auth: constant-time compare for VHOST and WEBIRC secrets — both used plain == on the config password, unlike oper/RPC/JWT secrets which already route through ct_eq; expose password_hash::ct_eq as the shared comparator and use it (usernames stay plain == — not secret)

src/modules/password_hash.rs

@@ -53,7 +53,8 @@ fn unhex(s: &str) -> Option<Vec<u8>> {
 
 /// Constant-time equality (guards against timing attacks on the compare).
 /// `openssl::memcmp::eq` requires equal-length inputs, so short-circuit first.
-fn ct_eq(a: &[u8], b: &[u8]) -> bool {
+/// Shared comparator for any secret check (passwords, gateway/vhost secrets).
+pub fn ct_eq(a: &[u8], b: &[u8]) -> bool {
     a.len() == b.len() && openssl::memcmp::eq(a, b)
 }