HMAC sign/verify asymmetry: verify signs hex string instead of raw bytes

verify_token() signed the hex-encoded payload string (payload_hex.encode()) instead of the original raw JSON bytes. create_token() signs raw JSON bytes. The two HMAC inputs never match, so all valid tokens are rejected.