Add gated cover byte fetcher (#66)

## Summary

Adds a plain-TLS cover byte fetcher with a destination-class SSRF gate and wires public cover sources through the content-addressed filesystem store.

## Changes

- Resolve hostnames before connecting; refuse non-HTTPS, loopback, private, link-local, unique-local, CGNAT, credentials, and mixed public/private DNS answers.
- Re-check every redirect and resolve/classify again at dial time to close DNS rebinding.
- Reuse `maxBodyBytes`; reject oversized responses and non-image content types before persistence.
- Add generic `Store.GetCover`/`PutCover` source-URL storage while preserving the browser-backed kagane path.
- Keep cover prefetch failures isolated from chapter polling.
- Add observable tests for TLS, no-connection refusals, all refused address classes, redirect blocking, streaming body caps, non-image rejection, content-addressed persistence, DNS rebinding, and poller routing.

## Verification

- `go test -count=1 ./...`
- `go vet ./...`

Both pass. No test touches the live network.

Closes #57

Reviewed-on: #66
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/main.go

@@ -343,8 +343,8 @@ func main() {
 
 // newLatestPoller wires the configured cooldowns and fetchers into the poller.
 func newLatestPoller(s *store.Store, cfg LatestPoll, fetch, browser latest.Fetcher) *latest.Poller {
-	var covers latest.CoverFetcher
-	if f, ok := browser.(latest.CoverFetcher); ok {
+	var covers latest.BrowserCoverFetcher
+	if f, ok := browser.(latest.BrowserCoverFetcher); ok {
 		covers = f
 	}
 	return &latest.Poller{
@@ -352,6 +352,7 @@ func newLatestPoller(s *store.Store, cfg LatestPoll, fetch, browser latest.Fetch
 		Fetch:           fetch,
 		BrowserFetch:    browser,
 		CoverFetch:      covers,
+		CoverBytesFetch: latest.NewCoverFetcher(),
 		Now:             time.Now,
 		Cooldown:        cfg.Cooldown,
 		BrowserCooldown: cfg.BrowserCooldown,