pub fn sha256_bytes(data: &[u8]) -> String
Compute the SHA-256 hex digest of a byte slice (used in tests).