Security: never send API keys via email, add browser-based recovery UI, adjust rate limits

Investor Directive 1: Key recovery now shows key in browser after email verification code.
- Removed sendRecoveryEmail function entirely
- Recovery endpoint returns apiKey in JSON response (shown once in browser)
- Added full recovery modal UI (email → code → key displayed)
- Added "Lost your API key?" links throughout signup flow

Investor Directive 3: Rate limits adjusted to match server capacity.
- Global rate limit: 100/min → 30/min (server handles ~28 PDFs/min)
- CORS: recover routes now restricted to docfast.dev origin

src/index.ts

@@ -27,6 +27,7 @@ app.use(helmet({ crossOriginResourcePolicy: { policy: "cross-origin" } }));
 // Differentiated CORS middleware
 app.use((req, res, next) => {
   const isAuthBillingRoute = req.path.startsWith('/v1/signup') || 
+                             req.path.startsWith('/v1/recover') || 
                              req.path.startsWith('/v1/billing');
   
   if (isAuthBillingRoute) {
@@ -59,7 +60,7 @@ app.set("trust proxy", 1);
 // Rate limiting
 const limiter = rateLimit({
   windowMs: 60_000,
-  max: 100,
+  max: 30,
   standardHeaders: true,
   legacyHeaders: false,
 });