feat(security): Critical "Gas Vampire" Fix & Zero-Trust Admin Auth

[AndriiEagle]

Security Hardening: "Gas Vampire" Mitigation

This PR implements a Zero-Trust security architecture for the DRAIN Provider admin endpoints, addressing the critical vulnerability.

Key Deliverables (Tier-1 Security Standards)

1. Zero-Trust Middleware:

   • Fail-Safe implementation: Server refuses to start without a strong ADMIN_KEY (min 32 chars).
   • All /v1/admin/* routes are protected by default.

2. Timing-Attack Protection:

   • Implemented crypto.timingSafeEqual for constant-time key comparison.
   • Mitigates statistical analysis attacks on key validation.

3. Forensics & Observability:

   • Gap Closed: Enhanced logging captures IP address, User-Agent, and Request Path for all unauthorized attempts.
   • Verified local build & manual stress tests passed (200 OK on valid key, 401 on attacks).

Verification

See Audit.md included in this PR for the full AI security audit log and verification guide.

cc: @ArthurMarkus