feat: one registry entry per Site, one shared Series-page read (#95)

Closes #94.

## What

Two phases per the spec, in three feature commits plus two review-fix commits:

**Phase one — one registry entry per Site** (`2d134fb`)
The six per-site comparison points that used to live across three files collapse
into one `sites` map in `backend/internal/latest/sites.go`: Latest Chapter parse,
Cover parse, browser-backed list, fetcher route, host pins, and the browser
payload read all become lookups into it. `browserBackedSites()` is derived from
the registry (sorted, deterministic); `fetcherFor` and `fetchableSeriesURL` keep
their signatures and become lookups; `BrowserFetcher.Get` dispatches through the
entries' `Read`/`Done` while the tab lifecycle stays in `BrowserFetcher.run`.

**Phase two — one shared Series-page read** (`f215130`)
`readSeriesPage` (new `read.go`) performs the read the Poll and the Acquisition
have in common: gate, route, fetch, parse Latest Chapter, parse Cover address.
It returns facts only — polling and persistence policies (stamp order, cooldowns,
cover policy) stay with the callers; `acquire.go` gained the comment naming the
deliberate post-fetch stamp order. The poll's legacy cover heal and the
no-chapter byte-count diagnostic were restored after review (`d998f87`) so the
claims "the Poll keeps its own Cover policy" and "pinning is the only
behavioural change" both hold.

## Behaviour

- All six Sites now pin their host exactly; asura/demonic/comix previously
  accepted any https host. For asura this is a strict improvement: its dead old
  domain redirects deep links to the site root and would parse the wrong
  document.
- Everything else is unchanged: existing parse tables, the challenge-body table
  and the gate table pass unmodified except the one deliberate exception — the
  gate table gains the three new pin cases.

## Security invariants preserved

- The address gate is recognisably the same rule, now a single registry lookup:
  `https` + exact hostname match, all callers route through it. No fetch path
  was widened; asura/demonic/comix were narrowed.
- The second host pin inside each browser entry's Read is retained deliberately
  (browser = strong SSRF primitive, `series_url` is client-supplied) and is not
  deduplicated against the shared gate.
- Review hardening: `fetcherFor` now fails closed for unknown site strings
  (previously fell through to the TLS fetcher on an unreachable path), and the
  browser dispatch iterates a sorted list so outcomes cannot depend on map order.
- The security review's log-injection finding was checked against Go's
  `url.Parse` and does not hold: control characters are rejected anywhere in a
  URL, so a client-supplied value in a log line cannot carry a newline.

## Review

Reviewed on three axes (spec, standards, security) by read-only subagents over
`672c16f..f1b26f4`. No blocking findings; all minor/nit findings addressed in
`d998f87` and `700de20`. Verified end to end with `go test ./...` (Docker
Postgres per test package) on every commit.

## Out of scope (tracked separately)

- Dropping asuracomic.net (CORS allowlist, userscript match, API fixtures,
  live env) — separate issue, per spec.

Reviewed-on: #95
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

graphify-out/.graphify_labels.json

@@ -25,12 +25,12 @@
   "23": "Browser Entrypoint",
   "24": "Memory Allocation & GC",
   "25": "Cover Fetcher Tests",
-  "26": "Deployment & Cover ADRs",
+  "26": "readSeries",
   "27": "Find Skills Guide",
   "28": "Allocation Patterns",
   "29": "Observability & Alerting",
   "30": "PG Test Infrastructure",
-  "31": "Domain Concepts",
+  "31": "Memory Layout",
   "32": "Repo Hard Constraints",
   "33": "Go Testing Guide",
   "34": "Session Store",
@@ -124,7 +124,7 @@
   "122": "Identity comes from Discord OAuth; we store no passwords and send no email",
   "123": "The wire format stays flat and deliberately does not mirror the schema",
   "124": "ADR-0005: On-demand browser sidecar",
-  "125": "AGENTS.md",
+  "125": "Duration",
   "126": "Bookmark Manager",
   "127": "triage-labels.md",
   "128": "Cross-Ticket Contract",
@@ -179,18 +179,6 @@
   "177": "Backend CLAUDE.md Guidance",
   "178": "Graphify Knowledge Graph (graphify-out/)",
   "179": "CLAUDE.md (Symlink to AGENTS.md)",
-  "180": "Chapter Slug",
-  "181": "CONTEXT.md Ubiquitous Language",
-  "182": "Favourite",
-  "183": "Latest Chapter",
-  "184": "Library",
-  "185": "Lifecycle Bucket",
-  "186": "New Chapter",
-  "187": "Poll",
-  "188": "Progress",
-  "189": "Reader",
-  "190": "Series",
-  "191": "Site",
   "192": "ADR-0001 (Drop modernc.org/sqlite)",
   "193": "ADR-0003 (Split Shared Series Facts)",
   "194": "SQLite-to-Postgres Cutover Runbook",
@@ -271,6 +259,6 @@
   "269": "pg_dump Hot Backup",
   "270": "Redeploy Runbook",
   "271": "Rollback Strategy",
-  "272": "Bearer-token API client (apiGet/apiPut/apiDelete)",
+  "273": "AGENTS.md",
   "279": "Userscript CLAUDE guidance"
 }