feat: one registry entry per Site, derived browser route and gate (#94)

Collapse the six per-site comparison points into a sites map in sites.go:
Latest Chapter parse, Cover parse, browser-backed list, fetcher route,
host pins, and the browser payload read all become lookups into it. All
six hosts are now pinned in fetchableSeriesURL; asura/demonic/comix were
previously accepted on any https host.

backend/internal/latest/poller_test.go

@@ -623,6 +623,13 @@ func TestFetchableSeriesURL(t *testing.T) {
 		{"demonic https", "demonic", "https://demonicscans.org/manga/X", true},
 		{"comix https", "comix", "https://comix.to/title/n8we-dungeons-and-crayons", true},
 		{"kagane on its own host", "kagane", "https://kagane.to/series/019f84bc-9ba0-7ed9-86f5-8b905ec7c28b", true},
+		// The pins added in #94 cover the three plain-TLS Sites too: a
+		// client-supplied series_url must not aim a fetcher at a lookalike
+		// host, even when the fetcher is only an HTTP GET.
+		{"asura on a foreign host", "asura", "https://asurascans.com.evil.example/comics/x", false},
+		{"asura on the dead old domain", "asura", "https://asuracomic.net/comics/x", false},
+		{"demonic on a lookalike host", "demonic", "https://demonicscans.org.evil.example/manga/X", false},
+		{"comix on a foreign host", "comix", "https://evil.example/title/x", false},
 		// The browser fetcher runs JavaScript and carries cookies, so a
 		// client-supplied series_url must not be able to aim it anywhere else.
 		{"kagane on a foreign host", "kagane", "https://evil.example/series/x", false},