Harden parsing and curl escaping

[ELF-Nigel]

• curl_easy_escape results are now freed safely to prevent leaks (auth.cpp).
• VerifyPayload now handles invalid timestamps defensively (still fails closed).
• safer substring extraction in get_str_between_two_str to avoid out‑of‑range when delimiters are missing.
• utils::string_to_timet now validates parse failure.
• minor loop safety in auth.hpp (size‑safe index and no copies).

[github-actions]

The KeyAuth owner has been notified of your pull request. Please wait for him to review it. This could take several days.