fix: blank page on non-localhost HTTP (secure-context crypto.randomUUID)

crypto.randomUUID() is secure-context-only — undefined on plain-HTTP
non-localhost origins (e.g. http://PII_REDACTED_DEVICE_01:24204), so createAppStore threw
during mount and nothing rendered. Add src/app/uuid.ts randomId(): prefer
crypto.randomUUID when present, else build a v4 from crypto.getRandomValues
(available in insecure contexts), else Math.random fallback. Use it for the
conversation id.

Verified: svelte-check 0/0, vitest 221, build ok.

1 files changed, 31 insertions, 0 deletions

diff --git a/src/app/uuid.test.ts b/src/app/uuid.test.ts
new file mode 100644
index 0000000..bd8e306
--- /dev/null
+++ b/src/app/uuid.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+import { randomId } from "./uuid";
+
+const V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+describe("randomId", () => {
+	it("returns a v4-shaped uuid", () => {
+		const id = randomId();
+		expect(id).toMatch(V4_RE);
+	});
+
+	it("returns distinct values across calls", () => {
+		const ids = new Set<string>();
+		for (let i = 0; i < 200; i++) {
+			ids.add(randomId());
+		}
+		expect(ids.size).toBe(200);
+	});
+
+	it("works without crypto.randomUUID (getRandomValues branch)", () => {
+		const origRandomUUID = crypto.randomUUID;
+		try {
+			// Remove randomUUID so the getRandomValues branch is taken
+			delete (crypto as { randomUUID?: () => string }).randomUUID;
+			const id = randomId();
+			expect(id).toMatch(V4_RE);
+		} finally {
+			crypto.randomUUID = origRandomUUID;
+		}
+	});
+});