fix: clean up request interceptor in recyclePage to prevent pool contamination

When renderUrlPdf() sets up request interception for SSRF DNS pinning,
the interceptor and event listener were never cleaned up in recyclePage().
This could cause subsequent HTML-to-PDF conversions on the same pooled
page to have external resources blocked by the stale interceptor.

- Export recyclePage for testability
- Add removeAllListeners('request') + setRequestInterception(false)
- Add browser-recycle.test.ts with TDD (red→green verified)

Tests: 443 passing (was 442)

src/services/browser.ts

@@ -40,11 +40,14 @@ export function getPoolStats() {
   };
 }
 
-async function recyclePage(page: Page): Promise<void> {
+export async function recyclePage(page: Page): Promise<void> {
   try {
     const client = await page.createCDPSession();
     await client.send("Network.clearBrowserCache").catch(() => {});
     await client.detach().catch(() => {});
+    // Clean up request interception (set by renderUrlPdf for SSRF protection)
+    page.removeAllListeners("request");
+    await page.setRequestInterception(false).catch(() => {});
     const cookies = await page.cookies();
     if (cookies.length > 0) {
       await page.deleteCookie(...cookies);