SUM-SEC-18 [P2][18/20][Low] Constant-time setup token compare

[CHINMAYVIVEK]

ID: SUM-SEC-18
Wave: P2
Severity: Low
Labels: security, setup, P2, low
Branch: fix/SUM-SEC-18-setup-token-constant-time
Languages: Go
Depends on: SUM-SEC-03
CWE: CWE-208

Summary

validateSetupToken uses == on strings. When setup is exposed with a shared secret, timing leaks are mitigated only weakly by rate limits.

Acceptance criteria

• Compare via subtle.ConstantTimeCompare on equal-length digests (hash both sides if lengths differ)
• Test with matching / mismatching tokens

Files to check / change

• sumeru/core/server/web/setup_security.go (~L47–62)