[Backend] Add cryptographic signature verification to Database Pooler

[DeFiVC]

Closes #759

Changes

• Add HMAC-SHA256 query signing and verification
• Add constant-time signature comparison (timing-safe)
• Add query result hashing for integrity verification
• Gracefully disabled when signing secret not configured

Implementation

• backend/src/lib/db-pooler-optimized.js — signQuery(), verifyQuerySignature(), hashQueryResult()
• backend/src/lib/db-pooler-optimized.test.js — Tests for signing, verification, and hashing

Test Output

All tests pass for signature generation, verification, timing-safe comparison, and result hashing.

Security Notes

• Uses crypto.timingSafeEqual() to prevent timing attacks
• HMAC-SHA256 (NIST-approved algorithm)
• Secret loaded from env var DB_POOLER_SIGNING_SECRET
• Each query signature includes both text and parameters (prevents replay)
• Prometheus metric: db_pooler_signature_verified_total

[vercel]

Someone is attempting to deploy a commit to the Emmanuel's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@DeFiVC Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits