Delete the kagane-specific cover path (#63)

The web proxy for kagane covers is dead: since #62 every Site's cover
bytes land in the content-addressed store at creation or on the poll,
and the one public route serves them all. Remove the second way to
reach a Cover:

- Bookmark.CoverURL() and the templates' use of it: templates render
  the wire value (.Cover) and nothing else.
- GET /img/kagane/{id}, web.CoverFetcher, coverIDRe: the route and its
  identifier validation are gone, and with them web/cover.go.
- store.KaganeImageID, GetKaganeCover, PutKaganeCover,
  kaganeCoverSourceURL: the proxy's persistence.
- Bookmark.CoverSource: dead once CoverURL is gone.

Acquisition keeps the browser where kagane genuinely needs it, but the
Site name leaves the routing: kaganeImageURLRe lives in browser.go with
the rest of the per-Site knowledge, browserCoverURL claims the URLs the
sidecar alone can fetch, and fetchCoverBytes routes by URL shape with
no Site argument. No plain-TLS fallback for a claimed URL — that would
only retrieve a challenge page.

Cover tests: kagane route tests removed, the general-route guarantees
they pinned kept and re-pinned — unstored and traversal-shaped
addresses serve nothing (TestPublicCoverRejectsUnknownAddress), non-image
content types are never echoed back (TestPublicCoverNeverEchoesNonImage
+ TestCoverStoreAcceptsAnySourceURL). Store content-addressing and
reopen-persistence tests rewritten against PutCover/GetCover.

No Site name remains in a cover code path outside the acquisition
module; go test ./... green.

backend/internal/store/store_test.go

@@ -550,45 +550,6 @@ func TestDisplayChapter(t *testing.T) {
 	}
 }
 
-// CoverURL reads the source address for the kagane branch and the wire value
-// otherwise, so both are set the way scanBookmark sets them.
-func TestCoverURL(t *testing.T) {
-	cases := []struct {
-		name        string
-		coverSource string
-		cover       string
-		want        string
-	}{
-		{
-			"kagane routes through the proxy",
-			"https://kagane.to/api/v2/image/019fe11a-84c3-7fc3-a84b-88787374b617/compressed",
-			"https://bookmarks.test/covers/" + CoverAddress("kagane"),
-			"/img/kagane/019fe11a-84c3-7fc3-a84b-88787374b617",
-		},
-		{
-			"another site is served from our own origin",
-			"https://gg.asuracomic.net/storage/media/1/conversions/cover.webp",
-			"https://bookmarks.test/covers/" + CoverAddress("asura"),
-			"https://bookmarks.test/covers/" + CoverAddress("asura"),
-		},
-		{
-			"a lookalike host is not rewritten",
-			"https://evil.example/api/v2/image/019fe11a-84c3-7fc3-a84b-88787374b617/compressed",
-			"https://bookmarks.test/covers/" + CoverAddress("evil"),
-			"https://bookmarks.test/covers/" + CoverAddress("evil"),
-		},
-		{"no cover stays empty", "", "", ""},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			b := Bookmark{CoverSource: tc.coverSource, Cover: tc.cover}
-			if got := b.CoverURL(); got != tc.want {
-				t.Errorf("CoverURL() = %q, want %q", got, tc.want)
-			}
-		})
-	}
-}
-
 func TestUpsertKindDefaultsToManga(t *testing.T) {
 	store := newTestStore(t)
 	got, err := store.Upsert(store.OwnerID(), Bookmark{
@@ -1397,7 +1358,7 @@ func TestTwoReadersShareOneSeriesWithIndependentProgress(t *testing.T) {
 		t.Fatalf("due after one Reader left = %+v, want the series still polled", due)
 	}
 }
-func TestKaganeCoverPersistsAcrossReopen(t *testing.T) {
+func TestCoverPersistsAcrossReopen(t *testing.T) {
 	url := pgtest.URL(t)
 	coverDir := t.TempDir()
 	first, err := Open(url, testOwner, coverDir, testCoverBaseURL)
@@ -1405,8 +1366,9 @@ func TestKaganeCoverPersistsAcrossReopen(t *testing.T) {
 		t.Fatalf("Open: %v", err)
 	}
 	body := []byte("stored-cover")
-	if err := first.PutKaganeCover("019fe11a-84c3-7fc3-a84b-88787374b617", body, "image/webp"); err != nil {
-		t.Fatalf("PutKaganeCover: %v", err)
+	const sourceURL = "https://cdn.example/covers/series.jpg"
+	if err := first.PutCover(sourceURL, body, "image/webp"); err != nil {
+		t.Fatalf("PutCover: %v", err)
 	}
 	if err := first.Close(); err != nil {
 		t.Fatalf("close first store: %v", err)
@@ -1417,9 +1379,9 @@ func TestKaganeCoverPersistsAcrossReopen(t *testing.T) {
 		t.Fatalf("reopen: %v", err)
 	}
 	defer second.Close()
-	got, contentType, ok, err := second.GetKaganeCover("019fe11a-84c3-7fc3-a84b-88787374b617")
+	got, contentType, ok, err := second.GetCover(sourceURL)
 	if err != nil {
-		t.Fatalf("GetKaganeCover: %v", err)
+		t.Fatalf("GetCover: %v", err)
 	}
 	if !ok || !bytes.Equal(got, body) || contentType != "image/webp" {
 		t.Fatalf("stored cover = (%q, %q, %v), want (%q, image/webp, true)", got, contentType, ok, body)
@@ -1443,7 +1405,7 @@ func TestOpenRequiresAbsoluteCoverBaseURL(t *testing.T) {
 	}
 }
 
-func TestKaganeCoverIsContentAddressedOnFilesystem(t *testing.T) {
+func TestCoverIsContentAddressedOnFilesystem(t *testing.T) {
 	url := pgtest.URL(t)
 	coverDir := t.TempDir()
 	first, err := Open(url, testOwner, coverDir, testCoverBaseURL)
@@ -1451,14 +1413,13 @@ func TestKaganeCoverIsContentAddressedOnFilesystem(t *testing.T) {
 		t.Fatalf("Open: %v", err)
 	}
 	body := []byte("stored-cover")
-	const imageID = "019fe11a-84c3-7fc3-a84b-88787374b617"
-	if err := first.PutKaganeCover(imageID, body, "image/webp"); err != nil {
+	const sourceURL = "https://cdn.example/covers/series.jpg"
+	if err := first.PutCover(sourceURL, body, "image/webp"); err != nil {
 		first.Close()
-		t.Fatalf("PutKaganeCover: %v", err)
+		t.Fatalf("PutCover: %v", err)
 	}
 	defer first.Close()
 
-	sourceURL := "https://kagane.to/api/v2/image/" + imageID + "/compressed"
 	addressBytes := sha256.Sum256([]byte(sourceURL))
 	address := hex.EncodeToString(addressBytes[:])
 	wantPath := filepath.Join(address[:2], address[2:4], address)