fix: OpenAPI spec accuracy — hide internal endpoints, mark signup/verify deprecated

- Remove @openapi annotations from /v1/billing/webhook (Stripe-internal)
- Remove @openapi annotations from /v1/billing/success (browser redirect)
- Mark /v1/signup/verify as deprecated (returns 410)
- Add 3 TDD tests in openapi-spec.test.ts
- Update 2 existing tests in app-routes.test.ts
- 530 tests passing (was 527)

dist/routes/recover.js

@@ -3,6 +3,7 @@ import rateLimit from "express-rate-limit";
 import { createPendingVerification, verifyCode } from "../services/verification.js";
 import { sendVerificationEmail } from "../services/email.js";
 import { getAllKeys } from "../services/keys.js";
+import { queryWithRetry } from "../services/db.js";
 import logger from "../services/logger.js";
 const router = Router();
 const recoverLimiter = rateLimit({
@@ -129,7 +130,22 @@ router.post("/verify", recoverLimiter, async (req, res) => {
     switch (result.status) {
         case "ok": {
             const keys = getAllKeys();
-            const userKey = keys.find(k => k.email === cleanEmail);
+            let userKey = keys.find(k => k.email === cleanEmail);
+            // DB fallback: cache may be stale in multi-replica setups
+            if (!userKey) {
+                logger.info({ email: cleanEmail }, "recover verify: cache miss, falling back to DB");
+                const dbResult = await queryWithRetry("SELECT key, tier, email, created_at, stripe_customer_id FROM api_keys WHERE email = $1 LIMIT 1", [cleanEmail]);
+                if (dbResult.rows.length > 0) {
+                    const row = dbResult.rows[0];
+                    userKey = {
+                        key: row.key,
+                        tier: row.tier,
+                        email: row.email,
+                        createdAt: row.created_at instanceof Date ? row.created_at.toISOString() : row.created_at,
+                        stripeCustomerId: row.stripe_customer_id || undefined,
+                    };
+                }
+            }
             if (userKey) {
                 res.json({
                     status: "recovered",