fix: swagger UI symlink, CSP headers, email-change route, updateKeyEmail

- Fix swagger-ui symlink in Dockerfile (was pointing to /opt/docfast instead of /app)
- Add CSP directives to allow inline scripts/styles and Google Fonts
- Add email-change.ts route with rate limiting (3/hr) and verification
- Add updateKeyEmail to keys service
- Add email-change route to index.ts with CORS support

Dockerfile

@@ -19,6 +19,7 @@ RUN npm install --omit=dev
 
 COPY dist/ dist/
 COPY public/ public/
+RUN rm -f public/swagger-ui && ln -s /app/node_modules/swagger-ui-dist public/swagger-ui
 
 # Create data directory and set ownership to docfast user
 RUN mkdir -p /app/data && chown -R docfast:docfast /app