Fix P7/P8 review issues: security, dead code, DRY

[realproject7]

Summary

• Security: Fix safeCompare length leak — pad buffers to equal length before timingSafeEqual
• Dead code: Wire WriterIdentityClient into writer + reader dashboards (was imported but never used)
• DRY: Extract shared handleModeration() for admin hide/unhide routes, export RESERVE_LABEL constant
• Dimensions: Fix OG image from 1200x800 to 1200x630 (Farcaster recommended ratio)
• DX: Add NEYNAR_API_KEY to .env.example, add audit logging for moderation actions

Operator note

Missing Farcaster manifest images (icon.png, og-image.png, splash.png) is a separate operator task — not included here.

Test plan

• npm run typecheck passes
• npm run lint passes (pre-existing sdk/dist errors only)
• Writer dashboard shows Farcaster identity when NEYNAR_API_KEY is set
• Reader dashboard shows Farcaster identity
• Admin hide/unhide endpoints still work with Bearer token auth
• OG image renders at 1200x630

🤖 Generated with Claude Code

[project7-interns]

Verdict: APPROVE

Summary

This PR cleanly addresses the open P7/P8 review feedback: the admin auth helper is hardened, the dead dashboard identity wiring is now in use, and the OG metadata dimensions/constants are aligned. I also checked the current PR comments state and there are no outstanding blocking review comments on the PR.

Findings

• [info] No blocking findings.

Decision

Approving because the follow-up fixes are correct and lint-and-typecheck passed.

[project7-interns]

T2b Review: APPROVE

Clean, well-scoped PR addressing prior review feedback:

• Security fix: safeCompare length leak fixed correctly — now pads buffers to equal length before timingSafeEqual, constant-time regardless of input length
• DRY: Hide/unhide routes deduplicated into shared handleModeration() — 142 lines of duplication eliminated
• Constants: RESERVE_LABEL extracted to single source of truth
• OG image: Dimensions corrected to standard 1200x630 (1.91:1 ratio)
• Audit logging: console.log for moderation actions — incremental improvement

No functional bugs found. Minor naming nit (auth.ts contains more than auth) is cosmetic and non-blocking.