fix: WebSocket unwrap panic and use OsRng for crypto (#128, #130)

[0xMuang]

Summary

• [Bug] Unwrap in WebSocket subscription handlers can crash service #128: Replace .unwrap() with proper error handling in WebSocket subscription handlers
• [Crypto] Use explicit OsRng for IV and salt generation #130: Use OsRng instead of thread_rng() for cryptographic IV/salt generation

Changes

pubsub.rs (Issue #128)

Replaced 5 occurrences of panic-prone code:

// Before (can panic)
sink.send(jsonrpsee::SubscriptionMessage::from_json(&msg).unwrap()).await

// After (graceful error handling)
let Ok(sub_msg) = jsonrpsee::SubscriptionMessage::from_json(&msg) else {
    warn!("Failed to serialize message for subscription {}", sub_id);
    continue;
};
sink.send(sub_msg).await

cipher.rs & kdf.rs (Issue #130)

Changed random number generator for cryptographic operations:

// Before
rand::thread_rng().fill_bytes(&mut data);

// After
OsRng.fill_bytes(&mut data);

OsRng directly uses the operating system's cryptographically secure random number generator, which is the recommended practice for generating cryptographic material like IVs and salts.

Test Plan

• cargo check passes

Closes #128
Closes #130