pub fn decode_key(text: &str) -> Result<Vec<u8>, AuthError>
Decodes a URL-safe base64 key string back to bytes.
Returns AuthError::Malformed if the string is not valid base64.
AuthError::Malformed