fix(web): fall back to getRandomValues when crypto.randomUUID is unavailable

[junmo-kim]

Problem

The web UI uses crypto.randomUUID() in five places (attachment adapter,
message local IDs, toast IDs, file attachment metadata, terminal IDs).
crypto.randomUUID is only defined in secure contexts — HTTPS, or the
special-cased http://localhost / http://127.0.0.1.

When the web app is opened over HTTP from a LAN IP (a common dev /
home-network setup — e.g. http://192.168.x.x:3006), crypto.randomUUID
is undefined. The first place this surfaces is the attachment flow:

TypeError: crypto.randomUUID is not a function
    at attachmentAdapter.add
    at addAttachment (assistant-ui)
    at ComposerAddAttachment.onchange

assistant-ui's ComposerPrimitive.AddAttachment swallows the rejection,
so from the user's side "pick a file" silently does nothing — no chip, no
upload request, no error indicator. Mobile browsers that go through the
HTTPS tunnel aren't affected.

Solution

Add a small web/src/lib/randomId.ts helper and call it everywhere the
web currently calls crypto.randomUUID() directly:

1. If crypto.randomUUID is available, use it (unchanged behavior for
   HTTPS and localhost).
2. Otherwise, use crypto.getRandomValues() to produce an RFC 4122 v4
   UUID string — same format and character set, so existing consumers
   (DB columns, SSE payloads, RPC params) see identical values.
3. If neither is available (very old environments), fall back to a
   Date.now()-based string.

Only the web package is changed. CLI / hub / shared still use
crypto.randomUUID() directly — Node has no secure-context concept there.

Tests

• bun typecheck passes.
• bun run test (web): 170 tests pass, including new
  randomId.test.ts covering all three branches.
• Manual verification on http://<LAN-IP>:<port>/ (not localhost):
  • Before: console TypeError: crypto.randomUUID is not a function,
    no attachment chip after picking a file.
  • After: chip appears, no console error, upload proceeds normally.

[github-actions]

Review mode: initial

Findings

• No issues identified in the modified lines.

Summary

• No blocking correctness, security, or regression issues found in the latest diff.
• Residual risk/testing gap: direct unit coverage was added for web/src/lib/randomId.test.ts; Not found in repo/docs: direct tests for the updated attachment, toast, or terminal ID-generation paths. I also could not run bun in this runner (bun: command not found).

Testing

• Not run (automation environment missing bun)

HAPI Bot