fix: address code review findings

cmd/api/handlers.go

@@ -1,7 +1,7 @@
 package main
 
 import (
-	"crypto/hmac"
+	"crypto/subtle"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -435,7 +435,7 @@ func adminAuth(hc *HandlerContext, w http.ResponseWriter, r *http.Request) bool
 		return false
 	}
 	providedAPIKey := r.Header.Get("X-Admin-Api-Key")
-	if !hmac.Equal([]byte(providedAPIKey), []byte(expectedAPIKey)) {
+	if subtle.ConstantTimeCompare([]byte(providedAPIKey), []byte(expectedAPIKey)) != 1 {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
 		return false
 	}