feat: a Reader's Sighting defers a Poll of a solitary Series (#103)

A userscript PUT already carries the Latest Chapter the Reader's own browser
read; it now stands in for a Poll where being wrong can hurt nobody else.
Deferral lives in the due query beside the rest cutoff: one Bookmark, sighted
within one rest, under the six-rest ceiling. checkOne judges the Reader whose
report raised the value off the comparison it already makes - three
contradictions stop them deferring, twenty confirmations forgive.

ADR-0011 records the trust model and the rejected alternatives.

backend/api_test.go

@@ -621,6 +621,46 @@ func TestPutDoesNotClobberLatestCheckedAt(t *testing.T) {
 	}
 }
 
+// Sighting deferral (issue #103) only reaches production through the PUT
+// handler: the store and poller can be right and the feature still dead if the
+// handler never records the report. Asserted where a client can see it - the
+// series stops being due the moment the PUT lands.
+func TestPutRecordsASighting(t *testing.T) {
+	s := newTestStore(t)
+	srv := newRouter(s, testConfig(), nil)
+
+	now := time.Now().UnixMilli()
+	hour := time.Hour.Milliseconds()
+	seedForCheck(t, s, "asura:x", "https://asurascans.com/comics/x", now-2*hour)
+	due, err := s.DueForLatestCheck("asura", now-hour, now-6*hour)
+	if err != nil {
+		t.Fatalf("DueForLatestCheck: %v", err)
+	}
+	if len(due) != 1 {
+		t.Fatalf("due before the PUT = %d series, want 1", len(due))
+	}
+
+	body := `{"key":"asura:x","site":"asura","series_id":"x",
+		"series_url":"https://asurascans.com/comics/x",
+		"last_chapter":"Chapter 5","last_chapter_num":5,
+		"latest_chapter":"Chapter 9","latest_chapter_num":9}`
+	req := httptest.NewRequest(http.MethodPut, "/bookmarks/asura:x", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	srv.ServeHTTP(rec, auth(req))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("PUT status = %d, want 200 (body %s)", rec.Code, rec.Body.String())
+	}
+
+	due, err = s.DueForLatestCheck("asura", now-hour, now-6*hour)
+	if err != nil {
+		t.Fatalf("DueForLatestCheck: %v", err)
+	}
+	if len(due) != 0 {
+		t.Fatalf("due after the PUT = %d series, want 0: the handler recorded no Sighting", len(due))
+	}
+}
+
 // The userscript route is registered outside the web UI's Discord auth, so it
 // must keep working whatever the web config — see internal/userscript for the
 // handler's own behaviour. The credential in the path is the owner's derived