security: harden mock webhook Lambda permissions and API key comparison#169

Draft

Copilot wants to merge 3 commits intomainfrom

copilot/full-security-review-repository

Commits on Apr 29, 2026

Initial plan
Copilot
authored
security: remove overly broad Lambda invoke permission, use timing-safe API key comparison, move esbuild to devDependencies

Copilot
and
RossBugginsNHS
authored
security: improve timing-safe comparison to use hash-based approach for constant-time comparison regardless of key length

Copilot
and
RossBugginsNHS
authored