fix: BUG-022 check duplicate email before rate limit, BUG-024 support X-API-Key header

public/docs.html

@@ -83,8 +83,10 @@
 
   <section id="auth">
     <h2>Authentication</h2>
-    <p>All conversion and template endpoints require an API key. Pass it in the <code>Authorization</code> header:</p>
+    <p>All conversion and template endpoints require an API key. Pass it using either method:</p>
     <pre>Authorization: Bearer df_free_your_api_key_here</pre>
+    <p>Or use the <code>X-API-Key</code> header:</p>
+    <pre>X-API-Key: df_free_your_api_key_here</pre>
     <p style="margin-top:0.75rem">Get a free API key instantly — no credit card required:</p>
     <pre>curl -X POST https://docfast.dev/v1/signup/free \
   -H "Content-Type: application/json" \