fix: critical security improvements

- Apply optimistic locking to deposit-matcher.ts (race condition fix)
- Add timing-safe comparison for API key validation
- Move admin IDs from wrangler.toml vars to secrets
- Add .env.example for secure credential management

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/routes/api.ts

@@ -10,6 +10,7 @@ import { handleCommand } from '../commands';
 import { openaiCircuitBreaker } from '../openai-service';
 import { createLogger } from '../utils/logger';
 import { toError } from '../utils/error';
+import { timingSafeEqual } from '../security';
 
 const logger = createLogger('api');
 
@@ -34,13 +35,13 @@ const ContactFormBodySchema = z.object({
 });
 
 /**
- * API Key 인증 검증
+ * API Key 인증 검증 (Timing-safe comparison으로 타이밍 공격 방지)
  * @returns 인증 실패 시 Response, 성공 시 null
  */
 function requireApiKey(request: Request, env: Env): Response | null {
   const apiSecret = env.DEPOSIT_API_SECRET;
   const authHeader = request.headers.get('X-API-Key');
-  if (!apiSecret || authHeader !== apiSecret) {
+  if (!apiSecret || !timingSafeEqual(authHeader, apiSecret)) {
     return Response.json({ error: 'Unauthorized' }, { status: 401 });
   }
   return null;