pub fn generate_device_keypair() -> (String, String)
Generate a static X25519 keypair for the device’s long-lived identity used in encrypted key-exchange bundles. Returns (private_b64, public_b64).