HKDF extract-then-expand (RFC 5869) — derive output keying material from initial keying material, an optional salt, and an optional info/context string. Useful for deriving multiple keys from a single shared secret. Returns hex-encoded OKM.