Hash bearer tokens at rest

Store OAuth access and refresh tokens as SHA-256 digests instead of plaintext, decoupling document names from tokens and adding index coverage for lookup.