feat(cover): acquire a Series Cover at creation (#59)

A Reader who bookmarks a Series nobody holds yet no longer waits out the
poll queue for its artwork: the first Bookmark to create a Series fires
Store.OnSeriesCreated, and latest.Acquirer turns that into a single
series-page fetch yielding both the Latest Chapter and the cover URL. The
bytes are fetched through the gated cover fetcher and stored
content-addressed, so the wire carries an absolute URL on this
deployment's own origin (ADR-0007) - never a third-party address and
never one that 404s.

- series.cover_address (migration 0009) splits the third-party source
  address the bytes came from (series.cover) from the content address
  they are stored under. A blank cover_address is what "no Cover yet"
  means, so the wire field is empty until real bytes exist.
- GET /covers/{address} serves the bytes publicly and uncredentialed,
  immutable-cached; the address is gated by a 64-hex pattern and
  cross-checked against a pure function of itself before any filesystem
  read.
- Client-sent cover values are decoded and discarded permanently: the
  cover columns are absent from Upsert's INSERT and its DO UPDATE, so no
  request value can reach the shared Series row (extends ADR-0003's
  "ignored after creation" to "ignored always", keeps ADR-0004's flat
  wire so installed userscripts keep working).
- Acquisition is asynchronous and log-and-drop: the Reader's write
  neither blocks on nor fails with a third-party Site. It is bounded by
  a two-slot semaphore, cancelled at shutdown, and stamps
  latest_checked_at so the poller does not refetch the same page a tick
  later.
- store.CoverContentType canonicalises comix's non-standard "image/jpg"
  to "image/jpeg", so one image cannot land under two spellings.
- PUBLIC_BASE_URL is a new required setting; Open rejects anything that
  is not an absolute http(s) origin, since a bare hostname would start
  cleanly and emit addresses no browser can load.

Verified against a live backend: bookmarking a comix series produced a
280x420 JPEG served from /covers/<sha256> with the immutable cache
header, and the web UI card renders that address.

backend/AGENTS.md

@@ -98,6 +98,18 @@ Guidance for OpenCode (and Claude Code) working under `backend/`. See root `AGEN
   (`Store.SetLatestChapter`), not a read-modify-write of the whole bookmark:
   it cannot revert read progress or move `updated_at`, so the old
   stale-re-read race is gone with the Get+Upsert flow.
+- **Covers are acquired at creation, then served from our own origin
+  (ADR-0007):** the first Bookmark of a Series fires `Store.OnSeriesCreated`,
+  which `latest.Acquirer` turns into one series-page fetch yielding both the
+  Latest Chapter and the cover URL; the bytes then go through
+  `latest.CoverBytesFetcher` into `Store.SetSeriesCover`. It runs in a
+  goroutine — the Reader's PUT must neither block on a Site nor fail with one
+  — and every failure is logged and dropped, leaving the Bookmark intact. The
+  wire's `cover` is the absolute `PUBLIC_BASE_URL + /covers/{sha256}` once
+  bytes exist and `""` before, never an address that 404s. `GET /covers/{addr}`
+  is public and uncredentialed: the userscript renders it on a Site's origin,
+  where no cookie or token of ours travels. A client-sent `cover` is decoded
+  and discarded, permanently (ADR-0004 compatibility).
 - **`updated_at` drives list order, so moves only on real reading progress:** server apply its timestamp when row new or `last_chapter_num` changes, else keep stored value — favouriting series or recording newly published chapter must not reorder list. `PUT` therefore returns row **as stored**, clients must adopt that response rather than own payload. See `plans/2026-07-25-bookmark-list-favorites-design.md` §4.
 - **Lifecycle buckets:** `status` on each bookmark is `reading` | `archived` |
   `finished`, orthogonal to `favorite`. Archived and finished appear only in
@@ -115,6 +127,9 @@ Guidance for OpenCode (and Claude Code) working under `backend/`. See root `AGEN
   `ALLOWED_ORIGINS` (comma list),
   `DATABASE_URL` (Postgres connection URL, required — no default),
   `COVER_DIR` (required filesystem volume for content-addressed Cover bytes),
+  `PUBLIC_BASE_URL` (required origin this deployment answers on, trailing
+  slash trimmed; every Cover URL on the wire is built from it, absolute
+  because the userscript renders on a Site's origin — ADR-0007),
   `PORT` (default `8080`), `DISCORD_CLIENT_ID`/`_CLIENT_SECRET`/`_GUILD_ID`/
   `_REDIRECT_URI` (required; Discord OAuth for the browser UI),
   `DISCORD_REQUIRED_ROLE` (optional role gate, empty by default),