v", err)
 		return
@@ -224,43 +224,35 @@ func (p *Poller) checkOne(ctx context.Context, sr store.Series) {
 		return
 	}
 
-	// series_url is client-supplied (PUT /bookmarks/{key} accepts any string),
-	// so this is not just an optimisation against burning a request on an
-	// unknown site: without it, the server would issue a GET from its own
-	// network position to whatever URL a token-holder writes, including
-	// link-local/internal addresses or non-https schemes. The cooldown above
-	// is already consumed, so a row that never passes this check is retried at
-	// cooldown pace rather than hot-looping.
-	if !fetchableSeriesURL(sr.Site, sr.SeriesURL) {
-		log.Printf("latest poll %q: not fetchable: site=%q url=%q", sr.Key(), sr.Site, sr.SeriesURL)
-		return
-	}
-
-	f := fetcherFor(sr.Site, p.BrowserFetch, p.Fetch)
-	if f == nil {
-		log.Printf("latest poll %q: no fetcher for site %q", sr.Key(), sr.Site)
-		return
-	}
-	p.prefetchCover(ctx, sr)
-
-	body, status, err := f.Get(ctx, sr.SeriesURL)
+	facts, err := readSeriesPage(ctx, sr.Site, sr.SeriesURL, p.BrowserFetch, p.Fetch)
 	if err != nil {
-		log.Printf("latest poll %q: fetch %s: %v", sr.Key(), sr.SeriesURL, err)
+		switch {
+		case errors.Is(err, errNotFetchable):
+			// The cooldown above is already consumed, so a row that never
+			// passes the gate is retried at cooldown pace rather than
+			// hot-looping.
+			log.Printf("latest poll %q: not fetchable: site=%q url=%q", sr.Key(), sr.Site, sr.SeriesURL)
+			return
+		case errors.Is(err, errNoFetcher):
+			log.Printf("latest poll %q: no fetcher for site %q", sr.Key(), sr.Site)
+			return
+		}
+		// A legacy cover heals independently of the page read: its source may
+		// answer — a CDN — while the origin does not, so a fetch failure does
+		// not skip the heal, matching the order the shared read replaced.
+		p.prefetchCover(ctx, sr)
+		log.Printf("latest poll %q: %v", sr.Key(), err)
 		return
 	}
-	if status != 200 {
-		log.Printf("latest poll %q: fetch %s: status %d", sr.Key(), sr.SeriesURL, status)
-		return
-	}
-
-	latest, ok := latestChapterFrom(sr.Site, sr.SeriesURL, body)
+	// A legacy cover source is healed independently of the page read.
+	p.prefetchCover(ctx, sr)
 	// Cover fill is independent of the chapter signal: a page that lost its
 	// chapter list may keep its og:image, and a blank Series heals either way.
-	p.fillBlankCover(ctx, sr, body)
-	if !ok {
+	p.fillBlankCover(ctx, sr, facts.Cover)
+	if !facts.HasLatest {
 		// Most likely a challenge page or a layout change. Either way the row is
 		// already stamped, so this waits out a cooldown instead of hot-looping.
-		log.Printf("latest poll %q: no chapter links in %d bytes", sr.Key(), len(body))
+		log.Printf("latest poll %q: no chapter links in %d bytes", sr.Key(), facts.BodyLen)
 		return
 	}
 
@@ -268,7 +260,7 @@ func (p *Poller) checkOne(ctx context.Context, sr store.Series) {
 	// chapter should correct the stored number downward. The comparison is
 	// against the due-query snapshot; a concurrent write in between only costs
 	// one redundant UPDATE of the same absolute value, never a wrong one.
-	if sr.LatestChapterNum != nil && *sr.LatestChapterNum == latest.Num {
+	if sr.LatestChapterNum != nil && *sr.LatestChapterNum == facts.Latest.Num {
 		return
 	}
 
@@ -276,52 +268,30 @@ func (p *Poller) checkOne(ctx context.Context, sr store.Series) {
 	// bookmark joining to it, and the bookmark's updated_at is never touched —
 	// a newly published chapter is not reading progress and must not reorder
 	// the list.
-	if err := p.Store.SetLatestChapter(sr.Site, sr.SeriesID, latest.Label, latest.Num); err != nil {
+	if err := p.Store.SetLatestChapter(sr.Site, sr.SeriesID, facts.Latest.Label, facts.Latest.Num); err != nil {
 		log.Printf("latest poll %q: set latest chapter: %v", sr.Key(), err)
 		return
 	}
-	log.Printf("latest poll %q: latest is now %s", sr.Key(), latest.Label)
+	log.Printf("latest poll %q: latest is now %s", sr.Key(), facts.Latest.Label)
 }
 
-// fetchableSeriesURL reports whether site is a site latestChapterFrom knows how
-// to parse and seriesURL is safe to hand to a fetcher: an https URL with a
-// non-empty host. series_url comes from client-supplied PUT bodies, so this is
-// a defence against the poller being used to probe arbitrary hosts from the
-// server's own network position, not just a check against wasted requests.
-//
-// Three sites are held to a stricter rule, each for a different reason:
-//
-//   - kagane and novelfull are fetched by a headless browser, which executes
-//     JavaScript and carries cookies, and is therefore a far stronger SSRF
-//     primitive than an HTTP GET. Their hosts must match exactly, not merely
-//     be non-empty.
-//   - lightnovelworld's parser regex hardcodes its host, so a URL anywhere
-//     else could never yield a match — reject it here rather than burn the
-//     request.
+// fetchableSeriesURL reports whether site is a Site the registry knows and
+// seriesURL is safe to hand to a fetcher: an https URL whose host matches the
+// Site's pinned hostname exactly. series_url comes from client-supplied PUT
+// bodies, so this is a defence against the poller being used to probe
+// arbitrary hosts from the server's own network position, not just a check
+// against wasted requests. The pin guards different things per Site — a
+// browser Site guards a control that executes JavaScript and carries cookies,
+// a parser Site guards a wasted request — but the rule is one rule, from the
+// registry.
 func fetchableSeriesURL(site, seriesURL string) bool {
-	switch site {
-	case "asura", "demonic", "comix", "kagane", "novelfull", "lightnovelworld":
-	default:
+	s, known := sites[site]
+	if !known {
 		return false
 	}
 	u, err := url.Parse(seriesURL)
 	if err != nil {
 		return false
 	}
-	if u.Scheme != "https" || u.Host == "" {
-		return false
-	}
-	switch site {
-	case "kagane":
-		return u.Hostname() == "kagane.to"
-	case "novelfull":
-		// Fetched by a real browser, same as kagane, so the host is pinned
-		// rather than merely non-empty.
-		return u.Hostname() == "novelfull.com"
-	case "lightnovelworld":
-		// Its parser regex hardcodes this host, so a URL anywhere else could
-		// never yield a match — reject it here rather than burn the request.
-		return u.Hostname() == "lightnovelworld.net"
-	}
-	return true
+	return u.Scheme == "https" && u.Hostname() == s.Host
 }