Fix timing attack vulnerability in token verification

Replaced insecure string comparison with `secrets.compare_digest` in `_check_token` to prevent timing attacks.
Added a test case for missing token to ensure robust error handling.

Co-authored-by: PR0M3TH3AN <[email protected]>

src/tests/test_api.py

@@ -65,6 +65,16 @@ def test_invalid_token(client):
     assert res.status_code == 401
 
 
+def test_missing_token(client):
+    cl, _token = client
+    # No Authorization header
+    res = cl.get(
+        "/api/v1/entry",
+        params={"query": "s"},
+    )
+    assert res.status_code == 401
+
+
 def test_get_entry_by_id(client):
     cl, token = client
     headers = {