Fix search param types, expose rate-limit headers, remove CORS-breaking User-Agent header

[hanoak]

Summary

This PR fixes three open issues:

• Missing types for search params #56 — Photo search was missing types for orientation, size, color, and locale filter params. Added a PhotoFilterParams type and wired it into photos.search.
• How to access headers such as X-Ratelimit-Limit? #53 — There was no way to read the X-Ratelimit-* response headers. createFetchWrapper now attaches the raw Headers object as a non-enumerable .headers property on every successful response (including the object returned by photos.random()), with return types updated via a new WithHeaders type.
• Fails to query in Firefox due to CORS #45 / Access to pexels fails on Safari and Firefox #48 — Removed the custom User-Agent: Pexels/JavaScript header. Browsers treat User-Agent as a forbidden/CORS-unsafe header; Chrome silently drops the override (which is why it appeared to work there), but Firefox and Safari fail the CORS preflight entirely, blocking every request from this library in those browsers.

Testing

• yarn build passes for all three changes; generated .d.ts output was inspected for correctness.
• Verified live against the real Pexels API (not mocked) for each fix: query param serialization, actual rate-limit header values, and outgoing request headers.
• Ran the existing Jest snapshot suite before and after each change. 11/15 tests fail identically on unmodified master due to a pre-existing bug in the mutateAllValuesToNull test helper (it only nulls truthy values, so live data drift like liked: false, description: "", or videos_count: 0 trips snapshot diffs). None of these three fixes introduce any new failures beyond that baseline.

Notes for maintainers

• The User-Agent removal was verified with Node's fetch (no User-Agent sent, request still succeeds), but Node doesn't perform CORS preflight, so the actual browser-side failure couldn't be reproduced locally. The fix follows directly from the root cause identified in Fails to query in Firefox due to CORS #45 and its linked Chromium bug report.
• Rate-limit headers are currently only attached on successful (response.ok) responses; a non-ok response still throws a bare Error without headers attached. Happy to extend this in a follow-up if useful.

Closes #56, #53, #45, #48

[hanoak]

Hi @dvandersluis @dorelljames @josephfarina @dvandersluis @gwenevieve @LarsFlieger

I've fixed 3 open issues. I'm tagging all of you here. All the information about this PR is mentioned above. Looking forward to discuss and merge the PR.
Thanks.

[hanoak]

Hi @dvandersluis @dorelljames @josephfarina @dvandersluis @gwenevieve @LarsFlieger
Hi guys, looping here again to get this thread to the top.
Thanks.