pub fn token_hash(token: &str) -> String
SHA-256 hex of a token string — the at-rest representation of sessions / API keys.