Function b64_encode 

pub fn b64_encode(bytes: &[u8]) -> String

Encode bytes as URL-safe base64 (no padding). Local helper so the crate does not pull in the base64 crate for one signature field.