pub fn derive_auth_token(master_key: &[u8]) -> FsResult<[u8; 32]>Expand description
Derive a 32-byte auth token from a master key using HKDF-SHA256.
The token is derived with a distinct info string ("server-auth-token"),
making it cryptographically independent of the encryption key derived by
ChaChaEngine::new. The server stores BLAKE3(token) and never learns
the encryption key.