feat: structured logging, JSDoc types, and WEBHOOK_SECRET guard

- Replace string-interpolated console.log/error with JSON.stringify
  for searchable/filterable CF Workers dashboard logs
- Add shared JSDoc typedefs (Subscriber, QueueMessage, ChatTarget)
  with @param/@returns annotations on key functions
- Guard against undefined WEBHOOK_SECRET env var (auth bypass on
  misconfigured deploy)
- Add 3 declined features to feature-decisions.md (fan-out decoupling,
  idempotency keys, /ping)

src/types.js

@@ -0,0 +1,21 @@
+/**
+ * Shared JSDoc type definitions for the project.
+ * Import via: @import { Subscriber, QueueMessage, ChatTarget } from "./types.js"
+ */
+
+/**
+ * Subscriber preferences stored in KV value and metadata
+ * @typedef {{ types: string[], components: string[] }} Subscriber
+ */
+
+/**
+ * Message body enqueued to CF Queue for fan-out delivery
+ * @typedef {{ chatId: number, threadId: ?number, html: string }} QueueMessage
+ */
+
+/**
+ * Chat target extracted from Telegram update
+ * @typedef {{ chatId: number, threadId: ?number }} ChatTarget
+ */
+
+export {};