pub fn token_device_label(token: &str) -> Option<String>Expand description
Convenience: reads the device_label from an unverified token payload.
Used by the companion to label the persisted session file without needing
the HMAC secret (the daemon verifies the signature on its side).