pub fn generate_pepper() -> Result<[u8; 32], String>
Generate a fresh 32-byte pepper from the OS CSPRNG.