v1.9.0: Full diagnostic sweep - 42 issues fixed

Critical fixes (7):
- Added global Express error handler (returns JSON instead of HTML)
- Removed caching from random endpoint (defeated purpose)
- Renamed share.jpg to share.png (MIME type mismatch)
- Fixed OG image dimensions (630 → 601)
- Fixed manifest.json icon sizes (192x192 → 512x512)
- Fixed implicit global event variable in console
- Added 9 missing endpoints to docs/endpoints.md

High fixes (12):
- Imported version from package.json (no hardcoded drift)
- Added dynamic endpoint count in stats
- Added input sanitization for mapper API (SSRF prevention)
- Added homepage caching (reduced 5 duplicate HTTP requests)
- Added rate limiting (100 requests/minute per IP)
- Added rel="noopener noreferrer" to all target="_blank" links
- Fixed trailing slash inconsistency in console
- Added noindex meta to 404.html
- Fixed docs/architecture.md controller filenames and dependency versions
- Fixed README.md dependency versions
- Added 12 missing endpoint tests

Medium fixes (22):
- Added escapeHtml helper for error messages
- Consistent favicon across all pages
- Added meta descriptions to privacy.html and tos.html
- Added OG/Twitter meta tags to privacy.html and tos.html
- Added aria-label to playground inputs
- Added aria-hidden to decorative SVGs
- Synced Twitter description with OG description
- Fixed robots.txt to disallow /api
- Added PWA fields to manifest.json
- Removed 5 unused imports
- Removed unused cookie-parser dependency
- Fixed inconsistent error handling in extractors
- Fixed resolvedSlug returning numeric ID
- Added /watch endpoint to streaming docs
- Improved test assertions and status code validation
- Deleted orphaned og-image.svg and logo.png

Low fixes (11):
- Removed redundant try/catch from extractPages
- Added max size eviction to cache
- Added cache key sorting in filter controller
- Added author meta tag
- Fixed favicon.svg font

Version bumped to 1.9.0

public/tos.html

@@ -2,10 +2,15 @@
 <html lang="en">
 <head>
   <meta charset="UTF-8" />
+  <meta name="description" content="Terms of Service for AniKotoAPI. Acceptable use, rate limits, liability, and DMCA policy." />
+  <meta property="og:title" content="Terms of Service — AniKotoAPI" />
+  <meta property="og:description" content="Terms of Service for AniKotoAPI. Acceptable use, rate limits, liability, and DMCA policy." />
+  <meta property="og:image" content="https://anikototvapi.vercel.app/share.png" />
+  <meta name="twitter:card" content="summary" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>Terms of Service — AniKotoAPI</title>
   <meta name="theme-color" content="#0A0A12" />
-  <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>⛩</text></svg>" />
+  <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
   <link rel="preconnect" href="https://fonts.googleapis.com" />
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
   <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet" />
@@ -78,16 +83,16 @@
     <p>In no event shall the creators of AniKotoAPI be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the Service.</p>
 
     <h2>10. Intellectual Property</h2>
-    <p>The source code of AniKotoAPI is open source and available on <a href="https://github.com/Shineii86/AniKotoAPI" target="_blank">GitHub</a> under the repository's license terms.</p>
+    <p>The source code of AniKotoAPI is open source and available on <a href="https://github.com/Shineii86/AniKotoAPI" target="_blank" rel="noopener noreferrer">GitHub</a> under the repository's license terms.</p>
 
     <h2>11. DMCA / Takedowns</h2>
-    <p>If you believe your copyrighted content is being displayed through this API without authorization, please open an issue at <a href="https://github.com/Shineii86/AniKotoAPI/issues" target="_blank">github.com/Shineii86/AniKotoAPI/issues</a> and we will promptly remove it.</p>
+    <p>If you believe your copyrighted content is being displayed through this API without authorization, please open an issue at <a href="https://github.com/Shineii86/AniKotoAPI/issues" target="_blank" rel="noopener noreferrer">github.com/Shineii86/AniKotoAPI/issues</a> and we will promptly remove it.</p>
 
     <h2>12. Changes to Terms</h2>
     <p>We reserve the right to modify these Terms at any time. Changes will be posted on this page with an updated "Last updated" date.</p>
 
     <h2>13. Contact</h2>
-    <p>For questions about these Terms, open an issue at <a href="https://github.com/Shineii86/AniKotoAPI/issues" target="_blank">github.com/Shineii86/AniKotoAPI/issues</a>.</p>
+    <p>For questions about these Terms, open an issue at <a href="https://github.com/Shineii86/AniKotoAPI/issues" target="_blank" rel="noopener noreferrer">github.com/Shineii86/AniKotoAPI/issues</a>.</p>
   </div>
   <footer>&copy; 2026 AniKotoAPI &middot; <a href="/" style="color:var(--purple)">Home</a> &middot; <a href="/privacy" style="color:var(--purple)">Privacy</a></footer>
 </body>