pub fn generate_token() -> (String, Vec<u8>)
Generate a fresh 32-byte random token and return both the raw bytes (to be base64-encoded into the link) and the SHA-256 hash (to be stored in the DB).