Generate an HMAC-SHA256 hex digest from a message and secret key—common for API signatures and webhooks.