Poll comix.to through the browser sidecar (#98) (#105)

Closes #98.

comix.to began answering plain-TLS fetches with a Cloudflare JavaScript
challenge on 2026-08-12, so every poll got a 403 interstitial. Its cover host
`static.comix.to` is gated the same way. comix therefore joins kagane and
novelfull as a browser-backed Site.

## What changed

- **Registry** (`internal/latest/sites.go`): comix gains a `Browser` entry —
  `comixRead`, `Done: body != "" && !isInterstitial(body)`, `Fallback: false`.
  Skip-when-no-browser falls out of the existing routing; no site-string compare
  was added anywhere.
- **Read shape** (`internal/latest/browser.go`): an in-tab `fetch()` of the
  Series URL, not a DOM render. comix is an SPA — rendering it costs ~65
  requests for the same server-rendered HTML one fetch returns (24.5 KB,
  ~480 ms measured). `comixSeriesPageURL` pins scheme + host + `/title/<slug>`
  and rebuilds the address, so a client-supplied `series_url` cannot aim the
  browser anywhere else.
- **Cover bytes**: `comixImageURLRe` pins `https://static.comix.to/<path>.<ext>`;
  `BrowserFetcher.Image` now gates on `browserOnlyCoverURL` rather than a
  kagane-only regex, so both Sites' image URLs route through the one path.
  Bytes come from direct navigation, not a page-context fetch — comix's Series
  page sets `cross-origin-embedder-policy: require-corp`, which fails one.
- **Parsers and stored Series identity: untouched.** The in-tab body is the same
  server-rendered HTML the existing fixtures were cut from.

## Verification

- `go test ./...` green (needs Docker).
- New seam tests: comix routes to the browser when one is configured, and is
  not fetched at all when none is (`TestComixUsesBrowserFetcher`,
  `TestComixSkippedWhenNoBrowserFetcher`); URL-pin and cover-gate table tests.
- Live proof against the real browser unit, `TestSmokeComix` (env-gated):
  page 24793 bytes in one in-tab fetch, chapter 53, cover accepted by the pin,
  26862 bytes of `image/jpg` retrieved.
- Two-axis review run; findings were stale comments on `BrowserFetcher`, `Get`
  and the `Fallback` field, fixed in f000cc7.

Docs updated: root `AGENTS.md` (constraint + smoke command, including the note
that this dev machine's ISP DNS-hijacks `comix.to`), `backend/AGENTS.md`
(poller, cover pipeline, `BROWSER_WS_URL`), `REDEPLOY.md` §8 degrade note.

Reviewed-on: #105
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/internal/latest/sites.go

@@ -47,9 +47,9 @@ type browserRead struct {
 	// Done reports whether the payload arrived.
 	Done func(body string) bool
 	// Fallback allows the plain-TLS fetcher when no browser is configured.
-	// False skips the Site instead. kagane is false — a plain fetch would
-	// only ever retrieve a challenge page — and novelfull is true, because
-	// its challenge is a live time-varying fact (AGENTS.md).
+	// False skips the Site instead. kagane and comix are false — a plain fetch
+	// would only ever retrieve a challenge page — and novelfull is true,
+	// because its challenge is a live time-varying fact (AGENTS.md).
 	Fallback bool
 }
 
@@ -248,14 +248,25 @@ var comixInitialDataRe = regexp.MustCompile(`(?is)<script\b[^>]*\bid\s*=\s*["']i
 // supplied, and a headless browser is a strong SSRF primitive.
 var kaganeImageURLRe = regexp.MustCompile(`^https://kagane\.to/api/v2/image/([0-9a-f-]{36})/compressed$`)
 
+// comixImageURLRe matches comix's cover host and path shape. Pinned in full
+// (scheme, host, path characters, image extension) for the same reason
+// kaganeImageURLRe is: the address reaches a headless browser, and it can
+// originate in a client-supplied PUT body. No dot is allowed inside the path,
+// so no traversal or second extension can hide in it. Shape from a live page,
+// 2026-08-10: /039d/i/1/34/6a6742bf15736@280.jpg.
+var comixImageURLRe = regexp.MustCompile(`^https://static\.comix\.to/[A-Za-z0-9@/_-]+\.(?:jpg|jpeg|png|webp)$`)
+
 // browserOnlyCoverURL reports whether the browser sidecar is the only fetcher
 // for cover bytes at imageURL. kagane's image route answers a plain fetch with
-// a challenge and `cross-origin-resource-policy: same-origin`, so a TLS fetch
-// would only ever retrieve a challenge page and must not be attempted
-// (ADR-0007). This is the byte-fetch router's per-Site knowledge; it lives in
-// the extraction module, which owns kagane's URL shapes.
+// a challenge and `cross-origin-resource-policy: same-origin`, and
+// static.comix.to answers one with the same Cloudflare challenge its pages
+// serve (measured 2026-08-12, issue #98), so a TLS fetch would only ever
+// retrieve a challenge page and must not be attempted (ADR-0007). This is the
+// byte-fetch router's per-Site knowledge; it lives in the extraction module,
+// which owns those URL shapes.
 func browserOnlyCoverURL(imageURL string) bool {
-	return kaganeImageURLRe.MatchString(imageURL)
+	return kaganeImageURLRe.MatchString(imageURL) ||
+		comixImageURLRe.MatchString(imageURL)
 }
 
 // kagane's browser-fetched series response publishes cover image IDs under
@@ -389,6 +400,15 @@ var sites = map[string]site{
 		Host:          "comix.to",
 		LatestChapter: comixLatestChapter,
 		Cover:         comixCoverEntry,
+		Browser: &browserRead{
+			Read: comixRead,
+			// The interstitial is served in place of the page, so "arrived"
+			// has to exclude it explicitly, as novelfull's does.
+			Done: func(body string) bool { return body != "" && !isInterstitial(body) },
+			// Never falls back: a plain fetch of a comix page or cover
+			// retrieves only a challenge page (measured 2026-08-12).
+			Fallback: false,
+		},
 	},
 	"kagane": {
 		Host:          "kagane.to",