Backend hardening: structured logging, timeouts, memory leak fixes, compression, XSS fix

- Add pino structured logging with request IDs (X-Request-Id header)
- Add 30s timeout to acquirePage() and renderPdf/renderUrlPdf
- Add verification cache cleanup (every 15min) and rate limit cleanup (every 60s)
- Read version from package.json in health endpoint
- Add compression middleware
- Escape currency in templates (XSS fix)
- Add static asset caching (1h maxAge)
- Remove deprecated docker-compose version field
- Replace all console.log/error with pino logger

src/middleware/usage.ts

@@ -1,4 +1,5 @@
 import { isProKey } from "../services/keys.js";
+import logger from "../services/logger.js";
 import pool from "../services/db.js";
 
 const FREE_TIER_LIMIT = 100;
@@ -18,9 +19,9 @@ export async function loadUsageData(): Promise<void> {
     for (const row of result.rows) {
       usage.set(row.key, { count: row.count, monthKey: row.month_key });
     }
-    console.log(`Loaded usage data for ${usage.size} keys from PostgreSQL`);
+    logger.info(`Loaded usage data for ${usage.size} keys from PostgreSQL`);
   } catch (error) {
-    console.log("No existing usage data found, starting fresh");
+    logger.info("No existing usage data found, starting fresh");
     usage = new Map();
   }
 }
@@ -33,7 +34,7 @@ async function saveUsageEntry(key: string, record: { count: number; monthKey: st
       [key, record.count, record.monthKey]
     );
   } catch (error) {
-    console.error("Failed to save usage data:", error);
+    logger.error({ err: error }, "Failed to save usage data");
   }
 }
 
@@ -68,10 +69,10 @@ function trackUsage(key: string, monthKey: string): void {
   if (!record || record.monthKey !== monthKey) {
     const newRecord = { count: 1, monthKey };
     usage.set(key, newRecord);
-    saveUsageEntry(key, newRecord).catch(console.error);
+    saveUsageEntry(key, newRecord).catch((err) => logger.error({ err }, "Failed to save usage entry"));
   } else {
     record.count++;
-    saveUsageEntry(key, record).catch(console.error);
+    saveUsageEntry(key, record).catch((err) => logger.error({ err }, "Failed to save usage entry"));
   }
 }