feat: key recovery via email verification (BUG-014)

- POST /v1/recover: request recovery code
- POST /v1/recover/verify: verify code, receive key via email
- Key sent via email only (not in API response) for security
- Rate limited to 3 attempts per hour
- Non-enumerable: same response whether email exists or not
- DKIM-signed emails via postfix/opendkim

src/index.ts

@@ -7,6 +7,7 @@ import { convertRouter } from "./routes/convert.js";
 import { templatesRouter } from "./routes/templates.js";
 import { healthRouter } from "./routes/health.js";
 import { signupRouter } from "./routes/signup.js";
+import { recoverRouter } from "./routes/recover.js";
 import { billingRouter } from "./routes/billing.js";
 import { authMiddleware } from "./middleware/auth.js";
 import { usageMiddleware } from "./middleware/usage.js";
@@ -67,6 +68,7 @@ app.use(limiter);
 // Public routes
 app.use("/health", healthRouter);
 app.use("/v1/signup", signupRouter);
+app.use("/v1/recover", recoverRouter);
 app.use("/v1/billing", billingRouter);
 
 // Authenticated routes