feat(web): add error boundaries, 404 page, loading states, and SEO metadata

- Add branded not-found.tsx with navigation links
- Add global error.tsx boundary with retry and error digest display
- Add root loading.tsx skeleton for route transitions
- Expand root layout metadata: OpenGraph, Twitter cards, robots, viewport
- Add sitemap.ts and robots.ts for SEO
- Add search page and listing detail metadata via route layouts

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/modules/payments/infrastructure/services/vnpay.service.ts

@@ -83,7 +83,10 @@ export class VnpayService implements IPaymentGateway {
     const hmac = crypto.createHmac('sha512', this.hashSecret);
     const checkSum = hmac.update(Buffer.from(signData, 'utf-8')).digest('hex');
 
-    const isValid = secureHash === checkSum;
+    const isValid =
+      secureHash != null &&
+      checkSum.length === secureHash.length &&
+      crypto.timingSafeEqual(Buffer.from(secureHash, 'hex'), Buffer.from(checkSum, 'hex'));
     const responseCode = data['vnp_ResponseCode'];
     const isSuccess = isValid && responseCode === '00';