Add OpenTelemetry hooks for observability

[JosephDoUrden]

Summary

Add optional OpenTelemetry instrumentation to provide observability into webhook signing and verification operations.

Context

From PRD.md Future Enhancements: "OpenTelemetry hooks"

Production systems need visibility into webhook verification performance, failure rates, and error types.

Scope

• Add optional OTel spans for signWebhook and verifyWebhook operations
• Record attributes: version, timestamp age, verification result, error type
• Add metrics: verification success/failure counters, latency histograms
• Keep OTel as an optional peer dependency (not required)

Implementation Notes

• Use @opentelemetry/api as an optional peer dependency
• Gracefully degrade when OTel is not installed (no-op)
• Consider a separate export path (e.g. webhook-hmac-kit/otel)
• Follow OTel semantic conventions for HTTP/messaging

Acceptance Criteria

• Spans are created for sign and verify operations
• Error attributes are recorded on verification failures
• Works without OTel installed (no runtime errors)
• Documentation with setup examples