fix(cors): dynamic origin for staging support (BUG-111) + eliminate all 'as any' casts

- CORS middleware now allows both docfast.dev and staging.docfast.dev origins
  for auth/billing routes, with Vary: Origin header for proper caching
- Unknown origins fall back to production origin (not reflected)
- 13 TDD tests added for CORS behavior

Type safety improvements:
- Augment Express.Request with requestId, acquirePdfSlot, releasePdfSlot
- Use Puppeteer's PaperFormat and PuppeteerLifeCycleEvent types in browser.ts
- Use 'as const' for format literals in convert/demo/templates routes
- Replace Stripe apiVersion 'as any' with @ts-expect-error
- Zero 'as any' casts remaining in production code

579 tests passing (13 new), 51 test files

src/routes/convert.ts

@@ -78,7 +78,7 @@ interface ConvertBody {
  *       500:
  *         description: PDF generation failed
  */
-convertRouter.post("/html", async (req: Request & { acquirePdfSlot?: () => Promise<void>; releasePdfSlot?: () => void }, res: Response) => {
+convertRouter.post("/html", async (req: Request, res: Response) => {
   let slotAcquired = false;
   try {
     // Reject non-JSON content types
@@ -188,7 +188,7 @@ convertRouter.post("/html", async (req: Request & { acquirePdfSlot?: () => Promi
  *       500:
  *         description: PDF generation failed
  */
-convertRouter.post("/markdown", async (req: Request & { acquirePdfSlot?: () => Promise<void>; releasePdfSlot?: () => void }, res: Response) => {
+convertRouter.post("/markdown", async (req: Request, res: Response) => {
   let slotAcquired = false;
   try {
     // Reject non-JSON content types
@@ -299,7 +299,7 @@ convertRouter.post("/markdown", async (req: Request & { acquirePdfSlot?: () => P
  *       500:
  *         description: PDF generation failed
  */
-convertRouter.post("/url", async (req: Request & { acquirePdfSlot?: () => Promise<void>; releasePdfSlot?: () => void }, res: Response) => {
+convertRouter.post("/url", async (req: Request, res: Response) => {
   let slotAcquired = false;
   try {
     // Reject non-JSON content types