feat(cover): acquire a Series Cover at creation (#59)

A Reader who bookmarks a Series nobody holds yet no longer waits out the
poll queue for its artwork: the first Bookmark to create a Series fires
Store.OnSeriesCreated, and latest.Acquirer turns that into a single
series-page fetch yielding both the Latest Chapter and the cover URL. The
bytes are fetched through the gated cover fetcher and stored
content-addressed, so the wire carries an absolute URL on this
deployment's own origin (ADR-0007) - never a third-party address and
never one that 404s.

- series.cover_address (migration 0009) splits the third-party source
  address the bytes came from (series.cover) from the content address
  they are stored under. A blank cover_address is what "no Cover yet"
  means, so the wire field is empty until real bytes exist.
- GET /covers/{address} serves the bytes publicly and uncredentialed,
  immutable-cached; the address is gated by a 64-hex pattern and
  cross-checked against a pure function of itself before any filesystem
  read.
- Client-sent cover values are decoded and discarded permanently: the
  cover columns are absent from Upsert's INSERT and its DO UPDATE, so no
  request value can reach the shared Series row (extends ADR-0003's
  "ignored after creation" to "ignored always", keeps ADR-0004's flat
  wire so installed userscripts keep working).
- Acquisition is asynchronous and log-and-drop: the Reader's write
  neither blocks on nor fails with a third-party Site. It is bounded by
  a two-slot semaphore, cancelled at shutdown, and stamps
  latest_checked_at so the poller does not refetch the same page a tick
  later.
- store.CoverContentType canonicalises comix's non-standard "image/jpg"
  to "image/jpeg", so one image cannot land under two spellings.
- PUBLIC_BASE_URL is a new required setting; Open rejects anything that
  is not an absolute http(s) origin, since a bare hostname would start
  cleanly and emit addresses no browser can load.

Verified against a live backend: bookmarking a comix series produced a
280x420 JPEG served from /covers/<sha256> with the immutable cache
header, and the web UI card renders that address.

backend/internal/latest/poller.go

@@ -87,23 +87,26 @@ func (p *Poller) prefetchCover(ctx context.Context, sr store.Series) {
 		}
 		return
 	}
-	if p.CoverBytesFetch == nil {
+	if p.CoverBytesFetch == nil || sr.CoverAddress != "" {
 		return
 	}
-	_, _, found, err := p.Store.GetCover(sr.Cover)
+	// Bytes may already be stored from an earlier poll that ran before the
+	// Series carried an address; storing them again is free (they are
+	// content-addressed and immutable), and the point of the second call is
+	// the address, which is what makes the Cover visible on the wire.
+	body, contentType, found, err := p.Store.GetCover(sr.Cover)
 	if err != nil {
 		log.Printf("latest poll %q: read cover: %v", sr.Key(), err)
 		return
 	}
-	if found {
-		return
+	if !found {
+		body, contentType, err = p.CoverBytesFetch.Fetch(ctx, sr.Cover)
+		if err != nil {
+			log.Printf("latest poll %q: fetch cover: %v", sr.Key(), err)
+			return
+		}
 	}
-	body, contentType, err := p.CoverBytesFetch.Fetch(ctx, sr.Cover)
-	if err != nil {
-		log.Printf("latest poll %q: fetch cover: %v", sr.Key(), err)
-		return
-	}
-	if err := p.Store.PutCover(sr.Cover, body, contentType); err != nil {
+	if err := p.Store.SetSeriesCover(sr.Site, sr.SeriesID, sr.Cover, body, contentType); err != nil {
 		log.Printf("latest poll %q: persist cover: %v", sr.Key(), err)
 	}
 }