Session 45: support email, audit fixes (template validation, content-type, admin auth, waitUntil)

- Added support@docfast.dev to footer, impressum, terms, landing page, openapi.json
- Fixed audit #6: Template render validates required fields (400 on missing)
- Fixed audit #7: Content-Type check on markdown/URL routes (415)
- Fixed audit #11: /v1/usage and /v1/concurrency now require ADMIN_API_KEY
- Fixed audit Critical #3: URL convert uses domcontentloaded instead of networkidle0

dist/services/verification.js

@@ -1,4 +1,4 @@
-import { randomBytes, randomInt } from "crypto";
+import { randomBytes, randomInt, timingSafeEqual } from "crypto";
 import logger from "./logger.js";
 import pool from "./db.js";
 const TOKEN_EXPIRY_MS = 24 * 60 * 60 * 1000;
@@ -87,7 +87,10 @@ export async function verifyCode(email, code) {
         return { status: "max_attempts" };
     }
     await pool.query("UPDATE pending_verifications SET attempts = attempts + 1 WHERE email = $1", [cleanEmail]);
-    if (pending.code !== code) {
+    const a = Buffer.from(pending.code, "utf8");
+    const b = Buffer.from(code, "utf8");
+    const codeMatch = a.length === b.length && timingSafeEqual(a, b);
+    if (!codeMatch) {
         return { status: "invalid" };
     }
     await pool.query("DELETE FROM pending_verifications WHERE email = $1", [cleanEmail]);