Function verify_token 

pub fn verify_token(
    token: &str,
    secret: &[u8],
) -> Result<TokenPayload, TokenError>

Verify and decode a token string.

Uses constant-time comparison for the signature to prevent timing attacks.