fix: swagger UI symlink, CSP headers, email-change route, updateKeyEmail

- Fix swagger-ui symlink in Dockerfile (was pointing to /opt/docfast instead of /app)
- Add CSP directives to allow inline scripts/styles and Google Fonts
- Add email-change.ts route with rate limiting (3/hr) and verification
- Add updateKeyEmail to keys service
- Add email-change route to index.ts with CORS support

src/services/keys.ts

@@ -118,3 +118,11 @@ export function revokeByCustomer(stripeCustomerId: string): boolean {
 export function getAllKeys(): ApiKey[] {
   return [...store.keys];
 }
+
+export function updateKeyEmail(apiKey: string, newEmail: string): boolean {
+  const entry = store.keys.find(k => k.key === apiKey);
+  if (!entry) return false;
+  entry.email = newEmail;
+  save();
+  return true;
+}