feat(web-auth): case-insensitive username match
Typing CEO (uppercase) returned 401 because the env var stores 'ceo'. Username now case-insensitive; password stays case-sensitive and constant-time.
Typing CEO (uppercase) returned 401 because the env var stores 'ceo'. Username now case-insensitive; password stays case-sensitive and constant-time.