🛡️ Sentinel: [CRITICAL] Fix timing attack and information disclosure vulnerabilities

[ivanleekk]

🚨 Severity: CRITICAL
💡 Vulnerability:

1. Timing Attack: The verify_scheduler_secret dependency used the != operator to compare a sensitive secret token, which could allow an attacker to guess the token through a timing attack.
2. Information Disclosure: The daily snapshot endpoint caught broad exceptions and returned str(e) in the detail response of a 500 status code, exposing internal server state and errors to the client.

🎯 Impact:

1. An attacker could potentially bypass the scheduler authentication by measuring response times to reconstruct the secret token character by character.
2. An attacker could intentionally trigger an error to leak stack traces, database schema details, or other sensitive runtime information.

🔧 Fix:

1. Replaced the insecure != operator with secrets.compare_digest for constant-time comparison, ensuring x_scheduler_secret is not None before comparison.
2. Caught broad exceptions securely by returning a generic error message ("An internal server error occurred while processing the daily snapshot.") instead of the raw exception value.

✅ Verification:
Verified that all modified code passes ruff check and pytest without regressions. Documented the learning in .jules/sentinel.md.

---

PR created automatically by Jules for task 10651909993743263293 started by @ivanleekk

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.