pub fn generate_token() -> String
Generate a secure random token (for refresh tokens). Returns hex-encoded.