Site tokens and where they are stored

Each registered install gets a 48-character token, sent on every call as the X-K2S-Token header.

The hub stores only a SHA-256 hash of it. The raw token is returned once, at registration, and cannot be retrieved afterwards — if a site loses it, it re-registers and gets a new one.

Re-registering the same URL rotates the token. It never downgrades a site that is already active.