Poll comix.to through the browser sidecar (#98) (#105)

Closes #98.

comix.to began answering plain-TLS fetches with a Cloudflare JavaScript
challenge on 2026-08-12, so every poll got a 403 interstitial. Its cover host
`static.comix.to` is gated the same way. comix therefore joins kagane and
novelfull as a browser-backed Site.

## What changed

- **Registry** (`internal/latest/sites.go`): comix gains a `Browser` entry —
  `comixRead`, `Done: body != "" && !isInterstitial(body)`, `Fallback: false`.
  Skip-when-no-browser falls out of the existing routing; no site-string compare
  was added anywhere.
- **Read shape** (`internal/latest/browser.go`): an in-tab `fetch()` of the
  Series URL, not a DOM render. comix is an SPA — rendering it costs ~65
  requests for the same server-rendered HTML one fetch returns (24.5 KB,
  ~480 ms measured). `comixSeriesPageURL` pins scheme + host + `/title/<slug>`
  and rebuilds the address, so a client-supplied `series_url` cannot aim the
  browser anywhere else.
- **Cover bytes**: `comixImageURLRe` pins `https://static.comix.to/<path>.<ext>`;
  `BrowserFetcher.Image` now gates on `browserOnlyCoverURL` rather than a
  kagane-only regex, so both Sites' image URLs route through the one path.
  Bytes come from direct navigation, not a page-context fetch — comix's Series
  page sets `cross-origin-embedder-policy: require-corp`, which fails one.
- **Parsers and stored Series identity: untouched.** The in-tab body is the same
  server-rendered HTML the existing fixtures were cut from.

## Verification

- `go test ./...` green (needs Docker).
- New seam tests: comix routes to the browser when one is configured, and is
  not fetched at all when none is (`TestComixUsesBrowserFetcher`,
  `TestComixSkippedWhenNoBrowserFetcher`); URL-pin and cover-gate table tests.
- Live proof against the real browser unit, `TestSmokeComix` (env-gated):
  page 24793 bytes in one in-tab fetch, chapter 53, cover accepted by the pin,
  26862 bytes of `image/jpg` retrieved.
- Two-axis review run; findings were stale comments on `BrowserFetcher`, `Get`
  and the `Fallback` field, fixed in f000cc7.

Docs updated: root `AGENTS.md` (constraint + smoke command, including the note
that this dev machine's ISP DNS-hijacks `comix.to`), `backend/AGENTS.md`
(poller, cover pipeline, `BROWSER_WS_URL`), `REDEPLOY.md` §8 degrade note.

Reviewed-on: #105
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/latest/poller.go

@@ -17,8 +17,8 @@ type Fetcher interface {
 }
 
 // BrowserCoverFetcher retrieves one cover's bytes through the browser-backed
-// path — the only route that clears the challenge kagane's image URLs answer
-// a plain fetch with. Satisfied by BrowserFetcher.
+// path — the only route that clears the challenge kagane's and comix's image
+// URLs answer a plain fetch with. Satisfied by BrowserFetcher.
 type BrowserCoverFetcher interface {
 	Image(ctx context.Context, imageURL string) (body []byte, contentType string, err error)
 }
@@ -119,9 +119,9 @@ func (p *Poller) storeCover(ctx context.Context, sr store.Series, sourceURL stri
 
 // fetcherFor returns the fetcher a site's page needs, or nil when the site
 // cannot be fetched at all right now. A Site whose registry entry carries a
-// Browser read — kagane and novelfull, both behind a Cloudflare JavaScript
-// challenge no TLS fingerprint clears — prefers the browser; when it is
-// absent, the entry's Fallback decides whether plain TLS may take over. One
+// Browser read — kagane, comix and novelfull, all behind a Cloudflare
+// JavaScript challenge no TLS fingerprint clears — prefers the browser; when it
+// is absent, the entry's Fallback decides whether plain TLS may take over. One
 // routing rule for the poll and the acquirer, so the two cannot drift apart.
 func fetcherFor(site string, browser, tls Fetcher) Fetcher {
 	s, known := sites[site]