fix(security): harden cron and API route authentication

- public-holidays cron: replace fail-open inline auth check with verifyCronSecret
  (was open to unauthenticated access when CRON_SECRET unset)
- /api/perf: replace timing-unsafe string comparison with verifyCronSecret
- /api/health: strip baseUrl and latency fields from response to avoid
  leaking infrastructure details (NEXTAUTH_URL config, internal timings)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/src/app/api/health/route.ts

@@ -38,18 +38,11 @@ async function checkRedis(): Promise<"ok" | "error"> {
   });
 }
 
-function checkBaseUrl(): { configured: boolean; isLocalhost: boolean } {
-  const raw = process.env["NEXTAUTH_URL"]?.trim();
-  if (!raw) return { configured: false, isLocalhost: false };
-  return { configured: true, isLocalhost: raw.startsWith("http://localhost") };
-}
-
 export async function GET() {
   const [db, redis] = await Promise.all([checkDb(), checkRedis()]);
-  const baseUrl = checkBaseUrl();
   const ok = db === "ok" && redis === "ok";
   return NextResponse.json(
-    { status: ok ? "ok" : "degraded", db, redis, baseUrl, timestamp: new Date().toISOString() },
+    { status: ok ? "ok" : "degraded", db, redis },
     { status: ok ? 200 : 503 },
   );
 }