Backend hardening: structured logging, timeouts, memory leak fixes, compression, XSS fix

- Add pino structured logging with request IDs (X-Request-Id header)
- Add 30s timeout to acquirePage() and renderPdf/renderUrlPdf
- Add verification cache cleanup (every 15min) and rate limit cleanup (every 60s)
- Read version from package.json in health endpoint
- Add compression middleware
- Escape currency in templates (XSS fix)
- Add static asset caching (1h maxAge)
- Remove deprecated docker-compose version field
- Replace all console.log/error with pino logger

src/routes/recover.ts

@@ -3,6 +3,7 @@ import rateLimit from "express-rate-limit";
 import { createPendingVerification, verifyCode } from "../services/verification.js";
 import { sendVerificationEmail } from "../services/email.js";
 import { getAllKeys } from "../services/keys.js";
+import logger from "../services/logger.js";
 
 const router = Router();
 
@@ -34,7 +35,7 @@ router.post("/", recoverLimiter, async (req: Request, res: Response) => {
   const pending = await createPendingVerification(cleanEmail);
 
   sendVerificationEmail(cleanEmail, pending.code).catch(err => {
-    console.error(`Failed to send recovery email to ${cleanEmail}:`, err);
+    logger.error({ err, email: cleanEmail }, "Failed to send recovery email");
   });
 
   res.json({ status: "recovery_sent", message: "If an account exists for this email, a verification code has been sent." });