feat(web): add error boundaries, 404 page, loading states, and SEO metadata

- Add branded not-found.tsx with navigation links
- Add global error.tsx boundary with retry and error digest display
- Add root loading.tsx skeleton for route transitions
- Expand root layout metadata: OpenGraph, Twitter cards, robots, viewport
- Add sitemap.ts and robots.ts for SEO
- Add search page and listing detail metadata via route layouts

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/modules/payments/infrastructure/services/zalopay.service.ts

@@ -104,7 +104,10 @@ export class ZalopayService implements IPaymentGateway {
       .update(dataStr)
       .digest('hex');
 
-    const isValid = reqMac === mac;
+    const isValid =
+      reqMac.length > 0 &&
+      reqMac.length === mac.length &&
+      crypto.timingSafeEqual(Buffer.from(reqMac, 'hex'), Buffer.from(mac, 'hex'));
 
     let parsedData: Record<string, unknown> = {};
     let orderId = '';