Function fingerprint 

fn fingerprint(secret: &str) -> String

Non-reversible fingerprint of a secret, for round-to-round diffing only.

FNV-1a over the bytes, low 32 bits as 8 hex chars. Deterministic across process restarts (unlike DefaultHasher), so fingerprints stay comparable even if the srv bounces mid-run. 32 bits of a hash of a ~100-char high-entropy token is not a meaningful disclosure — but keep it a fingerprint, never widen it toward the raw value.