fix: Full diagnostic sweep — bugs, dead code, unused imports, docs accuracy

Code fixes:
- seasons/watchOrder: Remove dead ternary (both branches identical)
- mirror.helper: Remove redundant ternary (both branches identical)
- topAnimeRankings: Fix JSDoc (day/week/month, not top/newest)
- apiRoutes: Fix proxy domain validation (exact match, not includes)
- apiRoutes: Fix proxy .m3u8 check (pathname, not hostname)
- pagination: Fix totalItems calculation (was overestimating)
- server.js: Remove dead has404File variable
- server.js: Remove duplicate /api/cache/stats route
- server.js: Remove unused getCacheStats import

Unused imports removed:
- animeInfo: URLS from dataUrl.js
- episodeList: headers from header.config.js
- episodeListAjax: axios
- trending: URLS from dataUrl.js
- trendingSidebar: URLS from dataUrl.js
- upcomingAnime: parseListItems
- watchPage: URLS, BASE_URL from dataUrl.js

Docs fixes:
- README: 33->38 endpoints, 24->28 controllers, 26->28 extractors
- README: Cache TTL 5min->per-endpoint, Timeout 15s->30s
- docs/index.md: 33->38 endpoints
- architecture.md: LRU cache strategy, remove stale cookie-parser
- agents: compression version, extractor/controller counts
- agents: domain typo, stale CORS dep, version badge

agents/security-architect.md

@@ -38,7 +38,7 @@ You are **Security Architect** for AniKotoAPI, responsible for securing a public
 ```javascript
 // ALLOWED_ORIGINS env var (comma-separated)
 // Default: allow all origins
-// Only GET method allowed
+// GET and POST methods allowed
 // Handles OPTIONS preflight
 ```
 
@@ -99,8 +99,7 @@ You are **Security Architect** for AniKotoAPI, responsible for securing a public
 | express | 4.21 | Check for known CVEs |
 | axios | 1.8 | Check for SSRF bugs |
 | cheerio | 1.0-rc.12 | Check for prototype pollution |
-| cors | 2.8 | Check for bypass issues |
-| compression | 1.8 | Check for BREACH attacks |
+| compression | 1.7 | Check for BREACH attacks |
 | dotenv | 16.4 | Check for env injection |
 
 ## What You Do