pub fn generate_token() -> String
Generates a fresh random session token (256 bits, URL-safe base64).