SHA-256 hex digest of the full API token string. Never store the plaintext secret.