Function generate_token 

pub fn generate_token(
    policies: Vec<String>,
    ttl_seconds: Option<i64>,
) -> (String, TokenEntry)

Generates a fresh opaque bearer token. Returns the raw token (given to the caller once) and the entry to persist, keyed by sha256(token).