backend: remove orphan series from the admin (ticket #155)

(*Store).RemoveSeries deletes one series row by (site, series_id) via a
plain parameterized DELETE; a bookmarks_series_fk violation outside
23503 is translated into the ErrSeriesHasBookmarks sentinel so no
driver type escapes the store. The caller reads the row's cover
address before the delete and reclaims it after: ReclaimCover's guard
cannot pass while a series row still points at the address.

POST /admin/series/{key}/remove answers the list row with the removed
row's fragment plus the heading re-rendered out of band at the fresh
count (HX-Reswap: delete removes the row through the same button that
swaps the refusal back in), and navigates from the detail page to the
No-Readers list (HX-Redirect for htmx, a 303 for plain clients). A
removal that races a fresh Bookmark is a refusal, not a 500: the row
re-renders at its new count with the fact spelled out. The control
renders only at zero Reader count on both surfaces, gated by hx-confirm
with the brief's copy.

backend/internal/store/store.go

@@ -16,6 +16,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/jackc/pgx/v5/pgconn"
 	_ "github.com/jackc/pgx/v5/stdlib"
 )
 
@@ -1082,6 +1083,37 @@ func (s *Store) Delete(readerID int64, key string) error {
 	return nil
 }
 
+// pgForeignKeyViolation is the SQLSTATE the driver surfaces when a Bookmark
+// row refuses a Series delete (bookmarks_series_fk). pgconn exports no named
+// constant for it, so the store names it here.
+const pgForeignKeyViolation = "23503"
+
+// ErrSeriesHasBookmarks is RemoveSeries' refusal: a Reader still holds the
+// Series, so the owner's removal must not reach past that record. The
+// delete is the check — no NOT EXISTS pre-check that can race the insert —
+// and the driver's foreign-key violation is translated here so no driver
+// type escapes the store (issue #155).
+var ErrSeriesHasBookmarks = errors.New("series has bookmarks")
+
+// RemoveSeries deletes one Series row by (site, series_id). It is refused
+// while any Bookmark references the row; deleting an absent key is not an
+// error, matching Delete. The caller owns the stranded Cover: read the row's
+// cover_address before the delete and call ReclaimCover after it — the
+// helper's guard cannot pass while the series row still points at the
+// address, so the order is the sequence, not a preference.
+func (s *Store) RemoveSeries(site, seriesID string) error {
+	if _, err := s.db.Exec(
+		`DELETE FROM series WHERE site = $1 AND series_id = $2`,
+		site, seriesID); err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) && pgErr.Code == pgForeignKeyViolation {
+			return ErrSeriesHasBookmarks
+		}
+		return fmt.Errorf("remove series %s:%s: %w", site, seriesID, err)
+	}
+	return nil
+}
+
 // RecordLanePass appends one pass and prunes every older row in the same
 // transaction. retainBefore is supplied by the poller's clock.
 func (s *Store) RecordLanePass(p LanePass, retainBefore int64) error {