list-stats — read-only subscriber counts.
GET /counts  (HMAC-signed; see README.md).