feat: one Poll Lane per Site, replacing the shared pace (#100)

Each Site runs its own poll goroutine, paced by Rest and Gap from the
registry (sites.go) instead of the shared cooldown/interval/stagger/batch
config. Rest is enforced by the due query's WHERE clause; the Lane sleeps
its effective gap between fetches (hour/eligible, floored at 1s).

Lane-local failures: two refusals stop that Site for 15m, a lost browser
stops only the round's remaining browser Lanes, and cover heals moved to
background goroutines so a slow CDN cannot consume a Lane's gap. The five
LATEST_CHAPTER_POLL_* pace env vars are gone; only the kill switch
remains.

backend/AGENTS.md

@@ -74,20 +74,33 @@ Guidance for OpenCode (and Claude Code) working under `backend/`. See root `AGEN
   Remove's row wear ember wash, two reversible ones wear `.calm` grey.
   `--ember` stay reserved for new-chapter signal: busy bar and inline
   error use `--mute`.
-- **Latest-chapter poller:** ticker goroutine in same binary re-check
-  each bookmarked series' newest published chapter from backend's own
-  network access, so `latest_chapter` stay fresh when user not
-  browsing. Second, parallel signal — userscript keep own
+- **Latest-chapter poller:** one goroutine per Site (a Poll Lane, issue #100),
+  each re-checking that Site's bookmarked series' newest published chapter from
+  backend's own network access, so `latest_chapter` stays fresh when the user
+  isn't browsing. Second, parallel signal — the userscript keeps its own
   `maybeCaptureLatestOnSeriesPage`/`backgroundRefreshLatest` logic unchanged.
-  Two independent clocks: per-series cooldown (`series.latest_checked_at`,
-  enforced by `Store.DueForLatestCheck`'s WHERE clause) and wake interval.
+  Two independent clocks: per-series rest (`series.latest_checked_at`,
+  enforced by `Store.DueForLatestCheck`'s WHERE clause — `now - Rest`) and
+  per-Lane gap (the Lane sleeping between fetches, `effectiveGap`). Both live
+  in the Site registry (`internal/latest/sites.go`), not config: the five env
+  knobs that used to size a shared pace are gone.
   The poller walks **Series, not Bookmarks** — a series referenced by several
   bookmarks is fetched once per cycle, and the due queue orders
   `reader_count DESC, latest_checked_at ASC` (ADR-0003). Series row stamped
-  *before* fetch so broken series wait out full cooldown instead of retrying
+  *before* fetch so broken series wait out the rest instead of retrying
   every tick; found chapter written straight to the series row via
   `Store.SetLatestChapter`, so a bookmark's `updated_at` — and the list
   order — is never touched.
+  Refusals and browser loss are Lane-local: two `errChallengeHeld` in one pass
+  stop that Site for `refuseBackoff` (15m) while other Lanes continue; an
+  `errBrowserInterrupted` (remote Chrome restart) sets a shared Poller flag
+  that makes the other browser Lanes skip their passes for the same 15m, so a
+  restarting Chrome doesn't stamp one Series per Lane per pass — after the
+  window the flag decays and they probe again. Browser Lanes wake Chrome only
+  when 5+ Series are due or one has waited 15m (ADR-0005 on-demand browser),
+  and cover work (both healing a stored source URL and filling a blank from
+  the series page) runs in the background so a slow CDN can't consume a
+  Lane's gap.
   Fetches use `bogdanfinn/tls-client` with Chrome profile as defence in depth
   against fingerprint-based blocking; any failure log and skip. kagane, comix
   and novelfull sit behind Cloudflare JavaScript challenges the TLS client
@@ -152,15 +165,17 @@ Guidance for OpenCode (and Claude Code) working under `backend/`. See root `AGEN
   `_REDIRECT_URI` (required; Discord OAuth for the browser UI),
   `DISCORD_REQUIRED_ROLE` (optional role gate, empty by default),
   `DISCORD_API_BASE` (default `https://discord.com/api/v10`),
-  `LATEST_CHAPTER_POLL_ENABLED`/`_COOLDOWN`/`_BROWSER_COOLDOWN`/`_INTERVAL`/
-  `_BATCH`/`_STAGGER` (background latest-chapter poller; defaults on,
-  `1h` plain-TLS cooldown, `6h` browser cooldown, `10m`/`14`/`20s`; both
-  cooldowns have a `15m` floor). The browser cooldown is longer for cost, not
-  for safety: a challenged page costs seconds of a serialized single-tab
-  browser, while a plain read costs one request. It buys no documented
-  reduction in challenge risk — free-plan zones have no bot score and no
-  published per-IP rate input, and `cf_clearance` expires in 30 minutes so
-  every cadence at or above 1h re-solves anyway —
+  `LATEST_CHAPTER_POLL_ENABLED` (background latest-chapter poller kill
+  switch, default on). Pace is per Site in the registry (issue #100): every
+  Site rests an hour and gaps ten seconds, a Site with more eligible Series
+  than 360 tightens its own gap toward the 1s floor, and browser Lanes wake
+  Chrome only on demand (ADR-0005). The `_COOLDOWN`/`_BROWSER_COOLDOWN`/
+  `_INTERVAL`/`_BATCH`/`_STAGGER` knobs that used to size a shared pace are
+  gone. The 1h rest for browser Sites is safe on documented grounds: a
+  challenged page costs seconds of a serialized single-tab browser, free-plan
+  zones have no bot score and no published per-IP rate input, and
+  `cf_clearance` expires in 30 minutes so every cadence at or above 1h
+  re-solves anyway —
   `docs/research/cloudflare-bot-scoring-and-poll-cadence.md`.
   `USERSCRIPT_PATH` and `NOVEL_USERSCRIPT_PATH` (files served at
   `/u/{token}/manga-bookmark.user.js` and `/u/{token}/novel-bookmark.user.js`,