Fix admin-key comparison timing vulnerability by extracting auth logic

[whitezaddy]

Description

Closes #526

This PR addresses the admin-key comparison vulnerability where a plain === operator was incorrectly used, exposing the ADMIN_API_KEY to potential timing side-channel attacks.

Instead of fixing the vulnerable checks individually and leaving duplicated code, we extracted the entire authorization header parsing, admin key verification, and consumer key validation logic into a new centralized helper (src/lib/authHelper.ts).

Changes included:

• Created resolveAuthFromHeaders in src/lib/authHelper.ts to cleanly extract and validate API keys from headers.
• Updated src/middleware/apiKeyAuth.ts and src/graphql/schema.ts to consume the new helper, eliminating the duplicate code across REST and GraphQL implementations.
• Implemented constant-time string comparison (timingSafeCompare) uniformly for the admin key check.
• Added comprehensive unit tests for the new authHelper.ts utility.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update

Testing checklist

• Tests pass locally
• Added new tests (if applicable)
• Code follows project conventions

Screenshots (if applicable)

[drips-wave]

@whitezaddy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[whitezaddy]

Kindly review

[whitezaddy]

Conflicts resolved. Please review.

[whitezaddy]

Conflict resolved