fix: harden webhook reliability, fix bugs, add test suite

- Statuspage webhook always returns 200 to prevent subscriber removal
- Fix parseKvKey returning string chatId instead of number
- Queue consumer retries on Telegram 5xx instead of acking (prevents message loss)
- Fix observability top-level enabled flag (false → true)
- Add defensive null checks for webhook payload body
- Cache Bot instance per isolate to avoid middleware rebuild per request
- Add vitest + @cloudflare/vitest-pool-workers with 31 tests
- Document DLQ and KV sharding as declined features

test/crypto-utils.test.js

@@ -0,0 +1,20 @@
+import { describe, it, expect } from "vitest";
+import { timingSafeEqual } from "../src/crypto-utils.js";
+
+describe("timingSafeEqual", () => {
+  it("returns true for identical strings", async () => {
+    expect(await timingSafeEqual("secret123", "secret123")).toBe(true);
+  });
+
+  it("returns false for different strings", async () => {
+    expect(await timingSafeEqual("secret123", "wrong")).toBe(false);
+  });
+
+  it("returns false for empty vs non-empty", async () => {
+    expect(await timingSafeEqual("", "something")).toBe(false);
+  });
+
+  it("returns true for both empty", async () => {
+    expect(await timingSafeEqual("", "")).toBe(true);
+  });
+});