fix: use constant-time comparison for auth credentials (CWE-208)

[spidershield-contrib]

Summary

Fixes #2863 — replaces timing-vulnerable comparison with constant-time alternative.

Changes

• local-auth.service.ts: Replace === hash comparison with crypto.timingSafeEqual() in comparePassword()
• permission.service.ts: Replace === share password comparison with crypto.timingSafeEqual()
• No behavioral change for valid authentication flows
• Uses stdlib only — no new dependencies

CWE Reference

• CWE-208: Observable Timing Discrepancy

---

Found by SpiderShield security scanner

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}