fix(websub): require feed existence for subscriptions, remove atom hub header, simplify router mounting

- Add KV feed existence check in hub.ts to prevent SSRF via non-existent feeds (returns 404)
- Treat empty string hub.secret as absent (|| instead of ??)
- Remove misleading hub Link header from atom.ts (hub only supports RSS topics)
- Simplify double-layered hub router in index.ts (direct app.route instead of nested Hono)
- Update hub.test.ts to seed KV with feed config for tests requiring valid subscribe/unsubscribe

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

src/routes/hub.ts

@@ -80,7 +80,16 @@ hubRouter.post("/", async (c) => {
   }
   const feedId = match[1];
 
-  const secret = form.get("hub.secret") ?? undefined;
+  // Verify the feed exists before accepting any subscription
+  const feedConfig = await env.EMAIL_STORAGE.get(
+    `feed:${feedId}:config`,
+    "json",
+  );
+  if (!feedConfig) {
+    return c.text("Not Found: feed does not exist", 404);
+  }
+
+  const secret = form.get("hub.secret") || undefined; // "" → undefined
   if (secret && secret.length > 200) {
     return c.text("Bad Request: hub.secret must be under 200 bytes", 400);
   }