pub fn generate_salt() -> String
Generate a random salt string for Argon2id key derivation.
A base64-encoded salt string suitable for derive_encryption_key.
derive_encryption_key