fix: use timing-safe comparison for daemon bearer tokens

- Use timing-safe daemon bearer-token comparison for local v1 authorization.
- Add unit coverage for accepted and rejected token candidates.
- Add maintainer changelog entry thanking @ejames-dev.

Proof:
- pnpm test tests/daemon.config.test.ts
- pnpm -s check

Co-authored-by: Evan Newman <evanjames010101@gmail.com>