refactor: per-subscriber KV keys, HMAC verification, cron trigger

Major refactor addressing scalability, security, and reliability:

- KV schema: single-key → per-subscriber keys (sub:{chatId}:{threadId})
  eliminates read-modify-write race conditions
- Component-specific subscriptions: /subscribe component <name>
- HMAC-SHA256 webhook verification with URL secret fallback
- Cron trigger (every 5 min) polls status.claude.com as safety net
- Shared telegram-api.js module (DRY fix)
- Error logging in all catch blocks
- Migration endpoint for existing subscribers
- Setup moved to standalone script (scripts/setup-bot.js)
- Removed setup HTTP route to reduce attack surface

src/telegram-api.js

@@ -0,0 +1,8 @@
+/**
+ * Shared Telegram Bot API base URL and helper
+ */
+export const TELEGRAM_API = "https://api.telegram.org/bot";
+
+export function telegramUrl(token, method) {
+  return `${TELEGRAM_API}${token}/${method}`;
+}