Overbuild & Scope Creep Diff Review

Structured review — findings first, ranked by severity, each with the
specific failure it causes. Coverage over politeness: I report
everything and let you filter.

BLOCKING
  ▸ auth.middleware.ts:34 — fails OPEN on token-parse error
    catch block logs and calls next(). A malformed token now passes
    the middleware. Auth must fail CLOSED — any error is a 401, not a
    pass-through. This is the finding that makes the PR unmergeable.
    → return res.status(401) in the catch, not next().

SHOULD-FIX
  ▸ :52 — timing-safe comparison missing
    Token compared with ===. Vulnerable to timing analysis. Use a
    constant-time compare (crypto.timingSafeEqual).
  ▸ :67 — no expiry check after signature verify
    Signature is validated; exp is never read. A valid-but-expired
    token is accepted. Verify exp explicitly.

CONSIDER
  ▸ :19 — the refactor moved token extraction into a helper but left
    the old inline path at :44 unreachable. Dead code, delete it.
  ▸ Tests cover the happy path only. No test for: malformed token,
    expired token, missing header. Given the fail-open bug above, the
    missing-malformed-token test is the one that would have caught it.

NON-BLOCKING NITS (listed, not weighted)
  ▸ :28 variable name "t" — spell it out
  ▸ :71 magic number 3600 — name it

WHAT'S GOOD
The extraction into a single validation path is the right structure and
makes the two security fixes above easy to apply in one place. The bones
are correct; it's the failure-mode handling that's wrong.

VERDICT
Block on the fail-open (:34). Everything else can land in a follow-up,
but I'd fix the two security items in the same PR since the code is
already open. Want the fail-closed patch written?