fix(auth): use timing-safe compares for sidecar token checks

[tynamite]

Summary

Use timingSafeEqualString for COVEN_CAVE_AUTH_TOKEN checks in the REST proxy and isLocalOrigin, matching the PTY upgrade path's constant-time compares.

Why

Sidecar token equality used plain === / !== while mobile and PTY auth already use timing-safe compares. This keeps auth checks consistent across surfaces and slightly harder to probe by timing.

Changes

• src/proxy.ts: shared sidecarTokenMatches helper (early returns + timingSafeEqualString) for header CSRF trust and sidecar authentication
• src/lib/server/local-origin.ts: timing-safe packaged sidecar header check
• Tests updated in middleware.test.ts and local-origin.test.ts

Verification

node --experimental-strip-types src/lib/server/local-origin.test.ts
node --experimental-strip-types src/middleware.test.ts
node --experimental-strip-types src/proxy-behavior.test.ts

Codex review on the fork PR: no major issues (chatgpt-codex-connector[bot] on a35fa211fa).

Risk + rollout notes

Low risk, behavior-preserving. Token accept/reject outcomes are unchanged for correct and incorrect secrets. No migration or release-note requirement.

[Copilot]

Pull request overview

This PR hardens sidecar token equality checks by switching REST proxy and isLocalOrigin comparisons to timingSafeEqualString, aligning token verification behavior with other constant-time auth checks in the codebase.

Changes:

• Added a shared sidecarTokenMatches() helper in src/proxy.ts and used it for both header-CSRF trust and sidecar authentication comparisons.
• Updated isLocalOrigin to use timingSafeEqualString for packaged sidecar header checks.
• Adjusted tests to assert the timing-safe matcher is used in both locations.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/proxy.ts	Replaces direct === token checks with a shared sidecarTokenMatches() helper that uses timingSafeEqualString.
src/middleware.test.ts	Updates source-level assertions to ensure the proxy uses the timing-safe matcher and shared helper.
src/lib/server/local-origin.ts	Switches sidecar header validation to timingSafeEqualString for packaged/local-route gating.
src/lib/server/local-origin.test.ts	Adds a source-level assertion that the timing-safe compare is present in isLocalOrigin.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.