Add gated cover byte fetcher (#66)

## Summary

Adds a plain-TLS cover byte fetcher with a destination-class SSRF gate and wires public cover sources through the content-addressed filesystem store.

## Changes

- Resolve hostnames before connecting; refuse non-HTTPS, loopback, private, link-local, unique-local, CGNAT, credentials, and mixed public/private DNS answers.
- Re-check every redirect and resolve/classify again at dial time to close DNS rebinding.
- Reuse `maxBodyBytes`; reject oversized responses and non-image content types before persistence.
- Add generic `Store.GetCover`/`PutCover` source-URL storage while preserving the browser-backed kagane path.
- Keep cover prefetch failures isolated from chapter polling.
- Add observable tests for TLS, no-connection refusals, all refused address classes, redirect blocking, streaming body caps, non-image rejection, content-addressed persistence, DNS rebinding, and poller routing.

## Verification

- `go test -count=1 ./...`
- `go vet ./...`

Both pass. No test touches the live network.

Closes #57

Reviewed-on: #66
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/store/store.go

@@ -156,9 +156,8 @@ func KaganeImageID(cover string) (string, bool) {
 	return m[1], true
 }
 
-// IsKaganeCoverContentType reports whether a fetched response is safe to store
-// and serve as a cover.
-func IsKaganeCoverContentType(contentType string) bool {
+// IsCoverContentType reports whether a fetched response is safe to store and serve.
+func IsCoverContentType(contentType string) bool {
 	switch contentType {
 	case "image/webp", "image/jpeg", "image/png", "image/avif", "image/gif":
 		return true
@@ -609,7 +608,7 @@ func (s *Store) getCover(sourceURL string) ([]byte, string, bool, error) {
 }
 
 func (s *Store) putCover(sourceURL string, body []byte, contentType string) error {
-	if !IsKaganeCoverContentType(contentType) {
+	if !IsCoverContentType(contentType) {
 		return fmt.Errorf("put cover %q: unsupported content type %q", sourceURL, contentType)
 	}
 	address := coverSourceAddress(sourceURL)
@@ -647,6 +646,18 @@ func (s *Store) putCover(sourceURL string, body []byte, contentType string) erro
 	return nil
 }
 
+// GetCover returns the immutable object addressed by its source URL. Missing
+// files are reported with ok=false so callers can retry acquisition later.
+func (s *Store) GetCover(sourceURL string) ([]byte, string, bool, error) {
+	return s.getCover(sourceURL)
+}
+
+// PutCover persists bytes under the source URL's content address. A later
+// write for the same URL cannot replace the immutable object.
+func (s *Store) PutCover(sourceURL string, body []byte, contentType string) error {
+	return s.putCover(sourceURL, body, contentType)
+}
+
 // GetKaganeCover returns one persisted cover. Missing covers are reported with
 // ok=false rather than as an error so the web handler can fetch them once.
 func (s *Store) GetKaganeCover(imageID string) ([]byte, string, bool, error) {

backend/internal/store/store_test.go

@@ -1352,3 +1352,25 @@ func TestKaganeCoverIsContentAddressedOnFilesystem(t *testing.T) {
 		t.Fatalf("covers still has body column")
 	}
 }
+
+func TestCoverStoreAcceptsAnySourceURL(t *testing.T) {
+	s := newTestStore(t)
+	const sourceURL = "https://cdn.example/covers/series.jpg"
+	want := []byte("cover-bytes")
+	if err := s.PutCover(sourceURL, want, "image/jpeg"); err != nil {
+		t.Fatalf("PutCover: %v", err)
+	}
+	got, contentType, ok, err := s.GetCover(sourceURL)
+	if err != nil {
+		t.Fatalf("GetCover: %v", err)
+	}
+	if !ok || !bytes.Equal(got, want) || contentType != "image/jpeg" {
+		t.Fatalf("GetCover = (%q, %q, %v), want (%q, image/jpeg, true)", got, contentType, ok, want)
+	}
+	if err := s.PutCover("https://cdn.example/not-image", []byte("html"), "text/html"); err == nil {
+		t.Fatal("PutCover accepted a non-image")
+	}
+	if _, _, ok, err := s.GetCover("https://cdn.example/not-image"); err != nil || ok {
+		t.Fatalf("rejected cover = found %v, err %v; want missing", ok, err)
+	}
+}