- authHook: use crypto.timingSafeEqual for the bearer token comparison
instead of !==, avoiding a timing side-channel on the secret key.
- .eslintrc.cjs: add argsIgnorePattern for underscore-prefixed unused
params, fixing false-positive no-unused-vars errors on intentional
_ctx/_params placeholders used throughout the LlmTool hierarchy.