feat: one registry entry per Site, one shared Series-page read (#95)

Closes #94.

## What

Two phases per the spec, in three feature commits plus two review-fix commits:

**Phase one — one registry entry per Site** (`2d134fb`)
The six per-site comparison points that used to live across three files collapse
into one `sites` map in `backend/internal/latest/sites.go`: Latest Chapter parse,
Cover parse, browser-backed list, fetcher route, host pins, and the browser
payload read all become lookups into it. `browserBackedSites()` is derived from
the registry (sorted, deterministic); `fetcherFor` and `fetchableSeriesURL` keep
their signatures and become lookups; `BrowserFetcher.Get` dispatches through the
entries' `Read`/`Done` while the tab lifecycle stays in `BrowserFetcher.run`.

**Phase two — one shared Series-page read** (`f215130`)
`readSeriesPage` (new `read.go`) performs the read the Poll and the Acquisition
have in common: gate, route, fetch, parse Latest Chapter, parse Cover address.
It returns facts only — polling and persistence policies (stamp order, cooldowns,
cover policy) stay with the callers; `acquire.go` gained the comment naming the
deliberate post-fetch stamp order. The poll's legacy cover heal and the
no-chapter byte-count diagnostic were restored after review (`d998f87`) so the
claims "the Poll keeps its own Cover policy" and "pinning is the only
behavioural change" both hold.

## Behaviour

- All six Sites now pin their host exactly; asura/demonic/comix previously
  accepted any https host. For asura this is a strict improvement: its dead old
  domain redirects deep links to the site root and would parse the wrong
  document.
- Everything else is unchanged: existing parse tables, the challenge-body table
  and the gate table pass unmodified except the one deliberate exception — the
  gate table gains the three new pin cases.

## Security invariants preserved

- The address gate is recognisably the same rule, now a single registry lookup:
  `https` + exact hostname match, all callers route through it. No fetch path
  was widened; asura/demonic/comix were narrowed.
- The second host pin inside each browser entry's Read is retained deliberately
  (browser = strong SSRF primitive, `series_url` is client-supplied) and is not
  deduplicated against the shared gate.
- Review hardening: `fetcherFor` now fails closed for unknown site strings
  (previously fell through to the TLS fetcher on an unreachable path), and the
  browser dispatch iterates a sorted list so outcomes cannot depend on map order.
- The security review's log-injection finding was checked against Go's
  `url.Parse` and does not hold: control characters are rejected anywhere in a
  URL, so a client-supplied value in a log line cannot carry a newline.

## Review

Reviewed on three axes (spec, standards, security) by read-only subagents over
`672c16f..f1b26f4`. No blocking findings; all minor/nit findings addressed in
`d998f87` and `700de20`. Verified end to end with `go test ./...` (Docker
Postgres per test package) on every commit.

## Out of scope (tracked separately)

- Dropping asuracomic.net (CORS allowlist, userscript match, API fixtures,
  live env) — separate issue, per spec.

Reviewed-on: #95
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

graphify-out/manifest.json

@@ -245,9 +245,9 @@
     "semantic_hash": "385b36f58488b7e6d93eb6d6034e9ee3"
   },
   "backend/internal/latest/browser.go": {
-    "mtime": 1786363889.5565126,
-    "ast_hash": "092dfbd2bc96e7a251672a5a0d922b37",
-    "semantic_hash": "092dfbd2bc96e7a251672a5a0d922b37"
+    "mtime": 1786469354.923288,
+    "ast_hash": "ed129a7f00601ea90c877ff29fa21220",
+    "semantic_hash": ""
   },
   "backend/internal/latest/browser_test.go": {
     "mtime": 1786262323.6964688,
@@ -260,18 +260,18 @@
     "semantic_hash": ""
   },
   "backend/internal/latest/poller.go": {
-    "mtime": 1786363889.5565126,
-    "ast_hash": "ebb0ee4e57d62b6aed97b8d266639a23",
-    "semantic_hash": "ebb0ee4e57d62b6aed97b8d266639a23"
+    "mtime": 1786469641.8342345,
+    "ast_hash": "44fef6074ac2eaffc8233f46aad5236b",
+    "semantic_hash": ""
   },
   "backend/internal/latest/poller_test.go": {
-    "mtime": 1786446006.9219902,
-    "ast_hash": "91151a7671a3fb1efc957137cfc6839b",
+    "mtime": 1786469644.9306462,
+    "ast_hash": "64bc838c822f1bf33bbf9e291215454b",
     "semantic_hash": ""
   },
   "backend/internal/latest/sites.go": {
-    "mtime": 1786446006.9219902,
-    "ast_hash": "a424fb3b3e1c5afb4ab545c2e88b167c",
+    "mtime": 1786469348.5394242,
+    "ast_hash": "b744cc685363317a526cc3bebceea39e",
     "semantic_hash": ""
   },
   "backend/internal/latest/sites_test.go": {
@@ -415,9 +415,9 @@
     "semantic_hash": "e44a2f6f624db044e19508bc5ab05592"
   },
   "CONTEXT.md": {
-    "mtime": 1786417841.7163916,
-    "ast_hash": "1ff47b5340a725b0b7287ee29f63cd34",
-    "semantic_hash": "1ff47b5340a725b0b7287ee29f63cd34"
+    "mtime": 1786466512.6719532,
+    "ast_hash": "544b7d93f1d5cb9d347cb0b92fc3a709",
+    "semantic_hash": ""
   },
   "CUTOVER.md": {
     "mtime": 1786216141.660644,
@@ -570,9 +570,9 @@
     "semantic_hash": "60d9eb7c59a3751baf4f31c7655217e7"
   },
   "backend/internal/latest/acquire.go": {
-    "mtime": 1786363889.5565126,
-    "ast_hash": "760310097141a864f14318ed3be2703e",
-    "semantic_hash": "760310097141a864f14318ed3be2703e"
+    "mtime": 1786468950.9432797,
+    "ast_hash": "6c1ad34bbe9f5b49d0fd1eae9093f55d",
+    "semantic_hash": ""
   },
   "backend/internal/latest/acquire_test.go": {
     "mtime": 1786363889.5565126,
@@ -608,5 +608,15 @@
     "mtime": 1786446006.9219902,
     "ast_hash": "2d65da8a081759172918fdf159760f45",
     "semantic_hash": ""
+  },
+  "docs/adr/0009-a-site-answers-questions-its-own-way.md": {
+    "mtime": 1786469367.6875648,
+    "ast_hash": "8039012a5b6de2359ff1a47079f51b66",
+    "semantic_hash": ""
+  },
+  "backend/internal/latest/read.go": {
+    "mtime": 1786469329.7445614,
+    "ast_hash": "3cf29046ddaef39fafb1df70b9f9ae8c",
+    "semantic_hash": ""
   }
 }