refactor: remove cron, use KV metadata, extract shared crypto util

- Remove cron status polling (statuspage notifies via email on webhook failure)
- Store subscriber types/components as KV metadata for O(1) filtering
- Extract timingSafeEqual to shared crypto-utils.js (was duplicated)
- Change /migrate route from GET to POST (prevent CSRF/prefetch)
- Preserve existing subscriber preferences on /start re-subscribe
- Remove dead getAllSubscribers export
- Update docs to reflect changes

wrangler.jsonc

@@ -23,9 +23,6 @@
 				"max_retries": 3
 			}
 		]
-	},
-	"triggers": {
-		"crons": ["*/5 * * * *"]
 	}
 	// Secrets (set via `wrangler secret put`):
 	// BOT_TOKEN - Telegram bot token