fix: Full diagnostic sweep — bugs, dead code, unused imports, docs accuracy

Code fixes:
- seasons/watchOrder: Remove dead ternary (both branches identical)
- mirror.helper: Remove redundant ternary (both branches identical)
- topAnimeRankings: Fix JSDoc (day/week/month, not top/newest)
- apiRoutes: Fix proxy domain validation (exact match, not includes)
- apiRoutes: Fix proxy .m3u8 check (pathname, not hostname)
- pagination: Fix totalItems calculation (was overestimating)
- server.js: Remove dead has404File variable
- server.js: Remove duplicate /api/cache/stats route
- server.js: Remove unused getCacheStats import

Unused imports removed:
- animeInfo: URLS from dataUrl.js
- episodeList: headers from header.config.js
- episodeListAjax: axios
- trending: URLS from dataUrl.js
- trendingSidebar: URLS from dataUrl.js
- upcomingAnime: parseListItems
- watchPage: URLS, BASE_URL from dataUrl.js

Docs fixes:
- README: 33->38 endpoints, 24->28 controllers, 26->28 extractors
- README: Cache TTL 5min->per-endpoint, Timeout 15s->30s
- docs/index.md: 33->38 endpoints
- architecture.md: LRU cache strategy, remove stale cookie-parser
- agents: compression version, extractor/controller counts
- agents: domain typo, stale CORS dep, version badge

src/routes/apiRoutes.js

@@ -238,7 +238,7 @@ app.use((req, res, next) => {
       // NOTE: Validate URL is from known streaming domains
       const allowedDomains = ["vidtube.site", "vidplay.site", "megaplay.buzz", "megaplay-1.buzz", "cdn.anipixcdn.co"];
       const urlObj = new URL(url);
-      const isAllowed = allowedDomains.some(d => urlObj.hostname.includes(d)) || urlObj.hostname.endsWith(".m3u8");
+      const isAllowed = allowedDomains.some(d => urlObj.hostname === d || urlObj.hostname.endsWith(`.${d}`)) || urlObj.pathname.endsWith(".m3u8");
 
       if (!isAllowed) {
         return res.status(403).json({ success: false, message: "Domain not allowed for proxy" });