fn random_token() -> String
256 bits from the OS, hex-encoded. Not a password and never stored anywhere but this process’s memory, so there is nothing to hash.