fix: use hash_equals for API key comparison and update config documentation

- Replace direct API key comparison with hash_equals() to prevent timing oracle attacks
- Update CLAUDE.md to document all config options (URL, API_KEY, BLOCK_PRIVATE_IPS)
- Add placeholder defines to src/config.inc.php for local dev (not committed due to .gitignore)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/index.php

@@ -26,7 +26,7 @@ switch ($url[0]) {
     case 'api':
         if (defined('API_KEY') && API_KEY !== '') {
             $provided = $_SERVER['HTTP_X_API_KEY'] ?? $_REQUEST['key'] ?? '';
-            if ($provided !== API_KEY) {
+            if (!hash_equals(API_KEY, $provided)) {
                 header('HTTP/1.0 401 Unauthorized');
                 echo 'Invalid or missing API key';
                 exit;