feat(api): validate status on PUT, refuse finished from clients

backend/handlers.go

@@ -60,6 +60,21 @@ func (h *bookmarkHandler) put(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 	}
+
+	// An empty status is "no opinion" and Upsert keeps the stored bucket.
+	// Finishing a series is a web-UI decision, so the JSON API refuses it
+	// rather than trusting every client to leave it alone.
+	switch b.Status {
+	case "", statusReading, statusArchived:
+	case statusFinished:
+		http.Error(w, "status "+statusFinished+" can only be set from the web UI",
+			http.StatusBadRequest)
+		return
+	default:
+		http.Error(w, "invalid status", http.StatusBadRequest)
+		return
+	}
+
 	// Candidate timestamp, not a decision: Upsert keeps the stored one unless
 	// reading progress actually moved. Any client value is ignored.
 	b.UpdatedAt = time.Now().UnixMilli()