fix: security and robustness improvements, add project docs

- Hash inputs in timingSafeEqual to prevent length leak side-channel
- Add quote escaping to escapeHtml for defense in depth
- Normalize chatId to Number in parseKvKey for type consistency
- Log Retry-After header on 429 rate limit responses
- Slim README to focused overview, move details to docs/
- Add docs/: system-architecture, setup-guide, feature-decisions
- Add documentation section and README guidelines to CLAUDE.md

CLAUDE.md

@@ -66,3 +66,16 @@ Bot stores `message_thread_id` from the topic where `/start` was sent. Notificat
 
 - `claude_status` — KV namespace
 - `claude-status` — Queue producer/consumer (batch size 30, max retries 3)
+
+## Documentation
+
+Detailed docs live in `docs/`:
+- `docs/setup-guide.md` — Prerequisites, deployment, local dev
+- `docs/system-architecture.md` — Entry points, data flow, KV schema, queue, security
+- `docs/feature-decisions.md` — Evaluated features and rationale for decisions
+
+## README Guidelines
+
+Keep `README.md` clean and focused: project intro, features, commands, quick start, and links to docs.
+Move detailed setup, architecture, and decision records to `docs/`. Do not bloat the README with
+step-by-step instructions or implementation details.