pub fn signature_hash(template: &str) -> String
Compute a stable SHA-256 hex digest of a normalized template.