fix: security hardening and performance improvements

Security:
- Add token+secret auth to /setup-webhook and /webhook-info endpoints
- Disable /api/test in production environment (ENVIRONMENT=production)

Performance:
- Add retryWithBackoff to weather-tool (maxRetries: 2)
- Add KV caching to executeLookupDocs (1h TTL)

Code Quality:
- Centralize error messages in src/constants/messages.ts
- Update 5 files to use centralized error constants

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/index.ts

@@ -21,6 +21,16 @@ export default {
         return Response.json({ error: 'WEBHOOK_SECRET not configured' }, { status: 500 });
       }
 
+      // 인증: token + secret 검증
+      const token = url.searchParams.get('token');
+      const secret = url.searchParams.get('secret');
+      if (!token || token !== env.BOT_TOKEN) {
+        return new Response('Unauthorized: Invalid or missing token', { status: 401 });
+      }
+      if (!secret || secret !== env.WEBHOOK_SECRET) {
+        return new Response('Unauthorized: Invalid or missing secret', { status: 401 });
+      }
+
       const webhookUrl = `${url.origin}/webhook`;
       const result = await setWebhook(env.BOT_TOKEN, webhookUrl, env.WEBHOOK_SECRET);
       return Response.json(result);
@@ -31,6 +41,20 @@ export default {
       if (!env.BOT_TOKEN) {
         return Response.json({ error: 'BOT_TOKEN not configured' }, { status: 500 });
       }
+      if (!env.WEBHOOK_SECRET) {
+        return Response.json({ error: 'WEBHOOK_SECRET not configured' }, { status: 500 });
+      }
+
+      // 인증: token + secret 검증
+      const token = url.searchParams.get('token');
+      const secret = url.searchParams.get('secret');
+      if (!token || token !== env.BOT_TOKEN) {
+        return new Response('Unauthorized: Invalid or missing token', { status: 401 });
+      }
+      if (!secret || secret !== env.WEBHOOK_SECRET) {
+        return new Response('Unauthorized: Invalid or missing secret', { status: 401 });
+      }
+
       const result = await getWebhookInfo(env.BOT_TOKEN);
       return Response.json(result);
     }