refactor(api): shared helpers for the five write routes

[mohanadft]

Summary

• Add shared response, origin-guard (withOriginGuard), validation and Notion/EmailOctopus helpers; migrate endorsement-request, e4p-pledge-sign, membership-complete, donation-complete, pipe.
• Characterization tests for all five routes first; route tests moved out of src/pages so Astro doesn't build them as endpoints.
• Status codes, headers and body keys are preserved, including 403s without CORS headers; Origin is still checked before body parsing.

Behaviour changes

• A non-string field on endorsement-request / e4p-pledge-sign now returns 400 instead of a Notion 500.
• isAllowedOrigin now requires a dot boundary on suffixes (evilpages.dev is rejected); existing suffixes behave the same.

Test plan

• CI green (lint, check, test, build)
• pnpm lint, pnpm check, pnpm test pass locally; independently reviewed

[cloudflare-workers-and-pages]

Deploying website with    Cloudflare Pages

Latest commit:	35c711e
Status:	✅  Deploy successful!
Preview URL:	https://308879b6.website-aun.pages.dev
Branch Preview URL:	https://refactor-api-write-routes.website-aun.pages.dev

View logs