fix: use timing-safe comparison for CLI API token validation (#9)

* fix: use timing-safe comparison for CLI API token validation

Replace direct string comparison (===) with constant-time comparison
using crypto.timingSafeEqual to prevent timing attacks that could
leak information about the token character by character.

Affected locations:
- server/src/web/routes/auth.ts (accessToken validation)
- server/src/web/routes/cli.ts (bearer token middleware)
- server/src/socket/server.ts (socket.io /cli namespace auth)

* Update server/src/utils/crypto.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

server/src/web/routes/auth.ts

@@ -2,6 +2,7 @@ import { Hono } from 'hono'
 import { SignJWT } from 'jose'
 import { z } from 'zod'
 import { configuration } from '../../configuration'
+import { safeCompareStrings } from '../../utils/crypto'
 import { validateTelegramInitData } from '../telegramInitData'
 import { getOrCreateOwnerId } from '../ownerId'
 import type { WebAppEnv } from '../middleware/auth'
@@ -33,7 +34,7 @@ export function createAuthRoutes(jwtSecret: Uint8Array): Hono<WebAppEnv> {
 
         // Access Token authentication (CLI_API_TOKEN)
         if ('accessToken' in parsed.data) {
-            if (parsed.data.accessToken !== configuration.cliApiToken) {
+            if (!safeCompareStrings(parsed.data.accessToken, configuration.cliApiToken)) {
                 return c.json({ error: 'Invalid access token' }, 401)
             }
             userId = await getOrCreateOwnerId()