pub fn pair_proof(token: &[u8], transcript: &[u8]) -> [u8; 32]
HMAC-SHA256(token, transcript) — full 256-bit output, never truncated.