pub fn random_token(prefix: &str) -> String
Generate a prefixed 256-bit random token (the full secret returned to the caller once).