security: metrics endpoint uses non-timing-safe password comparison

Problem

The /metrics endpoint in packages/auth-service/src/index.ts:96 compares the admin password using !== (standard string comparison):

```ts
authHeader !== 'Basic ' + Buffer.from('admin:' + adminPassword).toString('base64')
```

This is a timing oracle — the comparison short-circuits on the first differing byte, leaking information about the expected value through response timing.

The rest of the codebase consistently uses crypto.timingSafeEqual() for secret comparisons (CSRF tokens, HMAC signatures, etc.), so this is an inconsistency.

Proposed Fix

Use crypto.timingSafeEqual() for the Basic Auth comparison, with a length check guard:

```ts
const expected = 'Basic ' + Buffer.from('admin:' + adminPassword).toString('base64')
const actual = authHeader ?? ''
if (actual.length !== expected.length ||
!crypto.timingSafeEqual(Buffer.from(actual), Buffer.from(expected))) {
res.status(401).json({ error: 'Unauthorized' })
return
}
```

Severity

Very low — exploiting a timing oracle on a Basic Auth header over a network is impractical, but fixing it is trivial and maintains consistency with the rest of the codebase.

Open packages/auth-service/src/index.ts around line 96 and inspect the existing crypto.timingSafeEqual usage elsewhere in the repository. Update the metrics Basic Auth comparison with a length guard, then verify that valid credentials succeed and mismatched headers, including different-length values, return 401.