fix(security): fallback to crypto.getRandomValues for idempotency keys on insecure origins

[dezzy-music]

Summary

Fixes #706.

In non-secure contexts (such as plain-HTTP staging or preview deployments), crypto.randomUUID is not available (only exposed when isSecureContext is true). The previous fallback immediately degraded to Math.random(), creating predictable, collision-prone idempotency keys.

Changes

• Fall back to crypto.getRandomValues (which is accessible in non-secure contexts) when crypto.randomUUID is absent.
• Formats the 16 random bytes as a compliant RFC 4122 v4 UUID with appropriate version (0x40) and variant (0x80) bits.
• Retains defensive fallback to pseudo-random string for environments without Web Crypto API.
• Added tests in utils.test.ts simulating insecure environments without crypto.randomUUID.

Verification

• Ran Jest: 95/95 tests pass in src/lib/utils.test.ts.
• Ran ESLint: 0 errors.

[vercel]

@dezzy-music is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.