Poll comix.to through the browser sidecar (#98) (#105)

Closes #98.

comix.to began answering plain-TLS fetches with a Cloudflare JavaScript
challenge on 2026-08-12, so every poll got a 403 interstitial. Its cover host
`static.comix.to` is gated the same way. comix therefore joins kagane and
novelfull as a browser-backed Site.

## What changed

- **Registry** (`internal/latest/sites.go`): comix gains a `Browser` entry —
  `comixRead`, `Done: body != "" && !isInterstitial(body)`, `Fallback: false`.
  Skip-when-no-browser falls out of the existing routing; no site-string compare
  was added anywhere.
- **Read shape** (`internal/latest/browser.go`): an in-tab `fetch()` of the
  Series URL, not a DOM render. comix is an SPA — rendering it costs ~65
  requests for the same server-rendered HTML one fetch returns (24.5 KB,
  ~480 ms measured). `comixSeriesPageURL` pins scheme + host + `/title/<slug>`
  and rebuilds the address, so a client-supplied `series_url` cannot aim the
  browser anywhere else.
- **Cover bytes**: `comixImageURLRe` pins `https://static.comix.to/<path>.<ext>`;
  `BrowserFetcher.Image` now gates on `browserOnlyCoverURL` rather than a
  kagane-only regex, so both Sites' image URLs route through the one path.
  Bytes come from direct navigation, not a page-context fetch — comix's Series
  page sets `cross-origin-embedder-policy: require-corp`, which fails one.
- **Parsers and stored Series identity: untouched.** The in-tab body is the same
  server-rendered HTML the existing fixtures were cut from.

## Verification

- `go test ./...` green (needs Docker).
- New seam tests: comix routes to the browser when one is configured, and is
  not fetched at all when none is (`TestComixUsesBrowserFetcher`,
  `TestComixSkippedWhenNoBrowserFetcher`); URL-pin and cover-gate table tests.
- Live proof against the real browser unit, `TestSmokeComix` (env-gated):
  page 24793 bytes in one in-tab fetch, chapter 53, cover accepted by the pin,
  26862 bytes of `image/jpg` retrieved.
- Two-axis review run; findings were stale comments on `BrowserFetcher`, `Get`
  and the `Fallback` field, fixed in f000cc7.

Docs updated: root `AGENTS.md` (constraint + smoke command, including the note
that this dev machine's ISP DNS-hijacks `comix.to`), `backend/AGENTS.md`
(poller, cover pipeline, `BROWSER_WS_URL`), `REDEPLOY.md` §8 degrade note.

Reviewed-on: #105
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/latest/browser_test.go

@@ -61,6 +61,62 @@ func TestNovelfullSeriesURL(t *testing.T) {
 		})
 	}
 }
+
+func TestComixSeriesPageURL(t *testing.T) {
+	const series = "https://comix.to/title/n8we-dungeons-and-crayons"
+	cases := []struct {
+		name string
+		url  string
+		want string
+	}{
+		{"series page", series, series},
+		{"trailing slash kept", series + "/", series + "/"},
+		// Query and fragment are dropped: only the pinned path travels.
+		{"query dropped", series + "?tab=chapters", series},
+		{"foreign host", "https://evil.example/title/x", ""},
+		{"lookalike host", "https://comix.to.evil.example/title/x", ""},
+		{"not https", "http://comix.to/title/x", ""},
+		{"not a series path", "https://comix.to/search", ""},
+		{"chapter page", series + "/11139891-chapter-80", ""},
+		{"garbage", "://nope", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok := comixSeriesPageURL(tc.url)
+			if ok != (tc.want != "") || got != tc.want {
+				t.Fatalf("comixSeriesPageURL(%q) = %q, %v; want %q", tc.url, got, ok, tc.want)
+			}
+		})
+	}
+}
+
+// The browser is an SSRF primitive and a cover address can originate in a
+// client-supplied PUT body, so this gate decides what it may navigate to.
+func TestBrowserOnlyCoverURL(t *testing.T) {
+	cases := []struct {
+		url  string
+		want bool
+	}{
+		{"https://static.comix.to/039d/i/1/34/6a6742bf15736@280.jpg", true},
+		{"https://kagane.to/api/v2/image/019fe11a-84c3-7fc3-a84b-88787374b617/compressed", true},
+		// Every other Site's CDN answers plain TLS.
+		{"https://gg.asuracomic.net/covers/x.webp", false},
+		{"http://static.comix.to/039d/x.jpg", false},
+		{"https://static.comix.to.evil.example/039d/x.jpg", false},
+		{"https://evil.example/static.comix.to/x.jpg", false},
+		{"https://static.comix.to/039d/x.jpg?next=http://169.254.169.254/", false},
+		{"https://static.comix.to/039d/x.svg", false},
+		{"https://static.comix.to/../etc/passwd.jpg", false},
+		{"https://static.comix.to/", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.url, func(t *testing.T) {
+			if got := browserOnlyCoverURL(tc.url); got != tc.want {
+				t.Fatalf("browserOnlyCoverURL(%q) = %v, want %v", tc.url, got, tc.want)
+			}
+		})
+	}
+}
 func TestClassifyBrowserInterruption(t *testing.T) {
 	if err := classifyBrowserError(context.Background(), true, context.Canceled); !errors.Is(err, errBrowserInterrupted) {
 		t.Fatalf("classifyBrowserError(context.Canceled) = %v, want browser interruption", err)