fix: address code review findings

cmd/api/handlers.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"crypto/hmac"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -433,7 +434,7 @@ func adminAuth(hc *HandlerContext, w http.ResponseWriter, r *http.Request) bool
 		return false
 	}
 	providedAPIKey := r.Header.Get("X-Admin-Api-Key")
-	if providedAPIKey != expectedAPIKey {
+	if !hmac.Equal([]byte(providedAPIKey), []byte(expectedAPIKey)) {
 		http.Error(w, "unauthorized: admin API key required", http.StatusUnauthorized)
 		return false
 	}

cmd/cron/station_status.go

@@ -211,7 +211,7 @@ func ProcessStation(ctx context.Context, monitor *StationMonitor) error {
 	if err != nil {
 		log.Printf("WARNING: failed to check schedule for station %s: %v", monitor.ID, err)
 		// If API fails, don't change the status - keep current
-		return nil
+		return fmt.Errorf("failed to check schedule: %w", err)
 	}
 
 	newStatus, err := monitor.updateStationStatus(ctx, tripCount)