Backend hardening: structured logging, timeouts, memory leak fixes, compression, XSS fix

- Add pino structured logging with request IDs (X-Request-Id header)
- Add 30s timeout to acquirePage() and renderPdf/renderUrlPdf
- Add verification cache cleanup (every 15min) and rate limit cleanup (every 60s)
- Read version from package.json in health endpoint
- Add compression middleware
- Escape currency in templates (XSS fix)
- Add static asset caching (1h maxAge)
- Remove deprecated docker-compose version field
- Replace all console.log/error with pino logger

src/services/db.ts

@@ -1,5 +1,6 @@
 import pg from "pg";
 
+import logger from "./logger.js";
 const { Pool } = pg;
 
 const pool = new Pool({
@@ -13,7 +14,7 @@ const pool = new Pool({
 });
 
 pool.on("error", (err) => {
-  console.error("Unexpected PostgreSQL pool error:", err);
+  logger.error({ err }, "Unexpected PostgreSQL pool error");
 });
 
 export async function initDatabase(): Promise<void> {
@@ -55,7 +56,7 @@ export async function initDatabase(): Promise<void> {
         month_key TEXT NOT NULL
       );
     `);
-    console.log("PostgreSQL tables initialized");
+    logger.info("PostgreSQL tables initialized");
   } finally {
     client.release();
   }