Implement blake3 cryptographic hash verification for query string

[FireMasterK]

No description provided.

[sweep-ai]

Apply Sweep Rules to your PR?

• Apply: All new business logic should have corresponding unit tests.
• Apply: Refactor large functions to be more modular.
• Apply: Add docstrings to all functions and file headers.

[RealOrangeOne]

Is there a reason this isn't a constant-time comparison? In an async context it's harder to predict what the CPU is doing, but it's still good practice from a security perspective.

[FireMasterK]

This is a very small concern in this case, the query hash verification is mainly to prevent bad actors from crafting specialized URLs. (Usually bots) This is also why we only use the first 8 characters, too.