Module tokens 

Long-lived bearer-token store.

Closes audit findings HC-01 and HC-02 by replacing the “any non-empty bearer” P1 placeholder with a real token whitelist.

P2 scope (this commit):

• Token set held in memory; populated at boot from env / config / programmatic registration
• O(1) is_valid(&str) -> bool lookup via HashSet
• No expiry, no rotation, no per-user attribution yet — P3

Boot-time provisioning paths supported:

• HOMECORE_TOKENS env var: comma-separated bearer tokens
• LongLivedTokenStore::register(token) for programmatic insert

Provided constructors:

• LongLivedTokenStore::empty() → no tokens accepted (use after boot to add tokens manually)
• LongLivedTokenStore::from_env() → reads HOMECORE_TOKENS, splits on commas, trims, drops empties
• LongLivedTokenStore::allow_any_non_empty() → DEV ONLY; preserves the legacy “accept anything non-empty” behaviour for users who haven’t migrated yet. Emits a warning on every call. Removed in P3.

Structs

LongLivedTokenStore