pub fn tokens_equal(a: &str, b: &str) -> bool
Constant-time byte comparison for static-bearer matching (prevents timing-based prefix leakage).