pub(crate) fn challenge(verifier: &str) -> String
PKCE’s challenge for a verifier: SHA-256, as URL-safe base64 without padding (S256).