A retail company processes millions of loyalty transactions per hour and must protect customer national ID numbers. The architecture team requires that the sensitive values be replaced with surrogate tokens usable in analytics joins, but the solution must scale horizontally without a centralized data store that could become a performance bottleneck or single point of failure. Reversibility must still be supported for authorized fraud investigations. Which tokenization approach best meets these requirements?