fix: konstante Zeit fuer API-Key-Vergleich, Auth-Tests erweitert

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

finance/app/auth.py

@@ -46,7 +46,7 @@ def session_valid(token: str | None) -> bool:
 def require_auth(request: Request) -> None:
     settings = get_settings()
     header = request.headers.get("authorization", "")
-    if settings.api_key and header == f"Bearer {settings.api_key}":
+    if settings.api_key and hmac.compare_digest(header, f"Bearer {settings.api_key}"):
         return
     if session_valid(request.cookies.get(COOKIE)):
         return