SHA-256 hash of a raw token, base64url-encoded — only the hash is ever
persisted. base64url (43 chars) is shorter than hex (64 chars), URL-safe, and
carries the full 256 bits. Both write (CreateInvite) and read (RedeemInvite)
paths call this, so the encoding stays internally consistent.
SHA-256 hash of a raw token, base64url-encoded — only the hash is ever persisted. base64url (43 chars) is shorter than hex (64 chars), URL-safe, and carries the full 256 bits. Both write (CreateInvite) and read (RedeemInvite) paths call this, so the encoding stays internally consistent.