feat: one registry entry per Site, one shared Series-page read (#95)

Closes #94.

## What

Two phases per the spec, in three feature commits plus two review-fix commits:

**Phase one — one registry entry per Site** (`2d134fb`)
The six per-site comparison points that used to live across three files collapse
into one `sites` map in `backend/internal/latest/sites.go`: Latest Chapter parse,
Cover parse, browser-backed list, fetcher route, host pins, and the browser
payload read all become lookups into it. `browserBackedSites()` is derived from
the registry (sorted, deterministic); `fetcherFor` and `fetchableSeriesURL` keep
their signatures and become lookups; `BrowserFetcher.Get` dispatches through the
entries' `Read`/`Done` while the tab lifecycle stays in `BrowserFetcher.run`.

**Phase two — one shared Series-page read** (`f215130`)
`readSeriesPage` (new `read.go`) performs the read the Poll and the Acquisition
have in common: gate, route, fetch, parse Latest Chapter, parse Cover address.
It returns facts only — polling and persistence policies (stamp order, cooldowns,
cover policy) stay with the callers; `acquire.go` gained the comment naming the
deliberate post-fetch stamp order. The poll's legacy cover heal and the
no-chapter byte-count diagnostic were restored after review (`d998f87`) so the
claims "the Poll keeps its own Cover policy" and "pinning is the only
behavioural change" both hold.

## Behaviour

- All six Sites now pin their host exactly; asura/demonic/comix previously
  accepted any https host. For asura this is a strict improvement: its dead old
  domain redirects deep links to the site root and would parse the wrong
  document.
- Everything else is unchanged: existing parse tables, the challenge-body table
  and the gate table pass unmodified except the one deliberate exception — the
  gate table gains the three new pin cases.

## Security invariants preserved

- The address gate is recognisably the same rule, now a single registry lookup:
  `https` + exact hostname match, all callers route through it. No fetch path
  was widened; asura/demonic/comix were narrowed.
- The second host pin inside each browser entry's Read is retained deliberately
  (browser = strong SSRF primitive, `series_url` is client-supplied) and is not
  deduplicated against the shared gate.
- Review hardening: `fetcherFor` now fails closed for unknown site strings
  (previously fell through to the TLS fetcher on an unreachable path), and the
  browser dispatch iterates a sorted list so outcomes cannot depend on map order.
- The security review's log-injection finding was checked against Go's
  `url.Parse` and does not hold: control characters are rejected anywhere in a
  URL, so a client-supplied value in a log line cannot carry a newline.

## Review

Reviewed on three axes (spec, standards, security) by read-only subagents over
`672c16f..f1b26f4`. No blocking findings; all minor/nit findings addressed in
`d998f87` and `700de20`. Verified end to end with `go test ./...` (Docker
Postgres per test package) on every commit.

## Out of scope (tracked separately)

- Dropping asuracomic.net (CORS allowlist, userscript match, API fixtures,
  live env) — separate issue, per spec.

Reviewed-on: #95
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/latest/poller_test.go

@@ -623,6 +623,13 @@ func TestFetchableSeriesURL(t *testing.T) {
 		{"demonic https", "demonic", "https://demonicscans.org/manga/X", true},
 		{"comix https", "comix", "https://comix.to/title/n8we-dungeons-and-crayons", true},
 		{"kagane on its own host", "kagane", "https://kagane.to/series/019f84bc-9ba0-7ed9-86f5-8b905ec7c28b", true},
+		// The three plain-TLS Sites are pinned too: a client-supplied
+		// series_url must not aim a fetcher at a lookalike host, even when
+		// the fetcher is only an HTTP GET.
+		{"asura on a foreign host", "asura", "https://asurascans.com.evil.example/comics/x", false},
+		{"asura on the dead old domain", "asura", "https://asuracomic.net/comics/x", false},
+		{"demonic on a lookalike host", "demonic", "https://demonicscans.org.evil.example/manga/X", false},
+		{"comix on a foreign host", "comix", "https://evil.example/title/x", false},
 		// The browser fetcher runs JavaScript and carries cookies, so a
 		// client-supplied series_url must not be able to aim it anywhere else.
 		{"kagane on a foreign host", "kagane", "https://evil.example/series/x", false},
@@ -952,6 +959,8 @@ func TestFetcherForRoutesNovelSites(t *testing.T) {
 		// browser-less deployment: kagane is nothing, novelfull degrades to TLS
 		{"kagane", nil, tls, nil},
 		{"novelfull", nil, tls, tls},
+		// unknown site: fail closed — nothing to fetch or parse
+		{"mangadex", browser, tls, nil},
 	}
 	for _, tc := range cases {
 		t.Run(tc.site, func(t *testing.T) {