pub fn generate_session_id() -> String
Generate a cryptographically random session ID (32 bytes, base64url-encoded).