fix: harden device pairing token generation and verification (#16535)

Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: bcbb50e368
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras

src/infra/pairing-token.ts

@@ -0,0 +1,12 @@
+import { randomBytes } from "node:crypto";
+import { safeEqualSecret } from "../security/secret-equal.js";
+
+export const PAIRING_TOKEN_BYTES = 32;
+
+export function generatePairingToken(): string {
+  return randomBytes(PAIRING_TOKEN_BYTES).toString("base64url");
+}
+
+export function verifyPairingToken(provided: string, expected: string): boolean {
+  return safeEqualSecret(provided, expected);
+}