fix(verify): reject a zero-length signing key instead of throwing

[TheGreatAxios]

An empty standard-webhooks secret ("" or whsec_) or an empty Slack secret made WebCrypto throw on a zero-length HMAC key, so the hook answered 500 instead of 401.

Changes

• verifyStandardWebhooks skips zero-length keys and verifySlack rejects an empty secret, so both return false (401).
• Tests (each fails before the fix): "" and whsec_ under standard-webhooks, and an empty Slack secret.
• README: an unprefixed secret that is valid base64 is tried decoded first, then raw; an empty secret never verifies; a crash between claiming a replay key and forwarding holds the key until it expires with its timestamp window.

Checks

bun run check, bun run build and the Node pack smoke pass locally; test:e2e needs Postgres and runs in CI.

Closes CL-9457