Function encrypt_token 

pub fn encrypt_token(plaintext: &str, secret: &str) -> Result<String, AuthError>

Encrypt a plaintext string using AES-256-GCM.

Returns a base64-encoded string of nonce || ciphertext.