fix(worker-auth): unify token checks and bind job environment

packages/backend/convex/workerAuth.ts

@@ -0,0 +1,11 @@
+import { ConvexError } from 'convex/values';
+
+export const assertWorkerToken = (provided: string): void => {
+  const expected = process.env.SPOON_WORKER_TOKEN?.trim();
+  if (!expected) {
+    throw new ConvexError('SPOON_WORKER_TOKEN is not configured.');
+  }
+  if (provided.trim() !== expected) {
+    throw new ConvexError('Invalid worker token.');
+  }
+};