Spec #135: owner data-correction actions — Latest Chapter, series_url, Cover, orphan removal (#156)

Implements spec #135 (spec 2 of 4, derived from wayfinder map #114; decisions settled in #120/#121/#125/#131). Blocked-by #134 is merged, so this lands on `main`.

Four owner actions the dashboard can now perform, one ticket each:

- **#149** — Latest Chapter correction: one numeric input, overwritten by the next machine write.
- **#151** — Series URL repair: owner-typed, gated by the poller's own fetch gate.
- **#150 / #153 / #154** — Cover replacement: addresses derived from bytes (`#150`), a Forced Poll replaces the Cover while an ordinary pass still only fills a blank one (`#153`), and byte reclamation is one guarded helper, file first / covers row last (`#154`).
- **#155** — Orphan removal: one Series at a time, with the foreign key as the guard.

Plus **#152** — Latest Chapter provenance: one derived line naming the actor class, so an owner can tell a hand-edited number from a machine read.

- Migration `0015_latest_correction.sql` adds the correction/provenance columns; `0009` now derives cover addresses from bytes.
- ADR `0014-cover-addresses-from-bytes.md` records the address scheme.

Backend tests cover the store, poller, admin handlers, and web routes (`go test ./...`, needs Docker).

Reviewed-on: #156
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/store/admin.go

@@ -41,7 +41,8 @@ type SeriesFilter struct {
 // must never leave the store package — so the projection does not select it,
 // and only the anonymous boolean in raisedByReaderAnswer crosses it.
 const adminSeriesColumns = `s.site, s.series_id, s.title, s.series_url, s.cover_address,
-	s.kind, s.latest_chapter, s.latest_chapter_num, s.latest_checked_at, s.force_poll_at`
+	s.kind, s.latest_chapter, s.latest_chapter_num, s.latest_checked_at, s.force_poll_at,
+	s.latest_corrected_at`
 
 // raisedByReaderAnswer answers "did a Reader's report set this number" without
 // naming which Reader. Kept apart from adminSeriesColumns so the column list —
@@ -71,9 +72,15 @@ type AdminSeries struct {
 	// ForcePollAt is the owner's "check now" request stamp (issue #146), zero
 	// meaning never asked. Pending is derived, never stored: a request is
 	// pending while ForcePollAt is newer than LatestCheckedAt.
-	ForcePollAt    int64
-	ReaderCount    int
-	RaisedByReader bool // a Reader's report set LatestChapterNum
+	ForcePollAt int64
+	// LatestCorrectedAt is the correction stamp (issue #149): non-zero means
+	// the Latest Chapter is the owner's, zero means never corrected. The
+	// provenance line (#152) derives from it, so the zero-means-never meaning
+	// is load-bearing.
+	LatestCorrectedAt int64
+	ReaderCount       int
+	RaisedByReader    bool // a Reader's report set LatestChapterNum
+
 }
 
 // SeriesPage is one page of the owner's filtered Series list plus the count
@@ -189,7 +196,7 @@ func (s *Store) SeriesPage(f SeriesFilter) (SeriesPage, error) {
 		`+where+`
 		GROUP BY s.site, s.series_id, s.title, s.series_url, s.cover_address,
 		         s.kind, s.latest_chapter, s.latest_chapter_num, s.latest_checked_at,
-		         s.force_poll_at, s.latest_raised_by
+		         s.force_poll_at, s.latest_corrected_at, s.latest_raised_by
 		`+having+`
 		ORDER BY s.latest_checked_at, s.site, s.series_id
 		LIMIT $`+strconv.Itoa(base+1)+` OFFSET $`+strconv.Itoa(base+2), args...)
@@ -264,7 +271,7 @@ func scanAdminSeries(scan func(...any) error) (AdminSeries, int, error) {
 	if err := scan(
 		&a.Site, &a.SeriesID, &a.Title, &a.SeriesURL, &a.CoverAddress,
 		&a.Kind, &a.LatestChapter, &latestChapterNum, &a.LatestCheckedAt,
-		&a.ForcePollAt,
+		&a.ForcePollAt, &a.LatestCorrectedAt,
 		&a.RaisedByReader, &a.ReaderCount, &total,
 	); err != nil {
 		return AdminSeries{}, 0, err