feat: v2.2.0 — Modularize codebase, unify mirror fallback, harden security

Major Changes:
- Add shared parseListItem.helper.js for unified list parsing (DRY)
- Migrate all 22 extractors to use fetchWithMirror() for consistent mirror fallback
- Remove unused cors dependency (custom CORS middleware handles it)
- Fix middleware ordering: timeout now registered before routes
- Fix CORS to allow POST for /api/mirrors/reset endpoint
- Remove redundant cache check in homeInfo extractor

New Features:
- Request ID tracking (X-Request-Id header) for debugging
- Graceful shutdown handling (SIGTERM/SIGINT) with 10s timeout
- CSP and HSTS security headers
- Rate limiter cleanup interval (every 5 min) to prevent memory leak
- Request body size limits (10kb) via express.json()

Security:
- Content-Security-Policy header for XSS protection
- Strict-Transport-Security for HTTPS enforcement
- X-Permitted-Cross-Domain-Policies: none
- Body size limits to prevent large payload attacks

Code Quality:
- All files follow strict documentation style (box headers, section separators,
  feature markers, JSDoc params/returns, inline notes, module footers)
- Eliminated ~200 lines of duplicated code across 8+ extractors
- Updated CHANGELOG.md with comprehensive change history

src/extractors/schedule.extractor.js

@@ -16,9 +16,8 @@
  */
 
 import * as cheerio from "cheerio";
-import axios from "axios";
-import { headers } from "../configs/header.config.js";
 import { URLS } from "../configs/dataUrl.js";
+import { fetchWithMirror } from "../helper/mirror.helper.js";
 
 // ══════════════════════════════════════════════════════════════
 // SCHEDULE EXTRACTION
@@ -43,21 +42,18 @@ import { URLS } from "../configs/dataUrl.js";
  */
 const extractSchedule = async (date) => {
   try {
-    // NOTE: The schedule is fetched by appending date parameter to homepage
-    const url = `${URLS.home}?date=${date}`;
-    const { data } = await axios.get(url, { headers });
+    const path = `/?date=${date}`;
+    const { data } = await fetchWithMirror(path);
     const $ = cheerio.load(data);
 
     const schedule = [];
 
-    // NOTE: Schedule items use different selectors depending on page structure
     $(".schedule-item, .anime-schedule .item").each((i, el) => {
       const slug = $(el).find("a").attr("href")?.split("/watch/").pop() || "";
       const title = $(el).find(".film-name a, .name").text().trim() || "";
       const time = $(el).find(".time, .schedule-time").text().trim() || "";
       const episodeNo = parseInt($(el).find(".episode-no, .ep-num").text().trim()) || 0;
 
-      // NOTE: Only include items with valid slugs
       if (slug) {
         schedule.push({
           slug,