fix: use constant-time comparison for relayer API keys - #224

Holding this one rather than closing it, because the situation is unusual and worth a maintainer call.

Issue #202 has no GrantFox assignee — no assignee set, and no assignment comment from the campaign bot. Our normal rule is to close PRs for unassigned issues, since merging them can take a payout from whoever was actually assigned. Here there's nobody to displace, and the work itself looks correct, so closing seemed like the wrong outcome.

@N-thnI — could you either assign @Judah5808 to #202 so this can merge and be paid properly, or say if it should go to someone else?

One piece of context worth knowing: PR #223 found that RelayerAuth was never actually reachable, because main.ts constructed the syncer with authentication disabled entirely. So the timing side-channel #202 describes was in dead code. #223 wires auth on — which makes this fix genuinely load-bearing rather than theoretical. Worth landing, just with the assignment sorted first.

Thank you

Merged — thanks for the contribution! If you've got a moment, a rating on GrantFox helps the project.