- swagger.ts: changed apis glob from dist/routes/*.js to src/routes/*.ts
so OpenAPI spec includes demo endpoints during tests (fixes 6 test failures)
- Dockerfile: copy src/ to final stage for runtime swagger-jsdoc
- Updated stale /v1/signup/verify test refs to /v1/signup/free (endpoint
was removed when free tier was discontinued)
/v1/email-change was missing from the restricted CORS list, getting
wildcard Access-Control-Allow-Origin: * instead of being restricted to
https://docfast.dev like other account management routes (signup,
recover, billing, demo). TDD: test added to app-routes.test.ts.
