fix: address final-review findings on the latest-chapter poller

Wires the five poll env vars into docker-compose (the documented kill
switch was inert), skips fetching unknown sites and non-https URLs
before spending a request, and makes runOnce's summary log fire on
empty and cancelled ticks. Records the accepted non-atomic Get+Upsert
window and the one-interval startup delay in the docs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/latest.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"log"
+	"net/url"
 	"time"
 )
 
@@ -66,9 +67,6 @@ func (p *latestPoller) runOnce(ctx context.Context) {
 		log.Printf("latest poll: due query: %v", err)
 		return
 	}
-	if len(due) == 0 {
-		return
-	}
 
 	checked := 0
 	for i, b := range due {
@@ -79,13 +77,17 @@ func (p *latestPoller) runOnce(ctx context.Context) {
 		// from one server IP is the traffic shape most likely to move that IP's
 		// bot score. This is the server-side analogue of the userscript's "one
 		// series per navigation ... indistinguishable from browsing" (L455-456).
+		stopped := false
 		if i > 0 && p.stagger > 0 {
 			select {
 			case <-ctx.Done():
-				return
+				stopped = true
 			case <-time.After(p.stagger):
 			}
 		}
+		if stopped {
+			break
+		}
 		p.checkOne(ctx, b)
 		checked++
 	}
@@ -114,6 +116,18 @@ func (p *latestPoller) checkOne(ctx context.Context, b Bookmark) {
 		return
 	}
 
+	// series_url is client-supplied (PUT /bookmarks/{key} accepts any string),
+	// so this is not just an optimisation against burning a request on an
+	// unknown site: without it, the server would issue a GET from its own
+	// network position to whatever URL a token-holder writes, including
+	// link-local/internal addresses or non-https schemes. The cooldown above
+	// is already consumed, so a row that never passes this check is retried at
+	// cooldown pace rather than hot-looping.
+	if !fetchableSeriesURL(b.Site, b.SeriesURL) {
+		log.Printf("latest poll %q: not fetchable: site=%q url=%q", b.Key, b.Site, b.SeriesURL)
+		return
+	}
+
 	body, status, err := p.fetch.Get(ctx, b.SeriesURL)
 	if err != nil {
 		log.Printf("latest poll %q: fetch %s: %v", b.Key, b.SeriesURL, err)
@@ -160,3 +174,21 @@ func (p *latestPoller) checkOne(ctx context.Context, b Bookmark) {
 	}
 	log.Printf("latest poll %q: latest is now %s", b.Key, latest.Label)
 }
+
+// fetchableSeriesURL reports whether site is a site latestChapterFrom knows how
+// to parse and seriesURL is safe to hand to the fetcher: an https URL with a
+// non-empty host. series_url comes from client-supplied PUT bodies, so this is
+// a defence against the poller being used to probe arbitrary hosts from the
+// server's own network position, not just a check against wasted requests.
+func fetchableSeriesURL(site, seriesURL string) bool {
+	switch site {
+	case "asura", "demonic":
+	default:
+		return false
+	}
+	u, err := url.Parse(seriesURL)
+	if err != nil {
+		return false
+	}
+	return u.Scheme == "https" && u.Host != ""
+}