CheckPasswordHash compares a plain text password with a hashed password.

GetAPIKey extracts the API key from the Authorization header.

HashPassword takes a plain text password and returns a hashed version.

MakeRefreshToken generates a secure random 256-bit (32-byte) hex-encoded string.