Backend hardening: structured logging, timeouts, memory leak fixes, compression, XSS fix

- Add pino structured logging with request IDs (X-Request-Id header)
- Add 30s timeout to acquirePage() and renderPdf/renderUrlPdf
- Add verification cache cleanup (every 15min) and rate limit cleanup (every 60s)
- Read version from package.json in health endpoint
- Add compression middleware
- Escape currency in templates (XSS fix)
- Add static asset caching (1h maxAge)
- Remove deprecated docker-compose version field
- Replace all console.log/error with pino logger

src/routes/signup.ts

@@ -3,6 +3,7 @@ import rateLimit from "express-rate-limit";
 import { createFreeKey } from "../services/keys.js";
 import { createVerification, createPendingVerification, verifyCode, isEmailVerified, getVerifiedApiKey } from "../services/verification.js";
 import { sendVerificationEmail } from "../services/email.js";
+import logger from "../services/logger.js";
 
 const router = Router();
 
@@ -53,7 +54,7 @@ router.post("/free", rejectDuplicateEmail, signupLimiter, async (req: Request, r
   const pending = await createPendingVerification(cleanEmail);
 
   sendVerificationEmail(cleanEmail, pending.code).catch(err => {
-    console.error(`Failed to send verification email to ${cleanEmail}:`, err);
+    logger.error({ err, email: cleanEmail }, "Failed to send verification email");
   });
 
   res.json({