feat(auth): add local login and CSRF-protected sessions

backend/src/auth/csrf.ts

@@ -0,0 +1,13 @@
+import { timingSafeEqual } from "node:crypto";
+import { deriveCsrfToken as deriveStoredCsrfToken } from "./session-store.js";
+
+export { deriveStoredCsrfToken as deriveCsrfToken };
+
+/** Compare a client-supplied CSRF value without exposing a useful length timing oracle. */
+export function csrfTokensEqual(expectedToken: string, suppliedToken: string | undefined): boolean {
+  const expected = Buffer.from(expectedToken, "utf8");
+  const supplied = Buffer.from(suppliedToken ?? "", "utf8");
+  const padded = Buffer.alloc(expected.length);
+  supplied.copy(padded, 0, 0, expected.length);
+  return timingSafeEqual(expected, padded) && supplied.length === expected.length;
+}