pub fn generate_ephemeral_keypair() -> (String, String)
Generate an ephemeral X25519 keypair for ECDH key exchange. Returns (private_key_b64, public_key_b64).