feat: one Poll Lane per Site, replacing the shared pace (#100) (#106)

Closes #100.

Each Site runs its own Poll Lane: an independent goroutine with its own rest
and pace from the registry (`backend/internal/latest/sites.go`), replacing the
shared cooldown/interval/stagger/batch configuration. Rest (1h, all six Sites
including the browser trio) is enforced by the due query's WHERE clause; the
Lane sleeps its effective gap between fetches — the registry 10s, or
rest/eligible when a Site holds enough Series, floored at 1s with a
Site-naming warning when the floor engages.

Lane-local failure handling:
- Two challenge-held results stop that Site's Lane for 15m; the probes keep
  their stamp, untried Series stay due.
- A lost browser sets a shared Poller flag: the other browser Lanes skip
  their passes for the same 15m (no stamp-per-pass-per-Lane on a dead tab),
  then decay and probe again.
- Browser wake gate preserved (5 due, or one waiting 15m, ADR-0005); one tab
  shared by the three browser Sites; "browser lane behind by X" logged every
  pass.
- Cover work (healing a stored source URL and filling a blank from the series
  page) runs in the background so a slow CDN cannot consume a Lane's gap.

Removed: `LATEST_CHAPTER_POLL_{COOLDOWN,BROWSER_COOLDOWN,INTERVAL,BATCH,STAGGER}`
and the 6h browser rest. Only `LATEST_CHAPTER_POLL_ENABLED` remains; DEPLOY.md
documents the exact `.env` edit. ADR-0010 records the decisions.

Reviewed-on: #106
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/AGENTS.md

@@ -74,20 +74,33 @@ Guidance for OpenCode (and Claude Code) working under `backend/`. See root `AGEN
   Remove's row wear ember wash, two reversible ones wear `.calm` grey.
   `--ember` stay reserved for new-chapter signal: busy bar and inline
   error use `--mute`.
-- **Latest-chapter poller:** ticker goroutine in same binary re-check
-  each bookmarked series' newest published chapter from backend's own
-  network access, so `latest_chapter` stay fresh when user not
-  browsing. Second, parallel signal — userscript keep own
+- **Latest-chapter poller:** one goroutine per Site (a Poll Lane, issue #100),
+  each re-checking that Site's bookmarked series' newest published chapter from
+  backend's own network access, so `latest_chapter` stays fresh when the user
+  isn't browsing. Second, parallel signal — the userscript keeps its own
   `maybeCaptureLatestOnSeriesPage`/`backgroundRefreshLatest` logic unchanged.
-  Two independent clocks: per-series cooldown (`series.latest_checked_at`,
-  enforced by `Store.DueForLatestCheck`'s WHERE clause) and wake interval.
+  Two independent clocks: per-series rest (`series.latest_checked_at`,
+  enforced by `Store.DueForLatestCheck`'s WHERE clause — `now - Rest`) and
+  per-Lane gap (the Lane sleeping between fetches, `effectiveGap`). Both live
+  in the Site registry (`internal/latest/sites.go`), not config: the five env
+  knobs that used to size a shared pace are gone.
   The poller walks **Series, not Bookmarks** — a series referenced by several
   bookmarks is fetched once per cycle, and the due queue orders
   `reader_count DESC, latest_checked_at ASC` (ADR-0003). Series row stamped
-  *before* fetch so broken series wait out full cooldown instead of retrying
+  *before* fetch so broken series wait out the rest instead of retrying
   every tick; found chapter written straight to the series row via
   `Store.SetLatestChapter`, so a bookmark's `updated_at` — and the list
   order — is never touched.
+  Refusals and browser loss are Lane-local: two `errChallengeHeld` in one pass
+  stop that Site for `refuseBackoff` (15m) while other Lanes continue; an
+  `errBrowserInterrupted` (remote Chrome restart) sets a shared Poller flag
+  that makes the other browser Lanes skip their passes for the same 15m, so a
+  restarting Chrome doesn't stamp one Series per Lane per pass — after the
+  window the flag decays and they probe again. Browser Lanes wake Chrome only
+  when 5+ Series are due or one has waited 15m (ADR-0005 on-demand browser),
+  and cover work (both healing a stored source URL and filling a blank from
+  the series page) runs in the background so a slow CDN can't consume a
+  Lane's gap.
   Fetches use `bogdanfinn/tls-client` with Chrome profile as defence in depth
   against fingerprint-based blocking; any failure log and skip. kagane, comix
   and novelfull sit behind Cloudflare JavaScript challenges the TLS client
@@ -152,15 +165,17 @@ Guidance for OpenCode (and Claude Code) working under `backend/`. See root `AGEN
   `_REDIRECT_URI` (required; Discord OAuth for the browser UI),
   `DISCORD_REQUIRED_ROLE` (optional role gate, empty by default),
   `DISCORD_API_BASE` (default `https://discord.com/api/v10`),
-  `LATEST_CHAPTER_POLL_ENABLED`/`_COOLDOWN`/`_BROWSER_COOLDOWN`/`_INTERVAL`/
-  `_BATCH`/`_STAGGER` (background latest-chapter poller; defaults on,
-  `1h` plain-TLS cooldown, `6h` browser cooldown, `10m`/`14`/`20s`; both
-  cooldowns have a `15m` floor). The browser cooldown is longer for cost, not
-  for safety: a challenged page costs seconds of a serialized single-tab
-  browser, while a plain read costs one request. It buys no documented
-  reduction in challenge risk — free-plan zones have no bot score and no
-  published per-IP rate input, and `cf_clearance` expires in 30 minutes so
-  every cadence at or above 1h re-solves anyway —
+  `LATEST_CHAPTER_POLL_ENABLED` (background latest-chapter poller kill
+  switch, default on). Pace is per Site in the registry (issue #100): every
+  Site rests an hour and gaps ten seconds, a Site with more eligible Series
+  than 360 tightens its own gap toward the 1s floor, and browser Lanes wake
+  Chrome only on demand (ADR-0005). The `_COOLDOWN`/`_BROWSER_COOLDOWN`/
+  `_INTERVAL`/`_BATCH`/`_STAGGER` knobs that used to size a shared pace are
+  gone. The 1h rest for browser Sites is safe on documented grounds: a
+  challenged page costs seconds of a serialized single-tab browser, free-plan
+  zones have no bot score and no published per-IP rate input, and
+  `cf_clearance` expires in 30 minutes so every cadence at or above 1h
+  re-solves anyway —
   `docs/research/cloudflare-bot-scoring-and-poll-cadence.md`.
   `USERSCRIPT_PATH` and `NOVEL_USERSCRIPT_PATH` (files served at
   `/u/{token}/manga-bookmark.user.js` and `/u/{token}/novel-bookmark.user.js`,