Function generate_device_token 

pub fn generate_device_token() -> String

Generate a fresh, cryptographically-random per-device Bearer token (256 bits, hex-encoded). The raw token is returned to the app exactly once (in PairResponse); only its hash is persisted (see DeviceStore).