fix(cookies): use constant-time comparison for signature verification

[LeeCheneler]

Summary

• Replace naive string comparison (===) with @std/crypto timingSafeEqual() to prevent timing attacks
• Add documentation explaining why constant-time comparison is necessary
• The previous implementation returned early on first mismatched character, allowing attackers to measure response times and incrementally guess signatures

Security Impact

Vulnerability: Timing attack on cookie signature verification

Severity: Medium - requires network-level timing measurements, but feasible with statistical analysis

Fix: Use constant-time comparison that takes the same amount of time regardless of where the mismatch occurs

Changes

// Before (vulnerable)
return signature === expectedSignature;

// After (secure)
return timingSafeEqual(a, b);

Test plan

• All existing cookie tests pass (22 tests)
• Signed cookie verification works correctly
• Invalid signatures still rejected

🤖 Generated with Claude Code