fix: use constant-time comparison for bearer token validation (#8)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/dependencies.py

@@ -1,4 +1,5 @@
 import datetime
+import hmac
 import logging
 import os
 
@@ -39,7 +40,7 @@ if os.environ.get("TESTING") == "True":
 
 
 def valid_token(token):
-    return token == AUTH_TOKEN
+    return hmac.compare_digest(token, AUTH_TOKEN)
 
 
 def int_timestamp(datetime_obj: datetime) -> int: