fix: compare admin api key in constant time

[jamilahmadzai]

Closes #89

Bounty: GrantFox OSS campaign for issue #89

Summary

• Replace the raw ADMIN_API_KEY string equality check with a constant-time comparison over fixed-length SHA-256 digests
• Keep generated API-key validation on its existing hash lookup path
• Add auth tests proving the admin path invokes timingSafeEqual and handles wrong-length guesses without throwing
• Document why the bootstrap admin key uses constant-time comparison

Validation

• npm ci --ignore-scripts --no-audit
• npm test -- test/auth.test.js --runInBand
• npm test -- --runInBand
• rg source scan for remaining raw admin secret comparisons
• git diff --check