Encode & Hash Chain: document what each step actually does

Base64 and URL encoding before SHA-256 do not encrypt the input; they only change the exact bytes being hashed. Define a canonical input encoding and operation order, because semantically identical values can otherwise produce different digests. Store the algorithm and pipeline version with the output. A digest verifies integrity only when the expected digest comes from a trusted channel. Use a MAC or signature for authenticity, and authenticated encryption when the original value must remain secret.