fix: use constant-time comparison for relayer API keys

[Judah5808]

Summary

Fixes the relayer authentication API-key comparison to avoid
non-constant-time Set.has() string matching.

Changes

• Replace Set<string>.has() API-key validation with
  crypto.timingSafeEqual().
• Compare only equal-length buffers before calling timingSafeEqual.
• Preserve the existing API-key authentication behavior and
  unauthorized response.

Verification

• npm test — 13 suites passed, 86 tests passed
• npm run build — passed
• git diff --check — clean

Fixes #202

[N-thnI]

Holding this one rather than closing it, because the situation is unusual and worth a maintainer call.

Issue #202 has no GrantFox assignee — no assignee set, and no assignment comment from the campaign bot. Our normal rule is to close PRs for unassigned issues, since merging them can take a payout from whoever was actually assigned. Here there's nobody to displace, and the work itself looks correct, so closing seemed like the wrong outcome.

@N-thnI — could you either assign @Judah5808 to #202 so this can merge and be paid properly, or say if it should go to someone else?

One piece of context worth knowing: PR #223 found that RelayerAuth was never actually reachable, because main.ts constructed the syncer with authentication disabled entirely. So the timing side-channel #202 describes was in dead code. #223 wires auth on — which makes this fix genuinely load-bearing rather than theoretical. Worth landing, just with the assignment sorted first.

[Judah5808]

Thank you

[N-thnI]

Merged — thanks for the contribution! If you've got a moment, a rating on GrantFox helps the project.