OpaqueTokenLookup

Resolves a raw opaque token to its stored OpaqueTokenDetails, carrying the caller's own identity.

Returns the stored OpaqueTokenDetails (identity, optional expiry, and roles), or null when the token is unknown or revoked. Must return null for unknown tokens rather than throw. Storage and comparison — including hashing and constant-time equality — are the caller's responsibility. Register via the opaqueToken { } block (lookup).