Harden auth hook and fix eslint config for intentional unused args

- authHook: use crypto.timingSafeEqual for the bearer token comparison
  instead of !==, avoiding a timing side-channel on the secret key.
- .eslintrc.cjs: add argsIgnorePattern for underscore-prefixed unused
  params, fixing false-positive no-unused-vars errors on intentional
  _ctx/_params placeholders used throughout the LlmTool hierarchy.

.eslintrc.cjs

@@ -6,4 +6,7 @@ module.exports = {
   env: { node: true, es2022: true },
   parserOptions: { ecmaVersion: 2022, sourceType: 'module' },
   ignorePatterns: ['dist', 'node_modules'],
+  rules: {
+    '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
+  },
 };

src/core/server/authHook.ts

@@ -1,5 +1,15 @@
+import { timingSafeEqual } from 'node:crypto';
 import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
 
+function safeEqual(a: string, b: string): boolean {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) {
+    return false;
+  }
+  return timingSafeEqual(bufA, bufB);
+}
+
 export function registerAuthHook(
   app: FastifyInstance,
   secretKey: string,
@@ -12,8 +22,9 @@ export function registerAuthHook(
     }
     const header = request.headers.authorization ?? '';
     const token = header.startsWith('Bearer ') ? header.slice('Bearer '.length) : undefined;
-    if (token !== secretKey) {
+    if (token === undefined || !safeEqual(token, secretKey)) {
       reply.code(401).send({ error: 'unauthorized' });
+      return;
     }
   });
 }