chore: merge main, resolve biome formatting conflicts

Merge origin/main into feat/external-2fa-codes. Resolve formatting
conflicts caused by biome rollout; preserve both feature streams:
PR's external 2FA token + signing-session 2FA proof additions plus
main's RateLimit/RecipientExpired/signingReminders/date-auto-insert.

In complete-document-with-token.ts, drop the duplicate early
field-fetching block introduced when main moved that logic later
with date auto-insert support; keep the EXTERNAL_TWO_FACTOR_AUTH
check using derivedRecipientActionAuth.

apps/openpage-api/app/github/forks/route.ts

@@ -10,6 +10,7 @@ export async function GET(request: Request) {
       status: 200,
       headers: {
         'content-type': 'application/json',
+        'Cache-Control': 'public, s-maxage=3600, stale-while-revalidate=7200',
       },
     }),
   );

apps/openpage-api/app/github/issues/route.ts

@@ -12,6 +12,7 @@ export async function GET(request: Request) {
       status: 200,
       headers: {
         'content-type': 'application/json',
+        'Cache-Control': 'public, s-maxage=3600, stale-while-revalidate=7200',
       },
     }),
   );

apps/openpage-api/app/github/prs/route.ts

@@ -12,6 +12,7 @@ export async function GET(request: Request) {
       status: 200,
       headers: {
         'content-type': 'application/json',
+        'Cache-Control': 'public, s-maxage=3600, stale-while-revalidate=7200',
       },
     }),
   );

apps/openpage-api/app/github/stars/route.ts

@@ -10,6 +10,7 @@ export async function GET(request: Request) {
       status: 200,
       headers: {
         'content-type': 'application/json',
+        'Cache-Control': 'public, s-maxage=3600, stale-while-revalidate=7200',
       },
     }),
   );