pub fn generate_token() -> Res<String>
Mints a fresh, opaque invite token: 24 bytes of OS entropy, URL-safe base64 (DESIGN.md §6).
Returns an error if the OS random source cannot be read.