Function load_persistent_secret 

pub(crate) fn load_persistent_secret(
    secret_override: Option<String>,
) -> Result<Key>

Load the persistent cookie/token secret, generating and saving a fresh one if none exists.

This secret signs both the session cookies and the self-expiring access tokens, so it must be loaded once and shared between braid_types::start_listener (which mints Braid’s token) and the auth layer that validates it. A stable secret across restarts is what keeps already-issued browser cookies — and Braid’s persisted per-camera cookie jar — valid through an upgrade.