BEARER_ HMAC_ KEY
Salt-like constant prefixed into the bearer-token HMAC.
The literal "krill-api-pbkdf2-v1" is deliberately versioned: a future scheme rotation can ship "krill-api-pbkdf2-v2" and the server can accept both during a migration window. Do not change this value — every Krill-deployed bearer token currently in use was derived from it.