fix: OpenAPI spec accuracy — hide internal endpoints, mark signup/verify deprecated

- Remove @openapi annotations from /v1/billing/webhook (Stripe-internal)
- Remove @openapi annotations from /v1/billing/success (browser redirect)
- Mark /v1/signup/verify as deprecated (returns 410)
- Add 3 TDD tests in openapi-spec.test.ts
- Update 2 existing tests in app-routes.test.ts
- 530 tests passing (was 527)

dist/routes/signup.js

@@ -56,9 +56,10 @@ router.post("/free", rejectDuplicateEmail, signupLimiter, async (req, res) => {
  * /v1/signup/verify:
  *   post:
  *     tags: [Account]
- *     summary: Verify email and get API key
+ *     summary: Verify email and get API key (discontinued)
+ *     deprecated: true
  *     description: |
- *       Verifies the 6-digit code sent to the user's email and provisions a free API key.
+ *       **Discontinued.** Free accounts are no longer available. Try the demo at POST /v1/demo/html or upgrade to Pro at https://docfast.dev.
  *       Rate limited to 15 attempts per 15 minutes.
  *     requestBody:
  *       required: true