fix: use timing-safe compare for cron secret

[opastorello]

Summary

Use timing-safe string comparison for cron secret validation to prevent timing attacks.

What changed

File: src/app/api/automations/cron/route.ts

• Import timingSafeEqual from node:crypto
• Replace simple string equality with constant-time comparison
• Match the pattern already used in flows cron endpoint

Why

Simple string comparison leaks timing information — an attacker with network access could measure response latency and recover AUTOMATION_CRON_SECRET byte-by-byte.

Test plan

• typecheck + lint clean
• Pattern matches flows cron implementation