fix(node-agent): use timingSafeEqual for token comparison

services/mam-api/src/routes/users.js

@@ -34,7 +34,7 @@ router.post('/', async (req, res, next) => {
       `INSERT INTO users (username, password_hash, display_name, role)
        VALUES ($1, $2, $3, $4)
        RETURNING id, username, display_name, role, created_at`,
-      [username.trim(), hash, display_name || username.trim(), role || 'admin']
+      [username.trim(), hash, display_name || username.trim(), role || 'viewer']
     );
     res.status(201).json(rows[0]);
   } catch (err) {

services/node-agent/index.js

@@ -461,7 +461,15 @@ function checkAgentAuth(req) {
   if (!NODE_TOKEN) return true;
   const hdr = req.headers['authorization'] || '';
   const m = /^Bearer\s+(.+)$/i.exec(hdr);
-  return !!m && m[1] === NODE_TOKEN;
+  if (!m) return false;
+  
+  const token = m[1];
+  if (token.length !== NODE_TOKEN.length) return false;
+  try {
+    return crypto.timingSafeEqual(Buffer.from(token), Buffer.from(NODE_TOKEN));
+  } catch (_) {
+    return false;
+  }
 }
 
 // ── Driver/SDK install ────────────────────────────────────────────────────