feat(cover): acquire a Series Cover at creation (#59)

A Reader who bookmarks a Series nobody holds yet no longer waits out the
poll queue for its artwork: the first Bookmark to create a Series fires
Store.OnSeriesCreated, and latest.Acquirer turns that into a single
series-page fetch yielding both the Latest Chapter and the cover URL. The
bytes are fetched through the gated cover fetcher and stored
content-addressed, so the wire carries an absolute URL on this
deployment's own origin (ADR-0007) - never a third-party address and
never one that 404s.

- series.cover_address (migration 0009) splits the third-party source
  address the bytes came from (series.cover) from the content address
  they are stored under. A blank cover_address is what "no Cover yet"
  means, so the wire field is empty until real bytes exist.
- GET /covers/{address} serves the bytes publicly and uncredentialed,
  immutable-cached; the address is gated by a 64-hex pattern and
  cross-checked against a pure function of itself before any filesystem
  read.
- Client-sent cover values are decoded and discarded permanently: the
  cover columns are absent from Upsert's INSERT and its DO UPDATE, so no
  request value can reach the shared Series row (extends ADR-0003's
  "ignored after creation" to "ignored always", keeps ADR-0004's flat
  wire so installed userscripts keep working).
- Acquisition is asynchronous and log-and-drop: the Reader's write
  neither blocks on nor fails with a third-party Site. It is bounded by
  a two-slot semaphore, cancelled at shutdown, and stamps
  latest_checked_at so the poller does not refetch the same page a tick
  later.
- store.CoverContentType canonicalises comix's non-standard "image/jpg"
  to "image/jpeg", so one image cannot land under two spellings.
- PUBLIC_BASE_URL is a new required setting; Open rejects anything that
  is not an absolute http(s) origin, since a bare hostname would start
  cleanly and emit addresses no browser can load.

Verified against a live backend: bookmarking a comix series produced a
280x420 JPEG served from /covers/<sha256> with the immutable cache
header, and the web UI card renders that address.

backend/main.go

@@ -34,7 +34,13 @@ type Config struct {
 	// serving a stored address without durable bytes would be worse than a
 	// startup failure.
 	CoverDir string
-	Port     string
+	// PublicBaseURL is the origin this deployment answers on, e.g.
+	// "https://bookmarks.example.com". Required: cover URLs go out absolute
+	// because the userscript renders them on third-party origins, where a
+	// relative path would resolve against the Site (ADR-0007), and there is
+	// no way to guess it from a request the poller never sees.
+	PublicBaseURL string
+	Port          string
 	// OwnerDiscordID identifies the seeded owner Reader (issue #22). Required:
 	// bookmarks are scoped to a Reader, and a fresh deployment needs one
 	// before anybody logs in. The owner is also the only Reader who can revoke
@@ -172,6 +178,7 @@ func loadConfig() Config {
 		TokenKey:            os.Getenv("TOKEN_KEY"),
 		DatabaseURL:         os.Getenv("DATABASE_URL"),
 		CoverDir:            os.Getenv("COVER_DIR"),
+		PublicBaseURL:       os.Getenv("PUBLIC_BASE_URL"),
 		Port:                envOr("PORT", "8080"),
 		OwnerDiscordID:      os.Getenv("OWNER_DISCORD_ID"),
 		UserscriptPath:      envOr("USERSCRIPT_PATH", "/userscript/manga-bookmark.user.js"),
@@ -199,7 +206,12 @@ func loadConfig() Config {
 // /healthz is public.
 func newRouter(s *store.Store, cfg Config) http.Handler {
 	mux := http.NewServeMux()
+	h := &api.Handler{Store: s}
 	mux.HandleFunc("GET /healthz", api.Healthz)
+	// Public: cover bytes are rendered by the userscript on origins that may
+	// not send our credentials, and the address is the hash of a URL the Site
+	// already publishes (ADR-0007).
+	mux.HandleFunc("GET /covers/{address}", h.Cover)
 
 	// Outside httpmw.Auth (the updater sends no Authorization header) and
 	// outside the web UI's Discord auth (the script must be installable
@@ -211,7 +223,6 @@ func newRouter(s *store.Store, cfg Config) http.Handler {
 	mux.HandleFunc("GET /u/{token}/novel-bookmark.user.js",
 		userscript.Handler(s, cfg.NovelUserscriptPath))
 
-	h := &api.Handler{Store: s}
 	protected := http.NewServeMux()
 	protected.HandleFunc("GET /bookmarks", h.List)
 	protected.HandleFunc("PUT /bookmarks/{key}", h.Put)
@@ -262,6 +273,9 @@ func main() {
 	if cfg.CoverDir == "" {
 		log.Fatal("COVER_DIR is required")
 	}
+	if cfg.PublicBaseURL == "" {
+		log.Fatal("PUBLIC_BASE_URL is required")
+	}
 	// The web UI signs in through Discord, so a deployment without the OAuth
 	// application is misconfigured rather than passwordless.
 	for key, v := range map[string]string{
@@ -282,7 +296,7 @@ func main() {
 		TokenHash: token.Hash(token.Token([]byte(cfg.TokenKey), cfg.OwnerDiscordID, 0)),
 	}
 
-	s, err := store.Open(cfg.DatabaseURL, owner, cfg.CoverDir)
+	s, err := store.Open(cfg.DatabaseURL, owner, cfg.CoverDir, cfg.PublicBaseURL)
 	if err != nil {
 		log.Fatalf("open store: %v", err)
 	}
@@ -310,6 +324,16 @@ func main() {
 			log.Printf("browser fetcher at %s", ws)
 		}
 	}
+	// A Series nobody had bookmarked before gets its Latest Chapter and its
+	// Cover from one fetch, at creation, instead of waiting out a poll queue
+	// ordered by Reader count. Off the write path: the hook returns as soon
+	// as the goroutine is started.
+	if f, err := latest.NewTLSFetcher(); err != nil {
+		log.Printf("creation-time acquisition disabled, cannot build client: %v", err)
+	} else {
+		acq := &latest.Acquirer{Store: s, Fetch: f, Covers: latest.NewCoverFetcher(), Ctx: pollCtx}
+		s.OnSeriesCreated = acq.Acquire
+	}
 	startLatestPoller(pollCtx, s, cfg.LatestPoll, browser)
 
 	srv := &http.Server{