Use timing-safe comparison for admin token

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app.py

@@ -5,9 +5,9 @@ Pre-loaded workspace, global daily question limit, themed to match appsimple.io.
 
 from __future__ import annotations
 
+import hmac
 import json
 import os
-
 import tempfile
 import time
 from collections.abc import Generator
@@ -513,7 +513,7 @@ def build_app() -> gr.Blocks:
         def check_admin_reset(request: gr.Request):
             token = request.query_params.get("admin", "")
             reset = request.query_params.get("reset", "")
-            if ADMIN_TOKEN and token == ADMIN_TOKEN and reset:
+            if ADMIN_TOKEN and hmac.compare_digest(token, ADMIN_TOKEN) and reset:
                 _reset_counter()
                 print("Admin reset: daily counter cleared")
             return ""