fix: use hash_equals for API key comparison and update config documentation

- Replace direct API key comparison with hash_equals() to prevent timing oracle attacks
- Update CLAUDE.md to document all config options (URL, API_KEY, BLOCK_PRIVATE_IPS)
- Add placeholder defines to src/config.inc.php for local dev (not committed due to .gitignore)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -41,7 +41,7 @@ php -S localhost:8080 -t web/
 | `web/index.php` | API + template router |
 | `src/http2pic.class.php` | Legacy wkhtmltoimage renderer |
 | `src/helpers.php` | Template render, logging, IP helper |
-| `src/config.inc.php` | Runtime config (URL) |
+| `src/config.inc.php` | Runtime config (URL, API_KEY, BLOCK_PRIVATE_IPS) |
 | `docker/Caddyfile` | Reverse proxy, PHP-FPM, file server |
 | `docker/start.sh` | Boots PHP-FPM, ChromeDriver, writes config |
 | `docker-compose.yml` | Production compose |

web/index.php

@@ -26,7 +26,7 @@ switch ($url[0]) {
     case 'api':
         if (defined('API_KEY') && API_KEY !== '') {
             $provided = $_SERVER['HTTP_X_API_KEY'] ?? $_REQUEST['key'] ?? '';
-            if ($provided !== API_KEY) {
+            if (!hash_equals(API_KEY, $provided)) {
                 header('HTTP/1.0 401 Unauthorized');
                 echo 'Invalid or missing API key';
                 exit;