/demo/contact)用 appSecret 签名调用 POST /open/v1/visitor/tokenh5Url,App 用 WebView 打开(这里用 iframe 模拟)String body = "{\"userId\":\"u1001\",\"nickname\":\"张三\"}";
String ts = String.valueOf(System.currentTimeMillis());
String nonce = UUID.randomUUID().toString();
String toSign = String.join("\n", appId, ts, nonce, "POST", "/open/v1/visitor/token", body);
String sign = HexFormat.of().formatHex(hmacSha256(appSecret, toSign));
// Header: X-App-Id / X-Timestamp / X-Nonce / X-Sign