Fix timing attack vulnerability in API key verification

[Hallab7]

Description

ApiKeyService.verifySecret() performs regex validation before timing-safe comparison, allowing timing attacks to determine valid hash format.

Move format validation after timing-safe comparison or make the entire verification flow constant-time.

Acceptance criteria

• Secret verification is constant-time for all inputs
• Format validation does not short-circuit before comparison
• Tests verify timing consistency across valid/invalid inputs
• Security comment documents the constant-time requirement

Testing requirements

• Add test verifying similar execution time for valid/invalid secrets
• Code review confirms no timing leak paths
• npm run test passes

Files

src/api-keys/api-key.service.ts, src/api-keys/api-key.service.spec.ts

Suggested branch

fix/api-key-timing-attack

Suggested commit message

fix(security): prevent timing attack in API key verification