Function pkce_code_verifier 

pub fn pkce_code_verifier(seed: &[u8; 32]) -> String

Generate a PKCE code verifier (43..=128 random ASCII characters per RFC 7636 section 4.1). Returns the verifier; the challenge is base64url(sha256(verifier)) (S256 method). The verifier MUST be sent in the token exchange; the challenge is sent in the authorization request. Uses a caller-provided 32-byte random seed (the gateway does not pull in a crypto RNG crate; tests pass a fixed seed for determinism, production callers use the OS RNG).