security: timing-safe API key comparison, remove hardcoded DB password

- Use hmac.compare_digest for constant-time key check (router.py)
- Move POSTGRES_PASSWORD out of docker-compose.yml into .env (was a
  public default "corvid" now that the repo is public)
- Add .env.example with placeholder values

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,3 @@
+DATABASE_URL=postgresql+asyncpg://corvid:changeme@postgres:5432/corvid
+TICKETS_API_KEY=changeme-use-a-long-random-value
+POSTGRES_PASSWORD=changeme

corvid/router.py

@@ -1,3 +1,4 @@
+import hmac
 import uuid
 
 from fastapi import APIRouter, Depends, Header, HTTPException, Query, Request
@@ -101,7 +102,9 @@ def make_router(api_key: str, get_db, require_user=None) -> APIRouter:
     router = APIRouter()
 
     def _api_key_ok(x_api_key: str | None) -> bool:
-        return bool(api_key and x_api_key == api_key)
+        if not api_key or not x_api_key:
+            return False
+        return hmac.compare_digest(x_api_key, api_key)
 
     def require_ticket_auth(
         request: Request,

docker-compose.yml

@@ -1,9 +1,10 @@
 services:
   postgres:
     image: postgres:16-alpine
+    env_file:
+      - .env
     environment:
       POSTGRES_USER:     corvid
-      POSTGRES_PASSWORD: corvid
       POSTGRES_DB:       corvid
     volumes:
       - pgdata:/var/lib/postgresql/data