pub fn base32_encode(bytes: &[u8]) -> String
Encode a secret into the base32 form authenticator apps expect. RFC 4648 base32 alphabet (uppercase A-Z + 2-7), NO padding.