security: timing-safe API key comparison, remove hardcoded DB password

- Use hmac.compare_digest for constant-time key check (router.py)
- Move POSTGRES_PASSWORD out of docker-compose.yml into .env (was a
  public default "corvid" now that the repo is public)
- Add .env.example with placeholder values

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -1,9 +1,10 @@
 services:
   postgres:
     image: postgres:16-alpine
+    env_file:
+      - .env
     environment:
       POSTGRES_USER:     corvid
-      POSTGRES_PASSWORD: corvid
       POSTGRES_DB:       corvid
     volumes:
       - pgdata:/var/lib/postgresql/data