feat(web): proxy kagane cover images so the UI can render them

kagane serves cover images from behind the same Cloudflare challenge as
its pages and with cross-origin-resource-policy: same-origin. The second
header is the decisive one: no <img> on the web UI's origin can load a
kagane cover even from a browser that already holds the clearance cookie,
verified 2026-08-08 by loading one from a foreign origin with and without
a referrer. Hot-linking cannot be made to work, so every kagane series
rendered the monogram placeholder.

Bookmark.CoverURL rewrites a stored kagane og:image to /img/kagane/{id}
and returns every other cover untouched; the templates render .CoverURL
in place of .Cover. The endpoint is session-gated like every other UI
route, and hands the id to the shared headless browser, whose fetch is
same-origin with kagane and therefore satisfies both the challenge and
the CORP header. Results are memoised in-process, so a cover costs one
navigation per deployment lifetime.

The id is matched against a UUID regex before it reaches the browser.
That gate is load-bearing rather than tidiness: the cover is a stored
client-supplied string, so an unvalidated one turns the endpoint into an
SSRF primitive aimed at the deployment's own network. ServeMux
path-cleans a traversal into a redirect before the handler runs, but the
handler does not rely on that, and a test pins it.

With BROWSER_WS_URL unset there is no browser and the endpoint answers
404 rather than reaching for a nil fetcher - the same degrade-to-
userscript behaviour the poller already has for these sites.

backend/AGENTS.md

@@ -126,9 +126,20 @@ Guidance for OpenCode (and Claude Code) working under `backend/`. See root `AGEN
   `/userscript/novel-bookmark.user.js`, both supplied by bindmount; the
   `__API_TOKEN__` placeholder inside them is substituted with the requesting
   Reader's credential at serve time).
-  `BROWSER_WS_URL` (headless-shell CDP endpoint for kagane and novelfull;
-  unset disables browser polling and leaves those sites to the userscript
-  alone).
+  `BROWSER_WS_URL` (CDP endpoint of the `chrome/` sidecar, used by the poller
+  for kagane and novelfull *and* by the web UI's kagane cover proxy; unset
+  disables browser polling and serves 404 from the proxy, leaving those sites
+  to the userscript alone).
+- **kagane covers are proxied, not hot-linked:** kagane serves cover images
+  behind the same challenge as its pages and with
+  `cross-origin-resource-policy: same-origin`, so no `<img>` on the web UI's
+  origin can load one — not even from a browser holding the clearance cookie
+  (verified 2026-08-08). `Bookmark.CoverURL` rewrites a stored kagane
+  `og:image` to `/img/kagane/{id}`, served by `internal/web/cover.go` through
+  `latest.BrowserFetcher.Image` and memoised in-process. The templates render
+  `.CoverURL`, never `.Cover`. The id is matched against a UUID regex before it
+  reaches the browser: the stored value is client-supplied, so an unchecked one
+  is an SSRF primitive pointed at the deployment's own network.
 - **Web UI also owns:** session-gated `GET /install/{manga,novel}-bookmark.user.js`
   (renders the bindmounted script with the acting Reader's derived credential
   substituted in — the credential never appears in page markup, the address