feat(ops): heartbeat pings for the worker and bot, and a tunnel readiness check

[matthew-demidoff]

Fourth of the ops tranche: the dead-man's switch. Alerts (#83) are sent
from the host, so a dead worker, a hung loop, or a lost tunnel looked
identical to a quiet day. This adds the outbound half of an external
monitor; the monitor itself is a vendor choice (any healthchecks.io-style
ping-URL service; it can deliver into the same Telegram chat).

worker.js

• Each loop records its last error-free completion (loop bodies resolve
  false when they swallow an error; runBatch treats that like a throw).
• Every HEARTBEAT_INTERVAL_MS (60s) the worker GETs HEARTBEAT_URL only while
  every loop is inside its tolerance (a little over two periods each) and
  Redis answers a PING. Otherwise it logs heartbeat_withheld with the stale
  loops and raises a worker_unhealthy alert, so the vendor's missed-ping page
  and the in-band alert corroborate each other.
• CLOUDFLARED_READY_URL (http://cloudflared:2000/ready from build(compose): read the tunnel token from the environment and expose cloudflared metrics #81) is probed
  each minute; cloudflared_not_ready alerts while the tunnel has no edge
  connection. It does not gate the worker's own ping: the tunnel's dead-man
  is the external HTTP probe.
• Also fixed in passing: the activation-expiry sweep's catch logged but
  never alerted; it now does like the other loops.

bot/index.js

• Pings HEARTBEAT_URL once a minute while the last successful getUpdates is
  within 2x the long-poll window; withholds (and logs) otherwise. The pinned
  status message now says DEGRADED with the age of the last good poll
  instead of UP unconditionally.

Compose maps HEARTBEAT_URL_WORKER / HEARTBEAT_URL_BOT / CLOUDFLARED_READY_URL
from the env file; unset means no pings. docs/deployment.md gains a
Monitoring section: which HTTP probes to configure (readiness, discovery,
optional JWKS), heartbeat periods and grace, and the Cloudflare WAF skip
rule vendor probes may need.

Verified against scratch stores with a fake vendor endpoint (2s interval):
5 pings in 12s while healthy; DB paused -> pings continue for the 30s
tolerance then stop, heartbeat_withheld names webhook_delivery, one deduped
worker_unhealthy alert; DB unpaused -> pings resume within seconds; a closed
tunnel port -> cloudflared_not_ready; bot with a bad token -> zero pings and
one withheld line after its 60s tick. 484 tests pass; 0 edge warnings; both
images build.

Deploy: pick a vendor, create two heartbeat checks (1 min period, 3 min
grace) and put their ping URLs in prod.env as HEARTBEAT_URL_WORKER and
HEARTBEAT_URL_BOT, set CLOUDFLARED_READY_URL=http://cloudflared:2000/ready,
then docker compose up -d --build worker bot, confirm pings arrive, then
add the HTTP probes from the Monitoring section.