fix(security): use hmac.compare_digest for API key comparison to prevent timing attacks

[memosr]

What does this PR do?

The API server validated Bearer tokens using Python's == operator:

# Before (vulnerable)
if token == self._api_key:

String equality with == is not constant-time — it short-circuits on
the first mismatched character. An attacker can measure response times
to determine how many characters of their guess match the real key,
eventually recovering it character by character (timing attack).

Fix

Replaced with hmac.compare_digest() which always takes the same time
regardless of where the strings differ:

# After (safe)
if hmac.compare_digest(token, self._api_key):

Type of Change

• 🔒 Security fix (timing attack)

Checklist

• Read the Contributing Guide
• Commit messages follow Conventional Commits
• hmac is Python standard library — no new dependencies
• No behavior change for valid or invalid tokens

[teknium1]

Merged via #5944 as part of a consolidated security hardening PR. Your hmac.compare_digest fix was applied as-is — clean 2-line improvement. Thanks @memosr!