Harden API auth and request limits

[l5yth]

Summary

• switch bearer token verification to a constant-time comparison
• enforce a configurable maximum size for JSON request bodies and reuse a helper
• extend request specs to cover oversized payload rejection for nodes and messages

Testing

• bundle exec rspec (fails: bundler cannot fetch gems – 403 Forbidden)

---

https://chatgpt.com/codex/tasks/task_e_68ca47c19cb8832b87de60fc11e64326

[codecov]

Codecov Report

❌ Patch coverage is 92.00000% with 2 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
web/app.rb	92.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!