feat(cover): acquire a Series Cover at creation (#59)

A Reader who bookmarks a Series nobody holds yet no longer waits out the
poll queue for its artwork: the first Bookmark to create a Series fires
Store.OnSeriesCreated, and latest.Acquirer turns that into a single
series-page fetch yielding both the Latest Chapter and the cover URL. The
bytes are fetched through the gated cover fetcher and stored
content-addressed, so the wire carries an absolute URL on this
deployment's own origin (ADR-0007) - never a third-party address and
never one that 404s.

- series.cover_address (migration 0009) splits the third-party source
  address the bytes came from (series.cover) from the content address
  they are stored under. A blank cover_address is what "no Cover yet"
  means, so the wire field is empty until real bytes exist.
- GET /covers/{address} serves the bytes publicly and uncredentialed,
  immutable-cached; the address is gated by a 64-hex pattern and
  cross-checked against a pure function of itself before any filesystem
  read.
- Client-sent cover values are decoded and discarded permanently: the
  cover columns are absent from Upsert's INSERT and its DO UPDATE, so no
  request value can reach the shared Series row (extends ADR-0003's
  "ignored after creation" to "ignored always", keeps ADR-0004's flat
  wire so installed userscripts keep working).
- Acquisition is asynchronous and log-and-drop: the Reader's write
  neither blocks on nor fails with a third-party Site. It is bounded by
  a two-slot semaphore, cancelled at shutdown, and stamps
  latest_checked_at so the poller does not refetch the same page a tick
  later.
- store.CoverContentType canonicalises comix's non-standard "image/jpg"
  to "image/jpeg", so one image cannot land under two spellings.
- PUBLIC_BASE_URL is a new required setting; Open rejects anything that
  is not an absolute http(s) origin, since a bare hostname would start
  cleanly and emit addresses no browser can load.

Verified against a live backend: bookmarking a comix series produced a
280x420 JPEG served from /covers/<sha256> with the immutable cache
header, and the web UI card renders that address.

backend/internal/latest/acquire.go

@@ -0,0 +1,136 @@
+package latest
+
+import (
+	"context"
+	"log"
+	"slices"
+	"sync"
+	"time"
+
+	"bookmarkmanager/backend/internal/store"
+)
+
+// acquireTimeout bounds one creation-time acquisition end to end: the series
+// page plus the cover bytes. Nothing is waiting on it — the Reader's write has
+// already returned — so this only stops a stalled Site from holding a
+// goroutine and a connection open forever.
+const acquireTimeout = 45 * time.Second
+
+// Acquirer gives a Series its Latest Chapter and its Cover the moment the
+// first Bookmark creates it, instead of leaving the Reader to wait out the
+// poll queue — which is ordered by Reader count, so a Series with one Reader
+// sits behind every popular one (ADR-0007).
+//
+// Both facts come from a single series-page fetch, which is also why no
+// client-supplied cover hint is worth accepting: the page has to be fetched
+// for the chapter signal regardless, so a hint would save no request while
+// adding a client-controlled input to a server-side fetch.
+//
+// Every failure path is "log and move on". The Bookmark, its progress and its
+// Latest Chapter are already committed; a Site that is down or a Cover that
+// cannot be produced must not disturb any of them, and the Series is simply
+// left blank until the poll's own cover pass (#61) fills it.
+type Acquirer struct {
+	Store *store.Store
+	// Fetch retrieves the series page. Nil disables acquisition entirely.
+	Fetch Fetcher
+	// Covers retrieves the cover bytes. Nil leaves the Cover blank and the
+	// chapter half working.
+	Covers CoverBytesFetcher
+	// Ctx cancels in-flight acquisitions at shutdown. A hook signature has
+	// nowhere to pass one, so it lives here; nil means context.Background.
+	Ctx context.Context
+
+	inflight sync.WaitGroup
+}
+
+// acquireSlots caps how many creation-time fetches run at once. A Reader whose
+// userscript bulk-syncs creates many Series at once, and a burst of
+// simultaneous requests from one server IP is the traffic shape most likely to
+// move that IP's bot score — the same reason the poller staggers its batch.
+var acquireSlots = make(chan struct{}, 2)
+
+// Acquire starts one acquisition and returns immediately: a Reader's bookmark
+// action may not block on a third-party Site's latency, nor fail with it. It
+// is the store's OnSeriesCreated hook, so it only ever runs for a Series no
+// Reader had bookmarked before.
+func (a *Acquirer) Acquire(sr store.Series) {
+	a.inflight.Add(1)
+	go func() {
+		defer a.inflight.Done()
+		defer func() {
+			if r := recover(); r != nil {
+				log.Printf("acquire %q: recovered from panic: %v", sr.Key(), r)
+			}
+		}()
+		parent := a.Ctx
+		if parent == nil {
+			parent = context.Background()
+		}
+		select {
+		case acquireSlots <- struct{}{}:
+			defer func() { <-acquireSlots }()
+		case <-parent.Done():
+			return
+		}
+		ctx, cancel := context.WithTimeout(parent, acquireTimeout)
+		defer cancel()
+		a.acquire(ctx, sr)
+	}()
+}
+
+// Wait blocks until every started acquisition has finished. It exists for
+// tests: an asynchronous side effect is otherwise unobservable without
+// polling for it.
+func (a *Acquirer) Wait() { a.inflight.Wait() }
+
+func (a *Acquirer) acquire(ctx context.Context, sr store.Series) {
+	// Browser-backed Sites are deliberately not acquired here: their pages
+	// only yield a Cloudflare challenge to the TLS client, so the request
+	// would be spent for nothing.
+	if a.Fetch == nil || slices.Contains(browserBackedSites, sr.Site) {
+		return
+	}
+	// series_url arrives in a client-supplied PUT body, so the same gate the
+	// poller uses applies here — without it a token-holder chooses what the
+	// server fetches from its own network position.
+	if !fetchableSeriesURL(sr.Site, sr.SeriesURL) {
+		log.Printf("acquire %q: not fetchable: site=%q url=%q", sr.Key(), sr.Site, sr.SeriesURL)
+		return
+	}
+
+	body, status, err := a.Fetch.Get(ctx, sr.SeriesURL)
+	if err != nil {
+		log.Printf("acquire %q: fetch %s: %v", sr.Key(), sr.SeriesURL, err)
+		return
+	}
+	if status != 200 {
+		log.Printf("acquire %q: fetch %s: status %d", sr.Key(), sr.SeriesURL, status)
+		return
+	}
+
+	// This page just served the same purpose a poll tick would have; without
+	// the stamp the row stays due and the poller refetches it immediately.
+	if err := a.Store.MarkLatestChecked(sr.Site, sr.SeriesID, time.Now().UnixMilli()); err != nil {
+		log.Printf("acquire %q: mark checked: %v", sr.Key(), err)
+	}
+
+	if latest, ok := latestChapterFrom(sr.Site, sr.SeriesURL, body); ok {
+		if err := a.Store.SetLatestChapter(sr.Site, sr.SeriesID, latest.Label, latest.Num); err != nil {
+			log.Printf("acquire %q: set latest chapter: %v", sr.Key(), err)
+		}
+	}
+
+	cover, ok := coverFrom(sr.Site, sr.SeriesURL, body)
+	if !ok || a.Covers == nil {
+		return
+	}
+	bytes, contentType, err := a.Covers.Fetch(ctx, cover)
+	if err != nil {
+		log.Printf("acquire %q: fetch cover %s: %v", sr.Key(), cover, err)
+		return
+	}
+	if err := a.Store.SetSeriesCover(sr.Site, sr.SeriesID, cover, bytes, contentType); err != nil {
+		log.Printf("acquire %q: persist cover: %v", sr.Key(), err)
+	}
+}