fix(cors): dynamic origin for staging support (BUG-111) + eliminate all 'as any' casts

- CORS middleware now allows both docfast.dev and staging.docfast.dev origins
  for auth/billing routes, with Vary: Origin header for proper caching
- Unknown origins fall back to production origin (not reflected)
- 13 TDD tests added for CORS behavior

Type safety improvements:
- Augment Express.Request with requestId, acquirePdfSlot, releasePdfSlot
- Use Puppeteer's PaperFormat and PuppeteerLifeCycleEvent types in browser.ts
- Use 'as const' for format literals in convert/demo/templates routes
- Replace Stripe apiVersion 'as any' with @ts-expect-error
- Zero 'as any' casts remaining in production code

579 tests passing (13 new), 51 test files

src/routes/templates.ts

@@ -163,7 +163,7 @@ templatesRouter.post("/:id/render", async (req: Request, res: Response) => {
       res.status(400).json({ error: validation.error });
       return;
     }
-    const sanitizedPdf = { format: "A4" as string, ...validation.sanitized };
+    const sanitizedPdf = { format: "A4" as const, ...validation.sanitized };
 
     const html = renderTemplate(id, data);
     const { pdf, durationMs } = await renderPdf(html, sanitizedPdf);