Function generate_key 

pub fn generate_key() -> Result<(String, String, String), ApiKeyError>

Generate a fresh API key. Returns (full_token, prefix, hash):

• full_token — {prefix}.{secret} to give to the user
• prefix — 8-char hex prefix for the lookup column
• hash — argon2id hash of the secret for the password column

Errors

ApiKeyError::Hash on argon2 failures (extremely rare).