feat: add metrics tracking and remove unsupported HMAC verification

- Add metrics.js tracking webhooks, messages, cron, commands
- Add GET /metrics/:secret endpoint (text + JSON format)
- Remove HMAC verification (Statuspage doesn't support it)
- Extract validateSecret helper in index.js
- Integrate trackMetrics across webhook, queue, cron, bot handlers

README.md

@@ -13,7 +13,7 @@ Hosted on [Cloudflare Workers](https://workers.cloudflare.com/) with KV for stor
 - **Supergroup topic support** — send `/start` in a specific topic and notifications go to that topic
 - **On-demand status check** — `/status` fetches live data from status.claude.com
 - **Automatic status monitoring** — cron checks every 5 minutes as a safety net
-- **HMAC webhook verification** — validates Statuspage webhook signatures
+- **Metrics dashboard** — track webhooks, messages, cron checks via `/metrics` endpoint
 - **Self-healing** — automatically removes subscribers who block the bot
 
 ## Bot Commands
@@ -79,10 +79,6 @@ npx wrangler secret put BOT_TOKEN
 
 npx wrangler secret put WEBHOOK_SECRET
 # Choose a random secret string for the Statuspage webhook URL
-
-# Optional: HMAC verification for Statuspage webhooks
-npx wrangler secret put STATUSPAGE_HMAC_KEY
-# Paste the HMAC key from Statuspage webhook settings
 ```
 
 ### 5. Deploy