fix(auth): add security hardening per code review

- Add timing-safe username comparison to prevent timing attacks
- Regenerate session on login to prevent session fixation
- Add warning log when session secret persistence fails

src/web-server/middleware/auth-middleware.ts

@@ -56,8 +56,9 @@ function getSessionSecret(): string {
       fs.mkdirSync(dir, { recursive: true });
     }
     fs.writeFileSync(SESSION_SECRET_PATH, newSecret, { mode: 0o600 });
-  } catch {
-    // If we can't persist, still return the secret for this session
+  } catch (err) {
+    // Log warning - sessions won't persist across restarts
+    console.warn('[!] Failed to persist session secret:', (err as Error).message);
   }
 
   return newSecret;