fix: cancelled tier, remove key logging, add billing rate limits

- Add 'cancelled' tier (0 req/month) for downgraded subscriptions
- Remove full API key from recovery endpoint logs (security)
- Add IP-based rate limiting (10/15min) to billing endpoints
- Bump version to 0.7.0
- 4 new tests (338 total)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "snapapi",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "URL to Screenshot API — PNG, JPEG, WebP via simple REST API",
   "main": "dist/index.js",
   "type": "module",