fix(auth): validate JWT secret length, equalize login timing, reduce TTL to 24h

crates/application/src/use_cases/auth.rs

@@ -64,10 +64,15 @@ pub async fn login(
     input: LoginInput,
 ) -> Result<LoginOutput, DomainError> {
     let email = Email::new(input.email)?;
-    let user = users
-        .find_by_email(&email)
-        .await?
-        .ok_or(DomainError::Unauthorized)?;
+    let user = users.find_by_email(&email).await?;
+    if user.is_none() {
+        // Timing equalization — prevents email enumeration via response-time oracle.
+        // Running the hasher on a miss makes "no such user" take the same time as
+        // "wrong password", so attackers cannot distinguish the two cases.
+        let _ = hasher.hash(&input.password).await;
+        return Err(DomainError::Unauthorized);
+    }
+    let user = user.unwrap();
     if !hasher.verify(&input.password, &user.password_hash).await? {
         return Err(DomainError::Unauthorized);
     }