Function compose_source_id 

pub fn compose_source_id(
    client_id_hint: Option<&str>,
    kid_hint: Option<&str>,
) -> String

Compose a Phase 9 (e) compound source key from optional hints.

Free function (not a method) because it is referentially transparent: same inputs → same output, no Self needed. PasJwtVerifier::verify (Phase 9.D) calls this to derive the source_id field from a best-effort token decode; tests use it to construct expected keys without building an AuditEvent first.

Sentinels "anon" (missing client_id) and "nokid" (missing kid) collapse anonymous rejections into a single bucket so attacker- controlled token mangling can’t explode bucket count. The "::" separator is a deliberate choice for grep-friendliness (“all anon::*” surfaces every anonymous bucket as a glob).