pub fn token_hash(token_hex: &str) -> Result<[u8; 32], TokenError>
Compute SHA-256 of the token bytes. Used as the stable identity for state-machine tracking (never stores the raw token).