Define Cover and record hosting its bytes (#47)

Cover was named in the Series entry but never defined, and the gap is
what #47 is: nothing said whether a Cover is an address on a Site or an
image a Reader's browser can actually display. Kagane proved they are
not the same thing.

The ADR records the decision that follows — the backend fetches, stores
and serves every Site's cover bytes — along with the alternatives that
were rejected and the two knowing relaxations: destination-class control
instead of the host allowlist fetchableSeriesURL sets as precedent, and
a public cover route where the kagane proxy is session-gated.

CONTEXT.md

@@ -18,6 +18,13 @@ _Avoid_: manga, title, book, comic
 One third-party source a Series is published on. A Series on two Sites is two Series.
 _Avoid_: source, host, provider, domain
 
+**Cover**:
+The image that stands for a Series wherever it is listed. A fact about the Series like
+its title — one Cover per Series, shared by every Reader, never per-Reader. Defined by
+what a Reader's browser can display, not by where the Site keeps the picture: an address
+no client can load is not a Cover, it is a missing one.
+_Avoid_: thumbnail, poster, image URL, artwork
+
 **Reader**:
 A person with their own Progress. Exactly one per set of credentials, so there is no
 separate "account" concept to model — the credential belongs to the Reader.