security: timing-safe API key comparison, remove hardcoded DB password

- Use hmac.compare_digest for constant-time key check (router.py)
- Move POSTGRES_PASSWORD out of docker-compose.yml into .env (was a
  public default "corvid" now that the repo is public)
- Add .env.example with placeholder values

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,3 @@
+DATABASE_URL=postgresql+asyncpg://corvid:changeme@postgres:5432/corvid
+TICKETS_API_KEY=changeme-use-a-long-random-value
+POSTGRES_PASSWORD=changeme