fn sha256_hex(bytes: &[u8]) -> String
Returns a lowercase SHA-256 digest without an external encoder.