Delete the kagane-specific cover path (#63) (#73)

Closes #63

Deletes the second way to reach a Cover. Since #62, every Site's cover bytes land in the content-addressed store at creation or on the poll, and the one public route serves them all — nothing needs the kagane proxy anymore.

## What went

- **Template-level rewrite:** `Bookmark.CoverURL()` and both templates' use of it. Cards and chrome now render `.Cover` — the wire value — and nothing else. `Bookmark.CoverSource` was dead once `CoverURL` went, so it and its `bookmarkColumns` entry are gone too.
- **Kagane-only cover route and its identifier validation:** `GET /img/kagane/{id}`, `web.CoverFetcher`, `coverIDRe`, and the whole `internal/web/cover.go`.
- **The proxy's persistence:** `store.KaganeImageID`, `GetKaganeCover`, `PutKaganeCover`, `kaganeCoverSourceURL`, `kaganeCoverRe`.
- **The kagane-shaped branch in the byte-fetch routing:** `fetchCoverBytes` no longer takes a `site` argument and no longer names a Site. The URL shape kagane's API publishes is claimed by the browser module itself — `kaganeImageURLRe` + `browserCoverURL` live in `latest/browser.go` with the rest of the per-Site knowledge — and `BrowserFetcher.Image` is now URL-driven (it validates the URL it will navigate to, same SSRF discipline as before). The no-plain-TLS-fallback rule for a claimed URL is preserved: a claimed address with no browser is an error, never a challenge-page fetch.

## What stayed (deliberately)

- `BrowserFetcher.Image` and the browser-backed acquisition path: kagane genuinely serves cover bytes behind the challenge + `cross-origin-resource-policy: same-origin`, so the sidecar remains the only fetcher for them — it just routes by URL claim now instead of by Site name.
- `fetcherFor`'s per-Site page routing (kagane/novelfull page fetches) — that is the page path, not a cover path.

## Acceptance criteria

- [x] Template-level kagane cover rewrite gone
- [x] Kagane-only cover route and its identifier validation gone
- [x] Tests removed/rewritten against the general route, guarantees kept: unstored + traversal-shaped addresses serve nothing (`TestPublicCoverRejectsUnknownAddress`), non-image content types never echoed (`TestPublicCoverNeverEchoesNonImage` — new; the store-side gate was already pinned by `TestCoverStoreAcceptsAnySourceURL`). Store reopen-persistence and filesystem content-addressing tests rewritten against `PutCover`/`GetCover`, no guarantee lost.
- [x] No Site name in a cover code path outside the acquisition module (`grep kagane backend`: store/web/templates/api are clean; remaining hits are `latest/browser.go` + `latest/sites.go`, tests, docs)
- [x] Web UI and panel render Covers for all six Sites (templates render the wire address; panel renders `b.cover` — untouched, it never had a kagane path)
- [x] `go test ./...` green

## Verification

- `go vet ./...` clean
- `go test ./...` — all packages pass (root 16.9s, latest 12.7s, store 12.7s, web 0.004s)
- `CGO_ENABLED=0 go build` produces the static binary
- Cover-path tests run verbosely: `TestPublicCoverServesStoredBytesUnauthenticated`, `TestPublicCoverRejectsUnknownAddress` (unknown/malformed/traversal/empty), `TestPublicCoverNeverEchoesNonImage`, `TestListRendersAcquiredCover`, `TestAcquireKaganeCoverThroughBrowser`, `TestRunOncePrefetchesKaganeCover`, `TestRunOnceRoutesNonKaganeCoverToPublicFetcher` all pass; the three `SMOKE_*` tests skip without the browser sidecar, as designed

Live browser verification of the "web UI and panel render Covers for all six Sites" criterion is being run separately with Playwright against real Site pages and a locally mocked backend.

Reviewed-on: #73
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/web/cover.go

@@ -1,89 +0,0 @@
-package web
-
-import (
-	"bookmarkmanager/backend/internal/store"
-	"context"
-	"log"
-	"net/http"
-	"regexp"
-	"time"
-)
-
-// CoverFetcher retrieves one kagane cover by image id. Satisfied by
-// latest.BrowserFetcher. It is nil when BROWSER_WS_URL is unset; uncached
-// covers are then unavailable, while covers already stored by the backend
-// remain available without a browser.
-type CoverFetcher interface {
-	Image(ctx context.Context, imageID string) (body []byte, contentType string, err error)
-}
-
-// coverIDRe matches the request path segment that becomes part of an outbound
-// URL. The proxy is session-gated, but the id still reaches a headless browser,
-// so it is validated at the boundary rather than passed through.
-var coverIDRe = regexp.MustCompile(`^[0-9a-f-]{36}$`)
-
-// coverTimeout bounds one proxied cover. Shorter than the fetcher's own
-// challenge budget on purpose: a browser page is waiting on this, and a cover
-// that has not arrived by now is better left as a broken slot than as a request
-// holding a connection open.
-const coverTimeout = 20 * time.Second
-
-// kaganeCover serves a kagane cover from the backend's own origin.
-//
-// kagane answers image requests with a Cloudflare challenge and
-// `cross-origin-resource-policy: same-origin`, so the web UI cannot render one
-// directly under any combination of referrer policy or crossorigin attribute
-// (verified 2026-08-08). Fetching it through the headless browser that already
-// clears the challenge, and re-serving it here, is what puts the bytes on an
-// origin the page may load from.
-func (h *Handler) kaganeCover(w http.ResponseWriter, r *http.Request) {
-	id := r.PathValue("id")
-	if !coverIDRe.MatchString(id) {
-		http.NotFound(w, r)
-		return
-	}
-	body, contentType, ok, err := h.store.GetKaganeCover(id)
-	if err != nil {
-		log.Printf("read kagane cover %s: %v", id, err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	if ok {
-		writeCover(w, body, contentType)
-		return
-	}
-	if h.covers == nil {
-		http.NotFound(w, r)
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), coverTimeout)
-	defer cancel()
-	body, contentType, err = h.covers.Image(ctx, id)
-	if err != nil {
-		log.Printf("kagane cover %s: %v", id, err)
-		http.NotFound(w, r)
-		return
-	}
-	canonical, ok := store.CoverContentType(contentType)
-	if !ok {
-		log.Printf("kagane cover %s: unexpected content type %q", id, contentType)
-		http.NotFound(w, r)
-		return
-	}
-	contentType = canonical
-	if err := h.store.PutKaganeCover(id, body, contentType); err != nil {
-		log.Printf("persist kagane cover %s: %v", id, err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	writeCover(w, body, contentType)
-}
-
-// writeCover sends the bytes with a long cache life: an image id names one
-// immutable rendering, so a client that has it never needs to ask again.
-func writeCover(w http.ResponseWriter, body []byte, contentType string) {
-	w.Header().Set("Content-Type", contentType)
-	w.Header().Set("Cache-Control", "private, max-age=604800, immutable")
-	w.Write(body)
-}

backend/internal/web/templates/card.html

@@ -6,7 +6,7 @@
   <div class="row">
     <a class="cover" href="{{.ContinueURL}}" target="_blank" rel="noopener noreferrer"
        tabindex="-1" aria-hidden="true">
-      {{if .CoverURL}}<img src="{{.CoverURL}}" alt="" loading="lazy">
+      {{if .Cover}}<img src="{{.Cover}}" alt="" loading="lazy">
       {{/* aria-hidden on the cover link is not enough — Chromium still exposes
            the letter because the link is programmatically focusable — so the
            monogram carries its own, same as the recent strip's. */}}

backend/internal/web/templates/chrome.html

@@ -14,7 +14,7 @@
     <a class="recent-card {{if .HasNewChapter}}is-new{{end}}" href="{{.ContinueURL}}"
        target="_blank" rel="noopener noreferrer">
       <span class="recent-cover">
-        {{if .CoverURL}}<img src="{{.CoverURL}}" alt="" loading="lazy">
+        {{if .Cover}}<img src="{{.Cover}}" alt="" loading="lazy">
         {{else}}<span class="monogram" aria-hidden="true">{{.Initial}}</span>{{end}}
         {{if .HasNewChapter}}<span class="foot-rule"></span>
         {{else if .Favorite}}<span class="foot-rule brass"></span>{{end}}

backend/internal/web/web.go

@@ -50,9 +50,6 @@ type Handler struct {
 	// httpClient is the plain stdlib client that talks to Discord. It is not
 	// an injected interface: tests point APIBase at a stub server instead.
 	httpClient *http.Client
-	// covers proxies kagane cover images, which no browser can load directly.
-	// Nil disables the endpoint — see CoverFetcher.
-	covers CoverFetcher
 }
 
 // listView is what every list-rendering template receives.
@@ -114,7 +111,7 @@ type loginView struct {
 
 // New parses every template up front so a broken one kills the process at
 // startup rather than the first request that touches it.
-func New(s *store.Store, discord DiscordConfig, tokenKey []byte, mangaPath, novelPath string, covers CoverFetcher) (*Handler, error) {
+func New(s *store.Store, discord DiscordConfig, tokenKey []byte, mangaPath, novelPath string) (*Handler, error) {
 	tmpl, err := template.ParseFS(templateFS, "templates/*.html")
 	if err != nil {
 		return nil, err
@@ -129,7 +126,6 @@ func New(s *store.Store, discord DiscordConfig, tokenKey []byte, mangaPath, nove
 		states:              newOAuthStates(),
 		limiter:             session.NewLoginLimiter(),
 		httpClient:          &http.Client{Timeout: discordTimeout},
-		covers:              covers,
 	}, nil
 }
 
@@ -146,10 +142,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("POST /ui/bookmarks/{key}/chapter", h.requireSession(h.uiChapter))
 	mux.HandleFunc("DELETE /ui/bookmarks/{key}", h.requireSession(h.uiDelete))
 
-	// Session-gated like every other UI route: the deployment proxies kagane's
-	// images for its own Readers, not for the internet.
-	mux.HandleFunc("GET /img/kagane/{id}", h.requireSession(h.kaganeCover))
-
 	// Install endpoints render the script directly under the session: the
 	// credential travels inside the served bytes, never in the address bar or
 	// the page markup. Updates after install use the credential-bearing /u/